diff --git a/.goreleaser.yml b/.goreleaser.yml
index f2e6520..bb238d1 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -95,10 +95,19 @@ homebrew_casks:
     directory: Casks
     homepage: "https://remetric.dev"
     description: "Re-metric your stack - find waste in Prometheus, Grafana & Loki"
-    binary: "remetric"
+    binaries: ["remetric"]
     commit_author:
       name: "remetric-dev-bot"
       email: "noreply@remetric.dev"
+    # Strip macOS Gatekeeper quarantine on install so the unsigned binary
+    # actually executes. Once we sign + notarize (Apple Developer Program),
+    # remove this hook block and let Gatekeeper verify normally.
+    hooks:
+      post:
+        install: |
+          if OS.mac?
+            system_command "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "#{staged_path}/remetric"]
+          end
     # Publish on every tag, including pre-releases (v0.1.0-rc.N), so we can
     # validate the tap end-to-end before v0.1.0. Switch to `auto` post-v0.1
     # if you want to stop polluting the tap with alphas.
diff --git a/Makefile b/Makefile
index 00b8e7c..6b9b09f 100644
--- a/Makefile
+++ b/Makefile
@@ -3,7 +3,7 @@ GOLANGCI_VERSION := v2.12.1
 GOLANGCI_IMAGE   := golangci/golangci-lint:$(GOLANGCI_VERSION)
 GOFUMPT_VERSION  := v0.7.0
 GOVULN_VERSION   := v1.3.0
-GORELEASER_VERSION := v2.10.0
+GORELEASER_VERSION := v2.15.4
 LOCAL_PREFIX     := github.com/remetric-dev/remetric
 
 VERSION          ?= $(shell git describe --tags --dirty --always 2>/dev/null || echo dev)