Index: README.md
===================================================================
--- README.md	(revision d9c5eb825f0e52ae97cc1f60c9486b42d53b3795)
+++ README.md	(revision f3663e54e12e5e49fff3f2385b88d5e65dc1e707)
@@ -199,2 +199,9 @@
 users of that service. Made by robo.burr (Robin Genis) ·
 <https://klonkt.com>
+
+## Acknowledgements
+
+Klonkt stands on a lot of open-source work — Node.js, FFmpeg, SQLite, libwebp, resvg, htmx, EJS and
+more, plus the Fraunces, Plus Jakarta Sans and Literata fonts. See
+[THIRD-PARTY-NOTICES.md](THIRD-PARTY-NOTICES.md) for the full list and their licences. Thank you to
+everyone who made them.
Index: THIRD-PARTY-NOTICES.md
===================================================================
--- THIRD-PARTY-NOTICES.md	(revision f3663e54e12e5e49fff3f2385b88d5e65dc1e707)
+++ THIRD-PARTY-NOTICES.md	(revision f3663e54e12e5e49fff3f2385b88d5e65dc1e707)
@@ -0,0 +1,47 @@
+# Third-Party Notices
+
+Klonkt is licensed under **AGPL-3.0-or-later** (see [LICENSE](LICENSE)). It is built on the
+open-source software listed below, with gratitude. Each dependency's own licence text is retained in
+`node_modules/<package>/` after `npm install`; this file is a summary and acknowledgement.
+
+## Runtime dependencies (npm)
+
+| Package(s) | Licence |
+|---|---|
+| express · express-session · body-parser · multer · express-rate-limit · helmet · bcryptjs · better-sqlite3 · marked · sanitize-html · uuid · fluent-ffmpeg | MIT |
+| nodemailer | MIT-0 |
+| dotenv | BSD-2-Clause |
+| htmx.org | 0BSD |
+| ejs | Apache-2.0 |
+| @resvg/resvg-js | MPL-2.0 |
+| node-webpmux | LGPL-3.0-or-later |
+| ffmpeg-static | GPL-3.0-or-later |
+
+## Bundled binaries & native libraries
+
+These packages ship pre-built native components, redistributed under their own licences:
+
+- **FFmpeg** — bundled via [`ffmpeg-static`](https://github.com/eugeneware/ffmpeg-static), licensed
+  **GPL-3.0-or-later**. Source: <https://ffmpeg.org/>. Used to transcode audio and build the
+  looping video covers.
+- **libwebp** — bundled via [`node-webpmux`](https://github.com/ApeironTsuka/node-webpmux)
+  (LGPL-3.0-or-later); libwebp itself is BSD-3-Clause (© Google Inc.). Used to decode animated WebP
+  covers.
+- **resvg** — bundled via [`@resvg/resvg-js`](https://github.com/yisibl/resvg-js) (MPL-2.0). Used to
+  render the Open Graph preview cards.
+- **SQLite** — bundled via [`better-sqlite3`](https://github.com/WiseLibs/better-sqlite3) (MIT);
+  SQLite itself is public domain. The database engine.
+
+## Fonts
+
+Bundled in `src/assets/fonts/`, all under the **SIL Open Font License 1.1** (full text in
+`src/assets/fonts/OFL.txt`):
+
+- **Fraunces** — © The Fraunces Project Authors (<https://github.com/undercasetype/Fraunces>).
+- **Plus Jakarta Sans** — © The Plus Jakarta Sans Project Authors
+  (<https://github.com/tokotype/PlusJakartaSans>).
+- **Literata** — © The Literata Project Authors.
+
+---
+
+If you redistribute Klonkt, please keep this file and the bundled licence texts intact.