diff --git a/app/controllers/api/v1/release_engines/oci/tags_controller.rb b/app/controllers/api/v1/release_engines/oci/tags_controller.rb
new file mode 100644
index 000000000..234e9865f
--- /dev/null
+++ b/app/controllers/api/v1/release_engines/oci/tags_controller.rb
@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+module Api::V1::ReleaseEngines
+  class Oci::TagsController < Api::V1::BaseController
+    before_action :require_ee!
+    before_action :scope_to_current_account!
+    before_action :require_active_subscription!
+    before_action :authenticate_with_token
+    before_action :set_package
+
+    def index
+      authorize! package, to: :show?
+
+      releases = authorized_scope(package.releases)
+      authorize! releases
+
+      tags = releases.pluck(:tag)
+                     .sort
+
+      render json: {
+        name: package.key,
+        tags:,
+      }
+    end
+
+    private
+
+    attr_reader :package
+
+    def require_ee! = super(entitlements: %i[oci_engine])
+
+    def set_package
+      scoped_packages = authorized_scope(current_account.release_packages.oci)
+
+      @package = Current.resource = FindByAliasService.call(
+        scoped_packages,
+        id: params[:package],
+        aliases: :key,
+      )
+    end
+  end
+end
diff --git a/config/routes.rb b/config/routes.rb
index 451101ea6..58cf0d34c 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -121,6 +121,11 @@
         digest: /[^\/]*/,
       }
 
+      # see: https://github.com/opencontainers/distribution-spec/blob/main/spec.md#listing-tags
+      get ':package/tags/list', to: 'tags#index', as: :oci_tags, constraints: {
+        package: /[^\/]*/,
+      }
+
       # ignore other requests entirely for now e.g. GET /v2/:namespace/referrers/:digest
       match '*wildcard', via: :all, to: -> env { [405, {}, []] }
     end