diff --git a/plugins/package-managers/cargo/src/main/kotlin/Cargo.kt b/plugins/package-managers/cargo/src/main/kotlin/Cargo.kt
index 95ea7a9b30dc6..3b9f86f4a6d6d 100644
--- a/plugins/package-managers/cargo/src/main/kotlin/Cargo.kt
+++ b/plugins/package-managers/cargo/src/main/kotlin/Cargo.kt
@@ -200,22 +200,6 @@ class Cargo(
 
 private fun CargoMetadata.Package.isProject() = source == null
 
-private fun parseDeclaredLicenses(pkg: CargoMetadata.Package): Set<String> {
-    val declaredLicenses = pkg.license.orEmpty().split('/')
-        .map { it.trim() }
-        .filterTo(mutableSetOf()) { it.isNotEmpty() }
-
-    // Cargo allows declaring non-SPDX licenses only by referencing a license file. If a license file is specified, add
-    // an unknown declared license to indicate that there is a declared license, but we cannot know which it is at this
-    // point.
-    // See: https://doc.rust-lang.org/cargo/reference/manifest.html#the-license-and-license-file-fields
-    if (pkg.licenseFile.orEmpty().isNotBlank()) {
-        declaredLicenses += SpdxConstants.NOASSERTION
-    }
-
-    return declaredLicenses
-}
-
 private fun parsePackage(pkg: CargoMetadata.Package, hashes: Map<String, String>): Package {
     val declaredLicenses = parseDeclaredLicenses(pkg)
 
@@ -245,6 +229,22 @@ private fun parsePackage(pkg: CargoMetadata.Package, hashes: Map<String, String>
     )
 }
 
+private fun parseDeclaredLicenses(pkg: CargoMetadata.Package): Set<String> {
+    val declaredLicenses = pkg.license.orEmpty().split('/')
+        .map { it.trim() }
+        .filterTo(mutableSetOf()) { it.isNotEmpty() }
+
+    // Cargo allows declaring non-SPDX licenses only by referencing a license file. If a license file is specified, add
+    // an unknown declared license to indicate that there is a declared license, but we cannot know which it is at this
+    // point.
+    // See: https://doc.rust-lang.org/cargo/reference/manifest.html#the-license-and-license-file-fields
+    if (pkg.licenseFile.orEmpty().isNotBlank()) {
+        declaredLicenses += SpdxConstants.NOASSERTION
+    }
+
+    return declaredLicenses
+}
+
 // Match source dependencies that directly reference git repositories. The specified tag or branch
 // name is ignored (i.e. not captured) in favor of the actual commit hash that they currently refer
 // to.