diff --git a/.github/workflows/build-attested.yaml b/.github/workflows/build-attested.yaml
index a355b5910..35dd43961 100644
--- a/.github/workflows/build-attested.yaml
+++ b/.github/workflows/build-attested.yaml
@@ -75,6 +75,11 @@ jobs:
       - name: Build and attest
         env:
           GOFLAGS: -mod=vendor
+          # The brews pipe templates {{ .Env.HOMEBREW_DEPLOY_KEY }}; goreleaser
+          # errors on a missing env key. Provide it empty so skip_upload evaluates
+          # true and the Homebrew tap publish is skipped. on-tag.yaml supplies the
+          # real secret for production releases.
+          HOMEBREW_DEPLOY_KEY: ""
         run: |
           set -euo pipefail
           goreleaser release --snapshot --clean --skip=publish,ko,sbom --timeout 20m