diff --git a/cloud/agent/api/BUILD.bazel b/cloud/agent/api/BUILD.bazel
index 3742cf5..9312b9d 100644
--- a/cloud/agent/api/BUILD.bazel
+++ b/cloud/agent/api/BUILD.bazel
@@ -4,7 +4,10 @@
 
 proto_library(
     name = "api_proto",
-    srcs = ["agent.proto"],
+    srcs = [
+        "agent.proto",
+        "takeover.proto",
+    ],
     visibility = ["//visibility:public"],
 )
 
diff --git a/cloud/agent/api/takeover.proto b/cloud/agent/api/takeover.proto
new file mode 100644
index 0000000..9453df3
--- /dev/null
+++ b/cloud/agent/api/takeover.proto
@@ -0,0 +1,24 @@
+syntax = "proto3";
+package cloud.agent.api;
+option go_package = "source.monogon.dev/cloud/agent/api";
+
+// TakeoverInit is the message sent to the takeover process over an SSH session
+// during initialization.
+message TakeoverInit {
+  // provider is the provider name the machine was created at.
+  string provider = 1;
+  // provider_id is the machine's provider-assigned ID.
+  string provider_id = 2;
+  // bmaas_endpoint is an address of the BMaaS service the agent should call
+  // back to.
+  string bmaas_endpoint = 3;
+}
+
+// TakeoverResponse is the message the takeover process sends back after
+// receiving an TakeoverInit message.
+message TakeoverResponse {
+  // init_message is the exact init message the agent received.
+  TakeoverInit init_message = 1;
+  // key is the agent's public key.
+  bytes key = 2;
+}