diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 2233b5b..244b520 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -37,7 +37,9 @@ jobs:
         continue-on-error: true
 
       - name: Fix style issues from GoReleaser-generated files
-        run: brew style --fix Casks/*.rb || true
+        run: |
+          scripts/fix-casks.sh
+          brew style --fix Casks/*.rb || true
         working-directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
 
       - run: brew test-bot --only-tap-syntax
diff --git a/Casks/harness-sync.rb b/Casks/harness-sync.rb
index 486a4bb..54749e3 100644
--- a/Casks/harness-sync.rb
+++ b/Casks/harness-sync.rb
@@ -33,10 +33,9 @@ cask "harness-sync" do
 
   binary "harness-sync"
 
-  postflight do
-    if OS.mac?
-      system_command "/usr/bin/xattr",
-                     args: ["-dr", "com.apple.quarantine", "#{staged_path}/harness-sync"]
+  postflight_steps do
+    on_macos do
+      run "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "{{staged_path}}/harness-sync"]
     end
   end
 
diff --git a/Casks/kportal.rb b/Casks/kportal.rb
index 4c0f132..b8ab9ec 100644
--- a/Casks/kportal.rb
+++ b/Casks/kportal.rb
@@ -33,10 +33,9 @@ cask "kportal" do
 
   binary "kportal"
 
-  postflight do
-    if OS.mac?
-      system_command "/usr/bin/xattr",
-                     args: ["-dr", "com.apple.quarantine", "#{staged_path}/kportal"]
+  postflight_steps do
+    on_macos do
+      run "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "{{staged_path}}/kportal"]
     end
   end
 
diff --git a/Casks/lolcathost.rb b/Casks/lolcathost.rb
index 386d71b..b93928c 100644
--- a/Casks/lolcathost.rb
+++ b/Casks/lolcathost.rb
@@ -33,10 +33,9 @@ cask "lolcathost" do
 
   binary "lolcathost"
 
-  postflight do
-    if OS.mac?
-      system_command "/usr/bin/xattr",
-                     args: ["-dr", "com.apple.quarantine", "#{staged_path}/lolcathost"]
+  postflight_steps do
+    on_macos do
+      run "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "{{staged_path}}/lolcathost"]
     end
   end
 
diff --git a/Casks/semver-generator.rb b/Casks/semver-generator.rb
index e49a8ab..6f8af81 100644
--- a/Casks/semver-generator.rb
+++ b/Casks/semver-generator.rb
@@ -33,10 +33,9 @@ cask "semver-generator" do
 
   binary "semver-generator"
 
-  postflight do
-    if OS.mac?
-      system_command "/usr/bin/xattr",
-                     args: ["-dr", "com.apple.quarantine", "#{staged_path}/semver-generator"]
+  postflight_steps do
+    on_macos do
+      run "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "{{staged_path}}/semver-generator"]
     end
   end
 
diff --git a/scripts/fix-casks.sh b/scripts/fix-casks.sh
new file mode 100755
index 0000000..c494853
--- /dev/null
+++ b/scripts/fix-casks.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+# GoReleaser writes the quarantine hook as a postflight block, which Homebrew rejects
+# with Cask/InstallSteps. Rewrite it to postflight_steps.
+set -euo pipefail
+
+for cask in Casks/*.rb; do
+  perl -0pi -e 's|  postflight do\n    if OS\.mac\?\n      system_command "/usr/bin/xattr",\n\s+args: \["-dr", "com\.apple\.quarantine", "#\{staged_path\}/([\w-]+)"\]\n    end\n  end\n|  postflight_steps do\n    on_macos do\n      run "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "{{staged_path}}/$1"]\n    end\n  end\n|' "$cask"
+done