diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml
index 1d60f26c..f8bf571b 100644
--- a/.github/workflows/sbom.yml
+++ b/.github/workflows/sbom.yml
@@ -9,7 +9,8 @@ on:
     inputs:
       wolfssl_ref:
         description: 'wolfssl git ref that provides scripts/gen-sbom'
-        default: 'master'
+        # TODO: switch back to 'master' once wolfSSL/wolfssl#10343 merges.
+        default: 'refs/pull/10343/head'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -32,14 +33,16 @@ jobs:
 
       # wolfssl is checked out once and used for two things: built + installed
       # so wolfssh has a library to link, and its source tree (scripts/gen-sbom
-      # + wolfssl/version.h) is passed to `make sbom` via WOLFSSL_DIR.  Default
-      # ref is master; until the wolfSSL SBOM change is on master, use the
-      # "Run workflow" button with wolfssl_ref set to the SBOM branch.
+      # + wolfssl/version.h) is passed to `make sbom` via WOLFSSL_DIR.  gen-sbom
+      # is not yet on wolfssl master, so default to the open PR head that carries
+      # it (wolfSSL/wolfssl#10343) so CI actually exercises `make sbom` instead of
+      # silently skipping.  TODO: switch the fallback back to 'master' once
+      # #10343 merges.
       - name: Checkout wolfssl (gen-sbom + library source)
         uses: actions/checkout@v4
         with:
           repository: wolfSSL/wolfssl
-          ref: ${{ github.event.inputs.wolfssl_ref || 'master' }}
+          ref: ${{ github.event.inputs.wolfssl_ref || 'refs/pull/10343/head' }}
           path: wolfssl
 
       - name: Install SBOM validator (pyspdxtools) and pcpp
diff --git a/Makefile.am b/Makefile.am
index 7ee6c359..b04ea355 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -89,12 +89,12 @@ SBOM_PKGNAME      = wolfssh
 SBOM_LICENSE_FILE = $(srcdir)/LICENSING
 SBOM_DEP_WOLFSSL  = yes
 
-# wolfSSH is GPLv3-or-commercial; its LICENSING uses the "GPLv3" abbreviation
-# that older gen-sbom cannot parse (falls back to NOASSERTION).  Default to the
-# correct SPDX id so the SBOM is right regardless of gen-sbom version; commercial
-# licensees can still override it (e.g. LicenseRef-wolfSSL-Commercial).
-# Redundant-but-harmless once the detect_license fix lands in gen-sbom
-# (wolfSSL/wolfssl#10343).
-SBOM_LICENSE_OVERRIDE ?= GPL-3.0-only
+# wolfSSH is GPLv3-or-later (per the per-file source headers: "either version 3
+# of the License, or (at your option) any later version") or commercial.  Its
+# LICENSING summary uses the "GPLv3" abbreviation, which gen-sbom's
+# detect_license maps to GPL-3.0-only -- contradicting the headers -- so pin the
+# header-accurate SPDX id here.  Commercial licensees can still override it
+# (e.g. LicenseRef-wolfSSL-Commercial).
+SBOM_LICENSE_OVERRIDE ?= GPL-3.0-or-later
 
 include scripts/sbom.am