diff --git a/main.go b/main.go
index 9bb9e44..8903b7f 100644
--- a/main.go
+++ b/main.go
@@ -238,7 +238,8 @@ func runOlmMainWithArgs(ctx context.Context, cancel context.CancelFunc, signalCt
 		SocketPath:   config.SocketPath,
 		Version:      config.Version,
 		Agent:        "Olm CLI",
-		OnExit:       cancel, // Pass cancel function directly to trigger shutdown
+		OlmVersion:   config.Version, // the standalone binary is olm itself
+		OnExit:       cancel,         // Pass cancel function directly to trigger shutdown
 		OnTerminated: cancel,
 		PprofAddr:    ":4444", // TODO: REMOVE OR MAKE CONFIGURABLE
 		// Re-invoke this binary in watchdog mode to clean up DNS if we die.
diff --git a/olm/olm.go b/olm/olm.go
index 2c1cf00..38245a4 100644
--- a/olm/olm.go
+++ b/olm/olm.go
@@ -288,6 +288,8 @@ func Init(ctx context.Context, config OlmConfig) (*Olm, error) {
 	apiServer.SetVersion(config.Version)
 	apiServer.SetAgent(config.Agent)
 
+	config.OlmVersion = resolveOlmVersion(config)
+
 	newOlm := &Olm{
 		logFile:                logFile,
 		olmCtx:                 ctx,
@@ -727,16 +729,17 @@ func (o *Olm) StartTunnel(config TunnelConfig) {
 		publicKey := o.privateKey.PublicKey()
 		logger.Debug("Sending registration message to server with public key: %s, relay: %v, pingResults: %+v", publicKey, !config.Holepunch, pingResults)
 		o.stopRegister, o.updateRegister = o.websocket.SendMessageInterval("olm/wg/register", map[string]any{
-			"publicKey":   publicKey.String(),
-			"relay":       !config.Holepunch,
-			"olmVersion":  o.olmConfig.Version,
-			"olmAgent":    o.olmConfig.Agent,
-			"orgId":       config.OrgID,
-			"userToken":   userToken,
-			"fingerprint": o.fingerprint,
-			"postures":    o.postures,
-			"pingResults": pingResults,
-			"chainId":     generateChainId(), // use a random chainId for registration updates - it won't be used for cancellation since registration is a one-time message but for tracking the session
+			"publicKey":    publicKey.String(),
+			"relay":        !config.Holepunch,
+			"olmVersion":   o.olmConfig.OlmVersion,
+			"olmAgent":     o.olmConfig.Agent,
+			"agentVersion": o.olmConfig.Version,
+			"orgId":        config.OrgID,
+			"userToken":    userToken,
+			"fingerprint":  o.fingerprint,
+			"postures":     o.postures,
+			"pingResults":  pingResults,
+			"chainId":      generateChainId(), // use a random chainId for registration updates - it won't be used for cancellation since registration is a one-time message but for tracking the session
 		}, 2*time.Second, 20) // after 18 tries on the server side we send the error so dont change this without changing that
 	})
 
@@ -786,8 +789,9 @@ func (o *Olm) StartTunnel(config TunnelConfig) {
 			if err := o.websocket.SendMessage("olm/wg/register", map[string]any{
 				"publicKey":           publicKey.String(),
 				"relay":               !config.Holepunch,
-				"olmVersion":          o.olmConfig.Version,
+				"olmVersion":          o.olmConfig.OlmVersion,
 				"olmAgent":            o.olmConfig.Agent,
+				"agentVersion":        o.olmConfig.Version,
 				"orgId":               config.OrgID,
 				"userToken":           userToken,
 				"fingerprint":         o.fingerprint,
diff --git a/olm/types.go b/olm/types.go
index 5e304b0..99ec928 100644
--- a/olm/types.go
+++ b/olm/types.go
@@ -82,8 +82,11 @@ type OlmConfig struct {
 	EnableAPI  bool
 	HTTPAddr   string
 	SocketPath string
-	Version    string
+	Version    string // version of the agent (the app embedding olm)
 	Agent      string
+	// OlmVersion is the version of the github.com/fosrl/olm module itself.
+	// Optional: when empty it is read from the binary's build info.
+	OlmVersion string
 
 	WakeUpDebounce time.Duration
 
diff --git a/olm/version.go b/olm/version.go
new file mode 100644
index 0000000..8806514
--- /dev/null
+++ b/olm/version.go
@@ -0,0 +1,30 @@
+package olm
+
+import (
+	"runtime/debug"
+	"strings"
+)
+
+// olmModulePath is the module path of this package, used to find its version
+// in the build info of a binary that embeds olm (the CLI, Pangolin Windows, ...).
+const olmModulePath = "github.com/fosrl/olm"
+
+// resolveOlmVersion returns the version of the olm module this binary was
+// built with, as opposed to config.Version which is the embedding agent's
+// version. It prefers config.OlmVersion, then the module version from the
+// binary's build info, and returns "" if neither is available.
+func resolveOlmVersion(config OlmConfig) string {
+	if config.OlmVersion != "" {
+		return config.OlmVersion
+	}
+
+	if bi, ok := debug.ReadBuildInfo(); ok {
+		for _, dep := range bi.Deps {
+			if dep.Path == olmModulePath {
+				return strings.TrimPrefix(dep.Version, "v")
+			}
+		}
+	}
+
+	return ""
+}