diff --git a/.github/workflows/reuse.yml b/.github/workflows/reuse.yml
index fa62e61e74..031e80a835 100644
--- a/.github/workflows/reuse.yml
+++ b/.github/workflows/reuse.yml
@@ -9,12 +9,14 @@
 
 name: REUSE Compliance Check
 
-on: pull_request
+on: [pull_request]
 
 jobs:
   reuse-compliance-check:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+    - name: Checkout
+      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+
     - name: REUSE Compliance Check
-      uses: fsfe/reuse-action@a46482ca367aef4454a87620aa37c2be4b2f8106 # v3.0.0
+      uses: fsfe/reuse-action@3ae3c6bdf1257ab19397fab11fd3312144692083 # v4.0.0
diff --git a/.reuse/dep5 b/.reuse/dep5
deleted file mode 100644
index f14515e03d..0000000000
--- a/.reuse/dep5
+++ /dev/null
@@ -1,28 +0,0 @@
-Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
-Upstream-Name: richdocuments
-Upstream-Contact: Nextcloud <info@nextcloud.com>
-Source: https://github.com/nextcloud/richdocuments
-
-Files: .gitattributes .github/issue_template.md .github/CODEOWNERS .editorconfig package-lock.json package.json composer.json composer.lock */composer.json */composer.lock .l10nignore cypress/tsconfig.json vendor-bin/*/composer.json vendor-bin/*/composer.lock .tx/config tsconfig.json js/vendor.LICENSE.txt krankerl.toml .npmignore .nextcloudignore .eslintrc.json .tx/backport
-Copyright: none
-License: CC0-1.0
-
-Files: l10n/*.js l10n/*.json
-Copyright: 2016 Nextcloud contributors
-License: AGPL-3.0-or-later
-
-Files: js/*.js.map js/*.js js/*.mjs js/*.mjs.map js/templates/*.handlebars emptyTemplates/* cypress/fixtures/* tests/features/*.feature
-Copyright: 2016 Nextcloud GmbH and Nextcloud contributors
-License: AGPL-3.0-or-later
-
-Files: composer/*
-Copyright: Nils Adermann , Jordi Boggiano
-License: MIT
-
-Files: screenshots/Nextcloud-presentation.png screenshots/Nextcloud-spreadsheet.png screenshots/Nextcloud-writer.png
-Copyright: Nextcloud GmbH and Nextcloud contributors
-License: CC0-1.0
-
-Files:img/app-dark.svg img/app.png img/app.svg img/launch.svg img/x-office-document.svg img/x-office-drawing.svg img/x-office-presentation.svg img/x-office-spreadsheet.svg
-Copyright: 2018-2024 Google LLC
-License: Apache-2.0
diff --git a/REUSE.toml b/REUSE.toml
new file mode 100644
index 0000000000..acbdd57624
--- /dev/null
+++ b/REUSE.toml
@@ -0,0 +1,42 @@
+# SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors
+# SPDX-License-Identifier: AGPL-3.0-or-later
+version = 1
+SPDX-PackageName = "richdocuments"
+SPDX-PackageSupplier = "Nextcloud <info@nextcloud.com>"
+SPDX-PackageDownloadLocation = "https://github.com/nextcloud/richdocuments"
+
+[[annotations]]
+path = [".gitattributes", ".github/issue_template.md", ".github/CODEOWNERS", ".editorconfig", "package-lock.json", "package.json", "composer.json", "composer.lock", "**/composer.json", "**/composer.lock", ".l10nignore", "cypress/tsconfig.json", "vendor-bin/**/composer.json", "vendor-bin/**/composer.lock", ".tx/config", "tsconfig.json", "js/vendor.LICENSE.txt", "krankerl.toml", ".npmignore", ".nextcloudignore", ".eslintrc.json", ".tx/backport"]
+precedence = "aggregate"
+SPDX-FileCopyrightText = "none"
+SPDX-License-Identifier = "CC0-1.0"
+
+[[annotations]]
+path = ["l10n/**.js", "l10n/**.json"]
+precedence = "aggregate"
+SPDX-FileCopyrightText = "2016 Nextcloud contributors"
+SPDX-License-Identifier = "AGPL-3.0-or-later"
+
+[[annotations]]
+path = ["js/**.js.map", "js/**.js", "js/**.mjs", "js/**.mjs.map", "js/templates/**.handlebars", "emptyTemplates/**", "cypress/fixtures/**", "tests/features/**.feature"]
+precedence = "aggregate"
+SPDX-FileCopyrightText = "2016 Nextcloud GmbH and Nextcloud contributors"
+SPDX-License-Identifier = "AGPL-3.0-or-later"
+
+[[annotations]]
+path = "composer/**"
+precedence = "aggregate"
+SPDX-FileCopyrightText = "Nils Adermann , Jordi Boggiano"
+SPDX-License-Identifier = "MIT"
+
+[[annotations]]
+path = ["screenshots/Nextcloud-presentation.png", "screenshots/Nextcloud-spreadsheet.png", "screenshots/Nextcloud-writer.png"]
+precedence = "aggregate"
+SPDX-FileCopyrightText = "Nextcloud GmbH and Nextcloud contributors"
+SPDX-License-Identifier = "CC0-1.0"
+
+[[annotations]]
+path = ["img/app-dark.svg", "img/app.png", "img/app.svg", "img/launch.svg", "img/x-office-document.svg", "img/x-office-drawing.svg", "img/x-office-presentation.svg", "img/x-office-spreadsheet.svg"]
+precedence = "aggregate"
+SPDX-FileCopyrightText = "2018-2024 Google LLC"
+SPDX-License-Identifier = "Apache-2.0"