diff --git a/.github/workflows/verify.yaml b/.github/workflows/verify.yaml
index 88e28e2f901..6a960226513 100644
--- a/.github/workflows/verify.yaml
+++ b/.github/workflows/verify.yaml
@@ -80,7 +80,6 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: eclipse-edc/.github/.github/actions/setup-build@main
-
       - name: Component Tests
         run: ./gradlew test -DincludeTags="ComponentTest"
 
@@ -97,3 +96,38 @@ jobs:
     uses: eclipse-edc/.github/.github/workflows/verify-openapi.yml@main
     secrets: inherit
 
+  Verify-BOM:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+
+      # we can't test the "controlplane-oauth2-com" because it only starts successfully if the public key is already in the vault
+      matrix:
+        bom-directory: [ "dist/bom/dataplane-base-bom",
+                         "dist/bom/controlplane-dcp-bom",
+                         "dist/bom/sts-feature-bom" ]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: eclipse-edc/.github/.github/actions/setup-build@main
+      - name: Build runtime
+        run: ./gradlew -p ${{ matrix.bom-directory }} build
+      - name: Smoke Test
+        timeout-minutes: 10
+        run: |
+          # Start the program in the background
+          java -Dedc.fs.config=${{ matrix.bom-directory }}/example.properties -cp "$(./gradlew -q -p ${{ matrix.bom-directory }} printClassPath)" org.eclipse.edc.boot.system.runtime.BaseRuntime > ${{ matrix.bom-directory }}/log.txt &
+
+          # Get the PID of the running command
+          PID=$!
+
+          # Monitor the output and kill the process when desired output is found
+          while :; do
+            # Capture the output of the command
+            cat ${{ matrix.bom-directory }}/log.txt 2>/dev/null | grep -q "Runtime .* ready" && break
+            sleep 1
+          done
+
+          # Kill the process once the output is detected
+          kill $PID
+          echo "Runtime ${{ matrix.bom-directory }} shutdown after ready signal detected."
+          rm ${{ matrix.bom-directory }}/log.txt
diff --git a/dist/bom/controlplane-base-bom/build.gradle.kts b/dist/bom/controlplane-base-bom/build.gradle.kts
new file mode 100644
index 00000000000..9c7c099ed39
--- /dev/null
+++ b/dist/bom/controlplane-base-bom/build.gradle.kts
@@ -0,0 +1,53 @@
+/*
+ *  Copyright (c) 2024 Bayerische Motoren Werke Aktiengesellschaft (BMW AG)
+ *
+ *  This program and the accompanying materials are made available under the
+ *  terms of the Apache License, Version 2.0 which is available at
+ *  https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  SPDX-License-Identifier: Apache-2.0
+ *
+ *  Contributors:
+ *       Bayerische Motoren Werke Aktiengesellschaft (BMW AG) - initial API and implementation
+ *
+ */
+
+plugins {
+    `java-library`
+}
+
+dependencies {
+    // SPI dependencies
+    api(project(":spi:common:core-spi"))
+
+    // core dependencies
+    api(project(":core:common:boot"))
+    api(project(":core:common:connector-core"))
+    api(project(":core:control-plane:control-plane-core"))
+    api(project(":core:common:edr-store-core"))
+    api(project(":data-protocols:dsp"))
+    api(project(":core:data-plane-selector:data-plane-selector-core"))
+
+
+    // extension dependencies
+    api(project(":extensions:common:configuration:configuration-filesystem"))
+    api(project(":extensions:common:auth:auth-tokenbased"))
+    api(project(":extensions:common:auth:auth-configuration"))
+    api(project(":extensions:common:auth:auth-delegated"))
+    api(project(":extensions:control-plane:api:management-api"))
+    api(project(":extensions:data-plane-selector:data-plane-selector-api"))
+    api(project(":extensions:data-plane:data-plane-signaling:data-plane-signaling-client"))
+    api(project(":extensions:common:api:api-observability"))
+    api(project(":extensions:common:api:version-api"))
+    api(project(":extensions:common:http"))
+    api(project(":extensions:control-plane:callback:callback-event-dispatcher"))
+    api(project(":extensions:control-plane:callback:callback-http-dispatcher"))
+    api(project(":extensions:control-plane:edr:edr-store-receiver"))
+
+    // libs
+    api(project(":core:common:lib:transform-lib"))
+}
+
+edcBuild {
+    
+}
\ No newline at end of file
diff --git a/dist/bom/controlplane-dcp-bom/build.gradle.kts b/dist/bom/controlplane-dcp-bom/build.gradle.kts
new file mode 100644
index 00000000000..cac6a75aafb
--- /dev/null
+++ b/dist/bom/controlplane-dcp-bom/build.gradle.kts
@@ -0,0 +1,38 @@
+/*
+ *  Copyright (c) 2024 Bayerische Motoren Werke Aktiengesellschaft (BMW AG)
+ *
+ *  This program and the accompanying materials are made available under the
+ *  terms of the Apache License, Version 2.0 which is available at
+ *  https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  SPDX-License-Identifier: Apache-2.0
+ *
+ *  Contributors:
+ *       Bayerische Motoren Werke Aktiengesellschaft (BMW AG) - initial API and implementation
+ *
+ */
+
+plugins {
+    `java-library`
+}
+
+dependencies {
+    // SPI dependencies
+    api(project(":dist:bom:controlplane-base-bom"))
+
+    // DCP dependencies, JWT and LDP
+    api(project(":spi:common:jwt-spi"))
+
+    api(project(":extensions:common:crypto:ldp-verifiable-credentials"))
+    api(project(":extensions:common:crypto:jwt-verifiable-credentials"))
+    api(project(":extensions:common:crypto:lib:jws2020-lib"))
+    api(project(":extensions:common:iam:identity-trust:identity-trust-core"))
+    api(project(":extensions:common:iam:identity-trust:identity-trust-issuers-configuration"))
+    api(project(":extensions:common:iam:identity-trust:identity-trust-service"))
+    api(project(":extensions:common:iam:identity-trust:identity-trust-transform"))
+    api(project(":extensions:common:iam:identity-trust:identity-trust-sts:identity-trust-sts-remote-client"))
+
+
+    api(project(":extensions:common:iam:decentralized-identity"))
+    api(project(":extensions:common:iam:oauth2:oauth2-client"))
+}
\ No newline at end of file
diff --git a/dist/bom/controlplane-dcp-bom/example.properties b/dist/bom/controlplane-dcp-bom/example.properties
new file mode 100644
index 00000000000..2311c0ef6f1
--- /dev/null
+++ b/dist/bom/controlplane-dcp-bom/example.properties
@@ -0,0 +1,7 @@
+edc.iam.sts.oauth.token.url=https://sts.com/token
+edc.iam.sts.oauth.client.id=test-client
+edc.iam.sts.oauth.client.secret.alias=test-alias
+web.http.port=8080
+web.http.path=/api
+web.http.management.port=8081
+web.http.management.path=/api/management
\ No newline at end of file
diff --git a/dist/bom/controlplane-feature-sql-bom/build.gradle.kts b/dist/bom/controlplane-feature-sql-bom/build.gradle.kts
new file mode 100644
index 00000000000..59f7306ec68
--- /dev/null
+++ b/dist/bom/controlplane-feature-sql-bom/build.gradle.kts
@@ -0,0 +1,39 @@
+/*
+ *  Copyright (c) 2024 Bayerische Motoren Werke Aktiengesellschaft (BMW AG)
+ *
+ *  This program and the accompanying materials are made available under the
+ *  terms of the Apache License, Version 2.0 which is available at
+ *  https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  SPDX-License-Identifier: Apache-2.0
+ *
+ *  Contributors:
+ *       Bayerische Motoren Werke Aktiengesellschaft (BMW AG) - initial API and implementation
+ *
+ */
+
+plugins {
+    `java-library`
+}
+
+dependencies {
+    // entity stores
+    api(project(":extensions:control-plane:store:sql:asset-index-sql"))
+    api(project(":extensions:control-plane:store:sql:contract-definition-store-sql"))
+    api(project(":extensions:control-plane:store:sql:contract-negotiation-store-sql"))
+    api(project(":extensions:control-plane:store:sql:control-plane-sql"))
+    api(project(":extensions:control-plane:store:sql:policy-definition-store-sql"))
+    api(project(":extensions:control-plane:store:sql:transfer-process-store-sql"))
+    api(project(":extensions:common:store:sql:edr-index-sql"))
+    api(project(":extensions:data-plane-selector:store:sql:data-plane-instance-store-sql"))
+
+    // other SQL dependencies - not strictly necessary, but could come in handy for BOM users
+    api(project(":extensions:common:sql:sql-core"))
+    api(project(":extensions:common:sql:sql-bootstrapper"))
+    api(project(":extensions:common:sql:sql-lease"))
+    api(project(":extensions:common:sql:sql-pool"))
+    api(project(":extensions:common:transaction:transaction-local"))
+
+    // third-party deps
+    api(libs.postgres)
+}
\ No newline at end of file
diff --git a/dist/bom/controlplane-oauth2-bom/build.gradle.kts b/dist/bom/controlplane-oauth2-bom/build.gradle.kts
new file mode 100644
index 00000000000..9c0a935778d
--- /dev/null
+++ b/dist/bom/controlplane-oauth2-bom/build.gradle.kts
@@ -0,0 +1,27 @@
+/*
+ *  Copyright (c) 2024 Bayerische Motoren Werke Aktiengesellschaft (BMW AG)
+ *
+ *  This program and the accompanying materials are made available under the
+ *  terms of the Apache License, Version 2.0 which is available at
+ *  https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  SPDX-License-Identifier: Apache-2.0
+ *
+ *  Contributors:
+ *       Bayerische Motoren Werke Aktiengesellschaft (BMW AG) - initial API and implementation
+ *
+ */
+
+plugins {
+    `java-library`
+}
+
+dependencies {
+    // SPI dependencies
+    api(project(":dist:bom:controlplane-base-bom"))
+
+    // DCP dependencies, JWT and LDP
+    api(project(":spi:common:jwt-spi"))
+
+    api(project(":extensions:common:iam:oauth2:oauth2-service"))
+}
\ No newline at end of file
diff --git a/dist/bom/controlplane-oauth2-bom/example.properties b/dist/bom/controlplane-oauth2-bom/example.properties
new file mode 100644
index 00000000000..a319f1ac513
--- /dev/null
+++ b/dist/bom/controlplane-oauth2-bom/example.properties
@@ -0,0 +1,5 @@
+edc.oauth.token.url=https://oauth2.com/token
+# this will require the public key alias to be present in the vault
+edc.oauth.certificate.alias=test-alias
+edc.oauth.private.key.alias=private-test-alias
+edc.oauth.client.id=test-client
\ No newline at end of file
diff --git a/dist/bom/dataplane-base-bom/build.gradle.kts b/dist/bom/dataplane-base-bom/build.gradle.kts
new file mode 100644
index 00000000000..3bfd07bd05e
--- /dev/null
+++ b/dist/bom/dataplane-base-bom/build.gradle.kts
@@ -0,0 +1,43 @@
+/*
+ *  Copyright (c) 2024 Bayerische Motoren Werke Aktiengesellschaft (BMW AG)
+ *
+ *  This program and the accompanying materials are made available under the
+ *  terms of the Apache License, Version 2.0 which is available at
+ *  https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  SPDX-License-Identifier: Apache-2.0
+ *
+ *  Contributors:
+ *       Bayerische Motoren Werke Aktiengesellschaft (BMW AG) - initial API and implementation
+ *
+ */
+
+plugins {
+    `java-library`
+}
+
+dependencies {
+    // SPI dependencies
+    api(project(":spi:common:core-spi"))
+
+    // core dependencies
+    api(project(":core:common:boot"))
+    api(project(":core:common:connector-core"))
+    api(project(":core:data-plane:data-plane-core"))
+
+
+    // extension dependencies
+    api(project(":extensions:common:api:control-api-configuration"))
+    api(project(":extensions:common:configuration:configuration-filesystem"))
+    api(project(":extensions:common:json-ld"))
+    api(project(":extensions:control-plane:api:control-plane-api-client"))
+    api(project(":extensions:data-plane:data-plane-self-registration"))
+    api(project(":extensions:data-plane:data-plane-http"))
+    api(project(":extensions:data-plane:data-plane-http-oauth2"))
+    api(project(":extensions:data-plane:data-plane-public-api-v2"))
+    api(project(":extensions:data-plane:data-plane-signaling:data-plane-signaling-api"))
+    api(project(":extensions:data-plane:data-plane-iam"))
+    api(project(":extensions:data-plane-selector:data-plane-selector-client"))
+    api(project(":extensions:common:api:api-observability"))
+    api(project(":extensions:common:http"))
+}
\ No newline at end of file
diff --git a/dist/bom/dataplane-base-bom/example.properties b/dist/bom/dataplane-base-bom/example.properties
new file mode 100644
index 00000000000..75facad1235
--- /dev/null
+++ b/dist/bom/dataplane-base-bom/example.properties
@@ -0,0 +1,6 @@
+edc.transfer.proxy.token.verifier.publickey.alias=test-alias
+edc.transfer.proxy.token.signer.privatekey.alias=private-alias
+edc.dpf.selector.url=http://test.com/selector
+web.http.control.port=9091
+web.http.control.path=/api/control
+web.http.port=9090
\ No newline at end of file
diff --git a/dist/bom/dataplane-feature-sql-bom/build.gradle.kts b/dist/bom/dataplane-feature-sql-bom/build.gradle.kts
new file mode 100644
index 00000000000..448ff510fef
--- /dev/null
+++ b/dist/bom/dataplane-feature-sql-bom/build.gradle.kts
@@ -0,0 +1,35 @@
+/*
+ *  Copyright (c) 2024 Bayerische Motoren Werke Aktiengesellschaft (BMW AG)
+ *
+ *  This program and the accompanying materials are made available under the
+ *  terms of the Apache License, Version 2.0 which is available at
+ *  https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  SPDX-License-Identifier: Apache-2.0
+ *
+ *  Contributors:
+ *       Bayerische Motoren Werke Aktiengesellschaft (BMW AG) - initial API and implementation
+ *
+ */
+
+plugins {
+    `java-library`
+}
+
+dependencies {
+    // entity stores
+    api(project(":extensions:data-plane-selector:store:sql:data-plane-instance-store-sql"))
+    api(project(":extensions:data-plane:store:sql:accesstokendata-store-sql"))
+    api(project(":extensions:data-plane:store:sql:data-plane-store-sql"))
+
+    // other SQL dependencies - not strictly necessary, but could come in handy for BOM users
+    api(project(":extensions:common:sql:sql-core"))
+    api(project(":extensions:common:sql:sql-bootstrapper"))
+    api(project(":extensions:common:sql:sql-lease"))
+    api(project(":extensions:common:sql:sql-pool"))
+    api(project(":extensions:common:transaction:transaction-local"))
+
+    // third-party deps
+    api(libs.postgres)
+
+}
\ No newline at end of file
diff --git a/dist/bom/sts-feature-bom/build.gradle.kts b/dist/bom/sts-feature-bom/build.gradle.kts
new file mode 100644
index 00000000000..bb47d8cb1d2
--- /dev/null
+++ b/dist/bom/sts-feature-bom/build.gradle.kts
@@ -0,0 +1,40 @@
+/*
+ *  Copyright (c) 2024 Bayerische Motoren Werke Aktiengesellschaft (BMW AG)
+ *
+ *  This program and the accompanying materials are made available under the
+ *  terms of the Apache License, Version 2.0 which is available at
+ *  https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  SPDX-License-Identifier: Apache-2.0
+ *
+ *  Contributors:
+ *       Bayerische Motoren Werke Aktiengesellschaft (BMW AG) - initial API and implementation
+ *
+ */
+
+plugins {
+    `java-library`
+    application
+}
+
+dependencies {
+    // SPI dependencies
+    api(project(":spi:common:core-spi"))
+
+    // core dependencies
+    api(project(":core:common:boot"))
+    api(project(":core:common:connector-core"))
+
+
+    // extension dependencies
+    api(project(":extensions:common:http"))
+    api(project(":extensions:common:json-ld"))
+    api(project(":extensions:common:api:api-observability"))
+    api(project(":extensions:common:api:version-api"))
+    api(project(":extensions:common:configuration:configuration-filesystem"))
+
+    api(project(":extensions:common:iam:identity-trust:identity-trust-sts:identity-trust-sts-api"))
+    api(project(":extensions:common:iam:identity-trust:identity-trust-sts:identity-trust-sts-accounts-api"))
+    api(project(":extensions:common:iam:identity-trust:identity-trust-sts:identity-trust-sts-core"))
+    api(project(":extensions:common:iam:identity-trust:identity-trust-sts:identity-trust-sts-embedded"))
+}
\ No newline at end of file
diff --git a/dist/bom/sts-feature-bom/example.properties b/dist/bom/sts-feature-bom/example.properties
new file mode 100644
index 00000000000..e153d883a44
--- /dev/null
+++ b/dist/bom/sts-feature-bom/example.properties
@@ -0,0 +1 @@
+edc.api.accounts.key=password
\ No newline at end of file
diff --git a/extensions/common/iam/decentralized-identity/build.gradle.kts b/extensions/common/iam/decentralized-identity/build.gradle.kts
index 23cb9524ae7..37431d88158 100644
--- a/extensions/common/iam/decentralized-identity/build.gradle.kts
+++ b/extensions/common/iam/decentralized-identity/build.gradle.kts
@@ -20,6 +20,7 @@ plugins {
 dependencies {
     api(project(":spi:common:identity-did-spi"))
     api(project(":extensions:common:iam:decentralized-identity:identity-did-core"))
+    api(project(":extensions:common:iam:decentralized-identity:identity-did-web"))
 }
 
 
diff --git a/extensions/common/iam/identity-trust/identity-trust-sts/build.gradle.kts b/extensions/common/iam/identity-trust/identity-trust-sts/build.gradle.kts
index 51b3bad6847..1985d621759 100644
--- a/extensions/common/iam/identity-trust/identity-trust-sts/build.gradle.kts
+++ b/extensions/common/iam/identity-trust/identity-trust-sts/build.gradle.kts
@@ -22,7 +22,6 @@ dependencies {
     api(project(":extensions:common:iam:identity-trust:identity-trust-sts:identity-trust-sts-core"))
     api(project(":extensions:common:iam:identity-trust:identity-trust-sts:identity-trust-sts-remote-client"))
     api(project(":extensions:common:iam:identity-trust:identity-trust-sts:identity-trust-sts-api"))
-    api(project(":extensions:common:iam:identity-trust:identity-trust-sts:identity-trust-sts-accounts-api"))
     api(project(":extensions:common:iam:identity-trust:identity-trust-sts:identity-trust-sts-client-configuration"))
     api(project(":extensions:common:iam:identity-trust:identity-trust-sts:lib:identity-trust-sts-remote-lib"))
 }
diff --git a/extensions/control-plane/api/management-api/build.gradle.kts b/extensions/control-plane/api/management-api/build.gradle.kts
index e137acadde4..2a8a818bbf3 100644
--- a/extensions/control-plane/api/management-api/build.gradle.kts
+++ b/extensions/control-plane/api/management-api/build.gradle.kts
@@ -24,6 +24,7 @@ dependencies {
     api(project(":extensions:control-plane:api:management-api:contract-agreement-api"))
     api(project(":extensions:control-plane:api:management-api:contract-definition-api"))
     api(project(":extensions:control-plane:api:management-api:contract-negotiation-api"))
+    api(project(":extensions:control-plane:api:management-api:edr-cache-api"))
     api(project(":extensions:control-plane:api:management-api:policy-definition-api"))
     api(project(":extensions:control-plane:api:management-api:transfer-process-api"))
 }
diff --git a/settings.gradle.kts b/settings.gradle.kts
index 0e9e09151d4..e7350744864 100644
--- a/settings.gradle.kts
+++ b/settings.gradle.kts
@@ -282,4 +282,15 @@ include(":system-tests:sts-api:sts-api-test-runtime")
 include(":system-tests:telemetry:telemetry-test-runner")
 include(":system-tests:telemetry:telemetry-test-runtime")
 
+// BOM modules ----------------------------------------------------------------
+include(":dist:bom:controlplane-base-bom")
+include(":dist:bom:controlplane-dcp-bom")
+include(":dist:bom:controlplane-oauth2-bom")
+include(":dist:bom:controlplane-feature-sql-bom")
+
+include(":dist:bom:dataplane-base-bom")
+include(":dist:bom:dataplane-feature-sql-bom")
+include(":dist:bom:sts-feature-bom")
+
+
 include(":version-catalog")
diff --git a/system-tests/telemetry/telemetry-test-runtime/build.gradle.kts b/system-tests/telemetry/telemetry-test-runtime/build.gradle.kts
index 8aea9ed7c92..14f70d9966a 100644
--- a/system-tests/telemetry/telemetry-test-runtime/build.gradle.kts
+++ b/system-tests/telemetry/telemetry-test-runtime/build.gradle.kts
@@ -18,6 +18,7 @@ plugins {
 
 dependencies {
     implementation(project(":core:common:token-core"))
+    implementation(project(":core:common:edr-store-core"))
     implementation(project(":core:common:connector-core"))
     implementation(project(":core:control-plane:control-plane-core"))
     implementation(project(":data-protocols:dsp"))
diff --git a/system-tests/version-api/version-api-test-runtime/build.gradle.kts b/system-tests/version-api/version-api-test-runtime/build.gradle.kts
index 3d157981c74..6d7796389f9 100644
--- a/system-tests/version-api/version-api-test-runtime/build.gradle.kts
+++ b/system-tests/version-api/version-api-test-runtime/build.gradle.kts
@@ -18,6 +18,7 @@ plugins {
 
 dependencies {
     implementation(project(":core:common:token-core"))
+    implementation(project(":core:common:edr-store-core"))
     implementation(project(":core:control-plane:control-plane-core"))
     implementation(project(":data-protocols:dsp"))
     implementation(project(":extensions:common:http"))