diff --git a/cmd/image-builder/manifest.go b/cmd/image-builder/manifest.go
index b7562ed..5c46ab3 100644
--- a/cmd/image-builder/manifest.go
+++ b/cmd/image-builder/manifest.go
@@ -41,11 +41,13 @@ func sbomWriter(outputDir, filename string, content io.Reader) error {
 	if err != nil {
 		return err
 	}
+	// ensure we do not leak FDs if the function returns prematurely
 	defer f.Close()
+
 	if _, err := io.Copy(f, content); err != nil {
 		return err
 	}
-	return nil
+	return f.Close()
 }
 
 // used in tests