diff --git a/account.go b/account.go
index e077dca..caf8989 100644
--- a/account.go
+++ b/account.go
@@ -189,7 +189,8 @@ func runAccountLookup(cctx *cli.Context) error {
 
 	// create a new API client to connect to the account's PDS
 	xrpcc := xrpc.Client{
-		Host: ident.PDSEndpoint(),
+		Host:      ident.PDSEndpoint(),
+		UserAgent: userAgent(),
 	}
 	if xrpcc.Host == "" {
 		return fmt.Errorf("no PDS endpoint for identity")
@@ -413,7 +414,8 @@ func runAccountCreate(cctx *cli.Context) error {
 
 	// create a new API client to connect to the account's PDS
 	xrpcc := xrpc.Client{
-		Host: pdsHost,
+		Host:      pdsHost,
+		UserAgent: userAgent(),
 	}
 
 	raw = cctx.String("service-auth")
diff --git a/account_migrate.go b/account_migrate.go
index 08925f4..4c38a2b 100644
--- a/account_migrate.go
+++ b/account_migrate.go
@@ -84,7 +84,8 @@ func runAccountMigrate(cctx *cli.Context) error {
 	newEmail := cctx.String("new-email")
 
 	newClient := xrpc.Client{
-		Host: newHostURL,
+		Host:      newHostURL,
+		UserAgent: userAgent(),
 	}
 
 	// connect to new host to discover service DID
diff --git a/auth.go b/auth.go
index cfa4412..8f3100e 100644
--- a/auth.go
+++ b/auth.go
@@ -67,7 +67,8 @@ func loadAuthClient(ctx context.Context) (*xrpc.Client, error) {
 	}
 
 	client := xrpc.Client{
-		Host: sess.PDS,
+		Host:      sess.PDS,
+		UserAgent: userAgent(),
 		Auth: &xrpc.AuthInfo{
 			Did: sess.DID.String(),
 			// NOTE: using refresh in access location for "refreshSession" call
@@ -118,7 +119,8 @@ func refreshAuthSession(ctx context.Context, username syntax.AtIdentifier, passw
 	}
 
 	client := xrpc.Client{
-		Host: pdsURL,
+		Host:      pdsURL,
+		UserAgent: userAgent(),
 	}
 	var token *string
 	if authFactorToken != "" {
diff --git a/blob.go b/blob.go
index 8742d8e..19b9cb5 100644
--- a/blob.go
+++ b/blob.go
@@ -84,7 +84,8 @@ func runBlobExport(cctx *cli.Context) error {
 
 	// create a new API client to connect to the account's PDS
 	xrpcc := xrpc.Client{
-		Host: pdsHost,
+		Host:      pdsHost,
+		UserAgent: userAgent(),
 	}
 	if xrpcc.Host == "" {
 		return fmt.Errorf("no PDS endpoint for identity")
@@ -141,7 +142,8 @@ func runBlobList(cctx *cli.Context) error {
 
 	// create a new API client to connect to the account's PDS
 	xrpcc := xrpc.Client{
-		Host: ident.PDSEndpoint(),
+		Host:      ident.PDSEndpoint(),
+		UserAgent: userAgent(),
 	}
 	if xrpcc.Host == "" {
 		return fmt.Errorf("no PDS endpoint for identity")
@@ -182,7 +184,8 @@ func runBlobDownload(cctx *cli.Context) error {
 
 	// create a new API client to connect to the account's PDS
 	xrpcc := xrpc.Client{
-		Host: ident.PDSEndpoint(),
+		Host:      ident.PDSEndpoint(),
+		UserAgent: userAgent(),
 	}
 	if xrpcc.Host == "" {
 		return fmt.Errorf("no PDS endpoint for identity")
diff --git a/firehose.go b/firehose.go
index aaa2b27..7201ab9 100644
--- a/firehose.go
+++ b/firehose.go
@@ -22,7 +22,6 @@ import (
 	"github.com/bluesky-social/indigo/events/schedulers/parallel"
 	lexutil "github.com/bluesky-social/indigo/lex/util"
 
-	"github.com/carlmjohnson/versioninfo"
 	"github.com/gorilla/websocket"
 	"github.com/urfave/cli/v2"
 )
@@ -104,7 +103,7 @@ func runFirehose(cctx *cli.Context) error {
 		SkipHandleVerification: true,
 		TryAuthoritativeDNS:    false,
 		SkipDNSDomainSuffixes:  []string{".bsky.social"},
-		UserAgent:              "goat/" + versioninfo.Short(),
+		UserAgent:              *userAgent(),
 	}
 	cdir := identity.NewCacheDirectory(&bdir, 1_000_000, time.Hour*24, time.Minute*2, time.Minute*5)
 
@@ -153,7 +152,7 @@ func runFirehose(cctx *cli.Context) error {
 	}
 	urlString := u.String()
 	con, _, err := dialer.Dial(urlString, http.Header{
-		"User-Agent": []string{fmt.Sprintf("goat/%s", versioninfo.Short())},
+		"User-Agent": []string{*userAgent()},
 	})
 	if err != nil {
 		return fmt.Errorf("subscribing to firehose failed (dialing): %w", err)
diff --git a/lexicon.go b/lexicon.go
index 433df07..16d43a0 100644
--- a/lexicon.go
+++ b/lexicon.go
@@ -232,7 +232,8 @@ func runLexList(cctx *cli.Context) error {
 
 	// create a new API client to connect to the account's PDS
 	xrpcc := xrpc.Client{
-		Host: ident.PDSEndpoint(),
+		Host:      ident.PDSEndpoint(),
+		UserAgent: userAgent(),
 	}
 	if xrpcc.Host == "" {
 		return fmt.Errorf("no PDS endpoint for identity")
diff --git a/net.go b/net.go
index accdb71..8e58af0 100644
--- a/net.go
+++ b/net.go
@@ -16,7 +16,8 @@ func fetchRecord(ctx context.Context, ident identity.Identity, aturi syntax.ATUR
 
 	slog.Debug("fetching record", "did", ident.DID.String(), "collection", aturi.Collection().String(), "rkey", aturi.RecordKey().String())
 	xrpcc := xrpc.Client{
-		Host: ident.PDSEndpoint(),
+		Host:      ident.PDSEndpoint(),
+		UserAgent: userAgent(),
 	}
 	resp, err := agnostic.RepoGetRecord(ctx, &xrpcc, "", aturi.Collection().String(), ident.DID.String(), aturi.RecordKey().String())
 	if err != nil {
diff --git a/pds.go b/pds.go
index 9a2b963..be3dd81 100644
--- a/pds.go
+++ b/pds.go
@@ -37,7 +37,8 @@ func runPdsDescribe(cctx *cli.Context) error {
 		return fmt.Errorf("PDS host is not a url: %s", pdsHost)
 	}
 	client := xrpc.Client{
-		Host: pdsHost,
+		Host:      pdsHost,
+		UserAgent: userAgent(),
 	}
 
 	resp, err := comatproto.ServerDescribeServer(ctx, &client)
diff --git a/plc.go b/plc.go
index 977a7ab..a2ac924 100644
--- a/plc.go
+++ b/plc.go
@@ -211,6 +211,7 @@ func runPLCDump(cctx *cli.Context) error {
 	if err != nil {
 		return err
 	}
+	req.Header.Set("User-Agent", *userAgent())
 	q := req.URL.Query()
 	q.Add("count", fmt.Sprintf("%d", size))
 	req.URL.RawQuery = q.Encode()
diff --git a/record.go b/record.go
index 6d286d9..c6e3eb7 100644
--- a/record.go
+++ b/record.go
@@ -154,7 +154,8 @@ func runRecordList(cctx *cli.Context) error {
 
 	// create a new API client to connect to the account's PDS
 	xrpcc := xrpc.Client{
-		Host: ident.PDSEndpoint(),
+		Host:      ident.PDSEndpoint(),
+		UserAgent: userAgent(),
 	}
 	if xrpcc.Host == "" {
 		return fmt.Errorf("no PDS endpoint for identity")
diff --git a/relay.go b/relay.go
index 945fbf8..74150bc 100644
--- a/relay.go
+++ b/relay.go
@@ -126,7 +126,8 @@ func runRelayAccountList(cctx *cli.Context) error {
 	}
 
 	client := xrpc.Client{
-		Host: cctx.String("relay-host"),
+		Host:      cctx.String("relay-host"),
+		UserAgent: userAgent(),
 	}
 
 	collection := cctx.String("collection")
@@ -196,7 +197,8 @@ func runRelayAccountStatus(cctx *cli.Context) error {
 	}
 
 	client := xrpc.Client{
-		Host: cctx.String("relay-host"),
+		Host:      cctx.String("relay-host"),
+		UserAgent: userAgent(),
 	}
 
 	r, err := comatproto.SyncGetRepoStatus(ctx, &client, did.String())
@@ -239,7 +241,8 @@ func runRelayHostRequestCrawl(cctx *cli.Context) error {
 	}
 
 	client := xrpc.Client{
-		Host: cctx.String("relay-host"),
+		Host:      cctx.String("relay-host"),
+		UserAgent: userAgent(),
 	}
 
 	err := comatproto.SyncRequestCrawl(ctx, &client, &comatproto.SyncRequestCrawl_Input{Hostname: hostname})
@@ -258,7 +261,8 @@ func runRelayHostList(cctx *cli.Context) error {
 	}
 
 	client := xrpc.Client{
-		Host: cctx.String("relay-host"),
+		Host:      cctx.String("relay-host"),
+		UserAgent: userAgent(),
 	}
 
 	cursor := ""
@@ -313,7 +317,8 @@ func runRelayHostStatus(cctx *cli.Context) error {
 	}
 
 	client := xrpc.Client{
-		Host: cctx.String("relay-host"),
+		Host:      cctx.String("relay-host"),
+		UserAgent: userAgent(),
 	}
 
 	h, err := comatproto.SyncGetHostStatus(ctx, &client, hostname)
@@ -355,7 +360,8 @@ type hostInfo struct {
 func fetchHosts(ctx context.Context, relayHost string) ([]hostInfo, error) {
 
 	client := xrpc.Client{
-		Host: relayHost,
+		Host:      relayHost,
+		UserAgent: userAgent(),
 	}
 
 	hosts := []hostInfo{}
diff --git a/relay_admin.go b/relay_admin.go
index 5151934..7d82e38 100644
--- a/relay_admin.go
+++ b/relay_admin.go
@@ -10,7 +10,6 @@ import (
 	"net/http"
 	"net/url"
 
-	"github.com/carlmjohnson/versioninfo"
 	"github.com/urfave/cli/v2"
 )
 
@@ -179,7 +178,7 @@ func (c *RelayAdminClient) Do(method, path string, params map[string]string, bod
 	} else if c.BearerToken != "" {
 		req.Header.Set("Authorization", "Bearer "+c.BearerToken)
 	}
-	req.Header.Set("User-Agent", fmt.Sprintf("goat/"+versioninfo.Short()))
+	req.Header.Set("User-Agent", *userAgent())
 	if buf != nil {
 		req.Header.Set("Content-Type", "application/json")
 	}
diff --git a/repo.go b/repo.go
index b532d1b..7139812 100644
--- a/repo.go
+++ b/repo.go
@@ -107,7 +107,8 @@ func runRepoExport(cctx *cli.Context) error {
 
 	// create a new API client to connect to the account's PDS
 	xrpcc := xrpc.Client{
-		Host: ident.PDSEndpoint(),
+		Host:      ident.PDSEndpoint(),
+		UserAgent: userAgent(),
 	}
 	if xrpcc.Host == "" {
 		return fmt.Errorf("no PDS endpoint for identity")
diff --git a/util.go b/util.go
index ac2227b..d88f65a 100644
--- a/util.go
+++ b/util.go
@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"fmt"
 	"io"
 	"log/slog"
 	"os"
@@ -10,6 +11,7 @@ import (
 	"github.com/bluesky-social/indigo/atproto/identity"
 	"github.com/bluesky-social/indigo/atproto/syntax"
 
+	"github.com/carlmjohnson/versioninfo"
 	"github.com/urfave/cli/v2"
 )
 
@@ -67,3 +69,9 @@ func configLogger(cctx *cli.Context, writer io.Writer) *slog.Logger {
 	slog.SetDefault(logger)
 	return logger
 }
+
+// returns a pointer because that is what xrpc.Client expects
+func userAgent() *string {
+	s := fmt.Sprintf("goat/" + versioninfo.Short())
+	return &s
+}