diff --git a/requirements/recovery-v2.0.2.in b/requirements/recovery-v2.0.2.in
index 25867ad..469254a 100644
--- a/requirements/recovery-v2.0.2.in
+++ b/requirements/recovery-v2.0.2.in
@@ -3,7 +3,7 @@
 -r build.in
 PyYAML>=6
 aces-sdl==0.23.1
-cyclonedx-bom==7.3.0
+cyclonedx-bom==7.4.0
 # Floor, not a pin: the historical closure pulls cryptography transitively
 # (aces-sdl, asyncssh, pyjwt) and the resolver would otherwise hold it at the
 # version this lock was first generated with, which is affected by
diff --git a/requirements/recovery-v2.0.2.txt b/requirements/recovery-v2.0.2.txt
index 6914a37..7bf7194 100644
--- a/requirements/recovery-v2.0.2.txt
+++ b/requirements/recovery-v2.0.2.txt
@@ -320,9 +320,9 @@ cryptography==50.0.1 \
     #   aces-sdl
     #   asyncssh
     #   pyjwt
-cyclonedx-bom==7.3.0 \
-    --hash=sha256:73d7d76b3a28ebadc50eabf424cbcf128785a74b8a59ce7893da2e29cfaab585 \
-    --hash=sha256:d54080d65731980945de38e52009a5e5711f4a3c31377a3d13af96eaca5fcf3d
+cyclonedx-bom==7.4.0 \
+    --hash=sha256:425862a74a6660cfa867fd4bc3dff34ca1cec49549594e4a9096663135426cfe \
+    --hash=sha256:75756389cef95b9bb1d9c8d0c5b884719c2bfeb595109e2ed5321598a141bf4a
     # via -r requirements/recovery-v2.0.2.in
 cyclonedx-python-lib[validation]==11.11.0 \
     --hash=sha256:3049fc83e06a059b5c5907a527625a8ed5073caab10607ed4c9e5503b590fd44 \
diff --git a/requirements/sbom.in b/requirements/sbom.in
index c70a43d..00edf0e 100644
--- a/requirements/sbom.in
+++ b/requirements/sbom.in
@@ -1 +1 @@
-cyclonedx-bom==7.3.1
+cyclonedx-bom==7.4.0
diff --git a/requirements/sbom.txt b/requirements/sbom.txt
index 2a52f7a..8c7a4e6 100644
--- a/requirements/sbom.txt
+++ b/requirements/sbom.txt
@@ -18,11 +18,11 @@ chardet==5.2.0 \
     --hash=sha256:1b3b6ff479a8c414bc3fa2c0852995695c4a026dcd6d0633b2dd092ca39c1cf7 \
     --hash=sha256:e1cf59446890a00105fe7b7912492ea04b6e6f06d4b742b2c788469e34c82970
     # via cyclonedx-bom
-cyclonedx-bom==7.3.1 \
-    --hash=sha256:8c5adccefd593e89c0500463649c232625cee8e38dae1a433e057dfa495eff08 \
-    --hash=sha256:ebd99dc2cf62a7067e327bef2b2ffada99d57ed3fda2db6c4c8f3004e5bfd3cf
+cyclonedx-bom==7.4.0 \
+    --hash=sha256:425862a74a6660cfa867fd4bc3dff34ca1cec49549594e4a9096663135426cfe \
+    --hash=sha256:75756389cef95b9bb1d9c8d0c5b884719c2bfeb595109e2ed5321598a141bf4a
     # via -r requirements/sbom.in
-cyclonedx-python-lib==11.12.0 \
+cyclonedx-python-lib[validation]==11.12.0 \
     --hash=sha256:0e807521a921a5c3cb8ce1153f8a61d29eedfe76a46aac2796b7c6b573391a54 \
     --hash=sha256:16767c4039de90c04e9f03348f8f0ed4b8ff842eaa7eefcad3a95685f970dacf
     # via cyclonedx-bom
@@ -46,7 +46,7 @@ jsonpointer==3.1.1 \
     --hash=sha256:0b801c7db33a904024f6004d526dcc53bbb8a4a0f4e32bfd10beadf60adf1900 \
     --hash=sha256:8ff8b95779d071ba472cf5bc913028df06031797532f08a7d5b602d8b2a488ca
     # via jsonschema
-jsonschema==4.26.0 \
+jsonschema[format-nongpl]==4.26.0 \
     --hash=sha256:0c26707e2efad8aa1bfc5b7ce170f3fccc2e4918ff85989ba9ffa9facb2be326 \
     --hash=sha256:d489f15263b8d200f8387e64b4c3a75f06629559fb73deb8fdfb525f2dab50ce
     # via cyclonedx-python-lib