diff --git a/.changeset/ship-legal-files.md b/.changeset/ship-legal-files.md
new file mode 100644
index 000000000..ba428b993
--- /dev/null
+++ b/.changeset/ship-legal-files.md
@@ -0,0 +1,9 @@
+---
+"@asyncapi/parser": patch
+"@asyncapi/multi-parser": patch
+"@asyncapi/openapi-schema-parser": patch
+---
+
+Ship the Apache-2.0 `LICENSE` and the `NOTICE` file inside the published tarballs, and add the repository
+README to the two packages that had none. `LICENSE` and `README.md` were already listed in each package's
+`files` array, but those entries resolve inside `packages/<pkg>/`, where neither file exists.
diff --git a/packages/multi-parser/.gitignore b/packages/multi-parser/.gitignore
index 943fd793b..a39117d6f 100644
--- a/packages/multi-parser/.gitignore
+++ b/packages/multi-parser/.gitignore
@@ -8,3 +8,8 @@ node_modules
 /cjs
 /browser
 *.tgz
+
+# copied from the repo root by prepublishOnly (scripts/copy-legal.js)
+LICENSE
+NOTICE
+README.md
diff --git a/packages/multi-parser/package.json b/packages/multi-parser/package.json
index 5f9a15524..85f65ce69 100644
--- a/packages/multi-parser/package.json
+++ b/packages/multi-parser/package.json
@@ -23,6 +23,7 @@
     "/esm",
     "/cjs",
     "LICENSE",
+    "NOTICE",
     "README.md"
   ],
   "scripts": {
@@ -36,7 +37,8 @@
     "generate:readme:toc": "markdown-toc -i \"../../README.md\"",
     "generate:assets": "npm run generate:readme:toc",
     "bump:version": "npm --no-git-tag-version --allow-same-version version $VERSION",
-    "prepublishOnly": "npm run generate:assets"
+    "copy:legal": "node ../../scripts/copy-legal.js",
+    "prepublishOnly": "npm run copy:legal && npm run generate:assets"
   },
   "dependencies": {
     "@asyncapi/avro-schema-parser": "^3.0.3",
diff --git a/packages/openapi-schema-parser/.gitignore b/packages/openapi-schema-parser/.gitignore
index 666dee4ba..28a4681ca 100644
--- a/packages/openapi-schema-parser/.gitignore
+++ b/packages/openapi-schema-parser/.gitignore
@@ -6,3 +6,7 @@ node_modules
 /lib
 /esm
 /cjs
+
+# copied from the repo root by prepublishOnly (scripts/copy-legal.js)
+LICENSE
+NOTICE
diff --git a/packages/openapi-schema-parser/package.json b/packages/openapi-schema-parser/package.json
index f94d767b5..9d2fc4d22 100644
--- a/packages/openapi-schema-parser/package.json
+++ b/packages/openapi-schema-parser/package.json
@@ -34,6 +34,7 @@
     "/esm",
     "/cjs",
     "LICENSE",
+    "NOTICE",
     "README.md"
   ],
   "scripts": {
@@ -47,7 +48,8 @@
     "generate:readme:toc": "markdown-toc -i \"README.md\"",
     "generate:assets": "npm run build && npm run generate:readme:toc",
     "bump:version": "npm --no-git-tag-version --allow-same-version version $VERSION",
-    "prepublishOnly": "npm run generate:assets"
+    "copy:legal": "node ../../scripts/copy-legal.js",
+    "prepublishOnly": "npm run copy:legal && npm run generate:assets"
   },
   "dependencies": {
     "@openapi-contrib/openapi-schema-to-json-schema": "~3.2.0",
diff --git a/packages/parser/.gitignore b/packages/parser/.gitignore
index 70f71a941..df85cfa8e 100644
--- a/packages/parser/.gitignore
+++ b/packages/parser/.gitignore
@@ -9,3 +9,8 @@ node_modules
 /browser
 *.tgz
 .turbo
+
+# copied from the repo root by prepublishOnly (scripts/copy-legal.js)
+LICENSE
+NOTICE
+README.md
diff --git a/packages/parser/package.json b/packages/parser/package.json
index 5957fa1c5..e1459afb1 100644
--- a/packages/parser/package.json
+++ b/packages/parser/package.json
@@ -24,6 +24,7 @@
     "/cjs",
     "/browser",
     "LICENSE",
+    "NOTICE",
     "README.md"
   ],
   "scripts": {
@@ -40,7 +41,8 @@
     "generate:readme:toc": "markdown-toc -i \"../../README.md\"",
     "generate:assets": "npm run generate:readme:toc",
     "bump:version": "npm --no-git-tag-version --allow-same-version version $VERSION",
-    "prepublishOnly": "npm run generate:assets"
+    "copy:legal": "node ../../scripts/copy-legal.js",
+    "prepublishOnly": "npm run copy:legal && npm run generate:assets"
   },
   "dependencies": {
     "@asyncapi/specs": "^6.11.1",
diff --git a/scripts/copy-legal.js b/scripts/copy-legal.js
new file mode 100644
index 000000000..3e0548740
--- /dev/null
+++ b/scripts/copy-legal.js
@@ -0,0 +1,18 @@
+// Copy the monorepo-root legal and readme files into the package being published.
+// npm only packs files that exist inside the package directory, so without this the published tarballs
+// contain no LICENSE and no NOTICE - see the "files" array in each packages/*/package.json.
+const fs = require('fs');
+const path = require('path');
+
+const root = path.join(__dirname, '..');
+const pkg = process.cwd();
+
+for (const name of ['LICENSE', 'NOTICE']) {
+  fs.copyFileSync(path.join(root, name), path.join(pkg, name));
+}
+
+// Only fall back to the monorepo README for packages that do not ship one of their own;
+// @asyncapi/openapi-schema-parser has its own and it must not be overwritten.
+if (!fs.existsSync(path.join(pkg, 'README.md'))) {
+  fs.copyFileSync(path.join(root, 'README.md'), path.join(pkg, 'README.md'));
+}