diff --git a/.github/workflows/sbom.yaml b/.github/workflows/sbom.yaml
deleted file mode 100644
index df6d38f01..000000000
--- a/.github/workflows/sbom.yaml
+++ /dev/null
@@ -1,69 +0,0 @@
-name: Build SBOMs
-
-on:
-  push:
-    branches:
-      - master
-    paths:
-      - 'bun.lock'
-      - 'uv.lock'
-    tags:
-      - 'v*'
-
-jobs:
-  run-tests:
-    uses: ./.github/workflows/docker-test.yaml
-
-  js-sbom:
-    needs: run-tests
-    runs-on: ubuntu-24.04
-    permissions:
-      id-token: write
-      contents: read
-      attestations: write
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-
-      - name: Build and upload SBOM
-        uses: sbomify/github-action@master
-        env:
-          COMPONENT_ID: 'LCkvzm8qaL'
-          COMPONENT_VERSION: ${{ github.ref_type == 'tag' && github.ref_name || github.sha }}
-          LOCK_FILE: 'bun.lock'
-          AUGMENT: true
-          UPLOAD: true
-          OUTPUT_FILE: js.cdx.json
-
-      - name: Attest
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4
-        with:
-          subject-path: '${{ github.workspace }}/*.cdx.json'
-
-  python-sbom:
-    needs: run-tests
-    runs-on: ubuntu-24.04
-    permissions:
-      id-token: write
-      contents: read
-      attestations: write
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-
-      - name: Build and upload SBOM
-        uses: sbomify/github-action@master
-        env:
-          COMPONENT_ID: 'Vhc4zm8pdV'
-          COMPONENT_VERSION: ${{ github.ref_type == 'tag' && github.ref_name || github.sha }}
-          LOCK_FILE: 'uv.lock'
-          AUGMENT: true
-          UPLOAD: true
-          OUTPUT_FILE: python.cdx.json
-
-      - name: Attest
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4
-        with:
-          subject-path: '${{ github.workspace }}/*.cdx.json'
diff --git a/.github/workflows/sboms.yml b/.github/workflows/sboms.yml
new file mode 100644
index 000000000..8b1b53be1
--- /dev/null
+++ b/.github/workflows/sboms.yml
@@ -0,0 +1,82 @@
+# Generated by `sbomify-action wizard`. Re-run the wizard to update.
+# sbomify-action wizard v1
+name: sboms
+on:
+  push:
+    tags: ['v*']
+  workflow_dispatch:
+jobs:
+  sbom:
+    name: ${{ matrix.name }}
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write   # required to mint the GitHub OIDC JWT
+      contents: read
+      attestations: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: anthias-javascript
+            component_name: Anthias - JavaScript
+            component_id: LCkvzm8qaL
+            lockfile: bun.lock
+            sbom_format: cyclonedx
+            output_file: anthias-javascript.cdx.json
+          - name: anthias-python
+            component_name: Anthias - Python
+            component_id: Vhc4zm8pdV
+            lockfile: uv.lock
+            sbom_format: cyclonedx
+            output_file: anthias-python.cdx.json
+          - name: anthias-marketing-site
+            component_name: Anthias - Marketing Site
+            component_id: DAAUcQBwTx6P
+            lockfile: website/bun.lock
+            sbom_format: cyclonedx
+            output_file: anthias-marketing-site.cdx.json
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
+        with:
+          path: .sbomify-cache
+          key: sbomify-${{ runner.os }}
+      - id: ver
+        run: |
+          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
+            echo "v=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"
+          else
+            echo "v=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
+          fi
+      - uses: sbomify/sbomify-action@ac8b0d423c90447f3011ef8ab5f9ff2e854c6931  # v26.2.0
+        env:
+          COMPONENT_ID: ${{ matrix.component_id }}
+          COMPONENT_NAME: ${{ matrix.component_name }}
+          COMPONENT_VERSION: ${{ steps.ver.outputs.v }}
+          LOCK_FILE: ${{ matrix.lockfile }}
+          UPLOAD: 'true'
+          AUGMENT: 'true'
+          ENRICH: 'true'
+          SBOM_FORMAT: ${{ matrix.sbom_format }}
+          OUTPUT_FILE: ${{ matrix.output_file }}
+          API_BASE_URL: https://app.sbomify.com
+          SBOMIFY_CACHE_DIR: ${{ github.workspace }}/.sbomify-cache
+          SYFT_CACHE_DIR: ${{ github.workspace }}/.sbomify-cache/syft
+          PRODUCT_RELEASE: '["HQRDDqHBiQH5:${{ steps.ver.outputs.v }}"]'
+      # ---------------------------------------------------------------------
+      # Build-provenance attestation (SLSA v1)
+      # ---------------------------------------------------------------------
+      # Where this step is supported:
+      #   * Public repository on any GitHub plan (Free, Pro, Team, Enterprise)
+      #     — uses the public-good Sigstore instance (Fulcio + Rekor public log).
+      #   * Private / internal repository on GitHub Enterprise Cloud
+      #     — uses GitHub's private Sigstore instance (scoped to the repo).
+      # Where it is NOT supported and the workflow will fail:
+      #   * Private / internal repository on GitHub Free, Pro, or Team.
+      #   * Any repository on GitHub Enterprise Server (self-hosted).
+      # If you hit one of the unsupported configurations, either upgrade to
+      # GitHub Enterprise Cloud, make the repo public, or remove this step.
+      # Reference: https://github.com/actions/attest-build-provenance
+      - uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  # v4.1.0
+        with:
+          subject-path: '${{ github.workspace }}/${{ matrix.output_file }}'