diff --git a/README.md b/README.md
index 9b434549..570196a8 100644
--- a/README.md
+++ b/README.md
@@ -25,6 +25,7 @@ install scripts provided in the respective repositories.
   - [clean_cache](docs/actions/clean_cache.md) is used at the end of a successful workflow to clean up the cached objects
   - [composer_merge](docs/actions/composer_merge.md) merges a JSON string with composer.json.
   - [consolidate_artifacts](docs/actions/consolidate_artifacts.md) consolidates multiple artifacts into one.
+  - [generate_sbom](docs/actions/generate_sbom.md) generates a CycloneDX SBOM of a Composer project's production dependencies.
   - [start_shop](docs/actions/start_shop.md) fetches a shop from cache and starts it.
   - [stop_shop](docs/actions/stop_shop.md) stops a running shop.
   - [load_cached_testplan](docs/actions/load_cached_testplan.md) loads the cached
diff --git a/docs/actions/generate_sbom.md b/docs/actions/generate_sbom.md
new file mode 100644
index 00000000..b2570430
--- /dev/null
+++ b/docs/actions/generate_sbom.md
@@ -0,0 +1,25 @@
+# generate_sbom
+
+This action generates a CycloneDX SBOM (Software Bill of Materials) listing the
+production dependencies of a Composer project. It installs the
+`cyclonedx/cyclonedx-php-composer` plugin globally, resolves the project's
+production dependencies, and writes the SBOM file.
+
+## Inputs
+
+**working_directory:** *not required*, *default:* '.'  
+Composer project to scan, i.e. the directory containing the composer.json.
+
+**spec_version:** *not required*, *default:* '1.4'  
+CycloneDX specification version. BSI TR-03183-2 requires at least 1.4.
+
+**output_format:** *not required*, *default:* 'JSON'  
+SBOM output format, either JSON or XML.
+
+**output_file:** *not required*, *default:* 'sbom.json'  
+Name of the SBOM file, written inside working_directory.
+
+## Outputs
+
+**sbom_path:**  
+Path to the generated SBOM file, for the caller to upload or publish.
diff --git a/generate_sbom/action.yaml b/generate_sbom/action.yaml
new file mode 100644
index 00000000..463bcf61
--- /dev/null
+++ b/generate_sbom/action.yaml
@@ -0,0 +1,61 @@
+name: 'generate_sbom'
+
+description: 'Generate a CycloneDX SBOM (production dependencies) for a Composer project'
+
+inputs:
+  working_directory:
+    type: string
+    required: false
+    description: 'Composer project to scan (directory containing composer.json)'
+    default: '.'
+  spec_version:
+    type: string
+    required: false
+    description: 'CycloneDX spec version (BSI TR-03183-2 wants >= 1.4)'
+    default: '1.4'
+  output_format:
+    type: string
+    required: false
+    description: 'SBOM output format: JSON or XML'
+    default: 'JSON'
+  output_file:
+    type: string
+    required: false
+    description: 'SBOM file name, written inside working_directory'
+    default: 'sbom.json'
+
+outputs:
+  sbom_path:
+    description: 'Path to the generated SBOM file'
+    value: ${{ steps.generate.outputs.path }}
+
+runs:
+  using: 'composite'
+  steps:
+    - name: 'Install the SBOM plugin globally'
+      shell: bash
+      run: |
+        # generate_sbom: Install the SBOM plugin globally
+        composer global config allow-plugins.cyclonedx/cyclonedx-php-composer true
+        composer global require cyclonedx/cyclonedx-php-composer --no-interaction
+
+    - name: 'Resolve production dependencies'
+      shell: bash
+      working-directory: ${{ inputs.working_directory }}
+      run: |
+        # generate_sbom: Resolve production dependencies
+        composer update --no-dev --no-scripts --no-plugins --ignore-platform-reqs --no-interaction
+
+    - name: 'Generate SBOM'
+      id: generate
+      shell: bash
+      working-directory: ${{ inputs.working_directory }}
+      run: |
+        # generate_sbom: Generate SBOM
+        composer CycloneDX:make-sbom \
+          --output-format='${{ inputs.output_format }}' \
+          --output-file='${{ inputs.output_file }}' \
+          --spec-version='${{ inputs.spec_version }}' \
+          --omit=dev \
+          --no-interaction
+        echo "path=${{ inputs.working_directory }}/${{ inputs.output_file }}" >> "$GITHUB_OUTPUT"