diff --git a/cmd/tsconnect/wasmbuild/wasmbuild.go b/cmd/tsconnect/wasmbuild/wasmbuild.go
index bb2814027..a5dcade07 100644
--- a/cmd/tsconnect/wasmbuild/wasmbuild.go
+++ b/cmd/tsconnect/wasmbuild/wasmbuild.go
@@ -55,24 +55,34 @@ var baseTags = []string{
 //   - "captiveportal": the browser handles captive portal detection
 //     in front of us.
 //   - "syspolicy": no MDM in a browser.
-//   - "drive", "taildrop", "peerapi*": no local filesystem.
 //   - "clientupdate": no binary self-update.
 //   - "dbus", "resolved", "networkmanager", "iptables", "linkspeed",
 //     "linuxdnsfight", "listenrawdisco", "osrouter", "synology",
 //     "systray", "tundevstats", "wakeonlan": OS integrations not
 //     applicable to a browser-hosted client.
 //   - "aws", "cloud", "kube", "bird", "appconnectors", "conn25",
-//     "relayserver", "serve", "acme", "tap", "tpm", "doctor",
-//     "advertiseroutes", "advertiseexitnode", "useroutes",
-//     "useexitnode": server-side or otherwise out of scope for the
-//     SSH-in-browser / fetch-in-browser use case.
+//     "relayserver", "tap", "tpm", "doctor", "advertiseroutes",
+//     "useroutes": server-side or otherwise out of scope.
+//
+// This fork keeps considerably more than upstream's SSH-in-browser
+// build: the JS bridge exposes Taildrop, Taildrive, Funnel/serve, ACME
+// certs and exit node selection, all of which need their feature linked
+// in. The taildrop/drive FileOps are backed by JS callbacks rather than
+// a real filesystem, so the usual "no local filesystem" objection to
+// linking them into wasm doesn't apply here.
 var Keep = []featuretags.FeatureTag{
-	"c2n",      // control-to-node mechanism the control client invokes
-	"dns",      // MagicDNS resolution in-process
-	"health",   // ipnstate/ipnlocal reference health warnables pervasively
-	"ipnbus",   // notification bus for state/netmap callbacks
-	"logtail",  // log upload (browser console + remote)
-	"netstack", // userspace networking; wasm has no kernel TUN
+	"acme",              // getCert / listenTLS need ACME cert issuance
+	"advertiseexitnode", // exit node advertisement via the JS bridge
+	"c2n",               // control-to-node mechanism the control client invokes
+	"dns",               // MagicDNS resolution in-process
+	"drive",             // Taildrive WebDAV server exposed to JS
+	"health",            // ipnstate/ipnlocal reference health warnables pervasively
+	"ipnbus",            // notification bus for state/netmap callbacks
+	"logtail",           // log upload (browser console + remote)
+	"netstack",          // userspace networking; wasm has no kernel TUN
+	"serve",             // setFunnel / listenTLS serve config
+	"taildrop",          // file send/receive over a JS-backed FileOps
+	"useexitnode",       // exit node selection exposed to JS
 }
 
 func init() {