diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 902b111..c874c49 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,7 +24,10 @@ name: Release
 #
 # The cask bump runs only after the draft release is PUBLISHED (the GitHub
 # releases/tags API does not serve drafts), so it is wired to the `release:
-# published` event rather than the tag push. It also needs HOMEBREW_TAP_TOKEN.
+# published` event rather than the tag push. It pushes with a write-enabled
+# deploy key scoped to ONLY the tap repo (HOMEBREW_TAP_DEPLOY_KEY), so no
+# broad personal access token is stored — the default GITHUB_TOKEN cannot
+# push to a different repository.
 
 on:
   push:
@@ -421,9 +424,10 @@ jobs:
   # render Casks/gridline.rb from the template, and push it. Users then get
   # the new version via `brew upgrade --cask gridline`.
   #
-  # Requires the HOMEBREW_TAP_TOKEN secret (a PAT with `repo` scope on the tap
-  # repo — the default GITHUB_TOKEN cannot push to a different repo). The job
-  # no-ops until that secret is set, so releases stay green before this is
+  # Requires the HOMEBREW_TAP_DEPLOY_KEY secret — a write-enabled SSH deploy
+  # key on the tap repo (the default GITHUB_TOKEN cannot push to a different
+  # repository, and a deploy key avoids storing a broad PAT). The job skips
+  # cleanly until that secret is set, so releases stay green before this is
   # configured.
   bump-cask:
     # Triggered by `release: published`, NOT the tag push: the GitHub
@@ -434,15 +438,15 @@ jobs:
     permissions:
       contents: read
     steps:
-      - name: Check for tap token
+      - name: Check for tap deploy key
         id: tap
         shell: bash
         run: |
-          if [ -n "${{ secrets.HOMEBREW_TAP_TOKEN }}" ]; then
+          if [ -n "${{ secrets.HOMEBREW_TAP_DEPLOY_KEY }}" ]; then
             echo "enabled=true" >> "$GITHUB_OUTPUT"
           else
             echo "enabled=false" >> "$GITHUB_OUTPUT"
-            echo "::notice::HOMEBREW_TAP_TOKEN not set - skipping Homebrew cask bump."
+            echo "::notice::HOMEBREW_TAP_DEPLOY_KEY not set - skipping Homebrew cask bump."
           fi
 
       - name: Checkout
@@ -467,7 +471,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           repository: AdrianBonpin/homebrew-gridline
-          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
+          ssh-key: ${{ secrets.HOMEBREW_TAP_DEPLOY_KEY }}
           path: tap
 
       - name: Render and push cask
diff --git a/README.md b/README.md
index 7474c0a..a7d56a0 100644
--- a/README.md
+++ b/README.md
@@ -367,7 +367,7 @@ git tag v0.7.15
 git push origin v0.7.15
 ```
 
-GitHub Actions (`.github/workflows/release.yml`) builds the **macOS (Apple Silicon + Intel), Windows, and Linux** installers in parallel and opens a **draft release** on the [Releases](https://github.com/AdrianBonpin/gridline/releases) page. Review the draft and hit **Publish release** — publishing triggers a follow-up job that bumps the Homebrew cask in [`AdrianBonpin/homebrew-gridline`](https://github.com/AdrianBonpin/homebrew-gridline) (requires the `HOMEBREW_TAP_TOKEN` secret; skipped when unset).
+GitHub Actions (`.github/workflows/release.yml`) builds the **macOS (Apple Silicon + Intel), Windows, and Linux** installers in parallel and opens a **draft release** on the [Releases](https://github.com/AdrianBonpin/gridline/releases) page. Review the draft and hit **Publish release** — publishing triggers a follow-up job that bumps the Homebrew cask in [`AdrianBonpin/homebrew-gridline`](https://github.com/AdrianBonpin/homebrew-gridline) (pushed via a write-enabled deploy key on the tap, `HOMEBREW_TAP_DEPLOY_KEY`; skipped when unset).
 
 The self-hosted Gitea mirror (`.gitea/workflows/release.yml`) still builds Linux and Windows for the Gitea release, and `scripts/release-mac.sh` can build macOS locally — both are kept as a fallback if GitHub is unavailable.