diff --git a/pom.xml b/pom.xml
index 398671e1..b17564a0 100644
--- a/pom.xml
+++ b/pom.xml
@@ -171,12 +171,11 @@ alternative support for serializing POJOs as XML and deserializing XML as POJOs.
         <!-- Inherited from oss-base. Generate PackageVersion.java.-->
         <groupId>com.google.code.maven-replacer-plugin</groupId>
         <artifactId>replacer</artifactId>
-        <executions>
-          <execution>
-            <id>process-packageVersion</id>
-            <phase>generate-sources</phase>
-          </execution>
-        </executions>
+      </plugin>
+      <!-- 29-Apr-2025, tatu: SBOM generation [JSTEP-14] -->
+      <plugin>
+        <groupId>org.cyclonedx</groupId>
+        <artifactId>cyclonedx-maven-plugin</artifactId>
       </plugin>
       <!-- 20-Mar-2019, tatu: use Moditect for JDK9+ module info inclusion -->
       <plugin>
diff --git a/release-notes/VERSION-2.x b/release-notes/VERSION-2.x
index 4423b938..e74499b4 100644
--- a/release-notes/VERSION-2.x
+++ b/release-notes/VERSION-2.x
@@ -6,7 +6,7 @@ Project: jackson-dataformat-xml
 
 2.20.0 (not yet released)
 
--
+- Generate SBOMs [JSTEP-14]
 
 2.19.0-rc2 (24-Apr-2025)
 
diff --git a/src/main/java/com/fasterxml/jackson/dataformat/xml/ser/XmlSerializerProvider.java b/src/main/java/com/fasterxml/jackson/dataformat/xml/ser/XmlSerializerProvider.java
index 7a2d3d78..ffc0a18a 100644
--- a/src/main/java/com/fasterxml/jackson/dataformat/xml/ser/XmlSerializerProvider.java
+++ b/src/main/java/com/fasterxml/jackson/dataformat/xml/ser/XmlSerializerProvider.java
@@ -315,7 +315,7 @@ protected void _serializeUnwrappedObjectNode(ToXmlGenerator xgen, Object value,
             JsonSerializer<Object> ser) throws IOException
     {
         ObjectNode root = (ObjectNode) value;
-        Map.Entry<String, JsonNode> entry = root.fields().next();
+        Map.Entry<String, JsonNode> entry = root.properties().iterator().next();
         final JsonNode newRoot = entry.getValue();
 
         // No namespace associated with JsonNode: