diff --git a/.github/workflows/bump-homebrew.yml b/.github/workflows/bump-homebrew.yml
new file mode 100644
index 0000000..f97f4ed
--- /dev/null
+++ b/.github/workflows/bump-homebrew.yml
@@ -0,0 +1,97 @@
+name: Bump Homebrew formula
+
+# Keeps tambo-labs/homebrew-tap's charming.rb pointed at the latest
+# published npm tarball. Triggers off this repo's own GitHub Release
+# (created by release.yml), so it only ever points at a version that
+# already published successfully.
+#
+# Uses HOMEBREW_TAP_TOKEN, a fine-grained PAT scoped to just
+# tambo-labs/homebrew-tap with Contents: read/write — not the
+# CLI_SYNC_APP_ID app used elsewhere in this repo, since that app was
+# never actually installed (see sync-openapi.yml, which has been
+# disabled and has never run).
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Version to bump the formula to (no leading v, e.g. 0.1.2)
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  bump:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Resolve version
+        id: version
+        run: |
+          version="${{ inputs.version }}"
+          if [ -z "$version" ]; then
+            version="${GITHUB_REF_NAME#v}"
+          fi
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+      - name: Download tarball and compute sha256
+        id: tarball
+        run: |
+          version="${{ steps.version.outputs.version }}"
+          url="https://registry.npmjs.org/usecharming/-/usecharming-${version}.tgz"
+          curl -sL -o package.tgz "$url"
+          sha256=$(shasum -a 256 package.tgz | cut -d' ' -f1)
+          echo "url=$url" >> "$GITHUB_OUTPUT"
+          echo "sha256=$sha256" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: tambo-labs/homebrew-tap
+          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
+          path: homebrew-tap
+
+      - name: Update formula
+        working-directory: homebrew-tap
+        run: |
+          version="${{ steps.version.outputs.version }}"
+          url="${{ steps.tarball.outputs.url }}"
+          sha256="${{ steps.tarball.outputs.sha256 }}"
+          sed -i "s#^  url \".*\"#  url \"${url}\"#" Formula/charming.rb
+          sed -i "s#^  sha256 \".*\"#  sha256 \"${sha256}\"#" Formula/charming.rb
+          if git diff --quiet; then
+            echo "changed=false" >> "$GITHUB_ENV"
+          else
+            echo "changed=true" >> "$GITHUB_ENV"
+          fi
+
+      - if: env.changed == 'true'
+        name: Commit and push
+        working-directory: homebrew-tap
+        run: |
+          version="${{ steps.version.outputs.version }}"
+          git config user.name "charming-cli-release[bot]"
+          git config user.email "charming-cli-release[bot]@users.noreply.github.com"
+          git switch -C "bump/charming-${version}"
+          git add Formula/charming.rb
+          git commit -m "charming ${version}"
+          git push --force origin "bump/charming-${version}"
+        env:
+          GH_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
+
+      - if: env.changed == 'true'
+        name: Open PR
+        working-directory: homebrew-tap
+        run: |
+          version="${{ steps.version.outputs.version }}"
+          count=$(gh pr list --repo tambo-labs/homebrew-tap --head "bump/charming-${version}" --state open --json number --jq length)
+          if [ "$count" -eq 0 ]; then
+            gh pr create --repo tambo-labs/homebrew-tap \
+              --base main \
+              --head "bump/charming-${version}" \
+              --title "charming ${version}" \
+              --body "Bumps the charming formula to ${version}, matching the npm release."
+          fi
+        env:
+          GH_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}