diff --git a/AGENTS.md b/AGENTS.md
index 7adcfa4..c38fb5b 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,3 +1,6 @@
+<!-- SPDX-License-Identifier: Apache-2.0
+     https://www.apache.org/licenses/LICENSE-2.0 -->
+
 # AGENTS.md
 
 Guidance for AI coding agents (and the humans running them) working in
diff --git a/pom.xml b/pom.xml
index 08d2244..6912526 100644
--- a/pom.xml
+++ b/pom.xml
@@ -120,8 +120,24 @@
             <exclude>examples/**/*.jsonld</exclude>
             <exclude>mappings/**/*.md</exclude>
             <exclude>CHANGELOG.md</exclude>
+            <!-- Generated lockfile; cannot carry a header. -->
+            <exclude>uv.lock</exclude>
           </excludes>
         </configuration>
+        <executions>
+          <!--
+            The Apache parent pom only runs RAT in the apache-release
+            profile; bind it here so every `mvn verify` (and CI) enforces
+            license headers.
+          -->
+          <execution>
+            <id>rat-check</id>
+            <goals>
+              <goal>check</goal>
+            </goals>
+            <phase>validate</phase>
+          </execution>
+        </executions>
       </plugin>
 
       <!--