diff --git a/share/sbom.am b/share/sbom.am
index 32b4a60..8782166 100644
--- a/share/sbom.am
+++ b/share/sbom.am
@@ -33,8 +33,15 @@
 #                       detected from SBOM_LICENSE_FILE.
 #   SBOM_LICENSE_TEXT   Path to licence text for any LicenseRef-* used in
 #                       SBOM_LICENSE_OVERRIDE (required by SPDX 2.3).
-#   SBOM_WOLFSSL_VERSION   Version recorded for the wolfSSL dependency;
-#                       auto-detected from WOLFSSL_DIR/wolfssl/version.h when unset.
+#   SBOM_WOLFSSL_VERSION   Version recorded for the wolfSSL dependency.  When
+#                       unset and WOLFSSL_DIR is set, it is read from that tree:
+#                       wolfssl/version.h, else configure.ac (version.h is
+#                       generated, so 'make distclean' removes it).  If neither
+#                       is readable the build fails rather than letting gen-sbom
+#                       fall back to pkg-config, which describes the installed
+#                       wolfSSL rather than the tree at WOLFSSL_DIR.  With no
+#                       WOLFSSL_DIR there is no tree to consult and gen-sbom's
+#                       pkg-config lookup is the intended source.
 #   SBOM_OPENSSL_VERSION   Version recorded for the OpenSSL dependency;
 #                       gen-sbom resolves it via pkg-config when unset.
 #   SBOM_CONFIG_H       Path to the configure-generated config header to
@@ -189,9 +196,27 @@ sbom:
 	        | $(GREP) -q -- '--dep-wolfssl'; then \
 	        dep_args="$$dep_args --dep-wolfssl yes"; \
 	        wv="$(SBOM_WOLFSSL_VERSION)"; \
-	        if test -z "$$wv" && test -n "$(WOLFSSL_DIR)" && test -f "$(WOLFSSL_DIR)/wolfssl/version.h"; then \
-	            wv=`sed -n 's/.*LIBWOLFSSL_VERSION_STRING[[:space:]]*"\([^"]*\)".*/\1/p' \
-	                "$(WOLFSSL_DIR)/wolfssl/version.h"`; \
+	        if test -z "$$wv" && test -n "$(WOLFSSL_DIR)"; then \
+	            if test -f "$(WOLFSSL_DIR)/wolfssl/version.h"; then \
+	                wv=`sed -n 's/.*LIBWOLFSSL_VERSION_STRING[[:space:]]*"\([^"]*\)".*/\1/p' \
+	                    "$(WOLFSSL_DIR)/wolfssl/version.h"`; \
+	            fi; \
+	            if test -z "$$wv" && test -f "$(WOLFSSL_DIR)/configure.ac"; then \
+	                wv=`sed -n 's/^AC_INIT(\[[^]]*\],\[\([^]]*\)\].*/\1/p' \
+	                    "$(WOLFSSL_DIR)/configure.ac" | sed -n 1p`; \
+	            fi; \
+	            if test -z "$$wv"; then \
+	                echo "ERROR: cannot determine the wolfSSL version from"; \
+	                echo "       $(WOLFSSL_DIR)"; \
+	                echo "       Neither wolfssl/version.h (generated by configure, so"; \
+	                echo "       'make distclean' removes it) nor configure.ac was"; \
+	                echo "       readable. Refusing to fall back to pkg-config: that"; \
+	                echo "       reports the *installed* wolfSSL, which may be a"; \
+	                echo "       different build than WOLFSSL_DIR, and would record a"; \
+	                echo "       wrong version in the SBOM. Re-run configure in that"; \
+	                echo "       tree, or set SBOM_WOLFSSL_VERSION=X.Y.Z explicitly."; \
+	                exit 1; \
+	            fi; \
 	        fi; \
 	        if test -n "$$wv"; then \
 	            dep_args="$$dep_args --dep-version wolfssl=$$wv"; \