diff --git a/Makefile b/Makefile
index 0a47a798..f5d5e545 100644
--- a/Makefile
+++ b/Makefile
@@ -934,8 +934,15 @@ SBOM_COMPONENT_TYPE?=firmware
 # Every GPL-headered source says "either version 3 ... or (at your option) any
 # later version".
 SBOM_LICENSE_OVERRIDE?=GPL-3.0-or-later
-SBOM_CDX_OUT:=wolfboot-$(WOLFBOOT_VERSION).cdx.json
-SBOM_SPDX_OUT:=wolfboot-$(WOLFBOOT_VERSION).spdx.json
+# One version of wolfBoot has about 100 configurations, and each one is a
+# different image with a different source set.  Name the document after the
+# configuration so a second target does not overwrite the first.  gen-sbom still
+# derives serialNumber and the SPDX documentNamespace from name and version
+# alone, which collides inside a scanner as well; that part is wolfGlass's to
+# fix, and this does not paper over it.
+SBOM_CONFIG_TAG:=$(TARGET)$(if $(SIGN),-$(SIGN))$(if $(HASH),-$(HASH))
+SBOM_CDX_OUT:=wolfboot-$(SBOM_CONFIG_TAG)-$(WOLFBOOT_VERSION).cdx.json
+SBOM_SPDX_OUT:=wolfboot-$(SBOM_CONFIG_TAG)-$(WOLFBOOT_VERSION).spdx.json
 SBOM_GEN?=
 
 # Guards both SBOM targets: see SBOM_SRCS_MISSING above.  SBOM_ALLOW_MISSING=1
diff --git a/README.md b/README.md
index 84938197..27a8db95 100644
--- a/README.md
+++ b/README.md
@@ -160,8 +160,10 @@ an identical CycloneDX 1.6 / SPDX 2.3 document however you build:
 | Zephyr TEE/PSA module | `tools/scripts/ide-sbom/zephyr_sbom.py` |
 
 Output files are written to the build directory as
-`wolfboot-<version>.cdx.json` (CycloneDX 1.6) and `wolfboot-<version>.spdx.json`
-(SPDX 2.3 JSON), where `<version>` is read from `include/wolfboot/version.h`.
+`wolfboot-<target>-<sign>-<hash>-<version>.cdx.json` (CycloneDX 1.6) and
+`wolfboot-<target>-<sign>-<hash>-<version>.spdx.json` (SPDX 2.3 JSON), where
+`<version>` is read from `include/wolfboot/version.h`. Each configuration is a
+different image, so each one gets its own document.
 
 See [docs/SBOM.md](./docs/SBOM.md) for the full per-build-system guide. For CRA
 guidance and worked SBOM examples, see the
diff --git a/cmake/sbom.cmake b/cmake/sbom.cmake
index db70c6b5..a89519eb 100644
--- a/cmake/sbom.cmake
+++ b/cmake/sbom.cmake
@@ -60,6 +60,21 @@ if(NOT DEFINED SBOM_WOLFSSL_VERSION OR SBOM_WOLFSSL_VERSION STREQUAL "")
     endif()
 endif()
 
+# Mirrors SBOM_CONFIG_TAG in the Makefile: one version of wolfBoot covers about
+# 100 configurations, and each is a different image, so the document is named
+# after the configuration rather than the version alone.
+if(DEFINED WOLFBOOT_TARGET AND NOT WOLFBOOT_TARGET STREQUAL "")
+    set(_sbom_config_tag "${WOLFBOOT_TARGET}")
+else()
+    set(_sbom_config_tag "notarget")
+endif()
+if(SIGN)
+    string(APPEND _sbom_config_tag "-${SIGN}")
+endif()
+if(HASH)
+    string(APPEND _sbom_config_tag "-${HASH}")
+endif()
+
 set(_sbom_args
     NAME          wolfboot
     VERSION_FILE  ${WOLFBOOT_ROOT}/include/wolfboot/version.h
@@ -79,8 +94,8 @@ set(_sbom_args
     LICENSE_OVERRIDE GPL-3.0-or-later
     DEP_WOLFSSL   ${SBOM_DEP_WOLFSSL}
     DEP_WOLFCRYPT ${SBOM_DEP_WOLFCRYPT}
-    CDX_OUT       ${CMAKE_CURRENT_BINARY_DIR}/wolfboot-${_wolfboot_sbom_version}.cdx.json
-    SPDX_OUT      ${CMAKE_CURRENT_BINARY_DIR}/wolfboot-${_wolfboot_sbom_version}.spdx.json
+    CDX_OUT       ${CMAKE_CURRENT_BINARY_DIR}/wolfboot-${_sbom_config_tag}-${_wolfboot_sbom_version}.cdx.json
+    SPDX_OUT      ${CMAKE_CURRENT_BINARY_DIR}/wolfboot-${_sbom_config_tag}-${_wolfboot_sbom_version}.spdx.json
 )
 
 if(SBOM_WOLFSSL_VERSION AND NOT SBOM_WOLFSSL_VERSION STREQUAL "")
diff --git a/docs/SBOM.md b/docs/SBOM.md
index 02b79e7d..95c6fd9e 100644
--- a/docs/SBOM.md
+++ b/docs/SBOM.md
@@ -337,11 +337,14 @@ python3 tools/sbom/frontends/compdb_sbom.py build/compile_commands.json \
 
 Every route writes, into the working/build directory:
 
-* `wolfboot-<version>.cdx.json` — CycloneDX 1.6
-* `wolfboot-<version>.spdx.json` — SPDX 2.3
+* `wolfboot-<target>-<sign>-<hash>-<version>.cdx.json` — CycloneDX 1.6
+* `wolfboot-<target>-<sign>-<hash>-<version>.spdx.json` — SPDX 2.3
 
-`<version>` is read from `include/wolfboot/version.h`. These are ignored by
-`.gitignore`.
+`<version>` is read from `include/wolfboot/version.h`. `<target>`, `<sign>`, and
+`<hash>` are the configuration you built. One version of wolfBoot covers about
+100 configurations, and each one is a different image with a different source
+set, so the configuration is part of the name. Without it, a second target
+overwrites the first. These files are ignored by `.gitignore`.
 
 You can sanity-check any output: