diff --git a/.changeset/fiery-cats-learn.md b/.changeset/fiery-cats-learn.md
new file mode 100644
index 0000000..b014ae5
--- /dev/null
+++ b/.changeset/fiery-cats-learn.md
@@ -0,0 +1,6 @@
+---
+"@smoothtml/vite-plugin-sri": patch
+---
+
+Add THIRD-PARTY-NOTICES.txt to the published package, carrying the MIT license
+and copyright for the bundled Vite-derived code.
diff --git a/NOTICE b/NOTICE
index 36d33ae..2997f9e 100644
--- a/NOTICE
+++ b/NOTICE
@@ -3,7 +3,3 @@ Copyright 2026 Rishvic Pushpakaran.
 
 This product includes software developed by
 Rishvic Pushpakaran <rishvic@gmail.com>.
-
-Portions derived from Vite (https://github.com/vitejs/vite),
-copyright (c) 2019-present, VoidZero Inc. and Vite contributors,
-licensed under MIT. See SPDX headers in the affected files.
diff --git a/README.md b/README.md
index 70aa45d..fe2856e 100644
--- a/README.md
+++ b/README.md
@@ -48,8 +48,8 @@ This plugin includes code adapted from [Vite](https://github.com/vitejs/vite) (
 2019-present, VoidZero Inc. and Vite contributors, MIT-licensed). Specifically,
 `src/html.ts` and `src/utils.ts` are derived from
 `packages/vite/src/node/plugins/html.ts` and `packages/vite/src/node/utils.ts`
-respectively. See the SPDX headers in those files and [`NOTICE`](./NOTICE) for
-details.
+respectively. See the SPDX headers in those files and
+[`THIRD-PARTY-NOTICES.txt`](./THIRD-PARTY-NOTICES.txt) for details.
 
 ## License
 
diff --git a/THIRD-PARTY-NOTICES.txt b/THIRD-PARTY-NOTICES.txt
new file mode 100644
index 0000000..39a5a82
--- /dev/null
+++ b/THIRD-PARTY-NOTICES.txt
@@ -0,0 +1,29 @@
+@smoothtml/vite-plugin-sri bundles code derived from Vite
+(https://github.com/vitejs/vite), specifically portions of
+packages/vite/src/node/plugins/html.ts and packages/vite/src/node/utils.ts,
+which are compiled into the published dist/ output. That code is licensed under
+the MIT License, reproduced below.
+
+------------------------------------------------------------------------
+
+MIT License
+
+Copyright (c) 2019-present, VoidZero Inc. and Vite contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/THIRD-PARTY-NOTICES.txt.license b/THIRD-PARTY-NOTICES.txt.license
new file mode 100644
index 0000000..ef841b3
--- /dev/null
+++ b/THIRD-PARTY-NOTICES.txt.license
@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2019-present, VoidZero Inc. and Vite contributors
+
+SPDX-License-Identifier: MIT
diff --git a/package.json b/package.json
index eaadbfc..d929694 100644
--- a/package.json
+++ b/package.json
@@ -36,7 +36,10 @@
     "./package.json": "./package.json"
   },
   "files": [
-    "dist"
+    "dist",
+    "NOTICE",
+    "CHANGELOG.md",
+    "THIRD-PARTY-NOTICES.txt"
   ],
   "sideEffects": false,
   "scripts": {
diff --git a/tsdown.config.ts b/tsdown.config.ts
index 80bd2ec..5bc0839 100644
--- a/tsdown.config.ts
+++ b/tsdown.config.ts
@@ -4,6 +4,8 @@
 
 import { defineConfig } from "tsdown";
 
+// Deps are externalized, not bundled. If you bundle one into dist/, add its
+// attribution to THIRD-PARTY-NOTICES.txt - nothing else enforces this.
 export default defineConfig({
   entry: "src/index.ts",
   format: ["esm", "cjs"],