diff --git a/README.md b/README.md
index 144165c..e9cb412 100644
--- a/README.md
+++ b/README.md
@@ -86,6 +86,9 @@ curl -sSfL https://raw.githubusercontent.com/bootintel/cli/main/packaging/script
 # Windows (PowerShell, x86_64):
 iwr -useb https://raw.githubusercontent.com/bootintel/cli/main/packaging/scripts/install.ps1 | iex
 
+# Homebrew (Linux + macOS):
+brew tap bootintel/tap && brew install bootintel
+
 # Docker:
 docker run --rm -i ghcr.io/bootintel/cli:latest scan - < boot.log
 
@@ -113,7 +116,7 @@ cargo install --path crates/cli --features tui
 
 Pin to a release tag (`@cli-v0.4.0`) or a commit SHA — **never `@main`** (a compromised `main` would execute arbitrary shell in every consumer's pipeline).
 
-**Homebrew:** the formula template lives at `packaging/homebrew/bootintel.rb`. A public `bootintel/homebrew-tap` for `brew install bootintel` is planned.
+**Homebrew:** `brew tap bootintel/tap && brew install bootintel`. The tap lives at [BootIntel/homebrew-tap](https://github.com/BootIntel/homebrew-tap) and installs the published release binary, verified against the SHA-256 the release workflow publishes. `packaging/homebrew/bootintel.rb` in this repo is the template the tap's formula is generated from; the tap is the one that ships.
 
 **crates.io:** `cargo install bootintel` installs the latest published release. It builds from source, so it needs a Rust toolchain and takes a few minutes; the one-liner above drops a prebuilt binary in seconds. See [docs/releasing.md](docs/releasing.md) for how releases are cut.
 
diff --git a/packaging/homebrew/bootintel.rb b/packaging/homebrew/bootintel.rb
index 29db28d..3c51104 100644
--- a/packaging/homebrew/bootintel.rb
+++ b/packaging/homebrew/bootintel.rb
@@ -1,23 +1,22 @@
-# Homebrew formula for bootintel-cli.
+# Template for the formula published at BootIntel/homebrew-tap.
 #
-# In-repo only — not published to any tap yet. To use today,
-# copy this file into your own tap:
+# The tap is what users install from:
 #
-#   brew tap-new <you>/bootintel
-#   cp bootintel.rb $(brew --repo <you>/bootintel)/Formula/
-#   brew install <you>/bootintel/bootintel
+#   brew tap bootintel/tap
+#   brew install bootintel
 #
-# Once the first public release is cut, a `bootintel/homebrew-tap`
-# repo will provide `brew tap bootintel/tap; brew install bootintel`.
+# This file is the reference copy. When cutting a release, update the tap's
+# Formula/bootintel.rb with the new version and all four sha256 values from
+# that release's SHA256SUMS artifact. A stale formula is worse than a missing
+# one: it installs an old binary while appearing to work.
 #
-# Formula uses the release tarballs from GitHub Releases directly.
-# Regenerate the sha256 values on every version bump: run the
-# release workflow, then paste values from SHA256SUMS into this file.
+# The version and checksums below track the latest release but are NOT what
+# users get; the tap is. Verify the tap after every release.
 
 class Bootintel < Formula
   desc "Interactive UART capture + streaming boot-log analysis"
   homepage "https://bootintel.com"
-  version "0.3.1"
+  version "0.5.0"
   license "Apache-2.0"
 
   # SHA256s pulled from the SHA256SUMS artifact of the v0.3.1
@@ -25,22 +24,22 @@ class Bootintel < Formula
   on_macos do
     on_arm do
       url "https://github.com/bootintel/cli/releases/download/cli-v#{version}/bootintel-v#{version}-aarch64-macos.tar.gz"
-      sha256 "469133f56a72a54fa865ad8b39e62a7b82c490244aa18e6a19f4fb0b58f23ba1"
+      sha256 "3863ee56f86b43a1fd4f131d9e484713ebcb1550bece5ad7c2ee4de2c3ca77ce"
     end
     on_intel do
       url "https://github.com/bootintel/cli/releases/download/cli-v#{version}/bootintel-v#{version}-x86_64-macos.tar.gz"
-      sha256 "984134978e995003c672c2aa0d370e968ddb2855f697166fbc132805b2afb376"
+      sha256 "55cfe10f276b47e8843a670ba349c0add1f091e842a190fdd07229b646425c44"
     end
   end
 
   on_linux do
     on_arm do
       url "https://github.com/bootintel/cli/releases/download/cli-v#{version}/bootintel-v#{version}-aarch64-linux.tar.gz"
-      sha256 "62ea0fd1b537c193fbc4f6874b960854e10e2f27f4f94c163ac8d19afdb2996c"
+      sha256 "0f91ffde24100bc8456aef39bda9493ba677d81b1589b2d59833be10d62ea4be"
     end
     on_intel do
       url "https://github.com/bootintel/cli/releases/download/cli-v#{version}/bootintel-v#{version}-x86_64-linux.tar.gz"
-      sha256 "6c7a7e401d6691afab53bee5522a604f02777d269cea85357275cd40ee4b54e9"
+      sha256 "1a2dc10499c8db658a698d45e47789b964843d806a0b5f7f51e439c1e05586ed"
     end
   end