diff --git a/src/libcharon/plugins/vici/README.md b/src/libcharon/plugins/vici/README.md
index a43c60399..985fb4a24 100644
--- a/src/libcharon/plugins/vici/README.md
+++ b/src/libcharon/plugins/vici/README.md
@@ -819,6 +819,8 @@ command.
 					mark-mask-out = <hex encoded outbound Netfilter mark mask>
 					if-id-in = <hex encoded inbound XFRM interface ID>
 					if-id-out = <hex encoded outbound XFRM interface ID>
+					per-cpu-sas = <yes if per-CPU SAs enabled>
+					cpu = <CPU ID of per-CPU SA>
 					label = <hex encoded security label>
 					encr-alg = <ESP encryption algorithm name, if any>
 					encr-keysize = <ESP encryption key size, if applicable>
diff --git a/src/libcharon/plugins/vici/vici_query.c b/src/libcharon/plugins/vici/vici_query.c
index bb0212107..43e3f4413 100644
--- a/src/libcharon/plugins/vici/vici_query.c
+++ b/src/libcharon/plugins/vici/vici_query.c
@@ -200,7 +200,7 @@ static void list_child_ipsec(vici_builder_t *b, child_sa_t *child)
 {
 	proposal_t *proposal;
 	uint16_t alg, ks;
-	uint32_t if_id;
+	uint32_t if_id, cpu;
 
 	b->add_kv(b, "protocol", "%N", protocol_id_names,
 			  child->get_protocol(child));
@@ -229,6 +229,15 @@ static void list_child_ipsec(vici_builder_t *b, child_sa_t *child)
 	{
 		b->add_kv(b, "if-id-out", "%.8x", if_id);
 	}
+	if (child->use_per_cpu(child))
+	{
+		b->add_kv(b, "per-cpu-sas", "yes");
+	}
+	cpu = child->get_cpu(child);
+	if (cpu != CPU_ID_MAX)
+	{
+		b->add_kv(b, "cpu", "%u", cpu);
+	}
 
 	proposal = child->get_proposal(child);
 	if (proposal)