diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a947001..4596da2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -71,7 +71,7 @@ jobs:
       # HVF grants VM creation only to binaries carrying the hypervisor
       # entitlement on current macOS; packaging signs the same way.
       - name: Sign the binary with the hypervisor entitlement
-        run: codesign --force --sign - --entitlements packaging/macos/ecrou.entitlements target/release/ecrou
+        run: codesign --force --sign - --entitlements packaging/homebrew/ecrou.entitlements target/release/ecrou
 
       - name: Probe
         run: ./target/release/ecrou probe
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 549e7f9..841cfb9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -87,7 +87,7 @@ jobs:
         run: cargo build --release -p ecrou-cli
 
       - name: Sign the binary with the hypervisor entitlement
-        run: codesign --force --sign - --entitlements packaging/macos/ecrou.entitlements target/release/ecrou
+        run: codesign --force --sign - --entitlements packaging/homebrew/ecrou.entitlements target/release/ecrou
 
       - name: Package
         run: |
diff --git a/SPEC.md b/SPEC.md
index 55ed6c4..cb2bdd6 100644
--- a/SPEC.md
+++ b/SPEC.md
@@ -342,7 +342,7 @@ the release tarball and pushes it (gated on a `HOMEBREW_TAP_TOKEN`
 PAT; without the secret the job no-ops). The formula carries the runtime
 dependencies (`libkrun` from the krun tap, `e2fsprogs`, `libarchive`),
 builds from source with cargo, and re-signs the binary with the
-entitlements plist from `packaging/macos/` — brew bottles are
+entitlements plist from `packaging/homebrew/` — brew bottles are
 ad-hoc signed, so the signature is part of the formula's install,
 not of the artifact. The formula is pinned by tag until the first
 release exists, then switches to the release tarball + sha256 the
diff --git a/packaging/homebrew/Formula/ecrou.rb b/packaging/homebrew/Formula/ecrou.rb
index c82f702..93d78f8 100644
--- a/packaging/homebrew/Formula/ecrou.rb
+++ b/packaging/homebrew/Formula/ecrou.rb
@@ -3,7 +3,7 @@
 # krunkit comes from, because the engine is dlopen'd from those kegs
 # at runtime.
 class Ecrou < Formula
-  desc "One-shot microVM environments"
+  desc "a small microVM runtime based on libkrun"
   homepage "https://github.com/vhaudiquet/ecrou"
   # Pinned by tag until the first release exists; switch to the
   # release tarball + sha256 then.
@@ -26,14 +26,14 @@ class Ecrou < Formula
     # with the hypervisor entitlement; on current macOS the signature
     # is a hard requirement, the same one krunkit's formula carries.
     system "codesign", "--force", "--sign", "-",
-      "--entitlements", "packaging/macos/ecrou.entitlements", bin/"ecrou"
+      "--entitlements", "packaging/homebrew/ecrou.entitlements", bin/"ecrou"
   end
 
   def caveats
     <<~EOS
       The binary is ad-hoc signed with the com.apple.security.hypervisor
       entitlement. Rebuilding from source (cargo) requires re-signing:
-        codesign --force --sign - --entitlements packaging/macos/ecrou.entitlements target/release/ecrou
+        codesign --force --sign - --entitlements packaging/homebrew/ecrou.entitlements target/release/ecrou
       `ecrou probe` reports this when the entitlement is missing.
     EOS
   end
diff --git a/packaging/macos/ecrou.entitlements b/packaging/homebrew/ecrou.entitlements
similarity index 100%
rename from packaging/macos/ecrou.entitlements
rename to packaging/homebrew/ecrou.entitlements