diff --git a/.reuse/dep5 b/.reuse/dep5
deleted file mode 100644
index e253c6e..0000000
--- a/.reuse/dep5
+++ /dev/null
@@ -1,16 +0,0 @@
-Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
-Upstream-Name: Kompetenzinventar
-Upstream-Contact: Michael Weimann <mail@michael-weimann.eu>
-Source: https://git.wtf-eg.de/kompetenzinventar/ki-backend
-
-Files: data/imgs/flags/*
-Copyright: 2013 Panayiotis Lipiridis <https://flagicons.lipis.dev/>
-License: MIT
-
-Files: Pipfile.lock migrations/*
-Copyright: WTF Kooperative eG <https://wtf-eg.de/>
-License: AGPL-3.0-or-later
-
-Files: renovate.json .python-version
-Copyright: WTF Kooperative eG <https://wtf-eg.de/>
-License: AGPL-3.0-or-later
diff --git a/Pipfile b/Pipfile
index bf804fa..f5d06c3 100644
--- a/Pipfile
+++ b/Pipfile
@@ -24,7 +24,7 @@ werkzeug = "==2.3.8"
 flake8 = "==7.1.1"
 yapf = "==0.40.2"
 pre-commit = "==2.21.0"
-reuse = "==2.1.0"
+reuse = "==4.0.3"
 
 [requires]
 python_version = "3.8"
diff --git a/Pipfile.lock b/Pipfile.lock
index fc52c21..ae703a5 100644
--- a/Pipfile.lock
+++ b/Pipfile.lock
@@ -1,7 +1,7 @@
 {
     "_meta": {
         "hash": {
-            "sha256": "2a23fc3623d80bb65920da40510365714935602aa1fba9ff627cb86784ec462a"
+            "sha256": "c56fd21c6bf45388a1a7040219ff20517b341517f3d4dd5a2db57d901f4297a4"
         },
         "pipfile-spec": 6,
         "requires": {
@@ -436,6 +436,14 @@
         }
     },
     "develop": {
+        "attrs": {
+            "hashes": [
+                "sha256:5cfb1b9148b5b086569baec03f20d7b6bf3bcacc9a42bebf87ffaaca362f6346",
+                "sha256:81921eb96de3191c8258c199618104dd27ac608d9366f5e35d011eae1867ede2"
+            ],
+            "markers": "python_version >= '3.7'",
+            "version": "==24.2.0"
+        },
         "binaryornot": {
             "hashes": [
                 "sha256:359501dfc9d40632edc9fac890e19542db1a287bbcfa58175b66658392018061",
@@ -708,12 +716,12 @@
         },
         "reuse": {
             "hashes": [
-                "sha256:4211e91caa4c9e433802618a89a2d49a67e2bf76a8029d6708090892f0cdebec",
-                "sha256:b214e756582766c9a8c84e195707a4ee86f58640bc2b0c5eac85279f5fd7d9de"
+                "sha256:4f2c3e1213ec644e5febc50d8322d18982e4e1102af8a51d9493bfc2164a0eac",
+                "sha256:b33e26ec1d105cfcfc2e904d103faec0d758994278feb95a4f4290a864562243"
             ],
             "index": "pypi",
             "markers": "python_version >= '3.8' and python_version < '4.0'",
-            "version": "==2.1.0"
+            "version": "==4.0.3"
         },
         "tomli": {
             "hashes": [
@@ -723,6 +731,14 @@
             "markers": "python_version >= '3.7'",
             "version": "==2.0.1"
         },
+        "tomlkit": {
+            "hashes": [
+                "sha256:7a974427f6e119197f670fbbbeae7bef749a6c14e793db934baefc1b5f03efde",
+                "sha256:fff5fe59a87295b278abd31bec92c15d9bc4a06885ab12bcea52c71119392e79"
+            ],
+            "markers": "python_version >= '3.8'",
+            "version": "==0.13.2"
+        },
         "virtualenv": {
             "hashes": [
                 "sha256:48f2695d9809277003f30776d155615ffc11328e6a0a8c1f0ec80188d7874a55",
diff --git a/REUSE.toml b/REUSE.toml
new file mode 100644
index 0000000..055fa2f
--- /dev/null
+++ b/REUSE.toml
@@ -0,0 +1,24 @@
+# SPDX-FileCopyrightText: NONE
+# SPDX-License-Identifier: CC0-1.0
+
+version = 1
+SPDX-PackageName = "Kompetenzinventar Backend"
+SPDX-PackageDownloadLocation = "https://git.wtf-eg.de/kompetenzinventar/ki-backend"
+
+[[annotations]]
+path = "data/imgs/flags/**"
+precedence = "aggregate"
+SPDX-FileCopyrightText = "2013 Panayiotis Lipiridis <https://flagicons.lipis.dev/>"
+SPDX-License-Identifier = "MIT"
+
+[[annotations]]
+path = ["Pipfile.lock", "migrations/**"]
+precedence = "aggregate"
+SPDX-FileCopyrightText = "WTF Kooperative eG <https://wtf-eg.de/>"
+SPDX-License-Identifier = "AGPL-3.0-or-later"
+
+[[annotations]]
+path = ["renovate.json", ".python-version"]
+precedence = "aggregate"
+SPDX-FileCopyrightText = "WTF Kooperative eG <https://wtf-eg.de/>"
+SPDX-License-Identifier = "AGPL-3.0-or-later"