diff --git a/pkgs/by-name/li/lib4sbom/package.nix b/pkgs/development/python-modules/lib4sbom/default.nix
similarity index 87%
rename from pkgs/by-name/li/lib4sbom/package.nix
rename to pkgs/development/python-modules/lib4sbom/default.nix
index c9c159f1b6ad..0840b14c70b7 100644
--- a/pkgs/by-name/li/lib4sbom/package.nix
+++ b/pkgs/development/python-modules/lib4sbom/default.nix
@@ -1,9 +1,13 @@
 { lib
-, python3Packages
+, buildPythonPackage
 , fetchFromGitHub
+, pyyaml
+, semantic-version
+, defusedxml
+, pytestCheckHook
 }:
 
-python3Packages.buildPythonPackage rec {
+buildPythonPackage rec {
   pname = "lib4sbom";
   version = "0.7.1";
   format = "setuptools";
@@ -15,13 +19,13 @@ python3Packages.buildPythonPackage rec {
     hash = "sha256-UQZZYTRDbUqSH6F8hjhp9L70025cRO3zXQ8Aoznotg4=";
   };
 
-  propagatedBuildInputs = with python3Packages; [
+  dependencies = [
     pyyaml
     semantic-version
     defusedxml
   ];
 
-  nativeCheckInputs = with python3Packages; [
+  nativeCheckInputs = [
     pytestCheckHook
   ];
 
diff --git a/pkgs/tools/security/cve-bin-tool/default.nix b/pkgs/tools/security/cve-bin-tool/default.nix
index 67b882ee103f..b269cd362f2b 100644
--- a/pkgs/tools/security/cve-bin-tool/default.nix
+++ b/pkgs/tools/security/cve-bin-tool/default.nix
@@ -1,35 +1,31 @@
 { lib
 , buildPythonApplication
 , fetchFromGitHub
+  # aiohttp[speedups]
+, aiodns
+, aiohttp
+, beautifulsoup4
+, brotlipy
+, cvss
+, distro
 , filetype
+, google-cloud-sdk
+, jinja2
 , jsonschema
 , lib4sbom
 , packageurl-python
-, python-gnupg
-, plotly
-, beautifulsoup4
-, pyyaml
-, isort
-, py
-, jinja2
-, rpmfile
-, reportlab
-, zstandard
-, rich
-, aiohttp
-, toml
-, distro
-  # aiohttp[speedups]
-, aiodns
-, brotlipy
-, faust-cchardet
-, pillow
-, pytestCheckHook
-, xmlschema
-, setuptools
 , packaging
-, cvss
-, google-cloud-sdk
+, plotly
+, pytestCheckHook
+, python-gnupg
+, pyyaml
+, rich
+, rpmfile
+, setuptools
+, toml
+, xmlschema
+, zstandard
+, reportlab
 , pip
 , testers
 , cve-bin-tool
@@ -50,45 +46,45 @@ buildPythonApplication rec {
   # Wants to open a sqlite database, access the internet, etc
   doCheck = false;
 
-  propagatedNativeBuildInputs = [
-    pip
-  ];
-
-  propagatedBuildInputs = [
-    google-cloud-sdk
+  dependencies = [
+    # aiohttp[speedups]
+    aiodns
+    aiohttp
+    beautifulsoup4
+    brotlipy
+    cvss
+    distro
     filetype
+    google-cloud-sdk # gsutil
+    jinja2
     jsonschema
     lib4sbom
     packageurl-python
-    python-gnupg
-    plotly
-    beautifulsoup4
-    pyyaml
-    isort
-    py
-    jinja2
-    rpmfile
-    reportlab
-    zstandard
-    rich
-    aiohttp
-    toml
-    distro
-    # aiohttp[speedups]
-    aiodns
-    brotlipy
-    faust-cchardet
-    # needed by brotlipy
-    pillow
-    setuptools
-    xmlschema
-    cvss
     packaging
+    plotly
+    python-gnupg
+    pyyaml
+    rich
+    rpmfile
+    setuptools
+    toml
+    xmlschema
+    zstandard
+  ];
+
+  optional-dependencies = {
+    pdf = [
+      reportlab
+    ];
+  };
+
+  propagatedBuildInputs = [
+    pip
   ];
 
   nativeCheckInputs = [
     pytestCheckHook
-  ];
+  ] ++ lib.flatten (lib.attrValues optional-dependencies);
 
   pythonImportsCheck = [
     "cve_bin_tool"
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index a78d1c956a7a..d2bc87b3c22e 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6564,6 +6564,8 @@ self: super: with self; {
 
   pa-ringbuffer = callPackage ../development/python-modules/pa-ringbuffer { };
 
+  lib4sbom = callPackage ../development/python-modules/lib4sbom { };
+
   libais = callPackage ../development/python-modules/libais { };
 
   libarchive-c = callPackage ../development/python-modules/libarchive-c {