diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes-recipe/rootfs.bbclass
index e17f711f..16b1aa50 100644
--- a/meta/classes-recipe/rootfs.bbclass
+++ b/meta/classes-recipe/rootfs.bbclass
@@ -42,6 +42,8 @@ ROOTFS_FEATURES:remove:bullseye = "generate-sbom"
 ROOTFS_FEATURES:remove:jammy = "generate-sbom"
 ROOTFS_FEATURES:remove:focal = "generate-sbom"
 
+# Capture all information needed for sbom generation
+ROOTFS_APT_STATE = "apt-state.tar.zst"
 ROOTFS_APT_ARGS="install --yes -o Debug::pkgProblemResolver=yes"
 
 ROOTFS_CLEAN_FILES="/etc/hostname /etc/resolv.conf"
@@ -414,6 +416,19 @@ rootfs_clear_initrd_symlinks() {
     run_privileged rm -f ${ROOTFSDIR}/initrd.img.old
 }
 
+ROOTFS_INSTALL_COMMAND += "${@bb.utils.contains('ROOTFS_FEATURES', 'generate-sbom', 'rootfs_capture_apt_state', '', d)}"
+rootfs_capture_apt_state() {
+    ( cd ${ROOTFSDIR} && find usr/share/doc -name copyright -print0 ) | \
+    tar -cf ${WORKDIR}/${ROOTFS_APT_STATE} --zstd -C ${ROOTFSDIR} \
+        --exclude=var/lib/apt/lists/partial \
+        --exclude=var/lib/apt/lists/lock \
+        --exclude=var/lib/apt/lists/auxfiles \
+        --null -T - \
+        var/lib/apt/lists \
+        var/lib/apt/extended_states \
+        var/lib/dpkg/status
+}
+
 do_rootfs_install[root_cleandirs] = "${ROOTFSDIR}"
 do_rootfs_install[cleandirs] += "${DEPLOYDIR}"
 do_rootfs_install[sstate-inputdirs] = "${DEPLOYDIR}"
@@ -674,6 +689,9 @@ rootfs_install_sstate_prepare() {
         tar -C ${WORKDIR}/mnt/rootfs -cpSf rootfs.tar $lopts ${SSTATE_TAR_ATTR_FLAGS} .
         umount -q ${WORKDIR}/mnt/rootfs
 EOF
+    if [ -f ${WORKDIR}/${ROOTFS_APT_STATE} ]; then
+        cp ${WORKDIR}/${ROOTFS_APT_STATE} .
+    fi
     ${@ 'sudo chown $(id -u):$(id -g) rootfs.tar' if d.getVar('ISAR_CHROOT_MODE') == 'schroot' else '' }
 }
 rootfs_install_sstate_prepare[lockfiles] = "${REPO_ISAR_DIR}/isar.lock"
@@ -691,6 +709,9 @@ rootfs_install_sstate_finalize() {
 EOF
         rm rootfs.tar
     fi
+    if [ -f ${ROOTFS_APT_STATE} ]; then
+        mv ${ROOTFS_APT_STATE} ${WORKDIR}/${ROOTFS_APT_STATE}
+    fi
 }
 
 python do_rootfs_install_setscene() {
diff --git a/meta/classes/sbom.bbclass b/meta/classes/sbom.bbclass
index 2e6d579f..34efb590 100644
--- a/meta/classes/sbom.bbclass
+++ b/meta/classes/sbom.bbclass
@@ -50,16 +50,18 @@ EOF
 }
 
 generate_sbom() {
-    run_privileged mkdir -p \
-        ${SBOM_CHROOT_LOCAL}/mnt/rootfs \
-        ${SBOM_CHROOT_LOCAL}/mnt/deploy-dir
+    run_privileged_heredoc <<'EOF'
+        mkdir -p ${SBOM_CHROOT_LOCAL}/mnt/rootfs \
+                 ${SBOM_CHROOT_LOCAL}/mnt/deploy-dir
+        tar -xf ${WORKDIR}/${ROOTFS_APT_STATE} --zstd \
+            -C ${SBOM_CHROOT_LOCAL}/mnt/rootfs
+EOF
 
     TIMESTAMP=$(date --iso-8601=s -d @${SOURCE_DATE_EPOCH})
     bwrap \
         --unshare-user \
         --unshare-pid \
         --bind ${SBOM_CHROOT_LOCAL} / \
-        --bind ${ROOTFSDIR} /mnt/rootfs \
         --bind ${DEPLOY_DIR_SBOM} /mnt/deploy-dir \
         -- debsbom -v generate ${SBOM_DEBSBOM_TYPE_ARGS} -r /mnt/rootfs -o /mnt/deploy-dir/'${ROOTFS_PACKAGE_SUFFIX}' \
             --distro-name '${SBOM_DISTRO_NAME}' --distro-supplier '${SBOM_DISTRO_SUPPLIER}' \