diff --git a/cmd/mgmt/mgmt.go b/cmd/mgmt/mgmt.go
index 08d3dcd..0429513 100644
--- a/cmd/mgmt/mgmt.go
+++ b/cmd/mgmt/mgmt.go
@@ -17,6 +17,7 @@ import (
 	"github.com/go-acme/lego/v3/providers/dns/duckdns"
 	"github.com/go-acme/lego/v3/providers/dns/godaddy"
 	"github.com/go-acme/lego/v3/providers/dns/namedotcom"
+	"github.com/go-chi/chi"
 
 	_ "github.com/joho/godotenv/autoload"
 )
@@ -28,8 +29,18 @@ var (
 	version = "v0.0.0-pre0+0000000"
 	// GitTimestamp refers to the timestamp of the most recent commit
 	date = "0000-00-00T00:00:00+0000"
+
+	// serviceName is the service name
+	serviceName = "telebit-mgmt"
+
+	// serviceDesc
+	serviceDesc = "Telebit Device Management"
 )
 
+func ver() string {
+	return fmt.Sprintf("%s v%s (%s) %s", serviceName, version, commit[:7], date)
+}
+
 var store authstore.Store
 var secret string
 
@@ -152,7 +163,14 @@ func main() {
 
 	go func() {
 		fmt.Println("Listening for ACME challenges on :" + challengesPort)
-		if err := http.ListenAndServe(":"+challengesPort, mgmt.RouteStatic()); nil != err {
+		r := chi.NewRouter()
+		r.Get("/version", func(w http.ResponseWriter, r *http.Request) {
+			w.Write([]byte(ver() + "\n"))
+		})
+		r.Get("/api/version", func(w http.ResponseWriter, r *http.Request) {
+			w.Write([]byte("TODO (json): " + ver() + "\n"))
+		})
+		if err := http.ListenAndServe(":"+challengesPort, mgmt.RouteStatic(r)); nil != err {
 			log.Fatal(err)
 			os.Exit(1)
 		}
diff --git a/cmd/telebit/telebit.go b/cmd/telebit/telebit.go
index 91b5d1b..4678c0e 100644
--- a/cmd/telebit/telebit.go
+++ b/cmd/telebit/telebit.go
@@ -73,7 +73,7 @@ var (
 	serviceName = "telebit"
 
 	// serviceDesc
-	serviceDesc = "securely relay traffic through telebit.io"
+	serviceDesc = "Telebit Secure Proxy"
 
 	// defaultRelay should be set when compiled for the client
 	defaultRelay = "" //"https://telebit.app"
@@ -119,6 +119,10 @@ type Config struct {
 
 var config Config
 
+func ver() string {
+	return fmt.Sprintf("%s v%s (%s) %s", serviceName, version, commit[:7], date)
+}
+
 func main() {
 	parseFlagsAndENVs()
 
@@ -189,7 +193,7 @@ func (p *program) Stop() error {
 func parseFlagsAndENVs() {
 	if len(os.Args) >= 2 {
 		if "version" == strings.TrimLeft(os.Args[1], "-") {
-			fmt.Printf("telebit %s (%s) %s\n", version, commit[:7], date)
+			fmt.Printf("%s\n", ver())
 			os.Exit(exitOk)
 			return
 		}
@@ -740,6 +744,10 @@ func muxAll(
 	if len(config.apiHostname) > 0 {
 		// this is a generic net listener
 		r := chi.NewRouter()
+		r.Get("/version", func(w http.ResponseWriter, r *http.Request) {
+			w.Write([]byte(ver() + "\n"))
+		})
+
 		telebit.RouteAdmin(config.authURL, r)
 		apiListener := tunnel.NewListener()
 		go func() {
diff --git a/internal/mgmt/route.go b/internal/mgmt/route.go
index 59dd3c7..5ed6de9 100644
--- a/internal/mgmt/route.go
+++ b/internal/mgmt/route.go
@@ -28,9 +28,7 @@ type MgmtClaims struct {
 var presenters = make(chan *Challenge)
 var cleanups = make(chan *Challenge)
 
-func RouteStatic() chi.Router {
-	r := chi.NewRouter()
-
+func RouteStatic(r chi.Router) chi.Router {
 	r.Use(middleware.Logger)
 	r.Use(middleware.Timeout(15 * time.Second))
 	r.Use(middleware.Recoverer)
diff --git a/internal/telebit/admin.go b/internal/telebit/admin.go
index 72e9807..a382809 100644
--- a/internal/telebit/admin.go
+++ b/internal/telebit/admin.go
@@ -25,6 +25,8 @@ var authorizer Authorizer
 
 // RouteAdmin sets up the API, including the Mgmt proxy and ACME relay
 func RouteAdmin(authURL string, r chi.Router) {
+	var apiPingContent = []byte("{ \"success\": true, \"error\": \"\" }\n")
+
 	authorizer = NewAuthorizer(authURL)
 
 	r.Use(middleware.Logger)
@@ -114,7 +116,6 @@ func RouteAdmin(authURL string, r chi.Router) {
 	})
 }
 
-var apiPingContent = []byte("{ \"success\": true, \"error\": \"\" }\n")
 var apiNotFoundContent = []byte("{ \"error\": \"not found\" }\n")
 var apiNotAuthorizedContent = []byte("{ \"error\": \"not authorized\" }\n")