diff --git a/sbom/README.md b/sbom/README.md
index f6b7d68..2053dec 100644
--- a/sbom/README.md
+++ b/sbom/README.md
@@ -25,7 +25,7 @@ java -Djarmode=tools -jar target/sbom-1.0.0.jar sbom --destination app.cdx.json
 
 | File | What it does |
 |---|---|
-| `pom.xml` | Boot parent, `cyclonedx-maven-plugin` writing `META-INF/sbom/application.cdx.json`, and a `vulnerable` profile that adds log4j-core 2.14.1 (never ship it) |
+| `pom.xml` | Boot parent, a bare `cyclonedx-maven-plugin` declaration (the parent supplies version, goal and output path, so the build writes `META-INF/sbom/application.cdx.json`), and a `vulnerable` profile that adds log4j-core 2.14.1 (never ship it) |
 | `src/main/resources/application.properties` | exposes the `sbom` Actuator endpoint |
 | `src/test/.../ActuatorSbomTest.java` | starts the app, calls `/actuator/sbom`, writes `output/05` |
 | `src/test/.../DefaultExposureTest.java` | the endpoint with default exposure, writes `output/06` |
diff --git a/sbom/pom.xml b/sbom/pom.xml
index 796b641..0069e29 100644
--- a/sbom/pom.xml
+++ b/sbom/pom.xml
@@ -60,21 +60,6 @@
       <plugin>
         <groupId>org.cyclonedx</groupId>
         <artifactId>cyclonedx-maven-plugin</artifactId>
-        <version>2.9.3</version>
-        <executions>
-          <execution>
-            <phase>generate-resources</phase>
-            <goals>
-              <goal>makeAggregateBom</goal>
-            </goals>
-          </execution>
-        </executions>
-        <configuration>
-          <outputFormat>json</outputFormat>
-          <outputName>application.cdx</outputName>
-          <outputDirectory>${project.build.outputDirectory}/META-INF/sbom</outputDirectory>
-          <projectType>application</projectType>
-        </configuration>
       </plugin>
     </plugins>
   </build>