diff --git a/.gitignore b/.gitignore
index 2b42ed7..81d57b9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -19,6 +19,9 @@ artemis-console-extension/artemis-extension/node/**/*
 artemis-console-extension/artemis-extension/packages/artemis-console-plugin/node_modules/
 artemis-console-extension/artemis-extension/app/node_modules/**/*
 
+# generated SBOM
+artemis-console-extension/artemis-extension/bom.cdx.json
+
 # yarn (zero-installs)
 artemis-console-extension/artemis-extension/.yarn/install-state.gz
 .yarn/**
diff --git a/artemis-console-extension/artemis-extension/package.json b/artemis-console-extension/artemis-extension/package.json
index 4ce5006..ab3d6d0 100644
--- a/artemis-console-extension/artemis-extension/package.json
+++ b/artemis-console-extension/artemis-extension/package.json
@@ -1,6 +1,6 @@
 {
   "name": "artemis-console-monorepo",
-  "version": "0",
+  "version": "0.0.0",
   "description": "Artemis Console Monorepo",
   "license": "Apache-2.0",
   "private": true,
diff --git a/artemis-console-extension/pom.xml b/artemis-console-extension/pom.xml
index 518ccf6..7dd899d 100644
--- a/artemis-console-extension/pom.xml
+++ b/artemis-console-extension/pom.xml
@@ -78,6 +78,36 @@
                             <arguments>yarn build</arguments>
                         </configuration>
                     </execution>
+                    <!--
+                        Generate a CycloneDX SBOM for all npm dependencies
+                        using the official CycloneDX Yarn plugin. Resolves
+                        licenses from package.json in node_modules.
+                    -->
+                    <execution>
+                        <id>generate-sbom</id>
+                        <goals>
+                            <goal>corepack</goal>
+                        </goals>
+                        <configuration>
+                            <arguments>yarn workspace artemis-console-app dlx @cyclonedx/yarn-plugin-cyclonedx@3.3.3 --spec-version 1.6 --output-file ../bom.cdx.json</arguments>
+                        </configuration>
+                    </execution>
+                    <!--
+                        Enrich the SBOM:
+                        - add SHA-512 hashes from yarn.lock;
+                        - add evidence.identity;
+                        - -prod-only excludes non-production dependencies entirely;
+                        - omitting -prod-only sets scope=excluded for non-prod dependencies.
+                    -->
+                    <execution>
+                        <id>enrich-sbom</id>
+                        <goals>
+                            <goal>corepack</goal>
+                        </goals>
+                        <configuration>
+                            <arguments>yarn dlx @cyberstamp/cdx-npm-enrich@0.1.5 --prod-only bom.cdx.json</arguments>
+                        </configuration>
+                    </execution>
                     <execution>
                         <id>yarn test</id>
                         <goals>
@@ -117,6 +147,12 @@
                             </includes>
                             <followSymlinks>false</followSymlinks>
                         </fileset>
+                        <fileset>
+                            <directory>${basedir}/${extension.path}</directory>
+                            <includes>
+                                <include>bom.cdx.json</include>
+                            </includes>
+                        </fileset>
                     </filesets>
                 </configuration>
             </plugin>
diff --git a/artemis-console-war/pom.xml b/artemis-console-war/pom.xml
index 1cb0743..bcd6124 100644
--- a/artemis-console-war/pom.xml
+++ b/artemis-console-war/pom.xml
@@ -76,6 +76,15 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-war-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>prepare-war</id>
+                        <phase>prepare-package</phase>
+                        <goals>
+                            <goal>exploded</goal>
+                        </goals>
+                    </execution>
+                </executions>
                 <configuration>
                 <nonFilteredFileExtensions>
                     <!-- default value contains jpg,jpeg,gif,bmp,png -->
@@ -92,10 +101,36 @@
                                 <include>**/*.*</include>
                             </includes>
                         </resource>
+                        <resource>
+                            <filtering>false</filtering>
+                            <directory>${project.build.directory}</directory>
+                            <targetPath>META-INF/sbom</targetPath>
+                            <includes>
+                                <include>bom.cdx.json</include>
+                            </includes>
+                        </resource>
                     </webResources>
                 </configuration>
             </plugin>
 
+            <plugin>
+                <groupId>dev.cyberstamp.maven.assembly.sbom</groupId>
+                <artifactId>assembly-sbom-maven-plugin</artifactId>
+                <version>0.1.1</version>
+                <executions>
+                    <execution>
+                        <phase>prepare-package</phase>
+                        <goals>
+                            <goal>generate</goal>
+                        </goals>
+                        <configuration>
+                            <externalSboms>${project.basedir}/../artemis-console-extension/artemis-extension/bom.cdx.json</externalSboms>
+                            <outputFile>${project.build.directory}/bom.cdx.json</outputFile>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
+
             <plugin>
                 <groupId>org.eclipse.jetty.ee11</groupId>
                 <artifactId>jetty-ee11-maven-plugin</artifactId>
diff --git a/pom.xml b/pom.xml
index 01cf11d..0c00be3 100644
--- a/pom.xml
+++ b/pom.xml
@@ -244,6 +244,9 @@
                             <exclude>**/tsconfig.json</exclude>
                             <exclude>**/artemis-extension/app/build/**</exclude>
                             <exclude>**/artemis-extension/packages/artemis-console-plugin/dist/**</exclude>
+
+                            <!-- Generated SBOM -->
+                            <exclude>**/bom.cdx.json</exclude>
                         </excludes>
                     </configuration>
                 </plugin>