diff --git a/metropolis/proto/api/management.proto b/metropolis/proto/api/management.proto
index 5560455..5c8905f 100644
--- a/metropolis/proto/api/management.proto
+++ b/metropolis/proto/api/management.proto
@@ -148,6 +148,16 @@
     // heartbeats was received, expressed in nanoseconds. It is only valid with
     // the health status of either HEALTHY or HEARTBEAT_TIMEOUT.
     google.protobuf.Duration time_since_heartbeat = 6;
+
+    // tpm_usage describes whether this node has a TPM 2.0 and whether it is
+    // being actively used as part of its membership in the Metropolis cluster.
+    //
+    // Currently, the TPM 2.0 is only used to seal the local part of the disk
+    // encryption key and the early join credentials of the node. Depending on
+    // future cluster configuration settings, this might also indicate that the
+    // node has actually passed high assurance hardware attestation against the
+    // cluster.
+    metropolis.proto.common.NodeTPMUsage tpm_usage = 8;
 }
 
 message ApproveNodeRequest {
diff --git a/metropolis/proto/common/common.proto b/metropolis/proto/common/common.proto
index 27dfa5a..8e0fa58 100644
--- a/metropolis/proto/common/common.proto
+++ b/metropolis/proto/common/common.proto
@@ -302,3 +302,16 @@
     }
     TPMMode tpm_mode = 1;
 }
+
+// NodeTPMUsage describes whether a node has a TPM2.0 and if it is/should be
+// actively used to seal secrets before saving them to its EFI system partition.
+enum NodeTPMUsage {
+    NODE_TPM_INVALID = 0;
+    // This node has no TPM 2.0.
+    NODE_TPM_NOT_PRESENT = 1;
+    // This node has a TPM 2.0 but the cluster configuration mandates not using
+    // it.
+    NODE_TPM_PRESENT_BUT_UNUSED = 2;
+    // This node has a TPM 2.0 and it is being actively used.
+    NODE_TPM_PRESENT_AND_USED = 3;
+}
\ No newline at end of file