diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml
deleted file mode 100644
index 6d50ee98..00000000
--- a/.github/workflows/sbom.yml
+++ /dev/null
@@ -1,34 +0,0 @@
----
-name: Generate SBOMs
-
-on:
-  push:
-    tags:
-      - 'v*'
-
-jobs:
-  sbom:
-    permissions:
-      id-token: write
-      contents: read
-      attestations: write
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Upload SBOM
-        uses: sbomify/github-action@master
-        env:
-          TOKEN: ${{ secrets.SBOMIFY_TOKEN }}
-          COMPONENT_ID: 'UUzAdk8ixV'
-          LOCK_FILE: 'Cargo.lock'
-          SBOM_VERSION: ${{ github.ref_name }}
-          OUTPUT_FILE: 'cli.cdx.json'
-          OVERRIDE_NAME: true
-          AUGMENT: true
-          ENRICH: true
-
-      - name: Attest
-        uses: actions/attest-build-provenance@v1
-        with:
-          subject-path: '${{ github.workspace }}/cli.cdx.json'
diff --git a/.github/workflows/sboms.yml b/.github/workflows/sboms.yml
new file mode 100644
index 00000000..6df393ab
--- /dev/null
+++ b/.github/workflows/sboms.yml
@@ -0,0 +1,70 @@
+# Generated by `sbomify-action wizard`. Re-run the wizard to update.
+# sbomify-action wizard v26.7.0
+name: sboms
+on:
+  push:
+    tags: ['v*', '[0-9]*']
+  workflow_dispatch:
+jobs:
+  sbom:
+    name: ${{ matrix.name }}
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write   # required to mint the GitHub OIDC JWT
+      contents: read
+      attestations: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: cli
+            component_name: CLI
+            component_id: UUzAdk8ixV
+            lockfile: Cargo.lock
+            sbom_format: cyclonedx
+            output_file: cli.cdx.json
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
+        with:
+          path: .sbomify-cache
+          key: sbomify-${{ runner.os }}
+      - id: ver
+        run: |
+          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
+            echo "v=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"
+          else
+            echo "v=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
+          fi
+      - uses: sbomify/sbomify-action@ddf6a0d3d75b645153ad1ad60034b3fe2cb1eb63  # v26.7.0
+        env:
+          COMPONENT_ID: ${{ matrix.component_id }}
+          COMPONENT_NAME: ${{ matrix.component_name }}
+          COMPONENT_VERSION: ${{ steps.ver.outputs.v }}
+          LOCK_FILE: ${{ matrix.lockfile }}
+          UPLOAD: 'true'
+          AUGMENT: 'true'
+          ENRICH: 'true'
+          SBOM_FORMAT: ${{ matrix.sbom_format }}
+          OUTPUT_FILE: ${{ matrix.output_file }}
+          API_BASE_URL: https://app.sbomify.com
+          SBOMIFY_CACHE_DIR: ${{ github.workspace }}/.sbomify-cache
+          SYFT_CACHE_DIR: ${{ github.workspace }}/.sbomify-cache/syft
+          PRODUCT_RELEASE: '["44WZdk8ixV:${{ steps.ver.outputs.v }}"]'
+      # ---------------------------------------------------------------------
+      # Build-provenance attestation (SLSA v1)
+      # ---------------------------------------------------------------------
+      # Where this step is supported:
+      #   * Public repository on any GitHub plan (Free, Pro, Team, Enterprise)
+      #     — uses the public-good Sigstore instance (Fulcio + Rekor public log).
+      #   * Private / internal repository on GitHub Enterprise Cloud
+      #     — uses GitHub's private Sigstore instance (scoped to the repo).
+      # Where it is NOT supported and the workflow will fail:
+      #   * Private / internal repository on GitHub Free, Pro, or Team.
+      #   * Any repository on GitHub Enterprise Server (self-hosted).
+      # If you hit one of the unsupported configurations, either upgrade to
+      # GitHub Enterprise Cloud, make the repo public, or remove this step.
+      # Reference: https://github.com/actions/attest-build-provenance
+      - uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  # v4.1.0
+        with:
+          subject-path: '${{ github.workspace }}/${{ matrix.output_file }}'