I prefer to keep most of my homebrew stuff (especially casks) in a nix-managed Brewfile with some logic about when to run/update.