diff --git a/scripts/fetch-github-sbom.js b/scripts/fetch-github-sbom.js
index 807ab564..0483c4d8 100644
--- a/scripts/fetch-github-sbom.js
+++ b/scripts/fetch-github-sbom.js
@@ -414,7 +414,10 @@ async function processLatestTagStream(spec, existing) {
     }
 
     releases[cacheKey] = {
-      tag: imageRef,
+      // Store cacheKey as tag (e.g. "latest-20260514") so buildNvidiaMapFromSbomStream
+      // and the nvidiaByTag lookup in buildStreamFromSbom can match by cacheKey.
+      // Storing the full imageRef causes the lookup to fail (wrong image name).
+      tag: cacheKey,
       imageRef,
       digest: null,
       attestation,