diff --git a/client.go b/client.go
index 7469b57..9e32217 100644
--- a/client.go
+++ b/client.go
@@ -534,6 +534,9 @@ func (c *Client) requestRaw(ctx context.Context, method, path string, values url
 		req.Header.Set("Authorization", "Bearer "+c.bearer)
 		req.Header.Set("User-Agent", c.userAgent)
 		req.Header.Set("X-Attesto-SDK", c.userAgent)
+		// [P1.9] protocol handshake: the backend answers 426 when it speaks a
+		// different protocol generation (ErrProtocolMismatch via APIError).
+		req.Header.Set("X-Attesto-Protocol", ProtocolHandshake)
 		if body != nil {
 			req.Header.Set("Content-Type", "application/json")
 		}
@@ -577,6 +580,14 @@ func (e *APIError) Error() string {
 	return fmt.Sprintf("attesto api error: status=%d message=%s", e.StatusCode, e.Message)
 }
 
+// IsProtocolMismatch reports whether err is a 426 protocol-handshake rejection:
+// the backend speaks a different protocol generation than this SDK announced in
+// X-Attesto-Protocol. Upgrade the SDK to a release that speaks it.
+func IsProtocolMismatch(err error) bool {
+	var apiErr *APIError
+	return errors.As(err, &apiErr) && apiErr.StatusCode == http.StatusUpgradeRequired
+}
+
 func decodeResponse(resp *http.Response, out any) error {
 	defer resp.Body.Close()
 	if resp.StatusCode == http.StatusNoContent {
diff --git a/version.go b/version.go
index 96cbd86..3af03b0 100644
--- a/version.go
+++ b/version.go
@@ -5,4 +5,7 @@ const (
 	DefaultBaseURL       = "https://verify.attesto.eu"
 	ProofstreamProtocol  = "ATTESTO-PROOFSTREAM-001"
 	ProtocolVersionAlpha = "0.1-alpha"
+	// ProtocolHandshake is sent as X-Attesto-Protocol on every request; the
+	// backend answers 426 when it speaks a different protocol generation.
+	ProtocolHandshake = ProofstreamProtocol + "/" + ProtocolVersionAlpha
 )