diff --git a/.envrc b/.envrc
index 8b42278..c8a98ce 100644
--- a/.envrc
+++ b/.envrc
@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+# SPDX-FileCopyrightText: 2019–2020 Target, Copyright 2021 The Nix Community
+# SPDX-License-Identifier: Apache-2.0
 if type -P lorri &>/dev/null; then
   eval "$(lorri direnv)"
 else
diff --git a/LICENSES/Apache-2.0.txt b/LICENSES/Apache-2.0.txt
new file mode 120000
index 0000000..ea5b606
--- /dev/null
+++ b/LICENSES/Apache-2.0.txt
@@ -0,0 +1 @@
+../LICENSE
\ No newline at end of file
diff --git a/README.md b/README.md
index e52465f..80fefb1 100644
--- a/README.md
+++ b/README.md
@@ -1,3 +1,8 @@
+<!--
+SPDX-FileCopyrightText: SAP SE
+SPDX-License-Identifier: Apache-2.0
+-->
+
 # go-makefile-maker
 
 [![CI](https://github.com/sapcc/go-makefile-maker/actions/workflows/ci.yaml/badge.svg)](https://github.com/sapcc/go-makefile-maker/actions/workflows/ci.yaml)
diff --git a/REUSE.toml b/REUSE.toml
new file mode 100644
index 0000000..9e53486
--- /dev/null
+++ b/REUSE.toml
@@ -0,0 +1,22 @@
+# SPDX-FileCopyrightText: SAP SE
+# SPDX-License-Identifier: Apache-2.0
+
+version = 1
+
+[[annotations]]
+path = [
+  # shared
+  ".github/CODEOWNERS",
+  ".github/renovate.json",
+  ".gitignore",
+  ".license-scan-overrides.jsonl",
+  ".license-scan-rules.json",
+  "go.mod",
+  "go.sum",
+  "Makefile.maker.yaml",
+  # extra
+  "internal/makefile/license-scan-overrides.jsonl",
+  "internal/makefile/license-scan-rules.json",
+]
+SPDX-FileCopyrightText = "SAP SE"
+SPDX-License-Identifier = "Apache-2.0"
diff --git a/internal/goreleaser/RELEASE.md b/internal/goreleaser/RELEASE.md
index 40004f6..fb623be 100644
--- a/internal/goreleaser/RELEASE.md
+++ b/internal/goreleaser/RELEASE.md
@@ -1,3 +1,8 @@
+<!--
+SPDX-FileCopyrightText: SAP SE
+SPDX-License-Identifier: Apache-2.0
+-->
+
 # Release Guide
 
 We use [GoReleaser][goreleaser] and GitHub workflows for automating the release