diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 875995d..8f44243 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -31,6 +31,9 @@ jobs:
         run: |
           make checkfmt
 
+      - name: check for SPDX tags
+        run: ./LICENSES/spdx-ensure
+
   check-firmware:
     runs-on: ubuntu-latest
     container:
@@ -148,8 +151,3 @@ jobs:
       - name: check matching hashes for firmware.bin & application_fpga.bin
         working-directory: hw/application_fpga
         run: make check-binary-hashes
-
-
-      # TODO? first deal with hw/boards/ and hw/production_test/
-      # - name: check for SPDX tags
-      #   run: ./LICENSES/spdx-ensure
diff --git a/LICENSES/README.md b/LICENSES/README.md
index 8830ede..7874a75 100644
--- a/LICENSES/README.md
+++ b/LICENSES/README.md
@@ -2,11 +2,13 @@
 
 ## Main license
 
-Unless otherwise noted, the project sources are licensed under the
-terms and conditions of the "GNU General Public License v2.0 only".
+Unless otherwise noted, the project sources are copyright Tillitis AB,
+but you can redistribute it and/or modify it under the terms of the
+GNU General Public License version 2 as published by the Free Software
+Foundation. See `gpl-2.0.txt`.
 
-The `LICENSES/` directory contains copies of the license texts used by
-the sources included in the project source tree.
+This directory contains copies of the license texts used by the
+sources included in the project source tree.
 
 ## SPDX
 
@@ -19,3 +21,21 @@ The current set of valid, predefined SPDX identifiers can be found on
 the SPDX License List at:
 
 https://spdx.org/licenses/
+
+## Notable imported projects
+
+- ch552 firmware: `hw/usb_interface/ch552_fw/`
+
+  Originally by WCH under MIT. Much changed by Tillitis.
+
+- picorv32: `hw/application_fpga/core/picorv32`
+
+  From https://github.com/YosysHQ/picorv32
+
+  ISC.
+
+- PicoRV32 custom ops: `hw/application_fpga/fw/tk1/picorv32/`
+
+- tkey-libs: `hw/application_fpga/tkey-libs/`
+
+  BSD2. From https://github.com/tillitis/tkey-libs
diff --git a/LICENSES/spdx-ensure b/LICENSES/spdx-ensure
index 1f21092..3385211 100755
--- a/LICENSES/spdx-ensure
+++ b/LICENSES/spdx-ensure
@@ -16,34 +16,73 @@ LICENSES/
 doc/
 hw/application_fpga/core/picorv32/
 hw/application_fpga/core/uart/
-hw/application_fpga/fw/tk1/blake2s/
 )
 
 missingok_files=(
 .editorconfig
 .gitattributes
 .gitignore
+.clang-format
 README.md
 contrib/99-tillitis.rules
 contrib/Dockerfile
 contrib/Makefile
-dco.md
+contrib/verible.sha512
+
+hw/application_fpga/README.md
+hw/application_fpga/core/clk_reset_gen/README.md
+hw/application_fpga/core/fw_ram/README.md
+hw/application_fpga/core/ram/README.md
+hw/application_fpga/core/rom/README.md
+hw/application_fpga/core/tk1/tb/udi.hex
+hw/application_fpga/core/uds/README.md
+hw/application_fpga/fw/README.md
+hw/application_fpga/fw/tk1/picorv32/README.md
+hw/application_fpga/apps/Makefile
+hw/application_fpga/apps/README.md
 hw/application_fpga/application_fpga.bin.sha256
 hw/application_fpga/config.vlt
 hw/application_fpga/core/timer/README.md
 hw/application_fpga/core/tk1/README.md
 hw/application_fpga/core/touch_sense/README.md
 hw/application_fpga/core/trng/README.md
-hw/application_fpga/core/uds/README.txt
 hw/application_fpga/data/udi.hex
 hw/application_fpga/data/uds.hex
 hw/application_fpga/firmware.bin.sha512
-hw/application_fpga/fw/.clang-format
 hw/application_fpga/fw/testfw/Makefile
 hw/application_fpga/fw/tk1/Makefile
-hw/application_fpga/tools/makehex.py
-hw/application_fpga/tools/reset-tk1
 hw/application_fpga/tools/tpt/README.md
+hw/usb_interface/ch552_fw/.gitignore
+hw/usb_interface/ch552_fw/LICENSES/GPL-2.0-only.txt
+hw/usb_interface/ch552_fw/LICENSES/MIT.txt
+hw/usb_interface/ch552_fw/Makefile
+hw/usb_interface/ch552_fw/README.md
+
+# tkey-libs is assumed to be REUSE compliant
+hw/application_fpga/tkey-libs/LICENSE
+hw/application_fpga/tkey-libs/LICENSES/BSD-2-Clause.txt
+hw/application_fpga/tkey-libs/LICENSES/CC0-1.0.txt
+hw/application_fpga/tkey-libs/Makefile
+hw/application_fpga/tkey-libs/README-DIST.txt
+hw/application_fpga/tkey-libs/README.md
+hw/application_fpga/tkey-libs/RELEASE.md
+hw/application_fpga/tkey-libs/blake2s/LICENSE
+hw/application_fpga/tkey-libs/blake2s/Makefile
+hw/application_fpga/tkey-libs/blake2s/blake2s.c
+hw/application_fpga/tkey-libs/blake2s/blake2s.h
+hw/application_fpga/tkey-libs/blake2s/blake2s_test.c
+hw/application_fpga/tkey-libs/example-app/Makefile
+hw/application_fpga/tkey-libs/monocypher/LICENSE
+hw/application_fpga/tkey-libs/monocypher/README.md
+
+hw/application_fpga/tools/README.md
+hw/application_fpga/tools/b2s/README.md
+hw/application_fpga/tools/b2s/go.mod
+hw/application_fpga/tools/b2s/go.sum
+hw/application_fpga/tools/default_partition.bin
+hw/application_fpga/tools/tkeyimage/README.md
+hw/application_fpga/tools/tkeyimage/go.mod
+hw/application_fpga/tools/tkeyimage/go.sum
 )
 
 is_missingok() {
diff --git a/README.md b/README.md
index 9cd4878..d32a181 100644
--- a/README.md
+++ b/README.md
@@ -40,9 +40,17 @@ software and hardware should be.
 
 ## Licensing
 
+Unless otherwise noted, the project sources are copyright Tillitis AB.
+but you can redistribute it and/or modify it under the terms of the
+GNU General Public License version 2 as published by the Free Software
+Foundation.
+
 See [LICENSES](./LICENSES/README.md) for more information about
 the projects' licenses.
 
+Each imported project is typically kept in its own directory with its
+own LICENSE file.
+
 ## Repositories
 
 This repository contains the FPGA design, the source of the
diff --git a/hw/application_fpga/fw/tk1/picorv32/README.md b/hw/application_fpga/fw/tk1/picorv32/README.md
index 761be04..07077ff 100644
--- a/hw/application_fpga/fw/tk1/picorv32/README.md
+++ b/hw/application_fpga/fw/tk1/picorv32/README.md
@@ -2,6 +2,11 @@
 
 ## custom_ops.S
 
-Custom PicoRV32 instructions are located in `custom_ops.S`.
-`custom_ops.S` is imported from upstream PicoRV32 commit:
-YosysHQ/picorv32@70f3c33
+We have imported the custom Custom PicoRV32 instructions in
+`custom_ops.S` from https://github.com/YosysHQ/picorv32/ tag v1.0,
+commit 6d145b708d5dfa4caa3445bc599927cebc3291d8.
+
+Upstream path is `picorv32/firmware/custom_ops.S`.
+
+The picorv32 firmware is public domain, which we chose to mark as
+CC0-1.0.
diff --git a/hw/application_fpga/fw/tk1/picorv32/custom_ops.S b/hw/application_fpga/fw/tk1/picorv32/custom_ops.S
index 71889b9..af380a6 100644
--- a/hw/application_fpga/fw/tk1/picorv32/custom_ops.S
+++ b/hw/application_fpga/fw/tk1/picorv32/custom_ops.S
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Claire Xenia Wolf <claire@yosyshq.com>
+// SPDX-License-Identifier: CC0-1.0
+
 // This is free and unencumbered software released into the public domain.
 //
 // Anyone is free to copy, modify, publish, use, compile, sell, or
diff --git a/hw/application_fpga/fw/tk1/syscall_enable.S b/hw/application_fpga/fw/tk1/syscall_enable.S
index 459c097..88b6b0f 100644
--- a/hw/application_fpga/fw/tk1/syscall_enable.S
+++ b/hw/application_fpga/fw/tk1/syscall_enable.S
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: 2025 Tillitis AB <tillitis.se>
+// SPDX-License-Identifier: GPL-2.0-only
+
 #ifdef QEMU_SYSCALL
 
 #define picorv32_maskirq_insn(...)
diff --git a/hw/application_fpga/tools/load_preloaded_app.sh b/hw/application_fpga/tools/load_preloaded_app.sh
index 28f3b24..23186a5 100755
--- a/hw/application_fpga/tools/load_preloaded_app.sh
+++ b/hw/application_fpga/tools/load_preloaded_app.sh
@@ -1,5 +1,7 @@
 #!/bin/bash -e
 
+# SPDX-FileCopyrightText: 2025 Tillitis AB <tillitis.se>
+# SPDX-License-Identifier: GPL-2.0-only
 if [ $# != 2 ]
 then
     echo "Usage: $0 slot_num app_file"
diff --git a/hw/application_fpga/tools/makehex.py b/hw/application_fpga/tools/makehex.py
index 7f6cb71..a8b4d50 100755
--- a/hw/application_fpga/tools/makehex.py
+++ b/hw/application_fpga/tools/makehex.py
@@ -1,5 +1,8 @@
 #!/usr/bin/env python3
 #
+# SPDX-FileCopyrightText: Claire Xenia Wolf <claire@yosyshq.com>
+# SPDX-License-Identifier: CC0-1.0
+
 # This is free and unencumbered software released into the public domain.
 #
 # Anyone is free to copy, modify, publish, use, compile, sell, or
diff --git a/hw/application_fpga/tools/run_pnr.sh b/hw/application_fpga/tools/run_pnr.sh
index 68f9e70..21a5cb1 100755
--- a/hw/application_fpga/tools/run_pnr.sh
+++ b/hw/application_fpga/tools/run_pnr.sh
@@ -1,5 +1,8 @@
 #!/bin/bash
 
+# SPDX-FileCopyrightText: 2025 Tillitis AB <tillitis.se>
+# SPDX-License-Identifier: GPL-2.0-only
+
 help() {
     echo "Usage: $(basename $0) [OPTION]"
     echo "Run multiple place and route threads with nextpnr-ice40"