diff --git a/meta/conf/fragments/yocto/sbom-cve-check.conf b/meta/conf/fragments/yocto/sbom-cve-check.conf
index 73ed35be27..46f6965a0d 100644
--- a/meta/conf/fragments/yocto/sbom-cve-check.conf
+++ b/meta/conf/fragments/yocto/sbom-cve-check.conf
@@ -13,6 +13,9 @@ IMAGE_CLASSES:append = " sbom-cve-check"
 
 SRCREV:pn-sbom-cve-check-update-nvd-native = "${AUTOREV}"
 SRCREV:pn-sbom-cve-check-update-cvelist-native = "${AUTOREV}"
+# Drop the tag= or else do_unpack fails
+SRC_URI:pn-sbom-cve-check-update-cvelist-native = "git://github.com/CVEProject/cvelistV5.git;branch=main;protocol=https;destsuffix="
+SRC_URI:pn-sbom-cve-check-update-nvd-native = "git://github.com/fkie-cad/nvd-json-data-feeds.git;branch=main;protocol=https;destsuffix="
 
 SPDX_INCLUDE_VEX = "all"
 SPDX_INCLUDE_COMPILED_SOURCES:pn-linux-yocto = "1"