diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml
index 8d9f125..d802c37 100644
--- a/.github/workflows/sbom.yml
+++ b/.github/workflows/sbom.yml
@@ -1,5 +1,9 @@
 # .github/workflows/sbom.yml — thin per-repository caller.
 #
+# Pinned to @v1, a moving tag on <org>/.github that tracks the latest compatible 1.x release. That
+# means a fix to the reusable workflow reaches every caller when the tag moves, without touching
+# each repository. Pin @v1.1.0 instead where a repository must not move on its own.
+#
 # Deliberately has NO `schedule:` trigger. GitHub auto-disables scheduled workflows in repositories
 # with no activity for 60 days — already true for 58 of our 99 repos — and notifies only whoever
 # last edited the cron line. Periodic coverage is the central orchestrator's job; this workflow
@@ -11,15 +15,23 @@ on:
     branches: [main, master]
     tags: ['*']
   schedule:
-    # weekly, Monday 04:00 UTC 
+    # weekly, Monday 04:00 UTC
     - cron: '0 4 * * 1'
   workflow_dispatch:
+    inputs:
+      target_ref:
+        description: "Regenerate for this ref (e.g. a release tag). Empty = current branch."
+        required: false
+        type: string
+        default: ""
+
 
 jobs:
   sbom:
-    uses: web-vision/.github/.github/workflows/sbom-reusable.yml@v1.0.3
+    uses: web-vision/.github/.github/workflows/sbom-reusable.yml@v1
     with:
       dry_run: false
+      target_ref: ${{ inputs.target_ref || '' }}
     secrets:
       DTRACK_API_KEY: ${{ secrets.DTRACK_API_KEY }}
       DTRACK_API_URL: ${{ secrets.DTRACK_API_URL }}