diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index ea9ba60..5c6c6e0 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -21,7 +21,10 @@ jobs:
     - name: Install dependencies
       run: |
         python -m pip install --upgrade pip
-        pip install setuptools wheel twine
+        # setuptools is pinned below 81 because cyclonedx-bom 3.11.7 imports
+        # pkg_resources, which setuptools removed in 81. Remove this pin once
+        # the SBOM tooling is upgraded (cyclonedx-bom 7.x drops pkg_resources).
+        pip install "setuptools<81" wheel twine
     - name: Generate SBOM
       run: |
         pip install cyclonedx-bom==3.11.7
diff --git a/demo/requirements.txt b/demo/requirements.txt
index f224758..5870785 100644
--- a/demo/requirements.txt
+++ b/demo/requirements.txt
@@ -1,3 +1,3 @@
 Flask>=1.1.2
 configparser>=4.0.2
-duo_universal>=2.3.0
+duo_universal>=2.3.1
diff --git a/duo_universal/version.py b/duo_universal/version.py
index 55e4709..3a5935a 100644
--- a/duo_universal/version.py
+++ b/duo_universal/version.py
@@ -1 +1 @@
-__version__ = "2.3.0"
+__version__ = "2.3.1"
diff --git a/scripts/make-sbom.sh b/scripts/make-sbom.sh
index abb1505..adb9e53 100755
--- a/scripts/make-sbom.sh
+++ b/scripts/make-sbom.sh
@@ -1,4 +1,8 @@
 #!/usr/bin/env bash
+# Fail fast: without this, a failure in cyclonedx-py surfaces further down as a
+# confusing "could not find cyclonedx-sbom.json" from the convert step.
+set -euo pipefail
+
 cyclonedx-py --e --format json -o cyclonedx-sbom.json
 wget https://github.com/CycloneDX/cyclonedx-cli/releases/download/v0.24.2/cyclonedx-linux-x64
 chmod u+x cyclonedx-linux-x64