diff --git a/src/sig_stfl/xmss/external/core_hash.c b/src/sig_stfl/xmss/external/core_hash.c
index b27ad2ca9b..72fe4e9d5c 100644
--- a/src/sig_stfl/xmss/external/core_hash.c
+++ b/src/sig_stfl/xmss/external/core_hash.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0 AND MIT
 #include <oqs/sha2.h>
 #include <oqs/sha3.h>
 #include "core_hash.h"
diff --git a/src/sig_stfl/xmss/external/core_hash.h b/src/sig_stfl/xmss/external/core_hash.h
index f350857d14..e292e4c06d 100644
--- a/src/sig_stfl/xmss/external/core_hash.h
+++ b/src/sig_stfl/xmss/external/core_hash.h
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0 AND MIT
 #ifndef CORE_HASH
 #define CORE_HASH
 
diff --git a/src/sig_stfl/xmss/external/hash.c b/src/sig_stfl/xmss/external/hash.c
index a6bac00724..557c8de7db 100644
--- a/src/sig_stfl/xmss/external/hash.c
+++ b/src/sig_stfl/xmss/external/hash.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0 AND MIT
 #include <stdint.h>
 #include <string.h>
 
diff --git a/src/sig_stfl/xmss/external/hash.h b/src/sig_stfl/xmss/external/hash.h
index 076b3b56ec..bd1e1c1202 100644
--- a/src/sig_stfl/xmss/external/hash.h
+++ b/src/sig_stfl/xmss/external/hash.h
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0 AND MIT
 #ifndef XMSS_HASH_H
 #define XMSS_HASH_H
 
diff --git a/src/sig_stfl/xmss/external/hash_address.c b/src/sig_stfl/xmss/external/hash_address.c
index 7aacee5a58..a9fec506b5 100644
--- a/src/sig_stfl/xmss/external/hash_address.c
+++ b/src/sig_stfl/xmss/external/hash_address.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0 AND MIT
 #include <stdint.h>
 #include "hash_address.h"
 
diff --git a/src/sig_stfl/xmss/external/hash_address.h b/src/sig_stfl/xmss/external/hash_address.h
index 50ad17885e..06f5c502bd 100644
--- a/src/sig_stfl/xmss/external/hash_address.h
+++ b/src/sig_stfl/xmss/external/hash_address.h
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0 AND MIT
 #ifndef XMSS_HASH_ADDRESS_H
 #define XMSS_HASH_ADDRESS_H
 
diff --git a/src/sig_stfl/xmss/external/namespace.h b/src/sig_stfl/xmss/external/namespace.h
index 468388aa3b..7bb7d05349 100644
--- a/src/sig_stfl/xmss/external/namespace.h
+++ b/src/sig_stfl/xmss/external/namespace.h
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0 AND MIT
 #ifndef XMSS_NAMESPACE_H
 #define XMSS_NAMESPACE_H
 
diff --git a/src/sig_stfl/xmss/external/params.c b/src/sig_stfl/xmss/external/params.c
index fdb9c76f2c..f9ba544e47 100644
--- a/src/sig_stfl/xmss/external/params.c
+++ b/src/sig_stfl/xmss/external/params.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0 AND MIT
 #include <stdint.h>
 #include <string.h>
 
diff --git a/src/sig_stfl/xmss/external/params.h b/src/sig_stfl/xmss/external/params.h
index 59b86d3da6..f75e3c97c5 100644
--- a/src/sig_stfl/xmss/external/params.h
+++ b/src/sig_stfl/xmss/external/params.h
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0 AND MIT
 #ifndef XMSS_PARAMS_H
 #define XMSS_PARAMS_H
 
diff --git a/src/sig_stfl/xmss/external/utils.c b/src/sig_stfl/xmss/external/utils.c
index 855f63654d..c2d76aba15 100644
--- a/src/sig_stfl/xmss/external/utils.c
+++ b/src/sig_stfl/xmss/external/utils.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0 AND MIT
 #include "utils.h"
 
 /**
diff --git a/src/sig_stfl/xmss/external/utils.h b/src/sig_stfl/xmss/external/utils.h
index fc5df634a6..14d8588ddc 100644
--- a/src/sig_stfl/xmss/external/utils.h
+++ b/src/sig_stfl/xmss/external/utils.h
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0 AND MIT
 #ifndef XMSS_UTILS_H
 #define XMSS_UTILS_H
 
diff --git a/src/sig_stfl/xmss/external/wots.c b/src/sig_stfl/xmss/external/wots.c
index 09db90e55c..a4bfae956d 100644
--- a/src/sig_stfl/xmss/external/wots.c
+++ b/src/sig_stfl/xmss/external/wots.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0 AND MIT
 #include <stdint.h>
 #include <string.h>
 
diff --git a/src/sig_stfl/xmss/external/wots.h b/src/sig_stfl/xmss/external/wots.h
index 0ee55b5b10..e0e3f1d0a9 100644
--- a/src/sig_stfl/xmss/external/wots.h
+++ b/src/sig_stfl/xmss/external/wots.h
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0 AND MIT
 #ifndef XMSS_WOTS_H
 #define XMSS_WOTS_H
 
diff --git a/src/sig_stfl/xmss/external/xmss.c b/src/sig_stfl/xmss/external/xmss.c
index 53ea10c24a..17b40f5627 100644
--- a/src/sig_stfl/xmss/external/xmss.c
+++ b/src/sig_stfl/xmss/external/xmss.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0 AND MIT
 #include <stdint.h>
 
 #include "params.h"
diff --git a/src/sig_stfl/xmss/external/xmss.h b/src/sig_stfl/xmss/external/xmss.h
index b21db845d3..53d21e2dbd 100644
--- a/src/sig_stfl/xmss/external/xmss.h
+++ b/src/sig_stfl/xmss/external/xmss.h
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0 AND MIT
 #ifndef XMSS_H
 #define XMSS_H
 
diff --git a/src/sig_stfl/xmss/external/xmss_commons.c b/src/sig_stfl/xmss/external/xmss_commons.c
index 5f3818d184..168e6ffed5 100644
--- a/src/sig_stfl/xmss/external/xmss_commons.c
+++ b/src/sig_stfl/xmss/external/xmss_commons.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0 AND MIT
 #include <stdlib.h>
 #include <string.h>
 #include <stdint.h>
diff --git a/src/sig_stfl/xmss/external/xmss_commons.h b/src/sig_stfl/xmss/external/xmss_commons.h
index dbe841c6bf..26eb537ee3 100644
--- a/src/sig_stfl/xmss/external/xmss_commons.h
+++ b/src/sig_stfl/xmss/external/xmss_commons.h
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0 AND MIT
 #ifndef XMSS_COMMONS_H
 #define XMSS_COMMONS_H
 
diff --git a/src/sig_stfl/xmss/external/xmss_core.c b/src/sig_stfl/xmss/external/xmss_core.c
index daaf6aa6e4..4d7e8de096 100644
--- a/src/sig_stfl/xmss/external/xmss_core.c
+++ b/src/sig_stfl/xmss/external/xmss_core.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0 AND MIT
 #include <stdlib.h>
 #include <string.h>
 #include <stdint.h>
diff --git a/src/sig_stfl/xmss/external/xmss_core.h b/src/sig_stfl/xmss/external/xmss_core.h
index bed99862c5..007c42172a 100644
--- a/src/sig_stfl/xmss/external/xmss_core.h
+++ b/src/sig_stfl/xmss/external/xmss_core.h
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0 AND MIT
 #ifndef XMSS_CORE_H
 #define XMSS_CORE_H
 
diff --git a/src/sig_stfl/xmss/external/xmss_core_fast.c b/src/sig_stfl/xmss/external/xmss_core_fast.c
index 70b4b9774e..71b0f471ca 100644
--- a/src/sig_stfl/xmss/external/xmss_core_fast.c
+++ b/src/sig_stfl/xmss/external/xmss_core_fast.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0 AND MIT
 #include <stdlib.h>
 #include <string.h>
 #include <stdint.h>