diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8a12335..5e51f7e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -60,6 +60,10 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # PAT with write access to the Homebrew tap + Scoop bucket repos.
           TAP_GITHUB_TOKEN: ${{ secrets.TAP_GITHUB_TOKEN }}
+          # Write deploy keys on simtabi/homebrew-tap and simtabi/scoop-bucket. When set, GoReleaser
+          # pushes with them and the token is not used for those two.
+          HOMEBREW_TAP_DEPLOY_KEY: ${{ secrets.HOMEBREW_TAP_DEPLOY_KEY }}
+          SCOOP_BUCKET_DEPLOY_KEY: ${{ secrets.SCOOP_BUCKET_DEPLOY_KEY }}
       # Sign a build-provenance attestation for every released artifact. The
       # checksums file lists them all, so `gh attestation verify <file>
       # --repo simtabi/probaci` works for any downloaded binary or archive.
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 6ab3b3e..578bb2d 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -146,6 +146,12 @@ homebrew_casks:
       # Cross-repo tap push needs a PAT (the default GITHUB_TOKEN is scoped to
       # this repo). Set the TAP_GITHUB_TOKEN secret before releasing.
       token: "{{ .Env.TAP_GITHUB_TOKEN }}"
+      # Write deploy key on simtabi/homebrew-tap (secret HOMEBREW_TAP_DEPLOY_KEY): reaches that
+      # one repository only. Set, git pushes with it; unset, the URL is empty and the token
+      # path above runs. Measured with GoReleaser 2.18.3.
+      git:
+        url: '{{ if envOrDefault "HOMEBREW_TAP_DEPLOY_KEY" "" }}git@github.com:simtabi/homebrew-tap.git{{ end }}'
+        private_key: '{{ envOrDefault "HOMEBREW_TAP_DEPLOY_KEY" "" }}'
     commit_author:
       name: Imani Manyara
       email: imanimanyara@users.noreply.github.com
@@ -170,6 +176,12 @@ scoops:
       name: scoop-bucket
       branch: main
       token: "{{ .Env.TAP_GITHUB_TOKEN }}"
+      # Write deploy key on simtabi/scoop-bucket (secret SCOOP_BUCKET_DEPLOY_KEY): reaches that
+      # one repository only. Set, git pushes with it; unset, the URL is empty and the token
+      # path above runs. Measured with GoReleaser 2.18.3.
+      git:
+        url: '{{ if envOrDefault "SCOOP_BUCKET_DEPLOY_KEY" "" }}git@github.com:simtabi/scoop-bucket.git{{ end }}'
+        private_key: '{{ envOrDefault "SCOOP_BUCKET_DEPLOY_KEY" "" }}'
     commit_author:
       name: Imani Manyara
       email: imanimanyara@users.noreply.github.com
diff --git a/docs/release.md b/docs/release.md
index a40a7ca..30b5a5e 100644
--- a/docs/release.md
+++ b/docs/release.md
@@ -66,7 +66,8 @@ Pure Go, `CGO_ENABLED=0`.
 1. Make the repo public on GitHub.
 2. Create the `pypi`/`npm`-equivalent here: a GitHub Release flow via OIDC (no
    long-lived registry credentials).
-3. Add `TAP_GITHUB_TOKEN` (Homebrew tap) and any registry tokens as needed.
+3. Add the write deploy keys `HOMEBREW_TAP_DEPLOY_KEY` (on `simtabi/homebrew-tap`) and `SCOOP_BUCKET_DEPLOY_KEY` (on `simtabi/scoop-bucket`), each a repository secret that reaches its one repository and nothing else (`TAP_GITHUB_TOKEN` is only a fallback, and the
+   Winget pull request's token), plus any registry tokens as needed.
 4. Cut `v0.1.0`.
 
 The full org-wide gate is `/opensource/shipping-checklist.md` (local; not in any