diff --git a/.circleci/config.yml b/.circleci/config.yml
index b513eaa5f..3d8256a67 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -696,6 +696,9 @@ jobs:
                     echo "export RELEASE_ID=$(echo ${RELEASE} | jq .id)" >> ${BASH_ENV}
                     echo "export RELEASE_NOTES=$(echo ${RELEASE} | jq .releaseNotes)" >> ${BASH_ENV}
                 name: Create github release
+            - run:
+                command: npm exec -- app-toolbelt v0 sbom --release-id ${RELEASE_ID} --version-name ${NEW_VERSION_NAME} --path _manifest/spdx_2.3/manifest.spdx.json --branch ${CIRCLE_BRANCH} --private-key ${DELIVERINO_PRIVATE_KEY} --owner ${CIRCLE_PROJECT_USERNAME} --repo ${CIRCLE_PROJECT_REPONAME}
+                name: Generate SBoM, commit it and upload to github release
             - run:
                 command: npm exec -- app-toolbelt v0 release upload --releaseId ${RELEASE_ID} --files "$(ls ~/attached_workspace/*.apk)" --private-key ${DELIVERINO_PRIVATE_KEY} --owner ${CIRCLE_PROJECT_USERNAME} --repo ${CIRCLE_PROJECT_REPONAME}
                 name: Upload android apks to github release
diff --git a/.circleci/src/jobs/notify_release.yml b/.circleci/src/jobs/notify_release.yml
index dfba32b45..6b8d1babf 100644
--- a/.circleci/src/jobs/notify_release.yml
+++ b/.circleci/src/jobs/notify_release.yml
@@ -21,6 +21,9 @@ steps:
         RELEASE=$(npm exec -- app-toolbelt v0 release create << parameters.platform >> ${NEW_VERSION_NAME} ${NEW_VERSION_CODE} --private-key ${DELIVERINO_PRIVATE_KEY} --owner ${CIRCLE_PROJECT_USERNAME} --repo ${CIRCLE_PROJECT_REPONAME} <<# parameters.production_delivery >>--production-release<</ parameters.production_delivery >> ${HOTFIX_FLAG})
         echo "export RELEASE_ID=$(echo ${RELEASE} | jq .id)" >> ${BASH_ENV}
         echo "export RELEASE_NOTES=$(echo ${RELEASE} | jq .releaseNotes)" >> ${BASH_ENV}
+  - run:
+      name: Generate SBoM, commit it and upload to github release
+      command: npm exec -- app-toolbelt v0 sbom --release-id ${RELEASE_ID} --version-name ${NEW_VERSION_NAME} --path _manifest/spdx_2.3/manifest.spdx.json --branch ${CIRCLE_BRANCH} --private-key ${DELIVERINO_PRIVATE_KEY} --owner ${CIRCLE_PROJECT_USERNAME} --repo ${CIRCLE_PROJECT_REPONAME}
   - run:
       name: Upload android apks to github release
       command: npm exec -- app-toolbelt v0 release upload --releaseId ${RELEASE_ID} --files "$(ls ~/attached_workspace/*.apk)" --private-key ${DELIVERINO_PRIVATE_KEY} --owner ${CIRCLE_PROJECT_USERNAME} --repo ${CIRCLE_PROJECT_REPONAME}
diff --git a/package-lock.json b/package-lock.json
index 4c66fbfb5..ceb11ebef 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -4,7 +4,6 @@
   "requires": true,
   "packages": {
     "": {
-      "name": "entitlementcard",
       "workspaces": [
         "administration",
         "build-configs"
@@ -14,7 +13,7 @@
         "@eslint/eslintrc": "^3.3.6",
         "@trivago/prettier-plugin-sort-imports": "^6.0.2",
         "@typescript-eslint/eslint-plugin": "^8.66.0",
-        "app-toolbelt": "github:digitalfabrik/app-toolbelt#semver:1.0.0",
+        "app-toolbelt": "github:digitalfabrik/app-toolbelt#semver:1.2.1",
         "eslint": "^9.39.4",
         "eslint-config-airbnb": "^19.0.4",
         "eslint-config-prettier": "^10.1.8",
@@ -6317,6 +6316,40 @@
         "@octokit/core": ">=6"
       }
     },
+    "node_modules/@octokit/plugin-throttling": {
+      "version": "11.0.5",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-throttling/-/plugin-throttling-11.0.5.tgz",
+      "integrity": "sha512-LIdrkrUv+DWbKeg/49rGuFJ3SU0d3hUS+B4MhNZLepBoNUFXms8Ic9edJjrlx+zycqJHjrMRudVpVb/bAXM2Lw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/types": "^17.0.0",
+        "bottleneck": "^2.15.3"
+      },
+      "engines": {
+        "node": ">= 20"
+      },
+      "peerDependencies": {
+        "@octokit/core": "^7.0.0"
+      }
+    },
+    "node_modules/@octokit/plugin-throttling/node_modules/@octokit/openapi-types": {
+      "version": "28.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-28.0.0.tgz",
+      "integrity": "sha512-0rFyLuyHvIj6uuZWuDslxkowFYdPXoNIkeAv4b27dzm2Tf4vGWXnPsMcxs7d65kLdMERgP3wc1AEPlqMz8e1cQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@octokit/plugin-throttling/node_modules/@octokit/types": {
+      "version": "17.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-17.0.0.tgz",
+      "integrity": "sha512-ByP1v7YL5SMveFPP7+sj0/ZuWCOOg/Chs4NafOMpq6WNIM/hdGY0S7C0TCGDBWu1aGmOxmUIhMx3cO+IdwYZ1Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/openapi-types": "^28.0.0"
+      }
+    },
     "node_modules/@octokit/request": {
       "version": "10.0.11",
       "resolved": "https://registry.npmjs.org/@octokit/request/-/request-10.0.11.tgz",
@@ -8638,12 +8671,13 @@
       "license": "BSD-2-Clause"
     },
     "node_modules/app-toolbelt": {
-      "version": "0.10.0",
-      "resolved": "git+ssh://git@github.com/digitalfabrik/app-toolbelt.git#f7033bc41282af70515fa9aa971cba6f66919036",
+      "version": "1.2.1",
+      "resolved": "git+ssh://git@github.com/digitalfabrik/app-toolbelt.git#db036e2ab7feef83ce386b12901669f9468221cf",
       "dev": true,
       "dependencies": {
         "@expo/plist": "^0.5.2",
         "@octokit/auth-app": "^8.2.0",
+        "@octokit/plugin-throttling": "^11.0.3",
         "@octokit/rest": "^22.0.1",
         "@sentry/cli": "^3.4.0",
         "@types/flat": "^5.0.5",
@@ -8652,10 +8686,10 @@
         "commander": "^14.0.3",
         "decamelize": "^6.0.1",
         "flat": "^6.0.1",
-        "js-yaml": "^4.1.1",
+        "js-yaml": "^4.3.0",
         "node-fetch": "^3.3.2",
         "oauth": "^0.10.2",
-        "tsx": "^4.21.0",
+        "tsx": "^4.22.4",
         "typescript": "^6.0.3"
       },
       "bin": {
@@ -9154,6 +9188,13 @@
         "readable-stream": "^3.4.0"
       }
     },
+    "node_modules/bottleneck": {
+      "version": "2.19.5",
+      "resolved": "https://registry.npmjs.org/bottleneck/-/bottleneck-2.19.5.tgz",
+      "integrity": "sha512-VHiNCbI1lKdl44tGrhNfU3lup0Tj/ZBMJB5/2ZbNXRCPuRCO7ed2mgcK4r17y+KB2EfuYuRaVlwNbAeaWGSpbw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/brace-expansion": {
       "version": "1.1.18",
       "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
diff --git a/package.json b/package.json
index 41cc9b105..d349371db 100644
--- a/package.json
+++ b/package.json
@@ -21,7 +21,7 @@
     "@eslint/eslintrc": "^3.3.6",
     "@trivago/prettier-plugin-sort-imports": "^6.0.2",
     "@typescript-eslint/eslint-plugin": "^8.66.0",
-    "app-toolbelt": "github:digitalfabrik/app-toolbelt#semver:1.0.0",
+    "app-toolbelt": "github:digitalfabrik/app-toolbelt#semver:1.2.1",
     "eslint": "^9.39.4",
     "eslint-config-airbnb": "^19.0.4",
     "eslint-config-prettier": "^10.1.8",