diff --git a/LICENSE.md b/LICENSE.md
index f532c21..4c7c54b 100644
--- a/LICENSE.md
+++ b/LICENSE.md
@@ -27,9 +27,21 @@ software. `LICENSE` names all of them; keep every line.
 
 The car app links EVHardware into its APK, so the **built app** may only be used and passed on
 non-commercially, whatever the MIT parts would allow on their own. The server, the Kubernetes
-manifests and the docs do not contain EVHardware and are plain MIT. EVHardware's own notes say
-that parts of it come from EVProfile, whose upstream licence situation it calls unresolved;
-that caveat is EVHardware's and stays with it.
+manifests and the docs do not contain EVHardware and are plain MIT.
+
+EVHardware's own notes say parts of it come from EVProfile, "itself a fork whose upstream
+licence situation is unresolved". Checked on 2026-10-18, that is settled for the code in
+question:
+
+- [malys/EVProfile](https://github.com/malys/EVProfile) is MIT. It is a fork of
+  [SliDeeN/MG4Control](https://github.com/SliDeeN/MG4Control), and its last merge from
+  MG4Control is a commit of 2026-08-02.
+- MG4Control is MIT up to and including 2.6.5 (released 2026-08-05; its licence file dates
+  from 2026-06-24) and GPL v3 or later from 2.6.6 (2026-09-02). Its `LICENCE.md` states that
+  the earlier versions stay MIT for good.
+
+So what EVProfile took from MG4Control dates from MG4Control's MIT period. This covers the
+lineage EVHardware names; it is not an audit of every line in EVHardware.
 
 ## No warranty
 
diff --git a/SPECS.md b/SPECS.md
index 583c106..832d46f 100644
--- a/SPECS.md
+++ b/SPECS.md
@@ -109,6 +109,10 @@ tyre pressures, GPS (lat, lon, elevation, heading) and the is_* flags. It does *
   INGEST_TOKEN) into git and pushed it. Commit amended and force-pushed; both values regenerated in
   the now gitignored `k8s/secrets.yaml` (since moved to `k8s/secrets/secrets.yaml`, outside
   `kubectl apply -f k8s/`). Filled-in secrets live only there from now on.
+- 2026-10-18 — EVProfile's licence checked: MIT, forked from SliDeeN/MG4Control and last merged
+  from it on 2026-08-02, inside MG4Control's MIT period (MIT up to 2.6.5 of 2026-08-05, GPL v3
+  from 2.6.6 of 2026-09-02). Recorded in `LICENSE.md`. History scanned for secrets before the
+  repository went public: none.
 - 2026-10-18 — Licence: Leon Kernan's `ABRP_Uploader` has been MIT since 2026-07-29 (its commit
   `75d8f2bc`), so the "unresolved" notes are gone. `LICENSE` names every copyright holder in the
   fork chain; `LICENSE.md` explains that `EVHardware/` is PolyForm Noncommercial, which makes the