diff --git a/.github/workflows/validate-packaging.yml b/.github/workflows/validate-packaging.yml
new file mode 100644
index 00000000..f2e1d885
--- /dev/null
+++ b/.github/workflows/validate-packaging.yml
@@ -0,0 +1,51 @@
+name: Validate packaging metadata
+
+on:
+  pull_request:
+  push:
+
+jobs:
+  metadata:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.10'
+
+      - name: Install build
+        run: |
+          python -m pip install --upgrade pip
+          pip install build
+
+      - name: Build distributions
+        run: python -m build
+
+      - name: Dump METADATA
+        run: |
+          echo '--- METADATA ---'
+          unzip -p dist/*.whl '*/METADATA' > METADATA || unzip -p dist/*.whl '*-info/METADATA' > METADATA
+          cat METADATA
+
+      - name: Validate license
+        run: |
+          EXPECTED_LICENSE='Apache-2.0'
+          if grep -q "^License: ${EXPECTED_LICENSE}$" METADATA; then
+            echo "License matches: ${EXPECTED_LICENSE}"
+          elif grep -q "^Classifier: License :: OSI Approved :: Apache Software License$" METADATA; then
+            echo "License classifier present"
+          else
+            echo "ERROR: license metadata does not match ${EXPECTED_LICENSE}"; exit 1
+          fi
+
+      - name: Validate Requires-Python
+        run: |
+          EXPECTED_PY='>=3.8'
+          if grep -q "^Requires-Python: ${EXPECTED_PY}$" METADATA; then
+            echo "Requires-Python matches: ${EXPECTED_PY}"
+          else
+            echo "ERROR: Requires-Python missing or not ${EXPECTED_PY}"; exit 1
+          fi
diff --git a/README.md b/README.md
index 6be7b2af..58a2e9a2 100644
--- a/README.md
+++ b/README.md
@@ -8,3 +8,11 @@ For a detailed description and installation instructions, please check out this
 https://github.com/HSF/harvester/wiki
 
 ----------
+
+Packaging note
+--------------
+
+This project uses `pyproject.toml` (Hatch/hatchling) as the canonical source of packaging
+metadata (license, build-backend, dependencies). Keep `pyproject.toml` in sync when making
+packaging changes; `setup.py` is maintained for legacy compatibility and should mirror
+the same license and supported Python versions.
diff --git a/pyproject.toml b/pyproject.toml
index 21068cfe..214325ef 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -14,6 +14,20 @@ authors = [
     { name = "PanDA Team", email = "panda-support@cern.ch" },
 ]
 
+# Declared Python requirement and PyPI classifiers for explicit metadata
+requires-python = ">=3.8"
+classifiers = [
+    "Development Status :: 5 - Production/Stable",
+    "License :: OSI Approved :: Apache Software License",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3 :: Only",
+    "Programming Language :: Python :: 3.8",
+    "Programming Language :: Python :: 3.9",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Operating System :: OS Independent",
+]
+
 dependencies = [
     'requests',
     'python-daemon',
diff --git a/setup.py b/setup.py
index a2753bc7..fec8567f 100644
--- a/setup.py
+++ b/setup.py
@@ -19,11 +19,15 @@
     version=release_version,
     description="Harvester Package",
     long_description="""This package contains Harvester components""",
-    license="GPL",
+    # Packaging metadata is canonicalised in pyproject.toml (PEP 621/517).
+    # Keep this file compatible with that metadata.
+    license="Apache-2.0",
     author="Panda Team",
     author_email="atlas-adc-panda@cern.ch",
     url="https://github.com/PanDAWMS/panda-harvester/wiki",
-    python_requires=">=2.7",
+    # The project is maintained for modern Python; declare supported versions here
+    # and keep in sync with `pyproject.toml` (preferred source of truth).
+    python_requires=">=3.8",
     packages=find_packages(),
     install_requires=[
         "requests",