diff --git a/.github/actions/build/action.yml b/.github/actions/build/action.yml
index 34e80c5..5d42efb 100644
--- a/.github/actions/build/action.yml
+++ b/.github/actions/build/action.yml
@@ -106,3 +106,10 @@ runs:
           echo "::error::built binary reported no version at all"
           exit 1
         fi
+
+        protocol="$($tmp/ormos --protocol-version)"
+        echo "protocol $protocol"
+        if [ "$protocol" != "4" ]; then
+          echo "::error::built binary advertises protocol '$protocol', expected the v4 release contract"
+          exit 1
+        fi
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d35942c..1998ebf 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -149,6 +149,9 @@ jobs:
           cat > dist/notes.md <<NOTES
           ormos $TAG
 
+          Advertised tunnel protocol: v4 (with backend compatibility for
+          released v0-v3 agents during the documented migration window).
+
           \`\`\`sh
           go install github.com/nicodes/ormos@$TAG
           \`\`\`
diff --git a/README.md b/README.md
index 10c0c6e..a676278 100644
--- a/README.md
+++ b/README.md
@@ -218,6 +218,7 @@ compatibility window; adding v4 does not itself change those versions' behavior.
 go test -race ./...
 go vet ./...
 go run . --version
+go run . --protocol-version
 ```
 
 The repository is intentionally limited to the public agent and shared
diff --git a/internal/system/run.go b/internal/system/run.go
index ec96007..79f50a3 100644
--- a/internal/system/run.go
+++ b/internal/system/run.go
@@ -50,10 +50,13 @@ import (
 	"os"
 	"os/signal"
 	"syscall"
+
+	"github.com/nicodes/ormos/relay"
 )
 
 // Main accepts `ormos`, `ormos --config PATH`, `ormos --help` and
-// `ormos --version`, and nothing else — no `-h` shorthand, no subcommands.
+// `ormos --version`, `ormos --protocol-version`, and nothing else — no `-h`
+// shorthand, no subcommands.
 // Parsed by hand rather than with the flag package, which would accept
 // single-dash spellings and add its own -h.
 //
@@ -69,6 +72,9 @@ func Main(args []string, version string) {
 	case len(args) == 1 && args[0] == "--version":
 		fmt.Println(version)
 		return
+	case len(args) == 1 && args[0] == "--protocol-version":
+		fmt.Println(relay.StreamFenceVersion)
+		return
 	case len(args) == 2 && args[0] == "--config" && args[1] != "":
 		configFileOverride = args[1]
 	case args[0] == "--config":
@@ -90,6 +96,7 @@ usage:
   ormos --config PATH      run with a different config file
   ormos --help             show this
   ormos --version          print the version
+  ormos --protocol-version print the advertised tunnel protocol version
 
 Just run ormos. If this machine isn't registered yet (or its credentials were
 revoked by forgetting it in the UI), it shows a short pairing code — approve it