diff --git a/README.md b/README.md
index b6c6f1e..9a11e04 100644
--- a/README.md
+++ b/README.md
@@ -32,6 +32,51 @@ viewer without wrestling dated IDEs or registry quirks.
 
 ### Installation
 
+Every route gives you a self-contained app with `.cbz`/`.cbr` double-click
+support and no Python installation to manage.
+
+| Platform | Install |
+| --- | --- |
+| macOS (Apple silicon) | `brew install --cask cdisplayagain` (see below for the two setup lines) |
+| Linux (x86-64) | Download the release archive, run `./install.sh` |
+| Anything else | Build from source with `make install` |
+
+#### macOS via Homebrew
+
+```bash
+brew tap JoshCLWren/tap
+brew trust joshclwren/tap
+brew install --cask cdisplayagain
+```
+
+Homebrew refuses to load casks from a third-party tap until you trust it, which
+is what the middle line does. It is a one-time decision per machine, and you can
+scope it to this cask alone with
+`brew trust --cask joshclwren/tap/cdisplayagain`.
+
+Then open any comic:
+
+```bash
+open ~/Comics/issue.cbz
+```
+
+Or double-click a `.cbz`/`.cbr` in Finder, which works because the installer
+registers the app as their default handler.
+
+Upgrade and removal are the usual Homebrew verbs:
+
+```bash
+brew upgrade --cask cdisplayagain
+brew uninstall --cask cdisplayagain
+```
+
+The cask ships the Apple silicon build the release workflow publishes. It is
+ad-hoc signed rather than notarized, since notarization requires a paid Apple
+Developer account, so Homebrew's quarantine flag is cleared during install; the
+[tap README](https://github.com/JoshCLWren/homebrew-tap) explains how to handle
+that yourself instead. Intel Macs have no published asset and should build from
+source, which sidesteps quarantine entirely.
+
 #### Linux release (Linux x86-64)
 
 Download the latest Linux release archive from GitHub. No Python installation
@@ -49,9 +94,8 @@ data directory. Uninstall with `./install.sh --uninstall` from the extracted
 release directory. `PREFIX`, `HOME`, and `XDG_DATA_HOME` can override these
 locations for testing or custom user-local layouts.
 
-Only Linux x86-64 release downloads are currently provided. Packaged Windows
-and macOS releases are not yet available; macOS users build the app locally
-with `make build && make install` (see below).
+Linux downloads are x86-64 only. macOS is published as an Apple silicon app
+bundle (see above); Windows has no packaged release yet.
 
 Release builds are produced in Ubuntu 22.04 (glibc 2.35), the oldest verified
 distribution baseline, and compatibility checks run the same archive on
@@ -63,22 +107,6 @@ bundle includes its Python, Pillow, pyvips/libvips, unrar, and Tk runtime
 components; it requires a glibc-based Linux x86-64 system with the usual X11
 libraries. Alpine Linux and musl-based systems are unsupported.
 
-#### macOS via Homebrew
-
-```bash
-brew tap JoshCLWren/tap
-brew install --cask cdisplayagain
-```
-
-The cask installs the same notarization-free bundle the release workflow
-publishes for Apple silicon. Intel Macs get no release asset; build from source
-with `make install` instead. Because the app is ad-hoc signed rather than
-notarized, and Homebrew quarantines every cask download, the cask clears the
-quarantine flag on install. See the
-[tap README](https://github.com/JoshCLWren/homebrew-tap) if you would rather
-handle that yourself with `--no-quarantine`. Building from source avoids the
-question entirely, since a locally built app is never quarantined.
-
 #### macOS app bundle (build from source)
 
 Build a real `cdisplayagain.app` from a clone and install it, so `.cbz`/`.cbr`
diff --git a/scripts/update-cask.sh b/scripts/update-cask.sh
index 3f4f939..f58d430 100755
--- a/scripts/update-cask.sh
+++ b/scripts/update-cask.sh
@@ -57,18 +57,44 @@ cask "cdisplayagain" do
 
   # Only Apple silicon builds are published; Intel users build from source.
   depends_on arch: :arm64
-  depends_on macos: ">= :big_sur"
+  depends_on macos: :big_sur
+  # duti sets the default handlers below; without it a cask install would do
+  # strictly less than scripts/install-macos.sh and .cbz would not open on
+  # double-click for anyone whose Launch Services database already has a claim.
+  depends_on formula: "duti"
 
   # package-macos.sh zips a versioned parent directory holding the bundle
   # alongside install.sh and the license, so the app is one level down.
   app "cdisplayagain-#{version}-macos-arm64/cdisplayagain.app"
 
-  # The app is ad-hoc signed rather than notarized, so Gatekeeper blocks the
-  # quarantined copy Homebrew downloads until the flag is cleared.
   postflight do
+    installed = "#{appdir}/cdisplayagain.app"
+
+    # The app is ad-hoc signed rather than notarized, so Gatekeeper blocks the
+    # quarantined copy Homebrew downloads until the flag is cleared.
     system_command "/usr/bin/xattr",
-                   args: ["-dr", "com.apple.quarantine", "#{appdir}/cdisplayagain.app"],
-                   sudo: false
+                   args: ["-dr", "com.apple.quarantine", installed],
+                   sudo: false,
+                   must_succeed: false
+
+    launch_services = "/System/Library/Frameworks/CoreServices.framework/Versions/A" +
+                      "/Frameworks/LaunchServices.framework/Versions/A/Support"
+    system_command "#{launch_services}/lsregister",
+                   args: ["-f", installed],
+                   sudo: false,
+                   must_succeed: false
+
+    ["cbz", "cbr", "cbt", "cba"].each do |extension|
+      system_command "#{HOMEBREW_PREFIX}/bin/duti",
+                     args: ["-s", "io.github.joshclwren.cdisplayagain", extension, "all"],
+                     sudo: false,
+                     must_succeed: false
+    end
+
+    # Finder caches an icon against the bundle path and mtime, so a fresh
+    # install over a previous one otherwise keeps showing the stale icon.
+    system_command "/usr/bin/touch", args: [installed], sudo: false, must_succeed: false
+    system_command "/usr/bin/killall", args: ["Finder"], sudo: false, must_succeed: false
   end
 
   zap trash: [