diff --git a/.github/scripts/build_aosp.sh b/.github/scripts/build_aosp.sh
index 4e94b712..bfdf51a4 100755
--- a/.github/scripts/build_aosp.sh
+++ b/.github/scripts/build_aosp.sh
@@ -1,4 +1,8 @@
 #!/usr/bin/env bash
+#
+# SPDX-FileCopyrightText: 2023 The Calyx Institute
+# SPDX-License-Identifier: Apache-2.0
+#
 
 export DEBIAN_FRONTEND=noninteractive
 
diff --git a/.github/scripts/run_tests.sh b/.github/scripts/run_tests.sh
index b680a247..7b8d189d 100755
--- a/.github/scripts/run_tests.sh
+++ b/.github/scripts/run_tests.sh
@@ -1,3 +1,8 @@
+#
+# SPDX-FileCopyrightText: 2023 The Calyx Institute
+# SPDX-License-Identifier: Apache-2.0
+#
+
 adb root
 sleep 5
 adb remount
diff --git a/Android.bp b/Android.bp
index cdf2e5ac..46529b7a 100644
--- a/Android.bp
+++ b/Android.bp
@@ -1,17 +1,6 @@
 //
-// Copyright (C) 2018 The Android Open Source Project
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+// SPDX-FileCopyrightText: 2020 The Calyx Institute
+// SPDX-License-Identifier: Apache-2.0
 //
 
 android_app {
diff --git a/allowlist_com.stevesoltys.seedvault.xml b/allowlist_com.stevesoltys.seedvault.xml
index 0f4ad181..8b7e421f 100644
--- a/allowlist_com.stevesoltys.seedvault.xml
+++ b/allowlist_com.stevesoltys.seedvault.xml
@@ -1,4 +1,9 @@
 <?xml version="1.0" encoding="utf-8"?>
+<!--
+  SPDX-FileCopyrightText: 2017 Steve Soltys
+  SPDX-FileCopyrightText: 2020 The Calyx Institute
+  SPDX-License-Identifier: Apache-2.0
+  -->
 <config>
     <backup-transport-whitelisted-service
         service="com.stevesoltys.seedvault/.transport.ConfigurableBackupTransportService" />
diff --git a/app/build.gradle.kts b/app/build.gradle.kts
index 215f0a68..1bad870f 100644
--- a/app/build.gradle.kts
+++ b/app/build.gradle.kts
@@ -1,3 +1,8 @@
+//
+// SPDX-FileCopyrightText: 2023 The Calyx Institute
+// SPDX-License-Identifier: Apache-2.0
+//
+
 import org.gradle.api.tasks.testing.logging.TestExceptionFormat
 import java.io.ByteArrayOutputStream
 
diff --git a/app/development/scripts/clear_app_data.sh b/app/development/scripts/clear_app_data.sh
index 8bf4b978..d2d8424c 100755
--- a/app/development/scripts/clear_app_data.sh
+++ b/app/development/scripts/clear_app_data.sh
@@ -1,4 +1,8 @@
 #!/usr/bin/env bash
+#
+# SPDX-FileCopyrightText: 2023 The Calyx Institute
+# SPDX-License-Identifier: Apache-2.0
+#
 
 # assert ANDROID_HOME is set
 if [ -z "$ANDROID_HOME" ]; then
diff --git a/app/development/scripts/install_app.sh b/app/development/scripts/install_app.sh
index 93180f4a..e4f8cda3 100755
--- a/app/development/scripts/install_app.sh
+++ b/app/development/scripts/install_app.sh
@@ -1,4 +1,8 @@
 #!/usr/bin/env bash
+#
+# SPDX-FileCopyrightText: 2023 The Calyx Institute
+# SPDX-License-Identifier: Apache-2.0
+#
 
 # assert ANDROID_HOME is set
 if [ -z "$ANDROID_HOME" ]; then
diff --git a/app/development/scripts/provision_emulator.sh b/app/development/scripts/provision_emulator.sh
index 030eff7a..9219c9bf 100755
--- a/app/development/scripts/provision_emulator.sh
+++ b/app/development/scripts/provision_emulator.sh
@@ -1,4 +1,8 @@
 #!/usr/bin/env bash
+#
+# SPDX-FileCopyrightText: 2023 The Calyx Institute
+# SPDX-License-Identifier: Apache-2.0
+#
 
 # assert ANDROID_HOME is set
 if [ -z "$ANDROID_HOME" ]; then
diff --git a/app/development/scripts/start_emulator.sh b/app/development/scripts/start_emulator.sh
index b2113487..78805fee 100755
--- a/app/development/scripts/start_emulator.sh
+++ b/app/development/scripts/start_emulator.sh
@@ -1,4 +1,8 @@
 #!/usr/bin/env bash
+#
+# SPDX-FileCopyrightText: 2023 The Calyx Institute
+# SPDX-License-Identifier: Apache-2.0
+#
 
 # assert ANDROID_HOME is set
 if [ -z "$ANDROID_HOME" ]; then
diff --git a/build.libs.toml b/build.libs.toml
index 43a99c32..e2f31e0a 100644
--- a/build.libs.toml
+++ b/build.libs.toml
@@ -1,3 +1,8 @@
+#
+# SPDX-FileCopyrightText: 2023 The Calyx Institute
+# SPDX-License-Identifier: Apache-2.0
+#
+
 [metadata]
 
 [versions]
diff --git a/build.plugins.toml b/build.plugins.toml
index 6b67238d..9c72506c 100644
--- a/build.plugins.toml
+++ b/build.plugins.toml
@@ -1,3 +1,8 @@
+#
+# SPDX-FileCopyrightText: 2023 The Calyx Institute
+# SPDX-License-Identifier: Apache-2.0
+#
+
 [versions]
 # We need to enforce that the versions we use are the same as AOSP to ensure compatibility.
 # 1.3.61 Android 11
diff --git a/default-permissions_com.stevesoltys.seedvault.xml b/default-permissions_com.stevesoltys.seedvault.xml
index 4bcaa7b2..4c6ce2ba 100644
--- a/default-permissions_com.stevesoltys.seedvault.xml
+++ b/default-permissions_com.stevesoltys.seedvault.xml
@@ -1,4 +1,8 @@
 <?xml version='1.0' encoding='utf-8' standalone='yes' ?>
+<!--
+  SPDX-FileCopyrightText: 2020 The Calyx Institute
+  SPDX-License-Identifier: Apache-2.0
+  -->
 <exceptions>
     <exception package="com.stevesoltys.seedvault">
         <!-- Notifications -->
diff --git a/gradle.properties b/gradle.properties
index 8af1ea32..ea992988 100644
--- a/gradle.properties
+++ b/gradle.properties
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: 2020 The Calyx Institute
+# SPDX-License-Identifier: Apache-2.0
+
 org.gradle.jvmargs=-Xmx4g
 org.gradle.configureondemand=true
 org.gradle.caching=true
diff --git a/libs/Android.bp b/libs/Android.bp
index f20ae381..33f51101 100644
--- a/libs/Android.bp
+++ b/libs/Android.bp
@@ -1,3 +1,8 @@
+//
+// SPDX-FileCopyrightText: 2021 The Calyx Institute
+// SPDX-License-Identifier: Apache-2.0
+//
+
 java_import {
     name: "seedvault-lib-kotlin-bip39",
     jars: ["kotlin-bip39-jvm-1.0.6.jar"],
diff --git a/libs/dav4jvm/Android.bp b/libs/dav4jvm/Android.bp
index 7a4b82d7..3fae26c6 100644
--- a/libs/dav4jvm/Android.bp
+++ b/libs/dav4jvm/Android.bp
@@ -1,3 +1,8 @@
+//
+// SPDX-FileCopyrightText: 2024 The Calyx Institute
+// SPDX-License-Identifier: Apache-2.0
+//
+
 java_import {
     name: "seedvault-lib-dav4jvm",
     jars: ["dav4jvm-2.2.1.jar"],
diff --git a/libs/koin-android/Android.bp b/libs/koin-android/Android.bp
index c3369d9c..bb24944c 100644
--- a/libs/koin-android/Android.bp
+++ b/libs/koin-android/Android.bp
@@ -1,3 +1,8 @@
+//
+// SPDX-FileCopyrightText: 2020 The Calyx Institute
+// SPDX-License-Identifier: Apache-2.0
+//
+
 android_library_import {
     name: "seedvault-lib-koin-android",
     aars: ["koin-android-3.2.0.aar"],
diff --git a/logcat-verbose.sh b/logcat-verbose.sh
index 0099a2e5..4bef7525 100755
--- a/logcat-verbose.sh
+++ b/logcat-verbose.sh
@@ -1,4 +1,8 @@
 #!/usr/bin/env bash
+#
+# SPDX-FileCopyrightText: 2020 The Calyx Institute
+# SPDX-License-Identifier: Apache-2.0
+#
 
 set -ex
 
diff --git a/permissions_com.stevesoltys.seedvault.xml b/permissions_com.stevesoltys.seedvault.xml
index f6b63de3..536c2cc8 100644
--- a/permissions_com.stevesoltys.seedvault.xml
+++ b/permissions_com.stevesoltys.seedvault.xml
@@ -1,4 +1,9 @@
 <?xml version="1.0" encoding="utf-8"?>
+<!--
+  SPDX-FileCopyrightText: 2017 Steve Soltys
+  SPDX-FileCopyrightText: 2020 The Calyx Institute
+  SPDX-License-Identifier: Apache-2.0
+  -->
 <permissions>
     <privapp-permissions package="com.stevesoltys.seedvault">
         <permission name="android.permission.BACKUP"/>
diff --git a/settings.gradle.kts b/settings.gradle.kts
index 93105a8b..170d5ce4 100644
--- a/settings.gradle.kts
+++ b/settings.gradle.kts
@@ -1,3 +1,8 @@
+//
+// SPDX-FileCopyrightText: 2023 The Calyx Institute
+// SPDX-License-Identifier: Apache-2.0
+//
+
 pluginManagement {
     buildscript {
         repositories {