diff --git a/main.go b/main.go
index c790c85e..ef0edc29 100644
--- a/main.go
+++ b/main.go
@@ -8,10 +8,24 @@ import (
 	"github.com/tailscale/terraform-provider-tailscale/tailscale"
 )
 
+// version is filled by goreleaser at build time.
+var version = "dev"
+
 func main() {
 	plugin.Serve(&plugin.ServeOpts{
 		ProviderFunc: func() *schema.Provider {
-			return tailscale.Provider()
+			return tailscale.Provider(addUserAgent)
 		},
 	})
 }
+
+// addUserAgent adds a `user_agent` configuration key to the provider with a
+// default value based on provider version.
+func addUserAgent(p *schema.Provider) {
+	p.Schema["user_agent"] = &schema.Schema{
+		Type:        schema.TypeString,
+		Default:     p.UserAgent("terraform-provider-tailscale", version),
+		Optional:    true,
+		Description: "User-Agent header for API requests",
+	}
+}
diff --git a/tailscale/provider.go b/tailscale/provider.go
index c94644a4..d896fbc2 100644
--- a/tailscale/provider.go
+++ b/tailscale/provider.go
@@ -107,6 +107,8 @@ func providerConfigure(_ context.Context, d *schema.ResourceData) (interface{},
 		return nil, diag.Errorf("tailscale provider argument 'oauth_client_secret' is empty")
 	}
 
+	userAgent := d.Get("user_agent").(string)
+
 	if oauthClientID != "" && oauthClientSecret != "" {
 		var oauthScopes []string
 		oauthScopesFromConfig := d.Get("scopes").([]interface{})
@@ -121,6 +123,7 @@ func providerConfigure(_ context.Context, d *schema.ResourceData) (interface{},
 			"",
 			tailnet,
 			tailscale.WithBaseURL(baseURL),
+			tailscale.WithUserAgent(userAgent),
 			tailscale.WithOAuthClientCredentials(oauthClientID, oauthClientSecret, oauthScopes),
 		)
 		if err != nil {
@@ -134,6 +137,7 @@ func providerConfigure(_ context.Context, d *schema.ResourceData) (interface{},
 		apiKey,
 		tailnet,
 		tailscale.WithBaseURL(baseURL),
+		tailscale.WithUserAgent(userAgent),
 	)
 	if err != nil {
 		return nil, diagnosticsError(err, "failed to initialise client")