diff --git a/.github/workflows/reuse.yaml b/.github/workflows/reuse.yaml
new file mode 100644
index 0000000000..a5f91e4517
--- /dev/null
+++ b/.github/workflows/reuse.yaml
@@ -0,0 +1,12 @@
+name: REUSE Compliance Check
+
+on: [push, pull_request]
+
+jobs:
+  reuse:
+    name: REUSE Compliance Check
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - name: REUSE Compliance Check
+      uses: fsfe/reuse-action@v3
diff --git a/.reuse/dep5 b/.reuse/dep5
new file mode 100644
index 0000000000..d7f2867324
--- /dev/null
+++ b/.reuse/dep5
@@ -0,0 +1,12 @@
+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: cloud-hypervisor
+Upstream-Contact:  <>
+Source: https://www.cloudhypervisor.org
+
+Files: docs/*.md *.md
+Copyright: 2024
+License: CC-BY-4.0
+
+Files: scripts/* test_data/* *.toml .git* fuzz/Cargo.lock fuzz/.gitignore resources/linux-config-* vmm/src/api/openapi/cloud-hypervisor.yaml CODEOWNERS Cargo.lock
+Copyright: 2024
+License: Apache-2.0
diff --git a/LICENSE-APACHE b/LICENSES/Apache-2.0.txt
similarity index 100%
rename from LICENSE-APACHE
rename to LICENSES/Apache-2.0.txt
diff --git a/LICENSE-BSD-3-Clause b/LICENSES/BSD-3-Clause.txt
similarity index 100%
rename from LICENSE-BSD-3-Clause
rename to LICENSES/BSD-3-Clause.txt
diff --git a/docs/COPYING.docs b/LICENSES/CC-BY-4.0.txt
similarity index 99%
rename from docs/COPYING.docs
rename to LICENSES/CC-BY-4.0.txt
index 4728f5b46b..e36dfc0858 100644
--- a/docs/COPYING.docs
+++ b/LICENSES/CC-BY-4.0.txt
@@ -1,4 +1,5 @@
-The documentation in this directory is covered by the following license:
+All documentations (e.g. files with extension `.md`) in this repository is
+covered by the following license:
 
 Attribution 4.0 International
 
diff --git a/arch/src/aarch64/uefi.rs b/arch/src/aarch64/uefi.rs
index 3576c4c42d..a920acb0ce 100644
--- a/arch/src/aarch64/uefi.rs
+++ b/arch/src/aarch64/uefi.rs
@@ -1,4 +1,6 @@
 // Copyright 2020 Arm Limited (or its affiliates). All rights reserved.
+//
+// SPDX-License-Identifier: Apache-2.0
 
 use std::io::{Read, Seek, SeekFrom};
 use std::os::fd::AsFd;
diff --git a/arch/src/x86_64/mpspec.rs b/arch/src/x86_64/mpspec.rs
index 8006a3f977..5a1369b9d4 100644
--- a/arch/src/x86_64/mpspec.rs
+++ b/arch/src/x86_64/mpspec.rs
@@ -1,4 +1,6 @@
 // Copyright 2017 The Chromium OS Authors. All rights reserved.
+//
+// SPDX-License-Identifier: Apache-2.0 AND BSD-3-Clause
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE-BSD-3-Clause file.
 
diff --git a/block/src/qcow/mod.rs b/block/src/qcow/mod.rs
index 66bb0405f8..cf18d64ab2 100644
--- a/block/src/qcow/mod.rs
+++ b/block/src/qcow/mod.rs
@@ -1,6 +1,8 @@
 // Copyright 2018 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE-BSD-3-Clause file.
+//
+// SPDX-License-Identifier: Apache-2.0 AND BSD-3-Clause
 
 mod qcow_raw_file;
 mod raw_file;
diff --git a/block/src/qcow/qcow_raw_file.rs b/block/src/qcow/qcow_raw_file.rs
index 8a9a38e436..e789d07b93 100644
--- a/block/src/qcow/qcow_raw_file.rs
+++ b/block/src/qcow/qcow_raw_file.rs
@@ -1,6 +1,8 @@
 // Copyright 2018 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE-BSD-3-Clause file.
+//
+// SPDX-License-Identifier: Apache-2.0 AND BSD-3-Clause
 
 use super::RawFile;
 use byteorder::{BigEndian, ReadBytesExt, WriteBytesExt};
diff --git a/block/src/qcow/refcount.rs b/block/src/qcow/refcount.rs
index 82585db403..965594ea02 100644
--- a/block/src/qcow/refcount.rs
+++ b/block/src/qcow/refcount.rs
@@ -1,6 +1,8 @@
 // Copyright 2018 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE-BSD-3-Clause file.
+//
+// SPDX-License-Identifier: Apache-2.0 AND BSD-3-Clause
 
 use std::fmt::{self, Display};
 use std::io;
diff --git a/block/src/qcow/vec_cache.rs b/block/src/qcow/vec_cache.rs
index 478f5191f2..752d0ad6c7 100644
--- a/block/src/qcow/vec_cache.rs
+++ b/block/src/qcow/vec_cache.rs
@@ -1,6 +1,8 @@
 // Copyright 2018 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE-BSD-3-Clause file.
+//
+// SPDX-License-Identifier: Apache-2.0 AND BSD-3-Clause
 
 use std::collections::hash_map::IterMut;
 use std::collections::HashMap;
diff --git a/devices/src/legacy/cmos.rs b/devices/src/legacy/cmos.rs
index a043315460..d8d20dc374 100644
--- a/devices/src/legacy/cmos.rs
+++ b/devices/src/legacy/cmos.rs
@@ -1,6 +1,8 @@
 // Copyright 2017 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
+//
+// SPDX-License-Identifier: Apache-2.0 AND BSD-3-Clause
 
 use libc::{clock_gettime, gmtime_r, timespec, tm, CLOCK_REALTIME};
 use std::cmp::min;
diff --git a/devices/src/legacy/i8042.rs b/devices/src/legacy/i8042.rs
index 6edfc73a32..887fb4d007 100644
--- a/devices/src/legacy/i8042.rs
+++ b/devices/src/legacy/i8042.rs
@@ -1,6 +1,8 @@
 // Copyright 2017 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE-BSD-3-Clause file.
+//
+// SPDX-License-Identifier: Apache-2.0 AND BSD-3-Clause
 
 use std::sync::{
     atomic::{AtomicBool, Ordering},
diff --git a/fuzz/fuzz_targets/qcow.rs b/fuzz/fuzz_targets/qcow.rs
index a5a3d357ef..d2d187c952 100644
--- a/fuzz/fuzz_targets/qcow.rs
+++ b/fuzz/fuzz_targets/qcow.rs
@@ -1,6 +1,8 @@
 // Copyright 2018 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE-BSD-3-Clause file.
+//
+// SPDX-License-Identifier: Apache-2.0 AND BSD-3-Clause
 
 #![no_main]
 use libfuzzer_sys::fuzz_target;
diff --git a/hypervisor/src/arch/aarch64/gic.rs b/hypervisor/src/arch/aarch64/gic.rs
index 9dc8e69f2a..c18fc2c5c1 100644
--- a/hypervisor/src/arch/aarch64/gic.rs
+++ b/hypervisor/src/arch/aarch64/gic.rs
@@ -1,4 +1,6 @@
 // Copyright 2022 Arm Limited (or its affiliates). All rights reserved.
+//
+// SPDX-License-Identifier: Apache-2.0
 
 use crate::{CpuState, GicState, HypervisorDeviceError, HypervisorVmError};
 use std::any::Any;
diff --git a/hypervisor/src/arch/aarch64/mod.rs b/hypervisor/src/arch/aarch64/mod.rs
index 68bf88166f..f3a15462df 100644
--- a/hypervisor/src/arch/aarch64/mod.rs
+++ b/hypervisor/src/arch/aarch64/mod.rs
@@ -1,3 +1,5 @@
 // Copyright 2022 Arm Limited (or its affiliates). All rights reserved.
+//
+// SPDX-License-Identifier: Apache-2.0
 
 pub mod gic;
diff --git a/hypervisor/src/arch/x86/msr_index.rs b/hypervisor/src/arch/x86/msr_index.rs
index 81a7b06a0a..810fe08b9a 100644
--- a/hypervisor/src/arch/x86/msr_index.rs
+++ b/hypervisor/src/arch/x86/msr_index.rs
@@ -1,4 +1,6 @@
 // Copyright 2017 The Chromium OS Authors. All rights reserved.
+//
+// SPDX-License-Identifier: Apache-2.0 AND BSD-3-Clause
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE-BSD-3-Clause file.
 
diff --git a/hypervisor/src/kvm/aarch64/gic/mod.rs b/hypervisor/src/kvm/aarch64/gic/mod.rs
index dbb7436da0..563b0864d4 100644
--- a/hypervisor/src/kvm/aarch64/gic/mod.rs
+++ b/hypervisor/src/kvm/aarch64/gic/mod.rs
@@ -1,4 +1,6 @@
 // Copyright 2022 Arm Limited (or its affiliates). All rights reserved.
+//
+// SPDX-License-Identifier: Apache-2.0
 
 mod dist_regs;
 mod icc_regs;
diff --git a/net_gen/src/lib.rs b/net_gen/src/lib.rs
index c4e90faf58..3ad1b89876 100644
--- a/net_gen/src/lib.rs
+++ b/net_gen/src/lib.rs
@@ -1,6 +1,8 @@
 // Copyright TUNTAP, 2017 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the THIRD-PARTY file.
+//
+// SPDX-License-Identifier: Apache-2.0 AND BSD-3-Clause
 
 #![allow(non_upper_case_globals)]
 #![allow(non_camel_case_types)]
diff --git a/pci/src/bus.rs b/pci/src/bus.rs
index 2d65b2bf53..ecaea6086d 100644
--- a/pci/src/bus.rs
+++ b/pci/src/bus.rs
@@ -1,6 +1,8 @@
 // Copyright 2018 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE-BSD-3-Clause file.
+//
+// SPDX-License-Identifier: Apache-2.0 AND BSD-3-Clause
 
 use crate::configuration::{
     PciBarRegionType, PciBridgeSubclass, PciClassCode, PciConfiguration, PciHeaderType,
diff --git a/pci/src/configuration.rs b/pci/src/configuration.rs
index b38c4d048e..93c552bddb 100644
--- a/pci/src/configuration.rs
+++ b/pci/src/configuration.rs
@@ -1,6 +1,8 @@
 // Copyright 2018 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE-BSD-3-Clause file.
+//
+// SPDX-License-Identifier: Apache-2.0 AND BSD-3-Clause
 
 use crate::device::BarReprogrammingParams;
 use crate::{MsixConfig, PciInterruptPin};
diff --git a/pci/src/device.rs b/pci/src/device.rs
index cec5786c21..43d86cd5bf 100644
--- a/pci/src/device.rs
+++ b/pci/src/device.rs
@@ -1,6 +1,8 @@
 // Copyright 2018 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE-BSD-3-Clause file.
+//
+// SPDX-License-Identifier: Apache-2.0 AND BSD-3-Clause
 
 use crate::configuration::{self, PciBarRegionType};
 use crate::PciBarConfiguration;
diff --git a/pci/src/lib.rs b/pci/src/lib.rs
index 1e852f91bf..3a45d04f0d 100644
--- a/pci/src/lib.rs
+++ b/pci/src/lib.rs
@@ -1,6 +1,8 @@
 // Copyright 2018 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE-BSD-3-Clause file.
+//
+// SPDX-License-Identifier: Apache-2.0 AND BSD-3-Clause
 
 //! Implements pci devices and busses.
 #[macro_use]
diff --git a/resources/Dockerfile b/resources/Dockerfile
index ef88eddbc2..28c1651b82 100644
--- a/resources/Dockerfile
+++ b/resources/Dockerfile
@@ -1,3 +1,5 @@
+# Copyright © 2024 Intel Corporation
+#
 # SPDX-License-Identifier: Apache-2.0
 #
 # When changing this file don't forget to update the tag name in the
diff --git a/scripts/prepare_vdpa.sh b/scripts/prepare_vdpa.sh
index 0730f3d439..4a99daaf7b 100755
--- a/scripts/prepare_vdpa.sh
+++ b/scripts/prepare_vdpa.sh
@@ -6,12 +6,14 @@ sudo sed -i -- 's/# deb-src/deb-src/g' /etc/apt/sources.list
 sudo apt update
 apt-get source linux-image-unsigned-"$(uname -r)"
 pushd linux-azure*/drivers/vdpa/vdpa_sim/ || exit
+# REUSE-IgnoreStart
 cat <<'EOF' >Makefile
 # SPDX-License-Identifier: GPL-2.0
 obj-m += vdpa_sim.o
 obj-m += vdpa_sim_net.o
 obj-m += vdpa_sim_blk.o
 EOF
+# REUSE-IgnoreEnd
 make -C /lib/modules/"$(uname -r)"/build M="$PWD"
 sudo make -C /lib/modules/"$(uname -r)"/build M="$PWD" modules_install
 popd || exit
diff --git a/virtio-devices/src/balloon.rs b/virtio-devices/src/balloon.rs
index a44f9f246f..c25e0067f2 100644
--- a/virtio-devices/src/balloon.rs
+++ b/virtio-devices/src/balloon.rs
@@ -1,5 +1,7 @@
 // Copyright (c) 2020 Ant Financial
 //
+// SPDX-License-Identifier: Apache-2.0
+//
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
diff --git a/virtio-devices/src/mem.rs b/virtio-devices/src/mem.rs
index a2600a253a..5058ce7326 100644
--- a/virtio-devices/src/mem.rs
+++ b/virtio-devices/src/mem.rs
@@ -1,5 +1,7 @@
 // Copyright (c) 2020 Ant Financial
 //
+// SPDX-License-Identifier: Apache-2.0
+//
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
diff --git a/virtio-devices/src/rng.rs b/virtio-devices/src/rng.rs
index a3fa25276c..af1098270d 100644
--- a/virtio-devices/src/rng.rs
+++ b/virtio-devices/src/rng.rs
@@ -1,6 +1,8 @@
 // Copyright 2017 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
+//
+// SPDX-License-Identifier: Apache-2.0 AND BSD-3-Clause
 
 use super::Error as DeviceError;
 use super::{