diff --git a/Dockerfile b/Dockerfile
index 8d42dc2..1cac153 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -46,7 +46,9 @@ RUN GOOS=${TARGETOS} GOARCH=${TARGETARCH} go install golang.org/x/tools/cmd/goim
     GOOS=${TARGETOS} GOARCH=${TARGETARCH} go install github.com/google/wire/cmd/wire@latest && \
     GOOS=${TARGETOS} GOARCH=${TARGETARCH} go install go.uber.org/mock/mockgen@latest && \
     GOOS=${TARGETOS} GOARCH=${TARGETARCH} go install google.golang.org/protobuf/cmd/protoc-gen-go@latest && \
-    GOOS=${TARGETOS} GOARCH=${TARGETARCH} go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest
+    GOOS=${TARGETOS} GOARCH=${TARGETARCH} go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest && \
+    GOOS=${TARGETOS} GOARCH=${TARGETARCH} go install github.com/google/go-licenses@latest && \
+    GOOS=${TARGETOS} GOARCH=${TARGETARCH} go install github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@latest
 
 FROM ${PULL_URL}:${DISTRO_VERSION} AS build
 ARG TZ
diff --git a/README.md b/README.md
index c9f8b36..68e7bf6 100644
--- a/README.md
+++ b/README.md
@@ -180,6 +180,13 @@ volumes:
 | `ko` | Build Go container images without a Dockerfile |
 | `air` | Live-reload dev server for iterative development |
 
+### License & SBOM
+
+| Tool | Purpose |
+|------|---------|
+| `go-licenses` | Scan all dependencies and report their licenses |
+| `cyclonedx-gomod` | Generate a CycloneDX SBOM from a Go module |
+
 ### Language server
 
 | Tool | Purpose |