diff --git a/tailcfg/tailcfg.go b/tailcfg/tailcfg.go
index a3f401a4d..ede343979 100644
--- a/tailcfg/tailcfg.go
+++ b/tailcfg/tailcfg.go
@@ -72,7 +72,7 @@ type CapabilityVersion int
 //	34: 2022-08-02: client understands CapabilityFileSharingTarget
 //	36: 2022-08-02: added PeersChangedPatch.{Key,DiscoKey,Online,LastSeen,KeyExpiry,Capabilities}
 //	37: 2022-08-09: added Debug.{SetForceBackgroundSTUN,SetRandomizeClientPort}; Debug are sticky
-const CurrentCapabilityVersion CapabilityVersion = 36
+const CurrentCapabilityVersion CapabilityVersion = 37
 
 type StableID string
 
diff --git a/tailcfg/tailcfg_test.go b/tailcfg/tailcfg_test.go
index 6a900bcae..36256ec02 100644
--- a/tailcfg/tailcfg_test.go
+++ b/tailcfg/tailcfg_test.go
@@ -8,13 +8,17 @@ import (
 	"encoding"
 	"encoding/json"
 	"net/netip"
+	"os"
 	"reflect"
+	"regexp"
+	"strconv"
 	"strings"
 	"testing"
 	"time"
 
 	"tailscale.com/tstest"
 	"tailscale.com/types/key"
+	"tailscale.com/util/must"
 	"tailscale.com/version"
 )
 
@@ -651,3 +655,20 @@ func TestRegisterRequestNilClone(t *testing.T) {
 		t.Errorf("got = %v; want nil", got)
 	}
 }
+
+// Tests that CurrentCapabilityVersion is bumped when the comment block above it gets bumped.
+// We've screwed this up several times.
+func TestCurrentCapabilityVersion(t *testing.T) {
+	f := must.Get(os.ReadFile("tailcfg.go"))
+	matches := regexp.MustCompile(`(?m)^//\s+(\d+): \d\d\d\d-\d\d-\d\d: `).FindAllStringSubmatch(string(f), -1)
+	max := 0
+	for _, m := range matches {
+		n := must.Get(strconv.Atoi(m[1]))
+		if n > max {
+			max = n
+		}
+	}
+	if CapabilityVersion(max) != CurrentCapabilityVersion {
+		t.Errorf("CurrentCapabilityVersion = %d; want %d", CurrentCapabilityVersion, max)
+	}
+}