diff --git a/.github/workflows/linux-release.yml b/.github/workflows/linux-release.yml
index 447952a..7168931 100644
--- a/.github/workflows/linux-release.yml
+++ b/.github/workflows/linux-release.yml
@@ -12,6 +12,8 @@ permissions:
 jobs:
   bootstrap:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - name: Checkout
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0
@@ -54,14 +56,9 @@ jobs:
             ochenstarik-server-monitor-manager.sh.sha256
             server-monitor-manager-bootstrap-manifest.json
 
-      - name: Generate SBOM (bootstrap)
-        run: dotnet tool install --global CycloneDX && dotnet CycloneDX ServerMonitorManager.slnx -o sbom -j --filename server-monitor-manager-bootstrap-sbom || true
-
       - name: Attach bootstrap to GitHub Release
         if: startsWith(github.ref, 'refs/tags/')
         uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65  # v2.6.2
-        permissions:
-          contents: write
         with:
           prerelease: ${{ contains(github.ref_name, '-') }}
           files: |
@@ -71,6 +68,8 @@ jobs:
 
   publish:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     strategy:
       matrix:
         runtime: [linux-x64, linux-arm64]
@@ -111,7 +110,7 @@ jobs:
       - name: Generate SBOM
         run: |
           dotnet tool install --global CycloneDX
-          dotnet CycloneDX ServerMonitorManager.slnx -o . -j --filename "server-monitor-manager-${{ matrix.runtime }}-sbom" || true
+          dotnet CycloneDX ServerMonitorManager.slnx -o . -j --filename "server-monitor-manager-${{ matrix.runtime }}-sbom"
 
       - name: Upload artifact
         uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
@@ -120,14 +119,14 @@ jobs:
           path: |
             server-monitor-manager-${{ matrix.runtime }}.tar.gz
             server-monitor-manager-${{ matrix.runtime }}.tar.gz.sha256
+            server-monitor-manager-${{ matrix.runtime }}-sbom.json
 
       - name: Attach to GitHub Release
         if: startsWith(github.ref, 'refs/tags/')
         uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65  # v2.6.2
-        permissions:
-          contents: write
         with:
           prerelease: ${{ contains(github.ref_name, '-') }}
           files: |
             server-monitor-manager-${{ matrix.runtime }}.tar.gz
             server-monitor-manager-${{ matrix.runtime }}.tar.gz.sha256
+            server-monitor-manager-${{ matrix.runtime }}-sbom.json
diff --git a/.github/workflows/windows-release.yml b/.github/workflows/windows-release.yml
index 38a4c0d..54b5e6c 100644
--- a/.github/workflows/windows-release.yml
+++ b/.github/workflows/windows-release.yml
@@ -12,6 +12,8 @@ permissions:
 jobs:
   package:
     runs-on: windows-latest
+    permissions:
+      contents: write
     env:
       SIGNING_CERTIFICATE_BASE64: ${{ secrets.WINDOWS_SIGNING_CERTIFICATE_BASE64 }}
       SIGNING_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_SIGNING_CERTIFICATE_PASSWORD }}
@@ -65,10 +67,10 @@ jobs:
           if ($actual -ne $expected) { throw 'Windows installer checksum mismatch.' }
 
       - name: Generate SBOM
+        shell: bash
         run: |
           dotnet tool install --global CycloneDX
-          dotnet CycloneDX ServerMonitorManager.slnx -o . -j --filename server-monitor-manager-win-x64-sbom || true
-        shell: bash
+          dotnet CycloneDX ServerMonitorManager.slnx -o . -j --filename server-monitor-manager-win-x64-sbom
 
       - name: Upload installer artifact
         uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
@@ -78,16 +80,16 @@ jobs:
             artifacts/windows-installer/ServerMonitorManager-win-x64.msix
             artifacts/windows-installer/ServerMonitorManager-test-signing.cer
             artifacts/windows-installer/SHA256SUMS
+            server-monitor-manager-win-x64-sbom.json
           if-no-files-found: error
 
       - name: Attach installer to GitHub Release
         if: startsWith(github.ref, 'refs/tags/')
         uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65  # v2.6.2
-        permissions:
-          contents: write
         with:
           prerelease: ${{ contains(github.ref_name, '-') }}
           files: |
             artifacts/windows-installer/ServerMonitorManager-win-x64.msix
             artifacts/windows-installer/ServerMonitorManager-test-signing.cer
             artifacts/windows-installer/SHA256SUMS
+            server-monitor-manager-win-x64-sbom.json