diff --git a/CHANGELOG.md b/CHANGELOG.md
index 86bdd2b1..295aa0f2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,7 @@
 # Changelog
 
 ## Unreleased
+- [BE] 🧾 **Lockfile 기반 CycloneDX SBOM 생성기 (#953 2차 증분)**: `app/release/sbom.py`를 추가했습니다. 저장소가 이미 커밋하는 lockfile을 순수 텍스트/JSON 파싱만으로 CycloneDX 1.6 `bom`으로 만듭니다 — `pip`/`npm` 실행·의존성 해석·네트워크 없음. `parse_pip_lock(text)`은 `name==version` 요구사항과 뒤따르는 `--hash=sha256:` 값을 수집(주석·옵션 줄 skip), `parse_npm_lock(obj)`은 `package-lock.json` v2/v3의 `packages` 맵을 순회(root `""`·버전 없는 workspace link skip, `@scope/` 유지, `integrity` → hash), `build_sbom(*, pip_lock, npm_lock, component_name, component_version, generated_at)`은 둘을 병합·`purl` 중복 제거·`(type, name, version)` 정렬해 CycloneDX 봉투로 감쌉니다. 빈 메타데이터/비-dict npm_lock은 첫 문제 필드명을 담은 `ValueError`. 테스트 16종(작은 리터럴 픽스처, 실제 lockfile 미사용). `docs/doctoring/release-manifest.md`에 계약 기록, OWASP CycloneDX 1.6·NTIA(2021) SBOM 최소 요소 인용.
 - [BE] 📦 **릴리스 증거 매니페스트 조립기 (#953 1차 증분)**: `app/release/manifest.py`의 `build_release_manifest(*, source_commit, backend_version, frontend_version, migration_revisions, dependency_lock_digests, included_prs, known_limitations, generated_at) -> dict`를 추가했습니다. 호출자가 이미 수집한 릴리스 사실(commit·버전·Alembic revision·lock 파일 sha256 다이제스트·포함 PR·알려진 한계·생성 시각)을 검증·정규화해 불변·JSON 직렬화 가능한 단일 매니페스트로 만듭니다. git·네트워크·파일시스템 접근 없음. 검증 실패 시 첫 문제 필드명을 담은 `ValueError`. `migration_revisions`/`included_prs`는 정렬·중복 제거, digest는 `^sha256:[0-9a-f]{64}$` 강제. `is_ga_candidate = len(known_limitations) == 0`(한계가 하나라도 있으면 GA 후보 아님 — 정직성 규칙). 테스트 12종. `docs/doctoring/release-manifest.md`에 필드 계약·후속 증분(SBOM·서명 provenance·operability baseline·마이그레이션 리허설) 기록, NIST SP 800-218·SLSA v1.2 인용.
 - [BE] 🔒 **Cryptography 50+ 보안 경계 갱신**: `pyproject.toml`과 두 hash-locked 요구사항 파일을 동일한 Cryptography 50+ 해석으로 정합화하여 PKCS#7 오류·타이밍 구분으로 인한 CVE-2026-69247 완화를 실제 설치·검증 경로에 반영했습니다.
 - [FE] ⚡ **검색 노드 참조 안정화 및 순차 스냅샷 폴링**: 같은 정규화 검색어와 원본 테이블 데이터에는 장식된 `node.data` 참조를 재사용하여 드래그 중 불필요한 하위 렌더링과 할당을 줄입니다. 스냅샷 폴링은 이전 요청이 끝난 뒤에만 다음 요청을 예약하며, 선택 변경·언마운트 후 도착한 오래된 성공 또는 실패 응답을 무시합니다.
diff --git a/backend/app/release/sbom.py b/backend/app/release/sbom.py
new file mode 100644
index 00000000..38ec9c98
--- /dev/null
+++ b/backend/app/release/sbom.py
@@ -0,0 +1,230 @@
+"""Build a CycloneDX 1.6 SBOM from the lockfiles already in the repo.
+
+A software bill of materials (SBOM) lists every third-party component that
+ships inside a release, so a buyer's security team can match it against
+vulnerability feeds and license policy. This module produces one **from the
+lockfiles the repo already commits** -- the hash-locked pip/uv requirements
+lock and the npm ``package-lock.json`` -- by pure text/JSON parsing. It never
+runs ``pip``/``npm``, never resolves a dependency graph, and never touches
+the network: whatever the lockfile pins is exactly what the SBOM reports.
+
+Public functions:
+
+* :func:`parse_pip_lock` -- turn a requirements lock's text into component
+  dicts (name, version, ``pkg:pypi`` purl, SHA-256 hashes).
+* :func:`parse_npm_lock` -- turn a parsed ``package-lock.json`` (v2/v3, which
+  carries a ``packages`` map) into component dicts (name, version,
+  ``pkg:npm`` purl, integrity hash).
+* :func:`build_sbom` -- merge both into one CycloneDX 1.6 ``bom`` document
+  with the components de-duplicated by purl and stably sorted.
+
+Deferred (tracked on issue #953): signing the SBOM, attaching it to the
+release manifest built by :mod:`app.release.manifest`, and emitting VEX
+(exploitability) statements.
+
+References (APA 7th):
+
+* OWASP Foundation. (2024). *CycloneDX specification 1.6*.
+  https://cyclonedx.org/docs/1.6/
+* National Telecommunications and Information Administration. (2021). *The
+  minimum elements for a software bill of materials (SBOM)*. U.S. Department
+  of Commerce.
+  https://www.ntia.gov/report/2021/minimum-elements-software-bill-materials-sbom
+"""
+
+from __future__ import annotations
+
+import re
+from typing import Any
+
+SBOM_SPEC_VERSION = "1.6"
+"""The CycloneDX schema version emitted by :func:`build_sbom`."""
+
+_PIP_HASH_RE = re.compile(r"--hash=sha256:([0-9a-fA-F]{64})")
+_PIP_NAME_VERSION_RE = re.compile(r"^([A-Za-z0-9._-]+)\s*==\s*([^\s;]+)")
+
+
+def _require_non_empty_str(value: object, field: str) -> str:
+    """Return ``value`` unchanged, or raise :class:`ValueError` naming ``field``."""
+
+    if not isinstance(value, str) or not value.strip():
+        raise ValueError(f"{field} must be a non-empty string")
+    return value
+
+
+def _logical_lines(text: str) -> list[str]:
+    """Join ``\\``-continued lines so one requirement is one string."""
+
+    joined = text.replace("\\\n", " ").replace("\\\r\n", " ")
+    return joined.splitlines()
+
+
+def parse_pip_lock(text: str) -> list[dict[str, Any]]:
+    """Parse a pip / uv requirements lock into CycloneDX component dicts.
+
+    Recognises ``name==version`` requirements (the form every hash-locked
+    lockfile uses) and collects the ``--hash=sha256:<hex>`` values that
+    follow, whether on the same line or on ``\\``-continued lines. Blank
+    lines, ``#`` comments, and option lines (anything starting with ``-``)
+    are skipped.
+
+    Args:
+        text: The full lockfile text.
+
+    Returns:
+        One dict per requirement: ``{"type": "library", "name", "version",
+        "purl": "pkg:pypi/<name>@<version>", "hashes": [{"alg": "SHA-256",
+        "content": <hex>}, ...]}``. Order follows the file.
+    """
+
+    components: list[dict[str, Any]] = []
+    for raw in _logical_lines(text):
+        line = raw.strip()
+        if not line or line.startswith("#") or line.startswith("-"):
+            continue
+        match = _PIP_NAME_VERSION_RE.match(line)
+        if match is None:
+            continue
+        name, version = match.group(1), match.group(2)
+        hashes = [
+            {"alg": "SHA-256", "content": h.lower()}
+            for h in _PIP_HASH_RE.findall(line)
+        ]
+        components.append(
+            {
+                "type": "library",
+                "name": name,
+                "version": version,
+                "purl": f"pkg:pypi/{name}@{version}",
+                "hashes": hashes,
+            }
+        )
+    return components
+
+
+def _npm_name_from_key(key: str) -> str | None:
+    """Return the package name for a ``package-lock.json`` ``packages`` key.
+
+    ``"node_modules/foo"`` -> ``"foo"``; ``"node_modules/@scope/bar"`` ->
+    ``"@scope/bar"``; nested ``".../node_modules/baz"`` -> ``"baz"``. Keys
+    without a ``node_modules/`` segment (the root ``""`` and workspace
+    entries) return ``None`` so the caller skips them.
+    """
+
+    marker = "node_modules/"
+    if marker not in key:
+        return None
+    return key.rsplit(marker, 1)[1]
+
+
+def _npm_hashes(integrity: object) -> list[dict[str, str]]:
+    """Turn an npm ``integrity`` string (``sha512-<b64>``) into hash dicts."""
+
+    if not isinstance(integrity, str) or "-" not in integrity:
+        return []
+    algo, _, content = integrity.partition("-")
+    alg_map = {"sha512": "SHA-512", "sha384": "SHA-384", "sha256": "SHA-256"}
+    if algo not in alg_map or not content:
+        return []
+    return [{"alg": alg_map[algo], "content": content}]
+
+
+def parse_npm_lock(obj: dict[str, Any]) -> list[dict[str, Any]]:
+    """Parse a parsed ``package-lock.json`` (v2/v3) into component dicts.
+
+    Walks ``obj["packages"]``, skips the root key ``""`` and any entry with
+    no ``version`` (workspace links, bundled placeholders), and emits one
+    component per installed ``node_modules`` package.
+
+    Args:
+        obj: The already-``json.load``ed lockfile. Must be a dict; a
+            ``packages`` key is expected (an absent one yields ``[]``).
+
+    Returns:
+        One dict per package: ``{"type": "library", "name", "version",
+        "purl": "pkg:npm/<name>@<version>", "hashes": [...]}``.
+
+    Raises:
+        ValueError: If ``obj`` is not a dict.
+    """
+
+    if not isinstance(obj, dict):
+        raise ValueError("npm_lock must be a parsed JSON object (dict)")
+    packages = obj.get("packages")
+    if not isinstance(packages, dict):
+        return []
+
+    components: list[dict[str, Any]] = []
+    for key, entry in packages.items():
+        if key == "" or not isinstance(entry, dict):
+            continue
+        name = _npm_name_from_key(key)
+        version = entry.get("version")
+        if name is None or not isinstance(version, str) or not version:
+            continue
+        components.append(
+            {
+                "type": "library",
+                "name": name,
+                "version": version,
+                "purl": f"pkg:npm/{name}@{version}",
+                "hashes": _npm_hashes(entry.get("integrity")),
+            }
+        )
+    return components
+
+
+def build_sbom(
+    *,
+    pip_lock: str,
+    npm_lock: dict[str, Any],
+    component_name: str,
+    component_version: str,
+    generated_at: str,
+) -> dict[str, Any]:
+    """Merge the pip and npm components into one CycloneDX 1.6 ``bom``.
+
+    Args:
+        pip_lock: Requirements-lock text (see :func:`parse_pip_lock`).
+        npm_lock: Parsed ``package-lock.json`` (see :func:`parse_npm_lock`).
+        component_name: Name of the application this SBOM describes.
+        component_version: Its version string.
+        generated_at: SBOM timestamp, recorded verbatim (an ISO-8601 string
+            is expected; this function does not parse it).
+
+    Returns:
+        ``{"bomFormat": "CycloneDX", "specVersion": "1.6", "version": 1,
+        "metadata": {"timestamp", "component": {...}}, "components": [...]}``
+        with components de-duplicated by ``purl`` and sorted by
+        ``(type, name, version)``.
+
+    Raises:
+        ValueError: If ``component_name``, ``component_version``, or
+            ``generated_at`` is blank, or if ``npm_lock`` is not a dict.
+    """
+
+    name = _require_non_empty_str(component_name, "component_name")
+    version = _require_non_empty_str(component_version, "component_version")
+    timestamp = _require_non_empty_str(generated_at, "generated_at")
+
+    merged: dict[str, dict[str, Any]] = {}
+    for component in [*parse_pip_lock(pip_lock), *parse_npm_lock(npm_lock)]:
+        merged.setdefault(component["purl"], component)
+
+    components = sorted(
+        merged.values(), key=lambda c: (c["type"], c["name"], c["version"])
+    )
+    return {
+        "bomFormat": "CycloneDX",
+        "specVersion": SBOM_SPEC_VERSION,
+        "version": 1,
+        "metadata": {
+            "timestamp": timestamp,
+            "component": {
+                "type": "application",
+                "name": name,
+                "version": version,
+            },
+        },
+        "components": components,
+    }
diff --git a/backend/tests/test_sbom.py b/backend/tests/test_sbom.py
new file mode 100644
index 00000000..db833ade
--- /dev/null
+++ b/backend/tests/test_sbom.py
@@ -0,0 +1,197 @@
+"""Tests for :mod:`app.release.sbom` — CycloneDX SBOM from lockfiles."""
+
+from __future__ import annotations
+
+import json
+
+import pytest
+
+from app.release.sbom import (
+    SBOM_SPEC_VERSION,
+    build_sbom,
+    parse_npm_lock,
+    parse_pip_lock,
+)
+
+_PIP_LOCK = """\
+# generated by a tool
+--index-url https://pypi.org/simple
+
+anyio==4.4.0 \\
+    --hash=sha256:1111111111111111111111111111111111111111111111111111111111111111 \\
+    --hash=sha256:2222222222222222222222222222222222222222222222222222222222222222
+click==8.1.7
+-e file:///local/thing
+"""
+
+_NPM_LOCK = {
+    "name": "frontend",
+    "lockfileVersion": 3,
+    "packages": {
+        "": {"name": "frontend", "version": "0.1.0"},
+        "node_modules/nanoid": {
+            "version": "5.0.7",
+            "integrity": "sha512-oooooooooooooooooooooo",
+        },
+        "node_modules/@xyflow/react": {
+            "version": "12.3.0",
+            "integrity": "sha512-rrrrrrrrrrrrrrrrrrrrrr",
+        },
+        "node_modules/leftpad": {"link": True},
+        "frontend/node_modules/dedupe-me": {
+            "version": "1.0.0",
+            "integrity": "sha512-dddddddddddddddddddddd",
+        },
+    },
+}
+
+
+def test_parse_pip_lock_happy_path_and_hashes() -> None:
+    """A name==version line yields one component with its collected hashes."""
+
+    components = parse_pip_lock(_PIP_LOCK)
+    by_name = {c["name"]: c for c in components}
+    assert set(by_name) == {"anyio", "click"}
+    assert by_name["anyio"]["version"] == "4.4.0"
+    assert by_name["anyio"]["purl"] == "pkg:pypi/anyio@4.4.0"
+    assert by_name["anyio"]["hashes"] == [
+        {"alg": "SHA-256", "content": "1" * 64},
+        {"alg": "SHA-256", "content": "2" * 64},
+    ]
+
+
+def test_parse_pip_lock_skips_comments_blanks_and_options() -> None:
+    """Comment, blank, -e and --index-url lines produce no components."""
+
+    components = parse_pip_lock(_PIP_LOCK)
+    assert all(c["name"] not in {"", "-e", "--index-url"} for c in components)
+    assert len(components) == 2
+
+
+def test_parse_pip_lock_component_without_hashes() -> None:
+    """A bare pin still parses, with an empty hash list."""
+
+    [component] = parse_pip_lock("click==8.1.7\n")
+    assert component["hashes"] == []
+
+
+def test_parse_npm_lock_happy_path() -> None:
+    """Each node_modules entry with a version becomes a component."""
+
+    components = parse_npm_lock(_NPM_LOCK)
+    by_name = {c["name"]: c for c in components}
+    assert by_name["nanoid"]["version"] == "5.0.7"
+    assert by_name["nanoid"]["purl"] == "pkg:npm/nanoid@5.0.7"
+    assert by_name["nanoid"]["hashes"] == [
+        {"alg": "SHA-512", "content": "oooooooooooooooooooooo"}
+    ]
+
+
+def test_parse_npm_lock_skips_root_and_linkless_versionless() -> None:
+    """The root key and a link-only (no version) entry are skipped."""
+
+    names = {c["name"] for c in parse_npm_lock(_NPM_LOCK)}
+    assert "frontend" not in names  # the "" root entry
+    assert "leftpad" not in names  # link: true, no version
+
+
+def test_parse_npm_lock_scoped_and_nested_names() -> None:
+    """Scoped packages keep the @scope/ prefix; nested paths take the last segment."""
+
+    names = {c["name"] for c in parse_npm_lock(_NPM_LOCK)}
+    assert "@xyflow/react" in names
+    assert "dedupe-me" in names  # from frontend/node_modules/dedupe-me
+
+
+def test_parse_npm_lock_rejects_non_dict() -> None:
+    """A non-dict lock is a programming error."""
+
+    with pytest.raises(ValueError, match="npm_lock"):
+        parse_npm_lock(["not", "a", "dict"])  # type: ignore[arg-type]
+
+
+def test_parse_npm_lock_missing_packages_key() -> None:
+    """A lock without a packages map yields no components (no crash)."""
+
+    assert parse_npm_lock({"name": "x", "lockfileVersion": 3}) == []
+
+
+def test_build_sbom_shape_and_spec_version() -> None:
+    """The bom has the CycloneDX envelope and the declared spec version."""
+
+    bom = build_sbom(
+        pip_lock=_PIP_LOCK,
+        npm_lock=_NPM_LOCK,
+        component_name="pg-erd-cloud",
+        component_version="0.1.0",
+        generated_at="2026-09-03T00:00:00Z",
+    )
+    assert bom["bomFormat"] == "CycloneDX"
+    assert bom["specVersion"] == SBOM_SPEC_VERSION == "1.6"
+    assert bom["version"] == 1
+    assert bom["metadata"]["timestamp"] == "2026-09-03T00:00:00Z"
+    assert bom["metadata"]["component"] == {
+        "type": "application",
+        "name": "pg-erd-cloud",
+        "version": "0.1.0",
+    }
+
+
+def test_build_sbom_sorted_and_deduped() -> None:
+    """Components are sorted by (type, name, version) and unique per purl."""
+
+    bom = build_sbom(
+        pip_lock="click==8.1.7\nclick==8.1.7\n",
+        npm_lock={"packages": {"node_modules/nanoid": {"version": "5.0.7"}}},
+        component_name="app",
+        component_version="1.0.0",
+        generated_at="t",
+    )
+    keys = [(c["type"], c["name"], c["version"]) for c in bom["components"]]
+    assert keys == sorted(keys)
+    purls = [c["purl"] for c in bom["components"]]
+    assert len(purls) == len(set(purls))
+    # sorted by name: "click" before "nanoid"
+    assert purls == ["pkg:pypi/click@8.1.7", "pkg:npm/nanoid@5.0.7"]
+
+
+def test_build_sbom_round_trips_through_json() -> None:
+    """The whole document is JSON-serializable."""
+
+    bom = build_sbom(
+        pip_lock=_PIP_LOCK,
+        npm_lock=_NPM_LOCK,
+        component_name="app",
+        component_version="1.0.0",
+        generated_at="t",
+    )
+    assert json.loads(json.dumps(bom)) == bom
+
+
+@pytest.mark.parametrize("field", ["component_name", "component_version", "generated_at"])
+def test_build_sbom_blank_metadata_rejected(field: str) -> None:
+    """Blank envelope metadata raises ValueError naming the field."""
+
+    kwargs = {
+        "pip_lock": "",
+        "npm_lock": {},
+        "component_name": "app",
+        "component_version": "1.0.0",
+        "generated_at": "t",
+    }
+    kwargs[field] = "   "
+    with pytest.raises(ValueError, match=field):
+        build_sbom(**kwargs)  # type: ignore[arg-type]
+
+
+def test_build_sbom_non_dict_npm_lock_rejected() -> None:
+    """build_sbom surfaces the npm_lock type error from parse_npm_lock."""
+
+    with pytest.raises(ValueError, match="npm_lock"):
+        build_sbom(
+            pip_lock="",
+            npm_lock="nope",  # type: ignore[arg-type]
+            component_name="app",
+            component_version="1.0.0",
+            generated_at="t",
+        )
diff --git a/docs/doctoring/release-manifest.md b/docs/doctoring/release-manifest.md
index 83b7fa17..370675c0 100644
--- a/docs/doctoring/release-manifest.md
+++ b/docs/doctoring/release-manifest.md
@@ -45,10 +45,38 @@ the supported way to ship a beta / non-GA artifact without the manifest
 claiming GA. A release workflow that wants a GA claim must first drive
 `known_limitations` to empty.
 
+## SBOM generation — landed
+
+`app.release.sbom` builds a **CycloneDX 1.6** `bom` from the lockfiles the
+repo already commits, by pure text/JSON parsing — no `pip`/`npm` run, no
+dependency resolution, no network. Whatever a lockfile pins is exactly what
+the SBOM reports.
+
+- `parse_pip_lock(text)` — reads `name==version` requirements and collects
+  the trailing `--hash=sha256:<hex>` values (same line or `\`-continued);
+  skips blank / `#` / option (`-…`) lines. Component:
+  `{"type": "library", "name", "version", "purl": "pkg:pypi/<name>@<ver>",
+  "hashes": [{"alg": "SHA-256", "content": <hex>}, …]}`.
+- `parse_npm_lock(obj)` — walks a parsed `package-lock.json` v2/v3
+  `packages` map; skips the root `""` key and any entry with no `version`
+  (workspace links); derives the name from the key (last `node_modules/`
+  segment, `@scope/` kept); maps `integrity` (`sha512-<b64>`) to a hash
+  entry. Non-dict input raises `ValueError`.
+- `build_sbom(*, pip_lock, npm_lock, component_name, component_version,
+  generated_at)` — merges both, de-duplicates by `purl`, sorts components
+  by `(type, name, version)`, and wraps them in the CycloneDX envelope
+  with an `application` metadata component. Blank envelope metadata raises
+  `ValueError` naming the first bad field.
+
+Still deferred: signing the SBOM, referencing it from the release manifest
+by digest, and emitting VEX (exploitability) statements.
+
 ## Deferred (later increments on #953)
 
-- **SBOM generation** — an SPDX or CycloneDX document per shipped artifact,
-  referenced from the manifest by digest.
+- **SBOM signing + manifest linkage** — the CycloneDX document now
+  generates (`app.release.sbom`, above); signing it and referencing it
+  from the manifest by digest, plus an SPDX rendering and VEX statements,
+  remain.
 - **Signed build provenance / attestation** — SLSA v1.2-compatible, tying
   the manifest to the build that produced it.
 - **The operability baseline** — SLI/SLO, dashboards, alerts, runbooks
@@ -76,3 +104,8 @@ specification, version 3.0*. https://spdx.dev/specifications/
 
 OWASP Foundation. (2024). *CycloneDX specification, version 1.6*.
 https://cyclonedx.org/specification/overview/
+
+National Telecommunications and Information Administration. (2021). *The
+minimum elements for a software bill of materials (SBOM)*. U.S. Department
+of Commerce.
+https://www.ntia.gov/report/2021/minimum-elements-software-bill-materials-sbom