diff --git a/conf/local.conf b/conf/local.conf
index 48e4f88..7728711 100644
--- a/conf/local.conf
+++ b/conf/local.conf
@@ -270,6 +270,19 @@ DISTRO_FEATURES_BACKFILL_CONSIDERED += " sysvinit pulseaudio bluez5 gobject-intr
 VIRTUAL-RUNTIME_init_manager = "systemd"
 VIRTUAL-RUNTIME_update-alternatives = ""
 
+# Enable SPDX SBOM generation
+INHERIT += "create-spdx"
+
+# Optional: nicer JSON formatting
+SPDX_PRETTY = "1"
+
+# Optional: include source descriptions / archives (useful for compliance)
+SPDX_INCLUDE_SOURCES = "1"
+SPDX_ARCHIVE_SOURCES = "1"
+
+# Enable security report generation at build time
+INHERIT += "cve-check"
+
 # /var/log should be persistent
 VOLATILE_LOG_DIR = "no"