diff --git a/app/appstate.py b/app/appstate.py
index 33fdd81..d627cb4 100644
--- a/app/appstate.py
+++ b/app/appstate.py
@@ -14,6 +14,7 @@ from typing import NamedTuple, Any
 from collections.abc import Sequence
 from pydantic import BaseModel
 from dataclasses import dataclass
+from packageurl import PackageURL
 
 from .appconfig import REPOSITORIES
 from .utils import vercmp, version_is_newer_than, extract_upstream_version, split_depends, \
@@ -600,6 +601,19 @@ class Source:
                     ext.append((ext_id, infos[realname]))
                     break
 
+        for purl_str in self.pkgextra.references.get("purl", []):
+            if purl_str is None:
+                continue
+            purl = PackageURL.from_string(purl_str)
+            if purl.type == "cargo":
+                ext.append((
+                    ExtId("cargo", "crates.io", True, True),
+                    ExtInfo(purl.name, None, 0, f"https://crates.io/crates/{quote(purl.name)}", {})))
+            elif purl.type == "gem":
+                ext.append((
+                    ExtId("gem", "RubyGems", True, True),
+                    ExtInfo(purl.name, None, 0, f"https://rubygems.org/gems/{quote(purl.name)}", {})))
+
         # XXX: let repology do the mapping for us
         repology_repo = "msys2_msys2" if self._package.repo == "msys" else "msys2_mingw"
         ext.append((
diff --git a/poetry.lock b/poetry.lock
index f542eb4..c9dee19 100644
--- a/poetry.lock
+++ b/poetry.lock
@@ -1,4 +1,4 @@
-# This file is automatically @generated by Poetry 2.1.0 and should not be changed by hand.
+# This file is automatically @generated by Poetry 2.1.1 and should not be changed by hand.
 
 [[package]]
 name = "aiolimiter"
@@ -786,6 +786,24 @@ files = [
     {file = "mypy_extensions-1.0.0.tar.gz", hash = "sha256:75dbf8955dc00442a438fc4d0666508a9a97b6bd41aa2f0ffe9d2f2725af0782"},
 ]
 
+[[package]]
+name = "packageurl-python"
+version = "0.16.0"
+description = "A purl aka. Package URL parser and builder"
+optional = false
+python-versions = ">=3.8"
+groups = ["main"]
+files = [
+    {file = "packageurl_python-0.16.0-py3-none-any.whl", hash = "sha256:5c3872638b177b0f1cf01c3673017b7b27ebee485693ae12a8bed70fa7fa7c35"},
+    {file = "packageurl_python-0.16.0.tar.gz", hash = "sha256:69e3bf8a3932fe9c2400f56aaeb9f86911ecee2f9398dbe1b58ec34340be365d"},
+]
+
+[package.extras]
+build = ["setuptools", "wheel"]
+lint = ["black", "isort", "mypy"]
+sqlalchemy = ["sqlalchemy (>=2.0.0)"]
+test = ["pytest"]
+
 [[package]]
 name = "packaging"
 version = "24.2"
@@ -1650,4 +1668,4 @@ cffi = ["cffi (>=1.11)"]
 [metadata]
 lock-version = "2.1"
 python-versions = "^3.10"
-content-hash = "61ccccbb7e5c53529ece0f2344696f8eb2a65e40217b6b8f5d303fad98820e2d"
+content-hash = "e1126be5f15426d67aa652315ba641392122b4f0a57f34d227e2217db7043383"
diff --git a/pyproject.toml b/pyproject.toml
index 8565d44..4c5b02e 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -19,6 +19,7 @@ pydantic = "^2.0.3"
 zstandard = "^0.23.0"
 MarkupSafe = "^3.0.2"
 uvicorn-worker = "^0.3.0"
+packageurl-python = "^0.16.0"
 
 [tool.poetry.group.dev.dependencies]
 reuse = "^5.0.2"