Once CycloneDX/cyclonedx-maven-plugin#419 is solved and published, we can remove the process-sbom execution and add the external reference to the plugin configuration.