diff --git a/README.md b/README.md
index a0baffd..86c79bd 100644
--- a/README.md
+++ b/README.md
@@ -16,9 +16,29 @@ sudo snap connect ecrou:kvm
 
 macOS (Apple Silicon, Homebrew):
 ```
+brew trust --tap libkrun/krun
 brew install vhaudiquet/ecrou/ecrou
 ```
 
+The `brew trust` step is Homebrew's tap-trust gate: dependencies from
+third-party taps stay refused until their tap is trusted once, and
+ecrou's engine, libkrun, ships from libkrun's own tap. The macOS
+build loads libkrun from that tap at runtime and boots through
+Hypervisor.framework; the formula signs the binary with the
+hypervisor entitlement macOS requires, so the install needs no extra
+steps. Building from source instead:
+
+```
+brew install libkrun/homebrew-krun/libkrun e2fsprogs libarchive
+cargo build --release -p ecrou-cli
+codesign --force --sign - --entitlements packaging/homebrew/ecrou.entitlements \
+  target/release/ecrou
+```
+
+Every local build needs that last line: cargo output is ad-hoc signed
+without the entitlement, and macOS refuses VM creation to it — `ecrou
+probe` says so and prints the command.
+
 ### Usage
 
 ```
diff --git a/SPEC.md b/SPEC.md
index cb2bdd6..6960b54 100644
--- a/SPEC.md
+++ b/SPEC.md
@@ -344,9 +344,13 @@ dependencies (`libkrun` from the krun tap, `e2fsprogs`, `libarchive`),
 builds from source with cargo, and re-signs the binary with the
 entitlements plist from `packaging/homebrew/` — brew bottles are
 ad-hoc signed, so the signature is part of the formula's install,
-not of the artifact. The formula is pinned by tag until the first
-release exists, then switches to the release tarball + sha256 the
-release workflow produces.
+not of the artifact. The in-repo formula's tag pin is a placeholder:
+the release workflow rewrites url and sha256 when it pushes the
+formula to the tap. Homebrew's tap-trust gate refuses dependencies
+from third-party taps until their tap is trusted, so the README
+leads with `brew trust --tap libkrun/krun` and CI trusts the tap
+before its install; removing that tax is another argument for
+libkrun landing in homebrew-core.
 
 ## Snap packaging