diff --git a/.github/workflows/release-config.yaml b/.github/workflows/release-config.yaml
index 07583a8..ebdb816 100644
--- a/.github/workflows/release-config.yaml
+++ b/.github/workflows/release-config.yaml
@@ -63,3 +63,16 @@ jobs:
             echo "Only the reviewed brews deprecation is allowed" >&2
             exit 1
           fi
+
+      - name: Verify recovery-safe Homebrew source URL
+        shell: bash
+        env:
+          EXPECTED_BREW_URL: '    url_template: "https://github.com/${{ github.repository }}/releases/download/{{ .Tag }}/{{ .ArtifactName }}"'
+        run: |
+          set -euo pipefail
+
+          matches="$(grep -Fxc "$EXPECTED_BREW_URL" .goreleaser.yaml || true)"
+          if [[ "$matches" -ne 1 ]]; then
+            echo "Expected exactly one recovery-safe Homebrew url_template" >&2
+            exit 1
+          fi
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index d6c9674..e5754b0 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -45,6 +45,7 @@ brews:
   - name: sitectl-drupal
     description: "A sitectl plugin for Drupal websites"
     homepage: "https://github.com/libops/sitectl-drupal"
+    url_template: "https://github.com/libops/sitectl-drupal/releases/download/{{ .Tag }}/{{ .ArtifactName }}"
     license: MIT
     commit_author:
       name: sitectl-dev[bot]