diff --git a/internal/sbom/mod_1.18.go b/internal/sbom/mod_1.18.go
index 5defd2c6f3..d8bf2b4a54 100644
--- a/internal/sbom/mod_1.18.go
+++ b/internal/sbom/mod_1.18.go
@@ -25,7 +25,7 @@ import (
 type BuildInfo debug.BuildInfo
 
 func ParseBuildInfo(data string) (*BuildInfo, error) {
-	dbi, err := debug.ParseBuildInfo(string(data))
+	dbi, err := debug.ParseBuildInfo(data)
 	if err != nil {
 		return nil, fmt.Errorf("parsing build info: %w", err)
 	}
diff --git a/internal/sbom/sbom.go b/internal/sbom/sbom.go
index 1728fbd786..d7e91b23c9 100644
--- a/internal/sbom/sbom.go
+++ b/internal/sbom/sbom.go
@@ -19,6 +19,7 @@ import (
 	"bytes"
 	"fmt"
 	"strings"
+	"unicode"
 )
 
 // massageGoModVersion massages the output of `go version -m` into a form that
@@ -41,7 +42,8 @@ func massageGoVersionM(b []byte) ([]byte, error) {
 		return nil, fmt.Errorf("malformed input: %w", err)
 	}
 	for scanner.Scan() {
-		line := strings.TrimSpace(scanner.Text())
+		// NOTE: debug.ParseBuildInfo relies on trailing tabs.
+		line := strings.TrimLeftFunc(scanner.Text(), unicode.IsSpace)
 		fmt.Fprintln(&out, line)
 	}
 	if err := scanner.Err(); err != nil {