diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index d0b3890..cc2b45a 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -28,6 +28,9 @@ jobs:
       - name: Build
         run: go build -v .
 
+      - name: Setup Syft
+        uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+
       - name: Run goreleaser in release mode
         if: success() && startsWith(github.ref, 'refs/tags/v')
         uses: goreleaser/goreleaser-action@v7
diff --git a/.goreleaser.yml b/.goreleaser.yml
index c07ae82..2f6a869 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -3,6 +3,9 @@ version: 2
 before:
   hooks:
     - go mod download
+sboms:
+  - artifacts: binary
+    args: ["$artifact", "--output", "cyclonedx-json=$document"]
 builds:
   - env:
       - CGO_ENABLED=0