diff --git a/pom.xml b/pom.xml
index 59a36c2d..8dd16994 100644
--- a/pom.xml
+++ b/pom.xml
@@ -196,6 +196,11 @@
                     </execution>
                 </executions>
             </plugin>
+            <!-- 28-Apr-2025, tatu: SBOM generation [JSTEP-14] -->
+            <plugin>
+                <groupId>org.cyclonedx</groupId>
+                <artifactId>cyclonedx-maven-plugin</artifactId>
+            </plugin>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-compiler-plugin</artifactId>
diff --git a/release-notes/VERSION-2.x b/release-notes/VERSION-2.x
index c23ff038..3ce0a537 100644
--- a/release-notes/VERSION-2.x
+++ b/release-notes/VERSION-2.x
@@ -20,6 +20,7 @@ Co-maintainers:
 
 #969: Deprecated content has been cleaned up with the version upgrade.
 #967: Kotlin has been upgraded to 2.0.21.
+- Generate SBOMs [JSTEP-14]
 
 2.19.1 (not yet released)