diff --git a/docs/source/interface.rst b/docs/source/interface.rst
index 2c5e990616b1f30b4dd88e7ba3f05540fc8ac5fe..afb2cc7ad6f70123620e622c9394fd38acbf505c 100644
--- a/docs/source/interface.rst
+++ b/docs/source/interface.rst
@@ -7,6 +7,16 @@ Client
 When enabled in a Tahoe-LAFS client node,
 ZKAPAuthorizer publishes an HTTP-based interface inside the main Tahoe-LAFS web interface.
 
+``GET /storage-plugins/privatestorageio-zkapauthz-v1/version``
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This endpoint returns the version of the ZKAPAuthorizer Python package in use by the Tahoe-LAFS client node.
+
+The response is **OK** with an ``application/json`` **Content-Type**::
+
+  { "version": <string>
+  }
+
 ``PUT /storage-plugins/privatestorageio-zkapauthz-v1/voucher``
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
diff --git a/src/_zkapauthorizer/resource.py b/src/_zkapauthorizer/resource.py
index 961aea71b7f268e0c23924ded4504795ea136cca..6c4931ca2cd08d64856f21b43bbbf37b6b35765d 100644
--- a/src/_zkapauthorizer/resource.py
+++ b/src/_zkapauthorizer/resource.py
@@ -45,6 +45,10 @@ from twisted.web.resource import (
     Resource,
 )
 
+from . import (
+    __version__ as _zkapauthorizer_version,
+)
+
 from ._base64 import (
     urlsafe_b64decode,
 )
@@ -108,6 +112,10 @@ def from_configuration(node_config, store, redeemer=None):
             controller,
         ),
     )
+    root.putChild(
+        b"version",
+        _ProjectVersion(),
+    )
     return root
 
 
@@ -120,6 +128,17 @@ def application_json(request):
     request.responseHeaders.setRawHeaders(u"content-type", [u"application/json"])
 
 
+class _ProjectVersion(Resource):
+    """
+    This resource exposes the version of **ZKAPAuthorizer** itself.
+    """
+    def render_GET(self, request):
+        application_json(request)
+        return dumps({
+            "version": _zkapauthorizer_version,
+        })
+
+
 class _UnblindedTokenCollection(Resource):
     """
     This class implements inspection of unblinded tokens.  Users **GET** this
diff --git a/src/_zkapauthorizer/tests/test_client_resource.py b/src/_zkapauthorizer/tests/test_client_resource.py
index aef17914a1fa31a84a0b543581ef35d9ab3d4223..8a24a2c84df5b8225b0772540801bd1f5a1c59cd 100644
--- a/src/_zkapauthorizer/tests/test_client_resource.py
+++ b/src/_zkapauthorizer/tests/test_client_resource.py
@@ -116,6 +116,10 @@ from treq.testing import (
     RequestTraversalAgent,
 )
 
+from .. import (
+    __version__ as zkapauthorizer_version,
+)
+
 from ..model import (
     Voucher,
     Redeeming,
@@ -265,6 +269,27 @@ class ResourceTests(TestCase):
             Provides([IResource]),
         )
 
+    @given(tahoe_configs())
+    def test_version(self, get_config):
+        """
+        The ZKAPAuthorizer package version is available in a JSON response to a
+        **GET** to ``/version``.
+        """
+        tempdir = self.useFixture(TempDir())
+        config = get_config(tempdir.join(b"tahoe"), b"tub.port")
+        root = root_from_config(config, datetime.now)
+        agent = RequestTraversalAgent(root)
+        requesting = agent.request(
+            b"GET",
+            b"http://127.0.0.1/version",
+        )
+        requesting.addCallback(readBody)
+        requesting.addCallback(loads)
+        self.assertThat(
+            requesting,
+            succeeded(Equals({"version": zkapauthorizer_version})),
+        )
+
 
 class UnblindedTokenTests(TestCase):
     """