diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 85e3c4f..1f18ef7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,82 +24,109 @@ jobs:
       - name: Test
         run: go test ./...
 
-  build:
-    name: Build release binaries
+  release:
+    name: Run GoReleaser
     needs: test
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - goos: linux
-            goarch: amd64
-            os_name: linux
-            ext: ""
-          - goos: linux
-            goarch: arm64
-            os_name: linux
-            ext: ""
-          - goos: darwin
-            goarch: amd64
-            os_name: macos
-            ext: ""
-          - goos: darwin
-            goarch: arm64
-            os_name: macos
-            ext: ""
-          - goos: windows
-            goarch: amd64
-            os_name: windows
-            ext: ".exe"
-          - goos: windows
-            goarch: arm64
-            os_name: windows
-            ext: ".exe"
-
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
 
-      - name: Build
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@v7
+        with:
+          distribution: goreleaser
+          version: "~> v2"
+          args: release --clean
         env:
-          GOOS: ${{ matrix.goos }}
-          GOARCH: ${{ matrix.goarch }}
-          CGO_ENABLED: "0"
-          VERSION: ${{ github.ref_name }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Calculate Homebrew checksums
+        id: brew
         run: |
-          mkdir -p dist
-          output="dist/sing-box-sub_${VERSION}_${{ matrix.os_name }}_${GOARCH}${{ matrix.ext }}"
-          go build \
-            -trimpath \
-            -ldflags "-s -w -X main.version=${VERSION}" \
-            -o "${output}" \
-            ./cmd/sing-box-subscribe-cli
-
-      - name: Upload artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: sing-box-sub_${{ github.ref_name }}_${{ matrix.os_name }}_${{ matrix.goarch }}
-          path: dist/*
-          if-no-files-found: error
+          version="${GITHUB_REF_NAME#v}"
+          tag="${GITHUB_REF_NAME}"
+          echo "version=${version}" >> "$GITHUB_OUTPUT"
+          echo "tag=${tag}" >> "$GITHUB_OUTPUT"
+          echo "macos_arm64_sha=$(sha256sum "dist/sing-box-sub_${tag}_macos_arm64.tar.gz" | awk '{print $1}')" >> "$GITHUB_OUTPUT"
+          echo "macos_amd64_sha=$(sha256sum "dist/sing-box-sub_${tag}_macos_amd64.tar.gz" | awk '{print $1}')" >> "$GITHUB_OUTPUT"
+          echo "linux_arm64_sha=$(sha256sum "dist/sing-box-sub_${tag}_linux_arm64.tar.gz" | awk '{print $1}')" >> "$GITHUB_OUTPUT"
+          echo "linux_amd64_sha=$(sha256sum "dist/sing-box-sub_${tag}_linux_amd64.tar.gz" | awk '{print $1}')" >> "$GITHUB_OUTPUT"
 
-  release:
-    name: Publish GitHub release
-    needs: build
-    runs-on: ubuntu-latest
-    steps:
-      - name: Download artifacts
-        uses: actions/download-artifact@v4
+      - name: Checkout Homebrew tap
+        uses: actions/checkout@v4
         with:
-          path: dist
-          merge-multiple: true
+          repository: rainbend/homebrew-tap
+          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
+          path: homebrew-tap
 
-      - name: Upload release assets
-        uses: softprops/action-gh-release@v2
-        with:
-          files: dist/*
+      - name: Update Homebrew formula
+        env:
+          FORMULA_PATH: homebrew-tap/Formula/sing-box-subscribe-cli.rb
+          TAG: ${{ steps.brew.outputs.tag }}
+          VERSION: ${{ steps.brew.outputs.version }}
+          MACOS_ARM64_SHA: ${{ steps.brew.outputs.macos_arm64_sha }}
+          MACOS_AMD64_SHA: ${{ steps.brew.outputs.macos_amd64_sha }}
+          LINUX_ARM64_SHA: ${{ steps.brew.outputs.linux_arm64_sha }}
+          LINUX_AMD64_SHA: ${{ steps.brew.outputs.linux_amd64_sha }}
+        run: |
+          mkdir -p "$(dirname "$FORMULA_PATH")"
+          cat > "$FORMULA_PATH" <<FORMULA
+          class SingBoxSubscribeCli < Formula
+            desc "Generate sing-box configs from subscriptions and JSON templates"
+            homepage "https://github.com/rainbend/sing-box-subscribe-cli"
+            version "${VERSION}"
+            license "Apache-2.0"
+
+            on_macos do
+              on_arm do
+                url "https://github.com/rainbend/sing-box-subscribe-cli/releases/download/${TAG}/sing-box-sub_${TAG}_macos_arm64.tar.gz"
+                sha256 "${MACOS_ARM64_SHA}"
+              end
+
+              on_intel do
+                url "https://github.com/rainbend/sing-box-subscribe-cli/releases/download/${TAG}/sing-box-sub_${TAG}_macos_amd64.tar.gz"
+                sha256 "${MACOS_AMD64_SHA}"
+              end
+            end
+
+            on_linux do
+              if Hardware::CPU.arm? && Hardware::CPU.is_64_bit?
+                url "https://github.com/rainbend/sing-box-subscribe-cli/releases/download/${TAG}/sing-box-sub_${TAG}_linux_arm64.tar.gz"
+                sha256 "${LINUX_ARM64_SHA}"
+              end
+
+              if Hardware::CPU.intel? && Hardware::CPU.is_64_bit?
+                url "https://github.com/rainbend/sing-box-subscribe-cli/releases/download/${TAG}/sing-box-sub_${TAG}_linux_amd64.tar.gz"
+                sha256 "${LINUX_AMD64_SHA}"
+              end
+            end
+
+            def install
+              bin.install "sing-box-sub"
+            end
+
+            test do
+              assert_match version.to_s, shell_output("#{bin}/sing-box-sub version")
+              assert_match "sb-config-1.14.json", shell_output("#{bin}/sing-box-sub list")
+            end
+          end
+          FORMULA
+          ruby -c "$FORMULA_PATH"
+
+      - name: Commit Homebrew formula
+        working-directory: homebrew-tap
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          [ -n "$(git status --porcelain -- Formula/sing-box-subscribe-cli.rb)" ] || exit 0
+          git add Formula/sing-box-subscribe-cli.rb
+          git commit -m "Update sing-box-subscribe-cli to ${GITHUB_REF_NAME}"
+          git push
diff --git a/.gitignore b/.gitignore
index ee425eb..ba51558 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
 /sing-box-subscribe-cli
 /bin/
+/dist/
 config.json
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
new file mode 100644
index 0000000..eb240e9
--- /dev/null
+++ b/.goreleaser.yaml
@@ -0,0 +1,35 @@
+version: 2
+
+project_name: sing-box-subscribe-cli
+
+builds:
+  - id: sing-box-sub
+    main: ./cmd/sing-box-subscribe-cli
+    binary: sing-box-sub
+    env:
+      - CGO_ENABLED=0
+    goos:
+      - linux
+      - darwin
+      - windows
+    goarch:
+      - amd64
+      - arm64
+    ldflags:
+      - -s -w -X main.version={{ .Tag }}
+
+archives:
+  - id: default
+    ids:
+      - sing-box-sub
+    formats:
+      - tar.gz
+    format_overrides:
+      - goos: windows
+        formats:
+          - zip
+    name_template: 'sing-box-sub_{{ .Tag }}_{{ if eq .Os "darwin" }}macos{{ else }}{{ .Os }}{{ end }}_{{ .Arch }}'
+
+checksum:
+  name_template: checksums.txt
+  algorithm: sha256
diff --git a/README.md b/README.md
index 3316bcd..3a4a768 100644
--- a/README.md
+++ b/README.md
@@ -105,7 +105,7 @@ If `ExecStartPre` fails, systemd stops the startup before launching sing-box. Ma
 
 ### Windows
 
-Download the matching `.exe` from the [GitHub Releases page](https://github.com/rainbend/sing-box-subscribe-cli/releases), rename it to `sing-box-sub.exe` if you like, and place it in a directory listed in `PATH`.
+Download the matching Windows `.zip` from the [GitHub Releases page](https://github.com/rainbend/sing-box-subscribe-cli/releases), extract `sing-box-sub.exe`, and place it in a directory listed in `PATH`.
 
 Check the installed command:
 
@@ -274,7 +274,7 @@ git tag v1.0.0
 git push origin v1.0.0
 ```
 
-The release workflow runs tests, builds Linux, macOS, and Windows binaries for `amd64` and `arm64`, injects the tag into `sing-box-sub version`, and uploads the binaries to GitHub Releases.
+The release workflow runs tests, uses GoReleaser to build Linux, macOS, and Windows archives for `amd64` and `arm64`, injects the tag into `sing-box-sub version`, uploads the artifacts and `checksums.txt` to GitHub Releases, and updates the Homebrew tap formula.
 
 Container images are published to GitHub Packages. Version tags publish `<version>` and `latest`; pushes to `main` publish `main` and a `sha-...` tag.
 
diff --git a/README.zh-CN.md b/README.zh-CN.md
index af7cb6a..be633f8 100644
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -105,7 +105,7 @@ WantedBy=multi-user.target
 
 ### Windows
 
-从 [GitHub Releases 页面](https://github.com/rainbend/sing-box-subscribe-cli/releases) 下载匹配的 `.exe` 文件，可以重命名为 `sing-box-sub.exe`，并放到 `PATH` 包含的目录。
+从 [GitHub Releases 页面](https://github.com/rainbend/sing-box-subscribe-cli/releases) 下载匹配的 Windows `.zip` 文件，解压出 `sing-box-sub.exe`，并放到 `PATH` 包含的目录。
 
 检查安装结果：
 
@@ -274,7 +274,7 @@ git tag v1.0.0
 git push origin v1.0.0
 ```
 
-release workflow 会运行测试，构建 Linux、macOS 和 Windows 的 `amd64`、`arm64` 二进制文件，把 tag 注入 `sing-box-sub version`，并上传到 GitHub Releases。
+release workflow 会运行测试，通过 GoReleaser 构建 Linux、macOS 和 Windows 的 `amd64`、`arm64` 归档文件，把 tag 注入 `sing-box-sub version`，将产物和 `checksums.txt` 上传到 GitHub Releases，并更新 Homebrew tap formula。
 
 容器镜像会发布到 GitHub Packages。版本 tag 会发布 `<version>` 和 `latest`；推送到 `main` 会发布 `main` 和 `sha-...` tag。
 
diff --git a/install.sh b/install.sh
index b4372ba..e883820 100755
--- a/install.sh
+++ b/install.sh
@@ -56,18 +56,33 @@ case "$version" in
   *) version="v${version}" ;;
 esac
 
-asset="${release_binary}_${version}_linux_${arch}"
-url="https://github.com/${repo}/releases/download/${version}/${asset}"
+archive_asset="${release_binary}_${version}_linux_${arch}.tar.gz"
+raw_asset="${release_binary}_${version}_linux_${arch}"
+archive_url="https://github.com/${repo}/releases/download/${version}/${archive_asset}"
+raw_url="https://github.com/${repo}/releases/download/${version}/${raw_asset}"
 tmp_dir="$(mktemp -d)"
-tmp_file="${tmp_dir}/${asset}"
+archive_file="${tmp_dir}/${archive_asset}"
+tmp_file="${tmp_dir}/${release_binary}"
 
 cleanup() {
   rm -rf "$tmp_dir"
 }
 trap cleanup EXIT INT TERM
 
-echo "Downloading ${asset}..."
-curl -fL "$url" -o "$tmp_file"
+echo "Downloading ${archive_asset}..."
+if curl -fsSL "$archive_url" -o "$archive_file"; then
+  need_cmd tar
+  tar -xzf "$archive_file" -C "$tmp_dir"
+else
+  echo "Archive not found, falling back to ${raw_asset}..."
+  curl -fL "$raw_url" -o "$tmp_file"
+fi
+
+if [ ! -f "$tmp_file" ]; then
+  echo "error: release asset did not contain ${release_binary}" >&2
+  exit 1
+fi
+
 chmod 0755 "$tmp_file"
 
 if [ ! -d "$install_dir" ]; then