diff --git a/docs/LICENSES.md b/docs/LICENSES.md
index 52ea1ca..8cea131 100644
--- a/docs/LICENSES.md
+++ b/docs/LICENSES.md
@@ -164,6 +164,40 @@ do not edit the dependency's own files. We do not and should not: if
 `serialport` ever needs a patch, vendor the change as a fork with its own
 notice, or wrap it, rather than editing files in place.
 
+**An HTTP client in `continuum-proxy`, and the version we could not take.**
+Added 2026-10-15 so a gateway can download a job file from a presigned URL.
+The choice is `reqwest` 0.12.28 with `default-features = false` and
+`rustls-tls-native-roots`, and the version matters:
+
+- **reqwest 0.13 is out.** Its `rustls` feature pulls
+  `rustls-platform-verifier` -> `webpki-root-certs` under
+  **CDLA-Permissive-2.0**, which is not in the table above, and
+  `cargo deny` rejects it outright (`error[rejected]: license is not
+  explicitly allowed`). CDLA-Permissive-2.0 is in fact a permissive licence
+  and could reasonably be added - but it is a *data* licence applied to a
+  certificate bundle, which is a different question from a code licence and
+  deserves a deliberate decision rather than being waved through to unblock
+  a dependency bump. Left out until someone wants it.
+- The other 0.13 route brings `aws-lc`, which contains OpenSSL-licensed C.
+  Also out.
+
+What 0.12 with that feature set brings, all verified from `cargo metadata`
+rather than from memory, and all permissive: `reqwest` 0.12.28, `hyper`
+1.12.0, `hyper-util` 0.1.21, `http-body` 1.1.0, `tower` 0.5.3,
+`tower-service` 0.3.3 (all MIT); `rustls` 0.23.46, `hyper-rustls` 0.27.10,
+`rustls-native-certs` 0.8.5 (`Apache-2.0 OR ISC OR MIT`); `rustls-webpki`
+0.103.15 and `untrusted` 0.9.0 (ISC); `ring` 0.17.14
+(**`Apache-2.0 AND ISC`** - note the AND: both apply, and both are fine);
+`sync_wrapper` 1.0.2 (Apache-2.0); `subtle` 2.6.1 (BSD-3-Clause);
+`zerocopy` 0.8.56 (`BSD-2-Clause OR Apache-2.0 OR MIT`); plus `http`,
+`httparse`, `base64`, `url`, `ipnet`, `rustls-pki-types` and `tokio-rustls`
+(`MIT OR Apache-2.0`).
+
+`openssl-probe` 0.2.1 appears and is only a certificate-path lookup, no C.
+Note that `openssl-sys` is still in the tree regardless, via the existing
+`native-tls` the Bambu MQTT and FTPS clients use - rustls here does not
+remove it.
+
 **New in `continuum-proxy` on 2026-10-15, all clear:** `zip` 9.0.3 (MIT),
 `flate2` 1.1.10, `crc32fast` 1.5.2, `typed-path` 0.12.3 (all
 `MIT OR Apache-2.0`), `miniz_oxide` 0.9.1 (`MIT OR Zlib OR Apache-2.0`),