diff --git a/consts/consts.go b/consts/consts.go
--- a/consts/consts.go
+++ b/consts/consts.go
@@ -7,3 +7,7 @@
 	DefaultSpindle = "spindle.tangled.sh"
 	DefaultKnot    = "knot1.tangled.sh"
 )
+
+type Capability string
+
+const CapKnotACL Capability = "knot-acl"
diff --git a/api/tangled/knotversion.go b/api/tangled/knotversion.go
--- a/api/tangled/knotversion.go
+++ b/api/tangled/knotversion.go
@@ -16,7 +16,8 @@
 
 // KnotVersion_Output is the output of a sh.tangled.knot.version call.
 type KnotVersion_Output struct {
-	Version string `json:"version" cborgen:"version"`
+	Version      string   `json:"version" cborgen:"version"`
+	Capabilities []string `json:"capabilities,omitempty" cborgen:"capabilities,omitempty"`
 }
 
 // KnotVersion calls the XRPC method "sh.tangled.knot.version".
diff --git a/lexicons/knot/version.json b/lexicons/knot/version.json
--- a/lexicons/knot/version.json
+++ b/lexicons/knot/version.json
@@ -15,6 +15,13 @@
           "properties": {
             "version": {
               "type": "string"
+            },
+            "capabilities": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "description": "Protocol capability tokens this knot implements, such as knot-acl. Knots that omit this field are treated as legacy."
             }
           }
         }