diff --git a/package-lists/build/main.pkgs b/package-lists/build/main.pkgs
index 429b5c7..1fa2a34 100644
--- a/package-lists/build/main.pkgs
+++ b/package-lists/build/main.pkgs
@@ -7,6 +7,7 @@ challenge-response
 cloud-init
 crash-python
 crypt-blowfish
+cyclonedx-cli
 delphix-go
 delphix-platform
 delphix-rust
@@ -28,6 +29,8 @@ ptools
 python-rtslib-fb
 savedump
 sdb
+# see the cyclonedx-cli comment above -- same build-host-only rule applies here.
+syft
 targetcli-fb
 virtualization
 windows-connector
diff --git a/packages/cyclonedx-cli/config.sh b/packages/cyclonedx-cli/config.sh
new file mode 100755
index 0000000..d081b53
--- /dev/null
+++ b/packages/cyclonedx-cli/config.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+#
+# Copyright 2026 Delphix
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# shellcheck disable=SC2034
+
+DEFAULT_PACKAGE_GIT_URL="https://github.com/delphix/cyclonedx-cli.git"
+
+function build() {
+	logmust mkdir -p "$WORKDIR/repo"
+
+	#
+	# Instead of relying on linux-pkg to assign a default version like 1.0.0, set the
+	# version of the delphix-cyclonedx-cli package to the pinned cyclonedx-cli version.
+	# This is done so that "apt-cache policy delphix-cyclonedx-cli" on a build host can
+	# tell you which cyclonedx-cli actually validated a given CycloneDX SBOM.
+	#
+	PACKAGE_VERSION="$(tr -d '\n' <"$WORKDIR/repo/CYCLONEDX_VERSION")"
+	[[ -n "$PACKAGE_VERSION" ]] || die "Failed to retrieve package version"
+
+	logmust dpkg_buildpackage_default
+}
diff --git a/packages/syft/config.sh b/packages/syft/config.sh
new file mode 100755
index 0000000..9ba72f8
--- /dev/null
+++ b/packages/syft/config.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+#
+# Copyright 2026 Delphix
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# shellcheck disable=SC2034
+
+DEFAULT_PACKAGE_GIT_URL="https://github.com/delphix/syft.git"
+
+function build() {
+	logmust mkdir -p "$WORKDIR/repo"
+
+	#
+	# Instead of relying on linux-pkg to assign a default version like 1.0.0, set the
+	# version of the delphix-syft package to the pinned Syft version. This is done so
+	# that "dpkg -l delphix-syft" on a build host can tell you which Syft actually
+	# produced a given CycloneDX SBOM.
+	#
+	PACKAGE_VERSION="$(tr -d '\n' <"$WORKDIR/repo/SYFT_VERSION")"
+	[[ -n "$PACKAGE_VERSION" ]] || die "Failed to retrieve package version"
+
+	logmust dpkg_buildpackage_default
+}