diff --git a/Casks/tacet.rb b/Casks/tacet.rb
index 8a91bca..815aa34 100644
--- a/Casks/tacet.rb
+++ b/Casks/tacet.rb
@@ -2,8 +2,7 @@
   version "0.1.3"
   sha256 "6850c13401ee7e9666ab5abc81dc6b38a4d77b69be48a13a37344c64520e9e6b"
 
-  url "https://github.com/DRYCodeWorks/tacet/releases/download/v#{version}/Tacet.zip",
-      verified: "github.com/DRYCodeWorks/tacet/"
+  url "https://github.com/DRYCodeWorks/tacet/releases/download/v#{version}/Tacet.zip"
   name "Tacet"
   desc "Push-to-talk dictation that pastes the transcript at the cursor"
   homepage "https://github.com/DRYCodeWorks/tacet"
@@ -34,12 +33,18 @@
   # the fact does not recover it, and neither does replacing the file — only a
   # different path does. So this has to run before anything execs the binary.
   #
+  # Install steps take only literal arguments, so there is no way to name
+  # #{appdir}/Tacet.app. Instead this clears the flag on the staged bundle
+  # (`chdir` defaults to staged_path) before the app artifact moves it:
+  # Homebrew quarantines the download and propagates the flag on extraction,
+  # and nothing re-applies it after the move. A file without the attribute
+  # makes xattr exit non-zero, which the old system_command also ignored.
+  #
   # See DRYCodeWorks/tacet#25 for the isolation. CI enforces that this keeps
   # working: the cask job execs the installed bundle with --help and fails the
   # build on a hang, which is the signature of this bug coming back.
-  postflight do
-    system_command "/usr/bin/xattr",
-                   args: ["-dr", "com.apple.quarantine", "#{appdir}/Tacet.app"]
+  preflight_steps do
+    run "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "Tacet.app"], chdir: ".", must_succeed: false
   end
 
   # Deliberately NOT `depends_on formula: "whisper-cpp"`. One bundle plays two
diff --git a/Formula/tailctl.rb b/Formula/tailctl.rb
index a2cff5d..8c5b79f 100644
--- a/Formula/tailctl.rb
+++ b/Formula/tailctl.rb
@@ -3,8 +3,8 @@ class Tailctl < Formula
 
   desc "Per-identity Tailscale networking for parallel sessions on a single Mac"
   homepage "https://github.com/DRYCodeWorks/tailctl"
-  url "https://files.pythonhosted.org/packages/eb/ec/44787a94cb609e6ad06ace0fe82fb5444acaa0e6c78a1100bdbd89d2adbb/tailctl-0.1.1.tar.gz"
-  sha256 "c4f63c97ea17a947c24f0b48232256a8b16707f962125186a234a34dc8ed20cc"
+  url "https://files.pythonhosted.org/packages/f0/be/bf470ff244523e00a83cad9a8b9cf1d70ba59fdb0bcb759969ec6d8efe59/tailctl-0.2.0.tar.gz"
+  sha256 "ba133a7d1df11b00f27647480cb60762e21f1596a6ee154055217b49c627f84f"
   license "MIT"
 
   # Bumps here are manual, so let `brew livecheck` spot new PyPI releases.