diff --git a/lib/wp/client.c b/lib/wp/client.c
index dfa44811..59afcff0 100644
--- a/lib/wp/client.c
+++ b/lib/wp/client.c
@@ -9,6 +9,7 @@
 #include "client.h"
 #include "log.h"
 #include "private/pipewire-object-mixin.h"
+#include "private/permission-manager.h"
 
 WP_DEFINE_LOCAL_LOG_TOPIC ("wp-client")
 
@@ -25,6 +26,7 @@ WP_DEFINE_LOCAL_LOG_TOPIC ("wp-client")
 struct _WpClient
 {
   WpGlobalProxy parent;
+  GWeakRef permission_manager;
 };
 
 static void wp_client_pw_object_mixin_priv_interface_init (
@@ -39,6 +41,7 @@ G_DEFINE_TYPE_WITH_CODE (WpClient, wp_client, WP_TYPE_GLOBAL_PROXY,
 static void
 wp_client_init (WpClient * self)
 {
+  g_weak_ref_init (&self->permission_manager, NULL);
 }
 
 static void
@@ -76,11 +79,27 @@ wp_client_pw_proxy_created (WpProxy * proxy, struct pw_proxy * pw_proxy)
 static void
 wp_client_pw_proxy_destroyed (WpProxy * proxy)
 {
+  WpClient *self = WP_CLIENT (proxy);
+
+  wp_client_attach_permission_manager (self, NULL);
+
   wp_pw_object_mixin_handle_pw_proxy_destroyed (proxy);
 
   WP_PROXY_CLASS (wp_client_parent_class)->pw_proxy_destroyed (proxy);
 }
 
+static void
+wp_impl_node_finalize (GObject * object)
+{
+  WpClient *self = WP_CLIENT (object);
+
+  wp_client_attach_permission_manager (self, NULL);
+
+  g_weak_ref_clear (&self->permission_manager);
+
+  G_OBJECT_CLASS (wp_client_parent_class)->finalize (object);
+}
+
 static void
 wp_client_class_init (WpClientClass * klass)
 {
@@ -88,6 +107,7 @@ wp_client_class_init (WpClientClass * klass)
   WpObjectClass *wpobject_class = (WpObjectClass *) klass;
   WpProxyClass *proxy_class = (WpProxyClass *) klass;
 
+  object_class->finalize = wp_impl_node_finalize;
   object_class->get_property = wp_pw_object_mixin_get_property;
 
   wpobject_class->get_supported_features =
@@ -221,3 +241,30 @@ wp_client_update_properties (WpClient * self, WpProperties * updates)
 
   g_warn_if_fail (client_update_properties_result >= 0);
 }
+
+/*!
+ * \brief Attaches a permission manager in the client to handle permissions
+ * automatically.
+ *
+ * \ingroup wpclient
+ * \param self the client
+ * \param pm (transfer none) (nullable): the permission manager to attach, or
+ * NULL to detach the current permission manager.
+ */
+void
+wp_client_attach_permission_manager (WpClient *self, WpPermissionManager *pm)
+{
+  g_autoptr (WpPermissionManager) curr_pm = NULL;
+
+  g_return_if_fail (WP_IS_CLIENT (self));
+
+  curr_pm = g_weak_ref_get (&self->permission_manager);
+  if (curr_pm == pm)
+    return;
+
+  if (curr_pm)
+    wp_permission_manager_remove_client (curr_pm, self);
+  if (pm)
+    wp_permission_manager_add_client (pm, self);
+  g_weak_ref_set (&self->permission_manager, pm);
+}
diff --git a/lib/wp/client.h b/lib/wp/client.h
index be8678e2..1a878cb2 100644
--- a/lib/wp/client.h
+++ b/lib/wp/client.h
@@ -10,6 +10,7 @@
 #define __WIREPLUMBER_CLIENT_H__
 
 #include "global-proxy.h"
+#include "permission-manager.h"
 
 G_BEGIN_DECLS
 
@@ -37,6 +38,10 @@ void wp_client_update_permissions_array (WpClient * self,
 WP_API
 void wp_client_update_properties (WpClient * self, WpProperties * updates);
 
+WP_API
+void wp_client_attach_permission_manager (WpClient *self,
+    WpPermissionManager *pm);
+
 G_END_DECLS
 
 #endif
diff --git a/modules/module-lua-scripting/api/api.c b/modules/module-lua-scripting/api/api.c
index f71a0fbd..7ccd28c5 100644
--- a/modules/module-lua-scripting/api/api.c
+++ b/modules/module-lua-scripting/api/api.c
@@ -1388,10 +1388,22 @@ client_send_error (lua_State *L)
   return 0;
 }
 
+static int
+client_attach_permission_manager (lua_State *L)
+{
+  WpClient *client = wplua_checkobject (L, 1, WP_TYPE_CLIENT);
+  WpPermissionManager *pm =
+      wplua_checkobject (L, 2, WP_TYPE_PERMISSION_MANAGER);
+
+  wp_client_attach_permission_manager (client, pm);
+  return 0;
+}
+
 static const luaL_Reg client_methods[] = {
   { "update_permissions", client_update_permissions },
   { "update_properties", client_update_properties },
   { "send_error", client_send_error },
+  { "attach_permission_manager", client_attach_permission_manager },
   { NULL, NULL }
 };