diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f7a21001..a1cdb4d3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -115,11 +115,21 @@ jobs:
       - name: Install Go tools
         run: make goreleaser repogen
 
+      - name: Generate GitHub App token for homebrew-tap
+        id: app-token
+        if: startsWith(github.ref, 'refs/tags/') || inputs.tag
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ vars.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          repositories: homebrew-tap
+
       - name: Build release (tag)
         if: startsWith(github.ref, 'refs/tags/') || inputs.tag
         env:
           GORELEASER_CURRENT_TAG: ${{ steps.tag.outputs.tag }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAP_GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
           RSA_SIGNING_KEY_FILE: ${{ steps.signing-keys.outputs.key_dir }}/rsa-signing-key.pem
           GPG_SIGNING_KEY_FILE: ${{ steps.signing-keys.outputs.key_dir }}/gpg-signing-key.asc
           CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }}
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 4cae804b..79406403 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -160,7 +160,7 @@ brews:
     repository:
       owner: upsun
       name: homebrew-tap
-      token: "{{ .Env.GITHUB_TOKEN }}"
+      token: "{{ .Env.TAP_GITHUB_TOKEN }}"
     ids:
       - platform
 
@@ -191,7 +191,7 @@ brews:
     repository:
       owner: upsun
       name: homebrew-tap
-      token: "{{ .Env.GITHUB_TOKEN }}"
+      token: "{{ .Env.TAP_GITHUB_TOKEN }}"
     ids:
       - upsun
 
@@ -223,7 +223,7 @@ scoops:
     repository:
       owner: upsun
       name: homebrew-tap
-      token: "{{ .Env.GITHUB_TOKEN }}"
+      token: "{{ .Env.TAP_GITHUB_TOKEN }}"
     ids:
       - platform
 
@@ -245,7 +245,7 @@ scoops:
     repository:
       owner: upsun
       name: homebrew-tap
-      token: "{{ .Env.GITHUB_TOKEN }}"
+      token: "{{ .Env.TAP_GITHUB_TOKEN }}"
     ids:
       - upsun