diff --git a/.github/workflows/bump-homebrew.yml b/.github/workflows/bump-homebrew.yml
index def09d1..08fe25b 100644
--- a/.github/workflows/bump-homebrew.yml
+++ b/.github/workflows/bump-homebrew.yml
@@ -12,6 +12,11 @@ on:
         description: "Version to bump to."
         required: true
         type: string
+      dry_run:
+        description: "Validate the bump without opening a tap PR."
+        required: false
+        default: false
+        type: boolean
     secrets:
       TAP_BOT_APP_ID:
         required: true
@@ -24,6 +29,11 @@ on:
         description: "Version to bump to (e.g. 0.40.0). Defaults to latest on PyPI."
         required: false
         type: string
+      dry_run:
+        description: "Validate the bump without opening a tap PR."
+        required: false
+        default: false
+        type: boolean
 
 permissions:
   contents: read
@@ -119,7 +129,6 @@ jobs:
 
       - name: Update url + sha256 and regenerate resources
         env:
-          HOMEBREW_NO_INSTALL_FROM_API: "1"
           HOMEBREW_NO_REQUIRE_TAP_TRUST: "1"
           SDIST_URL: ${{ steps.sdist.outputs.url }}
           SDIST_SHA: ${{ steps.sdist.outputs.sha256 }}
@@ -174,7 +183,6 @@ jobs:
 
       - name: Validate the formula
         env:
-          HOMEBREW_NO_INSTALL_FROM_API: "1"
           HOMEBREW_NO_REQUIRE_TAP_TRUST: "1"
         run: |
           set -euo pipefail
@@ -182,6 +190,7 @@ jobs:
           brew audit --formula "${FORMULA}"
 
       - name: Open the bump PR
+        if: ${{ !inputs.dry_run }}
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
           VERSION: ${{ steps.ver.outputs.version }}
@@ -191,7 +200,8 @@ jobs:
           BRANCH="bump-sccfm-cli-${VERSION}"
 
           create_pr() {
-            gh pr create \
+            local pr_url
+            pr_url="$(gh pr create \
               --repo "${TAP_REPO}" \
               --base main \
               --head "$BRANCH" \
@@ -201,7 +211,9 @@ jobs:
             - url + sha256 updated from PyPI (\`${PYPI_NAME}\` ${VERSION})
             - resource blocks regenerated with \`brew update-python-resources\`
 
-            Opened by the release workflow in \`${GITHUB_REPOSITORY}\`."
+            Opened by the release workflow in \`${GITHUB_REPOSITORY}\`.")"
+            echo "Opened ${pr_url}"
+            gh pr merge --auto --squash --delete-branch "${pr_url}"
           }
 
           if git ls-remote --exit-code --heads origin "$BRANCH" >/dev/null 2>&1; then
@@ -213,6 +225,7 @@ jobs:
               --jq '.[0].url // empty')"
             if [ -n "${EXISTING_PR}" ]; then
               echo "Branch ${BRANCH} already has an open PR: ${EXISTING_PR}"
+              gh pr merge --auto --squash --delete-branch "${EXISTING_PR}"
               exit 0
             fi
             echo "Branch ${BRANCH} exists without an open PR; creating one."
diff --git a/sccfm-ansible/CHANGELOG.rst b/sccfm-ansible/CHANGELOG.rst
index 74f84c5..b531c6e 100644
--- a/sccfm-ansible/CHANGELOG.rst
+++ b/sccfm-ansible/CHANGELOG.rst
@@ -4,6 +4,14 @@ Cisco SCCFM Collection Release Notes
 
 .. contents:: Topics
 
+v0.40.2
+========
+
+Bugfixes
+--------
+
+- Corrected Homebrew release automation to resolve Core dependencies through the Formula API, support dry-run validation, and enable protected automatic merging of successful tap updates.
+
 v0.40.1
 ========
 
diff --git a/sccfm-ansible/changelogs/changelog.yaml b/sccfm-ansible/changelogs/changelog.yaml
index 0a1b415..d347a38 100644
--- a/sccfm-ansible/changelogs/changelog.yaml
+++ b/sccfm-ansible/changelogs/changelog.yaml
@@ -2,6 +2,14 @@
 ancestor: null
 # sccfm-release-retarget-seed: 0.39.0
 releases:
+  0.40.2:
+    changes:
+      bugfixes:
+        - Corrected Homebrew release automation to resolve Core dependencies through
+          the Formula API, support dry-run validation, and enable protected automatic
+          merging of successful tap updates.
+    fragments: []
+    release_date: '2026-09-01'
   0.40.1:
     changes:
       minor_changes:
diff --git a/tests/test_release_artifacts.py b/tests/test_release_artifacts.py
index 5bee45c..f265817 100644
--- a/tests/test_release_artifacts.py
+++ b/tests/test_release_artifacts.py
@@ -191,6 +191,7 @@ def test_workflows_separate_automatic_preparation_from_manual_deployment() -> No
     repository = Path(__file__).resolve().parents[1]
     ci = (repository / ".github/workflows/ci.yml").read_text(encoding="utf-8")
     release = (repository / ".github/workflows/release.yml").read_text(encoding="utf-8")
+    homebrew = (repository / ".github/workflows/bump-homebrew.yml").read_text(encoding="utf-8")
 
     prepare = _workflow_job(ci, "prepare-release")
     draft = _workflow_job(ci, "create-draft-release")
@@ -298,6 +299,13 @@ def test_workflows_separate_automatic_preparation_from_manual_deployment() -> No
     assert release.count("actions/upload-artifact@v7") == 1
     assert release.count("actions/download-artifact@v7") == 2
 
+    assert homebrew.count("type: boolean") == 2
+    assert 'description: "Validate the bump without opening a tap PR."' in homebrew
+    assert "HOMEBREW_NO_INSTALL_FROM_API" not in homebrew
+    assert "if: ${{ !inputs.dry_run }}" in homebrew
+    assert "brew update-python-resources" in homebrew
+    assert homebrew.count("gh pr merge --auto --squash --delete-branch") == 2
+
     assert "pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33" in pypi
     assert "pypa/gh-action-pypi-publish@release/v1" not in pypi
     assert "secrets.PYPI_API_TOKEN" in pypi