diff --git a/.goreleaser.yml b/.goreleaser.yml
index c11a9fbd..f5a5d433 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -115,8 +115,6 @@ homebrew_casks:
       post:
         install: |
           system_command "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "#{staged_path}/cr"]
-          result = system_command "#{staged_path}/cr", args: ["catalog", "update"], must_succeed: false
-          opoo "cr catalog update failed; run `cr catalog update` to refresh the model catalog." unless result&.success?
     caveats: |
       To configure cr, follow the setup examples in the README:
         https://github.com/open-cli-collective/codereview-cli#authentication-and-setup
@@ -124,6 +122,9 @@ homebrew_casks:
       Secrets are stored in the OS credential store. They are never written to
       config.yml.
 
+      cr ships with a bundled model catalog. Run `cr catalog update` to fetch
+      the latest one.
+
 checksum:
   name_template: "checksums.txt"
 
diff --git a/scripts/verify-package-render.sh b/scripts/verify-package-render.sh
index b5e2762f..bdccdac3 100755
--- a/scripts/verify-package-render.sh
+++ b/scripts/verify-package-render.sh
@@ -40,65 +40,24 @@ require_grep 'binary "cr"' "$cask"
 require_grep 'open-cli-collective/codereview-cli/releases/download/v' "$cask"
 require_grep 'cr_v#{version}_darwin_arm64.tar.gz' "$cask"
 require_grep 'cr_v#{version}_darwin_amd64.tar.gz' "$cask"
-require_grep 'args: ["catalog", "update"]' "$cask"
-require_grep 'must_succeed: false' "$cask"
-require_grep 'cr catalog update failed; run `cr catalog update`' "$cask"
+require_grep '"com.apple.quarantine", "#{staged_path}/cr"' "$cask"
 
-# Exercise the rendered Ruby control flow as well as checking its source. The
-# updater is warning-only during package installation, so a failed refresh
-# must call opoo without raising or skipping the command.
+# The shared release workflow rewrites this legacy postflight block into
+# Homebrew's install-step DSL, which has no system_command, by turning each line
+# that starts with system_command into a run step. Any other statement survives
+# the rewrite and makes Homebrew reject the whole cask as invalid.
 ruby - "$cask" <<'RUBY'
-path = ARGV.fetch(0)
-source = File.read(path)
+source = File.read(ARGV.fetch(0))
 body = source[/  postflight do\n(.*?)\n  end/m, 1]
 raise "postflight body missing" unless body
 
-HookResult = Struct.new(:ok) do
-  def success?
-    ok
-  end
-end
-
-class HookHarness
-  attr_reader :calls, :warnings
-
-  def initialize(fail_refresh)
-    @fail_refresh = fail_refresh
-    @calls = []
-    @warnings = []
-  end
-
-  def staged_path
-    "/tmp/staged"
-  end
+body.each_line do |line|
+  next if line.strip.empty?
+  next if line.match?(/\A\s*system_command\s/)
 
-  def system_command(command, args:, must_succeed: true)
-    @calls << {command: command, args: args, must_succeed: must_succeed}
-    failed_refresh = @fail_refresh && command == "#{staged_path}/cr"
-    HookResult.new(!failed_refresh)
-  end
-
-  def opoo(message)
-    @warnings << message
-  end
-
-  def run(rendered_body)
-    instance_eval(rendered_body, "rendered-cask", 1)
-  end
+  raise "postflight line is not a bare system_command call: #{line.strip}"
 end
-
-success = HookHarness.new(false)
-success.run(body)
-raise "success path did not invoke both commands" unless success.calls.length == 2
-raise "success path emitted a warning" unless success.warnings.empty?
-raise "refresh command is not warning-only" unless success.calls.last[:must_succeed] == false
-
-failure = HookHarness.new(true)
-failure.run(body)
-raise "failure path did not invoke both commands" unless failure.calls.length == 2
-raise "failure path did not warn" unless failure.warnings.length == 1
-raise "failure path did not keep refresh warning-only" unless failure.calls.last[:must_succeed] == false
-puts "rendered package hook behavior check OK"
+puts "rendered package hook check OK"
 RUBY
 
 for kind in deb rpm pkg.tar.zst; do