diff --git a/meta/classes-recipe/sbom-cve-check.bbclass b/meta/classes-recipe/sbom-cve-check.bbclass
index 451595f..b184c12 100644
--- a/meta/classes-recipe/sbom-cve-check.bbclass
+++ b/meta/classes-recipe/sbom-cve-check.bbclass
@@ -14,9 +14,20 @@ python do_sbom_cve_check() {
     """
     Task: Run sbom-cve-check analysis on SBOM.
     """
-    sbom_path = d.expand("${DEPLOY_DIR_IMAGE}/${IMAGE_NAME}.spdx.json")
+    import os
+
     image_name = d.getVar("IMAGE_NAME")
     link_name = d.getVar("IMAGE_LINK_NAME")
+    deploy_dir = d.getVar("DEPLOY_DIR_IMAGE")
+
+    # IMAGE_NAME carries DATETIME, which changes on every invocation while being
+    # excluded from task hashes, so this path is only valid when
+    # do_create_image_sbom_spdx ran in the same invocation. Fall back to the
+    # symlink it maintains, which is stable across builds.
+    sbom_path = os.path.join(deploy_dir, "%s.spdx.json" % image_name)
+    if not os.path.exists(sbom_path) and link_name:
+        sbom_path = os.path.join(deploy_dir, "%s.spdx.json" % link_name)
+
     run_sbom_cve_check(d, sbom_path, image_name, link_name)
 }