diff --git a/.github/workflows/client-integration.yml b/.github/workflows/client-integration.yml
index 2fb99c56f9e..562c6cf3d2b 100644
--- a/.github/workflows/client-integration.yml
+++ b/.github/workflows/client-integration.yml
@@ -32,6 +32,8 @@ on:
       - 'fluss-server/**'
       - 'fluss-common/**'
       - 'fluss-dist/**'
+      - 'LICENSE-bin'
+      - 'NOTICE-bin'
       - 'docker/fluss/**'
       - 'fluss-rust/crates/**'
       - 'fluss-rust/bindings/**'
@@ -47,6 +49,8 @@ on:
       - 'fluss-server/**'
       - 'fluss-common/**'
       - 'fluss-dist/**'
+      - 'LICENSE-bin'
+      - 'NOTICE-bin'
       - 'docker/fluss/**'
       - 'fluss-rust/crates/**'
       - 'fluss-rust/bindings/**'
@@ -90,7 +94,7 @@ jobs:
           # a change to this workflow itself should exercise every suite
           has '^\.github/workflows/client-integration\.yml' && all=true || true
           protocol=false; core=false; py=false; cpp=false; ex=false; gateway=false
-          has '^(fluss-rpc/src/main/proto/|fluss-server/|fluss-common/|fluss-dist/|docker/fluss/)' && protocol=true || true
+          has '^(fluss-rpc/src/main/proto/|fluss-server/|fluss-common/|fluss-dist/|LICENSE-bin$|NOTICE-bin$|docker/fluss/)' && protocol=true || true
           has '^(fluss-rust/crates/|fluss-rust/Cargo\.)' && core=true || true
           has '^fluss-rust/bindings/python/' && py=true || true
           has '^fluss-rust/bindings/cpp/' && cpp=true || true
@@ -121,7 +125,7 @@ jobs:
         uses: actions/cache@v4
         with:
           path: /tmp/fluss-dev.tar
-          key: fluss-dev-image-${{ hashFiles('fluss-server/**', 'fluss-common/**', 'fluss-rpc/**', 'fluss-dist/**', 'docker/fluss/**', 'pom.xml') }}
+          key: fluss-dev-image-${{ hashFiles('fluss-server/**', 'fluss-common/**', 'fluss-rpc/**', 'fluss-dist/**', 'LICENSE-bin', 'NOTICE-bin', 'docker/fluss/**', 'pom.xml') }}
 
       - name: Set up JDK 17
         if: steps.image-cache.outputs.cache-hit != 'true'
@@ -135,10 +139,14 @@ jobs:
         if: steps.image-cache.outputs.cache-hit != 'true'
         run: |
           ./mvnw -B --no-transfer-progress clean package -pl fluss-dist -am -DskipTests
+          cmp LICENSE-bin build-target/LICENSE
+          cmp NOTICE-bin build-target/NOTICE
           rm -rf docker/fluss/build-target
           mkdir -p docker/fluss/build-target
           cp -r build-target/* docker/fluss/build-target/
           docker build -t fluss:dev docker/fluss
+          docker run --rm --network none --read-only --entrypoint /bin/sh fluss:dev \
+            -c 'test -s /opt/fluss/LICENSE && test -s /opt/fluss/NOTICE'
           docker save fluss:dev -o /tmp/fluss-dev.tar
 
       - name: Upload server image
diff --git a/fluss-dist/src/main/assemblies/bin.xml b/fluss-dist/src/main/assemblies/bin.xml
index 3c1d879f086..aac59ac89e6 100644
--- a/fluss-dist/src/main/assemblies/bin.xml
+++ b/fluss-dist/src/main/assemblies/bin.xml
@@ -48,6 +48,21 @@
 
 
     <files>
+        <!-- copy binary distribution legal files -->
+        <file>
+            <source>${project.basedir}/../LICENSE-bin</source>
+            <outputDirectory>/</outputDirectory>
+            <destName>LICENSE</destName>
+            <fileMode>0644</fileMode>
+        </file>
+
+        <file>
+            <source>${project.basedir}/../NOTICE-bin</source>
+            <outputDirectory>/</outputDirectory>
+            <destName>NOTICE</destName>
+            <fileMode>0644</fileMode>
+        </file>
+
         <!-- copy fluss-server fat jar -->
         <file>
             <source>../fluss-server/target/fluss-server-${project.version}.jar</source>
@@ -91,4 +106,4 @@
         </fileSet>
     </fileSets>
 
-</assembly>
\ No newline at end of file
+</assembly>
diff --git a/tools/releasing/create_binary_release.sh b/tools/releasing/create_binary_release.sh
index 86b86313a60..8c367d7cade 100755
--- a/tools/releasing/create_binary_release.sh
+++ b/tools/releasing/create_binary_release.sh
@@ -70,9 +70,6 @@ make_binary_release() {
   $MVN clean package -Prelease -am -Dgpg.skip -Dcheckstyle.skip=true -DskipTests
 
   cd fluss-dist/target/fluss-${RELEASE_VERSION}-bin
-  cp ${FLUSS_DIR}/LICENSE-bin ./fluss-${RELEASE_VERSION}/LICENSE
-  cp ${FLUSS_DIR}/NOTICE-bin ./fluss-${RELEASE_VERSION}/NOTICE
-
   tar $TAR_OPTIONS -czf "${dir_name}.tgz" fluss-*
 
   cp fluss-*.tgz ${RELEASE_DIR}
diff --git a/website/community/how-to-release/creating-a-fluss-release.mdx b/website/community/how-to-release/creating-a-fluss-release.mdx
index 3e6f1d0976d..640496ae80d 100644
--- a/website/community/how-to-release/creating-a-fluss-release.mdx
+++ b/website/community/how-to-release/creating-a-fluss-release.mdx
@@ -517,17 +517,24 @@ If you can't login Docker ID in your region because of network issues, you can f
 
 Next, we need to build and push Docker images for the release candidates. This will enable users to easily test the new functionality using the Quickstart guide in the [Fluss documentation](https://fluss.apache.org/docs/quickstart/flink/) improving accessibility and feedback during the release validation phase.
 
-On the image-build machine, export the recorded `RELEASE_COMMIT` and verify
-that the Dockerfiles and preparation scripts are from that RC. From the
-repository root, check:
+On the image-build machine, export the recorded `RELEASE_COMMIT`. From the
+repository root, verify that the checkout is clean, the Docker inputs come from
+that RC, and the generated legal files match the binary distribution:
 
 ```bash
 test "$(git rev-parse HEAD)" = "${RELEASE_COMMIT:?Set the recorded RC commit}" &&
 git diff --quiet &&
-git diff --cached --quiet
+git diff --cached --quiet &&
+cmp LICENSE-bin build-target/LICENSE &&
+cmp NOTICE-bin build-target/NOTICE &&
+echo "Fluss Docker inputs verified"
+Fluss Docker inputs verified
 ```
 
-Then run the following commands to build and push the fluss Docker image.
+All checks are silent on success, so the message above is the only expected
+output. If any check fails, stop and verify that the image-build machine has
+checked out the intended release branch at the recorded `RELEASE_COMMIT`, then
+run the checks again.
 
 ```bash
 $ rm -rf docker/fluss/build-target/