diff --git a/meta/lib/oe/spdx30_tasks.py b/meta/lib/oe/spdx30_tasks.py
index 0a8f4b0e1a0..f782ea1cadf 100644
--- a/meta/lib/oe/spdx30_tasks.py
+++ b/meta/lib/oe/spdx30_tasks.py
@@ -497,6 +497,7 @@ def add_download_files(d, objset):
             primary_purpose = oe.spdx30.software_SoftwarePurpose.source
 
         if fd.type == "file":
+            (layer_path, layer_objset) = get_layer_info(d, fd.localpath)
             if os.path.isdir(fd.localpath):
                 walk_idx = 1
                 for root, dirs, files in os.walk(fd.localpath, onerror=walk_error):
@@ -512,23 +513,36 @@ def add_download_files(d, objset):
                             objset.new_spdxid(
                                 "source", str(download_idx + 1), str(walk_idx)
                             ),
-                            os.path.join(
-                                file_name, os.path.relpath(f_path, fd.localpath)
-                            ),
+                            os.path.relpath(f_path, layer_path),
                             f_path,
                             purposes=[primary_purpose],
                         )
 
+                        if layer_objset is not None:
+                            objset.new_scoped_relationship(
+                                [oe.sbom30.get_element_link_id(layer_objset)],
+                                oe.spdx30.RelationshipType.contains,
+                                oe.spdx30.LifecycleScopeType.build,
+                                [file],
+                            )
+
                         inputs.add(file)
                         walk_idx += 1
 
             else:
                 file = objset.new_file(
                     objset.new_spdxid("source", str(download_idx + 1)),
-                    file_name,
+                    os.path.relpath(fd.localpath, layer_path),
                     fd.localpath,
                     purposes=[primary_purpose],
                 )
+                if layer_objset is not None:
+                    objset.new_scoped_relationship(
+                        [oe.sbom30.get_element_link_id(layer_objset)],
+                        oe.spdx30.RelationshipType.contains,
+                        oe.spdx30.LifecycleScopeType.build,
+                        [file],
+                    )
                 inputs.add(file)
 
         else:
@@ -803,6 +817,28 @@ def load_recipe_spdx(d):
         oe.spdx30.software_Package,
     )
 
+def get_layer_info(d, path):
+    layer = None
+    path = Path(path)
+
+    layers = oe.buildcfg.get_layer_revisions(d)
+    for (l_path, l_name, l_branch, l_rev, l_ismodified) in layers:
+        l_path = Path(l_path)
+        if l_path in path.parents:
+            layer = l_name
+            break
+
+    if not l_path:
+        if oe.utils.vartrue("SPDX_REQUIRE_LAYER_ASSERTION", True, False, d):
+          bb.fatal(f"Path {path} does not originate from a meta-layer!")
+        return ("/", None)
+
+    deploy_dir_spdx = Path(d.getVar("DEPLOY_DIR_SPDX"))
+    objset = oe.sbom30.load_jsonld(d, deploy_dir_spdx / "layers.spdx.json", required=True)
+    spdx_obj = objset.find_root(oe.spdx30.software_Package, name=l_name)
+
+    return (l_path, spdx_obj)
+
 
 def create_spdx(d):
     def set_var_field(var, obj, name, package=None):