diff --git a/docs/LICENSES.md b/docs/LICENSES.md
index bb2ed51..52ea1ca 100644
--- a/docs/LICENSES.md
+++ b/docs/LICENSES.md
@@ -141,6 +141,39 @@ A `node_modules` walk turns up packages named `baz`, `browser_field`,
 field. These are test fixtures *inside* other packages, not dependencies.
 Ignore them.
 
+## Audit, 2026-10-15 - continuum-proxy dual-licence elections
+
+Found while adding a zip reader to `continuum-proxy` (see below). All three
+were already in the tree, all three pass `cargo deny check licenses`, and
+none had its election recorded - which rule one at the top of this document
+says to do, so that a `grep` for "GPL" does not restart the argument.
+Verified from `cargo metadata`, not from memory.
+
+**`unescaper` 0.1.10 - `MIT OR GPL-3.0-only`, we elect MIT.** Reached via
+`tokio-serial` -> `serialport` -> `unescaper`, so it is in the Linux build.
+The MIT half is ours to take.
+
+**`r-efi` 6.0.0 - `MIT OR Apache-2.0 OR LGPL-2.1-or-later`, we elect MIT or
+Apache-2.0.** Reached via `native-tls` -> `tempfile` -> `getrandom`, but only
+on UEFI targets: it is not compiled for any platform we ship. The LGPL option
+would be the problem one if it ever were, and electing around it is free.
+
+**`serialport` 4.10.0 - MPL-2.0, allowed with a condition.** The table above
+permits MPL-2.0 because its copyleft is per-file, which holds only while we
+do not edit the dependency's own files. We do not and should not: if
+`serialport` ever needs a patch, vendor the change as a fork with its own
+notice, or wrap it, rather than editing files in place.
+
+**New in `continuum-proxy` on 2026-10-15, all clear:** `zip` 9.0.3 (MIT),
+`flate2` 1.1.10, `crc32fast` 1.5.2, `typed-path` 0.12.3 (all
+`MIT OR Apache-2.0`), `miniz_oxide` 0.9.1 (`MIT OR Zlib OR Apache-2.0`),
+`adler2` 2.0.1 (`0BSD OR MIT OR Apache-2.0`), `simd-adler32` 0.3.10 (MIT),
+`zlib-rs` 0.6.8 (Zlib). Added for reading `.3mf` project archives. The
+feature set is deliberately `deflate-flate2` only - `zip`'s other codec
+features pull in bzip2, lzma/xz and zstd bindings, none of which are needed
+and each of which is another licence to check. Confirmed none of them entered
+the graph.
+
 ## When adding a dependency
 
 1. Check the licence against the table above **before** writing code against