diff --git a/.github/semgrep-rules.yml b/.github/semgrep-rules.yml
new file mode 100644
index 000000000..bd25720fb
--- /dev/null
+++ b/.github/semgrep-rules.yml
@@ -0,0 +1,20 @@
+rules:
+  - id: rust-no-dbg-in-runtime
+    message: Avoid dbg! in runtimes and pallets; use logging macros instead.
+    severity: WARNING
+    languages: [rust]
+    pattern: dbg!($X)
+    paths:
+      include:
+        - /runtime/**
+        - /zrml/**
+
+  - id: rust-no-println-in-runtime
+    message: Avoid println! in runtimes and pallets; use logging macros instead.
+    severity: WARNING
+    languages: [rust]
+    pattern: println!($X)
+    paths:
+      include:
+        - /runtime/**
+        - /zrml/**
diff --git a/.github/workflows/compliance.yml b/.github/workflows/compliance.yml
new file mode 100644
index 000000000..e523c7d3e
--- /dev/null
+++ b/.github/workflows/compliance.yml
@@ -0,0 +1,154 @@
+name: Compliance
+
+on:
+  pull_request:
+    types: [ labeled ]
+  push:
+    branches: [ main ]
+
+concurrency:
+  group: compliance-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  cargo-deny:
+    name: Cargo Deny
+    if: |
+      github.event_name == 'pull_request' && 
+        (contains(github.event.pull_request.labels.*.name, 's:review-needed') ||
+        contains(github.event.pull_request.labels.*.name, 's:accepted')) ||
+      github.event_name == 'push'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Install cargo-deny
+        uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-deny
+      - name: Run cargo-deny
+        run: |
+          cargo deny check licenses bans sources advisories
+
+  semgrep:
+    name: Semgrep
+    if: |
+      github.event_name == 'pull_request' && 
+        (contains(github.event.pull_request.labels.*.name, 's:review-needed') ||
+        contains(github.event.pull_request.labels.*.name, 's:accepted')) ||
+      github.event_name == 'push'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Run semgrep
+        uses: returntocorp/semgrep-action@v1
+        with:
+          config: .github/semgrep-rules.yml
+
+  node-licenses:
+    name: Node Licenses
+    if: |
+      github.event_name == 'pull_request' && 
+        (contains(github.event.pull_request.labels.*.name, 's:review-needed') ||
+        contains(github.event.pull_request.labels.*.name, 's:accepted')) ||
+      github.event_name == 'push'
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: integration-tests
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          run_install: false
+          version: 9
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: 'pnpm'
+          cache-dependency-path: integration-tests/pnpm-lock.yaml
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+      - name: Check licenses
+        run: pnpm dlx license-checker --production --summary
+      - name: Audit npm
+        run: pnpm audit --prod
+
+  gitleaks:
+    name: Gitleaks
+    if: |
+      (
+        github.event_name == 'pull_request' && 
+          (contains(github.event.pull_request.labels.*.name, 's:review-needed') ||
+          contains(github.event.pull_request.labels.*.name, 's:accepted'))
+      ) ||
+      github.event_name == 'push'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Install gitleaks (OSS)
+        run: |
+          set -euo pipefail
+          version="$(
+            curl -sI https://github.com/gitleaks/gitleaks/releases/latest \
+              | tr -d '\r' \
+              | awk 'tolower($1) == "location:" {print $2}' \
+              | sed -E 's#.*/tag/v?##; s#^v##'
+          )"
+
+          if [[ -z "${version}" || "${version}" == "null" ]]; then
+            echo "Failed to determine gitleaks version" >&2
+            exit 1
+          fi
+
+          arch="$(uname -m)"
+          os="$(uname -s | tr '[:upper:]' '[:lower:]')"
+
+          case "${arch}" in
+            x86_64) arch="x64" ;;
+            aarch64 | arm64) arch="arm64" ;;
+            *)
+              echo "Unsupported architecture: ${arch}" >&2
+              exit 1
+              ;;
+          esac
+
+          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${version}/gitleaks_${version}_${os}_${arch}.tar.gz" \
+            | tar -xz -C /tmp gitleaks
+          chmod +x /tmp/gitleaks
+          /tmp/gitleaks version
+      - name: Run gitleaks
+        run: /tmp/gitleaks detect --redact
+
+  sbom-vuln:
+    name: SBOM and Vulnerability Scan
+    if: |
+      github.event_name == 'pull_request' && 
+        (contains(github.event.pull_request.labels.*.name, 's:review-needed') ||
+        contains(github.event.pull_request.labels.*.name, 's:accepted')) ||
+      github.event_name == 'push'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Generate SBOM
+        uses: anchore/sbom-action@v0
+        with:
+          path: .
+          output-file: sbom.json
+          format: cyclonedx-json
+          syft-version: latest
+      - name: Scan SBOM
+        uses: anchore/scan-action@v3
+        env:
+          GRYPE_CONFIG: ${{ github.workspace }}/.grype.yaml
+        with:
+          sbom: sbom.json
+          grype-version: latest
+          fail-build: false
+          severity-cutoff: medium
diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
index 2938eb5dc..f3c58ea0a 100644
--- a/.github/workflows/integration-tests.yml
+++ b/.github/workflows/integration-tests.yml
@@ -80,13 +80,13 @@ jobs:
           mkdir -p integration-tests/tmp
 
       - name: Download runtime
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v4.1.8
         with:
           name: runtimes
           path: target/release/wbuild/zeitgeist-runtime/
 
       - name: Download binary
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v4.1.8
         with:
           name: binaries
           path: target/release
@@ -137,13 +137,13 @@ jobs:
           mkdir -p integration-tests/tmp
 
       - name: Download runtime
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v4.1.8
         with:
           name: runtimes
           path: target/release/wbuild/zeitgeist-runtime/
 
       - name: Download binary
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v4.1.8
         with:
           name: binaries
           path: target/release
@@ -193,7 +193,7 @@ jobs:
           mkdir -p integration-tests/tmp/node_logs
 
       - name: Download runtime
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v4.1.8
         with:
           name: runtimes
           path: target/release/wbuild/battery-station-runtime/
@@ -248,7 +248,7 @@ jobs:
           mkdir -p integration-tests/tmp/node_logs
 
       - name: "Download runtime"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v4.1.8
         with:
           name: runtimes
           path: target/release/wbuild/zeitgeist-runtime/
diff --git a/.github/workflows/scancode.yml b/.github/workflows/scancode.yml
new file mode 100644
index 000000000..4da286543
--- /dev/null
+++ b/.github/workflows/scancode.yml
@@ -0,0 +1,24 @@
+name: Scancode
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - "^v[0-9]+.[0-9]+.[0-9]+(-rc[0-9]+)?$"
+
+jobs:
+  scancode:
+    name: Scancode
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Install scancode
+        run: pip install scancode-toolkit
+      - name: Run scancode
+        run: scancode --processes 4 -clp . --json-pp compliance-report.json
+      - name: Upload scancode report
+        uses: actions/upload-artifact@v4
+        with:
+          name: scancode-report
+          path: compliance-report.json
diff --git a/.gitignore b/.gitignore
index 5aeff784e..47919b4bf 100644
--- a/.gitignore
+++ b/.gitignore
@@ -159,4 +159,7 @@ dmypy.json
 
 /integration-tests/tmp
 
-/integration-tests/specs
\ No newline at end of file
+/integration-tests/specs
+
+# Compliance artifacts
+sbom.json
diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 000000000..63d77de86
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,15 @@
+description = "Allow known public addresses and test keys that gitleaks flags"
+title = "Zeitgeist gitleaks allowlist"
+
+[allowlist]
+paths = [
+    '''^integration-tests/scripts/chopsticks-relay-timestamp-hook\.js$''',
+    '''^integration-tests/configs/rococo\.yml$''',
+    '''^integration-tests/configs/battery-station\.yml$''',
+    '''^runtime/battery-station/src/parachain_params\.rs$''',
+    '''^runtime/zeitgeist/src/parachain_params\.rs$''',
+    '''^scripts/runtime-upgrade/test_runtime_upgrade\.sh$''',
+    '''^node/res/bs_parachain\.json$''',
+    '''^node/res/bp\.json$''',
+    '''^node/res/bp_parachain\.json$''',
+]
diff --git a/.grype.yaml b/.grype.yaml
new file mode 100644
index 000000000..4025915e7
--- /dev/null
+++ b/.grype.yaml
@@ -0,0 +1,125 @@
+ignore:
+  # Temporary allowlist until the Polkadot SDK is upgraded and pulls newer crypto/runtime crates.
+  - vulnerability: GHSA-c86p-w88r-qvqr
+    package:
+      name: ring
+  - vulnerability: GHSA-4p46-pwfr-66x6
+    package:
+      name: ring
+  - vulnerability: GHSA-c2f5-jxjv-2hh8
+    package:
+      name: wasmtime
+  - vulnerability: GHSA-hc7m-r6v8-hg9q
+    package:
+      name: wasmtime
+  - vulnerability: GHSA-9ghp-w2hm-vfpf
+    package:
+      name: wasmtime-jit-debug
+  # Temporary allowlist for Go stdlib CVEs pulled in via prebuilt esbuild binaries; remove once upstream ships builds with patched Go toolchains.
+  - package:
+      name: stdlib
+    vulnerability: CVE-2023-45288
+  - package:
+      name: stdlib
+    vulnerability: CVE-2024-24787
+  - package:
+      name: stdlib
+    vulnerability: CVE-2024-24784
+  - package:
+      name: stdlib
+    vulnerability: CVE-2024-24791
+  - package:
+      name: stdlib
+    vulnerability: CVE-2023-24531
+  - package:
+      name: stdlib
+    vulnerability: CVE-2024-24783
+  - package:
+      name: stdlib
+    vulnerability: CVE-2023-45289
+  - package:
+      name: stdlib
+    vulnerability: CVE-2023-45290
+  - package:
+      name: stdlib
+    vulnerability: CVE-2024-34156
+  - package:
+      name: stdlib
+    vulnerability: CVE-2024-24785
+  - package:
+      name: stdlib
+    vulnerability: CVE-2024-34158
+  - package:
+      name: stdlib
+    vulnerability: CVE-2024-24790
+  - package:
+      name: stdlib
+    vulnerability: CVE-2024-45336
+  - package:
+      name: stdlib
+    vulnerability: CVE-2024-34155
+  - package:
+      name: stdlib
+    vulnerability: CVE-2024-45341
+  - package:
+      name: stdlib
+    vulnerability: CVE-2025-22871
+  - package:
+      name: stdlib
+    vulnerability: CVE-2025-61723
+  - package:
+      name: stdlib
+    vulnerability: CVE-2025-61725
+  - package:
+      name: stdlib
+    vulnerability: CVE-2025-58185
+  - package:
+      name: stdlib
+    vulnerability: CVE-2025-47907
+  - package:
+      name: stdlib
+    vulnerability: CVE-2025-58186
+  - package:
+      name: stdlib
+    vulnerability: CVE-2025-61724
+  - package:
+      name: stdlib
+    vulnerability: CVE-2025-47912
+  - package:
+      name: stdlib
+    vulnerability: CVE-2025-47906
+  - package:
+      name: stdlib
+    vulnerability: CVE-2025-58187
+  - package:
+      name: stdlib
+    vulnerability: CVE-2025-58188
+  - package:
+      name: stdlib
+    vulnerability: CVE-2025-58189
+  - package:
+      name: stdlib
+    vulnerability: CVE-2025-22866
+  - package:
+      name: stdlib
+    vulnerability: CVE-2025-4673
+  - package:
+      name: stdlib
+    vulnerability: CVE-2025-4674
+  - package:
+      name: stdlib
+    vulnerability: CVE-2025-58183
+  - package:
+      name: stdlib
+    vulnerability: CVE-2025-0913
+  - package:
+      name: stdlib
+    vulnerability: CVE-2024-24789
+  # idna GHSA still present in Rust stack; allowlisted until upstream upgrades.
+  - vulnerability: GHSA-h97m-ww89-6jmq
+    package:
+      name: idna
+  # tracing-subscriber 0.2.x pulled in via substrate stack; allowlist until upstream bumps to >=0.3.20.
+  - vulnerability: GHSA-xwfj-jgwm-7wp5
+    package:
+      name: tracing-subscriber
diff --git a/Cargo.lock b/Cargo.lock
index db67acd61..148b389a7 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2853,7 +2853,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8d162beedaa69905488a8da94f5ac3edb4dd4788b732fadb7bd120b2625c1976"
 dependencies = [
  "data-encoding",
- "syn 2.0.101",
+ "syn 1.0.109",
 ]
 
 [[package]]
@@ -5469,7 +5469,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc2f4eb4bc735547cfed7c0a4922cbd04a4655978c09b54f1f7b228750664c34"
 dependencies = [
  "cfg-if",
- "windows-targets 0.52.6",
+ "windows-targets 0.48.5",
 ]
 
 [[package]]
@@ -6254,11 +6254,11 @@ dependencies = [
 
 [[package]]
 name = "matchers"
-version = "0.1.0"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8263075bb86c5a1b1427b5ae862e8889656f126e9f77c484496e8b47cf5c5558"
+checksum = "d1525a2a28c7f4fa0fc98bb91ae755d1e2d1505079e05539e35bc876b5d65ae9"
 dependencies = [
- "regex-automata 0.1.10",
+ "regex-automata",
 ]
 
 [[package]]
@@ -6901,12 +6901,11 @@ checksum = "61807f77802ff30975e01f4f071c8ba10c022052f98b3294119f3e615d13e5be"
 
 [[package]]
 name = "nu-ansi-term"
-version = "0.46.0"
+version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77a8165726e8236064dbb45459242600304b42a5ea24ee2948e18e023bf7ba84"
+checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "overload",
- "winapi",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -7314,12 +7313,6 @@ dependencies = [
  "staging-xcm-executor",
 ]
 
-[[package]]
-name = "overload"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b15813163c1d831bf4a13c3610c05c0d03b39feb07f7e09fa234dac9b15aaf39"
-
 [[package]]
 name = "pallet-asset-conversion"
 version = "20.0.0"
@@ -11091,17 +11084,8 @@ checksum = "b544ef1b4eac5dc2db33ea63606ae9ffcfac26c1416a2806ae0bf5f56b201191"
 dependencies = [
  "aho-corasick",
  "memchr",
- "regex-automata 0.4.9",
- "regex-syntax 0.8.5",
-]
-
-[[package]]
-name = "regex-automata"
-version = "0.1.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c230d73fb8d8c1b9c0b3135c5142a8acee3a0558fb8db5cf1cb65f8d7862132"
-dependencies = [
- "regex-syntax 0.6.29",
+ "regex-automata",
+ "regex-syntax",
 ]
 
 [[package]]
@@ -11112,15 +11096,9 @@ checksum = "809e8dc61f6de73b46c85f4c96486310fe304c434cfa43669d7b40f711150908"
 dependencies = [
  "aho-corasick",
  "memchr",
- "regex-syntax 0.8.5",
+ "regex-syntax",
 ]
 
-[[package]]
-name = "regex-syntax"
-version = "0.6.29"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f162c6dd7b008981e4d40210aca20b4bd0f9b60ca9271061b07f78537722f2e1"
-
 [[package]]
 name = "regex-syntax"
 version = "0.8.5"
@@ -12874,7 +12852,7 @@ dependencies = [
  "thiserror 1.0.69",
  "tracing",
  "tracing-log",
- "tracing-subscriber 0.3.19",
+ "tracing-subscriber 0.3.20",
 ]
 
 [[package]]
@@ -14313,7 +14291,7 @@ dependencies = [
  "parity-scale-codec",
  "tracing",
  "tracing-core",
- "tracing-subscriber 0.3.19",
+ "tracing-subscriber 0.3.20",
 ]
 
 [[package]]
@@ -15396,15 +15374,15 @@ dependencies = [
 
 [[package]]
 name = "tracing-subscriber"
-version = "0.3.19"
+version = "0.3.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8189decb5ac0fa7bc8b96b7cb9b2701d60d48805aca84a238004d665fcc4008"
+checksum = "2054a14f5307d601f88daf0553e1cbf472acc4f2c51afab632431cdcd72124d5"
 dependencies = [
  "matchers",
  "nu-ansi-term",
  "once_cell",
  "parking_lot 0.12.3",
- "regex",
+ "regex-automata",
  "sharded-slab",
  "smallvec",
  "thread_local",
diff --git a/Cargo.toml b/Cargo.toml
index 4551e0c2c..b20759856 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -2,7 +2,7 @@
 authors = ["Zeitgeist PM <contact@zeitgeist.pm>"]
 edition = "2021"
 homepage = "https://zeitgeist.pm/"
-license = "GPL-3.0"
+license = "GPL-3.0-or-later"
 repository = "https://github.com/zeitgeistpm/zeitgeist"
 
 [workspace]
diff --git a/deny.toml b/deny.toml
new file mode 100644
index 000000000..8b816c147
--- /dev/null
+++ b/deny.toml
@@ -0,0 +1,88 @@
+[advisories]
+db-path = ".cargo-deny/advisory-dbs"
+ignore = [
+    "RUSTSEC-2020-0168",
+    "RUSTSEC-2022-0061",
+    "RUSTSEC-2022-0080",
+    "RUSTSEC-2023-0091",
+    "RUSTSEC-2024-0336",
+    "RUSTSEC-2024-0370",
+    "RUSTSEC-2024-0384",
+    "RUSTSEC-2024-0388",
+    "RUSTSEC-2024-0421",
+    "RUSTSEC-2024-0436",
+    "RUSTSEC-2024-0438",
+    "RUSTSEC-2024-0442",
+    "RUSTSEC-2025-0009",
+    "RUSTSEC-2025-0010",
+    "RUSTSEC-2025-0017",
+    "RUSTSEC-2025-0055",
+    "RUSTSEC-2025-0057",
+    "RUSTSEC-2025-0118",
+]
+
+[bans]
+allow = []
+allow-wildcard-paths = true
+deny = []
+highlight = "all"
+multiple-versions = "warn"
+skip = []
+skip-tree = []
+wildcards = "deny"
+
+[licenses]
+allow = [
+    "Apache-2.0",
+    "Apache-2.0 WITH LLVM-exception",
+    "MIT",
+    "BSD-3-Clause",
+    "BSD-2-Clause",
+    "ISC",
+    "CC0-1.0",
+    "MPL-2.0",
+    "NCSA",
+    "Zlib",
+    "GPL-3.0-only",
+    "GPL-3.0-or-later",
+    "Unicode-3.0",
+    "GPL-3.0-or-later WITH Classpath-exception-2.0",
+]
+confidence-threshold = 0.8
+exceptions = []
+
+[[licenses.clarify]]
+crate = "ring"
+expression = "BSD-3-Clause OR OpenSSL"
+license-files = [
+    { path = "LICENSE", hash = 0xbd0eed23 },
+]
+
+[[licenses.clarify]]
+crate = "array-bytes"
+expression = "Apache-2.0 OR GPL-3.0-or-later"
+license-files = []
+
+[[licenses.clarify]]
+crate = "proc-macro-warning"
+expression = "GPL-3.0-only OR Apache-2.0"
+license-files = []
+
+[[licenses.clarify]]
+crate = "webpki"
+expression = "ISC AND BSD-3-Clause"
+license-files = []
+
+[sources]
+allow-git = [
+    "https://github.com/paritytech/polkadot-sdk",
+    "https://github.com/zeitgeistpm/moonkit",
+    "https://github.com/zeitgeistpm/open-runtime-module-library",
+    "https://github.com/zeitgeistpm/polkadot-sdk",
+    "https://github.com/zeitgeistpm/runtimes",
+    "https://github.com/zeitgeistpm/moonbeam",
+    "https://github.com/galacticcouncil/HydraDX-node",
+    "https://github.com/zeitgeistpm/zeitgeist",
+]
+unknown-git = "warn"
+unknown-registry = "deny"
diff --git a/integration-tests/package.json b/integration-tests/package.json
index 90072703e..90ec534de 100644
--- a/integration-tests/package.json
+++ b/integration-tests/package.json
@@ -3,7 +3,7 @@
   "dependencies": {
     "sqlite3": "5.1.7",
     "typescript": "5.4.5",
-    "ws": "8.16.0"
+    "ws": "8.17.1"
   },
   "devDependencies": {
     "@acala-network/chopsticks": "1.2.4",
@@ -17,6 +17,23 @@
     "debug": "4.3.4",
     "ts-node": "10.9.2"
   },
+  "pnpm": {
+    "overrides": {
+      "tar-fs": "2.1.4",
+      "brace-expansion": "1.1.12",
+      "axios": "1.12.0",
+      "esbuild": "0.25.2",
+      "form-data": "4.0.4",
+      "glob": "10.5.0",
+      "jsondiffpatch": "0.7.2",
+      "typeorm": "0.3.26",
+      "vite": "5.4.21",
+      "ws": "8.17.1",
+      "sha.js": "2.4.12",
+      "js-yaml": "4.1.1",
+      "tmp": "0.2.4"
+    }
+  },
   "description": "Integration tests",
   "license": "GPL-3.0",
   "repository": "https://github.com/zeitgeistpm/zeitgeist",
diff --git a/integration-tests/pnpm-lock.yaml b/integration-tests/pnpm-lock.yaml
index 33c546233..c794c7165 100644
--- a/integration-tests/pnpm-lock.yaml
+++ b/integration-tests/pnpm-lock.yaml
@@ -23,8 +23,8 @@ importers:
         specifier: 5.4.5
         version: 5.4.5
       ws:
-        specifier: 8.16.0
-        version: 8.16.0
+        specifier: 8.17.1
+        version: 8.17.1
     devDependencies:
       '@acala-network/chopsticks':
         specifier: 1.2.4
@@ -4398,18 +4398,6 @@ packages:
     resolution: {integrity: sha512-uMQTubF/vcu+Wd0b5BGtDmiXePd/+44hUWQz2nZPbs92/BnxRo74tqs+hqDo12RLiEd+CXFKUwxvvIZvtt34Jw==}
     engines: {node: '>=18'}
 
-  ws@8.16.0:
-    resolution: {integrity: sha512-HS0c//TP7Ina87TfiPUz1rQzMhHrl/SG2guqRcTOIUYD2q8uhUdNHZYJUaQ8aTGPzCh+c6oawMKW35nFl1dxyQ==}
-    engines: {node: '>=10.0.0'}
-    peerDependencies:
-      bufferutil: ^4.0.1
-      utf-8-validate: '>=5.0.2'
-    peerDependenciesMeta:
-      bufferutil:
-        optional: true
-      utf-8-validate:
-        optional: true
-
   ws@8.17.1:
     resolution: {integrity: sha512-6XQFvXTkbfUOZOKKILFG1PDK2NDQs4azKQl26T0YS5CxqWLgXajbPZ+h4gZekJyRqFU8pvnbAbbs/3TgRPy+GQ==}
     engines: {node: '>=10.0.0'}
@@ -7808,9 +7796,9 @@ snapshots:
       events: 3.3.0
       readable-stream: 3.6.2
 
-  isomorphic-ws@5.0.0(ws@8.18.3):
+  isomorphic-ws@5.0.0(ws@8.17.1):
     dependencies:
-      ws: 8.18.3
+      ws: 8.17.1
 
   isows@1.0.7(ws@8.18.3):
     dependencies:
@@ -7856,7 +7844,7 @@ snapshots:
       whatwg-encoding: 3.1.1
       whatwg-mimetype: 4.0.0
       whatwg-url: 14.1.1
-      ws: 8.16.0
+      ws: 8.17.1
       xml-name-validator: 5.0.0
     transitivePeerDependencies:
       - bufferutil
@@ -8755,7 +8743,7 @@ snapshots:
 
   smoldot@2.0.26:
     dependencies:
-      ws: 8.16.0
+      ws: 8.17.1
     transitivePeerDependencies:
       - bufferutil
       - utf-8-validate
@@ -8763,7 +8751,7 @@ snapshots:
 
   smoldot@2.0.39:
     dependencies:
-      ws: 8.16.0
+      ws: 8.17.1
     transitivePeerDependencies:
       - bufferutil
       - utf-8-validate
@@ -9548,11 +9536,11 @@ snapshots:
   web3-providers-ws@4.0.8:
     dependencies:
       '@types/ws': 8.5.3
-      isomorphic-ws: 5.0.0(ws@8.18.3)
+      isomorphic-ws: 5.0.0(ws@8.17.1)
       web3-errors: 1.3.1
       web3-types: 1.10.0
       web3-utils: 4.3.3
-      ws: 8.18.3
+      ws: 8.17.1
     transitivePeerDependencies:
       - bufferutil
       - utf-8-validate
@@ -9726,8 +9714,6 @@ snapshots:
       type-fest: 4.41.0
       write-json-file: 6.0.0
 
-  ws@8.16.0: {}
-
   ws@8.17.1: {}
 
   ws@8.18.3: {}
diff --git a/integration-tests/scripts/build-battery-station-spec.sh b/integration-tests/scripts/build-battery-station-spec.sh
index 81f1401b8..fee274c68 100755
--- a/integration-tests/scripts/build-battery-station-spec.sh
+++ b/integration-tests/scripts/build-battery-station-spec.sh
@@ -1,4 +1,5 @@
 #!/bin/bash
+# SPDX-License-Identifier: GPL-3.0-or-later
 
 # Exit on any error
 set -e
diff --git a/integration-tests/scripts/build-node-configuration.sh b/integration-tests/scripts/build-node-configuration.sh
index 8cc34b90a..39496be74 100755
--- a/integration-tests/scripts/build-node-configuration.sh
+++ b/integration-tests/scripts/build-node-configuration.sh
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-3.0-or-later
 
 export PROFILE="${PROFILE:-release}"
 
diff --git a/integration-tests/scripts/build-node.sh b/integration-tests/scripts/build-node.sh
index 0863aebff..a1cebdd58 100755
--- a/integration-tests/scripts/build-node.sh
+++ b/integration-tests/scripts/build-node.sh
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-3.0-or-later
 
 source ./scripts/build-node-configuration.sh
 
diff --git a/integration-tests/scripts/build-zeitgeist-spec.sh b/integration-tests/scripts/build-zeitgeist-spec.sh
index bf0379c86..6a3d6dd4b 100755
--- a/integration-tests/scripts/build-zeitgeist-spec.sh
+++ b/integration-tests/scripts/build-zeitgeist-spec.sh
@@ -1,4 +1,5 @@
 #!/bin/bash
+# SPDX-License-Identifier: GPL-3.0-or-later
 
 # Exit on any error
 set -e
diff --git a/integration-tests/scripts/deploy-zombienet.sh b/integration-tests/scripts/deploy-zombienet.sh
index bdc237ac1..034efdb38 100755
--- a/integration-tests/scripts/deploy-zombienet.sh
+++ b/integration-tests/scripts/deploy-zombienet.sh
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-3.0-or-later
 
 if [ "$(dirname "$0")" != "./scripts" ]; then
     echo "Please execute this script from the integration-tests directory."
diff --git a/macros/Cargo.toml b/macros/Cargo.toml
index 0453ae004..564522025 100644
--- a/macros/Cargo.toml
+++ b/macros/Cargo.toml
@@ -5,5 +5,6 @@ std = []
 [package]
 authors = ["Zeitgeist PM <contact@zeitgeist.pm>"]
 edition.workspace = true
+license = "GPL-3.0-or-later"
 name = "zeitgeist-macros"
 version = "0.6.1"
diff --git a/node/Cargo.toml b/node/Cargo.toml
index 0b7ccb996..7de9784a9 100644
--- a/node/Cargo.toml
+++ b/node/Cargo.toml
@@ -190,7 +190,9 @@ build = "build.rs"
 description = "An evolving blockchain for prediction markets and futarchy."
 edition.workspace = true
 homepage = "https://zeitgeist.pm"
+license = "GPL-3.0-or-later"
 name = "zeitgeist-node"
+publish = false
 version = "0.6.1"
 
 [package.metadata.docs.rs]
diff --git a/primitives/Cargo.toml b/primitives/Cargo.toml
index dfc1ae1d1..0730234b3 100644
--- a/primitives/Cargo.toml
+++ b/primitives/Cargo.toml
@@ -39,5 +39,7 @@ std = [
 [package]
 authors = ["Zeitgeist PM <contact@zeitgeist.pm>"]
 edition.workspace = true
+license = "GPL-3.0-or-later"
 name = "zeitgeist-primitives"
+publish = false
 version = "0.6.1"
diff --git a/runtime/battery-station/Cargo.toml b/runtime/battery-station/Cargo.toml
index 5e312e0e9..6a24368ce 100644
--- a/runtime/battery-station/Cargo.toml
+++ b/runtime/battery-station/Cargo.toml
@@ -453,7 +453,9 @@ force-debug = ["sp-debug-derive/force-debug"]
 [package]
 authors = ["Zeitgeist PM <contact@zeitgeist.pm>"]
 edition.workspace = true
+license = "GPL-3.0-or-later"
 name = "battery-station-runtime"
+publish = false
 version = "0.6.1"
 
 [package.metadata.docs.rs]
diff --git a/runtime/common/Cargo.toml b/runtime/common/Cargo.toml
index be02f2655..d2b06eae0 100644
--- a/runtime/common/Cargo.toml
+++ b/runtime/common/Cargo.toml
@@ -118,7 +118,9 @@ try-runtime = [
 [package]
 authors = ["Zeitgeist PM <contact@zeitgeist.pm>"]
 edition.workspace = true
+license = "GPL-3.0-or-later"
 name = "common-runtime"
+publish = false
 version = "0.6.1"
 
 [package.metadata.docs.rs]
diff --git a/runtime/zeitgeist/Cargo.toml b/runtime/zeitgeist/Cargo.toml
index 870bd4709..eed3d7185 100644
--- a/runtime/zeitgeist/Cargo.toml
+++ b/runtime/zeitgeist/Cargo.toml
@@ -444,7 +444,9 @@ force-debug = ["sp-debug-derive/force-debug"]
 [package]
 authors = ["Zeitgeist PM <contact@zeitgeist.pm>"]
 edition.workspace = true
+license = "GPL-3.0-or-later"
 name = "zeitgeist-runtime"
+publish = false
 version = "0.6.1"
 
 [package.metadata.docs.rs]
diff --git a/scripts/benchmarks/configuration.sh b/scripts/benchmarks/configuration.sh
index 167deeafa..4c445c7f2 100644
--- a/scripts/benchmarks/configuration.sh
+++ b/scripts/benchmarks/configuration.sh
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-3.0-or-later
 
 EXTERNAL_WEIGHTS_PATH="./runtime/common/src/weights/"
 
diff --git a/scripts/benchmarks/quick_check.sh b/scripts/benchmarks/quick_check.sh
index 77e36b0bc..e181e06ba 100755
--- a/scripts/benchmarks/quick_check.sh
+++ b/scripts/benchmarks/quick_check.sh
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-3.0-or-later
 
 # This script benchmarks every pallet that is used within Zeitgeist.
 # Execute from the root of the project.
diff --git a/scripts/benchmarks/run_benchmarks.sh b/scripts/benchmarks/run_benchmarks.sh
index 793370a5e..4c5305758 100755
--- a/scripts/benchmarks/run_benchmarks.sh
+++ b/scripts/benchmarks/run_benchmarks.sh
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-3.0-or-later
 
 # This script benchmarks every pallet that is used within Zeitgeist.
 # Execute from the root of the project.
diff --git a/scripts/build-parachain-spec.sh b/scripts/build-parachain-spec.sh
index d15a1eb29..1a2fbc743 100755
--- a/scripts/build-parachain-spec.sh
+++ b/scripts/build-parachain-spec.sh
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-3.0-or-later
 
 # Takes a staging network chain to create a new production-ready specification
 
diff --git a/scripts/compliance/cargo_audit.sh b/scripts/compliance/cargo_audit.sh
new file mode 100755
index 000000000..45d482c49
--- /dev/null
+++ b/scripts/compliance/cargo_audit.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-3.0-or-later
+set -euo pipefail
+
+REPO_ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)
+cd "$REPO_ROOT"
+
+require_cmd() {
+  if ! command -v "$1" >/dev/null 2>&1; then
+    echo "Missing required command '$1'. Install it and retry." >&2
+    exit 127
+  fi
+}
+
+require_cmd cargo
+require_cmd cargo-audit
+
+cargo audit --json
diff --git a/scripts/compliance/cargo_deny.sh b/scripts/compliance/cargo_deny.sh
new file mode 100755
index 000000000..a749730cc
--- /dev/null
+++ b/scripts/compliance/cargo_deny.sh
@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-3.0-or-later
+set -euo pipefail
+
+REPO_ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)
+cd "$REPO_ROOT"
+
+require_cmd() {
+  if ! command -v "$1" >/dev/null 2>&1; then
+    echo "Missing required command '$1'. Install it and retry." >&2
+    exit 127
+  fi
+}
+
+require_cmd cargo
+require_cmd cargo-deny
+
+LOG_DIR=${CARGO_DENY_LOG_DIR:-"$REPO_ROOT/scripts/compliance/logs"}
+mkdir -p "$LOG_DIR"
+
+LOG_PATH=${CARGO_DENY_LOG:-"$LOG_DIR/cargo-deny.log"}
+ERR_LOG_PATH=${CARGO_DENY_ERR_LOG:-"$LOG_DIR/cargo-deny-errors.log"}
+CARGO_DENY_HOME=${CARGO_DENY_HOME:-"$REPO_ROOT/.cargo-deny"}
+export CARGO_DENY_HOME
+mkdir -p "$CARGO_DENY_HOME"
+ADVISORY_DB_PATH=${CARGO_DENY_ADVISORY_DB_PATH:-"$REPO_ROOT/.cargo-deny/advisory-dbs"}
+mkdir -p "$ADVISORY_DB_PATH"
+
+DISABLE_FETCH_FLAG=()
+if [[ -n "${CARGO_DENY_DISABLE_FETCH:-}" ]]; then
+  DISABLE_FETCH_FLAG+=(--disable-fetch)
+fi
+
+: > "$LOG_PATH"
+: > "$ERR_LOG_PATH"
+
+run_check() {
+  local check="$1"
+  echo "Running: cargo deny check $check"
+  cargo deny check "$check" "${DISABLE_FETCH_FLAG[@]}" >>"$LOG_PATH" 2>&1
+}
+
+run_check licenses
+run_check bans
+run_check sources
+run_check advisories
+
+grep -nEi 'error|warn' "$LOG_PATH" > "$ERR_LOG_PATH" || true
+
+echo
+echo "Full log:    $LOG_PATH"
+echo "Errors log:  $ERR_LOG_PATH"
+if [[ -s "$ERR_LOG_PATH" ]]; then
+  echo "Found errors/warnings. View with: less -R $ERR_LOG_PATH"
+else
+  echo "No errors/warnings recorded (errors log is empty)."
+fi
+echo "View full log with: less -R $LOG_PATH"
diff --git a/scripts/compliance/gitleaks.sh b/scripts/compliance/gitleaks.sh
new file mode 100755
index 000000000..a445f7850
--- /dev/null
+++ b/scripts/compliance/gitleaks.sh
@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-3.0-or-later
+set -euo pipefail
+
+REPO_ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)
+cd "$REPO_ROOT"
+
+require_cmd() {
+  if ! command -v "$1" >/dev/null 2>&1; then
+    echo "Missing required command '$1'. Install it and retry." >&2
+    exit 127
+  fi
+}
+
+require_cmd gitleaks
+
+gitleaks detect --redact
diff --git a/scripts/compliance/node_checks.sh b/scripts/compliance/node_checks.sh
new file mode 100755
index 000000000..cf8a4dab3
--- /dev/null
+++ b/scripts/compliance/node_checks.sh
@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-3.0-or-later
+set -euo pipefail
+
+REPO_ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)
+cd "$REPO_ROOT/integration-tests"
+
+require_cmd() {
+  if ! command -v "$1" >/dev/null 2>&1; then
+    echo "Missing required command '$1'. Install it and retry." >&2
+    exit 127
+  fi
+}
+
+require_cmd pnpm
+
+pnpm install --frozen-lockfile
+pnpm dlx license-checker --production --summary
+pnpm audit --prod
diff --git a/scripts/compliance/run_all.sh b/scripts/compliance/run_all.sh
new file mode 100755
index 000000000..da2bcf8e7
--- /dev/null
+++ b/scripts/compliance/run_all.sh
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-3.0-or-later
+set -euo pipefail
+
+SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+
+"$SCRIPT_DIR/cargo_deny.sh"
+"$SCRIPT_DIR/cargo_audit.sh"
+"$SCRIPT_DIR/semgrep.sh"
+"$SCRIPT_DIR/node_checks.sh"
+"$SCRIPT_DIR/gitleaks.sh"
+"$SCRIPT_DIR/sbom.sh"
+"$SCRIPT_DIR/scancode.sh"
diff --git a/scripts/compliance/sbom.sh b/scripts/compliance/sbom.sh
new file mode 100755
index 000000000..26461206f
--- /dev/null
+++ b/scripts/compliance/sbom.sh
@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-3.0-or-later
+set -euo pipefail
+
+REPO_ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)
+cd "$REPO_ROOT"
+
+require_cmd() {
+  if ! command -v "$1" >/dev/null 2>&1; then
+    echo "Missing required command '$1'. Install it and retry." >&2
+    exit 127
+  fi
+}
+
+require_cmd syft
+require_cmd grype
+
+SBOM_PATH=${SBOM_PATH:-"$REPO_ROOT/sbom.json"}
+
+syft dir:"$REPO_ROOT" --exclude "./scripts/check-license/.venv" -o cyclonedx-json > "$SBOM_PATH"
+grype sbom:"$SBOM_PATH" --fail-on medium --config "$REPO_ROOT/.grype.yaml"
diff --git a/scripts/compliance/scancode.sh b/scripts/compliance/scancode.sh
new file mode 100755
index 000000000..373f30f34
--- /dev/null
+++ b/scripts/compliance/scancode.sh
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-3.0-or-later
+set -euo pipefail
+
+REPO_ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)
+cd "$REPO_ROOT"
+
+require_cmd() {
+  if ! command -v "$1" >/dev/null 2>&1; then
+    echo "Missing required command '$1'. Install it and retry." >&2
+    exit 127
+  fi
+}
+
+require_cmd scancode
+
+OUTPUT=${OUTPUT:-"$REPO_ROOT/compliance-report.json"}
+DEFAULT_PROCESSES=$(command -v nproc >/dev/null 2>&1 && nproc || printf "4")
+PROCESSES=${PROCESSES:-$DEFAULT_PROCESSES}
+
+scancode --processes "$PROCESSES" \
+  -clp "$REPO_ROOT" \
+  --ignore "$REPO_ROOT/target" \
+  --ignore "$REPO_ROOT/integration-tests/tmp" \
+  --ignore "$REPO_ROOT/integration-tests/node_modules" \
+  --ignore "**/target/**" \
+  --ignore "*/node_modules/*" \
+  --ignore "**/node_modules/**" \
+  --ignore "**/integration-tests/node_modules/**" \
+  --ignore "**/integration-tests/tmp/**" \
+  --ignore "**/.venv/**" \
+  --json-pp "$OUTPUT"
diff --git a/scripts/compliance/semgrep.sh b/scripts/compliance/semgrep.sh
new file mode 100755
index 000000000..786a1b06b
--- /dev/null
+++ b/scripts/compliance/semgrep.sh
@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-3.0-or-later
+set -euo pipefail
+
+REPO_ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)
+cd "$REPO_ROOT"
+
+require_cmd() {
+  if ! command -v "$1" >/dev/null 2>&1; then
+    echo "Missing required command '$1'. Install it and retry." >&2
+    exit 127
+  fi
+}
+
+CONFIG="$REPO_ROOT/.github/semgrep-rules.yml"
+
+if [[ ! -f "$CONFIG" ]]; then
+  echo "Semgrep config not found at $CONFIG" >&2
+  exit 1
+fi
+
+require_cmd semgrep
+
+semgrep --config "$CONFIG"
diff --git a/scripts/docker-hub-publish.sh b/scripts/docker-hub-publish.sh
index ff4cfbcb5..748d38f24 100755
--- a/scripts/docker-hub-publish.sh
+++ b/scripts/docker-hub-publish.sh
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-3.0-or-later
 
 VERSION=$1
 
diff --git a/scripts/init.sh b/scripts/init.sh
index 8cee5890e..aec223fd8 100755
--- a/scripts/init.sh
+++ b/scripts/init.sh
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-3.0-or-later
 
 # Initializes a build environment.
 # Passing "nosudo" in the first argument results in avoiding the usage of sudo for privileged commands.
diff --git a/scripts/parachain/bootstrap.sh b/scripts/parachain/bootstrap.sh
index eb5088a79..e9cae1a3e 100755
--- a/scripts/parachain/bootstrap.sh
+++ b/scripts/parachain/bootstrap.sh
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-3.0-or-later
 
 set -euxo pipefail
 
diff --git a/scripts/parachain/local.sh b/scripts/parachain/local.sh
index 39bb1e4a6..4c3cc2815 100755
--- a/scripts/parachain/local.sh
+++ b/scripts/parachain/local.sh
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-3.0-or-later
 
 # Creates a local relay chain for testing and development
 #
diff --git a/scripts/parachain/testing-network-commons.sh b/scripts/parachain/testing-network-commons.sh
index c8c04d324..e93c949ff 100755
--- a/scripts/parachain/testing-network-commons.sh
+++ b/scripts/parachain/testing-network-commons.sh
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-3.0-or-later
 
 # Not meant to be called directly.
 #
diff --git a/scripts/runtime-upgrade/test_runtime_upgrade.sh b/scripts/runtime-upgrade/test_runtime_upgrade.sh
index f9ec99bfa..4a49da3bf 100755
--- a/scripts/runtime-upgrade/test_runtime_upgrade.sh
+++ b/scripts/runtime-upgrade/test_runtime_upgrade.sh
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-3.0-or-later
 
 set -euxo pipefail
 
diff --git a/scripts/tests/all-sequencial.sh b/scripts/tests/all-sequencial.sh
index a94141360..5e208a2a2 100755
--- a/scripts/tests/all-sequencial.sh
+++ b/scripts/tests/all-sequencial.sh
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-3.0-or-later
 
 # Checks everything in a sequential fashion. Useful for debugging but slow to compile/complete.
 #
diff --git a/scripts/tests/aux-functions.sh b/scripts/tests/aux-functions.sh
index 0bc90af4a..749c21e0a 100755
--- a/scripts/tests/aux-functions.sh
+++ b/scripts/tests/aux-functions.sh
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-3.0-or-later
 
 # Auxiliar functions used by the testing scripts
 
diff --git a/scripts/tests/clippy.sh b/scripts/tests/clippy.sh
index c9d08856c..54a778d97 100755
--- a/scripts/tests/clippy.sh
+++ b/scripts/tests/clippy.sh
@@ -1,3 +1,4 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-3.0-or-later
 
 cargo clippy --all-features --all-targets -- -Dwarnings -Aclippy::manual-inspect -Aclippy::useless_conversion -Aclippy::result-large-err
diff --git a/scripts/tests/coverage.sh b/scripts/tests/coverage.sh
index 71b59fa16..e86d48714 100755
--- a/scripts/tests/coverage.sh
+++ b/scripts/tests/coverage.sh
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-3.0-or-later
 
 # Coverage: Generate project coverage files using grcov 
 
diff --git a/scripts/tests/format.sh b/scripts/tests/format.sh
index 907969966..7c1eee96d 100755
--- a/scripts/tests/format.sh
+++ b/scripts/tests/format.sh
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-3.0-or-later
 
 usage() {
     cat <<EOF
diff --git a/scripts/tests/fuzz.sh b/scripts/tests/fuzz.sh
index c70909ac1..09b7770d9 100755
--- a/scripts/tests/fuzz.sh
+++ b/scripts/tests/fuzz.sh
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-3.0-or-later
 
 # Fuzzing tests
 
diff --git a/scripts/tests/parachain.sh b/scripts/tests/parachain.sh
index a59f27049..f11001497 100755
--- a/scripts/tests/parachain.sh
+++ b/scripts/tests/parachain.sh
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-3.0-or-later
 
 # Parachain node: Runtime and node directories
 
diff --git a/scripts/tests/standalone.sh b/scripts/tests/standalone.sh
index 8a9065b85..33471f697 100755
--- a/scripts/tests/standalone.sh
+++ b/scripts/tests/standalone.sh
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-3.0-or-later
 
 # Standalone node: Runtime and node directories
 
diff --git a/scripts/tests/test_parachain.sh b/scripts/tests/test_parachain.sh
index d6f26e7e3..e2b2f8242 100755
--- a/scripts/tests/test_parachain.sh
+++ b/scripts/tests/test_parachain.sh
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-3.0-or-later
 
 # Tests: Run tests on all crates using a parachain build
 
diff --git a/scripts/tests/test_standalone.sh b/scripts/tests/test_standalone.sh
index 2aac94683..251631be9 100755
--- a/scripts/tests/test_standalone.sh
+++ b/scripts/tests/test_standalone.sh
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-3.0-or-later
 
 # Tests: Run tests on all crates using a standalone build
 
diff --git a/scripts/update-copyright.sh b/scripts/update-copyright.sh
index 865bacead..f7438a0f5 100755
--- a/scripts/update-copyright.sh
+++ b/scripts/update-copyright.sh
@@ -1,2 +1,5 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-3.0-or-later
+
 RUST_FILES_CHANGED_NOT_DELETED=$(git diff --diff-filter=d --name-only main | grep -E '.*\.rs$')
 check-license -w ${RUST_FILES_CHANGED_NOT_DELETED}
diff --git a/zrml/authorized/Cargo.toml b/zrml/authorized/Cargo.toml
index b9052ebc1..d5850a9a8 100644
--- a/zrml/authorized/Cargo.toml
+++ b/zrml/authorized/Cargo.toml
@@ -38,5 +38,7 @@ try-runtime = [
 [package]
 authors = ["Zeitgeist PM <contact@zeitgeist.pm>"]
 edition.workspace = true
+license = "GPL-3.0-or-later"
 name = "zrml-authorized"
+publish = false
 version = "0.6.1"
diff --git a/zrml/combinatorial-tokens/Cargo.toml b/zrml/combinatorial-tokens/Cargo.toml
index b223165f2..40035d45f 100644
--- a/zrml/combinatorial-tokens/Cargo.toml
+++ b/zrml/combinatorial-tokens/Cargo.toml
@@ -66,5 +66,7 @@ try-runtime = [
 [package]
 authors = ["Zeitgeist PM <contact@zeitgeist.pm>"]
 edition.workspace = true
+license = "GPL-3.0-or-later"
 name = "zrml-combinatorial-tokens"
+publish = false
 version = "0.6.1"
diff --git a/zrml/combinatorial-tokens/fuzz/Cargo.toml b/zrml/combinatorial-tokens/fuzz/Cargo.toml
index de032d5c1..64c4e787d 100644
--- a/zrml/combinatorial-tokens/fuzz/Cargo.toml
+++ b/zrml/combinatorial-tokens/fuzz/Cargo.toml
@@ -30,6 +30,7 @@ zrml-combinatorial-tokens = { workspace = true, features = ["default", "mock"] }
 [package]
 authors = ["Forecasting Technologies Ltd"]
 edition.workspace = true
+license = "GPL-3.0-or-later"
 name = "zrml-combinatorial-tokens-fuzz"
 publish = false
 version = "0.6.1"
diff --git a/zrml/court/Cargo.toml b/zrml/court/Cargo.toml
index 000a92462..0c8789241 100644
--- a/zrml/court/Cargo.toml
+++ b/zrml/court/Cargo.toml
@@ -48,5 +48,7 @@ try-runtime = [
 [package]
 authors = ["Zeitgeist PM <contact@zeitgeist.pm>"]
 edition.workspace = true
+license = "GPL-3.0-or-later"
 name = "zrml-court"
+publish = false
 version = "0.6.1"
diff --git a/zrml/futarchy/Cargo.toml b/zrml/futarchy/Cargo.toml
index db59adafe..fddf8919f 100644
--- a/zrml/futarchy/Cargo.toml
+++ b/zrml/futarchy/Cargo.toml
@@ -61,5 +61,7 @@ try-runtime = [
 [package]
 authors = ["Zeitgeist PM <contact@zeitgeist.pm>"]
 edition.workspace = true
+license = "GPL-3.0-or-later"
 name = "zrml-futarchy"
+publish = false
 version = "0.6.1"
diff --git a/zrml/futarchy/fuzz/Cargo.toml b/zrml/futarchy/fuzz/Cargo.toml
index 646ac6c88..949ae2667 100644
--- a/zrml/futarchy/fuzz/Cargo.toml
+++ b/zrml/futarchy/fuzz/Cargo.toml
@@ -18,6 +18,7 @@ zrml-futarchy = { workspace = true, features = ["default", "fuzzing", "mock"] }
 [package]
 authors = ["Forecasting Technologies Ltd"]
 edition.workspace = true
+license = "GPL-3.0-or-later"
 name = "zrml-futarchy-fuzz"
 publish = false
 version = "0.6.1"
diff --git a/zrml/global-disputes/Cargo.toml b/zrml/global-disputes/Cargo.toml
index b4ac71b69..b01f3ecae 100644
--- a/zrml/global-disputes/Cargo.toml
+++ b/zrml/global-disputes/Cargo.toml
@@ -46,5 +46,7 @@ try-runtime = [
 [package]
 authors = ["Zeitgeist PM <contact@zeitgeist.pm>"]
 edition.workspace = true
+license = "GPL-3.0-or-later"
 name = "zrml-global-disputes"
+publish = false
 version = "0.6.1"
diff --git a/zrml/hybrid-router/Cargo.toml b/zrml/hybrid-router/Cargo.toml
index c49923e25..aa2a9aba7 100644
--- a/zrml/hybrid-router/Cargo.toml
+++ b/zrml/hybrid-router/Cargo.toml
@@ -96,5 +96,7 @@ try-runtime = [
 [package]
 authors = ["Zeitgeist PM <contact@zeitgeist.pm>"]
 edition.workspace = true
+license = "GPL-3.0-or-later"
 name = "zrml-hybrid-router"
+publish = false
 version = "0.6.1"
diff --git a/zrml/market-commons/Cargo.toml b/zrml/market-commons/Cargo.toml
index 5e61dc871..bc5e36bb8 100644
--- a/zrml/market-commons/Cargo.toml
+++ b/zrml/market-commons/Cargo.toml
@@ -33,5 +33,7 @@ try-runtime = [
 [package]
 authors = ["Zeitgeist PM <contact@zeitgeist.pm>"]
 edition.workspace = true
+license = "GPL-3.0-or-later"
 name = "zrml-market-commons"
+publish = false
 version = "0.6.1"
diff --git a/zrml/neo-swaps/Cargo.toml b/zrml/neo-swaps/Cargo.toml
index f3e328d3f..8fce3eb74 100644
--- a/zrml/neo-swaps/Cargo.toml
+++ b/zrml/neo-swaps/Cargo.toml
@@ -108,5 +108,7 @@ try-runtime = [
 [package]
 authors = ["Zeitgeist PM <contact@zeitgeist.pm>"]
 edition.workspace = true
+license = "GPL-3.0-or-later"
 name = "zrml-neo-swaps"
+publish = false
 version = "0.6.1"
diff --git a/zrml/neo-swaps/fuzz/Cargo.toml b/zrml/neo-swaps/fuzz/Cargo.toml
index 84c858b4f..35d90ee24 100644
--- a/zrml/neo-swaps/fuzz/Cargo.toml
+++ b/zrml/neo-swaps/fuzz/Cargo.toml
@@ -30,6 +30,7 @@ zrml-neo-swaps = { workspace = true, features = ["default", "mock"] }
 [package]
 authors = ["Forecasting Technologies Ltd"]
 edition.workspace = true
+license = "GPL-3.0-or-later"
 name = "zrml-neo-swaps-fuzz"
 publish = false
 version = "0.6.1"
diff --git a/zrml/orderbook/Cargo.toml b/zrml/orderbook/Cargo.toml
index 3180ceee3..66d7ccef0 100644
--- a/zrml/orderbook/Cargo.toml
+++ b/zrml/orderbook/Cargo.toml
@@ -56,5 +56,7 @@ try-runtime = [
 [package]
 authors = ["Zeitgeist PM <contact@zeitgeist.pm>"]
 edition.workspace = true
+license = "GPL-3.0-or-later"
 name = "zrml-orderbook"
+publish = false
 version = "0.6.1"
diff --git a/zrml/orderbook/fuzz/Cargo.toml b/zrml/orderbook/fuzz/Cargo.toml
index 11ace70bf..d6818b212 100644
--- a/zrml/orderbook/fuzz/Cargo.toml
+++ b/zrml/orderbook/fuzz/Cargo.toml
@@ -14,6 +14,7 @@ zrml-orderbook = { workspace = true, features = ["default", "mock"] }
 [package]
 authors = ["Automatically generated"]
 edition.workspace = true
+license = "GPL-3.0-or-later"
 name = "zrml-orderbook-fuzz"
 publish = false
 version = "0.6.1"
diff --git a/zrml/parimutuel/Cargo.toml b/zrml/parimutuel/Cargo.toml
index a1f7c574f..227ca70e6 100644
--- a/zrml/parimutuel/Cargo.toml
+++ b/zrml/parimutuel/Cargo.toml
@@ -45,5 +45,7 @@ try-runtime = [
 [package]
 authors = ["Zeitgeist PM <contact@zeitgeist.pm>"]
 edition.workspace = true
+license = "GPL-3.0-or-later"
 name = "zrml-parimutuel"
+publish = false
 version = "0.6.1"
diff --git a/zrml/prediction-markets/Cargo.toml b/zrml/prediction-markets/Cargo.toml
index 5e3d59728..81414556d 100644
--- a/zrml/prediction-markets/Cargo.toml
+++ b/zrml/prediction-markets/Cargo.toml
@@ -93,5 +93,7 @@ try-runtime = [
 [package]
 authors = ["Zeitgeist PM <contact@zeitgeist.pm>"]
 edition.workspace = true
+license = "GPL-3.0-or-later"
 name = "zrml-prediction-markets"
+publish = false
 version = "0.6.1"
diff --git a/zrml/prediction-markets/fuzz/Cargo.toml b/zrml/prediction-markets/fuzz/Cargo.toml
index 308eb755d..dab6184a5 100644
--- a/zrml/prediction-markets/fuzz/Cargo.toml
+++ b/zrml/prediction-markets/fuzz/Cargo.toml
@@ -15,6 +15,7 @@ zrml-prediction-markets = { workspace = true, features = ["mock", "default"] }
 [package]
 authors = ["Automatically generated"]
 edition.workspace = true
+license = "GPL-3.0-or-later"
 name = "zrml-prediction-markets-fuzz"
 publish = false
 version = "0.6.1"
diff --git a/zrml/prediction-markets/runtime-api/Cargo.toml b/zrml/prediction-markets/runtime-api/Cargo.toml
index be2199507..ce19f2d9f 100644
--- a/zrml/prediction-markets/runtime-api/Cargo.toml
+++ b/zrml/prediction-markets/runtime-api/Cargo.toml
@@ -14,5 +14,7 @@ std = [
 [package]
 authors = ["Zeitgeist PM <contact@zeitgeist.pm>"]
 edition.workspace = true
+license = "GPL-3.0-or-later"
 name = "zrml-prediction-markets-runtime-api"
+publish = false
 version = "0.6.1"
diff --git a/zrml/styx/Cargo.toml b/zrml/styx/Cargo.toml
index 124f1f674..2d8fab8e9 100644
--- a/zrml/styx/Cargo.toml
+++ b/zrml/styx/Cargo.toml
@@ -36,5 +36,7 @@ try-runtime = [
 [package]
 authors = ["Zeitgeist PM <contact@zeitgeist.pm>"]
 edition.workspace = true
+license = "GPL-3.0-or-later"
 name = "zrml-styx"
+publish = false
 version = "0.6.1"
diff --git a/zrml/swaps/Cargo.toml b/zrml/swaps/Cargo.toml
index f64d41557..41bdb8a40 100644
--- a/zrml/swaps/Cargo.toml
+++ b/zrml/swaps/Cargo.toml
@@ -64,5 +64,7 @@ try-runtime = [
 [package]
 authors = ["Zeitgeist PM <contact@zeitgeist.pm>"]
 edition.workspace = true
+license = "GPL-3.0-or-later"
 name = "zrml-swaps"
+publish = false
 version = "0.6.1"
diff --git a/zrml/swaps/fuzz/Cargo.toml b/zrml/swaps/fuzz/Cargo.toml
index e20a17a6d..f90f8b3fa 100644
--- a/zrml/swaps/fuzz/Cargo.toml
+++ b/zrml/swaps/fuzz/Cargo.toml
@@ -65,6 +65,7 @@ zrml-swaps = { workspace = true, features = ["mock", "default"] }
 [package]
 authors = ["Automatically generated"]
 edition.workspace = true
+license = "GPL-3.0-or-later"
 name = "zrml-swaps-fuzz"
 publish = false
 version = "0.6.1"
diff --git a/zrml/swaps/rpc/Cargo.toml b/zrml/swaps/rpc/Cargo.toml
index d22121216..c3cc1d500 100644
--- a/zrml/swaps/rpc/Cargo.toml
+++ b/zrml/swaps/rpc/Cargo.toml
@@ -10,5 +10,7 @@ zrml-swaps-runtime-api = { workspace = true, features = ["default"] }
 [package]
 authors = ["Zeitgeist PM <contact@zeitgeist.pm>"]
 edition.workspace = true
+license = "GPL-3.0-or-later"
 name = "zrml-swaps-rpc"
+publish = false
 version = "0.6.1"
diff --git a/zrml/swaps/runtime-api/Cargo.toml b/zrml/swaps/runtime-api/Cargo.toml
index 714a1949c..f83b7ffe9 100644
--- a/zrml/swaps/runtime-api/Cargo.toml
+++ b/zrml/swaps/runtime-api/Cargo.toml
@@ -17,5 +17,7 @@ std = [
 [package]
 authors = ["Zeitgeist PM <contact@zeitgeist.pm>"]
 edition.workspace = true
+license = "GPL-3.0-or-later"
 name = "zrml-swaps-runtime-api"
+publish = false
 version = "0.6.1"