diff --git a/.reuse/dep5 b/.reuse/dep5
deleted file mode 100644
index c37abaa..0000000
--- a/.reuse/dep5
+++ /dev/null
@@ -1,16 +0,0 @@
-Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
-Upstream-Name: notify_push
-Upstream-Contact: Nextcloud <info@nextcloud.com>
-Source: https://github.com/nextcloud/notify_push
-
-Files: .envrc Cargo.lock composer.json composer.lock tests/stub.phpstub
-Copyright: 2021 Nextcloud GmbH and Nextcloud contributors
-License: AGPL-3.0-or-later
-
-Files: flake.lock flake.nix
-Copyright: 2023 Nextcloud GmbH and Nextcloud contributors
-License: AGPL-3.0-or-later
-
-Files: img/app.svg img/app-dark.svg
-Copyright: 2018-2024 Google LLC
-License: Apache-2.0
diff --git a/REUSE.toml b/REUSE.toml
new file mode 100644
index 0000000..2e7f441
--- /dev/null
+++ b/REUSE.toml
@@ -0,0 +1,24 @@
+# SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors
+# SPDX-License-Identifier: AGPL-3.0-or-later
+version = 1
+SPDX-PackageName = "notify_push"
+SPDX-PackageSupplier = "Nextcloud <info@nextcloud.com>"
+SPDX-PackageDownloadLocation = "https://github.com/nextcloud/notify_push"
+
+[[annotations]]
+path = [".envrc", "Cargo.lock", "composer.json", "composer.lock", "tests/stub.phpstub"]
+precedence = "aggregate"
+SPDX-FileCopyrightText = "2021 Nextcloud GmbH and Nextcloud contributors"
+SPDX-License-Identifier = "AGPL-3.0-or-later"
+
+[[annotations]]
+path = ["flake.lock", "flake.nix"]
+precedence = "aggregate"
+SPDX-FileCopyrightText = "2023 Nextcloud GmbH and Nextcloud contributors"
+SPDX-License-Identifier = "AGPL-3.0-or-later"
+
+[[annotations]]
+path = ["img/app.svg", "img/app-dark.svg"]
+precedence = "aggregate"
+SPDX-FileCopyrightText = "2018-2024 Google LLC"
+SPDX-License-Identifier = "Apache-2.0"