diff --git a/tests/test_pins.py b/tests/test_pins.py
index 3b70734..bfe03da 100644
--- a/tests/test_pins.py
+++ b/tests/test_pins.py
@@ -1,3 +1,7 @@
+# SPDX-FileCopyrightText: 2026 Brad Barnett
+#
+# SPDX-License-Identifier: MIT
+
 """tools/pins.py: applying a request to pins.json, and recording it on main.
 
 Everything runs against throwaway git repositories; nothing is fetched.
diff --git a/tools/pins.py b/tools/pins.py
index de0b538..29736a1 100644
--- a/tools/pins.py
+++ b/tools/pins.py
@@ -1,4 +1,8 @@
 #!/usr/bin/env python3
+# SPDX-FileCopyrightText: 2026 Brad Barnett
+#
+# SPDX-License-Identifier: MIT
+
 """Which release of each source the published index is built from.
 
 ``pins.json`` names one entry per publication profile: