diff --git a/cmd/bitmask-helper/main.go b/cmd/bitmask-helper/main.go
index de180ab22aef0ca706cc079c8ccfb0dd8d412be2..3d190460d50a657b5d2b4f77fa3499a2be4b4ae0 100644
--- a/cmd/bitmask-helper/main.go
+++ b/cmd/bitmask-helper/main.go
@@ -1,4 +1,4 @@
-// Copyright (C) 2018 LEAP
+// Copyright (C) 2018-2020 LEAP
 //
 // This program is free software: you can redistribute it and/or modify
 // it under the terms of the GNU General Public License as published by
@@ -28,6 +28,8 @@ const (
 	logFile       = "helper.log"
 )
 
+var version string
+
 func main() {
 	logger, err := config.ConfigureLogger(path.Join(helper.LogFolder, logFile))
 	if err != nil {
@@ -35,6 +37,7 @@ func main() {
 	} else {
 		defer logger.Close()
 	}
+	config.Version = version
 
 	helper.ServeHTTP(preferredPort)
 }
diff --git a/pkg/config/config.go b/pkg/config/config.go
index b7987e443aad7f3f4e37f2b73c4543a1d4c1e257..4228dae2ccd5d2365ecb30b38095cbe05deecb93 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -1,6 +1,6 @@
 // Code generated by go generate; DO NOT EDIT.
 // This file was generated by vendorize.py
-// At 2019-10-11 16:05:25
+// At 2020-04-14 18:42:06
 
 package config
 
@@ -18,6 +18,8 @@ const (
 	GeolocationAPI  = "https://api.black.riseup.net:9001/json"
 )
 
+var Version string
+
 /*
 
 CaCert : a string containing a representation of the provider CA, used to
diff --git a/pkg/helper/helper.go b/pkg/helper/helper.go
index b5404c291d55108d3421915bd18b016041166892..b5b90bbc25e55459ad2618eb5f18e47bc89670fd 100644
--- a/pkg/helper/helper.go
+++ b/pkg/helper/helper.go
@@ -13,9 +13,16 @@
 // You should have received a copy of the GNU General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+// This helper is intended to be long-lived, and run with administrator privileges.
+// It will launch a http server and expose a REST API to control OpenVPN and the firewall.
+// At the moment, it is only used in Darwin and Windows - although it could also be used in GNU/Linux systems (but we use the one-shot bitmask-root wrapper in GNU/Linux instead).
+// In Windows, this helper will run on the first available port after the standard one (7171).
+// In other systems, the 7171 port is hardcoded.
+
 package helper
 
 import (
+	"0xacab.org/leap/bitmask-vpn/pkg/config"
 	"encoding/json"
 	"log"
 	"net/http"
@@ -33,6 +40,7 @@ func runCommandServer(bindAddr string) {
 	http.HandleFunc("/firewall/start", firewallStartHandler)
 	http.HandleFunc("/firewall/stop", firewallStopHandler)
 	http.HandleFunc("/firewall/isup", firewallIsUpHandler)
+	http.HandleFunc("/version", versionHandler)
 
 	log.Fatal(http.ListenAndServe(bindAddr, nil))
 }
@@ -136,6 +144,11 @@ func firewallIsUpHandler(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
+func versionHandler(w http.ResponseWriter, r *http.Request) {
+	w.Write([]byte(config.ApplicationName + "/" + config.Version + "\n"))
+	w.WriteHeader(http.StatusOK)
+}
+
 func getArgs(r *http.Request) ([]string, error) {
 	args := []string{}
 	decoder := json.NewDecoder(r.Body)