diff --git a/.github/workflows/publish-pywry.yml b/.github/workflows/publish-pywry.yml
index d9121c9..72dfba8 100644
--- a/.github/workflows/publish-pywry.yml
+++ b/.github/workflows/publish-pywry.yml
@@ -443,9 +443,65 @@ jobs:
     name: Generate release SBOM
     needs: [test]
     if: ${{ !cancelled() && (needs.test.result == 'success' || needs.test.result == 'skipped') }}
+    runs-on: ubuntu-24.04
+    defaults:
+      run:
+        working-directory: pywry
     permissions:
       contents: read
-    uses: ./.github/workflows/sbom.yml
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.12'
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: '22'
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install ".[all,dev,freeze]"
+
+      - name: Install CycloneDX tools
+        run: |
+          pip install cyclonedx-bom
+          npm ci --ignore-scripts
+
+      - name: Generate and validate merged SBOM
+        shell: bash
+        run: |
+          cyclonedx-py environment --pyproject pyproject.toml --output-format JSON --output-file sbom-python.cdx.json
+          npx @cyclonedx/cyclonedx-npm --package-lock-only --output-format JSON --output-file sbom-node.cdx.json
+
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            cyclonedx/cyclonedx-cli:latest \
+            merge \
+            --input-files sbom-python.cdx.json sbom-node.cdx.json \
+            --output-format json \
+            --output-file sbom.cdx.json
+
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            cyclonedx/cyclonedx-cli:latest \
+            validate \
+            --input-file sbom.cdx.json \
+            --input-format json \
+            --fail-on-errors
+
+      - name: Upload SBOM artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: sbom
+          path: pywry/sbom.cdx.json
+          retention-days: 30
 
   # =============================================================================
   # Step 3: Merge all artifacts into single dist
@@ -952,8 +1008,17 @@ jobs:
           echo "📦 Publishing to PyPI:"
           ls -la dist/
 
+      - name: Prepare Python package artifacts
+        shell: bash
+        run: |
+          mkdir -p publish-dist
+          cp dist/*.whl publish-dist/
+          cp dist/*.tar.gz publish-dist/
+          echo "📦 Python package artifacts to publish:"
+          ls -la publish-dist/
+
       - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
+          packages-dir: publish-dist
           verbose: true
-
diff --git a/claude/desktop-extension/pyproject.toml b/claude/desktop-extension/pyproject.toml
index 02356a4..2ccaf0b 100644
--- a/claude/desktop-extension/pyproject.toml
+++ b/claude/desktop-extension/pyproject.toml
@@ -1,8 +1,8 @@
 [project]
 name = "pywry-desktop-extension"
-version = "0.1.0"
+version = "0.1.1"
 description = "PyWry MCP Bundle (.mcpb) for Claude Desktop. Wraps pywry[mcp] so the uv runtime resolves dependencies automatically."
 requires-python = ">=3.10"
 dependencies = [
-  "pywry[mcp]>=2.0.0",
+  "pywry[mcp]>=2.0.1",
 ]
diff --git a/pywry/pyproject.toml b/pywry/pyproject.toml
index 023cbda..d091de4 100644
--- a/pywry/pyproject.toml
+++ b/pywry/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "pywry"
-version = "2.0.0"
+version = "2.0.1"
 description = "A lightweight and blazingly fast, cross-platform, WebView rendering engine and desktop UI toolkit for Python. Batteries included."
 authors = [{ name = "PyWry", email = "pywry2@gmail.com" }]
 license = { text = "Apache 2.0" }
@@ -54,7 +54,7 @@ test = [
     "testcontainers>=4.14.0",
 ]
 lint = [
-    "ruff>=0.13",
+    "ruff>=0.15",
 ]
 typecheck = [
     "ty>=0.0.1a8",