diff --git a/lib/constants.js b/lib/constants.js
index 7d340cd..905f823 100644
--- a/lib/constants.js
+++ b/lib/constants.js
@@ -2,6 +2,7 @@
 const _MAX_BACKOFF_WAIT_SECS = 32
 const _BACKOFF_FACTOR = 2
 const _RATE_LIMITED_RESP_CODE = 429
+const _CA_BUNDLE_VERSION = '1.0'
 
 const DUO_PINNED_CERT = `
 # Source URL: https://www.amazontrust.com/repository/AmazonRootCA1.cer
@@ -468,5 +469,6 @@ module.exports = {
   '_MAX_BACKOFF_WAIT_SECS': _MAX_BACKOFF_WAIT_SECS,
   '_BACKOFF_FACTOR': _BACKOFF_FACTOR,
   '_RATE_LIMITED_RESP_CODE': _RATE_LIMITED_RESP_CODE,
+  '_CA_BUNDLE_VERSION': _CA_BUNDLE_VERSION,
   'DUO_PINNED_CERT': DUO_PINNED_CERT
 }
diff --git a/lib/main.js b/lib/main.js
index d899f0b..c62f4a8 100644
--- a/lib/main.js
+++ b/lib/main.js
@@ -20,7 +20,7 @@ Client.prototype.apiCall = function (method, path, params, callback) {
   var headers = {
     'Date': date,
     'Host': this.host,
-    'User-Agent': `duo_api_nodejs/${_PACKAGE_VERSION}`
+    'User-Agent': `duo_api_nodejs/${_PACKAGE_VERSION} ca_bundle/${constants._CA_BUNDLE_VERSION} (ca_pinning=${this.enableCAPinning ? 'enabled' : 'disabled'})`
   }
   var body = ''
   var params_go_in_body = ['POST', 'PUT', 'PATCH'].includes(method)
diff --git a/tests/main.js b/tests/main.js
index a5daad3..b307ed1 100644
--- a/tests/main.js
+++ b/tests/main.js
@@ -234,4 +234,26 @@ describe('CA Pinning Configuration', function () {
       done()
     })
   })
+
+  it('User agent includes ca_bundle version and ca_pinning=enabled when pinning is on', function (done) {
+    var client = new duo_api.Client(IKEY, SKEY, API_HOSTNAME)
+    client.jsonApiCall('GET', '/foo/bar', {}, function (resp) {
+      var options = requestSpy.firstCall.args[0]
+      var ua = options.headers['User-Agent']
+      assert(ua.includes('ca_bundle/' + constants._CA_BUNDLE_VERSION))
+      assert(ua.includes('(ca_pinning=enabled)'))
+      done()
+    })
+  })
+
+  it('User agent includes ca_pinning=disabled when pinning is off', function (done) {
+    var client = new duo_api.Client(IKEY, SKEY, API_HOSTNAME, duo_api.SIGNATURE_VERSION_2, false)
+    client.jsonApiCall('GET', '/foo/bar', {}, function (resp) {
+      var options = requestSpy.firstCall.args[0]
+      var ua = options.headers['User-Agent']
+      assert(ua.includes('ca_bundle/' + constants._CA_BUNDLE_VERSION))
+      assert(ua.includes('(ca_pinning=disabled)'))
+      done()
+    })
+  })
 })