diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ec787a6..5d167cc 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -68,6 +68,10 @@ jobs:
           tar -czf builds/notalterra-${GITHUB_REF_NAME}-linux-amd64.tar.gz notalterra
           cp target/x86_64-pc-windows-gnu/release/notalterra.exe NotAlterra.exe
           zip -q builds/notalterra-${GITHUB_REF_NAME}-windows-x64.zip NotAlterra.exe
+      - name: Generate SBOM
+        run: |
+          cargo cyclonedx --all --output-dir builds
+          mv builds/notalterra-*.cdx.json builds/notalterra-${GITHUB_REF_NAME}-sbom.cdx.json 2>/dev/null || true
       - name: Generate hashes
         id: hash
         run: |
diff --git a/docs/GOVERNANCE.md b/docs/GOVERNANCE.md
index fea0c13..abc2a26 100644
--- a/docs/GOVERNANCE.md
+++ b/docs/GOVERNANCE.md
@@ -83,6 +83,10 @@ not published. The maintainer tests the draft binaries before publishing.
 
 > CodeQL static analysis is enabled on every push and pull request.
 > Alerts are reviewed before release. Currently zero open alerts.
+>
+> An SBOM (CycloneDX JSON) is generated during every tagged release
+> and included alongside the binaries. It lists every crate in the
+> dependency tree, versions, and licenses.
 
 Before signing a release tag, the maintainer verifies: