diff --git a/sdk/build.sh b/sdk/build.sh
index d6c0fc3aa..5bb1e5455 100755
--- a/sdk/build.sh
+++ b/sdk/build.sh
@@ -281,6 +281,8 @@ for platform in ${DY_PLATFORMS}; do
 			if [ "${DY_MFG_IMAGE}" = "true" ] && ! grep -qs "meta-digi-mfg" conf/bblayers.conf; then
 				sed -i -e "/meta-digi-dey/a\  ${YOCTO_INST_DIR}/sources/meta-digi-mfg \\\\" conf/bblayers.conf
 			fi
+			# Apply CVE layer if needed (do so before potentially inheriting "digi_ccss" to avoid errors)
+			[ "${DY_USE_CVE_LAYER}" = "true" ] && bitbake-layers add-layer ${YOCTO_INST_DIR}/sources/meta-digi-security
 			# If we want to generate a CVE report, update conf/local.conf
 			if [ "${DY_CVE_REPORT}" = "true" ]; then
 				# Build Vigiles config path using platform and patch status
@@ -292,8 +294,6 @@ for platform in ${DY_PLATFORMS}; do
 				[ ! -f "${VIGILES_CONF_PATH}" ] && error "Cannot find Vigiles config file ${VIGILES_CONF_PATH}"
 				printf "%s" "${VIGILES_CFG}" | sed -e "s,##VIGILES_CONF_PATH##,${VIGILES_CONF_PATH},g" -e "s,##VIGILES_BBCLASS##,${bbclass},g" >> conf/local.conf
 			fi
-			# Apply CVE layer if needed
-			[ "${DY_USE_CVE_LAYER}" = "true" ] && bitbake-layers add-layer ${YOCTO_INST_DIR}/sources/meta-digi-security
 			printf "\n[INFO] Show customized local.conf.\n"
 			cat conf/local.conf