diff --git a/.github/workflows/reuse.yml b/.github/workflows/reuse.yml
index b7a3dd95ea6..0d8e1962a80 100644
--- a/.github/workflows/reuse.yml
+++ b/.github/workflows/reuse.yml
@@ -11,34 +11,17 @@ name: REUSE Compliance Check
 
 on: [pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   reuse-compliance-check:
     runs-on: ubuntu-latest
     steps:
-    - name: Checkout
-      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-
-    - name: Read package.json node and npm engines version
-      uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3
-      id: versions
-      with:
-        fallbackNode: '^20'
-        fallbackNpm: '^10'
-
-    - name: Set up node ${{ steps.versions.outputs.nodeVersion }}
-      uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
-      with:
-        node-version: ${{ steps.versions.outputs.nodeVersion }}
-
-    - name: Set up npm ${{ steps.versions.outputs.npmVersion }}
-      run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}'
-
-    - name: Install dependencies & build
-      env:
-        CYPRESS_INSTALL_BINARY: 0
-      run: |
-        npm ci
-        npm run build --if-present
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
-    - name: REUSE Compliance Check
-      uses: fsfe/reuse-action@3ae3c6bdf1257ab19397fab11fd3312144692083 # v4.0.0
+      - name: REUSE Compliance Check
+        uses: fsfe/reuse-action@bb774aa972c2a89ff34781233d275075cbddf542 # v5.0.0
diff --git a/.reuse/dep5 b/.reuse/dep5
deleted file mode 100644
index 6630f474145..00000000000
--- a/.reuse/dep5
+++ /dev/null
@@ -1,28 +0,0 @@
-Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
-Upstream-Name: text
-Upstream-Contact: Nextcloud <info@nextcloud.com>
-Source: https://github.com/nextcloud/text
-
-Files: .gitattributes .editorconfig babel.config.js .php-cs-fixer.dist.php package-lock.json package.json composer.json composer.lock webpack.js stylelint.config.js .eslintrc.js cypress/.eslintrc.json .gitignore .jshintrc .l10nignore action/.gitignore action/package.json action/package-lock.json action/dist/index.js tests/* psalm.xml vendor-bin/*/composer.json vendor-bin/*/composer.lock .tx/config webpack.config.js js/vendor.LICENSE.txt .github/CODEOWNERS vite.config.js stylelint.config.cjs composer/*.php composer/composer.* tsconfig.json jsconfig.json krankerl.toml renovate.json .github/ISSUE_TEMPLATE/*  .nextcloudignore CHANGELOG.md .tsconfig.json
-Copyright: none
-License: CC0-1.0
-
-Files: l10n/*.js l10n/*.json js/*.mjs.map js/*.mjs css/*.css
-Copyright: 2019-2024 Nextcloud GmbH and Nextcloud contributors
-License: AGPL-3.0-or-later
-
-Files: src/assets/status-icons/user-status-away.svg src/assets/status-icons/user-status-dnd.svg src/assets/status-icons/user-status-online.svg img/checkbox-mark.svg img/article.svg
-Copyright: 2018-2024 Google LLC
-License: Apache-2.0
-
-Files: lib/composer/* apps/*/composer/autoload.php apps/*/composer/composer/*.php apps/files_external/3rdparty/autoload.php composer/composer/*
-Copyright: Nils Adermann, Jordi Boggiano
-License: MIT
-
-Files: cypress/fixtures/* cypress/snapshots/* src/tests/fixtures/*
-Copyright: 2019-2024 Nextcloud GmbH and Nextcloud contributors
-License: AGPL-3.0-or-later
-
-Files: img/app-dark.svg img/app.png img/app.svg img/screenshots/*
-Copyright: 2019-2024 Nextcloud GmbH and Nextcloud contributors
-License: AGPL-3.0-or-later
\ No newline at end of file
diff --git a/REUSE.toml b/REUSE.toml
new file mode 100644
index 00000000000..99f20ce5b4e
--- /dev/null
+++ b/REUSE.toml
@@ -0,0 +1,42 @@
+# SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors
+# SPDX-License-Identifier: AGPL-3.0-or-later
+version = 1
+SPDX-PackageName = "text"
+SPDX-PackageSupplier = "Nextcloud <info@nextcloud.com>"
+SPDX-PackageDownloadLocation = "https://github.com/nextcloud/text"
+
+[[annotations]]
+path = [".gitattributes", ".editorconfig", "babel.config.js", ".php-cs-fixer.dist.php", "package-lock.json", "package.json", "composer.json", "composer.lock", "webpack.js", "stylelint.config.js", ".eslintrc.js", "cypress/.eslintrc.json", ".gitignore", ".jshintrc", ".l10nignore", "action/.gitignore", "action/package.json", "action/package-lock.json", "action/dist/index.js", "tests/**", "psalm.xml", "vendor-bin/**/composer.json", "vendor-bin/**/composer.lock", ".tx/config", "webpack.config.js", "js/vendor.LICENSE.txt", ".github/CODEOWNERS", "vite.config.js", "stylelint.config.cjs", "composer/**.php", "composer/composer.**", "tsconfig.json", "jsconfig.json", "krankerl.toml", "renovate.json", ".github/ISSUE_TEMPLATE/**", ".nextcloudignore", "CHANGELOG.md", ".tsconfig.json"]
+precedence = "aggregate"
+SPDX-FileCopyrightText = "none"
+SPDX-License-Identifier = "CC0-1.0"
+
+[[annotations]]
+path = ["l10n/**.js", "l10n/**.json", "js/**.mjs.map", "js/**.mjs", "css/**.css"]
+precedence = "aggregate"
+SPDX-FileCopyrightText = "2019-2024 Nextcloud GmbH and Nextcloud contributors"
+SPDX-License-Identifier = "AGPL-3.0-or-later"
+
+[[annotations]]
+path = ["src/assets/status-icons/user-status-away.svg", "src/assets/status-icons/user-status-dnd.svg", "src/assets/status-icons/user-status-online.svg", "img/checkbox-mark.svg", "img/article.svg"]
+precedence = "aggregate"
+SPDX-FileCopyrightText = "2018-2024 Google LLC"
+SPDX-License-Identifier = "Apache-2.0"
+
+[[annotations]]
+path = ["lib/composer/**", "apps/**/composer/autoload.php", "apps/**/composer/composer/**.php", "apps/files_external/3rdparty/autoload.php", "composer/composer/**"]
+precedence = "aggregate"
+SPDX-FileCopyrightText = "Nils Adermann, Jordi Boggiano"
+SPDX-License-Identifier = "MIT"
+
+[[annotations]]
+path = ["cypress/fixtures/**", "cypress/snapshots/**", "src/tests/fixtures/**"]
+precedence = "aggregate"
+SPDX-FileCopyrightText = "2019-2024 Nextcloud GmbH and Nextcloud contributors"
+SPDX-License-Identifier = "AGPL-3.0-or-later"
+
+[[annotations]]
+path = ["img/app-dark.svg", "img/app.png", "img/app.svg", "img/screenshots/**"]
+precedence = "aggregate"
+SPDX-FileCopyrightText = "2019-2024 Nextcloud GmbH and Nextcloud contributors"
+SPDX-License-Identifier = "AGPL-3.0-or-later"