diff --git a/apps/server/src/provider/providerMaintenance.test.ts b/apps/server/src/provider/providerMaintenance.test.ts
index 5683da2c1a82..50787fe2a473 100644
--- a/apps/server/src/provider/providerMaintenance.test.ts
+++ b/apps/server/src/provider/providerMaintenance.test.ts
@@ -321,11 +321,11 @@ it.layer(NodeServices.layer)("providerMaintenance", (it) => {
       provider: driver("packageTool"),
       packageName: "@example/package-tool",
       update: {
-        command: "brew upgrade package-tool",
+        command: "brew upgrade --no-quarantine package-tool",
 
         executable: "brew",
 
-        args: ["upgrade", "package-tool"],
+        args: ["upgrade", "--no-quarantine", "package-tool"],
 
         lockKey: "homebrew",
       },
@@ -418,11 +418,11 @@ it.layer(NodeServices.layer)("providerMaintenance", (it) => {
       provider: driver("nativePackageTool"),
       packageName: "@example/native-package-tool",
       update: {
-        command: "brew upgrade native-package-tool",
+        command: "brew upgrade --no-quarantine native-package-tool",
 
         executable: "brew",
 
-        args: ["upgrade", "native-package-tool"],
+        args: ["upgrade", "--no-quarantine", "native-package-tool"],
 
         lockKey: "homebrew",
       },
@@ -441,11 +441,11 @@ it.layer(NodeServices.layer)("providerMaintenance", (it) => {
       provider: driver("scopedPackageTool"),
       packageName: "@example/scoped-package-tool",
       update: {
-        command: "brew upgrade example/tap/scoped-package-tool",
+        command: "brew upgrade --no-quarantine example/tap/scoped-package-tool",
 
         executable: "brew",
 
-        args: ["upgrade", "example/tap/scoped-package-tool"],
+        args: ["upgrade", "--no-quarantine", "example/tap/scoped-package-tool"],
 
         lockKey: "homebrew",
       },
diff --git a/apps/server/src/provider/providerMaintenance.ts b/apps/server/src/provider/providerMaintenance.ts
index 14d17cf365c3..09e9d31b2811 100644
--- a/apps/server/src/provider/providerMaintenance.ts
+++ b/apps/server/src/provider/providerMaintenance.ts
@@ -202,7 +202,11 @@ function makeHomebrewProviderMaintenanceCapabilities(
     provider: definition.provider,
     packageName: definition.npmPackageName,
     updateExecutable: "brew",
-    updateArgs: ["upgrade", definition.homebrewFormula],
+    // Cask upgrades quarantine the new binary by default. macOS then blocks
+    // the next exec behind a Gatekeeper approval prompt, which the T3 server
+    // cannot answer, so the provider probe hangs until a human approves the
+    // binary. --no-quarantine skips that and is a no-op for formulae.
+    updateArgs: ["upgrade", "--no-quarantine", definition.homebrewFormula],
     updateLockKey: "homebrew",
   });
 }