diff --git a/pkg/sbom/spdx/marshal.go b/pkg/sbom/spdx/marshal.go
index e170beea2..e2aa9860e 100644
--- a/pkg/sbom/spdx/marshal.go
+++ b/pkg/sbom/spdx/marshal.go
@@ -451,7 +451,7 @@ func (m *Marshaler) normalizeLicenses(licenses []string) (string, []*spdx.OtherL
                        if e.IsSPDXExpression() {
                                // Use SimpleExpr for a valid SPDX license with an exception,
                                // to avoid parsing the license and exception separately.
-                               return e
+                               return expression.SimpleExpr{License: e.String()}
                        }
 
                        licenseName = e.String()
diff --git a/pkg/sbom/spdx/marshal_private_test.go b/pkg/sbom/spdx/marshal_private_test.go
index 60d7945ef..26c540d65 100644
--- a/pkg/sbom/spdx/marshal_private_test.go
+++ b/pkg/sbom/spdx/marshal_private_test.go
@@ -70,10 +70,24 @@ func TestMarshaler_normalizeLicenses(t *testing.T) {
                {
                        name: "happy path with WITH operator",
                        input: []string{
-                               "AFL 2.0",
+                               "GPLv2",
+                               "AFL 3.0 with wrong-exceptions",
+                               "LGPL 2.0 and unknown-license and GNU LESSER",
                                "AFL 3.0 with Autoconf-exception-3.0",
                        },
-                       wantLicenseName: "AFL-2.0 AND AFL-3.0 WITH Autoconf-exception-3.0",
+                       wantLicenseName: "GPL-2.0-only AND LicenseRef-51373b28fab165e9 AND LGPL-2.0-only AND LicenseRef-a0bb0951a6dfbdbe AND LGPL-2.1-only AND AFL-3.0 WITH Autoconf-exception-3.0",
+                       wantOtherLicenses: []*spdx.OtherLicense{
+                               {
+                                       LicenseIdentifier: "LicenseRef-51373b28fab165e9",
+                                       LicenseName:       "AFL-3.0 WITH wrong-exceptions",
+                                       ExtractedText:     `This component is licensed under "AFL-3.0 WITH wrong-exceptions"`,
+                               },
+                               {
+                                       LicenseIdentifier: "LicenseRef-a0bb0951a6dfbdbe",
+                                       LicenseName:       "unknown-license",
+                                       ExtractedText:     `This component is licensed under "unknown-license"`,
+                               },
+                       },
                },
                {
                        name: "happy path with non-SPDX exception",

git diff pkg/sbom/cyclonedx/marshal.go 
diff --git a/pkg/sbom/cyclonedx/marshal.go b/pkg/sbom/cyclonedx/marshal.go
index 9c1e00e71..08314b051 100644
--- a/pkg/sbom/cyclonedx/marshal.go
+++ b/pkg/sbom/cyclonedx/marshal.go
@@ -8,7 +8,6 @@ import (
        "sort"
        "strconv"
        "strings"
-       "sync"
 
        cdx "github.com/CycloneDX/cyclonedx-go"
        "github.com/package-url/packageurl-go"
@@ -312,35 +311,33 @@ func (m *Marshaler) normalizeLicense(license string) cdx.LicenseChoice {
        license = strings.ReplaceAll(license, "-with-", " WITH ")
        license = strings.ReplaceAll(license, "-WITH-", " WITH ")
 
-       var licenseChoice cdx.LicenseChoice
-       onceValidateSPDXLicense := sync.Once{}
-       validateSPDXLicense := func(expr expression.Expression) expression.Expression {
-               // We only need to check the main license (not its parts).
-               onceValidateSPDXLicense.Do(func() {
-                       _, compoundExpr := expr.(expression.CompoundExpr)
-                       switch {
-                       case !expr.IsSPDXExpression():
-                               // Use licenseChoice.license.name for invalid SPDX ID / SPDX expression
-                               licenseChoice.License = &cdx.License{Name: expr.String()}
-                       case compoundExpr:
-                               // Use licenseChoice.expression for valid SPDX expression (with any conjunction)
-                               // e.g. "GPL-2.0 WITH Classpath-exception-2.0" or "GPL-2.0 AND MIT"
-                               licenseChoice.Expression = expr.String()
-                       default:
-                               // Use licenseChoice.license.id for valid SPDX ID
-                               licenseChoice.License = &cdx.License{ID: expr.String()}
-                       }
-               })
-
-               return expr
-       }
-
-       _, err := expression.Normalize(license, licensing.NormalizeLicense, expression.NormalizeForSPDX, validateSPDXLicense)
+       normalizedLicenses, err := expression.Normalize(license, licensing.NormalizeLicense, expression.NormalizeForSPDX)
        if err != nil {
                // Not fail on the invalid license
                m.logger.Warn("Unable to marshal SPDX licenses", log.String("license", license))
                return cdx.LicenseChoice{}
        }
+
+       // Case 1: the license is not a valid SPDX ID or SPDX expression
+       if !normalizedLicenses.IsSPDXExpression() {
+               // Use LicenseChoice.License.Name for invalid SPDX ID / SPDX expression
+               return cdx.LicenseChoice{
+                       License: &cdx.License{Name: normalizedLicenses.String()},
+               }
+       }
+
+       // Case 2: the license is a valid SPDX ID or SPDX expression
+       var licenseChoice cdx.LicenseChoice
+       switch normalizedLicenses.(type) {
+       case expression.SimpleExpr:
+               // Use LicenseChoice.License.ID for valid SPDX ID
+               licenseChoice.License = &cdx.License{ID: normalizedLicenses.String()}
+       case expression.CompoundExpr:
+               // Use LicenseChoice.Expression for valid SPDX expression (with any conjunction)
+               // e.g. "GPL-2.0 WITH Classpath-exception-2.0" or "GPL-2.0 AND MIT"
+               licenseChoice.Expression = normalizedLicenses.String()
+       }
+
        return licenseChoice
 }