diff --git a/scripts/sbom.am b/scripts/sbom.am
index 50973598500..80643ee0742 100644
--- a/scripts/sbom.am
+++ b/scripts/sbom.am
@@ -36,8 +36,13 @@
 #                       detected from SBOM_LICENSE_FILE.
 #   SBOM_LICENSE_TEXT   Path to licence text for any LicenseRef-* used in
 #                       SBOM_LICENSE_OVERRIDE (required by SPDX 2.3).
-#   SBOM_WOLFSSL_VERSION   Version recorded for the wolfSSL dependency;
-#                       auto-detected from WOLFSSL_DIR/wolfssl/version.h when unset.
+#   SBOM_WOLFSSL_VERSION   Version recorded for the wolfSSL dependency.  When
+#                       unset and WOLFSSL_DIR is set, it is read from that tree:
+#                       wolfssl/version.h, else configure.ac (version.h is
+#                       generated, so 'make distclean' removes it).  If neither
+#                       is readable the build fails rather than letting gen-sbom
+#                       fall back to pkg-config, which describes the installed
+#                       wolfSSL rather than the tree at WOLFSSL_DIR.
 #   SBOM_OPENSSL_VERSION   Version recorded for the OpenSSL dependency;
 #                       gen-sbom resolves it via pkg-config when unset.
 #   SBOM_CONFIG_H       Path to the configure-generated config header to
@@ -169,19 +174,34 @@ sbom:
 	        | $(GREP) -q -- '--dep-wolfssl'; then \
 	        dep_args="$$dep_args --dep-wolfssl yes"; \
 	        wv="$(SBOM_WOLFSSL_VERSION)"; \
-	        if test -z "$$wv" && test -f "$(WOLFSSL_DIR)/wolfssl/version.h"; then \
-	            wv=`sed -n 's/.*LIBWOLFSSL_VERSION_STRING[[:space:]]*"\([^"]*\)".*/\1/p' \
-	                "$(WOLFSSL_DIR)/wolfssl/version.h"`; \
+	        if test -z "$$wv" && test -n "$(WOLFSSL_DIR)"; then \
+	            if test -f "$(WOLFSSL_DIR)/wolfssl/version.h"; then \
+	                wv=`sed -n 's/.*LIBWOLFSSL_VERSION_STRING[[:space:]]*"\([^"]*\)".*/\1/p' \
+	                    "$(WOLFSSL_DIR)/wolfssl/version.h"`; \
+	            fi; \
+	            if test -z "$$wv" && test -f "$(WOLFSSL_DIR)/configure.ac"; then \
+	                wv=`sed -n 's/^AC_INIT(\[[^]]*\],\[\([^]]*\)\].*/\1/p' \
+	                    "$(WOLFSSL_DIR)/configure.ac" | sed -n 1p`; \
+	            fi; \
+	            if test -z "$$wv"; then \
+	                echo "ERROR: cannot determine the wolfSSL version from"; \
+	                echo "       $(WOLFSSL_DIR)"; \
+	                echo "       Neither wolfssl/version.h (generated by configure, so"; \
+	                echo "       'make distclean' removes it) nor configure.ac was"; \
+	                echo "       readable. Refusing to fall back to pkg-config: that"; \
+	                echo "       reports the *installed* wolfSSL, which may be a"; \
+	                echo "       different build than WOLFSSL_DIR, and would record a"; \
+	                echo "       wrong version in the SBOM. Re-run configure in that"; \
+	                echo "       tree, or set SBOM_WOLFSSL_VERSION=X.Y.Z explicitly."; \
+	                exit 1; \
+	            fi; \
 	        fi; \
 	        if test -n "$$wv"; then \
 	            dep_args="$$dep_args --dep-version wolfssl=$$wv"; \
 	        fi; \
 	    else \
 	        echo "NOTE: this gen-sbom has no --dep-wolfssl support, so the SBOM"; \
-	        echo "      will not list wolfssl as a dependency component. That"; \
-	        echo "      support is added by wolfSSL/wolfssl#10343; until it merges"; \
-	        echo "      to wolfssl master, point WOLFSSL_DIR at that PR's branch"; \
-	        echo "      to enable it. The generated SBOM is valid either way."; \
+	        echo "      will not list wolfssl as a dependency component."; \
 	    fi; \
 	fi; \
 	if test "$(SBOM_DEP_OPENSSL)" = yes; then \