diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c2a0351..b5228a2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -109,7 +109,7 @@ jobs:
             -e "s/sha256 \"[^\"]*\"/sha256 \"${SHA256}\"/" \
             Casks/heard.rb
 
-      # Push the cask update back to master. The release commit is already at master HEAD
+      # Push the cask update back to main. The release commit is already at main HEAD
       # (release.sh pushed it before the tag), so this is always a fast-forward.
       # [skip ci] prevents this commit from re-triggering the workflow.
       - name: Commit and push cask update
@@ -121,7 +121,7 @@ jobs:
           git add Casks/heard.rb
           git commit -m "Update Homebrew cask to v${{ steps.meta.outputs.version }} [skip ci]"
           git remote set-url origin "https://execsumo:${GH_PAT}@github.com/execsumo/Heard.git"
-          git push origin HEAD:refs/heads/master
+          git push origin HEAD:refs/heads/main
 
       # Clone the Homebrew tap repo, copy the updated cask, and push so that
       # `brew upgrade --cask heard` picks up the new version automatically.
@@ -138,4 +138,4 @@ jobs:
           git config user.email "github-actions[bot]@users.noreply.github.com"
           git add Casks/heard.rb
           git commit -m "Update heard to v${VERSION}"
-          git push origin HEAD:refs/heads/master
+          git push origin HEAD:refs/heads/main
diff --git a/.github/workflows/update-tap.yml b/.github/workflows/update-tap.yml
new file mode 100644
index 0000000..c8a247c
--- /dev/null
+++ b/.github/workflows/update-tap.yml
@@ -0,0 +1,44 @@
+name: Update Homebrew Tap
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version to publish (e.g. 0.2.2)'
+        required: true
+        default: '0.2.2'
+      sha256:
+        description: 'SHA256 of the release DMG'
+        required: true
+        default: '65a620aa747a55121c4d82cfeab598bfc5f0796c4f402cebed7b91a0c6f906b3'
+
+jobs:
+  update-tap:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Update local cask
+        run: |
+          VERSION="${{ inputs.version }}"
+          SHA256="${{ inputs.sha256 }}"
+          sed -i \
+            -e "s/version \"[^\"]*\"/version \"${VERSION}\"/" \
+            -e "s/sha256 \"[^\"]*\"/sha256 \"${SHA256}\"/" \
+            Casks/heard.rb
+
+      - name: Push cask to Homebrew tap
+        env:
+          GH_PAT: ${{ secrets.GH_PAT }}
+        run: |
+          VERSION="${{ inputs.version }}"
+          git clone "https://execsumo:${GH_PAT}@github.com/execsumo/homebrew-heard.git" homebrew-tap
+          mkdir -p homebrew-tap/Casks
+          cp Casks/heard.rb homebrew-tap/Casks/heard.rb
+          cd homebrew-tap
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add Casks/heard.rb
+          git diff --cached --quiet && echo "No changes" && exit 0
+          git commit -m "Update heard to v${VERSION}"
+          git push origin HEAD:refs/heads/main
diff --git a/CLAUDE.md b/CLAUDE.md
index 90ea822..e1d9f0e 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -29,7 +29,7 @@ No Xcode project — this is a Swift Package Manager executable. macOS 15.0+ req
 - `Heard.entitlements` — Entitlements (audio input only, no sandbox)
 - `scripts/bundle.sh` — Build script for .app bundle
 - `scripts/dmg.sh` — Distribution pipeline: release build → sign → notarize → staple → DMG → SHA256 (called by CI, not directly)
-- `scripts/release.sh` — **Use this to ship a release.** Bumps `Info.plist` version, commits, tags `v<version>`, and pushes — triggering the CI release pipeline. Usage: `./scripts/release.sh 0.3.0`. Requires being on `master` with a clean tree. Notarization in CI needs `APPLE_ID`, `APPLE_APP_PASSWORD`, `APPLE_TEAM_ID` secrets set in GitHub Actions.
+- `scripts/release.sh` — **Use this to ship a release.** Bumps `Info.plist` version, commits, tags `v<version>`, and pushes — triggering the CI release pipeline. Usage: `./scripts/release.sh 0.3.0`. Requires being on `main` with a clean tree. Notarization in CI needs `APPLE_ID`, `APPLE_APP_PASSWORD`, `APPLE_TEAM_ID` secrets set in GitHub Actions.
 - `.github/workflows/ci.yml` — CI: build + test on all pushes; release bundle + GitHub Release upload on tag push
 
 ## Working Rules
diff --git a/scripts/release.sh b/scripts/release.sh
index c253f02..f9f54f8 100755
--- a/scripts/release.sh
+++ b/scripts/release.sh
@@ -21,10 +21,10 @@ if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
     exit 1
 fi
 
-# Preflight: must be on master
+# Preflight: must be on main
 BRANCH=$(git rev-parse --abbrev-ref HEAD)
-if [[ "$BRANCH" != "master" ]]; then
-    echo "ERROR: Must be on master branch (currently on '$BRANCH')"
+if [[ "$BRANCH" != "main" ]]; then
+    echo "ERROR: Must be on main branch (currently on '$BRANCH')"
     exit 1
 fi
 
@@ -78,7 +78,7 @@ git commit -m "Release v${VERSION}"
 git tag "v${VERSION}"
 
 echo "==> Pushing commit and tag to origin..."
-git push origin master
+git push origin main
 git push origin "v${VERSION}"
 
 echo ""