diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml
index 883221ae..8e7fb71a 100644
--- a/.github/workflows/auto-release.yml
+++ b/.github/workflows/auto-release.yml
@@ -14,7 +14,7 @@ on:
         default: true
 
 # The tag push uses the dedicated RELEASE_TAG_TOKEN via a credential helper, not
-# GITHUB_TOKEN, so the pushed tag retriggers release.yml. HOMEBREW_TAP_TOKEN is
+# GITHUB_TOKEN, so the pushed tag retriggers release.yml. TAP_GITHUB_TOKEN is
 # only for release.yml Homebrew tap pushes.
 permissions:
   contents: read
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a397ed21..88c148fa 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -29,7 +29,7 @@ jobs:
       # — this is robust to either and always yields a real boolean.
       dry-run: ${{ github.event_name == 'workflow_dispatch' && (inputs.dry-run == true || inputs.dry-run == 'true') }}
     secrets:
-      homebrew-tap-token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
+      homebrew-tap-token: ${{ secrets.TAP_GITHUB_TOKEN }}
       chocolatey-api-key: ${{ secrets.CHOCOLATEY_API_KEY }}
       winget-token: ${{ secrets.WINGET_GITHUB_TOKEN }}
       linux-dispatch-token: ${{ secrets.LINUX_PACKAGES_DISPATCH_TOKEN }}
diff --git a/docs/development.md b/docs/development.md
index 81ed5224..bec595d4 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -56,7 +56,7 @@ package-channel credentials. The preferred long-term shape is the GitHub App
 installation-token path described in the shared release standard; until that is
 wired through, use a narrowly scoped `RELEASE_TAG_TOKEN`.
 
-`HOMEBREW_TAP_TOKEN` is only for Homebrew tap pushes from the release workflow.
+`TAP_GITHUB_TOKEN` is only for Homebrew tap pushes from the release workflow.
 Do not reuse it for auto-release tag pushes.
 
 Package-channel releases also use `CHOCOLATEY_API_KEY`,
@@ -71,7 +71,7 @@ shared workflow owns publish mechanics.
 
 - Homebrew: GoReleaser renders `dist/homebrew/Casks/codereview-cli.rb` with
   `skip_upload: true`; the shared Homebrew job pushes that generated cask to
-  `open-cli-collective/homebrew-tap` with `HOMEBREW_TAP_TOKEN`.
+  `open-cli-collective/homebrew-tap` with `TAP_GITHUB_TOKEN`.
 - Chocolatey: the shared Chocolatey job rewrites
   `packaging/chocolatey/cr.nuspec` from version `0.0.0` to the release version
   and replaces `CHECKSUM_AMD64_PLACEHOLDER` /
diff --git a/scripts/verify-package-render.sh b/scripts/verify-package-render.sh
index 33d91c3a..063276c2 100755
--- a/scripts/verify-package-render.sh
+++ b/scripts/verify-package-render.sh
@@ -68,7 +68,7 @@ require_grep "<id>cr</id>" "packaging/chocolatey/cr.nuspec"
 require_grep 'releases/download/v${version}' "packaging/chocolatey/tools/chocolateyInstall.ps1"
 require_grep 'cr_v${version}_windows_${arch}.zip' "packaging/chocolatey/tools/chocolateyInstall.ps1"
 
-require_grep 'homebrew-tap-token: ${{ secrets.HOMEBREW_TAP_TOKEN }}' ".github/workflows/release.yml"
+require_grep 'homebrew-tap-token: ${{ secrets.TAP_GITHUB_TOKEN }}' ".github/workflows/release.yml"
 require_grep 'chocolatey-api-key: ${{ secrets.CHOCOLATEY_API_KEY }}' ".github/workflows/release.yml"
 require_grep 'winget-token: ${{ secrets.WINGET_GITHUB_TOKEN }}' ".github/workflows/release.yml"
 require_grep 'linux-dispatch-token: ${{ secrets.LINUX_PACKAGES_DISPATCH_TOKEN }}' ".github/workflows/release.yml"