diff --git a/cmd/nginx-auth/nginx-auth.go b/cmd/nginx-auth/nginx-auth.go
index 09da74da1..96488635e 100644
--- a/cmd/nginx-auth/nginx-auth.go
+++ b/cmd/nginx-auth/nginx-auth.go
@@ -20,6 +20,7 @@ import (
 	"os"
 	"strings"
 
+	"golang.org/x/exp/slices"
 	"github.com/coreos/go-systemd/activation"
 	"tailscale.com/client/tailscale"
 )
@@ -83,6 +84,20 @@ func main() {
 			return
 		}
 
+		if expectedCap := r.Header.Get("Expected-Cap"); expectedCap != "" {
+			if info.Caps == nil {
+				w.WriteHeader(http.StatusForbidden)
+				log.Printf("user does not have any caps, wanted: %s", url.QueryEscape(expectedCap))
+				return
+			}
+
+			if !slices.Contains(info.Caps, expectedCap) {
+				w.WriteHeader(http.StatusForbidden)
+				log.Printf("user is missing expected cap, has: %s, wanted: %s", strings.Join(info.Caps[:], ","), url.QueryEscape(expectedCap))
+				return
+			}
+		}
+
 		h := w.Header()
 		h.Set("Tailscale-Login", strings.Split(info.UserProfile.LoginName, "@")[0])
 		h.Set("Tailscale-User", info.UserProfile.LoginName)