diff --git a/.env.example b/.env.example
index b1b79dd..a26cd7c 100644
--- a/.env.example
+++ b/.env.example
@@ -81,8 +81,8 @@ OPENAI_API_KEY=
 # Both services track `latest` unless you set these, so `docker compose pull && up -d` upgrades you.
 # Pinning makes an upgrade a decision instead of a side effect of pulling. The app reports its real
 # version either way — `latest` is a second name on the same image, not a build that forgot its number.
-#JARVIS_IMAGE_API=git.luxit.be/luxit/jarvis-api:0.59.0
-#JARVIS_IMAGE_WEB=git.luxit.be/luxit/jarvis-web:0.74.0
+#JARVIS_IMAGE_API=git.luxit.be/luxit/jarvis-api:0.59.1
+#JARVIS_IMAGE_WEB=git.luxit.be/luxit/jarvis-web:0.74.2
 # Only read when the agent overlay is enabled, just below. Its version is the AGENT's, and moves
 # independently of the two above — a Jarvis release usually does not change the agent at all.
 #JARVIS_IMAGE_AGENT=git.luxit.be/luxit/jarvis-agent-dist:0.20.0
@@ -107,3 +107,19 @@ OPENAI_API_KEY=
 
 #AGENT_HEARTBEAT_INTERVAL_SEC=30
 #RUN_SHUTDOWN_GRACE_SEC=25
+
+# ---------------------------------------------------------------------------
+# Licence (required to create anything)
+# ---------------------------------------------------------------------------
+
+# The key your provider gave you. REQUIRED to create anything new.
+#
+# Without it, an instance keeps running everything already set up and refuses to create new
+# organizations, users and agents — so an existing deployment does not stop working when this
+# reaches it, and a fresh install gets as far as its first administrator and then needs a key. An
+# unlicensed instance also contacts nobody at all. See the README for exactly what a licensed one
+# reports.
+#
+# This value SEEDS the database on first boot and does not govern it afterwards: a renewal arrives
+# through the check-in and is stored, so leaving an old key here cannot roll you back.
+#JARVIS_LICENSE_KEY=
diff --git a/README.md b/README.md
index 05517fd..69bb71b 100644
--- a/README.md
+++ b/README.md
@@ -131,6 +131,45 @@ docker compose exec -T postgres pg_dump -U jarvis jarvis | gzip > jarvis.sql.gz
 Plus `VAULT_MASTER_KEY`, stored somewhere that is not this host. A dump without the key is a database
 whose credentials cannot be read.
 
+## Licence keys, and what your instance reports
+
+**Jarvis needs a licence key.** Ask your provider for one and put it in `.env` as
+`JARVIS_LICENSE_KEY`. The key is a signed token your instance verifies **offline** — it carries your
+term and your limits, and it needs no network to be checked.
+
+Without one, an instance keeps running everything already set up — every organization, every user,
+every agent, and the assistant itself — and refuses to create anything NEW. So an existing
+deployment does not stop working when this reaches it, and a fresh install gets as far as its first
+administrator account and then needs a key.
+
+**An unlicensed instance contacts nobody.** No check-in, no telemetry, nothing leaves your network at
+all. The reporting below starts only once a key is in place.
+
+A licensed instance then reports to the address written into that key, by default once a day. This is
+everything it sends, in full:
+
+| Field                   | What it is                                        |
+| ----------------------- | ------------------------------------------------- |
+| Licence id              | Which licence this is                             |
+| Instance id + public key | A key pair your instance generated, identifying it |
+| Version                 | Which Jarvis build you are running                |
+| Counts                  | How many organizations, users, agents and assets  |
+| Public URL              | Your instance's address — **optional, see below** |
+| Timestamps              | When the process started, and when it reported    |
+
+**Counts, not contents.** No names, no email addresses, no conversation text, no asset inventory, no
+credentials, nothing about what you administer. The only field that identifies your network rather
+than measuring something is the public URL, and it can be switched off.
+
+The reply can carry a renewed key, which your instance adopts on its own — so a renewal reaches you
+without anybody re-pasting anything.
+
+**Your platform does not stop working because of a licence.** Expiry gives you a grace period, then
+refuses only the creation of new organizations, users and agents — everything already set up keeps
+running, and so does the assistant. There is no state in which Jarvis disables, deletes or locks you
+out of something you are already using. If the check-in cannot reach the server, nothing changes at
+all: the key you hold is what governs, and it is checked without a network.
+
 ## Licence
 
 The images are provided as-is with no warranty, no support and no commitment to future availability.
diff --git a/docker-compose.yml b/docker-compose.yml
index d19fa83..80a4a82 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -100,6 +100,10 @@ services:
       # log, in the session list and in the enrollment rate limit.
       TRUST_PROXY_HOPS: ${TRUST_PROXY_HOPS:-2}
 
+      # Required to create new organizations, users or agents. Without it an instance keeps running
+      # everything it already has, creates nothing new, and contacts nobody. See the README.
+      JARVIS_LICENSE_KEY: ${JARVIS_LICENSE_KEY:-}
+
       AGENT_HEARTBEAT_INTERVAL_SEC: ${AGENT_HEARTBEAT_INTERVAL_SEC:-30}
       RUN_SHUTDOWN_GRACE_SEC: ${RUN_SHUTDOWN_GRACE_SEC:-25}