diff --git a/Dockerfile b/Dockerfile
index f957915..d61ae74 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -56,12 +56,12 @@ RUN apt-get update \
   && python3 -m venv /root/.python \
   && /root/.python/bin/pip install meson ninja packaging cmake
 
-COPY versions.sh build-deps.sh build-bash-profile.sh *.patch ./
+COPY versions.sh build-deps.sh *.patch ./
 COPY --from=deps-src /root/deps /root/deps
 
 # We need environment variables that are based on the uname -m output,
 # so we have to use a Bash profile instead of ENV
-RUN ./build-bash-profile.sh > /root/.bashrc
+COPY bashrc.sh /root/.bashrc
 ENV BASH_ENV=/root/.bashrc
 
 RUN ./build-deps.sh
@@ -131,6 +131,7 @@ COPY --from=deps /root/deps/lychee/lychee /usr/local/bin/lychee
 COPY --from=deps /opt/imgproxy/lib /opt/imgproxy/lib
 COPY --from=deps /opt/imgproxy/include /opt/imgproxy/include
 COPY --from=deps /opt/imgproxy/bin /opt/imgproxy/bin
+COPY --from=deps /opt/imgproxy/sbom /opt/imgproxy/sbom
 
 COPY --from=deps /root/.bashrc /root/.bashrc
 ENV BASH_ENV=/root/.bashrc
diff --git a/bashrc.sh b/bashrc.sh
new file mode 100755
index 0000000..4932ccc
--- /dev/null
+++ b/bashrc.sh
@@ -0,0 +1,24 @@
+#!/bin/bash
+
+set -e
+
+case "$(uname -m)" in
+  x86_64)
+    export CFLAGS="-msse4"
+    )
+    ;;
+
+  aarch64)
+    export CFLAGS="-march=armv8.2-a+fp16"
+    ;;
+esac
+
+export PATH="/opt/imgproxy/bin:/root/.cargo/bin:/root/.python/bin:$PATH"
+export PKG_CONFIG_LIBDIR=/opt/imgproxy/lib/pkgconfig
+export CGO_LDFLAGS_ALLOW="-s|-w"
+export CGO_LDFLAGS="-Wl,-rpath,/opt/imgproxy/lib"
+
+export CFLAGS="$CFLAGS -Os -fPIC -D_GLIBCXX_USE_CXX11_ABI=1 -fno-asynchronous-unwind-tables -ffunction-sections -fdata-sections"
+export CXXFLAGS=$CFLAGS
+export CPPFLAGS="$CPPFLAGS -I/opt/imgproxy/include"
+export LDFLAGS="$LDFLAGS -L/opt/imgproxy/lib -Wl,--gc-sections -Wl,-rpath,/opt/imgproxy/lib"
diff --git a/build-bash-profile.sh b/build-bash-profile.sh
deleted file mode 100755
index fe6bfe9..0000000
--- a/build-bash-profile.sh
+++ /dev/null
@@ -1,37 +0,0 @@
-#!/bin/bash
-
-set -e
-
-case "$(uname -m)" in
-  x86_64)
-    ARCH_ENV=$(cat << EOF
-export CFLAGS="-msse4"
-EOF
-    )
-    ;;
-
-  aarch64)
-    ARCH_ENV=$(cat << EOF
-export CFLAGS="-march=armv8.2-a+fp16"
-EOF
-    )
-    ;;
-
-  *)
-    echo "Unsupported architecture $(uname -m)"
-    exit 1
-    ;;
-esac
-
-cat << EOF
-export PATH="/opt/imgproxy/bin:/root/.cargo/bin:/root/.python/bin:\$PATH"
-export PKG_CONFIG_LIBDIR=/opt/imgproxy/lib/pkgconfig
-export CGO_LDFLAGS_ALLOW="-s|-w"
-export CGO_LDFLAGS="-Wl,-rpath,/opt/imgproxy/lib"
-
-$ARCH_ENV
-export CFLAGS="\$CFLAGS -Os -fPIC -D_GLIBCXX_USE_CXX11_ABI=1 -fno-asynchronous-unwind-tables -ffunction-sections -fdata-sections"
-export CXXFLAGS=\$CFLAGS
-export CPPFLAGS="\$CPPFLAGS -I/opt/imgproxy/include"
-export LDFLAGS="\$LDFLAGS -L/opt/imgproxy/lib -Wl,--gc-sections -Wl,-rpath,/opt/imgproxy/lib"
-EOF
diff --git a/build-deps.sh b/build-deps.sh
index 7fdffa1..c308eaf 100755
--- a/build-deps.sh
+++ b/build-deps.sh
@@ -20,6 +20,57 @@ mkdir -p $TARGET_PATH
 export CARGO_PROFILE_RELEASE_CODEGEN_UNITS=1
 export CARGO_PROFILE_RELEASE_LTO=true
 
+# Function to add Software Bill of Materials (SBOM) for a dependency.
+# Arguments:
+#   $1 - name of the dependency.
+#   $2 - version of the dependency.
+#   $3 - CPE (Common Platform Enumeration) of the dependency.
+#   $4 - PURL (Package URL) of the dependency.
+#
+# You can find CPEs at https://nvd.nist.gov/products/cpe/search/
+# or with `grype db search <name>`.
+#
+# For PURLs, you can generally use the format: "pkg:generic/<name>@<version>".
+# For Rust crates, you can use the format: "pkg:cargo/<name>@<version>",
+# but first take a look at `grype db search <name>`.
+# Grype uses EITHER CPEs or PURLs to identify packages with PURL having higher priority,
+# so if "pkg:cargo/<name>@<version>" PURL shows fewer matches than CPE,
+# it's better to use "pkg:generic/<name>@<version>" PURL instead, so that
+# Grype falls back to CPE.
+add_sbom() {
+  local name=$1
+  local version=$2
+  local cpe=$3
+  local purl=$4
+
+  local filename="$TARGET_PATH/share/sbom/$name.cdx.json"
+
+  mkdir -p $(dirname $filename)
+  cat << EOF > $filename
+{
+  "\$schema": "https://cyclonedx.org/schema/bom-1.7.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.7",
+  "version": 1,
+  "metadata": {
+    "timestamp": "$(date -u +"%Y-%m-%dT%H:%M:%SZ")",
+    "component": {
+      "type": "library",
+      "name": "$name",
+      "version": "$version",
+      "cpe": "$cpe",
+      "purl": "$purl",
+      "properties": [
+        { "name": "syft:package:type", "value": "binary" }
+      ]
+    }
+  }
+}
+EOF
+
+  echo "SBOM for $name $version added to $filename"
+}
+
 print_build_stage zlib $ZLIB_VERSION
 cd $DEPS_SRC/zlib
 mkdir _build
@@ -35,6 +86,9 @@ cmake \
   -DWITH_GTEST=FALSE \
   ..
 ninja install/strip
+add_sbom "zlib-ng" $ZLIB_VERSION \
+  "cpe:2.3:a:zlib-ng:zlib-ng:$ZLIB_VERSION:*:*:*:*:*:*:*" \
+  "pkg:generic/zlib-ng@$ZLIB_VERSION"
 
 print_build_stage brotli $BROTLI_VERSION
 cd $DEPS_SRC/brotli
@@ -49,6 +103,9 @@ cmake \
   -DBROTLI_DISABLE_TESTS=TRUE \
   ..
 ninja install/strip
+add_sbom "brotli" $BROTLI_VERSION \
+  "cpe:2.3:a:google:brotli:$BROTLI_VERSION:*:*:*:*:*:*:*" \
+  "pkg:generic/brotli@$BROTLI_VERSION"
 
 print_build_stage ffi $FFI_VERSION
 cd $DEPS_SRC/ffi
@@ -61,6 +118,9 @@ cd $DEPS_SRC/ffi
   --disable-multi-os-directory \
   --disable-raw-api
 make install-strip -j$(nproc)
+add_sbom "ffi" $FFI_VERSION \
+  "cpe:2.3:a:libffi_project:libffi:$FFI_VERSION:*:*:*:*:*:*:*" \
+  "pkg:generic/libffi@$FFI_VERSION"
 
 print_build_stage pcre2 $PCRE2_VERSION
 cd $DEPS_SRC/pcre2
@@ -76,6 +136,9 @@ cmake \
   -DPCRE2_SUPPORT_JIT=ON \
   ..
 ninja install/strip
+add_sbom "pcre2" $PCRE2_VERSION \
+  "cpe:2.3:a:pcre:pcre2:$PCRE2_VERSION:*:*:*:*:*:*:*" \
+  "pkg:generic/pcre2@$PCRE2_VERSION"
 
 print_build_stage glib $GLIB_VERSION
 cd $DEPS_SRC/glib
@@ -95,6 +158,9 @@ meson setup _build \
   -Dglib_debug=disabled
 ninja -C _build
 ninja -C _build install
+add_sbom "glib" $GLIB_VERSION \
+  "cpe:2.3:a:gnome:glib:$GLIB_VERSION:*:*:*:*:*:*:*" \
+  "pkg:generic/glib@$GLIB_VERSION"
 
 print_build_stage highway $HIGHWAY_VERSION
 cd $DEPS_SRC/highway
@@ -111,6 +177,9 @@ cmake \
   -DHWY_ENABLE_CONTRIB=FALSE \
   ..
 ninja install/strip
+add_sbom "highway" $HIGHWAY_VERSION \
+  "cpe:2.3:a:google:highway:$HIGHWAY_VERSION:*:*:*:*:*:*:*" \
+  "pkg:generic/highway@$HIGHWAY_VERSION"
 
 print_build_stage quantizr $QUANTIZR_VERSION
 cd $DEPS_SRC/quantizr
@@ -119,6 +188,9 @@ cargo cinstall \
   --library-type=cdylib \
   --prefix=$TARGET_PATH \
   --libdir=$TARGET_PATH/lib
+add_sbom "quantizr" $QUANTIZR_VERSION \
+  "cpe:2.3:a:darthsim:quantizr:$QUANTIZR_VERSION:*:*:*:*:*:*:*" \
+  "pkg:cargo/quantizr@$QUANTIZR_VERSION"
 
 print_build_stage expat $LIBEXPAT_VERSION
 cd $DEPS_SRC/expat
@@ -129,6 +201,9 @@ cd $DEPS_SRC/expat
   --disable-dependency-tracking \
   --without-xmlwf
 make install -j$(nproc)
+add_sbom "expat" $LIBEXPAT_VERSION \
+  "cpe:2.3:a:libexpat_project:libexpat:$LIBEXPAT_VERSION:*:*:*:*:*:*:*" \
+  "pkg:generic/libexpat@$LIBEXPAT_VERSION"
 
 print_build_stage libxml2 $LIBXML2_VERSION
 cd $DEPS_SRC/libxml2
@@ -141,6 +216,9 @@ meson setup _build \
   -Dminimum=true
 ninja -C _build
 ninja -C _build install
+add_sbom "libxml2" $LIBXML2_VERSION \
+  "cpe:2.3:a:xmlsoft:libxml2:$LIBXML2_VERSION:*:*:*:*:*:*:*" \
+  "pkg:generic/libxml2@$LIBXML2_VERSION"
 
 print_build_stage libexif $LIBEXIF_VERSION
 cd $DEPS_SRC/libexif
@@ -151,6 +229,9 @@ autoreconf -i
   --disable-static \
   --disable-dependency-tracking
 make install-strip -j$(nproc)
+add_sbom "libexif" $LIBEXIF_VERSION \
+  "cpe:2.3:a:libexif_project:libexif:$LIBEXIF_VERSION:*:*:*:*:*:*:*" \
+  "pkg:generic/libexif@$LIBEXIF_VERSION"
 
 print_build_stage lcms2 $LCMS2_VERSION
 cd $DEPS_SRC/lcms2
@@ -161,6 +242,9 @@ CFLAGS="${CFLAGS} -O3" \
   --disable-static \
   --disable-dependency-tracking
 make install-strip -j$(nproc)
+add_sbom "lcms2" $LCMS2_VERSION \
+  "cpe:2.3:a:littlecms:little_cms_color_engine:$LCMS2_VERSION:*:*:*:*:*:*:*" \
+  "pkg:generic/lcms2@$LCMS2_VERSION"
 
 print_build_stage libjpeg-turbo $LIBJPEGTURBO_VERSION
 cd $DEPS_SRC/libjpeg-turbo
@@ -177,6 +261,9 @@ cmake \
   -DPNG_SUPPORTED=FALSE \
   ..
 ninja install/strip
+add_sbom "libjpeg-turbo" $LIBJPEGTURBO_VERSION \
+  "cpe:2.3:a:libjpeg-turbo:libjpeg-turbo:$LIBJPEGTURBO_VERSION:*:*:*:*:*:*:*" \
+  "pkg:generic/libjpeg-turbo@$LIBJPEGTURBO_VERSION"
 
 print_build_stage libjxl $LIBJXL_VERSION
 cd $DEPS_SRC/libjxl
@@ -203,6 +290,9 @@ cmake \
   -DJPEGXL_ENABLE_SJPEG=FALSE \
   ..
 ninja install/strip
+add_sbom "libjxl" $LIBJXL_VERSION \
+  "cpe:2.3:a:libjxl_project:libjxl:$LIBJXL_VERSION:*:*:*:*:*:*:*" \
+  "pkg:generic/libjxl@$LIBJXL_VERSION"
 
 print_build_stage libpng $LIBPNG_VERSION
 cd $DEPS_SRC/libpng
@@ -212,6 +302,9 @@ cd $DEPS_SRC/libpng
   --disable-static \
   --disable-dependency-tracking
 make install-strip -j$(nproc)
+add_sbom "libpng" $LIBPNG_VERSION \
+  "cpe:2.3:a:libpng:libpng:$LIBPNG_VERSION:*:*:*:*:*:*:*" \
+  "pkg:generic/libpng@$LIBPNG_VERSION"
 
 print_build_stage libwebp $LIBWEBP_VERSION
 cd $DEPS_SRC/libwebp
@@ -223,6 +316,9 @@ cd $DEPS_SRC/libwebp
   --enable-libwebpmux \
   --enable-libwebpdemux
 make install-strip -j$(nproc)
+add_sbom "libwebp" $LIBWEBP_VERSION \
+  "cpe:2.3:a:webmproject:libwebp:$LIBWEBP_VERSION:*:*:*:*:*:*:*" \
+  "pkg:generic/libwebp@$LIBWEBP_VERSION"
 
 print_build_stage libtiff $LIBTIFF_VERSION
 cd $DEPS_SRC/libtiff
@@ -240,6 +336,9 @@ cmake \
   -Dtiff-deprecated=FALSE \
   ..
 ninja install/strip
+add_sbom "libtiff" $LIBTIFF_VERSION \
+  "cpe:2.3:a:libtiff:libtiff:$LIBTIFF_VERSION:*:*:*:*:*:*:*" \
+  "pkg:generic/libtiff@$LIBTIFF_VERSION"
 
 print_build_stage cgif $CGIF_VERSION
 cd $DEPS_SRC/cgif
@@ -252,6 +351,9 @@ meson setup _build \
   --libdir=lib
 ninja -C _build
 ninja -C _build install
+add_sbom "cgif" $CGIF_VERSION \
+  "cpe:2.3:a:dloebl:cgif:$CGIF_VERSION:*:*:*:*:*:*:*" \
+  "pkg:generic/cgif@$CGIF_VERSION"
 
 print_build_stage libde265 $LIBDE265_VERSION
 cd $DEPS_SRC/libde265
@@ -267,6 +369,9 @@ cmake \
   -DBUILD_SHARED_LIBS=1 \
   ..
 ninja install/strip
+add_sbom "libde265" $LIBDE265_VERSION \
+  "cpe:2.3:a:struktur:libde265:$LIBDE265_VERSION:*:*:*:*:*:*:*" \
+  "pkg:generic/libde265@$LIBDE265_VERSION"
 
 print_build_stage kvazaar $KVAZAAR_VERSION
 cd $DEPS_SRC/kvazaar
@@ -276,6 +381,9 @@ cd $DEPS_SRC/kvazaar
   --enable-shared \
   --disable-static
 make install-strip -j$(nproc)
+add_sbom "kvazaar" $KVAZAAR_VERSION \
+  "cpe:2.3:a:ultravideo:kvazaar:$KVAZAAR_VERSION:*:*:*:*:*:*:*" \
+  "pkg:generic/kvazaar@$KVAZAAR_VERSION"
 
 print_build_stage dav1d $DAV1D_VERSION
 cd $DEPS_SRC/dav1d
@@ -287,6 +395,9 @@ meson setup _build \
   --libdir=lib
 ninja -C _build
 ninja -C _build install
+add_sbom "dav1d" $DAV1D_VERSION \
+  "cpe:2.3:a:videolan:dav1d:$DAV1D_VERSION:*:*:*:*:*:*:*" \
+  "pkg:generic/dav1d@$DAV1D_VERSION"
 
 # print_build_stage rav1e $RAV1E_VERSION
 # cd $DEPS_SRC/rav1e
@@ -295,6 +406,9 @@ ninja -C _build install
 #   --library-type=cdylib \
 #   --prefix=$TARGET_PATH \
 #   --libdir=$TARGET_PATH/lib
+# add_sbom "rav1e" $RAV1E_VERSION \
+#   "cpe:2.3:a:xiph:rav1e:$RAV1E_VERSION:*:*:*:*:*:*:*" \
+#   "pkg:cargo/rav1e@$RAV1E_VERSION"
 
 print_build_stage aom $AOM_VERSION
 cd $DEPS_SRC/aom
@@ -314,6 +428,9 @@ cmake \
   -DCONFIG_WEBM_IO=0 \
   ..
 ninja install/strip
+add_sbom "aom" $AOM_VERSION \
+  "cpe:2.3:a:aomedia:aomedia:$AOM_VERSION:*:*:*:*:*:*:*" \
+  "pkg:generic/libaom@$AOM_VERSION"
 
 print_build_stage libheif $LIBHEIF_VERSION
 cd $DEPS_SRC/libheif
@@ -333,6 +450,9 @@ cmake \
   -DWITH_AOM_DECODER=0 \
   ..
 ninja install/strip
+add_sbom "libheif" $LIBHEIF_VERSION \
+  "cpe:2.3:a:struktur:libheif:$LIBHEIF_VERSION:*:*:*:*:*:*:*" \
+  "pkg:generic/libheif@$LIBHEIF_VERSION"
 
 print_build_stage freetype $FREETYPE_VERSION
 cd $DEPS_SRC/freetype
@@ -349,6 +469,9 @@ meson setup _build \
   -Dbzip2=disabled
 ninja -C _build
 ninja -C _build install
+add_sbom "freetype" $FREETYPE_VERSION \
+  "cpe:2.3:a:freetype:freetype:$FREETYPE_VERSION:*:*:*:*:*:*:*" \
+  "pkg:generic/freetype@$FREETYPE_VERSION"
 
 print_build_stage fontconfig $FONTCONFIG_VERSION
 cd $DEPS_SRC/fontconfig
@@ -365,6 +488,9 @@ meson setup _build \
   -Dcache-build=disabled
 ninja -C _build
 ninja -C _build install
+add_sbom "fontconfig" $FONTCONFIG_VERSION \
+  "cpe:2.3:a:fontconfig_project:fontconfig:$FONTCONFIG_VERSION:*:*:*:*:*:*:*" \
+  "pkg:generic/fontconfig@$FONTCONFIG_VERSION"
 
 print_build_stage harfbuzz $HARFBUZZ_VERSION
 cd $DEPS_SRC/harfbuzz
@@ -385,6 +511,9 @@ meson setup _build \
 ninja -C _build
 ninja -C _build install
 rm $TARGET_PATH/lib/libharfbuzz-subset*
+add_sbom "harfbuzz" $HARFBUZZ_VERSION \
+  "cpe:2.3:a:harfbuzz_project:harfbuzz:$HARFBUZZ_VERSION:*:*:*:*:*:*:*" \
+  "pkg:generic/harfbuzz@$HARFBUZZ_VERSION"
 
 print_build_stage pixman $PIXMAN_VERSION
 cd $DEPS_SRC/pixman
@@ -401,6 +530,9 @@ meson setup _build \
   -Dtests=disabled
 ninja -C _build
 ninja -C _build install
+add_sbom "pixman" $PIXMAN_VERSION \
+  "cpe:2.3:a:pixman:pixman:$PIXMAN_VERSION:*:*:*:*:*:*:*" \
+  "pkg:generic/pixman@$PIXMAN_VERSION"
 
 print_build_stage cairo $CAIRO_VERSION
 cd $DEPS_SRC/cairo
@@ -421,6 +553,9 @@ meson setup _build \
   -Dsymbol-lookup=disabled
 ninja -C _build
 ninja -C _build install
+add_sbom "cairo" $CAIRO_VERSION \
+  "cpe:2.3:a:cairographics:cairo:$CAIRO_VERSION:*:*:*:*:*:*:*" \
+  "pkg:generic/cairo@$CAIRO_VERSION"
 
 print_build_stage fribidi $FRIBIDI_VERSION
 cd $DEPS_SRC/fribidi
@@ -431,6 +566,9 @@ autoreconf -fiv
   --disable-static \
   --disable-dependency-tracking
 make install-strip -j$(nproc)
+add_sbom "fribidi" $FRIBIDI_VERSION \
+  "cpe:2.3:a:gnu:fribidi:$FRIBIDI_VERSION:*:*:*:*:*:*:*" \
+  "pkg:generic/fribidi@$FRIBIDI_VERSION"
 
 print_build_stage pango $PANGO_VERSION
 cd $DEPS_SRC/pango
@@ -445,6 +583,9 @@ meson setup _build \
   -Dfontconfig=enabled
 ninja -C _build
 ninja -C _build install
+add_sbom "pango" $PANGO_VERSION \
+  "cpe:2.3:a:gnome:pango:$PANGO_VERSION:*:*:*:*:*:*:*" \
+  "pkg:generic/pango@$PANGO_VERSION"
 
 print_build_stage librsvg $LIBRSVG_VERSION
 cd $DEPS_SRC/librsvg
@@ -469,6 +610,9 @@ meson setup _build \
   -Davif=enabled
 ninja -C _build
 ninja -C _build install
+add_sbom "librsvg" $LIBRSVG_VERSION \
+  "cpe:2.3:a:gnome:librsvg:$LIBRSVG_VERSION:*:*:*:*:*:*:*" \
+  "pkg:generic/librsvg@$LIBRSVG_VERSION"
 
 print_build_stage vips $VIPS_VERSION
 cd $DEPS_SRC/vips
@@ -485,6 +629,9 @@ meson setup _build \
 ninja -C _build
 ninja -C _build install
 rm -rf $TARGET_PATH/lib/libvips-cpp.*
+add_sbom "vips" $VIPS_VERSION \
+  "cpe:2.3:a:libvips:libvips:$VIPS_VERSION:*:*:*:*:*:*:*" \
+  "pkg:generic/libvips@$VIPS_VERSION"
 
 rm -rf $TARGET_PATH/lib/*.a
 rm -rf $TARGET_PATH/lib/*.la