diff --git a/.github/workflows/onPushToMain.yml b/.github/workflows/onPushToMain.yml
index b60d14f..8f12bc4 100644
--- a/.github/workflows/onPushToMain.yml
+++ b/.github/workflows/onPushToMain.yml
@@ -18,7 +18,7 @@ jobs:
     - name: Setup Node.js
       uses: actions/setup-node@v3
       with:
-        node-version: '18'  # Set to your Node.js version
+        node-version: '24'  # Same line as the Node bundled in the tarballs
         registry-url: 'https://registry.npmjs.org/'
       
     - name: Install dependencies
@@ -83,7 +83,7 @@ jobs:
     # Configured on npmjs.com: @apso/cli > Settings > Trusted Publisher
     # (GitHub Actions, apsoai/cli, onPushToMain.yml, environment blank,
     # "Allow npm publish" checked; without it only `npm stage publish` works).
-    # Build stays on Node 18 (what CI tests); publish needs npm >= 11.5.1,
+    # Build runs on Node 24 (what CI tests); publish needs npm >= 11.5.1,
     # which needs Node 22.
     # No registry-url: with it, setup-node writes an .npmrc that sends the
     # NODE_AUTH_TOKEN placeholder (XXXXX-...) as the auth token, and npm then
@@ -111,6 +111,12 @@ jobs:
       run: |
         npx oclif pack tarballs --targets darwin-x64,darwin-arm64,linux-x64
 
+    # Run the linux tarball before anything is uploaded, so a broken bundle
+    # never reaches the GitHub Release or the Homebrew formula.
+    - name: Smoke test the linux tarball
+      if: steps.bump_version.outputs.newTag != ''
+      run: bash scripts/tarball-smoke.sh linux-x64
+
     - name: Rename tarballs and compute checksums
       if: steps.bump_version.outputs.newTag != ''
       id: tarballs
diff --git a/.github/workflows/scaffold-smoke.yml b/.github/workflows/scaffold-smoke.yml
index 8c9beef..6b660cc 100644
--- a/.github/workflows/scaffold-smoke.yml
+++ b/.github/workflows/scaffold-smoke.yml
@@ -40,7 +40,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: "18"
+          node-version: "24"
           registry-url: "https://npm.pkg.github.com"
           scope: "@mavric"
 
diff --git a/.github/workflows/tarball-smoke.yml b/.github/workflows/tarball-smoke.yml
new file mode 100644
index 0000000..24b9efe
--- /dev/null
+++ b/.github/workflows/tarball-smoke.yml
@@ -0,0 +1,31 @@
+name: tarball smoke test
+
+# Packs the linux standalone tarball (the Homebrew/curl bundle with its own
+# Node) and runs it. Only on PRs that change what goes into the bundle, since
+# packing downloads a Node binary.
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - package.json
+      - npm-shrinkwrap.json
+      - scripts/tarball-smoke.sh
+      - .github/workflows/tarball-smoke.yml
+
+permissions:
+  contents: read
+
+jobs:
+  tarball-smoke:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+
+      - run: npm ci
+      - run: npm run build
+      - run: bash scripts/tarball-smoke.sh linux-x64
diff --git a/.github/workflows/unitTests.yml b/.github/workflows/unitTests.yml
index ca74c3f..036c309 100644
--- a/.github/workflows/unitTests.yml
+++ b/.github/workflows/unitTests.yml
@@ -10,6 +10,11 @@ permissions:
 jobs:
   build-and-publish:
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        # 24 is the Node bundled in the Homebrew tarballs; 22 is the oldest
+        # supported line, kept for npm installs on older machines.
+        node: ['22', '24']
     steps:
     - uses: actions/checkout@v3
       with:
@@ -18,7 +23,7 @@ jobs:
     - name: Setup Node.js
       uses: actions/setup-node@v3
       with:
-        node-version: '18'  # Set to your Node.js version
+        node-version: ${{ matrix.node }}
         registry-url: 'https://npm.pkg.github.com'
         scope: '@mavric'
       
diff --git a/README.md b/README.md
index 0bb19f8..7762c2d 100644
--- a/README.md
+++ b/README.md
@@ -9,8 +9,9 @@ Apso generates production-ready backend services from a JSON schema file. You ge
 **Homebrew** (macOS / Linux)
 
 ```bash
-brew tap apsoai/tap
-brew install apso
+brew install apsoai/tap/apso
+# Installed before Homebrew 6? Trust the formula so upgrades work:
+# brew trust --formula apsoai/tap/apso
 ```
 
 **npm**
diff --git a/package.json b/package.json
index 937cd42..682ab41 100644
--- a/package.json
+++ b/package.json
@@ -108,7 +108,7 @@
     },
     "update": {
       "node": {
-        "version": "18.20.4",
+        "version": "24.22.1",
         "targets": [
           "darwin-x64",
           "darwin-arm64",
diff --git a/scripts/tarball-smoke.sh b/scripts/tarball-smoke.sh
new file mode 100755
index 0000000..97d74a3
--- /dev/null
+++ b/scripts/tarball-smoke.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# Run the standalone tarball the way a Homebrew user gets it: the bundled Node
+# must be the pinned version, and the CLI must start, validate a schema and
+# run the PGlite migrate sandbox. Packs the tarball first unless one exists.
+#
+# Usage: scripts/tarball-smoke.sh [target]   (default: linux-x64)
+set -euo pipefail
+
+target="${1:-linux-x64}"
+cd "$(dirname "$0")/.."
+root="$PWD"
+want="v$(node -p "require('./package.json').oclif.update.node.version")"
+
+tarball="$(ls dist/apso-v*-"$target".tar.gz 2>/dev/null | head -1 || true)"
+if [ -z "$tarball" ]; then
+  npx oclif pack tarballs --targets "$target" --no-xz
+  tarball="$(ls dist/apso-v*-"$target".tar.gz | head -1)"
+fi
+
+work="$(mktemp -d)"
+tar -xzf "$tarball" -C "$work"
+apso="$work/apso/bin/apso"
+export APSO_TELEMETRY_DISABLED=1
+
+got="$("$work/apso/bin/node" --version)"
+if [ "$got" != "$want" ]; then
+  echo "bundled node is $got, want $want" >&2
+  exit 1
+fi
+"$apso" --version
+"$apso" --help >/dev/null
+
+proj="$(mktemp -d)"
+cp "$root/test/fixtures/inventory-multi-fk.apsorc" "$proj/.apsorc"
+cd "$proj"
+"$apso" schema validate >/dev/null
+"$apso" migrate
+
+echo "tarball smoke passed: $(basename "$tarball") on node $got"