diff --git a/planetwars-server/src/lib.rs b/planetwars-server/src/lib.rs
index fa1af8d..6018eee 100644
--- a/planetwars-server/src/lib.rs
+++ b/planetwars-server/src/lib.rs
@@ -127,6 +127,7 @@ pub fn api() -> Router {
             "/bots/:bot_name/upload",
             post(routes::bots::upload_code_multipart),
         )
+        .route("/code/:version_id", get(routes::bots::get_code))
         .route("/matches", get(routes::matches::list_recent_matches))
         .route("/matches/:match_id", get(routes::matches::get_match_data))
         .route(
diff --git a/planetwars-server/src/routes/bots.rs b/planetwars-server/src/routes/bots.rs
index f2bf202..4ab1b4e 100644
--- a/planetwars-server/src/routes/bots.rs
+++ b/planetwars-server/src/routes/bots.rs
@@ -249,3 +249,29 @@ pub async fn upload_code_multipart(
 
     Ok(Json(code_bundle))
 }
+
+pub async fn get_code(
+    conn: DatabaseConnection,
+    user: User,
+    Path(bundle_id): Path<i32>,
+    Extension(config): Extension<Arc<GlobalConfig>>,
+) -> Result<Vec<u8>, StatusCode> {
+    let version =
+        db::bots::find_bot_version(bundle_id, &conn).map_err(|_| StatusCode::NOT_FOUND)?;
+    let bot_id = version.bot_id.ok_or(StatusCode::FORBIDDEN)?;
+    let bot = db::bots::find_bot(bot_id, &conn).map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+
+    if bot.owner_id != Some(user.id) {
+        return Err(StatusCode::FORBIDDEN);
+    }
+
+    let bundle_path = version.code_bundle_path.ok_or(StatusCode::NOT_FOUND)?;
+
+    // TODO: avoid hardcoding paths
+    let full_bundle_path = PathBuf::from(&config.bots_directory)
+        .join(&bundle_path)
+        .join("bot.py");
+    let bot_code =
+        std::fs::read(full_bundle_path).map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    Ok(bot_code)
+}