diff --git a/meson.build b/meson.build
index 0455d89b78c..c54acd0d049 100644
--- a/meson.build
+++ b/meson.build
@@ -3891,6 +3891,7 @@ endif
 ############################################################
 
 check_help = find_program('tools/check-help.sh')
+check_version = find_program('tools/check-version.sh')
 
 foreach exec : public_programs
         name = exec.full_path().split('/')[-1]
@@ -3899,6 +3900,12 @@ foreach exec : public_programs
                      check_help,
                      args : exec.full_path(),
                      depends: exec)
+
+                test('check-version-' + name,
+                     check_version,
+                     args : [exec.full_path(),
+                             meson.project_version()],
+                     depends: exec)
         endif
 endforeach
 
diff --git a/tools/check-help.sh b/tools/check-help.sh
index 76ac2926750..19ec9414692 100755
--- a/tools/check-help.sh
+++ b/tools/check-help.sh
@@ -3,8 +3,8 @@
 set -eu
 set -o pipefail
 
-# Note: `grep ... >/dev/null` instead of just `grep -q` is used intentionally
-#       here, since `grep -q` exits on the first match causing SIGPIPE being
+# Note: 'grep ... >/dev/null' instead of just 'grep -q' is used intentionally
+#       here, since 'grep -q' exits on the first match causing SIGPIPE being
 #       sent to the sender.
 
 BINARY="${1:?}"
@@ -24,11 +24,11 @@ fi
 
 # --help prints something. Also catches case where args are ignored.
 if ! "$BINARY" --help | grep . >/dev/null; then
-    echo "$(basename "$BINARY") --help output is empty."
+    echo "$(basename "$BINARY") --help output is empty"
     exit 2
 fi
 
-# no --help output to stdout
+# no --help output to stderr
 if "$BINARY" --help 2>&1 1>/dev/null | grep .; then
     echo "$(basename "$BINARY") --help prints to stderr"
     exit 3
diff --git a/tools/check-version.sh b/tools/check-version.sh
new file mode 100755
index 00000000000..faefb468837
--- /dev/null
+++ b/tools/check-version.sh
@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: LGPL-2.1-or-later
+set -eu
+set -o pipefail
+
+# Note: 'grep ... >/dev/null' instead of just 'grep -q' is used intentionally
+#       here, since 'grep -q' exits on the first match causing SIGPIPE being
+#       sent to the sender.
+
+BINARY="${1:?}"
+VERSION="${2:?}"
+export SYSTEMD_LOG_LEVEL=info
+
+if [[ ! -x "$BINARY" ]]; then
+    echo "$BINARY is not an executable"
+    exit 1
+fi
+
+# --version prints something. Also catches case where args are ignored.
+if ! "$BINARY" --version | grep . >/dev/null; then
+    echo "$(basename "$BINARY") --version output is empty"
+    exit 2
+fi
+
+# no --version output to stderr
+if "$BINARY" --version 2>&1 1>/dev/null | grep .; then
+    echo "$(basename "$BINARY") --version prints to stderr"
+    exit 3
+fi
+
+# project version appears in version output
+out="$("$BINARY" --version)"
+if ! grep -F "$VERSION" >/dev/null <<<"$out"; then
+    echo "$(basename "$BINARY") --version output does not match '$VERSION': $out"
+    exit 4
+fi