diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8325681..c926448 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,7 +24,7 @@ jobs:
       CARGO_TERM_COLOR: always
     steps:
       - name: Checkout source
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5.0.1
 
       - name: Install system dependencies
         run: |
@@ -65,7 +65,7 @@ jobs:
       CARGO_TERM_COLOR: always
     steps:
       - name: Checkout source
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5.0.1
 
       - name: Install system dependencies
         run: |
diff --git a/.github/workflows/release-edge.yml b/.github/workflows/release-edge.yml
index ec01abc..23f4394 100644
--- a/.github/workflows/release-edge.yml
+++ b/.github/workflows/release-edge.yml
@@ -14,7 +14,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout source
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5.0.1
         with:
           fetch-depth: 0
 
@@ -43,7 +43,7 @@ jobs:
       CARGO_TERM_COLOR: always
     steps:
       - name: Checkout source
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5.0.1
 
       - name: Install Linux dependencies
         if: runner.os == 'Linux'
@@ -78,7 +78,7 @@ jobs:
           shasum -a 256 "${{ matrix.asset_name }}.tar.gz" > "${{ matrix.asset_name }}.sha256"
 
       - name: Publish edge release assets
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v2.5.0
         with:
           tag_name: edge
           name: Edge
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d535ba8..a19e95d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -26,7 +26,7 @@ jobs:
       CARGO_TERM_COLOR: always
     steps:
       - name: Checkout source
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5.0.1
 
       - name: Install Linux dependencies
         if: runner.os == 'Linux'
@@ -61,7 +61,7 @@ jobs:
           shasum -a 256 "${{ matrix.asset_name }}.tar.gz" > "${{ matrix.asset_name }}.sha256"
 
       - name: Publish GitHub release assets
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v2.5.0
         with:
           files: |
             ${{ matrix.asset_name }}.tar.gz
diff --git a/README.md b/README.md
index 6dd757f..8da58b3 100644
--- a/README.md
+++ b/README.md
@@ -16,6 +16,20 @@ published release binaries. It does not compile from source. If no stable tag
 is published yet, the installer automatically falls back to the rolling `edge`
 release.
 
+Or install with Homebrew:
+
+```bash
+brew tap ModernRelay/tap
+brew install ModernRelay/tap/omnigraph
+```
+
+The Homebrew tap currently builds from source. To install the latest `main`
+from the tap instead of the pinned formula version, use:
+
+```bash
+brew install --HEAD ModernRelay/tap/omnigraph
+```
+
 To install the rolling prerelease binaries from `main` instead:
 
 ```bash
diff --git a/docs/install.md b/docs/install.md
index 2be6c3e..72ea902 100644
--- a/docs/install.md
+++ b/docs/install.md
@@ -18,6 +18,20 @@ verifies the SHA256 checksum, and unpacks it. It does not build from source.
 If no stable tag is published yet, the installer automatically falls back to
 the rolling `edge` release.
 
+## Homebrew
+
+```bash
+brew tap ModernRelay/tap
+brew install ModernRelay/tap/omnigraph
+```
+
+The Homebrew formula currently builds from source. To install the latest `main`
+instead of the pinned formula version:
+
+```bash
+brew install --HEAD ModernRelay/tap/omnigraph
+```
+
 ## Channels
 
 Stable binaries: