diff --git a/.github/scripts/bump-netbird.sh b/.github/scripts/bump-netbird.sh
index 8005e13..9ca191c 100755
--- a/.github/scripts/bump-netbird.sh
+++ b/.github/scripts/bump-netbird.sh
@@ -4,7 +4,7 @@
 set -euo pipefail
 cask=Casks/netbird-ui.rb
 formula=Formula/netbird.rb
-latest=$(gh api repos/netbirdio/netbird/releases/latest --jq .tag_name)
+latest=$(curl -fsSL https://api.github.com/repos/netbirdio/netbird/releases/latest | jq -r .tag_name)
 latest=${latest#v}
 current=$(sed -nE 's/^  version "([^"]+)"$/\1/p' "$cask")
 if [ "$latest" = "$current" ]; then
diff --git a/.github/scripts/bump-zshellcheck.sh b/.github/scripts/bump-zshellcheck.sh
index 95c8efa..426cdf9 100755
--- a/.github/scripts/bump-zshellcheck.sh
+++ b/.github/scripts/bump-zshellcheck.sh
@@ -4,7 +4,7 @@
 set -euo pipefail
 formula=Formula/zshellcheck.rb
 repo=afadesigns/zshellcheck
-latest=$(gh api repos/$repo/releases/latest --jq .tag_name)
+latest=$(curl -fsSL "https://api.github.com/repos/$repo/releases/latest" | jq -r .tag_name)
 latest=${latest#v}
 current=$(sed -nE 's|.*/releases/download/v([^/]+)/.*|\1|p' "$formula" | head -1)
 if [ "$latest" = "$current" ]; then
diff --git a/.github/workflows/bump.yml b/.github/workflows/bump.yml
index f26fab1..3d2a9f5 100644
--- a/.github/workflows/bump.yml
+++ b/.github/workflows/bump.yml
@@ -11,8 +11,6 @@ permissions:
 jobs:
   bump:
     runs-on: ubuntu-latest
-    env:
-      GH_TOKEN: ${{ github.token }}
     steps:
       - uses: actions/checkout@v7
 
@@ -20,20 +18,20 @@ jobs:
           echo "BUMP_DIR=$RUNNER_TEMP/bumps" >> "$GITHUB_ENV"
           mkdir -p "$RUNNER_TEMP/bumps"
 
-      # Each script edits its own files and leaves committing to the next step,
-      # so the parallel steps never race for the git index.
-      - parallel:
-          - name: Bump netbird
-            run: .github/scripts/bump-netbird.sh
+      # Each script edits its own files and leaves committing to the last step, so every bump
+      # gets its own commit. The scripts ask api.github.com without a token: two requests per run
+      # is far below the 60 an hour GitHub allows per IP.
+      - name: Bump netbird
+        run: .github/scripts/bump-netbird.sh
 
-          - name: Bump zshellcheck
-            run: .github/scripts/bump-zshellcheck.sh
+      - name: Bump zshellcheck
+        run: .github/scripts/bump-zshellcheck.sh
 
       - name: Commit and push
         run: |
           set -euo pipefail
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git config user.name "gitea-actions"
+          git config user.email "gitea-actions@git.trivk.dev"
           shopt -s nullglob
           for record in "$BUMP_DIR"/*; do
             mapfile -t lines < "$record"
diff --git a/README.md b/README.md
index 9ed5f4d..1eb991e 100644
--- a/README.md
+++ b/README.md
@@ -11,15 +11,18 @@ My personal Homebrew tap for macOS.
 ## Install
 
 ```sh
-brew tap vokhactri/tap
+brew tap vokhactri/tap https://git.trivk.dev/tri/homebrew-tap.git
 brew trust vokhactri/tap
 brew install vokhactri/tap/<name>
 ```
 
 Use `brew install --cask` for casks.
 
+The tap lives on git.trivk.dev, so `brew tap` needs the URL. Without it, Homebrew looks on GitHub,
+where the old copy is archived and no longer updated.
+
 ## Updates
 
-A GitHub Action checks for new upstream releases every two hours and commits the new version
-and sha256 values. If a release doesn't have its macOS files yet, the Action tries again on the
+A Gitea Actions workflow checks for new upstream releases every two hours and commits the new
+version and sha256 values. If a release doesn't have its macOS files yet, the Action tries again on the
 next run.