diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 8b6c9249..0fbdce61 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -5,7 +5,7 @@ on:
     tags: [v*]
 jobs:
   release:
-    uses: suzuki-shunsuke/go-release-workflow/.github/workflows/release.yaml@4602cd60ba10f19df17a074d76c518a9b8b979bb # v4.0.1
+    uses: suzuki-shunsuke/go-release-workflow/.github/workflows/release.yaml@4e688e779e85af46e57ea7e79dbe0685e20c27c9 # v5.0.1
     with:
       go-version-file: go.mod
       aqua_version: v2.53.3
diff --git a/.gitignore b/.gitignore
index ab5f5a63..2ba1d5e3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -24,3 +24,5 @@ vendor
 dist
 
 .DS_Store
+
+third_party_licenses
diff --git a/.goreleaser.yml b/.goreleaser.yml
index d34469fa..e3f29479 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -40,13 +40,21 @@ signs:
 
 archives:
   - name_template: '{{ .ProjectName }}_{{ .Os }}_{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}'
+    files:
+      - LICENSE
+      - README.md
+      - third_party_licenses/**/*
 
 release:
-  prerelease: true # we update release note manually before releasing
+  prerelease: "true" # we update release note manually before releasing
   header: |
     [Pull Requests](https://github.com/suzuki-shunsuke/tfcmt/pulls?q=is%3Apr+milestone%3A{{.Tag}}) | [Issues](https://github.com/suzuki-shunsuke/tfcmt/issues?q=is%3Aissue+milestone%3A{{.Tag}}) | https://github.com/suzuki-shunsuke/tfcmt/compare/{{.PreviousTag}}...{{.Tag}}
 
-brews:
+sboms:
+  - id: default
+    disable: false
+
+homebrew_casks:
   -
     # NOTE: make sure the url_template, the token and given repo (github or gitlab) owner and name are from the
     # same kind. We will probably unify this in the next major version like it is done with scoop.
@@ -74,8 +82,3 @@ brews:
     # in case there is an indicator for prerelease in the tag e.g. v1.0.0-rc1
     # Default is false.
     skip_upload: true
-
-    # So you can `brew test` your formula.
-    # Default is empty.
-    test: |
-      system "#{bin}/tfcmt --version"
diff --git a/aqua/aqua-checksums.json b/aqua/aqua-checksums.json
index dbf7e172..246b4350 100644
--- a/aqua/aqua-checksums.json
+++ b/aqua/aqua-checksums.json
@@ -1,5 +1,30 @@
 {
   "checksums": [
+    {
+      "id": "github_release/github.com/anchore/syft/v1.28.0/syft_1.28.0_darwin_amd64.tar.gz",
+      "checksum": "15067673A0EA8AEBA31E2A53DEB1633EAC5C0024AB73BDFF91CFFB157735D90A",
+      "algorithm": "sha256"
+    },
+    {
+      "id": "github_release/github.com/anchore/syft/v1.28.0/syft_1.28.0_darwin_arm64.tar.gz",
+      "checksum": "8666A08560B7AFB3A547A5CD596880C9FF51736A4C49B1576009AEF292C08343",
+      "algorithm": "sha256"
+    },
+    {
+      "id": "github_release/github.com/anchore/syft/v1.28.0/syft_1.28.0_linux_amd64.tar.gz",
+      "checksum": "3EDEE7FE1CEB1F78360E547F57048930D57F00C7EC3D0B8BDFB902805F048468",
+      "algorithm": "sha256"
+    },
+    {
+      "id": "github_release/github.com/anchore/syft/v1.28.0/syft_1.28.0_linux_arm64.tar.gz",
+      "checksum": "95C8533C46D4A952A576365F373D04FC0A4348E7335CBB82AC3EA2BC66E1E58B",
+      "algorithm": "sha256"
+    },
+    {
+      "id": "github_release/github.com/anchore/syft/v1.28.0/syft_1.28.0_windows_amd64.zip",
+      "checksum": "A1637FDC074E9C80C6BF900DF26A883516BF32E90499E3BD9AA314493D40A0A8",
+      "algorithm": "sha256"
+    },
     {
       "id": "github_release/github.com/golangci/golangci-lint/v2.1.6/golangci-lint-2.1.6-darwin-amd64.tar.gz",
       "checksum": "E091107C4CA7E283902343BA3A09D14FB56B86E071EFFD461CE9D67193EF580E",
@@ -31,28 +56,28 @@
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/goreleaser/goreleaser/v2.9.0/goreleaser_Darwin_all.tar.gz",
-      "checksum": "82953B65C4B64E73B1077827663D97BF8E32592B4FC2CDB55C738BD484260A47",
+      "id": "github_release/github.com/goreleaser/goreleaser/v2.11.0/goreleaser_Darwin_all.tar.gz",
+      "checksum": "EE980BC543590FCA6AFE171C4C7DAF1B57615E737CEA23A38B1AF3AC973772C5",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/goreleaser/goreleaser/v2.9.0/goreleaser_Linux_arm64.tar.gz",
-      "checksum": "574E83F5F0FC97803FF734C9342F8FD446D77E5E7CCAC53DEBF09B4A8DBDED80",
+      "id": "github_release/github.com/goreleaser/goreleaser/v2.11.0/goreleaser_Linux_arm64.tar.gz",
+      "checksum": "B06DEF64EE10ADFEF205CBE3A4C321AA86339A8E7CA0003B768ED680F6AB3000",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/goreleaser/goreleaser/v2.9.0/goreleaser_Linux_x86_64.tar.gz",
-      "checksum": "A066FCD713684ABED0D750D7559F1A5D794FA2FAA8E8F1AD2EECEC8C373668A7",
+      "id": "github_release/github.com/goreleaser/goreleaser/v2.11.0/goreleaser_Linux_x86_64.tar.gz",
+      "checksum": "DA8383CB2E1E848372A337922333EC883B8607C2BA70A2A68A0F33022FB7EBFD",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/goreleaser/goreleaser/v2.9.0/goreleaser_Windows_arm64.zip",
-      "checksum": "EA19CAE5A322FEC6794252D3E9FE77D43201CC831D939964730E556BF3C1CC2C",
+      "id": "github_release/github.com/goreleaser/goreleaser/v2.11.0/goreleaser_Windows_arm64.zip",
+      "checksum": "8A101601E83080D6598F193FEDBE63DF3ABB5DA3C45E9961657D1E916083508A",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/goreleaser/goreleaser/v2.9.0/goreleaser_Windows_x86_64.zip",
-      "checksum": "F56E85F8FD52875102DFC2B01DC07FC174486CAEBBAC7E3AA9F29B4F0057D495",
+      "id": "github_release/github.com/goreleaser/goreleaser/v2.11.0/goreleaser_Windows_x86_64.zip",
+      "checksum": "9DEE11DC151B45CE3195E7CE911320DE94533BF1661544FFC46539C850E021DF",
       "algorithm": "sha256"
     },
     {
diff --git a/aqua/imports/go-licenses.yaml b/aqua/imports/go-licenses.yaml
new file mode 100644
index 00000000..64156dcd
--- /dev/null
+++ b/aqua/imports/go-licenses.yaml
@@ -0,0 +1,2 @@
+packages:
+  - name: google/go-licenses@v1.6.0
diff --git a/aqua/imports/goreleaser.yaml b/aqua/imports/goreleaser.yaml
index 1286fc4b..a8d04fe8 100644
--- a/aqua/imports/goreleaser.yaml
+++ b/aqua/imports/goreleaser.yaml
@@ -1,2 +1,2 @@
 packages:
-  - name: goreleaser/goreleaser@v2.9.0
+  - name: goreleaser/goreleaser@v2.11.0
diff --git a/aqua/imports/syft.yaml b/aqua/imports/syft.yaml
new file mode 100644
index 00000000..2c7f9d47
--- /dev/null
+++ b/aqua/imports/syft.yaml
@@ -0,0 +1,2 @@
+packages:
+  - name: anchore/syft@v1.28.0
diff --git a/go.mod b/go.mod
index 4f5a4198..bd3d9d12 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/suzuki-shunsuke/tfcmt/v4
 
-go 1.24.2
+go 1.24.5
 
 require (
 	github.com/Masterminds/sprig/v3 v3.3.0