diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9e4050b..bb3b0c1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -89,6 +89,14 @@ jobs:
 
       - name: Install wasm-pack
         uses: jetli/wasm-pack-action@v0.4.0
+        with:
+          # Pinned deliberately. Left unset, the action resolves "latest" through
+          # the GitHub API and silently falls back to a much older wasm-pack when
+          # that call is rate-limited — and versions before workspace inheritance
+          # cannot parse `license.workspace = true`, failing the build with
+          # "invalid type: map, expected a string for key `package.license`".
+          # That is why this passed for months and then broke on an unrelated run.
+          version: 'v0.15.0'
 
       # The runner ships Chrome and a matching chromedriver on PATH. Letting
       # wasm-pack download its own risks a version mismatch with the installed
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 664bfc5..abe32cd 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -192,6 +192,14 @@ jobs:
 
       - name: Install wasm-pack
         uses: jetli/wasm-pack-action@v0.4.0
+        with:
+          # Pinned deliberately. Left unset, the action resolves "latest" through
+          # the GitHub API and silently falls back to a much older wasm-pack when
+          # that call is rate-limited — and versions before workspace inheritance
+          # cannot parse `license.workspace = true`, failing the build with
+          # "invalid type: map, expected a string for key `package.license`".
+          # That is why this passed for months and then broke on an unrelated run.
+          version: 'v0.15.0'
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
diff --git a/README.md b/README.md
index 5c74f19..eb29b85 100644
--- a/README.md
+++ b/README.md
@@ -31,8 +31,10 @@ The same Rust cache engine runs natively on your server (RESP on port 6379 — a
 # Docker
 docker run -p 6379:6379 -p 6380:6380 ghcr.io/recached-dev/recached:latest
 
-# Homebrew (macOS)
-brew tap recached-dev/recached && brew install recached && recached-server
+# Homebrew (macOS) — the tap is this repo, and Homebrew 6+ wants third-party taps trusted
+brew tap recached-dev/recached https://github.com/recached-dev/recached
+brew trust recached-dev/recached   # Homebrew 6.0+ only; older versions do not have it
+brew install recached && recached-server
 
 # Cargo (from source — the crate is not on crates.io yet)
 cargo install --git https://github.com/recached-dev/recached recached && recached-server
diff --git a/docs/guide/quick-start.md b/docs/guide/quick-start.md
index fc00246..b1616ed 100644
--- a/docs/guide/quick-start.md
+++ b/docs/guide/quick-start.md
@@ -17,7 +17,14 @@ Port 6379 is the RESP TCP port (Redis-compatible). Port 6380 is the WebSocket sy
 ### Homebrew (macOS)
 
 ```bash
-brew tap recached-dev/recached
+# The tap is the main repo rather than a separate homebrew-recached
+# repository, so the URL has to be given explicitly.
+brew tap recached-dev/recached https://github.com/recached-dev/recached
+
+# Homebrew 6.0 refuses to load formulae from an untrusted third-party tap.
+# Skip this on older Homebrew, which has no `trust` subcommand.
+brew trust recached-dev/recached
+
 brew install recached
 recached-server
 ```
diff --git a/docs/server/installation.md b/docs/server/installation.md
index 9351326..73a369e 100644
--- a/docs/server/installation.md
+++ b/docs/server/installation.md
@@ -46,7 +46,14 @@ services:
 ## Homebrew (macOS)
 
 ```bash
-brew tap recached-dev/recached
+# The tap is the main repo rather than a separate homebrew-recached
+# repository, so the URL has to be given explicitly.
+brew tap recached-dev/recached https://github.com/recached-dev/recached
+
+# Homebrew 6.0 refuses to load formulae from an untrusted third-party tap.
+# Skip this on older Homebrew, which has no `trust` subcommand.
+brew trust recached-dev/recached
+
 brew install recached
 recached-server
 ```
diff --git a/wasm-edge/Cargo.toml b/wasm-edge/Cargo.toml
index 5145b1d..d4461c9 100644
--- a/wasm-edge/Cargo.toml
+++ b/wasm-edge/Cargo.toml
@@ -2,7 +2,13 @@
 name    = "wasm-edge"
 version.workspace = true
 edition.workspace = true
-license.workspace = true
+# Spelled out rather than inherited: wasm-pack parses this manifest itself, and
+# every field it reads ends up in the generated npm package.json. `description`
+# and `repository` were absent, so the published recached-edge package carried
+# neither — wasm-pack warns about exactly this on every build.
+license = "Apache-2.0"
+description = "The Recached cache engine compiled to WebAssembly: a Redis-compatible store that runs inside the browser and syncs with a Recached server."
+repository.workspace = true
 
 [lib]
 crate-type = ["cdylib", "rlib"]