diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 361c47ae7..c56b41ac3 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -42,6 +42,13 @@ jobs:
     needs: npm
     runs-on: macos-latest
     steps:
+      # Ensure things are up to date
+      # Suggested by homebrew maintainers
+      # https://github.com/Homebrew/discussions/discussions/1532#discussioncomment-782633
+      - name: Set up Homebrew
+        id: set-up-homebrew
+        uses: Homebrew/actions/setup-homebrew@master
+
       - uses: actions/checkout@v2
       - name: Configure git
         run: |
diff --git a/ci/steps/brew-bump.sh b/ci/steps/brew-bump.sh
index e16ab5597..ec0704cda 100755
--- a/ci/steps/brew-bump.sh
+++ b/ci/steps/brew-bump.sh
@@ -29,7 +29,11 @@ main() {
   # Source: https://serverfault.com/a/912788
   # shellcheck disable=SC2016,SC2028
   echo '#!/bin/sh\nexec echo "$HOMEBREW_GITHUB_API_TOKEN"' >"$HOME"/.git-askpass.sh
-  GIT_ASKPASS="$HOME/.git-askpass.sh" git push https://cdrci@github.com/cdrci/homebrew-core.git --all
+  # Ensure it's executable since we just created it
+  chmod +x "$HOME/.git-askpass.sh"
+  # GIT_ASKPASS lets us use the password when pushing without revealing it in the process list
+  # See: https://serverfault.com/a/912788
+  GIT_ASKPASS="$HOME/.git-askpass.sh" git push https://cdr-oss@github.com/cdr-oss/homebrew-core.git --all
 
   # Find the docs for bump-formula-pr here
   # https://github.com/Homebrew/brew/blob/master/Library/Homebrew/dev-cmd/bump-formula-pr.rb#L18