diff --git a/coin/provisioning/common/linux/syft.sh b/coin/provisioning/common/linux/syft.sh
new file mode 100755
index 00000000..cb9aa96b
--- /dev/null
+++ b/coin/provisioning/common/linux/syft.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# Copyright (C) 2026 The Qt Company Ltd.
+# SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
+
+# This script installs Syft
+
+# Syft is used for generating SBOM (Software Bill of Materials) files.
+
+# shellcheck source=../unix/InstallFromCompressedFileFromURL.sh
+source "${BASH_SOURCE%/*}/../unix/InstallFromCompressedFileFromURL.sh"
+# shellcheck source=../unix/SetEnvVar.sh
+source "${BASH_SOURCE%/*}/../unix/SetEnvVar.sh"
+
+
+version="1.45.1"
+
+uname_m="$(uname -m)"
+case "$uname_m" in
+    x86_64|amd64)
+        SHA1="06e1d56173209977df8b11ad955843cb62f874fd"
+        arch="amd64"
+        ;;
+    arm64|aarch64)
+        SHA1="c48638b3998066dbd139e94e116a81a6cc6299be"
+        arch="arm64"
+        ;;
+    *) fatal "Unknown architecture in uname: $uname_m" 43 ;;
+esac
+
+PrimaryUrl="http://ci-files01-hki.ci.qt.io/input/syft/syft_${version}_linux_${arch}.tar.gz"
+AltUrl="https://github.com/anchore/syft/releases/download/v${version}/syft_${version}_linux_${arch}.tar.gz"
+targetFolder="/opt/syft-$version"
+appPrefix=""
+
+InstallFromCompressedFileFromURL "$PrimaryUrl" "$AltUrl" "$SHA1" "$targetFolder" "$appPrefix"
+
+SetEnvVar "PATH" "$targetFolder:\$PATH"
+
+echo "Syft = $version" >> ~/versions.txt
diff --git a/coin/provisioning/common/macos/syft.sh b/coin/provisioning/common/macos/syft.sh
new file mode 100755
index 00000000..e044203d
--- /dev/null
+++ b/coin/provisioning/common/macos/syft.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# Copyright (C) 2026 The Qt Company Ltd.
+# SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
+
+# This script installs Syft
+
+# Syft is used for generating SBOM (Software Bill of Materials) files.
+
+# shellcheck source=../unix/InstallFromCompressedFileFromURL.sh
+source "${BASH_SOURCE%/*}/../unix/InstallFromCompressedFileFromURL.sh"
+# shellcheck source=../unix/SetEnvVar.sh
+source "${BASH_SOURCE%/*}/../unix/SetEnvVar.sh"
+
+
+version="1.45.1"
+
+uname_m="$(uname -m)"
+case "$uname_m" in
+    x86_64|amd64)
+        SHA1="ecd1a9283e4ce025b5905a85e505fcba237edd51"
+        arch="amd64"
+        ;;
+    arm64|aarch64)
+        SHA1="996f3985f14ebbe8661c0b72d7ad520200155c46"
+        arch="arm64"
+        ;;
+    *) fatal "Unknown architecture in uname: $uname_m" 43 ;;
+esac
+
+PrimaryUrl="http://ci-files01-hki.ci.qt.io/input/syft/syft_${version}_darwin_${arch}.tar.gz"
+AltUrl="https://github.com/anchore/syft/releases/download/v${version}/syft_${version}_darwin_${arch}.tar.gz"
+targetFolder="/opt/syft-$version"
+appPrefix=""
+
+InstallFromCompressedFileFromURL "$PrimaryUrl" "$AltUrl" "$SHA1" "$targetFolder" "$appPrefix"
+
+SetEnvVar "PATH" "$targetFolder:\$PATH"
+
+echo "Syft = $version" >> ~/versions.txt
diff --git a/coin/provisioning/common/windows/syft.ps1 b/coin/provisioning/common/windows/syft.ps1
new file mode 100644
index 00000000..d521ce93
--- /dev/null
+++ b/coin/provisioning/common/windows/syft.ps1
@@ -0,0 +1,44 @@
+# Copyright (C) 2026 The Qt Company Ltd
+# SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
+
+. "$PSScriptRoot\helpers.ps1"
+
+$version = "1.45.1"
+
+$cpu_arch = Get-CpuArchitecture
+Write-Host "Installing Syft for architecture $cpu_arch"
+switch ($cpu_arch) {
+    arm64 {
+        $arch = "arm64"
+        $sha1 = "f629f6fa9c542e8803aa13987f8104a441c15878"
+        Break
+    }
+    x64 {
+        $arch = "amd64"
+        $sha1 = "debd2e1e77763fe8cf224e791abf79e11dc4a93b"
+        Break
+    }
+    default {
+        throw "Unknown architecture $cpu_arch"
+    }
+}
+
+$filename = "syft_" + $version + "_windows_" + $arch
+$filename_zip = $filename + ".zip"
+
+$zip = Get-DownloadLocation ($filename_zip)
+$externalUrl = "https://github.com/anchore/syft/releases/download/v" + $version + "/" + $filename_zip
+$internalUrl = "https://ci-files01-hki.ci.qt.io/input/syft/" + $filename_zip
+
+Write-Host "Removing old syft"
+Remove "C:\syft"
+
+Download $externalUrl $internalUrl $zip
+Verify-Checksum $zip $sha1
+
+Extract-7Zip $zip C:\syft
+Remove "$zip"
+
+Add-Path "C:\syft"
+
+Write-Output "Syft ($arch) = $version" >> ~\versions.txt
diff --git a/coin/provisioning/qtci-linux-RHEL-10.0-x86_64/09-install-syft.sh b/coin/provisioning/qtci-linux-RHEL-10.0-x86_64/09-install-syft.sh
new file mode 100755
index 00000000..cc0db58b
--- /dev/null
+++ b/coin/provisioning/qtci-linux-RHEL-10.0-x86_64/09-install-syft.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+#Copyright (C) 2026 The Qt Company Ltd
+#SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
+
+set -ex
+
+BASEDIR=$(dirname "$0")
+"$BASEDIR/../common/linux/syft.sh"
diff --git a/coin/provisioning/qtci-linux-RHEL-9.6-x86_64/09-install-syft.sh b/coin/provisioning/qtci-linux-RHEL-9.6-x86_64/09-install-syft.sh
new file mode 100755
index 00000000..cc0db58b
--- /dev/null
+++ b/coin/provisioning/qtci-linux-RHEL-9.6-x86_64/09-install-syft.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+#Copyright (C) 2026 The Qt Company Ltd
+#SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
+
+set -ex
+
+BASEDIR=$(dirname "$0")
+"$BASEDIR/../common/linux/syft.sh"
diff --git a/coin/provisioning/qtci-linux-SLES-15_SP6-x86_64/09-install-syft.sh b/coin/provisioning/qtci-linux-SLES-15_SP6-x86_64/09-install-syft.sh
new file mode 100755
index 00000000..cc0db58b
--- /dev/null
+++ b/coin/provisioning/qtci-linux-SLES-15_SP6-x86_64/09-install-syft.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+#Copyright (C) 2026 The Qt Company Ltd
+#SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
+
+set -ex
+
+BASEDIR=$(dirname "$0")
+"$BASEDIR/../common/linux/syft.sh"
diff --git a/coin/provisioning/qtci-linux-Ubuntu-22.04-x86_64/09-install-syft.sh b/coin/provisioning/qtci-linux-Ubuntu-22.04-x86_64/09-install-syft.sh
new file mode 100755
index 00000000..cc0db58b
--- /dev/null
+++ b/coin/provisioning/qtci-linux-Ubuntu-22.04-x86_64/09-install-syft.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+#Copyright (C) 2026 The Qt Company Ltd
+#SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
+
+set -ex
+
+BASEDIR=$(dirname "$0")
+"$BASEDIR/../common/linux/syft.sh"
diff --git a/coin/provisioning/qtci-linux-Ubuntu-24.04-aarch64/09-install-syft.sh b/coin/provisioning/qtci-linux-Ubuntu-24.04-aarch64/09-install-syft.sh
new file mode 100755
index 00000000..cc0db58b
--- /dev/null
+++ b/coin/provisioning/qtci-linux-Ubuntu-24.04-aarch64/09-install-syft.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+#Copyright (C) 2026 The Qt Company Ltd
+#SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
+
+set -ex
+
+BASEDIR=$(dirname "$0")
+"$BASEDIR/../common/linux/syft.sh"
diff --git a/coin/provisioning/qtci-linux-Ubuntu-24.04-x86_64/09-install-syft.sh b/coin/provisioning/qtci-linux-Ubuntu-24.04-x86_64/09-install-syft.sh
new file mode 100755
index 00000000..cc0db58b
--- /dev/null
+++ b/coin/provisioning/qtci-linux-Ubuntu-24.04-x86_64/09-install-syft.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+#Copyright (C) 2026 The Qt Company Ltd
+#SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
+
+set -ex
+
+BASEDIR=$(dirname "$0")
+"$BASEDIR/../common/linux/syft.sh"
diff --git a/coin/provisioning/qtci-linux-openSUSE-16.0-x86_64/09-install-syft.sh b/coin/provisioning/qtci-linux-openSUSE-16.0-x86_64/09-install-syft.sh
new file mode 100755
index 00000000..cc0db58b
--- /dev/null
+++ b/coin/provisioning/qtci-linux-openSUSE-16.0-x86_64/09-install-syft.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+#Copyright (C) 2026 The Qt Company Ltd
+#SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
+
+set -ex
+
+BASEDIR=$(dirname "$0")
+"$BASEDIR/../common/linux/syft.sh"
diff --git a/coin/provisioning/qtci-macos-15-arm/27-syft.sh b/coin/provisioning/qtci-macos-15-arm/27-syft.sh
new file mode 100755
index 00000000..60d8bd25
--- /dev/null
+++ b/coin/provisioning/qtci-macos-15-arm/27-syft.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+#Copyright (C) 2026 The Qt Company Ltd
+#SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
+
+set -ex
+
+# shellcheck source=../common/macos/syft.sh
+source "${BASH_SOURCE%/*}/../common/macos/syft.sh"
diff --git a/coin/provisioning/qtci-macos-26-arm/27-syft.sh b/coin/provisioning/qtci-macos-26-arm/27-syft.sh
new file mode 100755
index 00000000..60d8bd25
--- /dev/null
+++ b/coin/provisioning/qtci-macos-26-arm/27-syft.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+#Copyright (C) 2026 The Qt Company Ltd
+#SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
+
+set -ex
+
+# shellcheck source=../common/macos/syft.sh
+source "${BASH_SOURCE%/*}/../common/macos/syft.sh"
diff --git a/coin/provisioning/qtci-windows-10_22H2-x86_64/09-syft.ps1 b/coin/provisioning/qtci-windows-10_22H2-x86_64/09-syft.ps1
new file mode 100644
index 00000000..4e5d15ec
--- /dev/null
+++ b/coin/provisioning/qtci-windows-10_22H2-x86_64/09-syft.ps1
@@ -0,0 +1,4 @@
+# Copyright (C) 2026 The Qt Company Ltd
+# SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
+
+. "$PSScriptRoot\..\common\windows\syft.ps1"
diff --git a/coin/provisioning/qtci-windows-11_23H2-aarch64/09-syft.ps1 b/coin/provisioning/qtci-windows-11_23H2-aarch64/09-syft.ps1
new file mode 100644
index 00000000..4e5d15ec
--- /dev/null
+++ b/coin/provisioning/qtci-windows-11_23H2-aarch64/09-syft.ps1
@@ -0,0 +1,4 @@
+# Copyright (C) 2026 The Qt Company Ltd
+# SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
+
+. "$PSScriptRoot\..\common\windows\syft.ps1"
diff --git a/coin/provisioning/qtci-windows-11_24H2-x86_64/09-syft.ps1 b/coin/provisioning/qtci-windows-11_24H2-x86_64/09-syft.ps1
new file mode 100644
index 00000000..4e5d15ec
--- /dev/null
+++ b/coin/provisioning/qtci-windows-11_24H2-x86_64/09-syft.ps1
@@ -0,0 +1,4 @@
+# Copyright (C) 2026 The Qt Company Ltd
+# SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
+
+. "$PSScriptRoot\..\common\windows\syft.ps1"