diff --git a/.github/workflows/goreleaser.yml b/.github/workflows/goreleaser.yml
index 709c97adff..fed806a582 100644
--- a/.github/workflows/goreleaser.yml
+++ b/.github/workflows/goreleaser.yml
@@ -16,6 +16,8 @@ jobs:
     steps:
       - name: Cosign install
         uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
+      - name: Syft install
+        uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
       - name: Maximize build space
         uses: AdityaGarg8/remove-unwanted-software@90e01b21170618765a73370fcc3abbd1684a7793 # v5
         with:
diff --git a/.goreleaser.yml b/.goreleaser.yml
index 7c5e1059f8..31afc992cb 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -160,6 +160,13 @@ archives:
   - README*
   - CHANGELOG.md
 
+sboms:
+- artifacts: archive
+  cmd: syft
+  args: ["${artifact}", "--output", "spdx-json=${document}"]
+  documents:
+  - '{{ .ArtifactName }}.sbom.spdx.json'
+
 snapshot:
   version_template: SNAPSHOT-{{ .Commit }}