Two serialisers, one controller

Versioning the representation rather than the code, so the business logic exists once.

Route::get('/api/v1/orders/{order}', OrderController::class)
    ->defaults('serialiser', OrderV1Resource::class);

Route::get('/api/v2/orders/{order}', OrderController::class)
    ->defaults('serialiser', OrderV2Resource::class);

// the controller loads the order, authorises, and hands
// it to whichever resource the route named.

Duplicating the controller is the obvious move and it duplicates the authorisation, the loading and the error handling — three things that must not diverge between versions. Only the representation should differ, and expressing that as a route default rather than a conditional keeps the controller unaware that versions exist.