diff --git a/README.md b/README.md
index 98fe0666..d7d04112 100644
--- a/README.md
+++ b/README.md
@@ -696,3 +696,25 @@ WOLFSSH APPLICATIONS
 
 wolfSSH comes with a server daemon and a command line shell tool. Check out
 the apps directory for more information.
+
+## SBOM / EU CRA Compliance
+
+wolfSSH generates a Software Bill of Materials (SBOM) in CycloneDX 1.6 and
+SPDX 2.3 formats to support compliance with the EU Cyber Resilience Act (CRA).
+
+```sh
+make sbom WOLFSSL_DIR=/path/to/wolfssl
+```
+
+Requires `python3` and `pyspdxtools` (`pip install spdx-tools`). `WOLFSSL_DIR`
+must point to a wolfssl source tree containing `scripts/gen-sbom` (branch
+`feat/sbom-embedded`, or `master` once wolfSSL/wolfssl#10343 merges).
+
+Output: `wolfssh-<version>.cdx.json`, `wolfssh-<version>.spdx.json`, `wolfssh-<version>.spdx`
+
+```sh
+make install-sbom    # installs to $(datadir)/doc/wolfssh/
+make uninstall-sbom
+```
+
+For further CRA guidance see [wolfssl/doc/CRA.md](https://github.com/wolfSSL/wolfssl/blob/master/doc/CRA.md).