diff --git a/pkgs/by-name/bo/bomly/package.nix b/pkgs/by-name/bo/bomly/package.nix
new file mode 100644
index 000000000000..e09af8124794
--- /dev/null
+++ b/pkgs/by-name/bo/bomly/package.nix
@@ -0,0 +1,66 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  grype,
+  makeBinaryWrapper,
+  nix-update-script,
+  syft,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "bomly";
+  version = "0.16.0";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "bomly-dev";
+    repo = "bomly-cli";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-y4FJCOzgEUprIBy/RuWVIlco4bI0XNUNabRr+2VebgM=";
+  };
+
+  vendorHash = "sha256-qptl09fBZigImxr0ReWIqdmvyeHqr372pZqDnyMHe5A=";
+
+  # .gitattributes excludes all testdata from the GitHub tarball
+  postPatch = ''
+    mkdir -p internal/benchmark/testdata
+    cp ${./scan_targets.json} internal/benchmark/testdata/scan_targets.json
+  '';
+
+  buildInputs = [ makeBinaryWrapper ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  # testdata directories are excluded from the GitHub tarball via .gitattributes
+  doCheck = false;
+
+  ldflags = [
+    "-s"
+    "-X=main.version=${finalAttrs.version}"
+  ];
+
+  postFixup = ''
+    wrapProgram $out/bin/bomly --prefix PATH : "${
+      lib.makeBinPath [
+        grype
+        syft
+      ]
+    }"
+  '';
+
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "CLI for dependency intelligence, SBOMs, vulnerability auditing, and CI policy gates";
+    homepage = "https://github.com/bomly-dev/bomly-cli";
+    changelog = "https://github.com/bomly-dev/bomly-cli/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "bomly";
+  };
+})
diff --git a/pkgs/by-name/bo/bomly/scan_targets.json b/pkgs/by-name/bo/bomly/scan_targets.json
new file mode 100644
index 000000000000..95f0279f4b60
--- /dev/null
+++ b/pkgs/by-name/bo/bomly/scan_targets.json
@@ -0,0 +1,160 @@
+[
+  {
+    "name": "scan-go",
+    "url": "https://github.com/bomly-dev/example-go-gomod",
+    "ref": "v1.0.0",
+    "ecosystem": "go",
+    "tools": ["go"],
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-npm",
+    "url": "https://github.com/bomly-dev/example-javascript-npm",
+    "ref": "v1.0.0",
+    "ecosystem": "npm",
+    "tools": ["npm"],
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-maven",
+    "url": "https://github.com/bomly-dev/example-java-maven",
+    "ref": "v1.0.0",
+    "ecosystem": "maven",
+    "tools": ["mvn"],
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-python-pip",
+    "url": "https://github.com/bomly-dev/example-python-pip",
+    "ref": "fe04c758134b95dab102e1fce10275f7d18c0cf2",
+    "ecosystem": "python",
+    "tools": ["pip"],
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-composer",
+    "url": "https://github.com/bomly-dev/example-php-composer",
+    "ref": "v1.0.0",
+    "ecosystem": "php",
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-bundler",
+    "url": "https://github.com/bomly-dev/example-ruby-bundler",
+    "ref": "v1.0.0",
+    "ecosystem": "ruby",
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-github-actions",
+    "url": "https://github.com/bomly-dev/example-github-actions",
+    "ref": "v1.0.0",
+    "ecosystem": "github-actions",
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-nuget",
+    "url": "https://github.com/bomly-dev/example-dotnet-nuget",
+    "ref": "v1.0.0",
+    "ecosystem": "dotnet",
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-cargo",
+    "url": "https://github.com/bomly-dev/example-rust-cargo",
+    "ref": "v1.0.0",
+    "ecosystem": "rust",
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-pub",
+    "url": "https://github.com/bomly-dev/example-dart-pub",
+    "ref": "v1.0.0",
+    "ecosystem": "dart",
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-cocoapods",
+    "url": "https://github.com/bomly-dev/example-swift-cocoapods",
+    "ref": "v1.0.0",
+    "ecosystem": "swift",
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-mix",
+    "url": "https://github.com/bomly-dev/example-elixir-mix",
+    "ref": "v1.0.0",
+    "ecosystem": "elixir",
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-swiftpm",
+    "url": "https://github.com/bomly-dev/example-swift-swiftpm",
+    "ref": "v1.0.0",
+    "ecosystem": "swift",
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-sbt",
+    "url": "https://github.com/bomly-dev/example-scala-sbt",
+    "ref": "v1.0.0",
+    "ecosystem": "scala",
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-yarn",
+    "url": "https://github.com/bomly-dev/example-javascript-yarn",
+    "ref": "v1.0.0",
+    "ecosystem": "npm",
+    "tools": ["npm"],
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-pnpm",
+    "url": "https://github.com/bomly-dev/example-javascript-pnpm",
+    "ref": "v1.0.0",
+    "ecosystem": "npm",
+    "tools": ["npm"],
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-gradle",
+    "url": "https://github.com/bomly-dev/example-java-gradle",
+    "ref": "v1.0.0",
+    "ecosystem": "maven",
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-python-pipenv",
+    "url": "https://github.com/bomly-dev/example-python-pipenv",
+    "ref": "v1.0.0",
+    "ecosystem": "python",
+    "args": ["--install-first"],
+    "tools": ["pipenv"],
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-python-poetry",
+    "url": "https://github.com/bomly-dev/example-python-poetry",
+    "ref": "v1.0.0",
+    "ecosystem": "python",
+    "tools": ["poetry"],
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-python-uv",
+    "url": "https://github.com/bomly-dev/example-python-uv",
+    "ref": "v1.0.0",
+    "ecosystem": "python",
+    "args": ["--install-first"],
+    "tools": ["uv"],
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-cpp-conan",
+    "url": "https://github.com/bomly-dev/example-cpp-conan",
+    "ref": "v1.0.0",
+    "ecosystem": "cpp",
+    "benchmark_enabled": true
+  }
+]