diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
index 7b117a5d..21385345 100644
--- a/THIRD_PARTY_NOTICES.md
+++ b/THIRD_PARTY_NOTICES.md
@@ -48,6 +48,7 @@ These are copied into the source tree (see the path) rather than fetched.
 | [LZ4](https://github.com/lz4/lz4) | `compression/lz4/` | Yann Collet | BSD-2-Clause | [lz4.txt](licenses/lz4.txt) |
 | [HLS arbitrary-precision types](https://github.com/Xilinx/HLS_arbitrary_Precision_Types) | `fpga/include/` | Xilinx, Inc. | Apache-2.0 | [xilinx-hls-headers.txt](licenses/xilinx-hls-headers.txt) |
 | [GEMMI](https://github.com/project-gemmi/gemmi) | `gemmi_gph/` | Global Phasing Ltd. | MPL-2.0 | [gemmi.txt](licenses/gemmi.txt) |
+| [traccc (ACTS)](https://github.com/acts-project/traccc) | `image_analysis/spot_finding/StrongPixelSet.cpp`, `SpotExtractorGPU.cu` | CERN, for the benefit of the ACTS project | MPL-2.0 | [traccc.txt](licenses/traccc.txt) |
 | [xbflash.qspi](https://github.com/Xilinx/XRT) | `tools/xbflash.qspi/` | Xilinx / AMD | Apache-2.0 | [xbflash-qspi.txt](licenses/xbflash-qspi.txt) |
 | [wingetopt](https://github.com/alex85k/wingetopt) | `tools/wingetopt/` | Todd C. Miller; The NetBSD Foundation | ISC AND BSD-2-Clause | [wingetopt.txt](licenses/wingetopt.txt) |
 
@@ -74,9 +75,14 @@ served frontend, so the shipped web UI carries its own attribution.
 
 ## Notes on weak-copyleft and attribution-sensitive components
 
-* **MPL-2.0** (Eigen, GEMMI, libzmq): file-level copyleft. GEMMI is vendored in `gemmi_gph/` in
-  trimmed form; libzmq is fetched at build time; Eigen is provided externally (header-only). The
+* **MPL-2.0** (Eigen, GEMMI, libzmq, traccc): file-level copyleft. GEMMI is vendored in `gemmi_gph/`
+  in trimmed form; libzmq is fetched at build time; Eigen is provided externally (header-only). The
   corresponding source is available from each project upstream.
+* **traccc** is the one entry that is not a vendored directory. Its sparse connected-component
+  labelling enters two otherwise first-party files: `StrongPixelSet.cpp` adapts the SparseCCL source,
+  and `SpotExtractorGPU.cu` follows the design of its GPU counterpart. MPL-2.0 is file-level, so both
+  files name the origin at the top and are covered by `licenses/traccc.txt`. See
+  [ACKNOWLEDGEMENT.md](docs/ACKNOWLEDGEMENT.md) for the citation.
 * **FFTW** is GPL-2.0-or-later — compatible with, and absorbed by, this project's GPL-3.0 license.
 * **Apache-2.0** components: where upstream ships a `NOTICE` file, it is reproduced in the
   corresponding `licenses/` text.
diff --git a/update_version.sh b/update_version.sh
index 36138dff..cd7002ac 100755
--- a/update_version.sh
+++ b/update_version.sh
@@ -82,6 +82,7 @@ REPOBASE=https://gitea.psi.ch/mx/jungfraujoch/src/branch/main
   sed -e "s,](licenses/,]($REPOBASE/licenses/,g" \
       -e "s,](LICENSE)),](LICENSE.md)),g" \
       -e "s,](fpga/LICENSE),](FPGA_LICENSE.md),g" \
+      -e "s,](docs/ACKNOWLEDGEMENT.md),](ACKNOWLEDGEMENT.md),g" \
       THIRD_PARTY_NOTICES.md
 } > docs/THIRD_PARTY_NOTICES.md