diff --git a/shared/models/instance.go b/shared/models/instance.go
index 1bb140b..9f4c244 100644
--- a/shared/models/instance.go
+++ b/shared/models/instance.go
@@ -20,4 +20,15 @@ type Instance struct {
 	Name       string        `bson:"name" json:"name"`
 	Slug       string        `bson:"slug" json:"slug"`
 	CreatedAt  time.Time     `bson:"created_at" json:"created_at"`
+
+	// LicenseBlob is the authoritative licence. LicenseTier and LicenseExpiry
+	// are a denormalised cache for listing and for the admin service's queries,
+	// rewritten from the verified payload every time a blob is accepted.
+	// Nothing reads them for enforcement.
+	//
+	// The blob is json:"-" because there is no reason to spray it through API
+	// responses. It is signed public data, not a secret.
+	LicenseBlob   string     `bson:"license_blob,omitempty" json:"-"`
+	LicenseTier   string     `bson:"license_tier,omitempty" json:"license_tier,omitempty"`
+	LicenseExpiry *time.Time `bson:"license_expiry,omitempty" json:"license_expiry,omitempty"`
 }