diff --git a/.gitattributes b/.gitattributes
index 3eb528782..89734e2ba 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,2 +1,60 @@
-go.mod filter=go-mod
-*.go  diff=golang
+go.mod filter=go-mod eol=lf text
+*.go  diff=golang eol=lf text
+*.adml eol=lf text
+*.admx eol=lf text
+*.bash eol=lf text
+*.c eol=lf text
+*.cgi eol=lf text
+*.conf eol=lf text
+*.css eol=lf text
+*.csv eol=lf text
+*.desktop eol=lf text
+*.fish eol=lf text
+*.gitattributes eol=lf text
+*.gitignore eol=lf text
+*.gitkeep eol=lf text
+*.go eol=lf text
+*.h eol=lf text
+*.helmignore eol=lf text
+*.htaccess eol=lf text
+*.html eol=lf text
+*.hujson eol=lf text
+*.in eol=lf text
+*.init eol=lf text
+*.js eol=lf text
+*.json eol=lf text
+*.lock eol=lf text
+*.lua eol=lf text
+*.md eol=lf text
+*.mod eol=lf text
+*.nix eol=lf text
+*.openrc eol=lf text
+*.pbxproj eol=lf text
+*.pem eol=lf text
+*.plg eol=lf text
+*.plist eol=lf text
+*.rc eol=lf text
+*.resolved eol=lf text
+*.rev eol=lf text
+*.rs eol=lf text
+*.sc eol=lf text
+*.service eol=lf text
+*.sh eol=lf text
+*.socket eol=lf text
+*.stignore eol=lf text
+*.sum eol=lf text
+*.svg eol=lf text
+*.swift eol=lf text
+*.tmpl eol=lf text
+*.toml eol=lf text
+*.ts eol=lf text
+*.tsx eol=lf text
+*.txt eol=lf text
+*.version eol=lf text
+*.xcscheme eol=lf text
+*.xcsettings eol=lf text
+*.xib eol=lf text
+*.xml eol=lf text
+*.yaml eol=lf text
+*.yml eol=lf text
+*.zsh eol=lf text
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index abe6a2c3a..4f3290f58 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -49,7 +49,7 @@ jobs:
 
     # Install a more recent Go that understands modern go.mod content.
     - name: Install Go
-      uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+      uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # zizmor: ignore[cache-poisoning] v6.3.0
       with:
         go-version-file: go.mod
 
diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml
index 2b46aa9b0..956435f5f 100644
--- a/.github/workflows/govulncheck.yml
+++ b/.github/workflows/govulncheck.yml
@@ -17,7 +17,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install govulncheck
-        run: ./tool/go install golang.org/x/vuln/cmd/govulncheck@latest
+        run: ./tool/go install golang.org/x/vuln/cmd/govulncheck@0782b76014f15f24e22a438f30f308df42899ba1 # 1.3.0
 
       - name: Scan source code for known vulnerabilities
         run: PATH=$PWD/tool/:$PATH "$(./tool/go env GOPATH)/bin/govulncheck" -test ./...
diff --git a/.github/workflows/installer.yml b/.github/workflows/installer.yml
index 6fc8913c4..757c1fd9e 100644
--- a/.github/workflows/installer.yml
+++ b/.github/workflows/installer.yml
@@ -37,8 +37,6 @@ jobs:
           - "elementary/docker:stable"
           - "elementary/docker:unstable"
           - "parrotsec/core:latest"
-          - "kalilinux/kali-rolling"
-          - "kalilinux/kali-dev"
           - "oraclelinux:9"
           - "oraclelinux:8"
           - "fedora:latest"
@@ -61,6 +59,9 @@ jobs:
           - { image: "debian:stable-slim", deps: "curl" }
           - { image: "ubuntu:24.04", deps: "curl" }
           - { image: "fedora:latest", deps: "curl" }
+          # Kali doesn't have ca-certificates installed by default anymore
+          - { image: "kalilinux/kali-dev", "deps": "curl ca-certificates"}
+          - { image: "kalilinux/kali-rolling", "deps": "curl ca-certificates"}
           # Test TAILSCALE_VERSION pinning on a subset of distros.
           # Skip Alpine as community repos don't reliably keep old versions.
           - { image: "debian:stable-slim", deps: "curl", version: "1.80.0" }
@@ -68,7 +69,7 @@ jobs:
           - { image: "fedora:latest", deps: "curl", version: "1.80.0" }
     runs-on: ubuntu-latest
     container:
-      image: ${{ matrix.image }}
+      image: ${{ matrix.image }} # zizmor: ignore[unpinned-images]
       options: --user root
     steps:
     - name: install dependencies (pacman)
diff --git a/.github/workflows/natlab-integrationtest.yml b/.github/workflows/natlab-basic.yml
similarity index 52%
rename from .github/workflows/natlab-integrationtest.yml
rename to .github/workflows/natlab-basic.yml
index 162153cb2..1a19acfb8 100644
--- a/.github/workflows/natlab-integrationtest.yml
+++ b/.github/workflows/natlab-basic.yml
@@ -1,6 +1,7 @@
-# Run some natlab integration tests.
+# Run a single natlab smoke test on every PR. The full natlab suite
+# is opt-in and lives in .github/workflows/natlab-test.yml.
 # See https://github.com/tailscale/tailscale/issues/13038
-name: "natlab-integrationtest"
+name: "natlab-basic"
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
@@ -17,17 +18,28 @@ on:
     branches:
       - "main"
 jobs:
-  natlab-integrationtest:
+  EasyEasy:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Enable KVM
+        run: |
+          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
+          sudo udevadm control --reload-rules
+          sudo udevadm trigger --name-match=kvm
       - name: Install qemu
         run: |
           sudo rm -f /var/lib/man-db/auto-update
           sudo apt-get -y update
           sudo apt-get -y remove man-db
           sudo apt-get install -y qemu-system-x86 qemu-utils
+      - name: Build VM image
+        # The test will build this if missing, but we do it explicitly
+        # to avoid cutting into the go test -timeout budget, and to
+        # fail earlier with a clearer error if the image build breaks.
+        run: |
+          make -C gokrazy natlab
       - name: Run natlab integration tests
         run: |
-          ./tool/go test -v -run=^TestEasyEasy$ -timeout=3m -count=1 ./tstest/integration/nat  --run-vm-tests
+          ./tool/go test -v -run=^TestEasyEasy$ -timeout=3m -count=1 ./tstest/natlab/vmtest --run-vm-tests
diff --git a/.github/workflows/natlab-test.yml b/.github/workflows/natlab-test.yml
new file mode 100644
index 000000000..05dea6d0d
--- /dev/null
+++ b/.github/workflows/natlab-test.yml
@@ -0,0 +1,182 @@
+# Run the full natlab/vmtest opt-in test suite. These tests boot QEMU VMs
+# (gokrazy, Ubuntu, FreeBSD) and exercise vnet-driven networking scenarios.
+# They are gated behind --run-vm-tests because they need KVM and are slow.
+#
+# This workflow runs:
+#   - on demand (workflow_dispatch)
+#   - on PRs that carry the "run-natlab-tests" label
+#   - on main, every 12 hours, via cron
+#
+# Layout:
+#   - "prepare" builds the gokrazy VM image, downloads the cloud images
+#     (Ubuntu, FreeBSD), and discovers every Test* function in the two
+#     opt-in packages.
+#   - "test" is a per-TestFoo matrix that depends on prepare. Each matrix
+#     job restores the shared caches and runs a single test. Adding a new
+#     TestFoo automatically gets its own job — no workflow edits needed.
+#
+# A separate workflow (.github/workflows/natlab-basic.yml) runs a single
+# canary natlab test on every PR; this one runs the full suite.
+name: "natlab-test"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+on:
+  workflow_dispatch:
+  pull_request:
+    types: [labeled, synchronize, reopened]
+  schedule:
+    # Every 12 hours, off-the-hour to avoid GitHub's :00 cron-stampede window.
+    - cron: "23 3,15 * * *"
+
+jobs:
+  # prepare warms the per-workflow-run caches (gokrazy image, cloud VM
+  # images) and emits the dynamic matrix of test names. By doing the work
+  # once here, the matrix test jobs never race to rebuild or re-download
+  # the same artifacts on a cold cache.
+  prepare:
+    if: |
+      github.event_name == 'workflow_dispatch' ||
+      github.event_name == 'schedule' ||
+      (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'run-natlab-tests'))
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    outputs:
+      matrix: ${{ steps.list.outputs.matrix }}
+    steps:
+      - name: Check out code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      # The cloud VM image cache is keyed only on images.go (image URLs and
+      # SHAs), so it survives across workflow runs and is invalidated only
+      # when a new image source is added.
+      - name: Cache cloud VM images
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        with:
+          path: ~/.cache/tailscale/vmtest/images
+          key: natlab-vmimages-${{ hashFiles('tstest/natlab/vmtest/images.go') }}
+
+      # The gokrazy VM image is keyed by github.sha. That means we rebuild
+      # it once per commit but matrix test jobs in the same run all share
+      # the result. Per-PR re-runs of the same sha (e.g. a rerun-failed)
+      # also get the cache.
+      - name: Cache gokrazy VM image
+        id: gokrazy-cache
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        with:
+          path: gokrazy/natlabapp.qcow2
+          key: natlab-gokrazy-${{ github.sha }}
+
+      # qemu-utils provides qemu-img, which the gokrazy Makefile uses to
+      # convert natlabapp.img to qcow2. Only install if we need it (cache
+      # miss); the test matrix jobs install qemu separately for the runtime.
+      - name: Install qemu-utils
+        if: steps.gokrazy-cache.outputs.cache-hit != 'true'
+        run: |
+          sudo rm -f /var/lib/man-db/auto-update
+          sudo apt-get -y update
+          sudo apt-get -y remove man-db
+          sudo apt-get install -y qemu-utils
+
+      - name: Download cloud VM images
+        # natlabprep is idempotent: it checks the cache before downloading.
+        run: |
+          ./tool/go run ./tstest/natlab/vmtest/cmd/natlabprep
+
+      - name: Build gokrazy VM image
+        if: steps.gokrazy-cache.outputs.cache-hit != 'true'
+        run: |
+          make -C gokrazy natlab
+
+      - name: Discover tests
+        id: list
+        # Grep the test files directly rather than invoking `go test -list`
+        # so we don't pay the cost of compiling the test binaries here. The
+        # only test functions in these packages use the canonical
+        # `func TestFoo(t *testing.T)` signature.
+        #
+        # exclude is the set of tests that need special invocation
+        # (extra flags, a specific environment) and don't fit the
+        # single-test-per-matrix-job model. They stay runnable locally.
+        run: |
+          set -euo pipefail
+          exclude='^(TestGrid|TestVnetPerf.*)$'
+          tmp=$(mktemp)
+          for pkg_dir in tstest/natlab/vmtest tstest/integration/nat; do
+            pkg="./${pkg_dir}/"
+            for f in "${pkg_dir}"/*_test.go; do
+              [ -e "$f" ] || continue
+              { grep -hE '^func Test[A-Z][A-Za-z0-9_]*\(t \*testing\.T\)' "$f" || true; } \
+                | sed -E 's/^func (Test[A-Za-z0-9_]+).*/\1/' \
+                | { grep -vE "$exclude" || true; } \
+                | while read -r t; do
+                    jq -nc --arg pkg "$pkg" --arg test "$t" \
+                      '{pkg: $pkg, test: $test}' >> "$tmp"
+                  done
+            done
+          done
+          matrix=$(jq -s -c . "$tmp")
+          echo "matrix=${matrix}" >> "$GITHUB_OUTPUT"
+          echo "Discovered tests:"
+          jq . "$tmp"
+
+  test:
+    needs: prepare
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    name: "${{ matrix.test }}"
+    strategy:
+      fail-fast: false
+      matrix:
+        include: ${{ fromJson(needs.prepare.outputs.matrix) }}
+    steps:
+      - name: Check out code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Enable KVM
+        run: |
+          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
+          sudo udevadm control --reload-rules
+          sudo udevadm trigger --name-match=kvm
+
+      - name: Install qemu
+        run: |
+          sudo rm -f /var/lib/man-db/auto-update
+          sudo apt-get -y update
+          sudo apt-get -y remove man-db
+          sudo apt-get install -y qemu-system-x86 qemu-utils
+
+      # restore-only: prepare is the single writer of these caches, so
+      # matrix jobs don't write back. fail-on-cache-miss would be too
+      # strict for the gokrazy cache (e.g. a non-fatal cache eviction
+      # between prepare and us); we just rebuild on miss instead.
+      - name: Restore cloud VM images
+        uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        with:
+          path: ~/.cache/tailscale/vmtest/images
+          key: natlab-vmimages-${{ hashFiles('tstest/natlab/vmtest/images.go') }}
+
+      - name: Restore gokrazy VM image
+        uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        with:
+          path: gokrazy/natlabapp.qcow2
+          key: natlab-gokrazy-${{ github.sha }}
+
+      # The gokrazy-based tests boot the kernel directly from
+      # vmlinuz that ships in the gokrazy/kernel.amd64 module.
+      # Tests look it up under GOMODCACHE via findKernelPath, so the
+      # module has to be present even though no Go source imports it
+      # in the test package itself.
+      - name: Download kernel.amd64 module
+        run: |
+          ./tool/go mod download github.com/gokrazy/kernel.amd64
+
+      - name: Run ${{ matrix.test }}
+        # Per-test timeout is well above the few-minute typical runtime
+        # but small enough that a stuck test fails fast instead of holding
+        # the runner for the job's 20-minute budget.
+        run: |
+          ./tool/go test -v -timeout=15m -count=1 ${{ matrix.pkg }} \
+            -run='^${{ matrix.test }}$' --run-vm-tests
diff --git a/.github/workflows/policybot-test.yml b/.github/workflows/policybot-test.yml
new file mode 100644
index 000000000..c943ae0e0
--- /dev/null
+++ b/.github/workflows/policybot-test.yml
@@ -0,0 +1,45 @@
+name: policybot-test
+
+env:
+  HOME: ${{ github.workspace }}
+  GOMODCACHE: ${{ github.workspace }}/gomodcache
+  CMD_GO_USE_GIT_HASH: "true"
+
+on:
+  push:
+    branches:
+      - main
+      - "release-branch/*"
+    paths:
+      - .github/workflows/policybot-test.yml
+      - .policy.yml
+      - .policy-tests.yml
+      - go.mod
+  pull_request:
+    paths:
+      - .github/workflows/policybot-test.yml
+      - .policy.yml
+      - .policy-tests.yml
+      - go.mod
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  policybot-test:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          path: src
+
+      # The version of github.com/tailscale/policybottest used here is
+      # pinned by go.mod via internal/tooldeps/tooldeps.go; bump it with
+      # "go get github.com/tailscale/policybottest@<sha> && go mod tidy".
+      - name: Run policy tests
+        working-directory: src
+        run: ./tool/go run github.com/tailscale/policybottest -policy .policy.yml -tests .policy-tests.yml
diff --git a/.github/workflows/request-dataplane-review.yml b/.github/workflows/request-dataplane-review.yml
index 78bd8ff58..1367a6518 100644
--- a/.github/workflows/request-dataplane-review.yml
+++ b/.github/workflows/request-dataplane-review.yml
@@ -2,7 +2,7 @@ name: request-dataplane-review
 
 on:
   pull_request:
-    types: [ opened, synchronize, reopened, ready_for_review ]
+    types: [opened, synchronize, reopened, ready_for_review]
     paths:
       - ".github/workflows/request-dataplane-review.yml"
       - "**/*derp*"
@@ -15,8 +15,6 @@ jobs:
     name: Request Dataplane Review
     runs-on: ubuntu-latest
     steps:
-      - name: Check out code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Get access token
         uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
         id: generate-token
@@ -24,6 +22,8 @@ jobs:
           # Get token for app: https://github.com/apps/change-visibility-bot
           app-id: ${{ secrets.VISIBILITY_BOT_APP_ID }}
           private-key: ${{ secrets.VISIBILITY_BOT_APP_PRIVATE_KEY }}
+          # Limit the token to only requesting reviewers on pull requests.
+          permission-pull-requests: write
       - name: Add reviewers
         env:
           GH_TOKEN: ${{ steps.generate-token.outputs.token }}
diff --git a/.github/workflows/request-k8s-review.yml b/.github/workflows/request-k8s-review.yml
new file mode 100644
index 000000000..da335fb88
--- /dev/null
+++ b/.github/workflows/request-k8s-review.yml
@@ -0,0 +1,39 @@
+name: request-k8s-review
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    paths:
+      - ".github/workflows/request-k8s-review.yml"
+      - "k8s-operator/**"
+      - "kube/**"
+      - "cmd/k8s-operator/**"
+      - "cmd/k8s-proxy/**"
+      - "cmd/k8s-nameserver/**"
+      - "cmd/containerboot/**"
+      - "cmd/sync-containers/**"
+      - "ipn/store/kubestore/**"
+      - "docs/k8s/**"
+      - "!**/depaware.txt"
+
+jobs:
+  request-k8s-review:
+    if: github.event.pull_request.draft == false
+    name: Request K8s Review
+    runs-on: ubuntu-latest
+    steps:
+      - name: Get access token
+        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
+        id: generate-token
+        with:
+          # Get token for app: https://github.com/apps/change-visibility-bot
+          app-id: ${{ secrets.VISIBILITY_BOT_APP_ID }}
+          private-key: ${{ secrets.VISIBILITY_BOT_APP_PRIVATE_KEY }}
+          # Limit the token to only requesting reviewers on pull requests.
+          permission-pull-requests: write
+      - name: Add reviewers
+        env:
+          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
+          url: ${{ github.event.pull_request.html_url }}
+        run: |
+          gh pr edit "$url" --add-reviewer tailscale/k8s-devs
diff --git a/.github/workflows/ssh-integrationtest.yml b/.github/workflows/ssh-integrationtest.yml
index afe2dd2f7..84432cd72 100644
--- a/.github/workflows/ssh-integrationtest.yml
+++ b/.github/workflows/ssh-integrationtest.yml
@@ -1,5 +1,5 @@
-# Run the ssh integration tests with `make sshintegrationtest`.
-# These tests can also be running locally.
+# Run the ssh integration tests in various Docker containers.
+# These tests can also be run locally via `make sshintegrationtest`.
 name: "ssh-integrationtest"
 
 concurrency:
@@ -15,9 +15,25 @@ on:
 jobs:
   ssh-integrationtest:
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - base: "ubuntu:focal"
+            tag: "ssh-ubuntu-focal"
+          - base: "ubuntu:jammy"
+            tag: "ssh-ubuntu-jammy"
+          - base: "ubuntu:noble"
+            tag: "ssh-ubuntu-noble"
+          - base: "alpine:latest"
+            tag: "ssh-alpine-latest"
     steps:
       - name: Check out code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Run SSH integration tests
+      - name: Build test binaries
         run: |
-          make sshintegrationtest
\ No newline at end of file
+          GOOS=linux GOARCH=amd64 CGO_ENABLED=0 ./tool/go test -tags integrationtest -c ./ssh/tailssh -o ssh/tailssh/testcontainers/tailssh.test
+          GOOS=linux GOARCH=amd64 CGO_ENABLED=0 ./tool/go build -o ssh/tailssh/testcontainers/tailscaled ./cmd/tailscaled
+      - name: Run SSH integration tests (${{ matrix.base }})
+        run: |
+          docker build --build-arg="BASE=${{ matrix.base }}" -t "${{ matrix.tag }}" ssh/tailssh/testcontainers
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 38ebd1291..a5952f720 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -70,7 +70,7 @@ jobs:
         run: go mod download
       - name: Cache Go modules
         if: steps.check-cache.outputs.cache-hit != 'true'
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # zizmor: ignore[cache-poisoning] v5.0.4
         with:
           path: gomodcache # relative to workspace; see env note at top of file
           key: ${{ steps.hash.outputs.key }}
@@ -183,7 +183,7 @@ jobs:
         TS_TEST_SHARD: ${{ matrix.shard }}
     - name: bench all
       working-directory: src
-      run: ./tool/go test ${{matrix.buildflags}} -bench=. -benchtime=1x -run=^$ $(for x in $(git grep -l "^func Benchmark" | xargs dirname | sort | uniq); do echo "./$x"; done)
+      run: ./tool/go test ${{matrix.buildflags}} -bench=. -benchtime=1x -run='^$' $(for x in $(git grep -l '^func Benchmark' | xargs dirname | sort | uniq); do echo "./$x"; done)
       env:
         GOARCH: ${{ matrix.goarch }}
     - name: check that no tracked files changed
@@ -261,6 +261,7 @@ jobs:
         cigocached-host: ${{ vars.CIGOCACHED_AZURE_HOST }}
 
     - name: test
+      shell: bash
       if: matrix.key != 'win-bench' # skip on bench builder
       working-directory: src
       run: ./tool/go run ./cmd/testwrapper sharded:${{ matrix.shard }}
@@ -268,9 +269,10 @@ jobs:
         NOPWSHDEBUG: "true" # to quiet tool/gocross/gocross-wrapper.ps1 in CI
 
     - name: bench all
+      shell: bash
       if: matrix.key == 'win-bench'
       working-directory: src
-      run: ./tool/go test ./... -bench=. -benchtime=1x -run="^$"
+      run: ./tool/go test -bench=. -benchtime=1x -run='^$' $(for x in $(git grep -l '^func Benchmark' | xargs dirname | sort | uniq); do echo "./$x"; done)
       env:
         NOPWSHDEBUG: "true" # to quiet tool/gocross/gocross-wrapper.ps1 in CI
 
@@ -343,7 +345,7 @@ jobs:
     needs: gomod-cache
     runs-on: ubuntu-24.04
     container:
-      image: golang:latest
+      image: golang:latest # zizmor: ignore[unpinned-images]
       options: --privileged
     steps:
     - name: checkout
@@ -361,31 +363,7 @@ jobs:
       run: chown -R $(id -u):$(id -g) $PWD
     - name: privileged tests
       working-directory: src
-      run: ./tool/go test ./util/linuxfw ./derp/xdp
-
-  vm:
-    needs: gomod-cache
-    runs-on: ["self-hosted", "linux", "vm"]
-    # VM tests run with some privileges, don't let them run on 3p PRs.
-    if: github.repository == 'tailscale/tailscale'
-    steps:
-    - name: checkout
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      with:
-        path: src
-    - name: Restore Go module cache
-      uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
-      with:
-        path: gomodcache
-        key: ${{ needs.gomod-cache.outputs.cache-key }}
-        enableCrossOsArchive: true
-    - name: Run VM tests
-      working-directory: src
-      run: ./tool/go test ./tstest/integration/vms -v -no-s3 -run-vm-tests -run=TestRunUbuntu2404
-      env:
-        HOME: "/var/lib/ghrunner/home"
-        TMPDIR: "/tmp"
-        XDG_CACHE_HOME: "/var/lib/ghrunner/cache"
+      run: ./tool/go test $(./tool/go run ./tool/listpkgs --has-root-tests)
 
   cross: # cross-compile checks, build only.
     needs: gomod-cache
@@ -642,6 +620,13 @@ jobs:
       run: |
         ./tool/go run ./cmd/tsconnect --fast-compression build
         ./tool/go run ./cmd/tsconnect --fast-compression build-pkg
+    - name: verify Google Chrome is available
+      run: |
+        which google-chrome
+        google-chrome --version
+    - name: tsconnect js/wasm headless-browser tests
+      working-directory: src
+      run: ./tool/go test ./tstest/integration/jswasmtest/ -v -timeout 180s --run-headless-browser-tests
     - name: Tidy cache
       working-directory: src
       shell: bash
@@ -787,6 +772,14 @@ jobs:
         echo
         echo
         git diff --name-only --exit-code || (echo "The files above need updating. Please run 'go generate'."; exit 1)
+    - name: check that 'genreadme' is clean
+      working-directory: src
+      run: |
+        ./tool/go run ./misc/genreadme
+        git add -N . # ensure untracked files are noticed
+        echo
+        echo
+        git diff --name-only --exit-code || (echo "The files above need updating. Please run './tool/go run ./misc/genreadme'."; exit 1)
 
   make_tidy:
     runs-on: ubuntu-24.04
@@ -895,7 +888,6 @@ jobs:
       - test
       - windows
       - macos
-      - vm
       - cross
       - ios
       - wasm
@@ -941,7 +933,6 @@ jobs:
       - test
       - windows
       - macos
-      - vm
       - cross
       - ios
       - wasm
@@ -991,7 +982,6 @@ jobs:
       - test
       - windows
       - macos
-      - vm
       - wasm
       - fuzz
       - race-root-integration
diff --git a/.github/workflows/update-flake.yml b/.github/workflows/update-flake.yml
index 1304fb222..f594fd6df 100644
--- a/.github/workflows/update-flake.yml
+++ b/.github/workflows/update-flake.yml
@@ -23,8 +23,8 @@ jobs:
       - name: Check out code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Run update-flakes
-        run: ./update-flake.sh
+      - name: Run updateflakes
+        run: ./tool/go run ./tool/updateflakes
 
       - name: Get access token
         uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
@@ -33,6 +33,9 @@ jobs:
           # Get token for app: https://github.com/apps/tailscale-code-updater
           app-id: ${{ secrets.CODE_UPDATER_APP_ID }}
           private-key: ${{ secrets.CODE_UPDATER_APP_PRIVATE_KEY }}
+          # Limit the token to only pushing a branch and opening a pull request.
+          permission-contents: write
+          permission-pull-requests: write
 
       - name: Send pull request
         uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 #v8.1.0
@@ -41,8 +44,8 @@ jobs:
           author: Flakes Updater <noreply+flakes-updater@tailscale.com>
           committer: Flakes Updater <noreply+flakes-updater@tailscale.com>
           branch: flakes
-          commit-message: "go.mod.sri: update SRI hash for go.mod changes"
-          title: "go.mod.sri: update SRI hash for go.mod changes"
+          commit-message: "flakehashes.json: update SRI hash for go.mod changes"
+          title: "flakehashes.json: update SRI hash for go.mod changes"
           body: Triggered by ${{ github.repository }}@${{ github.sha }}
           signoff: true
           delete-branch: true
diff --git a/.github/workflows/update-webclient-prebuilt.yml b/.github/workflows/update-webclient-prebuilt.yml
index 5bb0573a1..fd8876ecf 100644
--- a/.github/workflows/update-webclient-prebuilt.yml
+++ b/.github/workflows/update-webclient-prebuilt.yml
@@ -29,6 +29,9 @@ jobs:
           # Get token for app: https://github.com/apps/tailscale-code-updater
           app-id: ${{ secrets.CODE_UPDATER_APP_ID }}
           private-key: ${{ secrets.CODE_UPDATER_APP_PRIVATE_KEY }}
+          # Limit the token to only pushing a branch and opening a pull request.
+          permission-contents: write
+          permission-pull-requests: write
 
       - name: Send pull request
         id: pull-request
diff --git a/.github/workflows/vet.yml b/.github/workflows/vet.yml
index c03190e4f..d8f8e98a4 100644
--- a/.github/workflows/vet.yml
+++ b/.github/workflows/vet.yml
@@ -14,15 +14,17 @@ on:
       - main
       - "release-branch/*"
     paths:
+      - .github/workflows/vet.yml
       - "**.go"
   pull_request:
     paths:
+      - .github/workflows/vet.yml
       - "**.go"
 
 jobs:
   vet:
-    runs-on: [ self-hosted, linux ]
-    timeout-minutes: 5
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
 
     steps:
       - name: Check out code
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 000000000..181d02bc2
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,32 @@
+name: security lint GitHub Actions  with zizmor
+
+on:
+  push:
+    branches: ["main"]
+    paths:
+      - ".github/workflows/**"
+  pull_request:
+    branches: ["**"]
+    paths:
+      - ".github/workflows/**"
+
+permissions: {}
+
+jobs:
+  zizmor:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read 
+      actions: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
+        with:
+          min-severity: high
+          advanced-security: false
+          annotations: true
diff --git a/.gitignore b/.gitignore
index 4bfabc80f..9d570d954 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,12 +1,15 @@
 # Binaries for programs and plugins
 *~
 *.tmp
-*.exe
 *.dll
 *.so
 *.dylib
 *.spk
 
+*.exe
+# tool/go.exe is built specially and committed.
+!/tool/go.exe
+
 cmd/tailscale/tailscale
 cmd/tailscaled/tailscaled
 ssh/tailssh/testcontainers/tailscaled
@@ -55,3 +58,5 @@ client/web/build/assets
 
 # Ignore syncthing state directory.
 /.stfolder
+fbstatus
+gafpush
diff --git a/.policy-tests.yml b/.policy-tests.yml
new file mode 100644
index 000000000..2ee550cde
--- /dev/null
+++ b/.policy-tests.yml
@@ -0,0 +1,258 @@
+# Tests for testdata/tailscale.com.policy.yml.
+#
+# Run from the parent directory with:
+#   go run . -policy testdata/tailscale.com.policy.yml \
+#            -tests  testdata/tailscale.com.policy-test.yml
+
+teams:
+  # Members are picked solely so tests below can refer to them.
+  # `alice` and `bob` are control-protocol-owners *and* dev. `carol`,
+  # `dave`, and `eve` are dev only. `outsider` is in nothing.
+  tailscale/control-protocol-owners:
+    - alice
+    - bob
+  tailscale/dev:
+    - alice
+    - bob
+    - carol
+    - dave
+    - eve
+
+tests:
+  # ------------------------------------------------------------------
+  # Baseline: every PR (touching tailcfg/ or not) requires a +1 from a
+  # tailscale/dev member.
+  # ------------------------------------------------------------------
+
+  - name: non-tailcfg PR with no review is pending
+    pull_request:
+      author: carol
+      changed_files:
+        - README.md
+        - cmd/tailscale/main.go
+    expect:
+      status: pending
+      rules:
+        "tailcfg changes approved by control-protocol-owners": skipped
+        "tailcfg changes overridden by another tailscale/dev": skipped
+        "any tailscale/dev review": pending
+
+  - name: non-tailcfg PR with dev review is approved
+    pull_request:
+      author: carol
+      changed_files:
+        - README.md
+      reviews:
+        - user: dave
+          state: approved
+    expect:
+      status: approved
+      rules:
+        "any tailscale/dev review": approved
+
+  - name: non-tailcfg PR with thumbs-up comment from dev is approved
+    pull_request:
+      author: carol
+      changed_files:
+        - README.md
+      comments:
+        - user: dave
+          body: ":+1:"
+    expect:
+      status: approved
+      rules:
+        "any tailscale/dev review": approved
+
+  - name: non-tailcfg PR with non-dev review is pending
+    pull_request:
+      author: carol
+      changed_files:
+        - README.md
+      reviews:
+        - user: outsider
+          state: approved
+    expect:
+      status: pending
+      rules:
+        "any tailscale/dev review": pending
+
+  - name: PR with no files at all is pending without a dev review
+    pull_request:
+      author: carol
+      changed_files: []
+    expect:
+      status: pending
+      rules:
+        "any tailscale/dev review": pending
+
+  # ------------------------------------------------------------------
+  # tailcfg/ requires BOTH a control-protocol-owners review (or an
+  # override comment) AND a dev +1. Owners are in tailscale/dev too,
+  # so their single review satisfies both gates.
+  # ------------------------------------------------------------------
+
+  - name: tailcfg change without anything is pending
+    pull_request:
+      author: carol
+      changed_files:
+        - tailcfg/tailcfg.go
+    expect:
+      status: pending
+      rules:
+        "tailcfg changes approved by control-protocol-owners": pending
+        "tailcfg changes overridden by another tailscale/dev": pending
+        "any tailscale/dev review": pending
+
+  - name: a single owner review approves both the owner rule and the dev rule
+    pull_request:
+      author: carol
+      changed_files:
+        - tailcfg/tailcfg.go
+      reviews:
+        - user: alice
+          state: approved
+    expect:
+      status: approved
+      rules:
+        "tailcfg changes approved by control-protocol-owners": approved
+        "any tailscale/dev review": approved
+
+  - name: owner cannot self-approve their own tailcfg PR
+    pull_request:
+      author: alice
+      changed_files:
+        - tailcfg/tailcfg.go
+      reviews:
+        - user: alice
+          state: approved
+    expect:
+      status: pending
+
+  - name: non-owner dev review alone leaves the tailcfg gate pending
+    pull_request:
+      author: alice
+      changed_files:
+        - tailcfg/tailcfg.go
+      reviews:
+        - user: carol
+          state: approved
+    expect:
+      status: pending
+      rules:
+        "tailcfg changes approved by control-protocol-owners": pending
+        "tailcfg changes overridden by another tailscale/dev": pending
+        "any tailscale/dev review": approved
+
+  # ------------------------------------------------------------------
+  # policybot-override flow on a tailcfg/ PR.
+  # ------------------------------------------------------------------
+
+  # An override comment by itself only satisfies the override rule.
+  # The baseline dev-review rule still needs a separate +1.
+  - name: override comment alone leaves baseline dev review pending
+    pull_request:
+      author: carol
+      changed_files:
+        - tailcfg/tailcfg.go
+      comments:
+        - user: dave
+          body: "policybot-override: emergency rollback"
+    expect:
+      status: pending
+      rules:
+        "tailcfg changes overridden by another tailscale/dev": approved
+        "any tailscale/dev review": pending
+
+  - name: override comment plus a separate dev review approves
+    pull_request:
+      author: carol
+      changed_files:
+        - tailcfg/tailcfg.go
+      comments:
+        - user: dave
+          body: "policybot-override: emergency rollback"
+      reviews:
+        - user: eve
+          state: approved
+    expect:
+      status: approved
+
+  # One dev doing BOTH (post the override AND a regular +1) works too.
+  - name: same dev posts both the override and a +1 review
+    pull_request:
+      author: carol
+      changed_files:
+        - tailcfg/tailcfg.go
+      comments:
+        - user: dave
+          body: "policybot-override: shipping a typo fix"
+      reviews:
+        - user: dave
+          state: approved
+    expect:
+      status: approved
+
+  - name: override comment from the author does not approve the override
+    pull_request:
+      author: carol
+      changed_files:
+        - tailcfg/tailcfg.go
+      comments:
+        - user: carol
+          body: "policybot-override: please let me ship this"
+    expect:
+      status: pending
+      rules:
+        "tailcfg changes overridden by another tailscale/dev": pending
+
+  - name: override comment from a non-dev does not approve the override
+    pull_request:
+      author: carol
+      changed_files:
+        - tailcfg/tailcfg.go
+      comments:
+        - user: outsider
+          body: "policybot-override: I am not on the dev team"
+    expect:
+      rules:
+        "tailcfg changes overridden by another tailscale/dev": pending
+
+  - name: empty-reason policybot-override does not approve
+    pull_request:
+      author: carol
+      changed_files:
+        - tailcfg/tailcfg.go
+      comments:
+        - user: dave
+          body: "policybot-override:"
+    expect:
+      rules:
+        "tailcfg changes overridden by another tailscale/dev": pending
+
+  # Defaults regression guards: a normal review approval from a dev
+  # member must NOT silently approve the override rule. Same for a
+  # plain :+1: comment. Without the explicit `methods: github_review:
+  # false` / `comments: []` on the override rule, both would.
+  - name: a regular dev review does not silently satisfy the override rule
+    pull_request:
+      author: carol
+      changed_files:
+        - tailcfg/tailcfg.go
+      reviews:
+        - user: dave
+          state: approved
+    expect:
+      rules:
+        "tailcfg changes overridden by another tailscale/dev": pending
+
+  - name: a thumbs-up comment from a dev does not silently satisfy the override rule
+    pull_request:
+      author: carol
+      changed_files:
+        - tailcfg/tailcfg.go
+      comments:
+        - user: dave
+          body: ":+1:"
+    expect:
+      rules:
+        "tailcfg changes overridden by another tailscale/dev": pending
diff --git a/.policy.yml b/.policy.yml
new file mode 100644
index 000000000..cd91ccf75
--- /dev/null
+++ b/.policy.yml
@@ -0,0 +1,84 @@
+# Approval policy for this repository, enforced by policy-bot
+# (https://github.com/palantir/policy-bot) running at
+# https://policybot.corp.ts.net.
+#
+# This file replaces the role GitHub's CODEOWNERS played: when a pull
+# request touches a path covered by a rule below, policy-bot posts a
+# status check that blocks merging until the required reviewers approve.
+#
+# Policy and rule syntax reference:
+#   https://github.com/palantir/policy-bot/blob/develop/README.md
+# Example policy files (team-approval, disapproval, remote, etc.):
+#   https://github.com/palantir/policy-bot/tree/develop/config/policy-examples
+#
+# Do not add to this policy without wide discussion.
+# See https://github.com/tailscale/corp/issues/13972.
+
+policy:
+  approval:
+    # tailcfg/ has an extra gate: either a control-protocol-owners
+    # review or an explicit policybot-override: comment from a dev.
+    # The block is skipped on PRs that don't touch tailcfg/.
+    - or:
+        - tailcfg changes approved by control-protocol-owners
+        - tailcfg changes overridden by another tailscale/dev
+    # And every PR, regardless of files, needs a +1 from a dev.
+    # This rule also keeps the policy from collapsing into "all rules
+    # skipped" (which policy-bot treats as a failure) on non-tailcfg
+    # PRs.
+    - any tailscale/dev review
+
+approval_rules:
+  - name: tailcfg changes approved by control-protocol-owners
+    if:
+      changed_files:
+        paths:
+          - "^tailcfg/"
+    requires:
+      count: 1
+      teams:
+        - "tailscale/control-protocol-owners"
+
+  - name: tailcfg changes overridden by another tailscale/dev
+    description: |
+      Any member of @tailscale/dev (other than the PR author) can
+      override the control-protocol-owners requirement by leaving a
+      comment of the form
+
+          policybot-override: <reason>
+
+      on the pull request. The reason can be anything but should
+      explain why the override is appropriate; it stays in the PR
+      conversation as a record. The override comment also counts as
+      that developer's approval.
+    if:
+      changed_files:
+        paths:
+          - "^tailcfg/"
+    requires:
+      count: 1
+      teams:
+        - "tailscale/dev"
+    options:
+      methods:
+        # Explicitly turn off the defaults (github_review: true,
+        # comments: [":+1:", "👍"]) so the ONLY way to satisfy this
+        # rule is a "policybot-override:" comment. Otherwise a normal
+        # review approval or thumbs-up from any tailscale/dev member
+        # would silently pass the rule.
+        github_review: false
+        comments: []
+        comment_patterns:
+          - '^policybot-override: \S.*'
+
+  - name: any tailscale/dev review
+    description: |
+      Every PR needs at least one approval from a member of
+      @tailscale/dev. policy-bot's default approval methods count
+      a GitHub review approval, a ":+1:" comment, or a "👍"
+      comment as approval. The PR author cannot approve their
+      own PR.
+    requires:
+      count: 1
+      teams:
+        - "tailscale/dev"
diff --git a/CODEOWNERS b/CODEOWNERS
index af9b0d9f9..9da519f43 100644
--- a/CODEOWNERS
+++ b/CODEOWNERS
@@ -1 +1,7 @@
-/tailcfg/ @tailscale/control-protocol-owners
+# This repository does NOT use GitHub's CODEOWNERS for review enforcement.
+# Approval policies live in .policy.yml at the repository root and are
+# enforced by policy-bot (https://github.com/palantir/policy-bot).
+#
+# To change required reviewers for a path, edit .policy.yml.
+#
+# See https://github.com/tailscale/corp/issues/13972.
diff --git a/Makefile b/Makefile
index b78ef0469..bad81f6e7 100644
--- a/Makefile
+++ b/Makefile
@@ -10,7 +10,7 @@ vet: ## Run go vet
 
 tidy: ## Run go mod tidy and update nix flake hashes
 	./tool/go mod tidy
-	./update-flake.sh
+	./tool/go run ./tool/updateflakes
 
 lint: ## Run golangci-lint
 	./tool/go run github.com/golangci/golangci-lint/cmd/golangci-lint run
@@ -137,15 +137,66 @@ publishdevproxy: check-image-repo ## Build and publish k8s-proxy image to locati
 sshintegrationtest: ## Run the SSH integration tests in various Docker containers
 	@GOOS=linux GOARCH=amd64 CGO_ENABLED=0 ./tool/go test -tags integrationtest -c ./ssh/tailssh -o ssh/tailssh/testcontainers/tailssh.test && \
 	GOOS=linux GOARCH=amd64 CGO_ENABLED=0 ./tool/go build -o ssh/tailssh/testcontainers/tailscaled ./cmd/tailscaled && \
-	echo "Testing on ubuntu:focal" && docker build --build-arg="BASE=ubuntu:focal" -t ssh-ubuntu-focal ssh/tailssh/testcontainers && \
-	echo "Testing on ubuntu:jammy" && docker build --build-arg="BASE=ubuntu:jammy" -t ssh-ubuntu-jammy ssh/tailssh/testcontainers && \
-	echo "Testing on ubuntu:noble" && docker build --build-arg="BASE=ubuntu:noble" -t ssh-ubuntu-noble ssh/tailssh/testcontainers && \
-	echo "Testing on alpine:latest" && docker build --build-arg="BASE=alpine:latest" -t ssh-alpine-latest ssh/tailssh/testcontainers
+	echo "Testing on ubuntu:focal, ubuntu:jammy, ubuntu:noble, alpine:latest (in parallel)" && \
+	docker build --build-arg="BASE=ubuntu:focal" -t ssh-ubuntu-focal ssh/tailssh/testcontainers & \
+	docker build --build-arg="BASE=ubuntu:jammy" -t ssh-ubuntu-jammy ssh/tailssh/testcontainers & \
+	docker build --build-arg="BASE=ubuntu:noble" -t ssh-ubuntu-noble ssh/tailssh/testcontainers & \
+	docker build --build-arg="BASE=alpine:latest" -t ssh-alpine-latest ssh/tailssh/testcontainers & \
+	wait
 
 .PHONY: generate
 generate: ## Generate code
 	./tool/go generate ./...
 
+.PHONY: tsapp-build-and-flash-pi
+tsapp-build-and-flash-pi: ## Build a tsapp-pi.arm64 GAF from HEAD and flash a local SD card (macOS auto-detects the disk; pass DISK=/dev/sdX on Linux)
+	cd gokrazy && ../tool/go run build.go --gaf --app=tsapp-pi.arm64
+	./tool/go run --exec=sudo ./cmd/tailscale configure flash-appliance \
+		--variant=pi-arm64 \
+		--gaf=gokrazy/tsapp-pi.arm64.gaf \
+		$(if $(DISK),--disk=$(DISK)) \
+		$(if $(wildcard $(HOME)/.ssh/id_ed25519.pub),--add-ssh-authorized-keys=$(HOME)/.ssh/id_ed25519.pub)
+
+.PHONY: tsapp-qemu-pi
+tsapp-qemu-pi: ## Build tsapp-pi.arm64 and boot it under qemu-system-aarch64 with a framebuffer GUI window and working network (requires mtools, dtc, qemu-efi-aarch64)
+	cd gokrazy && ../tool/go run build.go --build --app=tsapp-pi.arm64
+	# Extract the kernel from the FAT boot partition for direct -kernel boot.
+	rm -f gokrazy/tsapp-pi.arm64.vmlinuz
+	mcopy -i gokrazy/tsapp-pi.arm64.img@@4194304 ::vmlinuz gokrazy/tsapp-pi.arm64.vmlinuz
+	# Use the "virt" machine (not raspi3b) because it provides working
+	# PCI e1000 networking and, with UEFI firmware, an EFI framebuffer
+	# via the ramfb device. The raspi3b machine's USB NIC emulation is
+	# too broken for DHCP and its SoC watchdog reboots the guest.
+	#
+	# Find the UEFI firmware. Common paths:
+	#   Debian/Ubuntu: /usr/share/qemu-efi-aarch64/QEMU_EFI.fd
+	#   Homebrew:      /opt/homebrew/share/qemu/edk2-aarch64-code.fd
+	#   Fedora:        /usr/share/edk2/aarch64/QEMU_EFI.fd
+	QEMU_EFI=$$(for f in \
+		/usr/share/qemu-efi-aarch64/QEMU_EFI.fd \
+		/opt/homebrew/share/qemu/edk2-aarch64-code.fd \
+		/usr/share/edk2/aarch64/QEMU_EFI.fd \
+		$$(dirname $$(which qemu-system-aarch64))/../share/qemu/edk2-aarch64-code.fd; do \
+		[ -f "$$f" ] && echo "$$f" && break; \
+	done) && \
+	[ -n "$$QEMU_EFI" ] || { echo "error: cannot find QEMU EFI firmware (install qemu-efi-aarch64)"; exit 1; } && \
+	qemu-system-aarch64 \
+		-M virt -cpu cortex-a53 -m 1G \
+		-bios "$$QEMU_EFI" \
+		-device ramfb \
+		-device e1000,netdev=net0 -netdev user,id=net0 \
+		-kernel gokrazy/tsapp-pi.arm64.vmlinuz \
+		-append "console=ttyAMA0,115200 nowatchdog gokrazy.log_to_serial=1 root=PARTUUID=60c24cc1-f3f9-427a-8199-dd02023b0001/PARTNROFF=1 ro init=/gokrazy/init rootwait" \
+		-drive file=gokrazy/tsapp-pi.arm64.img,format=raw,if=none,id=disk0 \
+		-device virtio-blk-device,drive=disk0 \
+		-serial mon:stdio
+
+.PHONY: tsapp-push-pi
+tsapp-push-pi: ## Build a tsapp-pi.arm64 GAF from HEAD and push it to a running Pi over the network (pass PI=<ip>)
+	@[ -n "$(PI)" ] || { echo "usage: make tsapp-push-pi PI=<ip-address>"; exit 1; }
+	cd gokrazy && ../tool/go run build.go --gaf --app=tsapp-pi.arm64
+	./tool/go run ./gokrazy/gafpush --gaf=gokrazy/tsapp-pi.arm64.gaf --pi=$(PI)
+
 .PHONY: pin-github-actions
 pin-github-actions:
 	./tool/go tool github.com/stacklok/frizbee actions .github/workflows
diff --git a/VERSION.txt b/VERSION.txt
index acbb747ac..e402df2dd 100644
--- a/VERSION.txt
+++ b/VERSION.txt
@@ -1 +1 @@
-1.97.0
+1.103.0
diff --git a/appc/appconnector_test.go b/appc/appconnector_test.go
index d14ef68fc..c58aa8041 100644
--- a/appc/appconnector_test.go
+++ b/appc/appconnector_test.go
@@ -736,6 +736,7 @@ func TestRateLogger(t *testing.T) {
 }
 
 func TestRouteStoreMetrics(t *testing.T) {
+	clientmetric.ResetForTest(t)
 	metricStoreRoutes(1, 1)
 	metricStoreRoutes(1, 1)         // the 1 buckets value should be 2
 	metricStoreRoutes(5, 5)         // the 5 buckets value should be 1
diff --git a/appc/conn25.go b/appc/conn25.go
index fd1748fa6..e4c999a7a 100644
--- a/appc/conn25.go
+++ b/appc/conn25.go
@@ -5,18 +5,20 @@ package appc
 
 import (
 	"cmp"
+	"fmt"
 	"slices"
+	"strings"
 
 	"tailscale.com/ipn/ipnext"
 	"tailscale.com/tailcfg"
 	"tailscale.com/types/appctype"
-	"tailscale.com/util/mak"
+	"tailscale.com/types/dnstype"
 	"tailscale.com/util/set"
 )
 
 const AppConnectorsExperimentalAttrName = "tailscale.com/app-connectors-experimental"
 
-func isEligibleConnector(peer tailcfg.NodeView) bool {
+func isPeerEligibleConnector(peer tailcfg.NodeView) bool {
 	if !peer.Valid() || !peer.Hostinfo().Valid() {
 		return false
 	}
@@ -39,7 +41,7 @@ func sortByPreference(ns []tailcfg.NodeView) {
 func PickConnector(nb ipnext.NodeBackend, app appctype.Conn25Attr) []tailcfg.NodeView {
 	appTagsSet := set.SetOf(app.Connectors)
 	matches := nb.AppendMatchingPeers(nil, func(n tailcfg.NodeView) bool {
-		if !isEligibleConnector(n) {
+		if !isPeerEligibleConnector(n) {
 			return false
 		}
 		for _, t := range n.Tags().All() {
@@ -53,50 +55,32 @@ func PickConnector(nb ipnext.NodeBackend, app appctype.Conn25Attr) []tailcfg.Nod
 	return matches
 }
 
-// PickSplitDNSPeers looks at the netmap peers capabilities and finds which peers
-// want to be connectors for which domains.
-func PickSplitDNSPeers(hasCap func(c tailcfg.NodeCapability) bool, self tailcfg.NodeView, peers map[tailcfg.NodeID]tailcfg.NodeView) map[string][]tailcfg.NodeView {
-	var m map[string][]tailcfg.NodeView
+// DNSAddrScheme is the custom URI scheme used for conn25-managed split DNS
+// entries to determine the destination at query time rather than configuration
+// time.
+const DNSAddrScheme = "tailscale-app"
+
+func AppDNSRoutes(hasCap func(c tailcfg.NodeCapability) bool, self tailcfg.NodeView) map[string][]*dnstype.Resolver {
 	if !hasCap(AppConnectorsExperimentalAttrName) {
-		return m
+		return nil
 	}
 	apps, err := tailcfg.UnmarshalNodeCapViewJSON[appctype.AppConnectorAttr](self.CapMap(), AppConnectorsExperimentalAttrName)
 	if err != nil {
-		return m
+		return nil
 	}
-	tagToDomain := make(map[string][]string)
+	appNamesByDomain := map[string]string{}
 	for _, app := range apps {
-		for _, tag := range app.Connectors {
-			tagToDomain[tag] = append(tagToDomain[tag], app.Domains...)
+		for _, domain := range app.Domains {
+			domain, _ = strings.CutPrefix(domain, "*.")
+			domain = strings.ToLower(domain)
+			// in the case of multiple apps specifying the same domain (which is misconfiguration
+			// that should be validated at point of input) last write wins.
+			appNamesByDomain[domain] = app.Name
 		}
 	}
-	// NodeIDs are Comparable, and we have a map of NodeID to NodeView anyway, so
-	// use a Set of NodeIDs to deduplicate, and populate into a []NodeView later.
-	var work map[string]set.Set[tailcfg.NodeID]
-	for _, peer := range peers {
-		if !isEligibleConnector(peer) {
-			continue
-		}
-		for _, t := range peer.Tags().All() {
-			domains := tagToDomain[t]
-			for _, domain := range domains {
-				if work[domain] == nil {
-					mak.Set(&work, domain, set.Set[tailcfg.NodeID]{})
-				}
-				work[domain].Add(peer.ID())
-			}
-		}
-	}
-
-	// Populate m. Make a []tailcfg.NodeView from []tailcfg.NodeID using the peers map.
-	// And sort it to our preference.
-	for domain, ids := range work {
-		nodes := make([]tailcfg.NodeView, 0, ids.Len())
-		for id := range ids {
-			nodes = append(nodes, peers[id])
-		}
-		sortByPreference(nodes)
-		mak.Set(&m, domain, nodes)
+	m := make(map[string][]*dnstype.Resolver, len(appNamesByDomain))
+	for domain, appName := range appNamesByDomain {
+		m[domain] = []*dnstype.Resolver{{Addr: fmt.Sprintf("%s:%s", DNSAddrScheme, appName), UseWithExitNode: true}}
 	}
 	return m
 }
diff --git a/appc/conn25_test.go b/appc/conn25_test.go
index fc14caf36..7194a67fe 100644
--- a/appc/conn25_test.go
+++ b/appc/conn25_test.go
@@ -5,17 +5,18 @@ package appc
 
 import (
 	"encoding/json"
-	"reflect"
+	"fmt"
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
 	"tailscale.com/ipn/ipnext"
 	"tailscale.com/tailcfg"
 	"tailscale.com/types/appctype"
+	"tailscale.com/types/dnstype"
 	"tailscale.com/types/opt"
 )
 
-func TestPickSplitDNSPeers(t *testing.T) {
+func TestAppDNSRoutes(t *testing.T) {
 	getBytesForAttr := func(name string, domains []string, tags []string) []byte {
 		attr := appctype.AppConnectorAttr{
 			Name:       name,
@@ -32,83 +33,105 @@ func TestPickSplitDNSPeers(t *testing.T) {
 	appTwoBytes := getBytesForAttr("app2", []string{"a.example.com"}, []string{"tag:two"})
 	appThreeBytes := getBytesForAttr("app3", []string{"woo.b.example.com", "hoo.b.example.com"}, []string{"tag:three1", "tag:three2"})
 	appFourBytes := getBytesForAttr("app4", []string{"woo.b.example.com", "c.example.com"}, []string{"tag:four1", "tag:four2"})
+	appFiveBytes := getBytesForAttr("app5", []string{"*.example.com", "example.com"}, []string{"tag:one"})
+	appSixBytes := getBytesForAttr("app6", []string{"*.Example.com", "EXAMPLE.com", "EXAMPLE.COM"}, []string{"tag:one"})
 
-	makeNodeView := func(id tailcfg.NodeID, name string, tags []string) tailcfg.NodeView {
-		return (&tailcfg.Node{
-			ID:       id,
-			Name:     name,
-			Tags:     tags,
-			Hostinfo: (&tailcfg.Hostinfo{AppConnector: opt.NewBool(true)}).View(),
-		}).View()
+	resolver := func(appName string) []*dnstype.Resolver {
+		return []*dnstype.Resolver{{Addr: fmt.Sprintf("%s:%s", DNSAddrScheme, appName), UseWithExitNode: true}}
 	}
-	nvp1 := makeNodeView(1, "p1", []string{"tag:one"})
-	nvp2 := makeNodeView(2, "p2", []string{"tag:four1", "tag:four2"})
-	nvp3 := makeNodeView(3, "p3", []string{"tag:two", "tag:three1"})
-	nvp4 := makeNodeView(4, "p4", []string{"tag:two", "tag:three2", "tag:four2"})
 
 	for _, tt := range []struct {
 		name   string
-		want   map[string][]tailcfg.NodeView
-		peers  []tailcfg.NodeView
+		hasCap bool
 		config []tailcfg.RawMessage
+		want   map[string][]*dnstype.Resolver
 	}{
 		{
-			name: "empty",
+			name:   "no-capability", // hasCap false should return nil regardless of config.
+			hasCap: false,
 		},
 		{
-			name:   "bad-config", // bad config should return a nil map rather than error.
+			name:   "no-apps", // hasCap true but no configured apps returns an empty map.
+			hasCap: true,
+			want:   map[string][]*dnstype.Resolver{},
+		},
+		{
+			name:   "bad-config", // bad config should return nil rather than error.
+			hasCap: true,
 			config: []tailcfg.RawMessage{tailcfg.RawMessage(`hey`)},
 		},
 		{
-			name:   "no-peers",
+			name:   "single-app",
+			hasCap: true,
 			config: []tailcfg.RawMessage{tailcfg.RawMessage(appOneBytes)},
-		},
-		{
-			name:   "peers-that-are-not-connectors",
-			config: []tailcfg.RawMessage{tailcfg.RawMessage(appOneBytes)},
-			peers: []tailcfg.NodeView{
-				(&tailcfg.Node{
-					ID:   5,
-					Name: "p5",
-					Tags: []string{"tag:one"},
-				}).View(),
-				(&tailcfg.Node{
-					ID:   6,
-					Name: "p6",
-					Tags: []string{"tag:one"},
-				}).View(),
+			want: map[string][]*dnstype.Resolver{
+				"example.com": resolver("app1"),
 			},
 		},
 		{
-			name:   "peers-that-dont-match-tags",
-			config: []tailcfg.RawMessage{tailcfg.RawMessage(appOneBytes)},
-			peers: []tailcfg.NodeView{
-				makeNodeView(5, "p5", []string{"tag:seven"}),
-				makeNodeView(6, "p6", nil),
+			name:   "single-app-multi-domain",
+			hasCap: true,
+			config: []tailcfg.RawMessage{tailcfg.RawMessage(appThreeBytes)},
+			want: map[string][]*dnstype.Resolver{
+				"woo.b.example.com": resolver("app3"),
+				"hoo.b.example.com": resolver("app3"),
 			},
 		},
 		{
-			name: "matching-tagged-connector-peers",
+			name:   "multi-app-no-overlap",
+			hasCap: true,
 			config: []tailcfg.RawMessage{
 				tailcfg.RawMessage(appOneBytes),
 				tailcfg.RawMessage(appTwoBytes),
-				tailcfg.RawMessage(appThreeBytes),
-				tailcfg.RawMessage(appFourBytes),
 			},
-			peers: []tailcfg.NodeView{
-				nvp1,
-				nvp2,
-				nvp3,
-				nvp4,
-				makeNodeView(5, "p5", nil),
+			want: map[string][]*dnstype.Resolver{
+				"example.com":   resolver("app1"),
+				"a.example.com": resolver("app2"),
 			},
-			want: map[string][]tailcfg.NodeView{
-				// p5 has no matching tags and so doesn't appear
-				"example.com":       {nvp1},
-				"a.example.com":     {nvp3, nvp4},
-				"woo.b.example.com": {nvp2, nvp3, nvp4},
-				"hoo.b.example.com": {nvp3, nvp4},
-				"c.example.com":     {nvp2, nvp4},
+		},
+		{
+			name:   "domain-collision-last-write-wins",
+			hasCap: true,
+			config: []tailcfg.RawMessage{
+				tailcfg.RawMessage(appThreeBytes), // app3: woo.b.example.com, hoo.b.example.com
+				tailcfg.RawMessage(appFourBytes),  // app4: woo.b.example.com, c.example.com
+			},
+			want: map[string][]*dnstype.Resolver{
+				// app4 overwrites app3 for the shared domain
+				"woo.b.example.com": resolver("app4"),
+				"hoo.b.example.com": resolver("app3"),
+				"c.example.com":     resolver("app4"),
+			},
+		},
+		{
+			name:   "wildcards-are-stripped-and-deduped",
+			hasCap: true,
+			config: []tailcfg.RawMessage{tailcfg.RawMessage(appFiveBytes)},
+			want: map[string][]*dnstype.Resolver{
+				// *.example.com and example.com should both normalize to example.com.
+				"example.com": resolver("app5"),
+			},
+		},
+		{
+			name:   "domains-are-normalized-and-deduped",
+			hasCap: true,
+			config: []tailcfg.RawMessage{tailcfg.RawMessage(appSixBytes)},
+			want: map[string][]*dnstype.Resolver{
+				// *.Example.com, EXAMPLE.com, EXAMPLE.COM should all normalize to example.com.
+				"example.com": resolver("app6"),
+			},
+		},
+		{
+			name:   "sub-domains-and-top-domains-do-not-collide",
+			hasCap: true,
+			config: []tailcfg.RawMessage{
+				tailcfg.RawMessage(appTwoBytes),
+				tailcfg.RawMessage(appFiveBytes),
+			},
+			want: map[string][]*dnstype.Resolver{
+				// *.example.com normalizes to example.com; a.example.com remains distinct.
+				"a.example.com": resolver("app2"),
+				"example.com":   resolver("app5"),
 			},
 		},
 	} {
@@ -120,15 +143,11 @@ func TestPickSplitDNSPeers(t *testing.T) {
 				}
 			}
 			selfView := selfNode.View()
-			peers := map[tailcfg.NodeID]tailcfg.NodeView{}
-			for _, p := range tt.peers {
-				peers[p.ID()] = p
-			}
-			got := PickSplitDNSPeers(func(_ tailcfg.NodeCapability) bool {
-				return true
-			}, selfView, peers)
-			if !reflect.DeepEqual(got, tt.want) {
-				t.Fatalf("got %v, want %v", got, tt.want)
+			got := AppDNSRoutes(func(_ tailcfg.NodeCapability) bool {
+				return tt.hasCap
+			}, selfView)
+			if diff := cmp.Diff(tt.want, got); diff != "" {
+				t.Fatalf("AppDNSRoutes (-want, +got):\n%s", diff)
 			}
 		})
 	}
diff --git a/build_dist.sh b/build_dist.sh
index c05644711..a32fe419e 100755
--- a/build_dist.sh
+++ b/build_dist.sh
@@ -51,6 +51,13 @@ while [ "$#" -gt 1 ]; do
 		ldflags="$ldflags -w -s"
 		tags="${tags:+$tags,},$(GOOS= GOARCH= $go run ./cmd/featuretags --min)"
 		;;
+	--strip)
+		# --min overrides your flags, when you're using custom tags and want to
+		# additionally strip symbols to help reduce the size, this is the easiest
+		# way to do it.
+		shift
+		ldflags="$ldflags -w -s"
+		;;
 	--box)
 		if [ ! -z "${TAGS:-}" ]; then
 			echo "set either --box or \$TAGS, but not both"
diff --git a/cache_key_test.go b/cache_key_test.go
new file mode 100644
index 000000000..43de02e13
--- /dev/null
+++ b/cache_key_test.go
@@ -0,0 +1,57 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package tailscaleroot
+
+import (
+	"os"
+	"os/exec"
+	"strings"
+	"testing"
+
+	"tailscale.com/util/cibuild"
+)
+
+// TestTsgoRevInCacheKey verifies that the Tailscale Go toolchain's git
+// revision (from go.toolchain.rev) is blended into Go build cache keys.
+// Without this, bumping the toolchain to a new commit that doesn't change
+// the Go version number would silently reuse stale cached build artifacts.
+//
+// See https://github.com/tailscale/tailscale/issues/36589.
+func TestTsgoRevInCacheKey(t *testing.T) {
+	goRoot := goEnv(t, "GOROOT")
+	isTsgo := strings.Contains(goRoot, "/.cache/tsgo/")
+	if !cibuild.OnTailscaleCI() && !isTsgo {
+		t.Skip("skipping; not in Tailscale CI and not using the Tailscale Go toolchain")
+	}
+
+	rev := strings.TrimSpace(GoToolchainRev)
+	if rev == "" {
+		t.Fatal("go.toolchain.rev is empty")
+	}
+
+	// Build the small stdlib "errors" package with GODEBUG=gocachehash=1,
+	// which causes cmd/go to log its cache key computations to stderr.
+	cmd := exec.Command("go", "build", "errors")
+	cmd.Env = append(os.Environ(), "GODEBUG=gocachehash=1")
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("go build errors failed: %v\n%s", err, out)
+	}
+
+	// The cache key output should contain the toolchain rev alongside the
+	// Go version, e.g.:
+	//   HASH[moduleIndex]: "go1.26.2 dfe2a5fd8ee2e68b08ce5ff259269f50ecadf2f4"
+	if !strings.Contains(string(out), rev) {
+		t.Errorf("go.toolchain.rev %q not found in GODEBUG=gocachehash=1 output:\n%s", rev, out)
+	}
+}
+
+func goEnv(t *testing.T, key string) string {
+	t.Helper()
+	out, err := exec.Command("go", "env", key).Output()
+	if err != nil {
+		t.Fatalf("go env %s: %v", key, err)
+	}
+	return strings.TrimSpace(string(out))
+}
diff --git a/client/local/cert.go b/client/local/cert.go
index 701bfe026..0ce56b74f 100644
--- a/client/local/cert.go
+++ b/client/local/cert.go
@@ -10,13 +10,55 @@ import (
 	"crypto/tls"
 	"errors"
 	"fmt"
+	"net/http"
 	"net/url"
+	"strconv"
 	"strings"
 	"time"
 
 	"go4.org/mem"
 )
 
+// rateLimitedError is returned from cert-fetching methods when the
+// upstream ACME CA reported a rate limit. Callers should unpack it via
+// [RateLimitRetryAfter].
+type rateLimitedError struct {
+	retryAfter time.Duration
+	underlying error
+}
+
+func (e rateLimitedError) Error() string { return e.underlying.Error() }
+func (e rateLimitedError) Unwrap() error { return e.underlying }
+
+// RateLimitRetryAfter reports whether err was a rate-limit failure from
+// the upstream ACME CA and, if so, returns the CA's suggested wait
+// (zero if none was provided).
+func RateLimitRetryAfter(err error) (retryAfter time.Duration, ok bool) {
+	var rl rateLimitedError
+	if errors.As(err, &rl) {
+		return rl.retryAfter, true
+	}
+	return 0, false
+}
+
+// retryAfterFromHeader parses a Retry-After header, matching the
+// delta-seconds + HTTP-date pattern in tempfork/acme/http.go.
+func retryAfterFromHeader(h http.Header) time.Duration {
+	v := h.Get("Retry-After")
+	if i, err := strconv.Atoi(v); err == nil {
+		return time.Duration(i) * time.Second
+	}
+	t, err := http.ParseTime(v)
+	if err != nil {
+		return 0
+	}
+	d := time.Until(t)
+	if d < 0 {
+		return 0
+	}
+	return d
+}
+
 // SetDNS adds a DNS TXT record for the given domain name, containing
 // the provided TXT value. The intended use case is answering
 // LetsEncrypt/ACME dns-01 challenges.
@@ -43,6 +85,8 @@ func (lc *Client) SetDNS(ctx context.Context, name, value string) error {
 //
 // It returns a cached certificate from disk if it's still valid.
 //
+// Rate-limit failures can be identified via [RateLimitRetryAfter].
+//
 // Deprecated: use [Client.CertPair].
 func CertPair(ctx context.Context, domain string) (certPEM, keyPEM []byte, err error) {
 	return defaultClient.CertPair(ctx, domain)
@@ -52,6 +96,8 @@ func CertPair(ctx context.Context, domain string) (certPEM, keyPEM []byte, err e
 //
 // It returns a cached certificate from disk if it's still valid.
 //
+// Rate-limit failures can be identified via [RateLimitRetryAfter].
+//
 // API maturity: this is considered a stable API.
 func (lc *Client) CertPair(ctx context.Context, domain string) (certPEM, keyPEM []byte, err error) {
 	return lc.CertPairWithValidity(ctx, domain, 0)
@@ -65,10 +111,18 @@ func (lc *Client) CertPair(ctx context.Context, domain string) (certPEM, keyPEM
 // least the given duration, if permitted by the CA. If the certificate is
 // valid, but for less than minValidity, it will be synchronously renewed.
 //
+// Rate-limit failures can be identified via [RateLimitRetryAfter].
+//
 // API maturity: this is considered a stable API.
 func (lc *Client) CertPairWithValidity(ctx context.Context, domain string, minValidity time.Duration) (certPEM, keyPEM []byte, err error) {
 	res, err := lc.send(ctx, "GET", fmt.Sprintf("/localapi/v0/cert/%s?type=pair&min_validity=%s", domain, minValidity), 200, nil)
 	if err != nil {
+		if hse, ok := errors.AsType[httpStatusError](err); ok && hse.HTTPStatus == http.StatusTooManyRequests {
+			return nil, nil, rateLimitedError{
+				retryAfter: retryAfterFromHeader(hse.Header),
+				underlying: err,
+			}
+		}
 		return nil, nil, err
 	}
 	// with ?type=pair, the response PEM is first the one private
diff --git a/client/local/debugportmapper.go b/client/local/debugportmapper.go
index 1cbb3ee0a..869462e64 100644
--- a/client/local/debugportmapper.go
+++ b/client/local/debugportmapper.go
@@ -50,6 +50,9 @@ type DebugPortmapOpts struct {
 // process.
 //
 // opts can be nil; if so, default values will be used.
+//
+// API maturity: this method is not considered a stable API and is
+// subject to change between releases.
 func (lc *Client) DebugPortmap(ctx context.Context, opts *DebugPortmapOpts) (io.ReadCloser, error) {
 	vals := make(url.Values)
 	if opts == nil {
diff --git a/client/local/local.go b/client/local/local.go
index e72589306..889fafd65 100644
--- a/client/local/local.go
+++ b/client/local/local.go
@@ -2,6 +2,12 @@
 // SPDX-License-Identifier: BSD-3-Clause
 
 // Package local contains a Go client for the Tailscale LocalAPI.
+//
+// The APIs in this package vary in maturity: some methods are considered
+// stable APIs and are documented as such, while others are not necessarily
+// stable and are subject to change between releases. Methods without an
+// explicit "API maturity" note in their documentation should be assumed
+// to be unstable.
 package local
 
 import (
@@ -135,6 +141,9 @@ func (lc *Client) defaultDialer(ctx context.Context, network, addr string) (net.
 // authenticating to the local Tailscale daemon vary by platform.
 //
 // DoLocalRequest may mutate the request to add Authorization headers.
+//
+// API maturity: this method is not considered a stable API and is
+// subject to change between releases.
 func (lc *Client) DoLocalRequest(req *http.Request) (*http.Response, error) {
 	req.Header.Set("Tailscale-Cap", strconv.Itoa(int(tailcfg.CurrentCapabilityVersion)))
 	lc.tsClientOnce.Do(func() {
@@ -280,7 +289,7 @@ func (lc *Client) sendWithHeaders(
 	}
 	if res.StatusCode != wantStatus {
 		err = fmt.Errorf("%v: %s", res.Status, bytes.TrimSpace(slurp))
-		return nil, nil, httpStatusError{bestError(err, slurp), res.StatusCode}
+		return nil, nil, httpStatusError{bestError(err, slurp), res.StatusCode, res.Header}
 	}
 	return slurp, res.Header, nil
 }
@@ -288,6 +297,7 @@ func (lc *Client) sendWithHeaders(
 type httpStatusError struct {
 	error
 	HTTPStatus int
+	Header     http.Header
 }
 
 func (lc *Client) get200(ctx context.Context, path string) ([]byte, error) {
@@ -316,6 +326,8 @@ func decodeJSON[T any](b []byte) (ret T, err error) {
 // For connections proxied by tailscaled, this looks up the owner of the given
 // address as TCP first, falling back to UDP; if you want to only check a
 // specific address family, use WhoIsProto.
+//
+// API maturity: this is considered a stable API.
 func (lc *Client) WhoIs(ctx context.Context, remoteAddr string) (*apitype.WhoIsResponse, error) {
 	body, err := lc.get200(ctx, "/localapi/v0/whois?addr="+url.QueryEscape(remoteAddr))
 	if err != nil {
@@ -327,6 +339,39 @@ func (lc *Client) WhoIs(ctx context.Context, remoteAddr string) (*apitype.WhoIsR
 	return decodeJSON[*apitype.WhoIsResponse](body)
 }
 
+// WhoIsForService is like [Client.WhoIs] but scopes the returned CapMap to
+// capabilities that apply to the named VIP service. This enables per-service
+// capability resolution on hosts that advertise multiple VIP services.
+//
+// API maturity: this is considered a stable API.
+func (lc *Client) WhoIsForService(ctx context.Context, remoteAddr string, svcName tailcfg.ServiceName) (*apitype.WhoIsResponse, error) {
+	body, err := lc.get200(ctx, "/localapi/v0/whois?addr="+url.QueryEscape(remoteAddr)+"&svc_name="+url.QueryEscape(string(svcName)))
+	if err != nil {
+		if hs, ok := err.(httpStatusError); ok && hs.HTTPStatus == http.StatusNotFound {
+			return nil, ErrPeerNotFound
+		}
+		return nil, err
+	}
+	return decodeJSON[*apitype.WhoIsResponse](body)
+}
+
+// WhoIsForIP is like [Client.WhoIs] but scopes the returned CapMap to
+// capabilities that apply to the given destination IP. The IP may be a
+// VIP service address, the node's own tailnet address, or any other
+// routable IP the node handles.
+//
+// API maturity: this is considered a stable API.
+func (lc *Client) WhoIsForIP(ctx context.Context, remoteAddr string, dst netip.Addr) (*apitype.WhoIsResponse, error) {
+	body, err := lc.get200(ctx, "/localapi/v0/whois?addr="+url.QueryEscape(remoteAddr)+"&dst_ip="+url.QueryEscape(dst.String()))
+	if err != nil {
+		if hs, ok := err.(httpStatusError); ok && hs.HTTPStatus == http.StatusNotFound {
+			return nil, ErrPeerNotFound
+		}
+		return nil, err
+	}
+	return decodeJSON[*apitype.WhoIsResponse](body)
+}
+
 // ErrPeerNotFound is returned by [Client.WhoIs], [Client.WhoIsNodeKey] and
 // [Client.WhoIsProto] when a peer is not found.
 var ErrPeerNotFound = errors.New("peer not found")
@@ -334,6 +379,8 @@ var ErrPeerNotFound = errors.New("peer not found")
 // WhoIsNodeKey returns the owner of the given wireguard public key.
 //
 // If not found, the error is ErrPeerNotFound.
+//
+// API maturity: this is considered a stable API.
 func (lc *Client) WhoIsNodeKey(ctx context.Context, key key.NodePublic) (*apitype.WhoIsResponse, error) {
 	body, err := lc.get200(ctx, "/localapi/v0/whois?addr="+url.QueryEscape(key.String()))
 	if err != nil {
@@ -349,6 +396,8 @@ func (lc *Client) WhoIsNodeKey(ctx context.Context, key key.NodePublic) (*apityp
 // IP:port, for the given protocol (tcp or udp).
 //
 // If not found, the error is [ErrPeerNotFound].
+//
+// API maturity: this is considered a stable API.
 func (lc *Client) WhoIsProto(ctx context.Context, proto, remoteAddr string) (*apitype.WhoIsResponse, error) {
 	body, err := lc.get200(ctx, "/localapi/v0/whois?proto="+url.QueryEscape(proto)+"&addr="+url.QueryEscape(remoteAddr))
 	if err != nil {
@@ -425,6 +474,9 @@ func (lc *Client) SetGauge(ctx context.Context, name string, value int) error {
 
 // TailDaemonLogs returns a stream the Tailscale daemon's logs as they arrive.
 // Close the context to stop the stream.
+//
+// API maturity: this method is not considered a stable API and is
+// subject to change between releases.
 func (lc *Client) TailDaemonLogs(ctx context.Context) (io.Reader, error) {
 	req, err := http.NewRequestWithContext(ctx, "GET", "http://"+apitype.LocalAPIHost+"/localapi/v0/logtap", nil)
 	if err != nil {
@@ -441,12 +493,18 @@ func (lc *Client) TailDaemonLogs(ctx context.Context) (io.Reader, error) {
 }
 
 // EventBusGraph returns a graph of active publishers and subscribers in the eventbus
-// as a [eventbus.DebugTopics]
+// as a [eventbus.DebugTopics].
+//
+// API maturity: this method is not considered a stable API and is
+// subject to change between releases.
 func (lc *Client) EventBusGraph(ctx context.Context) ([]byte, error) {
 	return lc.get200(ctx, "/localapi/v0/debug-bus-graph")
 }
 
 // EventBusQueues returns a JSON snapshot of event bus queue depths per client.
+//
+// API maturity: this method is not considered a stable API and is
+// subject to change between releases.
 func (lc *Client) EventBusQueues(ctx context.Context) ([]byte, error) {
 	return lc.get200(ctx, "/localapi/v0/debug-bus-queues")
 }
@@ -455,6 +513,9 @@ func (lc *Client) EventBusQueues(ctx context.Context) ([]byte, error) {
 // Each pair is a valid event and a nil error, or a zero event a non-nil error.
 // In case of error, the iterator ends after the pair reporting the error.
 // Iteration stops if ctx ends.
+//
+// API maturity: this method is not considered a stable API and is
+// subject to change between releases.
 func (lc *Client) StreamBusEvents(ctx context.Context) iter.Seq2[eventbus.DebugEvent, error] {
 	return func(yield func(eventbus.DebugEvent, error) bool) {
 		req, err := http.NewRequestWithContext(ctx, "GET",
@@ -523,6 +584,8 @@ type BugReportOpts struct {
 //
 // The opts type specifies options to pass to the Tailscale daemon when
 // generating this bug report.
+//
+// API maturity: this is considered a stable API.
 func (lc *Client) BugReportWithOpts(ctx context.Context, opts BugReportOpts) (string, error) {
 	qparams := make(url.Values)
 	if opts.Note != "" {
@@ -568,12 +631,17 @@ func (lc *Client) BugReportWithOpts(ctx context.Context, opts BugReportOpts) (st
 //
 // This is the same as calling [Client.BugReportWithOpts] and only specifying the Note
 // field.
+//
+// API maturity: this is considered a stable API.
 func (lc *Client) BugReport(ctx context.Context, note string) (string, error) {
 	return lc.BugReportWithOpts(ctx, BugReportOpts{Note: note})
 }
 
 // DebugAction invokes a debug action, such as "rebind" or "restun".
-// These are development tools and subject to change or removal over time.
+// These are development tools.
+//
+// API maturity: this method is not considered a stable API and is
+// subject to change or removal between releases.
 func (lc *Client) DebugAction(ctx context.Context, action string) error {
 	body, err := lc.send(ctx, "POST", "/localapi/v0/debug?action="+url.QueryEscape(action), 200, nil)
 	if err != nil {
@@ -584,7 +652,10 @@ func (lc *Client) DebugAction(ctx context.Context, action string) error {
 
 // DebugActionBody invokes a debug action with a body parameter, such as
 // "debug-force-prefer-derp".
-// These are development tools and subject to change or removal over time.
+// These are development tools.
+//
+// API maturity: this method is not considered a stable API and is
+// subject to change or removal between releases.
 func (lc *Client) DebugActionBody(ctx context.Context, action string, rbody io.Reader) error {
 	body, err := lc.send(ctx, "POST", "/localapi/v0/debug?action="+url.QueryEscape(action), 200, rbody)
 	if err != nil {
@@ -594,7 +665,10 @@ func (lc *Client) DebugActionBody(ctx context.Context, action string, rbody io.R
 }
 
 // DebugResultJSON invokes a debug action and returns its result as something JSON-able.
-// These are development tools and subject to change or removal over time.
+// These are development tools.
+//
+// API maturity: this method is not considered a stable API and is
+// subject to change or removal between releases.
 func (lc *Client) DebugResultJSON(ctx context.Context, action string) (any, error) {
 	body, err := lc.send(ctx, "POST", "/localapi/v0/debug?action="+url.QueryEscape(action), 200, nil)
 	if err != nil {
@@ -607,6 +681,27 @@ func (lc *Client) DebugResultJSON(ctx context.Context, action string) (any, erro
 	return x, nil
 }
 
+// GetDebugResultJSON invokes a debug action and decodes the JSON response
+// into a value of type T. It avoids the marshal/unmarshal roundtrip that
+// callers of [Client.DebugResultJSON] otherwise need to do to get a typed
+// value.
+//
+// These are development tools.
+//
+// API maturity: this function is not considered a stable API and is
+// subject to change or removal between releases.
+func GetDebugResultJSON[T any](ctx context.Context, lc *Client, action string) (T, error) {
+	var v T
+	body, err := lc.send(ctx, "POST", "/localapi/v0/debug?action="+url.QueryEscape(action), 200, nil)
+	if err != nil {
+		return v, fmt.Errorf("error %w: %s", err, body)
+	}
+	if err := json.Unmarshal(body, &v); err != nil {
+		return v, err
+	}
+	return v, nil
+}
+
 // QueryOptionalFeatures queries the optional features supported by the Tailscale daemon.
 func (lc *Client) QueryOptionalFeatures(ctx context.Context) (*apitype.OptionalFeatures, error) {
 	body, err := lc.send(ctx, "POST", "/localapi/v0/debug-optional-features", 200, nil)
@@ -636,6 +731,9 @@ func (lc *Client) SetDevStoreKeyValue(ctx context.Context, key, value string) er
 // SetComponentDebugLogging sets component's debug logging enabled for
 // the provided duration. If the duration is in the past, the debug logging
 // is disabled.
+//
+// API maturity: this method is not considered a stable API and is
+// subject to change between releases.
 func (lc *Client) SetComponentDebugLogging(ctx context.Context, component string, d time.Duration) error {
 	if !buildfeatures.HasDebug {
 		return feature.ErrUnavailable
@@ -664,6 +762,8 @@ func Status(ctx context.Context) (*ipnstate.Status, error) {
 }
 
 // Status returns the Tailscale daemon's status.
+//
+// API maturity: this is considered a stable API.
 func (lc *Client) Status(ctx context.Context) (*ipnstate.Status, error) {
 	return lc.status(ctx, "")
 }
@@ -674,6 +774,8 @@ func StatusWithoutPeers(ctx context.Context) (*ipnstate.Status, error) {
 }
 
 // StatusWithoutPeers returns the Tailscale daemon's status, without the peer info.
+//
+// API maturity: this is considered a stable API.
 func (lc *Client) StatusWithoutPeers(ctx context.Context) (*ipnstate.Status, error) {
 	return lc.status(ctx, "?peers=false")
 }
@@ -778,6 +880,9 @@ func (lc *Client) PushFile(ctx context.Context, target tailcfg.StableNodeID, siz
 // CheckIPForwarding asks the local Tailscale daemon whether it looks like the
 // machine is properly configured to forward IP packets as a subnet router
 // or exit node.
+//
+// API maturity: this method is not considered a stable API and is
+// subject to change between releases.
 func (lc *Client) CheckIPForwarding(ctx context.Context) error {
 	if !buildfeatures.HasAdvertiseRoutes {
 		return nil
@@ -801,6 +906,9 @@ func (lc *Client) CheckIPForwarding(ctx context.Context) error {
 // CheckUDPGROForwarding asks the local Tailscale daemon whether it looks like
 // the machine is optimally configured to forward UDP packets as a subnet router
 // or exit node.
+//
+// API maturity: this method is not considered a stable API and is
+// subject to change between releases.
 func (lc *Client) CheckUDPGROForwarding(ctx context.Context) error {
 	body, err := lc.get200(ctx, "/localapi/v0/check-udp-gro-forwarding")
 	if err != nil {
@@ -850,6 +958,9 @@ func (lc *Client) CheckPrefs(ctx context.Context, p *ipn.Prefs) error {
 	return err
 }
 
+// GetPrefs returns the [ipn.Prefs] of the current Tailscale profile.
+//
+// API maturity: this is considered a stable API.
 func (lc *Client) GetPrefs(ctx context.Context) (*ipn.Prefs, error) {
 	body, err := lc.get200(ctx, "/localapi/v0/prefs")
 	if err != nil {
@@ -867,6 +978,8 @@ func (lc *Client) GetPrefs(ctx context.Context) (*ipn.Prefs, error) {
 // or a policy restriction. An optional reason or justification for the request can be
 // provided as a context value using [apitype.RequestReasonKey]. If permitted by policy,
 // access may be granted, and the reason will be logged for auditing purposes.
+//
+// API maturity: this is considered a stable API.
 func (lc *Client) EditPrefs(ctx context.Context, mp *ipn.MaskedPrefs) (*ipn.Prefs, error) {
 	body, err := lc.send(ctx, "PATCH", "/localapi/v0/prefs", http.StatusOK, jsonBody(mp))
 	if err != nil {
@@ -877,6 +990,9 @@ func (lc *Client) EditPrefs(ctx context.Context, mp *ipn.MaskedPrefs) (*ipn.Pref
 
 // GetDNSOSConfig returns the system DNS configuration for the current device.
 // That is, it returns the DNS configuration that the system would use if Tailscale weren't being used.
+//
+// API maturity: this method is not considered a stable API and is
+// subject to change between releases.
 func (lc *Client) GetDNSOSConfig(ctx context.Context) (*apitype.DNSOSConfig, error) {
 	if !buildfeatures.HasDNS {
 		return nil, feature.ErrUnavailable
@@ -910,7 +1026,26 @@ func (lc *Client) QueryDNS(ctx context.Context, name string, queryType string) (
 	return res.Bytes, res.Resolvers, nil
 }
 
-// StartLoginInteractive starts an interactive login.
+// StartLoginInteractive starts an interactive login, requesting a new
+// auth URL from the control plane if a login flow is not already in
+// progress. If one is, the existing auth URL is re-sent.
+//
+// The auth URL is not returned by this method; it is delivered
+// asynchronously to IPN bus watchers (see [Client.WatchIPNBus]) as an
+// [ipn.Notify] with a non-empty BrowseToURL field. StartLoginInteractive
+// returns as soon as the login has been requested; it does not wait for
+// the login to complete.
+//
+// Calling StartLoginInteractive does not itself change the node's
+// desired run state, but successfully completing the login does: the
+// node's WantRunning pref is set to true, so a stopped node
+// ("tailscale down") starts once the login finishes. If the login is
+// completed as a different user or node identity than the current
+// profile's, the node switches to an existing profile matching the new
+// identity if one exists, or else updates the current profile to the
+// new identity.
+//
+// API maturity: this is considered a stable API.
 func (lc *Client) StartLoginInteractive(ctx context.Context) error {
 	_, err := lc.send(ctx, "POST", "/localapi/v0/login-interactive", http.StatusNoContent, nil)
 	return err
@@ -935,6 +1070,8 @@ func (lc *Client) Logout(ctx context.Context) error {
 // tailscaled), a FQDN, or an IP address.
 //
 // The ctx is only used for the duration of the call, not the lifetime of the [net.Conn].
+//
+// API maturity: this is considered a stable API.
 func (lc *Client) DialTCP(ctx context.Context, host string, port uint16) (net.Conn, error) {
 	return lc.UserDial(ctx, "tcp", host, port)
 }
@@ -946,6 +1083,8 @@ func (lc *Client) DialTCP(ctx context.Context, host string, port uint16) (net.Co
 //
 // The ctx is only used for the duration of the call, not the lifetime of the
 // [net.Conn].
+//
+// API maturity: this is considered a stable API.
 func (lc *Client) UserDial(ctx context.Context, network, host string, port uint16) (net.Conn, error) {
 	connCh := make(chan net.Conn, 1)
 	trace := httptrace.ClientTrace{
@@ -972,6 +1111,19 @@ func (lc *Client) UserDial(ctx context.Context, network, host string, port uint1
 	if res.StatusCode != http.StatusSwitchingProtocols {
 		body, _ := io.ReadAll(res.Body)
 		res.Body.Close()
+		if res.StatusCode == http.StatusOK && res.Header.Get("Dial-Self") == "true" {
+			// Server told us to dial the address ourselves rather than
+			// proxying through the daemon. This happens for non-Tailscale
+			// addresses where the daemon shouldn't dial as root on the
+			// client's behalf. The server provides the resolved address
+			// to avoid a TOCTOU race with DNS re-resolution.
+			addr := res.Header.Get("Dial-Addr")
+			if addr == "" {
+				return nil, errors.New("server returned Dial-Self without Dial-Addr")
+			}
+			var d net.Dialer
+			return d.DialContext(ctx, network, addr)
+		}
 		return nil, fmt.Errorf("unexpected HTTP response: %s, %s", res.Status, body)
 	}
 	// From here on, the underlying net.Conn is ours to use, but there
@@ -997,6 +1149,10 @@ func (lc *Client) UserDial(ctx context.Context, network, host string, port uint1
 
 // CurrentDERPMap returns the current DERPMap that is being used by the local tailscaled.
 // It is intended to be used with netcheck to see availability of DERPs.
+//
+// API maturity: this is considered a stable API, though the returned
+// [tailcfg.DERPMap] type is subject to minor changes over time; its
+// general shape is stable.
 func (lc *Client) CurrentDERPMap(ctx context.Context) (*tailcfg.DERPMap, error) {
 	var derpMap tailcfg.DERPMap
 	res, err := lc.send(ctx, "GET", "/localapi/v0/derpmap", 200, nil)
@@ -1009,6 +1165,66 @@ func (lc *Client) CurrentDERPMap(ctx context.Context) (*tailcfg.DERPMap, error)
 	return &derpMap, nil
 }
 
+// CertDomains returns the list of domains for which the local tailscaled can
+// fetch TLS certificates, equivalent to the DNS.CertDomains field of the
+// current netmap. The returned list is sorted in ascending order, and is
+// empty if no netmap has been received yet.
+//
+// API maturity: this is considered a stable API.
+func (lc *Client) CertDomains(ctx context.Context) ([]string, error) {
+	body, err := lc.get200(ctx, "/localapi/v0/cert-domains")
+	if err != nil {
+		return nil, err
+	}
+	return decodeJSON[[]string](body)
+}
+
+// DNSConfig returns the [tailcfg.DNSConfig] from the current netmap.
+// It returns an error if no netmap has been received yet.
+// It is intended for callers that need fields like ExtraRecords or CertDomains
+// without pulling the rest of the netmap.
+func (lc *Client) DNSConfig(ctx context.Context) (*tailcfg.DNSConfig, error) {
+	body, err := lc.get200(ctx, "/localapi/v0/dns-config")
+	if err != nil {
+		return nil, err
+	}
+	return decodeJSON[*tailcfg.DNSConfig](body)
+}
+
+// PeerByID returns a peer's current full [tailcfg.Node] looked up by its
+// [tailcfg.NodeID]. It returns an error if no peer with that NodeID is in the
+// current netmap.
+//
+// It is intended for callers that observed a peer-mutation signal (e.g.
+// [ipn.Notify.PeerChangedPatch] or [ipn.Notify.PeersChanged]) and want the
+// latest state of the affected node without having to apply the patch
+// themselves.
+func (lc *Client) PeerByID(ctx context.Context, id tailcfg.NodeID) (*tailcfg.Node, error) {
+	body, err := lc.get200(ctx, "/localapi/v0/peer-by-id?id="+strconv.FormatInt(int64(id), 10))
+	if err != nil {
+		return nil, err
+	}
+	return decodeJSON[*tailcfg.Node](body)
+}
+
+// UserProfile returns the current [tailcfg.UserProfile] for the given
+// [tailcfg.UserID]. It returns an error if no user with that UserID is in the
+// current netmap.
+//
+// It is the LocalAPI fallback for IPN-bus consumers that see a UserID
+// referenced by a peer Node and want to resolve it to a UserProfile. Sessions
+// opted in to [ipn.NotifyPeerChanges] / [ipn.NotifyPeerPatches] also receive
+// UserProfiles automatically via [ipn.Notify.UserProfiles].
+//
+// API maturity: this is considered a stable API.
+func (lc *Client) UserProfile(ctx context.Context, id tailcfg.UserID) (*tailcfg.UserProfile, error) {
+	body, err := lc.get200(ctx, "/localapi/v0/user-profile?id="+strconv.FormatInt(int64(id), 10))
+	if err != nil {
+		return nil, err
+	}
+	return decodeJSON[*tailcfg.UserProfile](body)
+}
+
 // PingOpts contains options for the ping request.
 //
 // The zero value is valid, which means to use defaults.
@@ -1045,6 +1261,8 @@ func (lc *Client) Ping(ctx context.Context, ip netip.Addr, pingtype tailcfg.Ping
 // DisconnectControl shuts down all connections to control, thus making control consider this node inactive. This can be
 // run on HA subnet router or app connector replicas before shutting them down to ensure peers get told to switch over
 // to another replica whilst there is still some grace period for the existing connections to terminate.
+//
+// API maturity: this is considered a stable API.
 func (lc *Client) DisconnectControl(ctx context.Context) error {
 	_, _, err := lc.sendWithHeaders(ctx, "POST", "/localapi/v0/disconnect-control", 200, nil, nil)
 	if err != nil {
@@ -1140,13 +1358,18 @@ func (lc *Client) ReloadConfig(ctx context.Context) (ok bool, err error) {
 
 // SwitchToEmptyProfile creates and switches to a new unnamed profile. The new
 // profile is not assigned an ID until it is persisted after a successful login.
-// In order to login to the new profile, the user must call LoginInteractive.
+// In order to login to the new profile, the user must call
+// [Client.StartLoginInteractive].
+//
+// API maturity: this is considered a stable API.
 func (lc *Client) SwitchToEmptyProfile(ctx context.Context) error {
 	_, err := lc.send(ctx, "PUT", "/localapi/v0/profiles/", http.StatusCreated, nil)
 	return err
 }
 
 // SwitchProfile switches to the given profile.
+//
+// API maturity: this is considered a stable API.
 func (lc *Client) SwitchProfile(ctx context.Context, profile ipn.ProfileID) error {
 	_, err := lc.send(ctx, "POST", "/localapi/v0/profiles/"+url.PathEscape(string(profile)), 204, nil)
 	return err
@@ -1181,6 +1404,11 @@ func (lc *Client) QueryFeature(ctx context.Context, feature string) (*tailcfg.Qu
 	return decodeJSON[*tailcfg.QueryFeatureResponse](body)
 }
 
+// DebugDERPRegion reports diagnostic information about the DERP region with
+// the given ID or code.
+//
+// API maturity: this method is not considered a stable API and is
+// subject to change between releases.
 func (lc *Client) DebugDERPRegion(ctx context.Context, regionIDOrCode string) (*ipnstate.DebugDERPRegionReport, error) {
 	v := url.Values{"region": {regionIDOrCode}}
 	body, err := lc.send(ctx, "POST", "/localapi/v0/debug-derp-region?"+v.Encode(), 200, nil)
@@ -1191,6 +1419,9 @@ func (lc *Client) DebugDERPRegion(ctx context.Context, regionIDOrCode string) (*
 }
 
 // DebugPacketFilterRules returns the packet filter rules for the current device.
+//
+// API maturity: this method is not considered a stable API and is
+// subject to change between releases.
 func (lc *Client) DebugPacketFilterRules(ctx context.Context) ([]tailcfg.FilterRule, error) {
 	body, err := lc.send(ctx, "POST", "/localapi/v0/debug-packet-filter-rules", 200, nil)
 	if err != nil {
@@ -1202,6 +1433,9 @@ func (lc *Client) DebugPacketFilterRules(ctx context.Context) ([]tailcfg.FilterR
 // DebugSetExpireIn marks the current node key to expire in d.
 //
 // This is meant primarily for debug and testing.
+//
+// API maturity: this method is not considered a stable API and is
+// subject to change between releases.
 func (lc *Client) DebugSetExpireIn(ctx context.Context, d time.Duration) error {
 	v := url.Values{"expiry": {fmt.Sprint(time.Now().Add(d).Unix())}}
 	_, err := lc.send(ctx, "POST", "/localapi/v0/set-expiry-sooner?"+v.Encode(), 200, nil)
@@ -1210,6 +1444,9 @@ func (lc *Client) DebugSetExpireIn(ctx context.Context, d time.Duration) error {
 
 // DebugPeerRelaySessions returns debug information about the current peer
 // relay sessions running through this node.
+//
+// API maturity: this method is not considered a stable API and is
+// subject to change between releases.
 func (lc *Client) DebugPeerRelaySessions(ctx context.Context) (*status.ServerStatus, error) {
 	body, err := lc.send(ctx, "GET", "/localapi/v0/debug-peer-relay-sessions", 200, nil)
 	if err != nil {
@@ -1222,6 +1459,9 @@ func (lc *Client) DebugPeerRelaySessions(ctx context.Context) (*status.ServerSta
 //
 // The provided context does not determine the lifetime of the
 // returned [io.ReadCloser].
+//
+// API maturity: this method is not considered a stable API and is
+// subject to change between releases.
 func (lc *Client) StreamDebugCapture(ctx context.Context) (io.ReadCloser, error) {
 	req, err := http.NewRequestWithContext(ctx, "POST", "http://"+apitype.LocalAPIHost+"/localapi/v0/debug-capture", nil)
 	if err != nil {
@@ -1248,9 +1488,16 @@ func (lc *Client) StreamDebugCapture(ctx context.Context) (io.ReadCloser, error)
 // resources.
 //
 // A default set of ipn.Notify messages are returned but the set can be modified by mask.
+//
+// API maturity: this method is not considered a stable API and is
+// subject to change between releases.
 func (lc *Client) WatchIPNBus(ctx context.Context, mask ipn.NotifyWatchOpt) (*IPNBusWatcher, error) {
+	m, err := mask.MarshalText()
+	if err != nil {
+		return nil, err
+	}
 	req, err := http.NewRequestWithContext(ctx, "GET",
-		"http://"+apitype.LocalAPIHost+"/localapi/v0/watch-ipn-bus?mask="+fmt.Sprint(mask),
+		"http://"+apitype.LocalAPIHost+"/localapi/v0/watch-ipn-bus?mask="+string(m),
 		nil)
 	if err != nil {
 		return nil, err
@@ -1274,6 +1521,8 @@ func (lc *Client) WatchIPNBus(ctx context.Context, mask ipn.NotifyWatchOpt) (*IP
 // CheckUpdate returns a [*tailcfg.ClientVersion] indicating whether or not an update is available
 // to be installed via the LocalAPI. In case the LocalAPI can't install updates, it returns a
 // ClientVersion that says that we are up to date.
+//
+// API maturity: this is considered a stable API.
 func (lc *Client) CheckUpdate(ctx context.Context) (*tailcfg.ClientVersion, error) {
 	body, err := lc.get200(ctx, "/localapi/v0/update/check")
 	if err != nil {
@@ -1290,6 +1539,8 @@ func (lc *Client) CheckUpdate(ctx context.Context) (*tailcfg.ClientVersion, erro
 // To turn it on, there must have been a previously used exit node.
 // The most previously used one is reused.
 // This is a convenience method for GUIs. To select an actual one, update the prefs.
+//
+// API maturity: this is considered a stable API.
 func (lc *Client) SetUseExitNode(ctx context.Context, on bool) error {
 	_, err := lc.send(ctx, "POST", "/localapi/v0/set-use-exit-node-enabled?enabled="+strconv.FormatBool(on), http.StatusOK, nil)
 	return err
@@ -1298,6 +1549,9 @@ func (lc *Client) SetUseExitNode(ctx context.Context, on bool) error {
 // DriveSetServerAddr instructs Taildrive to use the server at addr to access
 // the filesystem. This is used on platforms like Windows and MacOS to let
 // Taildrive know to use the file server running in the GUI app.
+//
+// API maturity: this method is not considered a stable API and is
+// subject to change between releases.
 func (lc *Client) DriveSetServerAddr(ctx context.Context, addr string) error {
 	_, err := lc.send(ctx, "PUT", "/localapi/v0/drive/fileserver-address", http.StatusCreated, strings.NewReader(addr))
 	return err
@@ -1306,6 +1560,9 @@ func (lc *Client) DriveSetServerAddr(ctx context.Context, addr string) error {
 // DriveShareSet adds or updates the given share in the list of shares that
 // Taildrive will serve to remote nodes. If a share with the same name already
 // exists, the existing share is replaced/updated.
+//
+// API maturity: this method is not considered a stable API and is
+// subject to change between releases.
 func (lc *Client) DriveShareSet(ctx context.Context, share *drive.Share) error {
 	_, err := lc.send(ctx, "PUT", "/localapi/v0/drive/shares", http.StatusCreated, jsonBody(share))
 	return err
@@ -1313,6 +1570,9 @@ func (lc *Client) DriveShareSet(ctx context.Context, share *drive.Share) error {
 
 // DriveShareRemove removes the share with the given name from the list of
 // shares that Taildrive will serve to remote nodes.
+//
+// API maturity: this method is not considered a stable API and is
+// subject to change between releases.
 func (lc *Client) DriveShareRemove(ctx context.Context, name string) error {
 	_, err := lc.send(
 		ctx,
@@ -1324,6 +1584,9 @@ func (lc *Client) DriveShareRemove(ctx context.Context, name string) error {
 }
 
 // DriveShareRename renames the share from old to new name.
+//
+// API maturity: this method is not considered a stable API and is
+// subject to change between releases.
 func (lc *Client) DriveShareRename(ctx context.Context, oldName, newName string) error {
 	_, err := lc.send(
 		ctx,
@@ -1336,6 +1599,9 @@ func (lc *Client) DriveShareRename(ctx context.Context, oldName, newName string)
 
 // DriveShareList returns the list of shares that drive is currently serving
 // to remote nodes.
+//
+// API maturity: this method is not considered a stable API and is
+// subject to change between releases.
 func (lc *Client) DriveShareList(ctx context.Context) ([]*drive.Share, error) {
 	result, err := lc.get200(ctx, "/localapi/v0/drive/shares")
 	if err != nil {
@@ -1392,8 +1658,25 @@ func (lc *Client) SuggestExitNode(ctx context.Context) (apitype.ExitNodeSuggesti
 	return decodeJSON[apitype.ExitNodeSuggestionResponse](body)
 }
 
+// SuggestExitNodeWithProbe requests an exit node suggestion based on an immediate routecheck probe,
+// waits for the probe to finish, and returns the exit node's details.
+func (lc *Client) SuggestExitNodeWithProbe(ctx context.Context) (apitype.ExitNodeSuggestionResponse, error) {
+	if !buildfeatures.HasRouteCheck {
+		return apitype.ExitNodeSuggestionResponse{}, feature.ErrUnavailable
+	}
+	v := url.Values{"probe": {"true"}}
+	body, err := lc.send(ctx, "POST", "/localapi/v0/suggest-exit-node?"+v.Encode(), 200, nil)
+	if err != nil {
+		return apitype.ExitNodeSuggestionResponse{}, err
+	}
+	return decodeJSON[apitype.ExitNodeSuggestionResponse](body)
+}
+
 // CheckSOMarkInUse reports whether the socket mark option is in use. This will only
 // be true if tailscale is running on Linux and tailscaled uses SO_MARK.
+//
+// API maturity: this method is not considered a stable API and is
+// subject to change between releases.
 func (lc *Client) CheckSOMarkInUse(ctx context.Context) (bool, error) {
 	body, err := lc.get200(ctx, "/localapi/v0/check-so-mark-in-use")
 	if err != nil {
@@ -1410,11 +1693,19 @@ func (lc *Client) CheckSOMarkInUse(ctx context.Context) (bool, error) {
 }
 
 // ShutdownTailscaled requests a graceful shutdown of tailscaled.
+//
+// API maturity: this method is not considered a stable API and is
+// subject to change between releases.
 func (lc *Client) ShutdownTailscaled(ctx context.Context) error {
 	_, err := lc.send(ctx, "POST", "/localapi/v0/shutdown", 200, nil)
 	return err
 }
 
+// GetAppConnectorRouteInfo returns the current [appctype.RouteInfo] for this
+// node's app connector.
+//
+// API maturity: this method is not considered a stable API and is
+// subject to change between releases.
 func (lc *Client) GetAppConnectorRouteInfo(ctx context.Context) (appctype.RouteInfo, error) {
 	body, err := lc.get200(ctx, "/localapi/v0/appc-route-info")
 	if err != nil {
@@ -1422,3 +1713,13 @@ func (lc *Client) GetAppConnectorRouteInfo(ctx context.Context) (appctype.RouteI
 	}
 	return decodeJSON[appctype.RouteInfo](body)
 }
+
+// GetServices returns the Services visible to this node,
+// including their names, IP addresses, and ports, keyed by service name.
+func (lc *Client) GetServices(ctx context.Context) (map[tailcfg.ServiceName]tailcfg.ServiceDetails, error) {
+	body, err := lc.get200(ctx, "/localapi/v0/services")
+	if err != nil {
+		return nil, err
+	}
+	return decodeJSON[map[tailcfg.ServiceName]tailcfg.ServiceDetails](body)
+}
diff --git a/client/local/local_test.go b/client/local/local_test.go
index a5377fbd6..58a87b224 100644
--- a/client/local/local_test.go
+++ b/client/local/local_test.go
@@ -61,6 +61,57 @@ func TestWhoIsPeerNotFound(t *testing.T) {
 	}
 }
 
+func TestUserDialSelf(t *testing.T) {
+	// Start a real TCP listener that the client should dial directly
+	// when the server tells it to dial-self.
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer ln.Close()
+	go func() {
+		for {
+			c, err := ln.Accept()
+			if err != nil {
+				return
+			}
+			c.Write([]byte("hello"))
+			c.Close()
+		}
+	}()
+	targetAddr := ln.Addr().(*net.TCPAddr)
+
+	// Mock LocalAPI server that returns Dial-Self response.
+	nw := nettest.GetNetwork(t)
+	ts := nettest.NewHTTPServer(nw, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Dial-Self", "true")
+		w.Header().Set("Dial-Addr", targetAddr.String())
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer ts.Close()
+
+	lc := &Client{
+		Dial: func(ctx context.Context, network, addr string) (net.Conn, error) {
+			return nw.Dial(ctx, network, ts.Listener.Addr().String())
+		},
+	}
+
+	conn, err := lc.UserDial(context.Background(), "tcp", targetAddr.IP.String(), uint16(targetAddr.Port))
+	if err != nil {
+		t.Fatalf("UserDial: %v", err)
+	}
+	defer conn.Close()
+
+	buf := make([]byte, 5)
+	n, err := conn.Read(buf)
+	if err != nil {
+		t.Fatalf("Read: %v", err)
+	}
+	if got := string(buf[:n]); got != "hello" {
+		t.Errorf("got %q, want %q", got, "hello")
+	}
+}
+
 func TestDeps(t *testing.T) {
 	deptest.DepChecker{
 		BadDeps: map[string]string{
diff --git a/client/local/routecheck.go b/client/local/routecheck.go
new file mode 100644
index 000000000..bf64842f7
--- /dev/null
+++ b/client/local/routecheck.go
@@ -0,0 +1,43 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !ts_omit_routecheck
+
+package local
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+
+	"tailscale.com/net/routecheck"
+)
+
+// ErrReportPending is returned by [Client.RouteCheck] and [Client.RouteCheckProbe]
+// when the report is pending.
+var ErrRouteCheckReportUnavailable = errors.New("report pending")
+
+// RouteCheckProbe performs a routecheck probe and waits for its report.
+func (lc *Client) RouteCheckProbe(ctx context.Context) (*routecheck.Report, error) {
+	body, err := lc.send(ctx, "POST", "/localapi/v0/routecheck?probe=true", http.StatusOK, nil)
+	if err != nil {
+		if hs, ok := errors.AsType[httpStatusError](err); ok && hs.HTTPStatus == http.StatusNoContent {
+			return nil, ErrRouteCheckReportUnavailable
+		}
+		return nil, fmt.Errorf("error %w: %s", err, body)
+	}
+	return decodeJSON[*routecheck.Report](body)
+}
+
+// RouteCheck requests the report compiled by the latest routecheck probe.
+func (lc *Client) RouteCheck(ctx context.Context) (*routecheck.Report, error) {
+	body, err := lc.send(ctx, "POST", "/localapi/v0/routecheck", http.StatusOK, nil)
+	if err != nil {
+		if hs, ok := errors.AsType[httpStatusError](err); ok && hs.HTTPStatus == http.StatusNoContent {
+			return nil, ErrRouteCheckReportUnavailable
+		}
+		return nil, fmt.Errorf("error %w: %s", err, body)
+	}
+	return decodeJSON[*routecheck.Report](body)
+}
diff --git a/client/local/serve.go b/client/local/serve.go
index 7f9a16a03..c6e96ec07 100644
--- a/client/local/serve.go
+++ b/client/local/serve.go
@@ -17,6 +17,9 @@ import (
 // GetServeConfig return the current serve config.
 //
 // If the serve config is empty, it returns (nil, nil).
+//
+// API maturity: this method is not considered a stable API and is
+// subject to change between releases.
 func (lc *Client) GetServeConfig(ctx context.Context) (*ipn.ServeConfig, error) {
 	body, h, err := lc.sendWithHeaders(ctx, "GET", "/localapi/v0/serve-config", 200, nil, nil)
 	if err != nil {
diff --git a/client/local/serviceclientprefs.go b/client/local/serviceclientprefs.go
new file mode 100644
index 000000000..44dc40243
--- /dev/null
+++ b/client/local/serviceclientprefs.go
@@ -0,0 +1,37 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !ts_omit_serviceclientprefs
+
+package local
+
+import (
+	"context"
+	"net/http"
+
+	"tailscale.com/client/tailscale/apitype"
+	"tailscale.com/feature/serviceclientprefs/serviceclient"
+)
+
+// GetServiceClientPrefs returns all of the current profile's [serviceclient.Prefs].
+//
+// API maturity: this method is not considered a stable API and is subject to change between releases.
+func (lc *Client) GetServiceClientPrefs(ctx context.Context) (serviceclient.Prefs, error) {
+	body, err := lc.get200(ctx, "/localapi/v0/prefs/service-clients")
+	if err != nil {
+		return nil, err
+	}
+	return decodeJSON[serviceclient.Prefs](body)
+}
+
+// SetServiceClientPref merges the non-empty fields from an [apitype.ServiceClientPrefRequest] into the
+// saved service client prefs for the current profile and returns the full updated set.
+//
+// API maturity: this method is not considered a stable API and is subject to change between releases.
+func (lc *Client) SetServiceClientPref(ctx context.Context, req apitype.ServiceClientPrefRequest) (serviceclient.Prefs, error) {
+	body, err := lc.send(ctx, "POST", "/localapi/v0/prefs/service-clients", http.StatusOK, jsonBody(req))
+	if err != nil {
+		return nil, err
+	}
+	return decodeJSON[serviceclient.Prefs](body)
+}
diff --git a/client/local/syspolicy.go b/client/local/syspolicy.go
index 49708fa15..4753811bb 100644
--- a/client/local/syspolicy.go
+++ b/client/local/syspolicy.go
@@ -13,6 +13,9 @@ import (
 )
 
 // GetEffectivePolicy returns the effective policy for the specified scope.
+//
+// API maturity: this method is not considered a stable API and is
+// subject to change between releases.
 func (lc *Client) GetEffectivePolicy(ctx context.Context, scope setting.PolicyScope) (*setting.Snapshot, error) {
 	scopeID, err := scope.MarshalText()
 	if err != nil {
diff --git a/client/local/tailnetlock.go b/client/local/tailnetlock.go
index 5af90eb16..8445d9bd0 100644
--- a/client/local/tailnetlock.go
+++ b/client/local/tailnetlock.go
@@ -18,17 +18,22 @@ import (
 	"tailscale.com/types/tkatype"
 )
 
-// NetworkLockStatus fetches information about the tailnet key authority, if one is configured.
-func (lc *Client) NetworkLockStatus(ctx context.Context) (*ipnstate.NetworkLockStatus, error) {
+// TailnetLockStatus fetches information about the tailnet key authority, if one is configured.
+func (lc *Client) TailnetLockStatus(ctx context.Context) (*ipnstate.TailnetLockStatus, error) {
 	body, err := lc.send(ctx, "GET", "/localapi/v0/tka/status", 200, nil)
 	if err != nil {
 		return nil, fmt.Errorf("error: %w", err)
 	}
-	return decodeJSON[*ipnstate.NetworkLockStatus](body)
+	return decodeJSON[*ipnstate.TailnetLockStatus](body)
 }
 
-// NetworkLockInit initializes the tailnet key authority.
-func (lc *Client) NetworkLockInit(ctx context.Context, keys []tka.Key, disablementValues [][]byte, supportDisablement []byte) (*ipnstate.NetworkLockStatus, error) {
+// Deprecated: use [Client.TailnetLockStatus] instead.
+func (lc *Client) NetworkLockStatus(ctx context.Context) (*ipnstate.TailnetLockStatus, error) {
+	return lc.TailnetLockStatus(ctx)
+}
+
+// TailnetLockInit initializes the tailnet key authority.
+func (lc *Client) TailnetLockInit(ctx context.Context, keys []tka.Key, disablementValues [][]byte, supportDisablement []byte) (*ipnstate.TailnetLockStatus, error) {
 	var b bytes.Buffer
 	type initRequest struct {
 		Keys               []tka.Key
@@ -44,12 +49,17 @@ func (lc *Client) NetworkLockInit(ctx context.Context, keys []tka.Key, disableme
 	if err != nil {
 		return nil, fmt.Errorf("error: %w", err)
 	}
-	return decodeJSON[*ipnstate.NetworkLockStatus](body)
+	return decodeJSON[*ipnstate.TailnetLockStatus](body)
 }
 
-// NetworkLockWrapPreauthKey wraps a pre-auth key with information to
+// Deprecated: use [Client.TailnetLockInit] instead.
+func (lc *Client) NetworkLockInit(ctx context.Context, keys []tka.Key, disablementValues [][]byte, supportDisablement []byte) (*ipnstate.TailnetLockStatus, error) {
+	return lc.TailnetLockInit(ctx, keys, disablementValues, supportDisablement)
+}
+
+// TailnetLockWrapPreauthKey wraps a pre-auth key with information to
 // enable unattended bringup in the locked tailnet.
-func (lc *Client) NetworkLockWrapPreauthKey(ctx context.Context, preauthKey string, tkaKey key.NLPrivate) (string, error) {
+func (lc *Client) TailnetLockWrapPreauthKey(ctx context.Context, preauthKey string, tkaKey key.NLPrivate) (string, error) {
 	encodedPrivate, err := tkaKey.MarshalText()
 	if err != nil {
 		return "", err
@@ -71,8 +81,13 @@ func (lc *Client) NetworkLockWrapPreauthKey(ctx context.Context, preauthKey stri
 	return string(body), nil
 }
 
-// NetworkLockModify adds and/or removes key(s) to the tailnet key authority.
-func (lc *Client) NetworkLockModify(ctx context.Context, addKeys, removeKeys []tka.Key) error {
+// Deprecated: use [Client.TailnetLockWrapPreauthKey] instead.
+func (lc *Client) NetworkLockWrapPreauthKey(ctx context.Context, preauthKey string, tkaKey key.NLPrivate) (string, error) {
+	return lc.TailnetLockWrapPreauthKey(ctx, preauthKey, tkaKey)
+}
+
+// TailnetLockModify adds and/or removes key(s) to the tailnet key authority.
+func (lc *Client) TailnetLockModify(ctx context.Context, addKeys, removeKeys []tka.Key) error {
 	var b bytes.Buffer
 	type modifyRequest struct {
 		AddKeys    []tka.Key
@@ -89,9 +104,14 @@ func (lc *Client) NetworkLockModify(ctx context.Context, addKeys, removeKeys []t
 	return nil
 }
 
-// NetworkLockSign signs the specified node-key and transmits that signature to the control plane.
+// Deprecated: use [Client.TailnetLockModify] instead.
+func (lc *Client) NetworkLockModify(ctx context.Context, addKeys, removeKeys []tka.Key) error {
+	return lc.TailnetLockModify(ctx, addKeys, removeKeys)
+}
+
+// TailnetLockSign signs the specified node-key and transmits that signature to the control plane.
 // rotationPublic, if specified, must be an ed25519 public key.
-func (lc *Client) NetworkLockSign(ctx context.Context, nodeKey key.NodePublic, rotationPublic []byte) error {
+func (lc *Client) TailnetLockSign(ctx context.Context, nodeKey key.NodePublic, rotationPublic []byte) error {
 	var b bytes.Buffer
 	type signRequest struct {
 		NodeKey        key.NodePublic
@@ -108,8 +128,13 @@ func (lc *Client) NetworkLockSign(ctx context.Context, nodeKey key.NodePublic, r
 	return nil
 }
 
-// NetworkLockAffectedSigs returns all signatures signed by the specified keyID.
-func (lc *Client) NetworkLockAffectedSigs(ctx context.Context, keyID tkatype.KeyID) ([]tkatype.MarshaledSignature, error) {
+// Deprecated: use [Client.TailnetLockSign] instead.
+func (lc *Client) NetworkLockSign(ctx context.Context, nodeKey key.NodePublic, rotationPublic []byte) error {
+	return lc.TailnetLockSign(ctx, nodeKey, rotationPublic)
+}
+
+// TailnetLockAffectedSigs returns all signatures signed by the specified keyID.
+func (lc *Client) TailnetLockAffectedSigs(ctx context.Context, keyID tkatype.KeyID) ([]tkatype.MarshaledSignature, error) {
 	body, err := lc.send(ctx, "POST", "/localapi/v0/tka/affected-sigs", 200, bytes.NewReader(keyID))
 	if err != nil {
 		return nil, fmt.Errorf("error: %w", err)
@@ -117,19 +142,29 @@ func (lc *Client) NetworkLockAffectedSigs(ctx context.Context, keyID tkatype.Key
 	return decodeJSON[[]tkatype.MarshaledSignature](body)
 }
 
-// NetworkLockLog returns up to maxEntries number of changes to network-lock state.
-func (lc *Client) NetworkLockLog(ctx context.Context, maxEntries int) ([]ipnstate.NetworkLockUpdate, error) {
+// Deprecated: use [Client.TailnetLockAffectedSigs] instead.
+func (lc *Client) NetworkLockAffectedSigs(ctx context.Context, keyID tkatype.KeyID) ([]tkatype.MarshaledSignature, error) {
+	return lc.TailnetLockAffectedSigs(ctx, keyID)
+}
+
+// TailnetLockLog returns up to maxEntries number of changes to tailnet-lock state.
+func (lc *Client) TailnetLockLog(ctx context.Context, maxEntries int) ([]ipnstate.TailnetLockUpdate, error) {
 	v := url.Values{}
 	v.Set("limit", fmt.Sprint(maxEntries))
 	body, err := lc.send(ctx, "GET", "/localapi/v0/tka/log?"+v.Encode(), 200, nil)
 	if err != nil {
 		return nil, fmt.Errorf("error %w: %s", err, body)
 	}
-	return decodeJSON[[]ipnstate.NetworkLockUpdate](body)
+	return decodeJSON[[]ipnstate.TailnetLockUpdate](body)
 }
 
-// NetworkLockForceLocalDisable forcibly shuts down network lock on this node.
-func (lc *Client) NetworkLockForceLocalDisable(ctx context.Context) error {
+// Deprecated: use [Client.TailnetLockLog] instead.
+func (lc *Client) NetworkLockLog(ctx context.Context, maxEntries int) ([]ipnstate.TailnetLockUpdate, error) {
+	return lc.TailnetLockLog(ctx, maxEntries)
+}
+
+// TailnetLockForceLocalDisable forcibly shuts down tailnet lock on this node.
+func (lc *Client) TailnetLockForceLocalDisable(ctx context.Context) error {
 	// This endpoint expects an empty JSON stanza as the payload.
 	var b bytes.Buffer
 	if err := json.NewEncoder(&b).Encode(struct{}{}); err != nil {
@@ -142,9 +177,14 @@ func (lc *Client) NetworkLockForceLocalDisable(ctx context.Context) error {
 	return nil
 }
 
-// NetworkLockVerifySigningDeeplink verifies the network lock deeplink contained
+// Deprecated: use [Client.TailnetLockForceLocalDisable] instead.
+func (lc *Client) NetworkLockForceLocalDisable(ctx context.Context) error {
+	return lc.TailnetLockForceLocalDisable(ctx)
+}
+
+// TailnetLockVerifySigningDeeplink verifies the tailnet lock deeplink contained
 // in url and returns information extracted from it.
-func (lc *Client) NetworkLockVerifySigningDeeplink(ctx context.Context, url string) (*tka.DeeplinkValidationResult, error) {
+func (lc *Client) TailnetLockVerifySigningDeeplink(ctx context.Context, url string) (*tka.DeeplinkValidationResult, error) {
 	vr := struct {
 		URL string
 	}{url}
@@ -157,8 +197,13 @@ func (lc *Client) NetworkLockVerifySigningDeeplink(ctx context.Context, url stri
 	return decodeJSON[*tka.DeeplinkValidationResult](body)
 }
 
-// NetworkLockGenRecoveryAUM generates an AUM for recovering from a tailnet-lock key compromise.
-func (lc *Client) NetworkLockGenRecoveryAUM(ctx context.Context, removeKeys []tkatype.KeyID, forkFrom tka.AUMHash) ([]byte, error) {
+// Deprecated: use [Client.TailnetLockVerifySigningDeeplink] instead.
+func (lc *Client) NetworkLockVerifySigningDeeplink(ctx context.Context, url string) (*tka.DeeplinkValidationResult, error) {
+	return lc.TailnetLockVerifySigningDeeplink(ctx, url)
+}
+
+// TailnetLockGenRecoveryAUM generates an AUM for recovering from a tailnet-lock key compromise.
+func (lc *Client) TailnetLockGenRecoveryAUM(ctx context.Context, removeKeys []tkatype.KeyID, forkFrom tka.AUMHash) ([]byte, error) {
 	vr := struct {
 		Keys     []tkatype.KeyID
 		ForkFrom string
@@ -172,8 +217,13 @@ func (lc *Client) NetworkLockGenRecoveryAUM(ctx context.Context, removeKeys []tk
 	return body, nil
 }
 
-// NetworkLockCosignRecoveryAUM co-signs a recovery AUM using the node's tailnet lock key.
-func (lc *Client) NetworkLockCosignRecoveryAUM(ctx context.Context, aum tka.AUM) ([]byte, error) {
+// Deprecated: use [Client.TailnetLockGenRecoveryAUM] instead.
+func (lc *Client) NetworkLockGenRecoveryAUM(ctx context.Context, removeKeys []tkatype.KeyID, forkFrom tka.AUMHash) ([]byte, error) {
+	return lc.TailnetLockGenRecoveryAUM(ctx, removeKeys, forkFrom)
+}
+
+// TailnetLockCosignRecoveryAUM co-signs a recovery AUM using the node's tailnet lock key.
+func (lc *Client) TailnetLockCosignRecoveryAUM(ctx context.Context, aum tka.AUM) ([]byte, error) {
 	r := bytes.NewReader(aum.Serialize())
 	body, err := lc.send(ctx, "POST", "/localapi/v0/tka/cosign-recovery-aum", 200, r)
 	if err != nil {
@@ -183,8 +233,13 @@ func (lc *Client) NetworkLockCosignRecoveryAUM(ctx context.Context, aum tka.AUM)
 	return body, nil
 }
 
-// NetworkLockSubmitRecoveryAUM submits a recovery AUM to the control plane.
-func (lc *Client) NetworkLockSubmitRecoveryAUM(ctx context.Context, aum tka.AUM) error {
+// Deprecated: use [Client.TailnetLockCosignRecoveryAUM] instead.
+func (lc *Client) NetworkLockCosignRecoveryAUM(ctx context.Context, aum tka.AUM) ([]byte, error) {
+	return lc.TailnetLockCosignRecoveryAUM(ctx, aum)
+}
+
+// TailnetLockSubmitRecoveryAUM submits a recovery AUM to the control plane.
+func (lc *Client) TailnetLockSubmitRecoveryAUM(ctx context.Context, aum tka.AUM) error {
 	r := bytes.NewReader(aum.Serialize())
 	_, err := lc.send(ctx, "POST", "/localapi/v0/tka/submit-recovery-aum", 200, r)
 	if err != nil {
@@ -193,10 +248,20 @@ func (lc *Client) NetworkLockSubmitRecoveryAUM(ctx context.Context, aum tka.AUM)
 	return nil
 }
 
-// NetworkLockDisable shuts down network-lock across the tailnet.
-func (lc *Client) NetworkLockDisable(ctx context.Context, secret []byte) error {
+// Deprecated: use [Client.TailnetLockSubmitRecoveryAUM] instead.
+func (lc *Client) NetworkLockSubmitRecoveryAUM(ctx context.Context, aum tka.AUM) error {
+	return lc.TailnetLockSubmitRecoveryAUM(ctx, aum)
+}
+
+// TailnetLockDisable shuts down tailnet-lock across the tailnet.
+func (lc *Client) TailnetLockDisable(ctx context.Context, secret []byte) error {
 	if _, err := lc.send(ctx, "POST", "/localapi/v0/tka/disable", 200, bytes.NewReader(secret)); err != nil {
 		return fmt.Errorf("error: %w", err)
 	}
 	return nil
 }
+
+// Deprecated: use [Client.TailnetLockDisable] instead.
+func (lc *Client) NetworkLockDisable(ctx context.Context, secret []byte) error {
+	return lc.TailnetLockDisable(ctx, secret)
+}
diff --git a/client/systray/logo.go b/client/systray/logo.go
index a0f8bf7d0..334cd7917 100644
--- a/client/systray/logo.go
+++ b/client/systray/logo.go
@@ -11,6 +11,7 @@ import (
 	"image"
 	"image/color"
 	"image/png"
+	"log"
 	"runtime"
 	"sync"
 	"time"
@@ -204,12 +205,49 @@ var (
 )
 
 var (
-	bg   = color.NRGBA{0, 0, 0, 255}
-	fg   = color.NRGBA{255, 255, 255, 255}
-	gray = color.NRGBA{255, 255, 255, 102}
-	red  = color.NRGBA{229, 111, 74, 255}
+	black       = color.NRGBA{0, 0, 0, 255}
+	white       = color.NRGBA{255, 255, 255, 255}
+	darkGray    = color.NRGBA{102, 102, 102, 255}
+	lightGray   = color.NRGBA{153, 153, 153, 255}
+	red         = color.NRGBA{229, 111, 74, 255}
+	transparent = color.NRGBA{}
+
+	// default values to dark theme
+	bg   = black
+	fg   = white
+	gray = darkGray
 )
 
+// SetTheme sets the color theme of the systray icon.
+//
+// Supported themes are:
+//   - dark       - white and gray dots over black background
+//   - dark:nobg  - white and grey dots over transparent background
+//   - light      - black and gray dots over white background
+//   - light:nobg - black and grey dots over transparent background
+func SetTheme(theme string) {
+	switch theme {
+	case "dark":
+		bg = black
+		fg = white
+		gray = darkGray
+	case "dark:nobg":
+		bg = transparent
+		fg = white
+		gray = darkGray
+	case "light":
+		bg = white
+		fg = black
+		gray = lightGray
+	case "light:nobg":
+		bg = transparent
+		fg = black
+		gray = lightGray
+	default:
+		log.Printf("unknown theme: %q", theme)
+	}
+}
+
 // render returns a PNG image of the logo.
 func (logo tsLogo) render() *bytes.Buffer {
 	const borderUnits = 1
diff --git a/client/systray/startup-creator.go b/client/systray/startup-creator.go
index 369190012..02a018099 100644
--- a/client/systray/startup-creator.go
+++ b/client/systray/startup-creator.go
@@ -3,7 +3,6 @@
 
 //go:build cgo || !darwin
 
-// Package systray provides a minimal Tailscale systray application.
 package systray
 
 import (
diff --git a/client/systray/systray.go b/client/systray/systray.go
index 65c1bec20..eb550fde4 100644
--- a/client/systray/systray.go
+++ b/client/systray/systray.go
@@ -69,6 +69,11 @@ func (menu *Menu) Run(client *local.Client) {
 	go menu.lc.SetGauge(menu.bgCtx, "systray_running", 1)
 	defer menu.lc.SetGauge(menu.bgCtx, "systray_running", 0)
 
+	// set initial title, which is used by the systray package as the ID of the StatusNotifierItem.
+	// This value will get overwritten later as the client status changes.
+	// This must be called before systray.Run.
+	systray.SetTitle("tailscale")
+
 	systray.Run(menu.onReady, menu.onExit)
 }
 
@@ -172,10 +177,6 @@ See https://tailscale.com/kb/1597/linux-systray for more information.`)
 	}
 	setAppIcon(disconnected)
 
-	// set initial title, which is used by the systray package as the ID of the StatusNotifierItem.
-	// This value will get overwritten later as the client status changes.
-	systray.SetTitle("tailscale")
-
 	menu.rebuild()
 
 	menu.mu.Lock()
@@ -292,21 +293,23 @@ func (menu *Menu) rebuild() {
 		accounts := systray.AddMenuItem(account, "")
 		setRemoteIcon(accounts, menu.curProfile.UserProfile.ProfilePicURL)
 		time.Sleep(newMenuDelay)
-		for _, profile := range menu.allProfiles {
-			title := profileTitle(profile)
-			var item *systray.MenuItem
-			if profile.ID == menu.curProfile.ID {
-				item = accounts.AddSubMenuItemCheckbox(title, "", true)
-			} else {
-				item = accounts.AddSubMenuItem(title, "")
-			}
-			setRemoteIcon(item, profile.UserProfile.ProfilePicURL)
-			onClick(ctx, item, func(ctx context.Context) {
-				select {
-				case <-ctx.Done():
-				case menu.accountsCh <- profile.ID:
+		if len(menu.allProfiles) > 1 {
+			for _, profile := range menu.allProfiles {
+				title := profileTitle(profile)
+				var item *systray.MenuItem
+				if profile.ID == menu.curProfile.ID {
+					item = accounts.AddSubMenuItemCheckbox(title, "", true)
+				} else {
+					item = accounts.AddSubMenuItem(title, "")
 				}
-			})
+				setRemoteIcon(item, profile.UserProfile.ProfilePicURL)
+				onClick(ctx, item, func(ctx context.Context) {
+					select {
+					case <-ctx.Done():
+					case menu.accountsCh <- profile.ID:
+					}
+				})
+			}
 		}
 	}
 
@@ -352,16 +355,27 @@ func (menu *Menu) rebuild() {
 
 // profileTitle returns the title string for a profile menu item.
 func profileTitle(profile ipn.LoginProfile) string {
-	title := profile.Name
+	tailnet := ""
 	if profile.NetworkProfile.DomainName != "" {
-		if runtime.GOOS == "windows" || runtime.GOOS == "darwin" {
-			// windows and mac don't support multi-line menu
-			title += " (" + profile.NetworkProfile.DisplayNameOrDefault() + ")"
-		} else {
-			title += "\n" + profile.NetworkProfile.DisplayNameOrDefault()
-		}
+		tailnet = profile.NetworkProfile.DisplayNameOrDefault()
 	}
-	return title
+	// windows and mac don't support multi-line menu items.
+	multiline := runtime.GOOS != "windows" && runtime.GOOS != "darwin"
+
+	return formatProfileTitle(profile.Name, tailnet, multiline)
+}
+
+// formatProfileTitle builds a profile menu label from a login name and an
+// optional tailnet name. The tailnet portion is omitted when it matches the
+// login name, so single-user tailnets don't show the same string twice.
+func formatProfileTitle(name, tailnet string, multiline bool) string {
+	if tailnet == "" || strings.EqualFold(name, tailnet) {
+		return name
+	}
+	if multiline {
+		return name + "\n" + tailnet
+	}
+	return name + " (" + tailnet + ")"
 }
 
 var (
@@ -621,11 +635,9 @@ func (menu *Menu) rebuildExitNodeMenu(ctx context.Context) {
 				title += strings.Split(sugg.Name, ".")[0]
 			}
 			menu.exitNodes.AddSeparator()
-			rm := menu.exitNodes.AddSubMenuItemCheckbox(title, "", false)
+			active := recommendedIsActive(status, sugg.ID, sugg.Location.CountryCode(), sugg.Location.City())
+			rm := menu.exitNodes.AddSubMenuItemCheckbox(title, "", active)
 			setExitNodeOnClick(rm, sugg.ID)
-			if status.ExitNodeStatus != nil && sugg.ID == status.ExitNodeStatus.ID {
-				rm.Check()
-			}
 		}
 	}
 
@@ -647,13 +659,11 @@ func (menu *Menu) rebuildExitNodeMenu(ctx context.Context) {
 			if !ps.Online {
 				name += " (offline)"
 			}
-			sm := menu.exitNodes.AddSubMenuItemCheckbox(name, "", false)
+			active := status.ExitNodeStatus != nil && ps.ID == status.ExitNodeStatus.ID
+			sm := menu.exitNodes.AddSubMenuItemCheckbox(name, "", active)
 			if !ps.Online {
 				sm.Disable()
 			}
-			if status.ExitNodeStatus != nil && ps.ID == status.ExitNodeStatus.ID {
-				sm.Check()
-			}
 			setExitNodeOnClick(sm, ps.ID)
 		}
 	}
@@ -743,6 +753,30 @@ func (mc *mvCountry) sortedCities() []*mvCity {
 	return cities
 }
 
+// recommendedIsActive reports whether the suggested exit node corresponds to
+// the currently active exit node in status.
+func recommendedIsActive(status *ipnstate.Status, suggID tailcfg.StableNodeID, suggCountry, suggCity string) bool {
+	if status == nil || status.ExitNodeStatus == nil || status.ExitNodeStatus.ID.IsZero() {
+		return false
+	}
+	if suggID == status.ExitNodeStatus.ID {
+		return true
+	}
+	if suggCountry == "" || suggCity == "" {
+		return false
+	}
+	for _, p := range status.Peer {
+		if p.ID != status.ExitNodeStatus.ID {
+			continue
+		}
+		if loc := p.Location; loc != nil && loc.CountryCode == suggCountry && loc.City == suggCity {
+			return true
+		}
+		return false
+	}
+	return false
+}
+
 // countryFlag takes a 2-character ASCII string and returns the corresponding emoji flag.
 // It returns the empty string on error.
 func countryFlag(code string) string {
diff --git a/client/systray/systray_test.go b/client/systray/systray_test.go
new file mode 100644
index 000000000..6bb2bfee3
--- /dev/null
+++ b/client/systray/systray_test.go
@@ -0,0 +1,147 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build cgo || !darwin
+
+package systray
+
+import (
+	"testing"
+
+	"tailscale.com/ipn/ipnstate"
+	"tailscale.com/tailcfg"
+	"tailscale.com/types/key"
+)
+
+func TestProfileTitleMultiline(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name      string
+		login     string
+		tailnet   string
+		multiline bool
+		want      string
+	}{
+		{"no_tailnet", "alice@example.com", "", true, "alice@example.com"},
+		{"dup_exact", "example.com", "example.com", true, "example.com"},
+		{"dup_casefold", "Example.com", "example.com", false, "Example.com"},
+		{"distinct_multiline", "alice@example.com", "example.com", true, "alice@example.com\nexample.com"},
+		{"distinct_singleline", "alice@example.com", "example.com", false, "alice@example.com (example.com)"},
+		{"empty", "", "", true, ""},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			if got := formatProfileTitle(tt.login, tt.tailnet, tt.multiline); got != tt.want {
+				t.Errorf("profileTitleMultiline; got %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestRecommendedIsActive(t *testing.T) {
+	t.Parallel()
+
+	const (
+		activeID = tailcfg.StableNodeID("active")
+		suggID   = tailcfg.StableNodeID("suggestion")
+	)
+	usNYC := &tailcfg.Location{CountryCode: "US", City: "New York"}
+	usCHI := &tailcfg.Location{CountryCode: "US", City: "Chicago"}
+	seSTO := &tailcfg.Location{CountryCode: "SE", City: "Stockholm"}
+
+	statusWith := func(activePeer *ipnstate.PeerStatus) *ipnstate.Status {
+		s := &ipnstate.Status{
+			ExitNodeStatus: &ipnstate.ExitNodeStatus{ID: activeID},
+		}
+		if activePeer != nil {
+			s.Peer = map[key.NodePublic]*ipnstate.PeerStatus{{}: activePeer}
+		}
+		return s
+	}
+
+	tests := []struct {
+		name        string
+		status      *ipnstate.Status
+		suggID      tailcfg.StableNodeID
+		suggCountry string
+		suggCity    string
+		isActive    bool
+	}{
+		{
+			name:   "nil_status",
+			status: nil,
+			suggID: suggID,
+		},
+		{
+			name:   "no_exit_node",
+			status: &ipnstate.Status{},
+			suggID: suggID,
+		},
+		{
+			name:   "exit_node_id_is_zero",
+			status: &ipnstate.Status{ExitNodeStatus: &ipnstate.ExitNodeStatus{}},
+			suggID: suggID,
+		},
+		{
+			name:        "exact_id_match_short-circuits",
+			status:      statusWith(&ipnstate.PeerStatus{ID: activeID, Location: usCHI}),
+			suggID:      activeID,
+			suggCountry: "US",
+			suggCity:    "New York",
+			isActive:    true,
+		},
+		{
+			name:        "id_mismatch_but_same_city",
+			status:      statusWith(&ipnstate.PeerStatus{ID: activeID, Location: usNYC}),
+			suggID:      suggID,
+			suggCountry: "US",
+			suggCity:    "New York",
+			isActive:    true,
+		},
+		{
+			name:        "different_city",
+			status:      statusWith(&ipnstate.PeerStatus{ID: activeID, Location: usCHI}),
+			suggID:      suggID,
+			suggCountry: "US",
+			suggCity:    "New York",
+		},
+		{
+			name:        "different_country",
+			status:      statusWith(&ipnstate.PeerStatus{ID: activeID, Location: seSTO}),
+			suggID:      suggID,
+			suggCountry: "US",
+			suggCity:    "New York",
+		},
+		{
+			name:   "id_mismatch_suggestion_has_no_location",
+			status: statusWith(&ipnstate.PeerStatus{ID: activeID, Location: usNYC}),
+			suggID: suggID,
+		},
+		{
+			name:        "id_mismatch_active_peer_has_no_location",
+			status:      statusWith(&ipnstate.PeerStatus{ID: activeID}),
+			suggID:      suggID,
+			suggCountry: "US",
+			suggCity:    "New York",
+		},
+		{
+			name:        "active_peer_not_in_status",
+			status:      statusWith(nil),
+			suggID:      suggID,
+			suggCountry: "US",
+			suggCity:    "New York",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			isExitNodeActive := recommendedIsActive(tt.status, tt.suggID, tt.suggCountry, tt.suggCity)
+			if isExitNodeActive != tt.isActive {
+				t.Errorf("recommendedIsActive; got %v, want %v", isExitNodeActive, tt.isActive)
+			}
+		})
+	}
+}
diff --git a/client/tailscale/apitype/apitype.go b/client/tailscale/apitype/apitype.go
index d7d1440be..12293762b 100644
--- a/client/tailscale/apitype/apitype.go
+++ b/client/tailscale/apitype/apitype.go
@@ -76,7 +76,7 @@ type ReloadConfigResponse struct {
 type ExitNodeSuggestionResponse struct {
 	ID       tailcfg.StableNodeID
 	Name     string
-	Location tailcfg.LocationView `json:",omitempty"`
+	Location tailcfg.LocationView `json:",omitzero"`
 }
 
 // DNSOSConfig mimics dns.OSConfig without forcing us to import the entire dns package
@@ -104,3 +104,20 @@ type OptionalFeatures struct {
 	// are not guaranteed to be present.)
 	Features map[string]bool
 }
+
+// ServiceClientPrefRequest is the body POSTed to the LocalAPI endpoint /localapi/v0/prefs/service-clients.
+// Empty values for Client, Username, and DatabaseName mean "don't change this value".
+type ServiceClientPrefRequest struct {
+	// Key is the identifier for the service client pref. Required. Format is "<serviceName>:<port>"
+	// where serviceName is a [tailcfg.ServiceName], e.g. "svc:my-db:5432".
+	Key string
+
+	// Client is the name of the client that the user picked in the service launch. Optional.
+	Client string `json:",omitzero"`
+
+	// Username is the username that the user entered in the service launch. Optional.
+	Username string `json:",omitzero"`
+
+	// DatabaseName is the database name that the user entered in the service launch. Optional.
+	DatabaseName string `json:",omitzero"`
+}
diff --git a/client/tailscale/keys.go b/client/tailscale/keys.go
index 6edbae034..483d12390 100644
--- a/client/tailscale/keys.go
+++ b/client/tailscale/keys.go
@@ -22,7 +22,7 @@ type Key struct {
 
 // KeyCapabilities are the capabilities of a Key.
 type KeyCapabilities struct {
-	Devices KeyDeviceCapabilities `json:"devices,omitempty"`
+	Devices KeyDeviceCapabilities `json:"devices"`
 }
 
 // KeyDeviceCapabilities are the device-related capabilities of a Key.
diff --git a/client/web/auth.go b/client/web/auth.go
index 916f24782..1281695a9 100644
--- a/client/web/auth.go
+++ b/client/web/auth.go
@@ -199,7 +199,8 @@ func (s *Server) controlSupportsCheckMode(ctx context.Context) bool {
 	if err != nil {
 		return true
 	}
-	return strings.HasSuffix(controlURL.Host, ".tailscale.com")
+	return strings.HasSuffix(controlURL.Host, ".tailscale.com") ||
+		controlURL.Host == "control.tailscale" // for natlab tests
 }
 
 // awaitUserAuth blocks until the given session auth has been completed
diff --git a/client/web/src/components/exit-node-selector.tsx b/client/web/src/components/exit-node-selector.tsx
index a564ebbfc..75b2551df 100644
--- a/client/web/src/components/exit-node-selector.tsx
+++ b/client/web/src/components/exit-node-selector.tsx
@@ -61,7 +61,7 @@ export default function ExitNodeSelector({
     none, // not using exit nodes
     advertising, // advertising as exit node
     using, // using another exit node
-    offline, // selected exit node node is offline
+    offline, // selected exit node is offline
   ] = useMemo(
     () => [
       selected.ID === noExitNode.ID,
diff --git a/client/web/web.go b/client/web/web.go
index 3e5fa4b54..95259ef1a 100644
--- a/client/web/web.go
+++ b/client/web/web.go
@@ -35,8 +35,10 @@ import (
 	"tailscale.com/net/netutil"
 	"tailscale.com/net/tsaddr"
 	"tailscale.com/tailcfg"
+	"tailscale.com/tsweb"
 	"tailscale.com/types/logger"
 	"tailscale.com/types/views"
+	"tailscale.com/util/ctxkey"
 	"tailscale.com/util/httpm"
 	"tailscale.com/util/syspolicy/policyclient"
 	"tailscale.com/version"
@@ -527,45 +529,40 @@ func (s *Server) serveLoginAPI(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
-type apiHandler[data any] struct {
-	s *Server
-	w http.ResponseWriter
-	r *http.Request
-
-	// permissionCheck allows for defining whether a requesting peer's
-	// capabilities grant them access to make the given data update.
-	// If permissionCheck reports false, the request fails as unauthorized.
-	permissionCheck func(data data, peer peerCapabilities) bool
-}
-
-// newHandler constructs a new api handler which restricts the given request
-// to the specified permission check. If the permission check fails for
-// the peer associated with the request, an unauthorized error is returned
-// to the client.
-func newHandler[data any](s *Server, w http.ResponseWriter, r *http.Request, permissionCheck func(data data, peer peerCapabilities) bool) *apiHandler[data] {
-	return &apiHandler[data]{
-		s:               s,
-		w:               w,
-		r:               r,
-		permissionCheck: permissionCheck,
+// handleJSON manages decoding the request's body JSON as data and passing it
+// on to the provided handler function.
+func handleJSON[data any](h func(ctx context.Context, data data) error) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		defer r.Body.Close()
+		var body data
+		if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+		if err := h(r.Context(), body); err != nil {
+			if httpErr, ok := errors.AsType[tsweb.HTTPError](err); ok {
+				tsweb.WriteHTTPError(w, r, httpErr)
+			} else {
+				http.Error(w, err.Error(), http.StatusInternalServerError)
+			}
+			return
+		}
+		w.WriteHeader(http.StatusOK)
 	}
 }
 
-// alwaysAllowed can be passed as the permissionCheck argument to newHandler
-// for requests that are always allowed to complete regardless of a peer's
-// capabilities.
-func alwaysAllowed[data any](_ data, _ peerCapabilities) bool { return true }
+var contextKeyPeer = ctxkey.New("peer-capabilities", peerCapabilities{})
 
-func (a *apiHandler[data]) getPeer() (peerCapabilities, error) {
+func (s *Server) setPeer(r *http.Request) (*http.Request, error) {
 	// TODO(tailscale/corp#16695,sonia): We also call StatusWithoutPeers and
 	// WhoIs when originally checking for a session from authorizeRequest.
 	// Would be nice if we could pipe those through to here so we don't end
 	// up having to re-call them to grab the peer capabilities.
-	status, err := a.s.lc.StatusWithoutPeers(a.r.Context())
+	status, err := s.lc.StatusWithoutPeers(r.Context())
 	if err != nil {
 		return nil, err
 	}
-	whois, err := a.s.lc.WhoIs(a.r.Context(), a.r.RemoteAddr)
+	whois, err := s.lc.WhoIs(r.Context(), r.RemoteAddr)
 	if err != nil {
 		return nil, err
 	}
@@ -573,56 +570,11 @@ func (a *apiHandler[data]) getPeer() (peerCapabilities, error) {
 	if err != nil {
 		return nil, err
 	}
-	return peer, nil
+	return r.WithContext(contextKeyPeer.WithValue(r.Context(), peer)), nil
 }
 
-type noBodyData any // empty type, for use from serveAPI for endpoints with empty body
-
-// handle runs the given handler if the source peer satisfies the
-// constraints for running this request.
-//
-// handle is expected for use when `data` type is empty, or set to
-// `noBodyData` in practice. For requests that expect JSON body data
-// to be attached, use handleJSON instead.
-func (a *apiHandler[data]) handle(h http.HandlerFunc) {
-	peer, err := a.getPeer()
-	if err != nil {
-		http.Error(a.w, err.Error(), http.StatusInternalServerError)
-		return
-	}
-	var body data // not used
-	if !a.permissionCheck(body, peer) {
-		http.Error(a.w, "not allowed", http.StatusUnauthorized)
-		return
-	}
-	h(a.w, a.r)
-}
-
-// handleJSON manages decoding the request's body JSON and passing
-// it on to the provided function if the source peer satisfies the
-// constraints for running this request.
-func (a *apiHandler[data]) handleJSON(h func(ctx context.Context, data data) error) {
-	defer a.r.Body.Close()
-	var body data
-	if err := json.NewDecoder(a.r.Body).Decode(&body); err != nil {
-		http.Error(a.w, err.Error(), http.StatusInternalServerError)
-		return
-	}
-	peer, err := a.getPeer()
-	if err != nil {
-		http.Error(a.w, err.Error(), http.StatusInternalServerError)
-		return
-	}
-	if !a.permissionCheck(body, peer) {
-		http.Error(a.w, "not allowed", http.StatusUnauthorized)
-		return
-	}
-
-	if err := h(a.r.Context(), body); err != nil {
-		http.Error(a.w, err.Error(), http.StatusInternalServerError)
-		return
-	}
-	a.w.WriteHeader(http.StatusOK)
+func (s *Server) getPeer(ctx context.Context) peerCapabilities {
+	return contextKeyPeer.Value(ctx)
 }
 
 // serveAPI serves requests for the web client api.
@@ -637,67 +589,44 @@ func (s *Server) serveAPI(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
+	var err error
+	r, err = s.setPeer(r)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusUnauthorized)
+		return
+	}
+
 	path := strings.TrimPrefix(r.URL.Path, "/api")
 	switch {
 	case path == "/data" && r.Method == httpm.GET:
-		newHandler[noBodyData](s, w, r, alwaysAllowed).
-			handle(s.serveGetNodeData)
+		s.serveGetNodeData(w, r)
 		return
 	case path == "/exit-nodes" && r.Method == httpm.GET:
-		newHandler[noBodyData](s, w, r, alwaysAllowed).
-			handle(s.serveGetExitNodes)
+		s.serveGetExitNodes(w, r)
 		return
 	case path == "/routes" && r.Method == httpm.POST:
-		peerAllowed := func(d postRoutesRequest, p peerCapabilities) bool {
-			if d.SetExitNode && !p.canEdit(capFeatureExitNodes) {
-				return false
-			} else if d.SetRoutes && !p.canEdit(capFeatureSubnets) {
-				return false
-			}
-			return true
-		}
-		newHandler[postRoutesRequest](s, w, r, peerAllowed).
-			handleJSON(s.servePostRoutes)
+		handleJSON[postRoutesRequest](s.servePostRoutes)(w, r)
 		return
 	case path == "/device-details-click" && r.Method == httpm.POST:
-		newHandler[noBodyData](s, w, r, alwaysAllowed).
-			handle(s.serveDeviceDetailsClick)
+		s.serveDeviceDetailsClick(w, r)
 		return
 	case path == "/local/v0/logout" && r.Method == httpm.POST:
-		peerAllowed := func(_ noBodyData, peer peerCapabilities) bool {
-			return peer.canEdit(capFeatureAccount)
-		}
-		newHandler[noBodyData](s, w, r, peerAllowed).
-			handle(s.proxyRequestToLocalAPI)
+		s.proxyRequestToLocalAPI(w, r)
 		return
 	case path == "/local/v0/prefs" && r.Method == httpm.PATCH:
-		peerAllowed := func(data maskedPrefs, peer peerCapabilities) bool {
-			if data.RunSSHSet && !peer.canEdit(capFeatureSSH) {
-				return false
-			}
-			return true
-		}
-		newHandler[maskedPrefs](s, w, r, peerAllowed).
-			handleJSON(s.serveUpdatePrefs)
+		handleJSON[maskedPrefs](s.serveUpdatePrefs)(w, r)
 		return
 	case path == "/local/v0/update/check" && r.Method == httpm.GET:
-		newHandler[noBodyData](s, w, r, alwaysAllowed).
-			handle(s.proxyRequestToLocalAPI)
+		s.proxyRequestToLocalAPI(w, r)
 		return
 	case path == "/local/v0/update/check" && r.Method == httpm.POST:
-		peerAllowed := func(_ noBodyData, peer peerCapabilities) bool {
-			return peer.canEdit(capFeatureAccount)
-		}
-		newHandler[noBodyData](s, w, r, peerAllowed).
-			handle(s.proxyRequestToLocalAPI)
+		s.proxyRequestToLocalAPI(w, r)
 		return
 	case path == "/local/v0/update/progress" && r.Method == httpm.POST:
-		newHandler[noBodyData](s, w, r, alwaysAllowed).
-			handle(s.proxyRequestToLocalAPI)
+		s.proxyRequestToLocalAPI(w, r)
 		return
 	case path == "/local/v0/upload-client-metrics" && r.Method == httpm.POST:
-		newHandler[noBodyData](s, w, r, alwaysAllowed).
-			handle(s.proxyRequestToLocalAPI)
+		s.proxyRequestToLocalAPI(w, r)
 		return
 	}
 	http.Error(w, "invalid endpoint", http.StatusNotFound)
@@ -1122,6 +1051,11 @@ type maskedPrefs struct {
 }
 
 func (s *Server) serveUpdatePrefs(ctx context.Context, prefs maskedPrefs) error {
+	peer := s.getPeer(ctx)
+	if prefs.RunSSHSet && !peer.canEdit(capFeatureSSH) {
+		return tsweb.Error(http.StatusUnauthorized, "RunSSHSet not allowed", nil)
+	}
+
 	_, err := s.lc.EditPrefs(ctx, &ipn.MaskedPrefs{
 		RunSSHSet: prefs.RunSSHSet,
 		Prefs: ipn.Prefs{
@@ -1140,6 +1074,17 @@ type postRoutesRequest struct {
 }
 
 func (s *Server) servePostRoutes(ctx context.Context, data postRoutesRequest) error {
+	if !data.SetExitNode && !data.SetRoutes {
+		return tsweb.Error(http.StatusBadRequest, "must specify SetExitNode or SetRoutes", nil)
+	}
+	peer := s.getPeer(ctx)
+	if data.SetExitNode && !peer.canEdit(capFeatureExitNodes) {
+		return tsweb.Error(http.StatusUnauthorized, "SetExitNode not allowed", nil)
+	}
+	if data.SetRoutes && !peer.canEdit(capFeatureSubnets) {
+		return tsweb.Error(http.StatusUnauthorized, "SetRoutes not allowed", nil)
+	}
+
 	prefs, err := s.lc.GetPrefs(ctx)
 	if err != nil {
 		return err
@@ -1153,13 +1098,14 @@ func (s *Server) servePostRoutes(ctx context.Context, data postRoutesRequest) er
 		}
 		currNonExitRoutes = append(currNonExitRoutes, r.String())
 	}
-	// Set non-edited fields to their current values.
-	if data.SetExitNode {
-		data.AdvertiseRoutes = currNonExitRoutes
-	} else if data.SetRoutes {
+	// For each group of fields not being set, preserve the current prefs.
+	if !data.SetExitNode {
 		data.AdvertiseExitNode = currAdvertisingExitNode
 		data.UseExitNode = prefs.ExitNodeID
 	}
+	if !data.SetRoutes {
+		data.AdvertiseRoutes = currNonExitRoutes
+	}
 
 	// Calculate routes.
 	routesStr := strings.Join(data.AdvertiseRoutes, ",")
@@ -1336,6 +1282,19 @@ func (s *Server) proxyRequestToLocalAPI(w http.ResponseWriter, r *http.Request)
 		return
 	}
 
+	switch path {
+	case "/v0/logout":
+		if !s.getPeer(r.Context()).canEdit(capFeatureAccount) {
+			http.Error(w, "not allowed", http.StatusUnauthorized)
+			return
+		}
+	case "/v0/update/check":
+		if r.Method == httpm.POST && !s.getPeer(r.Context()).canEdit(capFeatureAccount) {
+			http.Error(w, "not allowed", http.StatusUnauthorized)
+			return
+		}
+	}
+
 	localAPIURL := "http://" + apitype.LocalAPIHost + "/localapi" + path
 	req, err := http.NewRequestWithContext(r.Context(), r.Method, localAPIURL, r.Body)
 	if err != nil {
diff --git a/client/web/web_test.go b/client/web/web_test.go
index 032cd5222..51b6a8ac5 100644
--- a/client/web/web_test.go
+++ b/client/web/web_test.go
@@ -191,7 +191,7 @@ func TestServeAPI(t *testing.T) {
 		reqBody:   "{\"setExitNode\":true}",
 		tests: []requestTest{{
 			remoteIP:     remoteIPWithNoCapabilities,
-			wantResponse: "not allowed",
+			wantResponse: "SetExitNode not allowed",
 			wantStatus:   http.StatusUnauthorized,
 		}, {
 			remoteIP:   remoteIPWithAllCapabilities,
@@ -204,7 +204,7 @@ func TestServeAPI(t *testing.T) {
 		reqContentType: "application/json",
 		tests: []requestTest{{
 			remoteIP:     remoteIPWithNoCapabilities,
-			wantResponse: "not allowed",
+			wantResponse: "RunSSHSet not allowed",
 			wantStatus:   http.StatusUnauthorized,
 		}, {
 			remoteIP:   remoteIPWithAllCapabilities,
@@ -1604,3 +1604,149 @@ func TestCSRFProtect(t *testing.T) {
 		})
 	}
 }
+
+func TestServePostRoutes(t *testing.T) {
+	existingExitNodeID := tailcfg.StableNodeID("existing-exit-node")
+	existingRoute := netip.MustParsePrefix("192.168.1.0/24")
+
+	existingPrefs := &ipn.Prefs{
+		ExitNodeID:      existingExitNodeID,
+		AdvertiseRoutes: []netip.Prefix{existingRoute},
+	}
+
+	tests := []struct {
+		name           string
+		data           postRoutesRequest
+		peerCaps       peerCapabilities
+		wantErr        bool
+		wantEditPrefs  bool // whether EditPrefs (PATCH /prefs) should be called
+		wantExitNodeID tailcfg.StableNodeID
+		wantRoutes     []netip.Prefix
+	}{
+		{
+			name:          "empty-request",
+			data:          postRoutesRequest{},
+			peerCaps:      peerCapabilities{capFeatureExitNodes: true, capFeatureSubnets: true},
+			wantErr:       true,
+			wantEditPrefs: false,
+		},
+		{
+			name: "SetExitNode-only",
+			data: postRoutesRequest{
+				SetExitNode: true,
+				UseExitNode: "new-exit-node",
+			},
+			peerCaps:       peerCapabilities{capFeatureExitNodes: true, capFeatureSubnets: true},
+			wantEditPrefs:  true,
+			wantExitNodeID: "new-exit-node",
+			wantRoutes:     []netip.Prefix{existingRoute},
+		},
+		{
+			name: "SetExitNode-not-allowed",
+			data: postRoutesRequest{
+				SetExitNode: true,
+				UseExitNode: "new-exit-node",
+			},
+			peerCaps: peerCapabilities{capFeatureSubnets: true},
+			wantErr:  true,
+		},
+		{
+			name: "SetRoutes-only",
+			data: postRoutesRequest{
+				SetRoutes:       true,
+				AdvertiseRoutes: []string{"10.0.0.0/8"},
+			},
+			peerCaps:       peerCapabilities{capFeatureExitNodes: true, capFeatureSubnets: true},
+			wantEditPrefs:  true,
+			wantExitNodeID: existingExitNodeID,
+			wantRoutes:     []netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")},
+		},
+		{
+			name: "SetRoutes-not-allowed",
+			data: postRoutesRequest{
+				SetRoutes:       true,
+				AdvertiseRoutes: []string{"10.0.0.0/8"},
+			},
+			peerCaps: peerCapabilities{capFeatureExitNodes: true},
+			wantErr:  true,
+		},
+		{
+			name: "SetExitNode-and-SetRoutes",
+			data: postRoutesRequest{
+				SetExitNode:     true,
+				SetRoutes:       true,
+				UseExitNode:     "new-exit-node",
+				AdvertiseRoutes: []string{"10.0.0.0/8"},
+			},
+			peerCaps:       peerCapabilities{capFeatureExitNodes: true, capFeatureSubnets: true},
+			wantEditPrefs:  true,
+			wantExitNodeID: "new-exit-node",
+			wantRoutes:     []netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var gotPrefs *ipn.MaskedPrefs
+
+			lal := memnet.Listen("local-tailscaled.sock:80")
+			defer lal.Close()
+
+			localapi := &http.Server{Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if r.URL.Path != "/localapi/v0/prefs" {
+					t.Errorf("unexpected localapi call to %q", r.URL.Path)
+					http.Error(w, "unexpected localapi call", http.StatusInternalServerError)
+					return
+				}
+				switch r.Method {
+				case httpm.GET:
+					writeJSON(w, existingPrefs)
+				case httpm.PATCH:
+					var mp ipn.MaskedPrefs
+					if err := json.NewDecoder(r.Body).Decode(&mp); err != nil {
+						http.Error(w, err.Error(), http.StatusBadRequest)
+						return
+					}
+					gotPrefs = &mp
+					writeJSON(w, gotPrefs.Prefs)
+				default:
+					t.Errorf("unexpected method %q on /prefs", r.Method)
+					http.Error(w, "unexpected method", http.StatusMethodNotAllowed)
+				}
+			})}
+			defer localapi.Close()
+			go localapi.Serve(lal)
+
+			s := &Server{
+				mode: ManageServerMode,
+				lc:   &local.Client{Dial: lal.Dial},
+			}
+
+			ctx := contextKeyPeer.WithValue(t.Context(), tt.peerCaps)
+			err := s.servePostRoutes(ctx, tt.data)
+
+			if tt.wantErr {
+				if err == nil {
+					t.Error("wanted error, got nil")
+				}
+				if gotPrefs != nil {
+					t.Error("EditPrefs should not have been called on error")
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+
+			if gotPrefs == nil {
+				t.Fatal("expected EditPrefs to be called")
+			}
+			if diff := cmp.Diff(tt.wantExitNodeID, gotPrefs.ExitNodeID); diff != "" {
+				t.Errorf("ExitNodeID mismatch (-want +got):\n%s", diff)
+			}
+			if diff := cmp.Diff(tt.wantRoutes, gotPrefs.AdvertiseRoutes, cmp.Comparer(func(a, b netip.Prefix) bool { return a.Compare(b) == 0 })); diff != "" {
+				t.Errorf("AdvertiseRoutes mismatch (-want +got):\n%s", diff)
+			}
+		})
+	}
+}
diff --git a/clientupdate/clientupdate.go b/clientupdate/clientupdate.go
index 6d034b342..20d2e7b0a 100644
--- a/clientupdate/clientupdate.go
+++ b/clientupdate/clientupdate.go
@@ -11,6 +11,7 @@ import (
 	"bufio"
 	"bytes"
 	"compress/gzip"
+	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -37,6 +38,25 @@ import (
 	"tailscale.com/version/distro"
 )
 
+// GokrazyUpdateArgs contains arguments for updating a Gokrazy appliance from a
+// GAF fetched from a URL.
+type GokrazyUpdateArgs struct {
+	// URL is the GAF download URL.
+	URL string
+
+	// AllowUnsigned permits installing a GAF without signature verification.
+	// It is intended for tests that serve a GAF from a fileserver that does
+	// not publish distsign.pub.
+	AllowUnsigned bool
+
+	// Logf is optional; nil discards log messages.
+	Logf logger.Logf
+}
+
+// GokrazyUpdateFromURL updates a Gokrazy appliance from a GAF fetched from a
+// URL, if Gokrazy update support is linked into the binary.
+var GokrazyUpdateFromURL feature.Hook[func(context.Context, GokrazyUpdateArgs) error]
+
 const (
 	StableTrack           = "stable"
 	UnstableTrack         = "unstable"
@@ -197,6 +217,17 @@ func (up *Updater) getUpdateFunction() (fn updateFunction, canAutoUpdate bool) {
 			// release cadence with Synology Package Center and use their
 			// auto-update mechanism.
 			return up.updateSynology, false
+		case distro.Gokrazy:
+			// Only the official Tailscale appliance image (built with the
+			// ts_appliance build tag, which causes hostinfo to report
+			// Package="tsapp") is auto-updatable. A user running a custom
+			// Gokrazy build that happens to include tailscaled must not be
+			// updated with our stock GAFs. TS_FORCE_ALLOW_TSAPP_UPDATE is an
+			// escape hatch for callers who know what they're doing.
+			if hi.Package != "tsapp" && !envknob.Bool("TS_FORCE_ALLOW_TSAPP_UPDATE") {
+				return nil, false
+			}
+			return up.updateGokrazy, true
 		case distro.Debian: // includes Ubuntu
 			return up.updateDebLike, true
 		case distro.Arch:
@@ -330,7 +361,7 @@ func (up *Updater) updateSynology() error {
 	if err != nil {
 		return err
 	}
-	latest, err := latestPackages(up.Track)
+	latest, err := LatestPackages(up.Track)
 	if err != nil {
 		return err
 	}
@@ -864,6 +895,56 @@ func (up *Updater) updateFreeBSD() (err error) {
 	return nil
 }
 
+// updateGokrazy fetches the latest signed GAF for this gokrazy device variant
+// (vm-amd64, vm-arm64, or pi-arm64) from up.PkgsAddr and applies it via the
+// local gokrazy init update API.
+func (up *Updater) updateGokrazy() error {
+	if !GokrazyUpdateFromURL.IsSet() {
+		return errors.New("gokrazy update support is not linked into this binary")
+	}
+	variant, err := gokrazyDeviceVariant()
+	if err != nil {
+		return err
+	}
+	latest, err := LatestPackages(up.Track)
+	if err != nil {
+		return err
+	}
+	gafName, ok := latest.GAFs[variant]
+	if !ok {
+		return fmt.Errorf("no GAF for device %q on %q track", variant, up.Track)
+	}
+	if latest.GAFsVersion == "" {
+		return fmt.Errorf("no GAF version on %q track", up.Track)
+	}
+	if !up.confirm(latest.GAFsVersion) {
+		return nil
+	}
+	gafURL := fmt.Sprintf("%s/%s/%s", strings.TrimRight(up.PkgsAddr, "/"), up.Track, gafName)
+	up.Logf("Updating to %s (%s)", latest.GAFsVersion, gafURL)
+	return GokrazyUpdateFromURL.Get()(context.Background(), GokrazyUpdateArgs{
+		URL:  gafURL,
+		Logf: up.Logf,
+	})
+}
+
+// gokrazyDeviceVariant returns the GAFs JSON key for the current gokrazy
+// device, e.g. "vm-amd64", "vm-arm64", or "pi-arm64". On arm64, it reads the
+// device-tree model to tell a Raspberry Pi apart from a VM.
+func gokrazyDeviceVariant() (string, error) {
+	switch runtime.GOARCH {
+	case "amd64":
+		return "vm-amd64", nil
+	case "arm64":
+		b, _ := os.ReadFile("/sys/firmware/devicetree/base/model")
+		if strings.HasPrefix(strings.Trim(string(b), "\x00\r\n\t "), "Raspberry Pi") {
+			return "pi-arm64", nil
+		}
+		return "vm-arm64", nil
+	}
+	return "", fmt.Errorf("unsupported gokrazy GOARCH %q", runtime.GOARCH)
+}
+
 func (up *Updater) updateLinuxBinary() error {
 	// Root is needed to overwrite binaries and restart systemd unit.
 	if err := requireRoot(); err != nil {
@@ -1224,7 +1305,7 @@ func LatestTailscaleVersion(track string) (string, error) {
 		track = CurrentTrack
 	}
 
-	latest, err := latestPackages(track)
+	latest, err := LatestPackages(track)
 	if err != nil {
 		return "", err
 	}
@@ -1236,8 +1317,11 @@ func LatestTailscaleVersion(track string) (string, error) {
 		ver = latest.MacZipsVersion
 	case "linux":
 		ver = latest.TarballsVersion
-		if distro.Get() == distro.Synology {
+		switch distro.Get() {
+		case distro.Synology:
 			ver = latest.SPKsVersion
+		case distro.Gokrazy:
+			ver = latest.GAFsVersion
 		}
 	}
 
@@ -1247,7 +1331,8 @@ func LatestTailscaleVersion(track string) (string, error) {
 	return ver, nil
 }
 
-type trackPackages struct {
+// TrackPackages is the JSON shape served at <pkgs>/<track>/?mode=json.
+type TrackPackages struct {
 	Version         string
 	Tarballs        map[string]string
 	TarballsVersion string
@@ -1255,6 +1340,8 @@ type trackPackages struct {
 	ExesVersion     string
 	MSIs            map[string]string
 	MSIsVersion     string
+	GAFs            map[string]string
+	GAFsVersion     string
 	MacZips         map[string]string
 	MacZipsVersion  string
 	SPKs            map[string]map[string]string
@@ -1263,14 +1350,16 @@ type trackPackages struct {
 
 var tailscaleHTTPEndpoint = "https://pkgs.tailscale.com"
 
-func latestPackages(track string) (*trackPackages, error) {
+// LatestPackages fetches the package manifest served at
+// <pkgs>/<track>/?mode=json for the current runtime.GOOS.
+func LatestPackages(track string) (*TrackPackages, error) {
 	url := fmt.Sprintf("%s/%s/?mode=json&os=%s", tailscaleHTTPEndpoint, track, runtime.GOOS)
 	res, err := http.Get(url)
 	if err != nil {
 		return nil, fmt.Errorf("fetching latest tailscale version: %w", err)
 	}
 	defer res.Body.Close()
-	var latest trackPackages
+	var latest TrackPackages
 	if err := json.NewDecoder(res.Body).Decode(&latest); err != nil {
 		return nil, fmt.Errorf("decoding JSON: %v: %w", res.Status, err)
 	}
diff --git a/clientupdate/clientupdate_gokrazy.go b/clientupdate/clientupdate_gokrazy.go
new file mode 100644
index 000000000..1ffd5477f
--- /dev/null
+++ b/clientupdate/clientupdate_gokrazy.go
@@ -0,0 +1,239 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build linux
+
+package clientupdate
+
+import (
+	"archive/zip"
+	"context"
+	"fmt"
+	"hash/crc32"
+	"io"
+	"net"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+
+	"tailscale.com/clientupdate/distsign"
+	"tailscale.com/types/logger"
+	"tailscale.com/util/progresstracking"
+)
+
+const (
+	gokrazyUpdateSocket  = "/run/gokrazy-http.sock"
+	gokrazyUpdateBaseURL = "http://gokrazy-local-unixsock"
+)
+
+// GokrazyUpdateFromURL downloads a Gokrazy archive format file from args.URL,
+// installs its partitions using the local gokrazy init update API, switches to
+// the new root partition, and asks gokrazy to reboot.
+//
+// The local gokrazy API is reached over gokrazyUpdateSocket. The
+// gokrazyUpdateBaseURL host is only a net/http URL sentinel; it is not resolved
+// with DNS.
+func init() {
+	GokrazyUpdateFromURL.Set(gokrazyUpdateFromURL)
+}
+
+func gokrazyUpdateFromURL(ctx context.Context, args GokrazyUpdateArgs) error {
+	logf := args.Logf
+	if logf == nil {
+		logf = logger.Discard
+	}
+
+	tmp, err := os.CreateTemp("", "tailscale-gokrazy-*.gaf")
+	if err != nil {
+		return err
+	}
+	tmpName := tmp.Name()
+	tmp.Close()
+	defer os.Remove(tmpName)
+
+	logf("downloading %s", args.URL)
+	if args.AllowUnsigned {
+		if err := downloadUnverified(ctx, logf, args.URL, tmpName); err != nil {
+			return err
+		}
+	} else {
+		if err := distsign.DownloadVerified(ctx, logf, args.URL, tmpName); err != nil {
+			return err
+		}
+	}
+
+	zr, err := zip.OpenReader(tmpName)
+	if err != nil {
+		return err
+	}
+	defer zr.Close()
+
+	logf("download complete")
+
+	gokClient := gokrazyHTTPClient()
+	for _, part := range []struct {
+		name string
+		path string
+	}{
+		{"root.img", "/update/root"},
+		{"boot.img", "/update/boot"},
+		{"mbr.img", "/update/mbr"},
+	} {
+		logf("writing %s...", part.name)
+		if err := putGokrazyGAFMember(ctx, gokClient, zr.File, part.name, part.path); err != nil {
+			return err
+		}
+		logf("wrote %s", part.name)
+	}
+	if err := postGokrazy(ctx, gokClient, "/update/switch"); err != nil {
+		return err
+	}
+	logf("switched boot target")
+	if err := postGokrazy(ctx, gokClient, "/reboot?async=true&kexec_merge_cmdline=true"); err != nil {
+		return err
+	}
+	logf("reboot requested")
+	return nil
+}
+
+// downloadUnverified saves the GAF at srcURL to dstPath without verifying
+// a signature. It is used only when args.AllowUnsigned is set, for tests
+// that serve the GAF from a fileserver that does not publish distsign.pub
+// and for the gafpush "sftp the GAF onto the appliance and update from a
+// local path" flow, which uses a "file://" URL.
+func downloadUnverified(ctx context.Context, logf logger.Logf, srcURL, dstPath string) error {
+	if after, ok := strings.CutPrefix(srcURL, "file://"); ok {
+		return copyLocalFile(after, dstPath, logf)
+	}
+	req, err := http.NewRequestWithContext(ctx, "GET", srcURL, nil)
+	if err != nil {
+		return err
+	}
+	res, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return err
+	}
+	defer res.Body.Close()
+	if res.StatusCode != http.StatusOK {
+		return fmt.Errorf("download GAF: %s", res.Status)
+	}
+	f, err := os.Create(dstPath)
+	if err != nil {
+		return err
+	}
+	total := res.ContentLength
+	pw := progresstracking.NewWriter(io.Discard, total, time.Second, func(done int64) {
+		if total > 0 {
+			logf("downloading: %d / %d MB (%.0f%%)", done>>20, total>>20, float64(done)/float64(total)*100)
+		}
+	})
+	if _, err := io.Copy(f, io.TeeReader(res.Body, pw)); err != nil {
+		f.Close()
+		return err
+	}
+	return f.Close()
+}
+
+// copyLocalFile copies the GAF at src to dst. Used by the "file://" branch
+// of downloadUnverified. The source file is left in place; callers that
+// staged it (e.g. gafpush) clean up after the update completes.
+func copyLocalFile(src, dst string, logf logger.Logf) error {
+	sf, err := os.Open(src)
+	if err != nil {
+		return err
+	}
+	defer sf.Close()
+	df, err := os.Create(dst)
+	if err != nil {
+		return err
+	}
+	fi, err := sf.Stat()
+	if err != nil {
+		df.Close()
+		return err
+	}
+	total := fi.Size()
+	logf("copying local GAF %s (%d MB)", src, total>>20)
+	pw := progresstracking.NewWriter(io.Discard, total, time.Second, func(done int64) {
+		if total > 0 {
+			logf("copying: %d / %d MB (%.0f%%)", done>>20, total>>20, float64(done)/float64(total)*100)
+		}
+	})
+	if _, err := io.Copy(df, io.TeeReader(sf, pw)); err != nil {
+		df.Close()
+		return err
+	}
+	return df.Close()
+}
+
+func gokrazyHTTPClient() *http.Client {
+	tr := http.DefaultTransport.(*http.Transport).Clone()
+	tr.DialContext = func(ctx context.Context, network, addr string) (net.Conn, error) {
+		var d net.Dialer
+		return d.DialContext(ctx, "unix", gokrazyUpdateSocket)
+	}
+	return &http.Client{
+		Transport: tr,
+		CheckRedirect: func(req *http.Request, via []*http.Request) error {
+			return http.ErrUseLastResponse
+		},
+	}
+}
+
+func putGokrazyGAFMember(ctx context.Context, hc *http.Client, files []*zip.File, name, path string) error {
+	var zf *zip.File
+	for _, f := range files {
+		if f.Name == name {
+			zf = f
+			break
+		}
+	}
+	if zf == nil {
+		return fmt.Errorf("GAF is missing %s", name)
+	}
+	rc, err := zf.Open()
+	if err != nil {
+		return err
+	}
+	defer rc.Close()
+
+	h := crc32.NewIEEE()
+	body := io.TeeReader(rc, h)
+	req, err := http.NewRequestWithContext(ctx, "PUT", gokrazyUpdateBaseURL+path, body)
+	if err != nil {
+		return err
+	}
+	req.ContentLength = int64(zf.UncompressedSize64)
+	req.Header.Set("X-Gokrazy-Update-Hash", "crc32")
+	res, err := hc.Do(req)
+	if err != nil {
+		return err
+	}
+	defer res.Body.Close()
+	resBody, _ := io.ReadAll(io.LimitReader(res.Body, 1<<20))
+	if res.StatusCode != http.StatusOK {
+		return fmt.Errorf("PUT %s: %s: %s", path, res.Status, strings.TrimSpace(string(resBody)))
+	}
+	if got, want := strings.TrimSpace(string(resBody)), fmt.Sprintf("%08x", h.Sum32()); got != want {
+		return fmt.Errorf("PUT %s: gokrazy checksum = %q; want %q", path, got, want)
+	}
+	return nil
+}
+
+func postGokrazy(ctx context.Context, hc *http.Client, path string) error {
+	req, err := http.NewRequestWithContext(ctx, "POST", gokrazyUpdateBaseURL+path, nil)
+	if err != nil {
+		return err
+	}
+	res, err := hc.Do(req)
+	if err != nil {
+		return err
+	}
+	defer res.Body.Close()
+	if res.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(io.LimitReader(res.Body, 1<<20))
+		return fmt.Errorf("POST %s: %s: %s", path, res.Status, strings.TrimSpace(string(body)))
+	}
+	return nil
+}
diff --git a/clientupdate/clientupdate_test.go b/clientupdate/clientupdate_test.go
index 8095151c8..d2e7601be 100644
--- a/clientupdate/clientupdate_test.go
+++ b/clientupdate/clientupdate_test.go
@@ -373,7 +373,7 @@ func TestCheckOutdatedAlpineRepo(t *testing.T) {
 
 			testServ := httptest.NewServer(http.HandlerFunc(
 				func(w http.ResponseWriter, _ *http.Request) {
-					version := trackPackages{
+					version := TrackPackages{
 						MSIsVersion:     tt.latestHTTPVersion,
 						MacZipsVersion:  tt.latestHTTPVersion,
 						TarballsVersion: tt.latestHTTPVersion,
diff --git a/clientupdate/clientupdate_windows.go b/clientupdate/clientupdate_windows.go
index 70a3c5091..50b77c38b 100644
--- a/clientupdate/clientupdate_windows.go
+++ b/clientupdate/clientupdate_windows.go
@@ -38,12 +38,12 @@ const (
 	updaterPrefix = "tailscale-updater"
 )
 
-func makeSelfCopy() (origPathExe, tmpPathExe string, err error) {
-	selfExe, err := os.Executable()
+func makeCmdTailscaleCopy() (origPathExe, tmpPathExe string, err error) {
+	srcExe, err := findCmdTailscale()
 	if err != nil {
 		return "", "", err
 	}
-	f, err := os.Open(selfExe)
+	f, err := os.Open(srcExe)
 	if err != nil {
 		return "", "", err
 	}
@@ -59,7 +59,25 @@ func makeSelfCopy() (origPathExe, tmpPathExe string, err error) {
 		f2.Close()
 		return "", "", err
 	}
-	return selfExe, f2.Name(), f2.Close()
+	return srcExe, f2.Name(), f2.Close()
+}
+
+// findCmdTailscale returns the path to the binary that should be copied for the update
+// re-execution. The copy is re-executed with "update" as a subcommand, so it must be
+// a binary that handles "update" (ie tailscale.exe, not tailscaled.exe)
+func findCmdTailscale() (string, error) {
+	selfExe, err := os.Executable()
+	if err != nil {
+		return "", err
+	}
+	if strings.EqualFold(filepath.Base(selfExe), "tailscale.exe") {
+		return selfExe, nil
+	}
+	ts := filepath.Join(filepath.Dir(selfExe), "tailscale.exe")
+	if _, err := os.Stat(ts); err != nil {
+		return "", fmt.Errorf("cannot find tailscale.exe alongside %s: %w", selfExe, err)
+	}
+	return ts, nil
 }
 
 func markTempFileWindows(name string) error {
@@ -159,14 +177,14 @@ you can run the command prompt as Administrator one of these ways:
 
 	up.Logf("making tailscale.exe copy to switch to...")
 	up.cleanupOldDownloads(filepath.Join(os.TempDir(), updaterPrefix+"-*.exe"))
-	_, selfCopy, err := makeSelfCopy()
+	_, cmdTailscaleCopy, err := makeCmdTailscaleCopy()
 	if err != nil {
 		return err
 	}
-	defer os.Remove(selfCopy)
+	defer os.Remove(cmdTailscaleCopy)
 	up.Logf("running tailscale.exe copy for final install...")
 
-	cmd := exec.Command(selfCopy, "update")
+	cmd := exec.Command(cmdTailscaleCopy, "update")
 	cmd.Env = append(os.Environ(), winMSIEnv+"="+msiTarget, winVersionEnv+"="+ver)
 	cmd.Stdout = up.Stderr
 	cmd.Stderr = up.Stderr
diff --git a/clientupdate/distsign/distsign.go b/clientupdate/distsign/distsign.go
index c804b855c..99ab193f8 100644
--- a/clientupdate/distsign/distsign.go
+++ b/clientupdate/distsign/distsign.go
@@ -56,9 +56,11 @@ import (
 	"github.com/hdevalence/ed25519consensus"
 	"golang.org/x/crypto/blake2s"
 	"tailscale.com/feature"
+	"tailscale.com/net/netutil"
 	"tailscale.com/types/logger"
 	"tailscale.com/util/httpm"
 	"tailscale.com/util/must"
+	"tailscale.com/util/progresstracking"
 )
 
 const (
@@ -329,7 +331,7 @@ func fetch(url string, limit int64) ([]byte, error) {
 // download writes the response body of url into a local file at dst, up to
 // limit bytes. On success, the returned value is a BLAKE2s hash of the file.
 func (c *Client) download(ctx context.Context, url, dst string, limit int64) ([]byte, int64, error) {
-	tr := http.DefaultTransport.(*http.Transport).Clone()
+	tr := netutil.NewDefaultTransport()
 	tr.Proxy = feature.HookProxyFromEnvironment.GetOrNil()
 	defer tr.CloseIdleConnections()
 	hc := &http.Client{
@@ -372,7 +374,10 @@ func (c *Client) download(ctx context.Context, url, dst string, limit int64) ([]
 		return nil, 0, err
 	}
 	defer of.Close()
-	pw := &progressWriter{total: res.ContentLength, logf: c.logf}
+	total := res.ContentLength
+	pw := progresstracking.NewWriter(io.Discard, total, 2*time.Second, func(done int64) {
+		c.logf("Downloaded %v/%v (%.1f%%)", done, total, float64(done)/float64(total)*100)
+	})
 	h := NewPackageHash()
 	n, err := io.Copy(io.MultiWriter(of, h, pw), io.LimitReader(dlRes.Body, limit))
 	if err != nil {
@@ -387,31 +392,10 @@ func (c *Client) download(ctx context.Context, url, dst string, limit int64) ([]
 	if err := of.Close(); err != nil {
 		return nil, n, err
 	}
-	pw.print()
 
 	return h.Sum(nil), h.Len(), nil
 }
 
-type progressWriter struct {
-	done      int64
-	total     int64
-	lastPrint time.Time
-	logf      logger.Logf
-}
-
-func (pw *progressWriter) Write(p []byte) (n int, err error) {
-	pw.done += int64(len(p))
-	if time.Since(pw.lastPrint) > 2*time.Second {
-		pw.print()
-	}
-	return len(p), nil
-}
-
-func (pw *progressWriter) print() {
-	pw.lastPrint = time.Now()
-	pw.logf("Downloaded %v/%v (%.1f%%)", pw.done, pw.total, float64(pw.done)/float64(pw.total)*100)
-}
-
 func parsePrivateKey(data []byte, typeTag string) (ed25519.PrivateKey, error) {
 	b, rest := pem.Decode(data)
 	if b == nil {
diff --git a/clientupdate/distsign/url.go b/clientupdate/distsign/url.go
new file mode 100644
index 000000000..1571cc73a
--- /dev/null
+++ b/clientupdate/distsign/url.go
@@ -0,0 +1,42 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package distsign
+
+import (
+	"context"
+	"fmt"
+	"net/url"
+	"strings"
+
+	"tailscale.com/types/logger"
+)
+
+// DownloadVerified is a convenience wrapper around [Client.Download]
+// for callers that have a full URL (e.g.
+// https://pkgs.tailscale.com/unstable/foo.gaf) rather than a base URL
+// plus path. It splits srcURL into a base ("scheme://host") and a path,
+// constructs a [Client] for the base, and downloads with signature
+// verification to dstPath.
+func DownloadVerified(ctx context.Context, logf logger.Logf, srcURL, dstPath string) error {
+	if logf == nil {
+		logf = logger.Discard
+	}
+	u, err := url.Parse(srcURL)
+	if err != nil {
+		return fmt.Errorf("parsing URL %q: %w", srcURL, err)
+	}
+	if u.Scheme == "" || u.Host == "" {
+		return fmt.Errorf("URL %q is missing scheme or host", srcURL)
+	}
+	base := &url.URL{Scheme: u.Scheme, User: u.User, Host: u.Host}
+	path := strings.TrimPrefix(u.Path, "/")
+	if path == "" {
+		return fmt.Errorf("URL %q has no path component", srcURL)
+	}
+	c, err := NewClient(logf, base.String())
+	if err != nil {
+		return err
+	}
+	return c.Download(ctx, path, dstPath)
+}
diff --git a/cmd/cigocacher/cigocacher.go b/cmd/cigocacher/cigocacher.go
index 74ed08367..5da783561 100644
--- a/cmd/cigocacher/cigocacher.go
+++ b/cmd/cigocacher/cigocacher.go
@@ -143,19 +143,32 @@ func main() {
 			log.Printf("Using cigocached at %s", *srvURL)
 		}
 		c.remote = &cachers.HTTPClient{
-			BaseURL:        *srvURL,
-			Disk:           c.disk,
-			HTTPClient:     httpClient(srvHost, *srvHostDial),
-			AccessToken:    *token,
-			Verbose:        *verbose,
-			BestEffortHTTP: true,
+			BaseURL:               *srvURL,
+			Disk:                  c.disk,
+			HTTPClient:            httpClient(srvHost, *srvHostDial),
+			AccessToken:           *token,
+			Verbose:               *verbose,
+			BestEffortHTTP:        true,
+			AsyncPutTimeout:       asyncPutTimeout,
+			AsyncPutMaxConcurrent: 10,
 		}
 	}
 	var p *cacheproc.Process
 	p = &cacheproc.Process{
 		Close: func() error {
+			if c.remote != nil {
+				ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+				defer cancel()
+				if !c.remote.Shutdown(ctx) {
+					log.Printf("cigocacher: timed out waiting for background PUTs to drain")
+				}
+				// Always surface dropped PUTs.
+				if timedOut, canceled := c.remote.PutsTimedOut.Load(), c.remote.PutsCanceled.Load(); timedOut+canceled > 0 {
+					log.Printf("cigocacher: %d background PUTs timed out, %d canceled", timedOut, canceled)
+				}
+			}
 			if c.verbose {
-				log.Printf("gocacheprog: closing; %d gets (%d hits, %d misses, %d errors); %d puts (%d errors)",
+				log.Printf("cigocacher: closing; %d gets (%d hits, %d misses, %d errors); %d puts (%d errors)",
 					p.Gets.Load(), p.GetHits.Load(), p.GetMisses.Load(), p.GetErrors.Load(), p.Puts.Load(), p.PutErrors.Load())
 			}
 			return c.close()
@@ -338,3 +351,23 @@ func fetchStats(cl *http.Client, baseURL, accessToken string) (string, error) {
 	}
 	return string(b), nil
 }
+
+const (
+	// minPutTimeout is the floor we clamp to for small objects where the time is
+	// dominated by fixed overheads like connection establishment, waiting for a
+	// busy server to service the request etc.
+	minPutTimeout = 5 * time.Second
+	// maxPutTimeout is the ceiling we clamp to for large objects.
+	maxPutTimeout = 30 * time.Second
+	// minAverageBandwidth is the minimum average bandwidth (2MiB/s) we require
+	// for PUTs to complete within the timeout in its linear scaling region.
+	minAverageBandwidth = 2 * 1 << 20 / float64(time.Second)
+)
+
+// asyncPutTimeout returns a size-dependent timeout for async PUTs to the remote
+// gocached server. It returns 5s for size <= 10MiB, 30s for size >= 60MiB and
+// scales linearly in between.
+func asyncPutTimeout(size int64) time.Duration {
+	timeout := time.Duration(float64(size) / minAverageBandwidth)
+	return min(max(minPutTimeout, timeout), maxPutTimeout)
+}
diff --git a/cmd/cigocacher/cigocacher_test.go b/cmd/cigocacher/cigocacher_test.go
new file mode 100644
index 000000000..a58514ba7
--- /dev/null
+++ b/cmd/cigocacher/cigocacher_test.go
@@ -0,0 +1,25 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package main
+
+import (
+	"testing"
+	"time"
+)
+
+func TestAsyncPutTimeout(t *testing.T) {
+	for size, expected := range map[int64]time.Duration{
+		0:            5 * time.Second,
+		10:           5 * time.Second,
+		10 * 1 << 20: 5 * time.Second,
+		20 * 1 << 20: 10 * time.Second,
+		40 * 1 << 20: 20 * time.Second,
+		60 * 1 << 20: 30 * time.Second,
+		10 * 1 << 30: 30 * time.Second,
+	} {
+		if actual := asyncPutTimeout(size); actual != expected {
+			t.Errorf("for size %d, expected %v, but got %v", size, expected, actual)
+		}
+	}
+}
diff --git a/cmd/cloner/cloner.go b/cmd/cloner/cloner.go
index ab4a7b22f..2894c862d 100644
--- a/cmd/cloner/cloner.go
+++ b/cmd/cloner/cloner.go
@@ -143,25 +143,9 @@ func gen(buf *bytes.Buffer, it *codegen.ImportTracker, typ *types.Named) {
 				writef("if src.%s != nil {", fname)
 				writef("dst.%s = make([]%s, len(src.%s))", fname, n, fname)
 				writef("for i := range dst.%s {", fname)
-				if ptr, isPtr := ft.Elem().(*types.Pointer); isPtr {
-					writef("if src.%s[i] == nil { dst.%s[i] = nil } else {", fname, fname)
-					if codegen.ContainsPointers(ptr.Elem()) {
-						if _, isIface := ptr.Elem().Underlying().(*types.Interface); isIface {
-							writef("\tdst.%s[i] = new((*src.%s[i]).Clone())", fname, fname)
-						} else {
-							writef("\tdst.%s[i] = src.%s[i].Clone()", fname, fname)
-						}
-					} else {
-						writef("\tdst.%s[i] = new(*src.%s[i])", fname, fname)
-					}
-					writef("}")
-				} else if ft.Elem().String() == "encoding/json.RawMessage" {
-					writef("\tdst.%s[i] = append(src.%s[i][:0:0], src.%s[i]...)", fname, fname, fname)
-				} else if _, isIface := ft.Elem().Underlying().(*types.Interface); isIface {
-					writef("\tdst.%s[i] = src.%s[i].Clone()", fname, fname)
-				} else {
-					writef("\tdst.%s[i] = *src.%s[i].Clone()", fname, fname)
-				}
+				writeSliceElemClone(writef, ft.Elem(),
+					fmt.Sprintf("src.%s[i]", fname),
+					fmt.Sprintf("dst.%s[i]", fname))
 				writef("}")
 				writef("}")
 			} else {
@@ -185,15 +169,32 @@ func gen(buf *bytes.Buffer, it *codegen.ImportTracker, typ *types.Named) {
 			writef("}")
 		case *types.Map:
 			elem := ft.Elem()
-			if sliceType, isSlice := elem.(*types.Slice); isSlice {
+			if sliceType, isSlice := elem.Underlying().(*types.Slice); isSlice {
 				n := it.QualifiedName(sliceType.Elem())
 				writef("if dst.%s != nil {", fname)
 				writef("\tdst.%s = map[%s]%s{}", fname, it.QualifiedName(ft.Key()), it.QualifiedName(elem))
-				writef("\tfor k := range src.%s {", fname)
-				// use zero-length slice instead of nil to ensure
-				// the key is always copied.
-				writef("\t\tdst.%s[k] = append([]%s{}, src.%s[k]...)", fname, n, fname)
-				writef("\t}")
+				if codegen.ContainsPointers(sliceType.Elem()) {
+					writef("\tfor k, sv := range src.%s {", fname)
+					writef("\t\tif sv == nil {")
+					writef("\t\t\tdst.%s[k] = nil", fname)
+					writef("\t\t\tcontinue")
+					writef("\t\t}")
+					writef("\t\tdst.%s[k] = make([]%s, len(sv))", fname, n)
+					writef("\t\tfor i := range sv {")
+					innerWritef := func(format string, args ...any) {
+						writef("\t\t"+format, args...)
+					}
+					writeSliceElemClone(innerWritef, sliceType.Elem(),
+						"sv[i]", fmt.Sprintf("dst.%s[k][i]", fname))
+					writef("\t\t}")
+					writef("\t}")
+				} else {
+					writef("\tfor k := range src.%s {", fname)
+					// use zero-length slice instead of nil to ensure
+					// the key is always copied.
+					writef("\t\tdst.%s[k] = append([]%s{}, src.%s[k]...)", fname, n, fname)
+					writef("\t}")
+				}
 				writef("}")
 			} else if codegen.IsViewType(elem) || !codegen.ContainsPointers(elem) {
 				// If the map values are view types (which are
@@ -242,6 +243,31 @@ func gen(buf *bytes.Buffer, it *codegen.ImportTracker, typ *types.Named) {
 	buf.Write(codegen.AssertStructUnchanged(t, name, typeParams, "Clone", it))
 }
 
+// writeSliceElemClone generates code to deep-clone a single slice element
+// from srcExpr to dstExpr. It handles pointer, json.RawMessage, interface,
+// and named struct element types.
+func writeSliceElemClone(writef func(string, ...any), elemType types.Type, srcExpr, dstExpr string) {
+	if ptr, isPtr := elemType.(*types.Pointer); isPtr {
+		writef("if %s == nil { %s = nil } else {", srcExpr, dstExpr)
+		if codegen.ContainsPointers(ptr.Elem()) {
+			if _, isIface := ptr.Elem().Underlying().(*types.Interface); isIface {
+				writef("\t%s = new((*%s).Clone())", dstExpr, srcExpr)
+			} else {
+				writef("\t%s = %s.Clone()", dstExpr, srcExpr)
+			}
+		} else {
+			writef("\t%s = new(*%s)", dstExpr, srcExpr)
+		}
+		writef("}")
+	} else if elemType.String() == "encoding/json.RawMessage" {
+		writef("%s = append(%s[:0:0], %s...)", dstExpr, srcExpr, srcExpr)
+	} else if _, isIface := elemType.Underlying().(*types.Interface); isIface {
+		writef("%s = %s.Clone()", dstExpr, srcExpr)
+	} else {
+		writef("%s = *%s.Clone()", dstExpr, srcExpr)
+	}
+}
+
 // hasBasicUnderlying reports true when typ.Underlying() is a slice or a map.
 func hasBasicUnderlying(typ types.Type) bool {
 	switch typ.Underlying().(type) {
diff --git a/cmd/cloner/cloner_test.go b/cmd/cloner/cloner_test.go
index c0a946480..04670e1f5 100644
--- a/cmd/cloner/cloner_test.go
+++ b/cmd/cloner/cloner_test.go
@@ -7,6 +7,7 @@ import (
 	"reflect"
 	"testing"
 
+	"github.com/google/go-cmp/cmp"
 	"tailscale.com/cmd/cloner/clonerex"
 )
 
@@ -182,6 +183,46 @@ func TestNamedMapContainer(t *testing.T) {
 	}
 }
 
+func TestMapSlicePointerContainer(t *testing.T) {
+	num := 42
+	orig := &clonerex.MapSlicePointerContainer{
+		Routes: map[string][]*clonerex.SliceContainer{
+			"route1": {
+				{Slice: []*int{&num}},
+				{Slice: []*int{&num, &num}},
+			},
+			"route2": {
+				{Slice: []*int{&num}},
+			},
+		},
+	}
+
+	cloned := orig.Clone()
+	if !reflect.DeepEqual(orig, cloned) {
+		t.Errorf("Clone() = %v, want %v", cloned, orig)
+	}
+
+	// Mutate cloned.Routes pointer values
+	*cloned.Routes["route1"][0].Slice[0] = 999
+	if *orig.Routes["route1"][0].Slice[0] == 999 {
+		t.Errorf("Clone() aliased memory in Routes: original was modified")
+	}
+}
+
+func TestMapSlicePointerContainerNilValue(t *testing.T) {
+	num := 7
+	orig := &clonerex.MapSlicePointerContainer{
+		Routes: map[string][]*clonerex.SliceContainer{
+			"nil-value": nil,
+			"non-nil":   {{Slice: []*int{&num}}},
+		},
+	}
+	cloned := orig.Clone()
+	if diff := cmp.Diff(orig.Routes, cloned.Routes); diff != "" {
+		t.Errorf("Clone() Routes mismatch (-orig +cloned):\n%s", diff)
+	}
+}
+
 func TestDeeplyNestedMap(t *testing.T) {
 	num := 123
 	orig := &clonerex.DeeplyNestedMap{
@@ -242,3 +283,13 @@ func TestDeeplyNestedMap(t *testing.T) {
 		t.Errorf("Clone() aliased FourLevels map: new nested key appeared in original")
 	}
 }
+
+func TestMapWithNamedSliceValues(t *testing.T) {
+	orig := &clonerex.MapWithNamedSliceValues{
+		M: map[string]clonerex.NamedSlice{"k": {"foo", "bar"}},
+	}
+	cloned := orig.Clone()
+	if diff := cmp.Diff(orig, cloned); diff != "" {
+		t.Errorf("Clone() mismatch (-orig +cloned):\n%s", diff)
+	}
+}
diff --git a/cmd/cloner/clonerex/clonerex.go b/cmd/cloner/clonerex/clonerex.go
index d17dbefc5..2f4c7a9e1 100644
--- a/cmd/cloner/clonerex/clonerex.go
+++ b/cmd/cloner/clonerex/clonerex.go
@@ -1,11 +1,13 @@
 // Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
-//go:generate go run tailscale.com/cmd/cloner  -clonefunc=true -type SliceContainer,InterfaceContainer,MapWithPointers,DeeplyNestedMap,NamedMapContainer
+//go:generate go run tailscale.com/cmd/cloner  -clonefunc=true -type SliceContainer,InterfaceContainer,MapWithPointers,DeeplyNestedMap,NamedMapContainer,MapSlicePointerContainer,MapWithNamedSliceValues
 
 // Package clonerex is an example package for the cloner tool.
 package clonerex
 
+import "maps"
+
 type SliceContainer struct {
 	Slice []*int
 }
@@ -49,9 +51,7 @@ func (m NamedMap) Clone() NamedMap {
 		return nil
 	}
 	m2 := make(NamedMap, len(m))
-	for k, v := range m {
-		m2[k] = v
-	}
+	maps.Copy(m2, m)
 	return m2
 }
 
@@ -60,8 +60,24 @@ type NamedMapContainer struct {
 	Attrs NamedMap
 }
 
+// MapSlicePointerContainer has a map whose values are slices of pointers.
+// This tests that the cloner deep-clones the pointer elements in the slice,
+// not just the slice itself (which would leave aliased pointers).
+type MapSlicePointerContainer struct {
+	Routes map[string][]*SliceContainer
+}
+
 // DeeplyNestedMap tests arbitrary depth of map nesting (3+ levels)
 type DeeplyNestedMap struct {
 	ThreeLevels map[string]map[string]map[string]int
 	FourLevels  map[string]map[string]map[string]map[string]*SliceContainer
 }
+
+// MapWithNamedSliceValues has a map with a named slice type for values. This
+// tests that the generator treats these values like any other slice and not a
+// struct.
+type MapWithNamedSliceValues struct {
+	M map[string]NamedSlice
+}
+
+type NamedSlice []string
diff --git a/cmd/cloner/clonerex/clonerex_clone.go b/cmd/cloner/clonerex/clonerex_clone.go
index 7d94688a3..dbe9f5387 100644
--- a/cmd/cloner/clonerex/clonerex_clone.go
+++ b/cmd/cloner/clonerex/clonerex_clone.go
@@ -176,9 +176,64 @@ var _NamedMapContainerCloneNeedsRegeneration = NamedMapContainer(struct {
 	Attrs NamedMap
 }{})
 
+// Clone makes a deep copy of MapSlicePointerContainer.
+// The result aliases no memory with the original.
+func (src *MapSlicePointerContainer) Clone() *MapSlicePointerContainer {
+	if src == nil {
+		return nil
+	}
+	dst := new(MapSlicePointerContainer)
+	*dst = *src
+	if dst.Routes != nil {
+		dst.Routes = map[string][]*SliceContainer{}
+		for k, sv := range src.Routes {
+			if sv == nil {
+				dst.Routes[k] = nil
+				continue
+			}
+			dst.Routes[k] = make([]*SliceContainer, len(sv))
+			for i := range sv {
+				if sv[i] == nil {
+					dst.Routes[k][i] = nil
+				} else {
+					dst.Routes[k][i] = sv[i].Clone()
+				}
+			}
+		}
+	}
+	return dst
+}
+
+// A compilation failure here means this code must be regenerated, with the command at the top of this file.
+var _MapSlicePointerContainerCloneNeedsRegeneration = MapSlicePointerContainer(struct {
+	Routes map[string][]*SliceContainer
+}{})
+
+// Clone makes a deep copy of MapWithNamedSliceValues.
+// The result aliases no memory with the original.
+func (src *MapWithNamedSliceValues) Clone() *MapWithNamedSliceValues {
+	if src == nil {
+		return nil
+	}
+	dst := new(MapWithNamedSliceValues)
+	*dst = *src
+	if dst.M != nil {
+		dst.M = map[string]NamedSlice{}
+		for k := range src.M {
+			dst.M[k] = append([]string{}, src.M[k]...)
+		}
+	}
+	return dst
+}
+
+// A compilation failure here means this code must be regenerated, with the command at the top of this file.
+var _MapWithNamedSliceValuesCloneNeedsRegeneration = MapWithNamedSliceValues(struct {
+	M map[string]NamedSlice
+}{})
+
 // Clone duplicates src into dst and reports whether it succeeded.
 // To succeed, <src, dst> must be of types <*T, *T> or <*T, **T>,
-// where T is one of SliceContainer,InterfaceContainer,MapWithPointers,DeeplyNestedMap,NamedMapContainer.
+// where T is one of SliceContainer,InterfaceContainer,MapWithPointers,DeeplyNestedMap,NamedMapContainer,MapSlicePointerContainer,MapWithNamedSliceValues.
 func Clone(dst, src any) bool {
 	switch src := src.(type) {
 	case *SliceContainer:
@@ -226,6 +281,24 @@ func Clone(dst, src any) bool {
 			*dst = src.Clone()
 			return true
 		}
+	case *MapSlicePointerContainer:
+		switch dst := dst.(type) {
+		case *MapSlicePointerContainer:
+			*dst = *src.Clone()
+			return true
+		case **MapSlicePointerContainer:
+			*dst = src.Clone()
+			return true
+		}
+	case *MapWithNamedSliceValues:
+		switch dst := dst.(type) {
+		case *MapWithNamedSliceValues:
+			*dst = *src.Clone()
+			return true
+		case **MapWithNamedSliceValues:
+			*dst = src.Clone()
+			return true
+		}
 	}
 	return false
 }
diff --git a/cmd/containerboot/egressservices.go b/cmd/containerboot/egressservices.go
index e60d65c04..0b2ab024e 100644
--- a/cmd/containerboot/egressservices.go
+++ b/cmd/containerboot/egressservices.go
@@ -22,11 +22,12 @@ import (
 	"time"
 
 	"github.com/fsnotify/fsnotify"
+
 	"tailscale.com/client/local"
-	"tailscale.com/ipn"
 	"tailscale.com/kube/egressservices"
 	"tailscale.com/kube/kubeclient"
 	"tailscale.com/kube/kubetypes"
+	"tailscale.com/types/views"
 	"tailscale.com/util/httpm"
 	"tailscale.com/util/linuxfw"
 	"tailscale.com/util/mak"
@@ -54,9 +55,10 @@ type egressProxy struct {
 
 	tsClient *local.Client // never nil
 
-	netmapChan chan ipn.Notify // chan to receive netmap updates on
+	netmapChan chan netmapState // chan to receive netmap state updates on
 
-	podIPv4 string // never empty string, currently only IPv4 is supported
+	podIPv4 string // empty if Pod does not have IPv4 address
+	podIPv6 string // empty if Pod does not have IPv6 address
 
 	// tailnetFQDNs is the egress service FQDN to tailnet IP mappings that
 	// were last used to configure firewall rules for this proxy.
@@ -86,7 +88,7 @@ type httpClient interface {
 // - the mounted egress config has changed
 // - the proxy's tailnet IP addresses have changed
 // - tailnet IPs have changed for any backend targets specified by tailnet FQDN
-func (ep *egressProxy) run(ctx context.Context, n ipn.Notify, opts egressProxyRunOpts) error {
+func (ep *egressProxy) run(ctx context.Context, nm netmapState, opts egressProxyRunOpts) error {
 	ep.configure(opts)
 	var tickChan <-chan time.Time
 	var eventChan <-chan fsnotify.Event
@@ -105,7 +107,7 @@ func (ep *egressProxy) run(ctx context.Context, n ipn.Notify, opts egressProxyRu
 		eventChan = w.Events
 	}
 
-	if err := ep.sync(ctx, n); err != nil {
+	if err := ep.sync(ctx, nm); err != nil {
 		return err
 	}
 	for {
@@ -116,14 +118,14 @@ func (ep *egressProxy) run(ctx context.Context, n ipn.Notify, opts egressProxyRu
 			log.Printf("periodic sync, ensuring firewall config is up to date...")
 		case <-eventChan:
 			log.Printf("config file change detected, ensuring firewall config is up to date...")
-		case n = <-ep.netmapChan:
-			shouldResync := ep.shouldResync(n)
+		case nm = <-ep.netmapChan:
+			shouldResync := ep.shouldResync(nm)
 			if !shouldResync {
 				continue
 			}
 			log.Printf("netmap change detected, ensuring firewall config is up to date...")
 		}
-		if err := ep.sync(ctx, n); err != nil {
+		if err := ep.sync(ctx, nm); err != nil {
 			return fmt.Errorf("error syncing egress service config: %w", err)
 		}
 	}
@@ -135,8 +137,9 @@ type egressProxyRunOpts struct {
 	kc           kubeclient.Client
 	tsClient     *local.Client
 	stateSecret  string
-	netmapChan   chan ipn.Notify
+	netmapChan   chan netmapState
 	podIPv4      string
+	podIPv6      string
 	tailnetAddrs []netip.Prefix
 }
 
@@ -149,6 +152,7 @@ func (ep *egressProxy) configure(opts egressProxyRunOpts) {
 	ep.stateSecret = opts.stateSecret
 	ep.netmapChan = opts.netmapChan
 	ep.podIPv4 = opts.podIPv4
+	ep.podIPv6 = opts.podIPv6
 	ep.tailnetAddrs = opts.tailnetAddrs
 	ep.client = &http.Client{} // default HTTP client
 	sleepDuration := time.Second
@@ -164,7 +168,7 @@ func (ep *egressProxy) configure(opts egressProxyRunOpts) {
 // any firewall rules need to be updated. Currently using status in state Secret as a reference for what is the current
 // firewall configuration is good enough because - the status is keyed by the Pod IP - we crash the Pod on errors such
 // as failed firewall update
-func (ep *egressProxy) sync(ctx context.Context, n ipn.Notify) error {
+func (ep *egressProxy) sync(ctx context.Context, nm netmapState) error {
 	cfgs, err := ep.getConfigs()
 	if err != nil {
 		return fmt.Errorf("error retrieving egress service configs: %w", err)
@@ -173,28 +177,27 @@ func (ep *egressProxy) sync(ctx context.Context, n ipn.Notify) error {
 	if err != nil {
 		return fmt.Errorf("error retrieving current egress proxy status: %w", err)
 	}
-	newStatus, err := ep.syncEgressConfigs(cfgs, status, n)
+	newStatus, err := ep.syncEgressConfigs(cfgs, status, nm)
 	if err != nil {
 		return fmt.Errorf("error syncing egress service configs: %w", err)
 	}
 	if !servicesStatusIsEqual(newStatus, status) {
-		if err := ep.setStatus(ctx, newStatus, n); err != nil {
+		if err := ep.setStatus(ctx, newStatus, nm); err != nil {
 			return fmt.Errorf("error setting egress proxy status: %w", err)
 		}
 	}
 	return nil
 }
 
-// addrsHaveChanged returns true if the provided netmap update contains tailnet address change for this proxy node.
-// Netmap must not be nil.
-func (ep *egressProxy) addrsHaveChanged(n ipn.Notify) bool {
-	return !reflect.DeepEqual(ep.tailnetAddrs, n.NetMap.SelfNode.Addresses())
+// addrsHaveChanged returns true if the provided netmap state contains tailnet address change for this proxy node.
+func (ep *egressProxy) addrsHaveChanged(nm netmapState) bool {
+	return !views.SliceEqual(views.SliceOf(ep.tailnetAddrs), nm.self.Addresses())
 }
 
 // syncEgressConfigs adds and deletes firewall rules to match the desired
 // configuration. It uses the provided status to determine what is currently
 // applied and updates the status after a successful sync.
-func (ep *egressProxy) syncEgressConfigs(cfgs *egressservices.Configs, status *egressservices.Status, n ipn.Notify) (*egressservices.Status, error) {
+func (ep *egressProxy) syncEgressConfigs(cfgs egressservices.Configs, status *egressservices.Status, nm netmapState) (*egressservices.Status, error) {
 	if !(wantsServicesConfigured(cfgs) || hasServicesConfigured(status)) {
 		return nil, nil
 	}
@@ -212,8 +215,8 @@ func (ep *egressProxy) syncEgressConfigs(cfgs *egressservices.Configs, status *e
 	// Add new services, update rules for any that have changed.
 	rulesPerSvcToAdd := make(map[string][]rule, 0)
 	rulesPerSvcToDelete := make(map[string][]rule, 0)
-	for svcName, cfg := range *cfgs {
-		tailnetTargetIPs, err := ep.tailnetTargetIPsForSvc(cfg, n)
+	for svcName, cfg := range cfgs {
+		tailnetTargetIPs, err := ep.tailnetTargetIPsForSvc(cfg, nm)
 		if err != nil {
 			return nil, fmt.Errorf("error determining tailnet target IPs: %w", err)
 		}
@@ -228,12 +231,12 @@ func (ep *egressProxy) syncEgressConfigs(cfgs *egressservices.Configs, status *e
 		if len(rulesToDelete) != 0 {
 			mak.Set(&rulesPerSvcToDelete, svcName, rulesToDelete)
 		}
-		if len(rulesToAdd) != 0 || ep.addrsHaveChanged(n) {
+		if len(rulesToAdd) != 0 || ep.addrsHaveChanged(nm) {
 			// For each tailnet target, set up SNAT from the local tailnet device address of the matching
 			// family.
 			for _, t := range tailnetTargetIPs {
 				var local netip.Addr
-				for _, pfx := range n.NetMap.SelfNode.Addresses().All() {
+				for _, pfx := range nm.self.Addresses().All() {
 					if !pfx.IsSingleIP() {
 						continue
 					}
@@ -249,6 +252,9 @@ func (ep *egressProxy) syncEgressConfigs(cfgs *egressservices.Configs, status *e
 				if err := ep.nfr.EnsureSNATForDst(local, t); err != nil {
 					return nil, fmt.Errorf("error setting up SNAT rule: %w", err)
 				}
+				if err := ep.nfr.ClampMSSToPMTU(tailscaleTunInterface, t); err != nil {
+					return nil, fmt.Errorf("error clamping MSS to PMTU: %w", err)
+				}
 			}
 		}
 		// Update the status. Status will be written back to the state Secret by the caller.
@@ -352,7 +358,7 @@ func updatesForCfg(svcName string, cfg egressservices.Config, status *egressserv
 
 // deleteUnneccessaryServices ensure that any services found on status, but not
 // present in config are deleted.
-func (ep *egressProxy) deleteUnnecessaryServices(cfgs *egressservices.Configs, status *egressservices.Status) error {
+func (ep *egressProxy) deleteUnnecessaryServices(cfgs egressservices.Configs, status *egressservices.Status) error {
 	if !hasServicesConfigured(status) {
 		return nil
 	}
@@ -367,7 +373,7 @@ func (ep *egressProxy) deleteUnnecessaryServices(cfgs *egressservices.Configs, s
 	}
 
 	for svcName, svc := range status.Services {
-		if _, ok := (*cfgs)[svcName]; !ok {
+		if _, ok := cfgs[svcName]; !ok {
 			log.Printf("service %s is no longer required, deleting", svcName)
 			if err := ensureServiceDeleted(svcName, svc, ep.nfr); err != nil {
 				return fmt.Errorf("error deleting service %s: %w", svcName, err)
@@ -379,7 +385,7 @@ func (ep *egressProxy) deleteUnnecessaryServices(cfgs *egressservices.Configs, s
 }
 
 // getConfigs gets the mounted egress service configuration.
-func (ep *egressProxy) getConfigs() (*egressservices.Configs, error) {
+func (ep *egressProxy) getConfigs() (egressservices.Configs, error) {
 	svcsCfg := filepath.Join(ep.cfgPath, egressservices.KeyEgressServices)
 	j, err := os.ReadFile(svcsCfg)
 	if os.IsNotExist(err) {
@@ -391,7 +397,7 @@ func (ep *egressProxy) getConfigs() (*egressservices.Configs, error) {
 	if len(j) == 0 || string(j) == "" {
 		return nil, nil
 	}
-	cfg := &egressservices.Configs{}
+	cfg := egressservices.Configs{}
 	if err := json.Unmarshal(j, &cfg); err != nil {
 		return nil, err
 	}
@@ -415,7 +421,7 @@ func (ep *egressProxy) getStatus(ctx context.Context) (*egressservices.Status, e
 	if err := json.Unmarshal([]byte(raw), status); err != nil {
 		return nil, fmt.Errorf("error unmarshalling previous config: %w", err)
 	}
-	if reflect.DeepEqual(status.PodIPv4, ep.podIPv4) {
+	if status.PodIPv4 == ep.podIPv4 && status.PodIPv6 == ep.podIPv6 {
 		return status, nil
 	}
 	return nil, nil
@@ -423,12 +429,13 @@ func (ep *egressProxy) getStatus(ctx context.Context) (*egressservices.Status, e
 
 // setStatus writes egress proxy's currently configured firewall to the state
 // Secret and updates proxy's tailnet addresses.
-func (ep *egressProxy) setStatus(ctx context.Context, status *egressservices.Status, n ipn.Notify) error {
+func (ep *egressProxy) setStatus(ctx context.Context, status *egressservices.Status, nm netmapState) error {
 	// Pod IP is used to determine if a stored status applies to THIS proxy Pod.
 	if status == nil {
 		status = &egressservices.Status{}
 	}
 	status.PodIPv4 = ep.podIPv4
+	status.PodIPv6 = ep.podIPv6
 	secret, err := ep.kc.GetSecret(ctx, ep.stateSecret)
 	if err != nil {
 		return fmt.Errorf("error retrieving state Secret: %w", err)
@@ -446,7 +453,7 @@ func (ep *egressProxy) setStatus(ctx context.Context, status *egressservices.Sta
 	if err := ep.kc.JSONPatchResource(ctx, ep.stateSecret, kubeclient.TypeSecrets, []kubeclient.JSONPatch{patch}); err != nil {
 		return fmt.Errorf("error patching state Secret: %w", err)
 	}
-	ep.tailnetAddrs = n.NetMap.SelfNode.Addresses().AsSlice()
+	ep.tailnetAddrs = nm.self.Addresses().AsSlice()
 	return nil
 }
 
@@ -456,7 +463,7 @@ func (ep *egressProxy) setStatus(ctx context.Context, status *egressservices.Sta
 // FQDN, resolve the FQDN and return the resolved IPs. It checks if the
 // netfilter runner supports IPv6 NAT and skips any IPv6 addresses if it
 // doesn't.
-func (ep *egressProxy) tailnetTargetIPsForSvc(svc egressservices.Config, n ipn.Notify) (addrs []netip.Addr, err error) {
+func (ep *egressProxy) tailnetTargetIPsForSvc(svc egressservices.Config, nm netmapState) (addrs []netip.Addr, err error) {
 	if svc.TailnetTarget.IP != "" {
 		addr, err := netip.ParseAddr(svc.TailnetTarget.IP)
 		if err != nil {
@@ -472,11 +479,11 @@ func (ep *egressProxy) tailnetTargetIPsForSvc(svc egressservices.Config, n ipn.N
 	if svc.TailnetTarget.FQDN == "" {
 		return nil, errors.New("unexpected egress service config- neither tailnet target IP nor FQDN is set")
 	}
-	if n.NetMap == nil {
-		log.Printf("netmap is not available, unable to determine backend addresses for %s", svc.TailnetTarget.FQDN)
+	if !nm.self.Valid() {
+		log.Printf("netmap state is not available, unable to determine backend addresses for %s", svc.TailnetTarget.FQDN)
 		return addrs, nil
 	}
-	egressAddrs, err := resolveTailnetFQDN(n.NetMap, svc.TailnetTarget.FQDN)
+	egressAddrs, err := resolveTailnetFQDN(nm, svc.TailnetTarget.FQDN)
 	if err != nil {
 		log.Printf("error fetching backend addresses for %q: %v", svc.TailnetTarget.FQDN, err)
 		return addrs, nil
@@ -500,26 +507,26 @@ func (ep *egressProxy) tailnetTargetIPsForSvc(svc egressservices.Config, n ipn.N
 	return addrs, nil
 }
 
-// shouldResync parses netmap update and returns true if the update contains
+// shouldResync parses netmap state update and returns true if the update contains
 // changes for which the egress proxy's firewall should be reconfigured.
-func (ep *egressProxy) shouldResync(n ipn.Notify) bool {
-	if n.NetMap == nil {
+func (ep *egressProxy) shouldResync(nm netmapState) bool {
+	if !nm.self.Valid() {
 		return false
 	}
 
 	// If proxy's tailnet addresses have changed, resync.
-	if !reflect.DeepEqual(n.NetMap.SelfNode.Addresses().AsSlice(), ep.tailnetAddrs) {
+	if !views.SliceEqual(nm.self.Addresses(), views.SliceOf(ep.tailnetAddrs)) {
 		log.Printf("node addresses have changed, trigger egress config resync")
-		ep.tailnetAddrs = n.NetMap.SelfNode.Addresses().AsSlice()
+		ep.tailnetAddrs = nm.self.Addresses().AsSlice()
 		return true
 	}
 
 	// If the IPs for any of the egress services configured via FQDN have
 	// changed, resync.
 	for fqdn, ips := range ep.targetFQDNs {
-		for _, nn := range n.NetMap.Peers {
+		for nn := range nm.peers() {
 			if equalFQDNs(nn.Name(), fqdn) {
-				if !reflect.DeepEqual(ips, nn.Addresses().AsSlice()) {
+				if !views.SliceEqual(views.SliceOf(ips), nn.Addresses()) {
 					log.Printf("backend addresses for egress target %q have changed old IPs %v, new IPs %v trigger egress config resync", nn.Name(), ips, nn.Addresses().AsSlice())
 					return true
 				}
@@ -602,8 +609,8 @@ type rule struct {
 	protocol      string
 }
 
-func wantsServicesConfigured(cfgs *egressservices.Configs) bool {
-	return cfgs != nil && len(*cfgs) != 0
+func wantsServicesConfigured(cfgs egressservices.Configs) bool {
+	return cfgs != nil && len(cfgs) != 0
 }
 
 func hasServicesConfigured(status *egressservices.Status) bool {
@@ -619,6 +626,8 @@ func servicesStatusIsEqual(st, st1 *egressservices.Status) bool {
 	}
 	st.PodIPv4 = ""
 	st1.PodIPv4 = ""
+	st.PodIPv6 = ""
+	st1.PodIPv6 = ""
 	return reflect.DeepEqual(*st, *st1)
 }
 
@@ -657,37 +666,42 @@ func (ep *egressProxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 // would normally be this Pod. When this Pod is being deleted, the operator should have removed it from the Service
 // backends and eventually kube proxy routing rules should be updated to no longer route traffic for the Service to this
 // Pod.
-func (ep *egressProxy) waitTillSafeToShutdown(ctx context.Context, cfgs *egressservices.Configs, hp int) {
-	if cfgs == nil || len(*cfgs) == 0 { // avoid sleeping if no services are configured
+func (ep *egressProxy) waitTillSafeToShutdown(ctx context.Context, cfgs egressservices.Configs, hp int) {
+	if cfgs == nil || len(cfgs) == 0 { // avoid sleeping if no services are configured
 		return
 	}
 	log.Printf("Ensuring that cluster traffic for egress targets is no longer routed via this Pod...")
 	var wg sync.WaitGroup
-	for s, cfg := range *cfgs {
+	for s, cfg := range cfgs {
 		hep := cfg.HealthCheckEndpoint
 		if hep == "" {
 			log.Printf("Tailnet target %q does not have a cluster healthcheck specified, unable to verify if cluster traffic for the target is still routed via this Pod", s)
 			continue
 		}
 		svc := s
+		// TODO(beckypauley): In dual-stack clusters, this is a best-effort check as we do not control which IP family is used.
+		// This confirms removal from routing on this node for one family only. The other IP family then relies on the longSleep below.
 		wg.Go(func() {
 			log.Printf("Ensuring that cluster traffic is no longer routed to %q via this Pod...", svc)
+			podIP, header := ep.podIPv4, kubetypes.PodIPv4Header
+			if podIP == "" {
+				podIP, header = ep.podIPv6, kubetypes.PodIPv6Header
+			}
+			if ep.podDrained(ctx, svc, hep, podIP, header, hp) {
+				return
+			}
+			ticker := time.NewTicker(ep.shortSleep)
+			defer ticker.Stop()
 			for {
-				if ctx.Err() != nil { // kubelet's HTTP request timeout
+				select {
+				case <-ctx.Done(): // kubelet's HTTP request timeout
 					log.Printf("Cluster traffic for %s did not stop being routed to this Pod.", svc)
 					return
+				case <-ticker.C:
+					if ep.podDrained(ctx, svc, hep, podIP, header, hp) {
+						return
+					}
 				}
-				found, err := lookupPodRoute(ctx, hep, ep.podIPv4, hp, ep.client)
-				if err != nil {
-					log.Printf("unable to reach endpoint %q, assuming the routing rules for this Pod have been deleted: %v", hep, err)
-					break
-				}
-				if !found {
-					log.Printf("service %q is no longer routed through this Pod", svc)
-					break
-				}
-				log.Printf("service %q is still routed through this Pod, waiting...", svc)
-				time.Sleep(ep.shortSleep)
 			}
 		})
 	}
@@ -701,9 +715,9 @@ func (ep *egressProxy) waitTillSafeToShutdown(ctx context.Context, cfgs *egresss
 
 // lookupPodRoute calls the healthcheck endpoint repeat times and returns true if the endpoint returns with the podIP
 // header at least once.
-func lookupPodRoute(ctx context.Context, hep, podIP string, repeat int, client httpClient) (bool, error) {
+func lookupPodRoute(ctx context.Context, hep, podIP, podIPHeader string, repeat int, client httpClient) (bool, error) {
 	for range repeat {
-		f, err := lookup(ctx, hep, podIP, client)
+		f, err := lookup(ctx, hep, podIP, podIPHeader, client)
 		if err != nil {
 			return false, err
 		}
@@ -715,7 +729,7 @@ func lookupPodRoute(ctx context.Context, hep, podIP string, repeat int, client h
 }
 
 // lookup calls the healthcheck endpoint and returns true if the response contains the podIP header.
-func lookup(ctx context.Context, hep, podIP string, client httpClient) (bool, error) {
+func lookup(ctx context.Context, hep, podIP, podIPHeader string, client httpClient) (bool, error) {
 	req, err := http.NewRequestWithContext(ctx, httpm.GET, hep, nil)
 	if err != nil {
 		return false, fmt.Errorf("error creating new HTTP request: %v", err)
@@ -730,7 +744,7 @@ func lookup(ctx context.Context, hep, podIP string, client httpClient) (bool, er
 		return true, nil
 	}
 	defer resp.Body.Close()
-	gotIP := resp.Header.Get(kubetypes.PodIPv4Header)
+	gotIP := resp.Header.Get(podIPHeader)
 	return strings.EqualFold(podIP, gotIP), nil
 }
 
@@ -759,3 +773,17 @@ func (ep *egressProxy) getHEPPings() (int, error) {
 	}
 	return hp, nil
 }
+
+func (ep *egressProxy) podDrained(ctx context.Context, svc, hep, podIP, header string, hp int) bool {
+	found, err := lookupPodRoute(ctx, hep, podIP, header, hp, ep.client)
+	if err != nil {
+		log.Printf("unable to reach endpoint %q, assuming the routing rules for this Pod have been deleted: %v", hep, err)
+		return true
+	}
+	if !found {
+		log.Printf("service %q is no longer routed through this Pod", svc)
+		return true
+	}
+	log.Printf("service %q is still routed through this Pod, waiting...", svc)
+	return false
+}
diff --git a/cmd/containerboot/egressservices_test.go b/cmd/containerboot/egressservices_test.go
index 0d8504bda..e41cc27f6 100644
--- a/cmd/containerboot/egressservices_test.go
+++ b/cmd/containerboot/egressservices_test.go
@@ -15,6 +15,7 @@ import (
 	"strings"
 	"sync"
 	"testing"
+	"time"
 
 	"tailscale.com/kube/egressservices"
 	"tailscale.com/kube/kubetypes"
@@ -255,13 +256,13 @@ func TestWaitTillSafeToShutdown(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			cfgs := &egressservices.Configs{}
+			cfgs := egressservices.Configs{}
 			switches := make(map[string]int)
 
 			for svc, callsToSwitch := range tt.services {
 				endpoint := fmt.Sprintf("http://%s.local", svc)
 				if tt.healthCheckSet {
-					(*cfgs)[svc] = egressservices.Config{
+					cfgs[svc] = egressservices.Config{
 						HealthCheckEndpoint: endpoint,
 					}
 				}
@@ -269,7 +270,8 @@ func TestWaitTillSafeToShutdown(t *testing.T) {
 			}
 
 			ep := &egressProxy{
-				podIPv4: podIP,
+				podIPv4:    podIP,
+				shortSleep: time.Millisecond,
 				client: &mockHTTPClient{
 					podIP:     podIP,
 					anotherIP: anotherIP,
diff --git a/cmd/containerboot/ingressservices.go b/cmd/containerboot/ingressservices.go
index d76bf86e0..d8ad01717 100644
--- a/cmd/containerboot/ingressservices.go
+++ b/cmd/containerboot/ingressservices.go
@@ -265,7 +265,13 @@ func ensureIngressRulesAdded(cfgs map[string]ingressservices.Config, nfr linuxfw
 
 func addDNATRuleForSvc(nfr linuxfw.NetfilterRunner, serviceName string, tsIP, clusterIP netip.Addr) error {
 	log.Printf("adding DNAT rule for Tailscale Service %s with IP %s to Kubernetes Service IP %s", serviceName, tsIP, clusterIP)
-	return nfr.EnsureDNATRuleForSvc(serviceName, tsIP, clusterIP)
+	if err := nfr.EnsureDNATRuleForSvc(serviceName, tsIP, clusterIP); err != nil {
+		return err
+	}
+	if err := nfr.ClampMSSToPMTU(tailscaleTunInterface, clusterIP); err != nil {
+		return fmt.Errorf("error clamping MSS to PMTU: %w", err)
+	}
+	return nil
 }
 
 // ensureIngressRulesDeleted takes a map of Tailscale Services and rules and ensures that the firewall rules are deleted.
diff --git a/cmd/containerboot/ingressservices_test.go b/cmd/containerboot/ingressservices_test.go
index 46330103e..1643bb11c 100644
--- a/cmd/containerboot/ingressservices_test.go
+++ b/cmd/containerboot/ingressservices_test.go
@@ -7,6 +7,7 @@ package main
 
 import (
 	"net/netip"
+	"slices"
 	"testing"
 
 	"tailscale.com/kube/ingressservices"
@@ -22,6 +23,7 @@ func TestSyncIngressConfigs(t *testing.T) {
 			TailscaleServiceIP netip.Addr
 			ClusterIP          netip.Addr
 		}
+		wantClampedAddrs []netip.Addr // cluster IPs that should have MSS clamping applied
 	}{
 		{
 			name: "add_new_rules_when_no_existing_config",
@@ -35,6 +37,7 @@ func TestSyncIngressConfigs(t *testing.T) {
 			}{
 				"svc:foo": makeWantService("100.64.0.1", "10.0.0.1"),
 			},
+			wantClampedAddrs: []netip.Addr{netip.MustParseAddr("10.0.0.1")},
 		},
 		{
 			name: "add_multiple_services",
@@ -52,6 +55,11 @@ func TestSyncIngressConfigs(t *testing.T) {
 				"svc:bar": makeWantService("100.64.0.2", "10.0.0.2"),
 				"svc:baz": makeWantService("100.64.0.3", "10.0.0.3"),
 			},
+			wantClampedAddrs: []netip.Addr{
+				netip.MustParseAddr("10.0.0.1"),
+				netip.MustParseAddr("10.0.0.2"),
+				netip.MustParseAddr("10.0.0.3"),
+			},
 		},
 		{
 			name: "add_both_ipv4_and_ipv6_rules",
@@ -65,6 +73,10 @@ func TestSyncIngressConfigs(t *testing.T) {
 			}{
 				"svc:foo": makeWantService("2001:db8::1", "2001:db8::2"),
 			},
+			wantClampedAddrs: []netip.Addr{
+				netip.MustParseAddr("10.0.0.1"),
+				netip.MustParseAddr("2001:db8::2"),
+			},
 		},
 		{
 			name: "add_ipv6_only_rules",
@@ -78,6 +90,7 @@ func TestSyncIngressConfigs(t *testing.T) {
 			}{
 				"svc:ipv6": makeWantService("2001:db8::10", "2001:db8::20"),
 			},
+			wantClampedAddrs: []netip.Addr{netip.MustParseAddr("2001:db8::20")},
 		},
 		{
 			name:           "delete_all_rules_when_config_removed",
@@ -94,6 +107,7 @@ func TestSyncIngressConfigs(t *testing.T) {
 				TailscaleServiceIP netip.Addr
 				ClusterIP          netip.Addr
 			}{},
+			wantClampedAddrs: nil, // no rules added, no clamping
 		},
 		{
 			name: "add_remove_modify",
@@ -117,6 +131,10 @@ func TestSyncIngressConfigs(t *testing.T) {
 				"svc:foo": makeWantService("100.64.0.1", "10.0.0.2"),
 				"svc:new": makeWantService("100.64.0.4", "10.0.0.4"),
 			},
+			wantClampedAddrs: []netip.Addr{
+				netip.MustParseAddr("10.0.0.2"),
+				netip.MustParseAddr("10.0.0.4"),
+			},
 		},
 		{
 			name: "update_with_outdated_status",
@@ -152,12 +170,17 @@ func TestSyncIngressConfigs(t *testing.T) {
 				"svc:web-ipv6": makeWantService("2001:db8::10", "2001:db8::20"),
 				"svc:api":      makeWantService("100.64.0.20", "10.0.0.20"),
 			},
+			wantClampedAddrs: []netip.Addr{
+				netip.MustParseAddr("10.0.0.10"),
+				netip.MustParseAddr("10.0.0.20"),
+				netip.MustParseAddr("2001:db8::20"),
+			},
 		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			var nfr linuxfw.NetfilterRunner = linuxfw.NewFakeNetfilterRunner()
+			nfr := linuxfw.NewFakeNetfilterRunner()
 
 			ep := &ingressProxy{
 				nfr:     nfr,
@@ -170,8 +193,7 @@ func TestSyncIngressConfigs(t *testing.T) {
 				t.Fatalf("syncIngressConfigs failed: %v", err)
 			}
 
-			fake := nfr.(*linuxfw.FakeNetfilterRunner)
-			gotServices := fake.GetServiceState()
+			gotServices := nfr.GetServiceState()
 			if len(gotServices) != len(tt.wantServices) {
 				t.Errorf("got %d services, want %d", len(gotServices), len(tt.wantServices))
 			}
@@ -188,6 +210,20 @@ func TestSyncIngressConfigs(t *testing.T) {
 					t.Errorf("service %s: got ClusterIP %v, want %v", svc, got.ClusterIP, want.ClusterIP)
 				}
 			}
+
+			gotClamped := nfr.GetClampedAddrs()
+			slices.SortFunc(gotClamped, func(a, b netip.Addr) int { return a.Compare(b) })
+			slices.SortFunc(tt.wantClampedAddrs, func(a, b netip.Addr) int { return a.Compare(b) })
+			if len(gotClamped) != len(tt.wantClampedAddrs) {
+				t.Errorf("ClampMSSToPMTU: got %v, want %v", gotClamped, tt.wantClampedAddrs)
+			} else {
+				for i := range gotClamped {
+					if gotClamped[i] != tt.wantClampedAddrs[i] {
+						t.Errorf("ClampMSSToPMTU: got %v, want %v", gotClamped, tt.wantClampedAddrs)
+						break
+					}
+				}
+			}
 		})
 	}
 }
diff --git a/cmd/containerboot/kube.go b/cmd/containerboot/kube.go
index 73f5819b4..3e97710da 100644
--- a/cmd/containerboot/kube.go
+++ b/cmd/containerboot/kube.go
@@ -21,6 +21,7 @@ import (
 	"github.com/fsnotify/fsnotify"
 	"tailscale.com/client/local"
 	"tailscale.com/ipn"
+	"tailscale.com/kube/authkey"
 	"tailscale.com/kube/egressservices"
 	"tailscale.com/kube/ingressservices"
 	"tailscale.com/kube/kubeapi"
@@ -32,7 +33,6 @@ import (
 )
 
 const fieldManager = "tailscale-container"
-const kubeletMountedConfigLn = "..data"
 
 // kubeClient is a wrapper around Tailscale's internal kube client that knows how to talk to the kube API server. We use
 // this rather than any of the upstream Kubernetes client libaries to avoid extra imports.
@@ -127,6 +127,9 @@ func (kc *kubeClient) deleteAuthKey(ctx context.Context) error {
 
 // resetContainerbootState resets state from previous runs of containerboot to
 // ensure the operator doesn't use stale state when a Pod is first recreated.
+//
+// Device identity keys (device_id, device_fqdn, device_ips) are preserved so
+// the operator can clean up the old device from the control plane.
 func (kc *kubeClient) resetContainerbootState(ctx context.Context, podUID string, tailscaledConfigAuthkey string) error {
 	existingSecret, err := kc.GetSecret(ctx, kc.stateSecret)
 	switch {
@@ -139,12 +142,7 @@ func (kc *kubeClient) resetContainerbootState(ctx context.Context, podUID string
 
 	s := &kubeapi.Secret{
 		Data: map[string][]byte{
-			kubetypes.KeyCapVer: fmt.Appendf(nil, "%d", tailcfg.CurrentCapabilityVersion),
-
-			// TODO(tomhjp): Perhaps shouldn't clear device ID and use a different signal, as this could leak tailnet devices.
-			kubetypes.KeyDeviceID:            nil,
-			kubetypes.KeyDeviceFQDN:          nil,
-			kubetypes.KeyDeviceIPs:           nil,
+			kubetypes.KeyCapVer:              fmt.Appendf(nil, "%d", tailcfg.CurrentCapabilityVersion),
 			kubetypes.KeyHTTPSEndpoint:       nil,
 			egressservices.KeyEgressServices: nil,
 			ingressservices.IngressConfigKey: nil,
@@ -169,47 +167,18 @@ func (kc *kubeClient) setAndWaitForAuthKeyReissue(ctx context.Context, client *l
 		return fmt.Errorf("error disconnecting from control: %w", err)
 	}
 
-	err = kc.setReissueAuthKey(ctx, tailscaledConfigAuthKey)
+	err = authkey.SetReissueAuthKey(ctx, kc.Client, kc.stateSecret, tailscaledConfigAuthKey, authkey.TailscaleContainerFieldManager)
 	if err != nil {
 		return fmt.Errorf("failed to set reissue_authkey in Kubernetes Secret: %w", err)
 	}
 
-	err = kc.waitForAuthKeyReissue(ctx, cfg.TailscaledConfigFilePath, tailscaledConfigAuthKey, 10*time.Minute)
-	if err != nil {
-		return fmt.Errorf("failed to receive new auth key: %w", err)
+	clearFn := func(ctx context.Context) error {
+		return authkey.ClearReissueAuthKey(ctx, kc.Client, kc.stateSecret, authkey.TailscaleContainerFieldManager)
 	}
 
-	return nil
-}
-
-func (kc *kubeClient) setReissueAuthKey(ctx context.Context, authKey string) error {
-	s := &kubeapi.Secret{
-		Data: map[string][]byte{
-			kubetypes.KeyReissueAuthkey: []byte(authKey),
-		},
-	}
-
-	log.Printf("Requesting a new auth key from operator")
-	return kc.StrategicMergePatchSecret(ctx, kc.stateSecret, s, fieldManager)
-}
-
-func (kc *kubeClient) waitForAuthKeyReissue(ctx context.Context, configPath string, oldAuthKey string, maxWait time.Duration) error {
-	log.Printf("Waiting for operator to provide new auth key (max wait: %v)", maxWait)
-
-	ctx, cancel := context.WithTimeout(ctx, maxWait)
-	defer cancel()
-
-	tailscaledCfgDir := filepath.Dir(configPath)
-	toWatch := filepath.Join(tailscaledCfgDir, kubeletMountedConfigLn)
-
-	var (
-		pollTicker <-chan time.Time
-		eventChan  <-chan fsnotify.Event
-	)
-
-	pollInterval := 5 * time.Second
-
-	// Try to use fsnotify for faster notification
+	getAuthKey := func() string { return authkey.AuthKeyFromConfig(cfg.TailscaledConfigFilePath) }
+	tailscaledCfgDir := filepath.Dir(cfg.TailscaledConfigFilePath)
+	var notify <-chan struct{}
 	if w, err := fsnotify.NewWatcher(); err != nil {
 		log.Printf("auth key reissue: fsnotify unavailable, using polling: %v", err)
 	} else if err := w.Add(tailscaledCfgDir); err != nil {
@@ -217,54 +186,28 @@ func (kc *kubeClient) waitForAuthKeyReissue(ctx context.Context, configPath stri
 		log.Printf("auth key reissue: fsnotify watch failed, using polling: %v", err)
 	} else {
 		defer w.Close()
+		ch := make(chan struct{}, 1)
+		toWatch := filepath.Join(tailscaledCfgDir, "..data")
+		go func() {
+			for ev := range w.Events {
+				if ev.Name == toWatch {
+					select {
+					case ch <- struct{}{}:
+					default:
+					}
+				}
+			}
+		}()
+		notify = ch
 		log.Printf("auth key reissue: watching for config changes via fsnotify")
-		eventChan = w.Events
 	}
 
-	// still keep polling if using fsnotify, for logging and in case fsnotify fails
-	pt := time.NewTicker(pollInterval)
-	defer pt.Stop()
-	pollTicker = pt.C
-
-	start := time.Now()
-
-	for {
-		select {
-		case <-ctx.Done():
-			return fmt.Errorf("timeout waiting for auth key reissue after %v", maxWait)
-		case <-pollTicker: // Waits for polling tick, continues when received
-		case event := <-eventChan:
-			if event.Name != toWatch {
-				continue
-			}
-		}
-
-		newAuthKey := authkeyFromTailscaledConfig(configPath)
-		if newAuthKey != "" && newAuthKey != oldAuthKey {
-			log.Printf("New auth key received from operator after %v", time.Since(start).Round(time.Second))
-
-			if err := kc.clearReissueAuthKeyRequest(ctx); err != nil {
-				log.Printf("Warning: failed to clear reissue request: %v", err)
-			}
-
-			return nil
-		}
-
-		if eventChan == nil && pollTicker != nil {
-			log.Printf("Waiting for new auth key from operator (%v elapsed)", time.Since(start).Round(time.Second))
-		}
+	err = authkey.WaitForAuthKeyReissue(ctx, tailscaledConfigAuthKey, 10*time.Minute, getAuthKey, clearFn, notify)
+	if err != nil {
+		return fmt.Errorf("failed to receive new auth key: %w", err)
 	}
-}
 
-// clearReissueAuthKeyRequest removes the reissue_authkey marker from the Secret
-// to signal to the operator that we've successfully received the new key.
-func (kc *kubeClient) clearReissueAuthKeyRequest(ctx context.Context) error {
-	s := &kubeapi.Secret{
-		Data: map[string][]byte{
-			kubetypes.KeyReissueAuthkey: nil,
-		},
-	}
-	return kc.StrategicMergePatchSecret(ctx, kc.stateSecret, s, fieldManager)
+	return nil
 }
 
 // waitForConsistentState waits for tailscaled to finish writing state if it
diff --git a/cmd/containerboot/kube_test.go b/cmd/containerboot/kube_test.go
index b2e89a36c..fec0b74f7 100644
--- a/cmd/containerboot/kube_test.go
+++ b/cmd/containerboot/kube_test.go
@@ -257,12 +257,8 @@ func TestResetContainerbootState(t *testing.T) {
 			authkey: "new-authkey",
 			initial: map[string][]byte{},
 			expected: map[string][]byte{
-				kubetypes.KeyCapVer: capver,
-				kubetypes.KeyPodUID: []byte("1234"),
-				// Cleared keys.
-				kubetypes.KeyDeviceID:            nil,
-				kubetypes.KeyDeviceFQDN:          nil,
-				kubetypes.KeyDeviceIPs:           nil,
+				kubetypes.KeyCapVer:              capver,
+				kubetypes.KeyPodUID:              []byte("1234"),
 				kubetypes.KeyHTTPSEndpoint:       nil,
 				egressservices.KeyEgressServices: nil,
 				ingressservices.IngressConfigKey: nil,
@@ -271,11 +267,7 @@ func TestResetContainerbootState(t *testing.T) {
 		"empty_initial_no_pod_uid": {
 			initial: map[string][]byte{},
 			expected: map[string][]byte{
-				kubetypes.KeyCapVer: capver,
-				// Cleared keys.
-				kubetypes.KeyDeviceID:            nil,
-				kubetypes.KeyDeviceFQDN:          nil,
-				kubetypes.KeyDeviceIPs:           nil,
+				kubetypes.KeyCapVer:              capver,
 				kubetypes.KeyHTTPSEndpoint:       nil,
 				egressservices.KeyEgressServices: nil,
 				ingressservices.IngressConfigKey: nil,
@@ -303,9 +295,6 @@ func TestResetContainerbootState(t *testing.T) {
 				kubetypes.KeyCapVer: capver,
 				kubetypes.KeyPodUID: []byte("1234"),
 				// Cleared keys.
-				kubetypes.KeyDeviceID:            nil,
-				kubetypes.KeyDeviceFQDN:          nil,
-				kubetypes.KeyDeviceIPs:           nil,
 				kubetypes.KeyHTTPSEndpoint:       nil,
 				egressservices.KeyEgressServices: nil,
 				ingressservices.IngressConfigKey: nil,
@@ -321,9 +310,6 @@ func TestResetContainerbootState(t *testing.T) {
 				kubetypes.KeyCapVer:         capver,
 				kubetypes.KeyReissueAuthkey: nil,
 				// Cleared keys.
-				kubetypes.KeyDeviceID:            nil,
-				kubetypes.KeyDeviceFQDN:          nil,
-				kubetypes.KeyDeviceIPs:           nil,
 				kubetypes.KeyHTTPSEndpoint:       nil,
 				egressservices.KeyEgressServices: nil,
 				ingressservices.IngressConfigKey: nil,
@@ -338,9 +324,6 @@ func TestResetContainerbootState(t *testing.T) {
 				kubetypes.KeyCapVer: capver,
 				// reissue_authkey not cleared.
 				// Cleared keys.
-				kubetypes.KeyDeviceID:            nil,
-				kubetypes.KeyDeviceFQDN:          nil,
-				kubetypes.KeyDeviceIPs:           nil,
 				kubetypes.KeyHTTPSEndpoint:       nil,
 				egressservices.KeyEgressServices: nil,
 				ingressservices.IngressConfigKey: nil,
@@ -355,9 +338,6 @@ func TestResetContainerbootState(t *testing.T) {
 				kubetypes.KeyCapVer: capver,
 				// reissue_authkey not cleared.
 				// Cleared keys.
-				kubetypes.KeyDeviceID:            nil,
-				kubetypes.KeyDeviceFQDN:          nil,
-				kubetypes.KeyDeviceIPs:           nil,
 				kubetypes.KeyHTTPSEndpoint:       nil,
 				egressservices.KeyEgressServices: nil,
 				ingressservices.IngressConfigKey: nil,
diff --git a/cmd/containerboot/main.go b/cmd/containerboot/main.go
index e80192a31..04651cd48 100644
--- a/cmd/containerboot/main.go
+++ b/cmd/containerboot/main.go
@@ -120,6 +120,7 @@ import (
 	"errors"
 	"fmt"
 	"io/fs"
+	"iter"
 	"log"
 	"math"
 	"net"
@@ -135,12 +136,15 @@ import (
 	"syscall"
 	"time"
 
+	"github.com/benbjohnson/immutable"
 	"golang.org/x/sys/unix"
 
+	"tailscale.com/client/local"
 	"tailscale.com/health"
 	"tailscale.com/ipn"
-	"tailscale.com/ipn/conffile"
+	"tailscale.com/ipn/ipnstate"
 	kubeutils "tailscale.com/k8s-operator"
+	"tailscale.com/kube/authkey"
 	healthz "tailscale.com/kube/health"
 	"tailscale.com/kube/kubetypes"
 	klc "tailscale.com/kube/localclient"
@@ -148,21 +152,170 @@ import (
 	"tailscale.com/kube/services"
 	"tailscale.com/tailcfg"
 	"tailscale.com/types/logger"
-	"tailscale.com/types/netmap"
+	"tailscale.com/types/views"
 	"tailscale.com/util/deephash"
+	"tailscale.com/util/def"
 	"tailscale.com/util/dnsname"
 	"tailscale.com/util/linuxfw"
 )
 
 func newNetfilterRunner(logf logger.Logf) (linuxfw.NetfilterRunner, error) {
-	if defaultBool("TS_TEST_FAKE_NETFILTER", false) {
+	if def.Bool(os.Getenv("TS_TEST_FAKE_NETFILTER"), false) {
 		return linuxfw.NewFakeIPTablesRunner(), nil
 	}
 	return linuxfw.New(logf, "")
 }
 
 func getAutoAdvertiseBool() bool {
-	return defaultBool("TS_EXPERIMENTAL_SERVICE_AUTO_ADVERTISEMENT", true)
+	return def.Bool(os.Getenv("TS_EXPERIMENTAL_SERVICE_AUTO_ADVERTISEMENT"), true)
+}
+
+const containerbootWatchMask = ipn.NotifyInitialStatus |
+	ipn.NotifyPeerChanges |
+	ipn.NotifyNoNetMap
+
+func notifyState(n ipn.Notify) (_ ipn.State, ok bool) {
+	if n.State != nil {
+		return *n.State, true
+	}
+	if n.InitialStatus != nil && n.InitialStatus.BackendState != "" {
+		if state, ok := ipn.StateFromString(n.InitialStatus.BackendState); ok {
+			return state, true
+		}
+	}
+	return ipn.NoState, false
+}
+
+var netmapStatePeerIDHasher = immutable.NewHasher(tailcfg.NodeID(0))
+
+type netmapState struct {
+	self            tailcfg.NodeView
+	peersByID       *immutable.Map[tailcfg.NodeID, tailcfg.NodeView]
+	peersByName     *immutable.Map[string, tailcfg.NodeView] // keyed by tailcfg.Node.Name when NodeID is unavailable
+	certDomains     views.Slice[string]
+	dnsExtraRecords views.Slice[tailcfg.DNSRecord]
+}
+
+func (s netmapState) updateFromNotify(n ipn.Notify) netmapState {
+	if n.InitialStatus != nil {
+		s = s.updateFromStatus(n.InitialStatus)
+	}
+	if n.SelfChange != nil {
+		s.self = n.SelfChange.View()
+	}
+	for _, p := range n.PeersChanged {
+		s = s.upsertPeer(p.View())
+	}
+	for _, id := range n.PeersRemoved {
+		if s.peersByID != nil {
+			s.peersByID = s.peersByID.Delete(id)
+		}
+	}
+	return s
+}
+
+// processNotify updates the netmap state from an IPN bus Notify. On
+// SelfChange it also refetches DNS via the LocalAPI dns-config
+// endpoint; the bus carries no DNS delta.
+func (s netmapState) processNotify(ctx context.Context, client *local.Client, n ipn.Notify) netmapState {
+	s = s.updateFromNotify(n)
+	if n.SelfChange != nil {
+		dns, err := client.DNSConfig(ctx)
+		if err != nil {
+			log.Printf("error refreshing DNS config from tailscaled: %v", err)
+		} else if dns != nil {
+			s.dnsExtraRecords = views.SliceOf(dns.ExtraRecords)
+			s.certDomains = views.SliceOf(dns.CertDomains)
+		}
+	}
+	return s
+}
+
+func (s netmapState) updateFromStatus(st *ipnstate.Status) netmapState {
+	s.certDomains = views.SliceOf(st.CertDomains)
+	s.dnsExtraRecords = views.SliceOf(st.ExtraRecords)
+	if st.Self != nil {
+		s.self = nodeFromPeerStatus(st.Self).View()
+	}
+	if len(st.Peer) != 0 {
+		s.peersByID = nil
+		s.peersByName = nil
+		for _, ps := range st.Peer {
+			s = s.upsertPeer(nodeFromPeerStatus(ps).View())
+		}
+	}
+	return s
+}
+
+func (s netmapState) upsertPeer(n tailcfg.NodeView) netmapState {
+	if !n.Valid() {
+		return s
+	}
+	if s.peersByID == nil {
+		s.peersByID = immutable.NewMap[tailcfg.NodeID, tailcfg.NodeView](netmapStatePeerIDHasher)
+	}
+	if s.peersByName == nil {
+		s.peersByName = immutable.NewMap[string, tailcfg.NodeView](nil)
+	}
+	if n.ID() != 0 {
+		s.peersByID = s.peersByID.Set(n.ID(), n)
+		if name := n.Name(); name != "" {
+			s.peersByName = s.peersByName.Delete(name)
+		}
+		return s
+	}
+	if n.Name() != "" {
+		s.peersByName = s.peersByName.Set(n.Name(), n)
+	}
+	return s
+}
+
+func nodeFromPeerStatus(ps *ipnstate.PeerStatus) *tailcfg.Node {
+	if ps == nil {
+		return nil
+	}
+	n := &tailcfg.Node{
+		ID:       ps.NodeID,
+		StableID: ps.ID,
+		Name:     ps.DNSName,
+		Key:      ps.PublicKey,
+	}
+	for _, ip := range ps.TailscaleIPs {
+		n.Addresses = append(n.Addresses, netip.PrefixFrom(ip, ip.BitLen()))
+	}
+	if ps.AllowedIPs != nil {
+		n.AllowedIPs = ps.AllowedIPs.AsSlice()
+	}
+	return n
+}
+
+func (s netmapState) peers() iter.Seq[tailcfg.NodeView] {
+	return func(yield func(tailcfg.NodeView) bool) {
+		if s.peersByID != nil {
+			it := s.peersByID.Iterator()
+			for {
+				_, p, ok := it.Next()
+				if !ok {
+					break
+				}
+				if !yield(p) {
+					return
+				}
+			}
+		}
+		if s.peersByName != nil {
+			it := s.peersByName.Iterator()
+			for {
+				_, p, ok := it.Next()
+				if !ok {
+					break
+				}
+				if !yield(p) {
+					return
+				}
+			}
+		}
+	}
 }
 
 func main() {
@@ -209,7 +362,7 @@ func run() error {
 
 	var tailscaledConfigAuthkey string
 	if isOneStepConfig(cfg) {
-		tailscaledConfigAuthkey = authkeyFromTailscaledConfig(cfg.TailscaledConfigFilePath)
+		tailscaledConfigAuthkey = authkey.AuthKeyFromConfig(cfg.TailscaledConfigFilePath)
 	}
 
 	var kc *kubeClient
@@ -271,7 +424,7 @@ func run() error {
 		mux := http.NewServeMux()
 
 		log.Printf("Running healthcheck endpoint at %s/healthz", cfg.HealthCheckAddrPort)
-		healthCheck = healthz.RegisterHealthHandlers(mux, cfg.PodIPv4, log.Printf)
+		healthCheck = healthz.RegisterHealthHandlers(mux, cfg.PodIPv4, cfg.PodIPv6, log.Printf)
 
 		close := runHTTPServer(mux, cfg.HealthCheckAddrPort)
 		defer close()
@@ -287,7 +440,7 @@ func run() error {
 
 		if cfg.localHealthEnabled() {
 			log.Printf("Running healthcheck endpoint at %s/healthz", cfg.LocalAddrPort)
-			healthCheck = healthz.RegisterHealthHandlers(mux, cfg.PodIPv4, log.Printf)
+			healthCheck = healthz.RegisterHealthHandlers(mux, cfg.PodIPv4, cfg.PodIPv6, log.Printf)
 		}
 
 		if cfg.egressSvcsTerminateEPEnabled() {
@@ -305,7 +458,7 @@ func run() error {
 		}
 	}
 
-	w, err := client.WatchIPNBus(bootCtx, ipn.NotifyInitialNetMap|ipn.NotifyInitialPrefs|ipn.NotifyInitialState|ipn.NotifyInitialHealthState|ipn.NotifyRateLimit)
+	w, err := client.WatchIPNBus(bootCtx, containerbootWatchMask|ipn.NotifyInitialPrefs|ipn.NotifyInitialHealthState)
 	if err != nil {
 		return fmt.Errorf("failed to watch tailscaled for updates: %w", err)
 	}
@@ -345,7 +498,7 @@ func run() error {
 		if err := tailscaleUp(bootCtx, cfg); err != nil {
 			return fmt.Errorf("failed to auth tailscale: %w", err)
 		}
-		w, err = client.WatchIPNBus(bootCtx, ipn.NotifyInitialNetMap|ipn.NotifyInitialState|ipn.NotifyRateLimit)
+		w, err = client.WatchIPNBus(bootCtx, containerbootWatchMask)
 		if err != nil {
 			return fmt.Errorf("rewatching tailscaled for updates after auth: %w", err)
 		}
@@ -365,8 +518,8 @@ authLoop:
 			return fmt.Errorf("failed to read from tailscaled: %w", err)
 		}
 
-		if n.State != nil {
-			switch *n.State {
+		if state, ok := notifyState(n); ok {
+			switch state {
 			case ipn.NeedsLogin:
 				if isOneStepConfig(cfg) {
 					// This could happen if this is the first time tailscaled was run for this
@@ -374,7 +527,7 @@ authLoop:
 					if hasKubeStateStore(cfg) {
 						log.Printf("Auth key missing or invalid (NeedsLogin state), disconnecting from control and requesting new key from operator")
 
-						err := kc.setAndWaitForAuthKeyReissue(bootCtx, client, cfg, tailscaledConfigAuthkey)
+						err := kc.setAndWaitForAuthKeyReissue(ctx, client, cfg, tailscaledConfigAuthkey)
 						if err != nil {
 							return fmt.Errorf("failed to get a reissued authkey: %w", err)
 						}
@@ -402,7 +555,7 @@ authLoop:
 				// deadline to continue monitoring for changes.
 				break authLoop
 			default:
-				log.Printf("tailscaled in state %q, waiting", *n.State)
+				log.Printf("tailscaled in state %q, waiting", state)
 			}
 		}
 
@@ -414,7 +567,7 @@ authLoop:
 				if isOneStepConfig(cfg) && hasKubeStateStore(cfg) {
 					log.Printf("Auth key failed to authenticate (may be expired or single-use), disconnecting from control and requesting new key from operator")
 
-					err := kc.setAndWaitForAuthKeyReissue(bootCtx, client, cfg, tailscaledConfigAuthkey)
+					err := kc.setAndWaitForAuthKeyReissue(ctx, client, cfg, tailscaledConfigAuthkey)
 					if err != nil {
 						return fmt.Errorf("failed to get a reissued authkey: %w", err)
 					}
@@ -457,7 +610,7 @@ authLoop:
 		}
 	}
 
-	w, err = client.WatchIPNBus(ctx, ipn.NotifyInitialNetMap|ipn.NotifyInitialState|ipn.NotifyRateLimit)
+	w, err = client.WatchIPNBus(ctx, containerbootWatchMask)
 	if err != nil {
 		return fmt.Errorf("rewatching tailscaled for updates after auth: %w", err)
 	}
@@ -536,7 +689,7 @@ authLoop:
 		failedResolveAttempts++
 	}
 
-	var egressSvcsNotify chan ipn.Notify
+	var egressSvcsNotify chan netmapState
 	notifyChan := make(chan ipn.Notify)
 	errChan := make(chan error)
 	go func() {
@@ -550,10 +703,12 @@ authLoop:
 			}
 		}
 	}()
+	var nmState netmapState
 	var wg sync.WaitGroup
 
 runLoop:
 	for {
+		var processNetmap bool
 		select {
 		case <-ctx.Done():
 			// Although killTailscaled() is deferred earlier, if we
@@ -567,244 +722,17 @@ runLoop:
 		case err := <-cfgWatchErrChan:
 			return fmt.Errorf("failed to watch tailscaled config: %w", err)
 		case n := <-notifyChan:
-			// TODO: (ChaosInTheCRD) Add node removed check when supported by ipn
-			if n.State != nil && *n.State != ipn.Running {
+			nmState = nmState.processNotify(ctx, client, n)
+			if state, ok := notifyState(n); ok && state != ipn.Running {
 				// Something's gone wrong and we've left the authenticated state.
 				// Our container image never recovered gracefully from this, and the
 				// control flow required to make it work now is hard. So, just crash
 				// the container and rely on the container runtime to restart us,
 				// whereupon we'll go through initial auth again.
-				return fmt.Errorf("tailscaled left running state (now in state %q), exiting", *n.State)
+				return fmt.Errorf("tailscaled left running state (now in state %q), exiting", state)
 			}
-			if n.NetMap != nil {
-				addrs = n.NetMap.SelfNode.Addresses().AsSlice()
-				newCurrentIPs := deephash.Hash(&addrs)
-				ipsHaveChanged := newCurrentIPs != currentIPs
-
-				// Store device ID in a Kubernetes Secret before
-				// setting up any routing rules. This ensures
-				// that, for containerboot instances that are
-				// Kubernetes operator proxies, the operator is
-				// able to retrieve the device ID from the
-				// Kubernetes Secret to clean up tailnet nodes
-				// for proxies whose route setup continuously
-				// fails.
-				deviceID := n.NetMap.SelfNode.StableID()
-				if hasKubeStateStore(cfg) && deephash.Update(&currentDeviceID, &deviceID) {
-					if err := kc.storeDeviceID(ctx, n.NetMap.SelfNode.StableID()); err != nil {
-						return fmt.Errorf("storing device ID in Kubernetes Secret: %w", err)
-					}
-				}
-				if cfg.TailnetTargetFQDN != "" {
-					egressAddrs, err := resolveTailnetFQDN(n.NetMap, cfg.TailnetTargetFQDN)
-					if err != nil {
-						log.Print(err.Error())
-						break
-					}
-
-					newCurentEgressIPs := deephash.Hash(&egressAddrs)
-					egressIPsHaveChanged := newCurentEgressIPs != currentEgressIPs
-					// The firewall rules get (re-)installed:
-					// - on startup
-					// - when the tailnet IPs of the tailnet target have changed
-					// - when the tailnet IPs of this node have changed
-					if (egressIPsHaveChanged || ipsHaveChanged) && len(egressAddrs) != 0 {
-						var rulesInstalled bool
-						for _, egressAddr := range egressAddrs {
-							ea := egressAddr.Addr()
-							if ea.Is4() || (ea.Is6() && nfr.HasIPV6NAT()) {
-								rulesInstalled = true
-								log.Printf("Installing forwarding rules for destination %v", ea.String())
-								if err := installEgressForwardingRule(ctx, ea.String(), addrs, nfr); err != nil {
-									return fmt.Errorf("installing egress proxy rules for destination %s: %v", ea.String(), err)
-								}
-							}
-						}
-						if !rulesInstalled {
-							return fmt.Errorf("no forwarding rules for egress addresses %v, host supports IPv6: %v", egressAddrs, nfr.HasIPV6NAT())
-						}
-					}
-					currentEgressIPs = newCurentEgressIPs
-				}
-				if cfg.ProxyTargetIP != "" && len(addrs) != 0 && ipsHaveChanged {
-					log.Printf("Installing proxy rules")
-					if err := installIngressForwardingRule(ctx, cfg.ProxyTargetIP, addrs, nfr); err != nil {
-						return fmt.Errorf("installing ingress proxy rules: %w", err)
-					}
-				}
-				if cfg.ProxyTargetDNSName != "" && len(addrs) != 0 && ipsHaveChanged {
-					newBackendAddrs, err := resolveDNS(ctx, cfg.ProxyTargetDNSName)
-					if err != nil {
-						log.Printf("[unexpected] error resolving DNS name %s: %v", cfg.ProxyTargetDNSName, err)
-						resetTimer(true)
-						continue
-					}
-					backendsHaveChanged := !(slices.EqualFunc(backendAddrs, newBackendAddrs, func(ip1 net.IP, ip2 net.IP) bool {
-						return slices.ContainsFunc(newBackendAddrs, func(ip net.IP) bool { return ip.Equal(ip1) })
-					}))
-					if backendsHaveChanged {
-						log.Printf("installing ingress proxy rules for backends %v", newBackendAddrs)
-						if err := installIngressForwardingRuleForDNSTarget(ctx, newBackendAddrs, addrs, nfr); err != nil {
-							return fmt.Errorf("error installing ingress proxy rules: %w", err)
-						}
-					}
-					resetTimer(false)
-					backendAddrs = newBackendAddrs
-				}
-				if cfg.ServeConfigPath != "" {
-					cd := certDomainFromNetmap(n.NetMap)
-					if cd == "" {
-						cd = kubetypes.ValueNoHTTPS
-					}
-					prev := certDomain.Swap(new(cd))
-					if prev == nil || *prev != cd {
-						select {
-						case certDomainChanged <- true:
-						default:
-						}
-					}
-				}
-				if cfg.TailnetTargetIP != "" && ipsHaveChanged && len(addrs) != 0 {
-					log.Printf("Installing forwarding rules for destination %v", cfg.TailnetTargetIP)
-					if err := installEgressForwardingRule(ctx, cfg.TailnetTargetIP, addrs, nfr); err != nil {
-						return fmt.Errorf("installing egress proxy rules: %w", err)
-					}
-				}
-				// If this is a L7 cluster ingress proxy (set up
-				// by Kubernetes operator) and proxying of
-				// cluster traffic to the ingress target is
-				// enabled, set up proxy rule each time the
-				// tailnet IPs of this node change (including
-				// the first time they become available).
-				if cfg.AllowProxyingClusterTrafficViaIngress && cfg.ServeConfigPath != "" && ipsHaveChanged && len(addrs) != 0 {
-					log.Printf("installing rules to forward traffic for %s to node's tailnet IP", cfg.PodIP)
-					if err := installTSForwardingRuleForDestination(ctx, cfg.PodIP, addrs, nfr); err != nil {
-						return fmt.Errorf("installing rules to forward traffic to node's tailnet IP: %w", err)
-					}
-				}
-				currentIPs = newCurrentIPs
-
-				// Only store device FQDN and IP addresses to
-				// Kubernetes Secret when any required proxy
-				// route setup has succeeded. IPs and FQDN are
-				// read from the Secret by the Tailscale
-				// Kubernetes operator and, for some proxy
-				// types, such as Tailscale Ingress, advertized
-				// on the Ingress status. Writing them to the
-				// Secret only after the proxy routing has been
-				// set up ensures that the operator does not
-				// advertize endpoints of broken proxies.
-				// TODO (irbekrm): instead of using the IP and FQDN, have some other mechanism for the proxy signal that it is 'Ready'.
-				deviceEndpoints := []any{n.NetMap.SelfNode.Name(), n.NetMap.SelfNode.Addresses()}
-				if hasKubeStateStore(cfg) && deephash.Update(&currentDeviceEndpoints, &deviceEndpoints) {
-					if err := kc.storeDeviceEndpoints(ctx, n.NetMap.SelfNode.Name(), n.NetMap.SelfNode.Addresses().AsSlice()); err != nil {
-						return fmt.Errorf("storing device IPs and FQDN in Kubernetes Secret: %w", err)
-					}
-				}
-
-				if healthCheck != nil {
-					healthCheck.Update(len(addrs) != 0)
-				}
-
-				var prevServeConfig *ipn.ServeConfig
-				if getAutoAdvertiseBool() {
-					prevServeConfig, err = client.GetServeConfig(ctx)
-					if err != nil {
-						return fmt.Errorf("autoadvertisement: failed to get serve config: %w", err)
-					}
-
-					err = refreshAdvertiseServices(ctx, prevServeConfig, klc.New(client))
-					if err != nil {
-						return fmt.Errorf("autoadvertisement: failed to refresh advertise services: %w", err)
-					}
-				}
-
-				if cfg.ServeConfigPath != "" {
-					triggerWatchServeConfigChanges.Do(func() {
-						go watchServeConfigChanges(ctx, certDomainChanged, certDomain, client, kc, cfg, prevServeConfig)
-					})
-				}
-
-				if egressSvcsNotify != nil {
-					egressSvcsNotify <- n
-				}
-			}
-			if !startupTasksDone {
-				// For containerboot instances that act as TCP proxies (proxying traffic to an endpoint
-				// passed via one of the env vars that containerboot reads) and store state in a
-				// Kubernetes Secret, we consider startup tasks done at the point when device info has
-				// been successfully stored to state Secret. For all other containerboot instances, if
-				// we just get to this point the startup tasks can be considered done.
-				if !isL3Proxy(cfg) || !hasKubeStateStore(cfg) || (currentDeviceEndpoints != deephash.Sum{} && currentDeviceID != deephash.Sum{}) {
-					// This log message is used in tests to detect when all
-					// post-auth configuration is done.
-					log.Println("Startup complete, waiting for shutdown signal")
-					startupTasksDone = true
-
-					// Configure egress proxy. Egress proxy will set up firewall rules to proxy
-					// traffic to tailnet targets configured in the provided configuration file. It
-					// will then continuously monitor the config file and netmap updates and
-					// reconfigure the firewall rules as needed. If any of its operations fail, it
-					// will crash this node.
-					if cfg.EgressProxiesCfgPath != "" {
-						log.Printf("configuring egress proxy using configuration file at %s", cfg.EgressProxiesCfgPath)
-						egressSvcsNotify = make(chan ipn.Notify)
-						opts := egressProxyRunOpts{
-							cfgPath:      cfg.EgressProxiesCfgPath,
-							nfr:          nfr,
-							kc:           kc,
-							tsClient:     client,
-							stateSecret:  cfg.KubeSecret,
-							netmapChan:   egressSvcsNotify,
-							podIPv4:      cfg.PodIPv4,
-							tailnetAddrs: addrs,
-						}
-						go func() {
-							if err := ep.run(ctx, n, opts); err != nil {
-								egressSvcsErrorChan <- err
-							}
-						}()
-					}
-					ip := ingressProxy{}
-					if cfg.IngressProxiesCfgPath != "" {
-						log.Printf("configuring ingress proxy using configuration file at %s", cfg.IngressProxiesCfgPath)
-						opts := ingressProxyOpts{
-							cfgPath:     cfg.IngressProxiesCfgPath,
-							nfr:         nfr,
-							kc:          kc,
-							stateSecret: cfg.KubeSecret,
-							podIPv4:     cfg.PodIPv4,
-							podIPv6:     cfg.PodIPv6,
-						}
-						go func() {
-							if err := ip.run(ctx, opts); err != nil {
-								ingressSvcsErrorChan <- err
-							}
-						}()
-					}
-
-					// Wait on tailscaled process. It won't be cleaned up by default when the
-					// container exits as it is not PID1. TODO (irbekrm): perhaps we can replace the
-					// reaper by a running cmd.Wait in a goroutine immediately after starting
-					// tailscaled?
-					reaper := func() {
-						defer wg.Done()
-						for {
-							var status unix.WaitStatus
-							_, err := unix.Wait4(daemonProcess.Pid, &status, 0, nil)
-							if errors.Is(err, unix.EINTR) {
-								continue
-							}
-							if err != nil {
-								log.Fatalf("Waiting for tailscaled to exit: %v", err)
-							}
-							log.Print("tailscaled exited")
-							os.Exit(0)
-						}
-					}
-					wg.Add(1)
-					go reaper()
-				}
+			if n.InitialStatus != nil || n.SelfChange != nil || len(n.PeersChanged) != 0 || len(n.PeersRemoved) != 0 || len(n.PeerChangedPatch) != 0 {
+				processNetmap = true
 			}
 		case <-tc:
 			newBackendAddrs, err := resolveDNS(ctx, cfg.ProxyTargetDNSName)
@@ -824,11 +752,253 @@ runLoop:
 			}
 			backendAddrs = newBackendAddrs
 			resetTimer(false)
+			continue
 		case e := <-egressSvcsErrorChan:
 			return fmt.Errorf("egress proxy failed: %v", e)
 		case e := <-ingressSvcsErrorChan:
 			return fmt.Errorf("ingress proxy failed: %v", e)
 		}
+		if !processNetmap {
+			continue
+		}
+		self := nmState.self
+		if !self.Valid() {
+			continue
+		}
+		{
+			addrs = self.Addresses().AsSlice()
+			newCurrentIPs := deephash.Hash(&addrs)
+			ipsHaveChanged := newCurrentIPs != currentIPs
+
+			// Store device ID in a Kubernetes Secret before
+			// setting up any routing rules. This ensures
+			// that, for containerboot instances that are
+			// Kubernetes operator proxies, the operator is
+			// able to retrieve the device ID from the
+			// Kubernetes Secret to clean up tailnet nodes
+			// for proxies whose route setup continuously
+			// fails.
+			deviceID := self.StableID()
+			if hasKubeStateStore(cfg) && deephash.Update(&currentDeviceID, &deviceID) {
+				if err := kc.storeDeviceID(ctx, deviceID); err != nil {
+					return fmt.Errorf("storing device ID in Kubernetes Secret: %w", err)
+				}
+			}
+			if cfg.TailnetTargetFQDN != "" {
+				egressAddrs, err := resolveTailnetFQDN(nmState, cfg.TailnetTargetFQDN)
+				if err != nil {
+					log.Print(err.Error())
+					break
+				}
+
+				newCurentEgressIPs := deephash.Hash(&egressAddrs)
+				egressIPsHaveChanged := newCurentEgressIPs != currentEgressIPs
+				// The firewall rules get (re-)installed:
+				// - on startup
+				// - when the tailnet IPs of the tailnet target have changed
+				// - when the tailnet IPs of this node have changed
+				if (egressIPsHaveChanged || ipsHaveChanged) && len(egressAddrs) != 0 {
+					var rulesInstalled bool
+					for _, egressAddr := range egressAddrs {
+						ea := egressAddr.Addr()
+						if ea.Is4() || (ea.Is6() && nfr.HasIPV6NAT()) {
+							rulesInstalled = true
+							log.Printf("Installing forwarding rules for destination %v", ea.String())
+							if err := installEgressForwardingRule(ctx, ea.String(), addrs, nfr); err != nil {
+								return fmt.Errorf("installing egress proxy rules for destination %s: %v", ea.String(), err)
+							}
+						}
+					}
+					if !rulesInstalled {
+						return fmt.Errorf("no forwarding rules for egress addresses %v, host supports IPv6: %v", egressAddrs, nfr.HasIPV6NAT())
+					}
+				}
+				currentEgressIPs = newCurentEgressIPs
+			}
+			if cfg.ProxyTargetIP != "" && len(addrs) != 0 && ipsHaveChanged {
+				log.Printf("Installing proxy rules")
+				if err := installIngressForwardingRule(ctx, cfg.ProxyTargetIP, addrs, nfr); err != nil {
+					return fmt.Errorf("installing ingress proxy rules: %w", err)
+				}
+			}
+			if cfg.ProxyTargetDNSName != "" && len(addrs) != 0 && ipsHaveChanged {
+				newBackendAddrs, err := resolveDNS(ctx, cfg.ProxyTargetDNSName)
+				if err != nil {
+					log.Printf("[unexpected] error resolving DNS name %s: %v", cfg.ProxyTargetDNSName, err)
+					resetTimer(true)
+					continue
+				}
+				backendsHaveChanged := !(slices.EqualFunc(backendAddrs, newBackendAddrs, func(ip1 net.IP, ip2 net.IP) bool {
+					return slices.ContainsFunc(newBackendAddrs, func(ip net.IP) bool { return ip.Equal(ip1) })
+				}))
+				if backendsHaveChanged {
+					log.Printf("installing ingress proxy rules for backends %v", newBackendAddrs)
+					if err := installIngressForwardingRuleForDNSTarget(ctx, newBackendAddrs, addrs, nfr); err != nil {
+						return fmt.Errorf("error installing ingress proxy rules: %w", err)
+					}
+				}
+				resetTimer(false)
+				backendAddrs = newBackendAddrs
+			}
+			if cfg.ServeConfigPath != "" {
+				var cd string
+				if nmState.certDomains.Len() != 0 {
+					cd = nmState.certDomains.At(0)
+				}
+				if cd == "" {
+					cd = kubetypes.ValueNoHTTPS
+				}
+				prev := certDomain.Swap(new(cd))
+				if prev == nil || *prev != cd {
+					select {
+					case certDomainChanged <- true:
+					default:
+					}
+				}
+			}
+			if cfg.TailnetTargetIP != "" && ipsHaveChanged && len(addrs) != 0 {
+				log.Printf("Installing forwarding rules for destination %v", cfg.TailnetTargetIP)
+				if err := installEgressForwardingRule(ctx, cfg.TailnetTargetIP, addrs, nfr); err != nil {
+					return fmt.Errorf("installing egress proxy rules: %w", err)
+				}
+			}
+			// If this is a L7 cluster ingress proxy (set up
+			// by Kubernetes operator) and proxying of
+			// cluster traffic to the ingress target is
+			// enabled, set up proxy rule each time the
+			// tailnet IPs of this node change (including
+			// the first time they become available).
+			if cfg.AllowProxyingClusterTrafficViaIngress && cfg.ServeConfigPath != "" && ipsHaveChanged && len(addrs) != 0 {
+				log.Printf("installing rules to forward traffic for %s to node's tailnet IP", cfg.PodIP)
+				if err := installTSForwardingRuleForDestination(ctx, cfg.PodIP, addrs, nfr); err != nil {
+					return fmt.Errorf("installing rules to forward traffic to node's tailnet IP: %w", err)
+				}
+			}
+			currentIPs = newCurrentIPs
+
+			// Only store device FQDN and IP addresses to
+			// Kubernetes Secret when any required proxy
+			// route setup has succeeded. IPs and FQDN are
+			// read from the Secret by the Tailscale
+			// Kubernetes operator and, for some proxy
+			// types, such as Tailscale Ingress, advertized
+			// on the Ingress status. Writing them to the
+			// Secret only after the proxy routing has been
+			// set up ensures that the operator does not
+			// advertize endpoints of broken proxies.
+			// TODO (irbekrm): instead of using the IP and FQDN, have some other mechanism for the proxy signal that it is 'Ready'.
+			deviceEndpoints := []any{self.Name(), self.Addresses()}
+			if hasKubeStateStore(cfg) && deephash.Update(&currentDeviceEndpoints, &deviceEndpoints) {
+				if err := kc.storeDeviceEndpoints(ctx, self.Name(), addrs); err != nil {
+					return fmt.Errorf("storing device IPs and FQDN in Kubernetes Secret: %w", err)
+				}
+			}
+
+			if healthCheck != nil {
+				healthCheck.Update(len(addrs) != 0)
+			}
+
+			var prevServeConfig *ipn.ServeConfig
+			if getAutoAdvertiseBool() {
+				prevServeConfig, err = client.GetServeConfig(ctx)
+				if err != nil {
+					return fmt.Errorf("autoadvertisement: failed to get serve config: %w", err)
+				}
+
+				err = refreshAdvertiseServices(ctx, prevServeConfig, klc.New(client))
+				if err != nil {
+					return fmt.Errorf("autoadvertisement: failed to refresh advertise services: %w", err)
+				}
+			}
+
+			if cfg.ServeConfigPath != "" {
+				triggerWatchServeConfigChanges.Do(func() {
+					go watchServeConfigChanges(ctx, certDomainChanged, certDomain, client, kc, cfg, prevServeConfig)
+				})
+			}
+
+			if egressSvcsNotify != nil {
+				egressSvcsNotify <- nmState
+			}
+		}
+		if !startupTasksDone {
+			// For containerboot instances that act as TCP proxies (proxying traffic to an endpoint
+			// passed via one of the env vars that containerboot reads) and store state in a
+			// Kubernetes Secret, we consider startup tasks done at the point when device info has
+			// been successfully stored to state Secret. For all other containerboot instances, if
+			// we just get to this point the startup tasks can be considered done.
+			if !isL3Proxy(cfg) || !hasKubeStateStore(cfg) || (currentDeviceEndpoints != deephash.Sum{} && currentDeviceID != deephash.Sum{}) {
+				// This log message is used in tests to detect when all
+				// post-auth configuration is done.
+				log.Println("Startup complete, waiting for shutdown signal")
+				startupTasksDone = true
+
+				// Configure egress proxy. Egress proxy will set up firewall rules to proxy
+				// traffic to tailnet targets configured in the provided configuration file. It
+				// will then continuously monitor the config file and netmap updates and
+				// reconfigure the firewall rules as needed. If any of its operations fail, it
+				// will crash this node.
+				if cfg.EgressProxiesCfgPath != "" {
+					log.Printf("configuring egress proxy using configuration file at %s", cfg.EgressProxiesCfgPath)
+					egressSvcsNotify = make(chan netmapState)
+					opts := egressProxyRunOpts{
+						cfgPath:      cfg.EgressProxiesCfgPath,
+						nfr:          nfr,
+						kc:           kc,
+						tsClient:     client,
+						stateSecret:  cfg.KubeSecret,
+						netmapChan:   egressSvcsNotify,
+						podIPv4:      cfg.PodIPv4,
+						podIPv6:      cfg.PodIPv6,
+						tailnetAddrs: addrs,
+					}
+					go func() {
+						if err := ep.run(ctx, nmState, opts); err != nil {
+							egressSvcsErrorChan <- err
+						}
+					}()
+				}
+				ip := ingressProxy{}
+				if cfg.IngressProxiesCfgPath != "" {
+					log.Printf("configuring ingress proxy using configuration file at %s", cfg.IngressProxiesCfgPath)
+					opts := ingressProxyOpts{
+						cfgPath:     cfg.IngressProxiesCfgPath,
+						nfr:         nfr,
+						kc:          kc,
+						stateSecret: cfg.KubeSecret,
+						podIPv4:     cfg.PodIPv4,
+						podIPv6:     cfg.PodIPv6,
+					}
+					go func() {
+						if err := ip.run(ctx, opts); err != nil {
+							ingressSvcsErrorChan <- err
+						}
+					}()
+				}
+
+				// Wait on tailscaled process. It won't be cleaned up by default when the
+				// container exits as it is not PID1. TODO (irbekrm): perhaps we can replace the
+				// reaper by a running cmd.Wait in a goroutine immediately after starting
+				// tailscaled?
+				reaper := func() {
+					defer wg.Done()
+					for {
+						var status unix.WaitStatus
+						_, err := unix.Wait4(daemonProcess.Pid, &status, 0, nil)
+						if errors.Is(err, unix.EINTR) {
+							continue
+						}
+						if err != nil {
+							log.Fatalf("Waiting for tailscaled to exit: %v", err)
+						}
+						log.Print("tailscaled exited")
+						os.Exit(0)
+					}
+				}
+				wg.Add(1)
+				go reaper()
+			}
+		}
 	}
 	wg.Wait()
 
@@ -964,34 +1134,52 @@ func runHTTPServer(mux *http.ServeMux, addr string) (close func() error) {
 }
 
 // resolveTailnetFQDN resolves a tailnet FQDN to a list of IP prefixes, which
-// can be either a peer device or a Tailscale Service.
-func resolveTailnetFQDN(nm *netmap.NetworkMap, fqdn string) ([]netip.Prefix, error) {
+// can be either a peer device, a Tailscale Service, or a 4via6 synthesized
+// DNS name (e.g. "10-1-0-5-via-7.tailnet.ts.net").
+func resolveTailnetFQDN(nm netmapState, fqdn string) ([]netip.Prefix, error) {
 	dnsFQDN, err := dnsname.ToFQDN(fqdn)
 	if err != nil {
 		return nil, fmt.Errorf("error parsing %q as FQDN: %w", fqdn, err)
 	}
 
 	// Check all peer devices first.
-	for _, p := range nm.Peers {
+	var ret []netip.Prefix
+	for p := range nm.peers() {
 		if strings.EqualFold(p.Name(), dnsFQDN.WithTrailingDot()) {
-			return p.Addresses().AsSlice(), nil
+			ret = p.Addresses().AsSlice()
+			break
 		}
 	}
+	if ret != nil {
+		return ret, nil
+	}
 
 	// If not found yet, check for a matching Tailscale Service.
 	if svcIPs := serviceIPsFromNetMap(nm, dnsFQDN); len(svcIPs) != 0 {
 		return svcIPs, nil
 	}
+	// If not found yet, check for a matching 4via6 DNS name.
+	if addr, ok := kubeutils.ResolveViaDomain(dnsFQDN.WithTrailingDot()); ok {
+		prefix := netip.PrefixFrom(addr, addr.BitLen())
+		for nn := range nm.peers() {
+			for _, allowedIP := range nn.AllowedIPs().All() {
+				if allowedIP.Contains(addr) {
+					return []netip.Prefix{prefix}, nil
+				}
+			}
+		}
+		return nil, fmt.Errorf("resolved 4via6 address %v for %q but no peer advertises a route containing it", addr, fqdn)
+	}
 
-	return nil, fmt.Errorf("could not find Tailscale node or service %q; it either does not exist, or not reachable because of ACLs", fqdn)
+	return nil, fmt.Errorf("could not find Tailscale node, service or 4via6 address %q; it either does not exist, or not reachable because of ACLs", fqdn)
 }
 
 // serviceIPsFromNetMap returns all IPs of a Tailscale Service if its FQDN is
 // found in the netmap. Note that Tailscale Services are not a first-class
 // object in the netmap, so we guess based on DNS ExtraRecords and AllowedIPs.
-func serviceIPsFromNetMap(nm *netmap.NetworkMap, fqdn dnsname.FQDN) []netip.Prefix {
+func serviceIPsFromNetMap(nm netmapState, fqdn dnsname.FQDN) []netip.Prefix {
 	var extraRecords []tailcfg.DNSRecord
-	for _, rec := range nm.DNS.ExtraRecords {
+	for _, rec := range nm.dnsExtraRecords.All() {
 		recFQDN, err := dnsname.ToFQDN(rec.Name)
 		if err != nil {
 			continue
@@ -1013,7 +1201,7 @@ func serviceIPsFromNetMap(nm *netmap.NetworkMap, fqdn dnsname.FQDN) []netip.Pref
 			continue
 		}
 		ipPrefix := netip.PrefixFrom(ip, ip.BitLen())
-		for _, ps := range nm.Peers {
+		for ps := range nm.peers() {
 			for _, allowedIP := range ps.AllowedIPs().All() {
 				if allowedIP == ipPrefix {
 					prefixes = append(prefixes, ipPrefix)
@@ -1024,11 +1212,3 @@ func serviceIPsFromNetMap(nm *netmap.NetworkMap, fqdn dnsname.FQDN) []netip.Pref
 
 	return prefixes
 }
-
-func authkeyFromTailscaledConfig(path string) string {
-	if cfg, err := conffile.Load(path); err == nil && cfg.Parsed.AuthKey != nil {
-		return *cfg.Parsed.AuthKey
-	}
-
-	return ""
-}
diff --git a/cmd/containerboot/main_test.go b/cmd/containerboot/main_test.go
index 5ea402f66..0013bb8e4 100644
--- a/cmd/containerboot/main_test.go
+++ b/cmd/containerboot/main_test.go
@@ -7,6 +7,7 @@ package main
 
 import (
 	"bytes"
+	"context"
 	_ "embed"
 	"encoding/base64"
 	"encoding/json"
@@ -32,24 +33,30 @@ import (
 
 	"github.com/google/go-cmp/cmp"
 	"golang.org/x/sys/unix"
+	"tailscale.com/client/local"
+	"tailscale.com/cmd/testwrapper/flakytest"
 	"tailscale.com/health"
 	"tailscale.com/ipn"
+	"tailscale.com/ipn/ipnstate"
 	"tailscale.com/kube/egressservices"
 	"tailscale.com/kube/kubeclient"
 	"tailscale.com/kube/kubetypes"
+	"tailscale.com/net/memnet"
 	"tailscale.com/tailcfg"
 	"tailscale.com/tstest"
-	"tailscale.com/types/netmap"
+	"tailscale.com/types/key"
 )
 
 const configFileAuthKey = "some-auth-key"
 
 func TestContainerBoot(t *testing.T) {
+	flakytest.Mark(t, "https://github.com/tailscale/tailscale/issues/19380")
 	boot := filepath.Join(t.TempDir(), "containerboot")
 	if err := exec.Command("go", "build", "-ldflags", "-X main.testSleepDuration=1ms", "-o", boot, "tailscale.com/cmd/containerboot").Run(); err != nil {
 		t.Fatalf("Building containerboot: %v", err)
 	}
 	egressStatus := egressSvcStatus("foo", "foo.tailnetxyz.ts.net", "100.64.0.2")
+	egressStatusUpdated := egressSvcStatus("foo", "foo.tailnetxyz.ts.net", "100.64.0.3")
 
 	metricsURL := func(port int) string {
 		return fmt.Sprintf("http://127.0.0.1:%d/metrics", port)
@@ -103,12 +110,10 @@ func TestContainerBoot(t *testing.T) {
 	}
 	runningNotify := &ipn.Notify{
 		State: new(ipn.Running),
-		NetMap: &netmap.NetworkMap{
-			SelfNode: (&tailcfg.Node{
-				StableID:  tailcfg.StableNodeID("myID"),
-				Name:      "test-node.test.ts.net.",
-				Addresses: []netip.Prefix{netip.MustParsePrefix("100.64.0.1/32")},
-			}).View(),
+		SelfChange: &tailcfg.Node{
+			StableID:  tailcfg.StableNodeID("myID"),
+			Name:      "test-node.test.ts.net.",
+			Addresses: []netip.Prefix{netip.MustParsePrefix("100.64.0.1/32")},
 		},
 	}
 	type testCase struct {
@@ -381,18 +386,16 @@ func TestContainerBoot(t *testing.T) {
 					{
 						Notify: &ipn.Notify{
 							State: new(ipn.Running),
-							NetMap: &netmap.NetworkMap{
-								SelfNode: (&tailcfg.Node{
-									StableID:  tailcfg.StableNodeID("myID"),
-									Name:      "test-node.test.ts.net.",
-									Addresses: []netip.Prefix{netip.MustParsePrefix("100.64.0.1/32")},
-								}).View(),
-								Peers: []tailcfg.NodeView{
-									(&tailcfg.Node{
-										StableID:  tailcfg.StableNodeID("ipv6ID"),
-										Name:      "ipv6-node.test.ts.net.",
-										Addresses: []netip.Prefix{netip.MustParsePrefix("::1/128")},
-									}).View(),
+							SelfChange: &tailcfg.Node{
+								StableID:  tailcfg.StableNodeID("myID"),
+								Name:      "test-node.test.ts.net.",
+								Addresses: []netip.Prefix{netip.MustParsePrefix("100.64.0.1/32")},
+							},
+							PeersChanged: []*tailcfg.Node{
+								{
+									StableID:  tailcfg.StableNodeID("ipv6ID"),
+									Name:      "ipv6-node.test.ts.net.",
+									Addresses: []netip.Prefix{netip.MustParsePrefix("::1/128")},
 								},
 							},
 						},
@@ -629,12 +632,10 @@ func TestContainerBoot(t *testing.T) {
 					{
 						Notify: &ipn.Notify{
 							State: new(ipn.Running),
-							NetMap: &netmap.NetworkMap{
-								SelfNode: (&tailcfg.Node{
-									StableID:  tailcfg.StableNodeID("newID"),
-									Name:      "new-name.test.ts.net.",
-									Addresses: []netip.Prefix{netip.MustParsePrefix("100.64.0.1/32")},
-								}).View(),
+							SelfChange: &tailcfg.Node{
+								StableID:  tailcfg.StableNodeID("newID"),
+								Name:      "new-name.test.ts.net.",
+								Addresses: []netip.Prefix{netip.MustParsePrefix("100.64.0.1/32")},
 							},
 						},
 						WantKubeSecret: map[string]string{
@@ -1093,18 +1094,16 @@ func TestContainerBoot(t *testing.T) {
 					{
 						Notify: &ipn.Notify{
 							State: new(ipn.Running),
-							NetMap: &netmap.NetworkMap{
-								SelfNode: (&tailcfg.Node{
-									StableID:  tailcfg.StableNodeID("myID"),
-									Name:      "test-node.test.ts.net.",
-									Addresses: []netip.Prefix{netip.MustParsePrefix("100.64.0.1/32")},
-								}).View(),
-								Peers: []tailcfg.NodeView{
-									(&tailcfg.Node{
-										StableID:  tailcfg.StableNodeID("fooID"),
-										Name:      "foo.tailnetxyz.ts.net.",
-										Addresses: []netip.Prefix{netip.MustParsePrefix("100.64.0.2/32")},
-									}).View(),
+							SelfChange: &tailcfg.Node{
+								StableID:  tailcfg.StableNodeID("myID"),
+								Name:      "test-node.test.ts.net.",
+								Addresses: []netip.Prefix{netip.MustParsePrefix("100.64.0.1/32")},
+							},
+							PeersChanged: []*tailcfg.Node{
+								{
+									StableID:  tailcfg.StableNodeID("fooID"),
+									Name:      "foo.tailnetxyz.ts.net.",
+									Addresses: []netip.Prefix{netip.MustParsePrefix("100.64.0.2/32")},
 								},
 							},
 						},
@@ -1120,6 +1119,23 @@ func TestContainerBoot(t *testing.T) {
 							egressSvcTerminateURL(env.localAddrPort): 200,
 						},
 					},
+					{
+						Notify: &ipn.Notify{
+							PeersChanged: []*tailcfg.Node{{
+								StableID:  tailcfg.StableNodeID("fooID"),
+								Name:      "foo.tailnetxyz.ts.net.",
+								Addresses: []netip.Prefix{netip.MustParsePrefix("100.64.0.3/32")},
+							}},
+						},
+						WantKubeSecret: map[string]string{
+							"egress-services":   string(mustJSON(t, egressStatusUpdated)),
+							"authkey":           "tskey-key",
+							"device_fqdn":       "test-node.test.ts.net.",
+							"device_id":         "myID",
+							"device_ips":        `["100.64.0.1"]`,
+							kubetypes.KeyCapVer: capver,
+						},
+					},
 				},
 			}
 		},
@@ -1274,6 +1290,12 @@ func TestContainerBoot(t *testing.T) {
 						t.Fatalf("phase %d: updating mtime for %q: %v", i, path, err)
 					}
 				}
+				if p.Notify != nil && p.Notify.InitialStatus == nil {
+					// Shallow-copy before mutating to avoid a race with
+					// parallel subtests that share the same *ipn.Notify.
+					p.Notify = new(*p.Notify)
+					p.Notify.InitialStatus = statusFromNotify(p.Notify)
+				}
 				env.lapi.Notify(p.Notify)
 				if p.Signal != nil {
 					cmd.Process.Signal(*p.Signal)
@@ -1502,6 +1524,43 @@ func (lc *localAPI) Notify(n *ipn.Notify) {
 	lc.cond.Broadcast()
 }
 
+func statusFromNotify(n *ipn.Notify) *ipnstate.Status {
+	st := new(ipnstate.Status)
+	if n.State != nil {
+		st.BackendState = n.State.String()
+	}
+	if n.SelfChange != nil {
+		st.Self = peerStatusFromNode(n.SelfChange.View())
+	}
+	if len(n.PeersChanged) != 0 {
+		st.Peer = map[key.NodePublic]*ipnstate.PeerStatus{}
+		for _, p := range n.PeersChanged {
+			pv := p.View()
+			st.Peer[pv.Key()] = peerStatusFromNode(pv)
+		}
+	}
+	return st
+}
+
+func peerStatusFromNode(n tailcfg.NodeView) *ipnstate.PeerStatus {
+	ps := &ipnstate.PeerStatus{
+		ID:        n.StableID(),
+		NodeID:    n.ID(),
+		PublicKey: n.Key(),
+		DNSName:   n.Name(),
+	}
+	for _, p := range n.Addresses().All() {
+		if p.IsSingleIP() {
+			ps.TailscaleIPs = append(ps.TailscaleIPs, p.Addr())
+		}
+	}
+	if n.AllowedIPs().Len() != 0 {
+		v := n.AllowedIPs()
+		ps.AllowedIPs = &v
+	}
+	return ps
+}
+
 func (lc *localAPI) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	switch r.URL.Path {
 	case "/localapi/v0/serve-config":
@@ -1889,3 +1948,57 @@ func newTestEnv(t *testing.T) testEnv {
 		healthAddrPort:  healthAddrPort,
 	}
 }
+
+// TestProcessNotifyRefreshesDNSOnSelfChange verifies that a SelfChange
+// notification triggers a DNS refresh; without it, VIPServices created
+// after pod boot are invisible to resolveTailnetFQDN.
+func TestProcessNotifyRefreshesDNSOnSelfChange(t *testing.T) {
+	extraRec := tailcfg.DNSRecord{
+		Name:  "my-ingress.tailnet.ts.net.",
+		Type:  "A",
+		Value: "100.99.10.20",
+	}
+	dnsCfg := &tailcfg.DNSConfig{
+		ExtraRecords: []tailcfg.DNSRecord{extraRec},
+		CertDomains:  []string{"node.tailnet.ts.net"},
+	}
+
+	lal := memnet.Listen("local-tailscaled.sock:80")
+	defer lal.Close()
+	mux := http.NewServeMux()
+	mux.HandleFunc("/localapi/v0/dns-config", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		if err := json.NewEncoder(w).Encode(dnsCfg); err != nil {
+			t.Errorf("encoding dns config: %v", err)
+		}
+	})
+	srv := &http.Server{Handler: mux}
+	go srv.Serve(lal)
+	t.Cleanup(func() { srv.Shutdown(context.Background()) })
+
+	client := &local.Client{Dial: lal.Dial}
+
+	// Empty starting state, as if the InitialStatus captured at pod
+	// boot carried no ExtraRecords because the VIPService didn't exist
+	// yet at that time.
+	var s netmapState
+
+	n := ipn.Notify{
+		SelfChange: &tailcfg.Node{
+			ID:   1,
+			Name: "self.tailnet.ts.net.",
+		},
+	}
+
+	got := s.processNotify(context.Background(), client, n)
+
+	if got.dnsExtraRecords.Len() != 1 {
+		t.Fatalf("dnsExtraRecords.Len() = %d, want 1", got.dnsExtraRecords.Len())
+	}
+	if rec := got.dnsExtraRecords.At(0); rec.Name != extraRec.Name {
+		t.Errorf("dnsExtraRecords[0].Name = %q, want %q", rec.Name, extraRec.Name)
+	}
+	if got.certDomains.Len() != 1 || got.certDomains.At(0) != "node.tailnet.ts.net" {
+		t.Errorf("certDomains = %v, want [node.tailnet.ts.net]", got.certDomains.AsSlice())
+	}
+}
diff --git a/cmd/containerboot/serve.go b/cmd/containerboot/serve.go
index f64d2d24f..f5423630f 100644
--- a/cmd/containerboot/serve.go
+++ b/cmd/containerboot/serve.go
@@ -24,7 +24,6 @@ import (
 	"tailscale.com/kube/kubetypes"
 	klc "tailscale.com/kube/localclient"
 	"tailscale.com/kube/services"
-	"tailscale.com/types/netmap"
 )
 
 // watchServeConfigChanges watches path for changes, and when it sees one, reads
@@ -142,13 +141,6 @@ func refreshAdvertiseServices(ctx context.Context, sc *ipn.ServeConfig, lc klc.L
 	return nil
 }
 
-func certDomainFromNetmap(nm *netmap.NetworkMap) string {
-	if len(nm.DNS.CertDomains) == 0 {
-		return ""
-	}
-	return nm.DNS.CertDomains[0]
-}
-
 func updateServeConfig(ctx context.Context, sc *ipn.ServeConfig, certDomain string, lc klc.LocalClient) error {
 	if !isValidHTTPSConfig(certDomain, sc) {
 		return nil
diff --git a/cmd/containerboot/settings.go b/cmd/containerboot/settings.go
index f695f2e5d..17483194f 100644
--- a/cmd/containerboot/settings.go
+++ b/cmd/containerboot/settings.go
@@ -6,6 +6,7 @@
 package main
 
 import (
+	"cmp"
 	"context"
 	"errors"
 	"fmt"
@@ -18,6 +19,7 @@ import (
 
 	"tailscale.com/ipn/conffile"
 	"tailscale.com/kube/kubeclient"
+	"tailscale.com/util/def"
 )
 
 // settings is all the configuration for containerboot.
@@ -89,47 +91,50 @@ type settings struct {
 
 func configFromEnv() (*settings, error) {
 	cfg := &settings{
-		AuthKey:            defaultEnvs([]string{"TS_AUTHKEY", "TS_AUTH_KEY"}, ""),
-		ClientID:           defaultEnv("TS_CLIENT_ID", ""),
-		ClientSecret:       defaultEnv("TS_CLIENT_SECRET", ""),
-		IDToken:            defaultEnv("TS_ID_TOKEN", ""),
-		Audience:           defaultEnv("TS_AUDIENCE", ""),
-		Hostname:           defaultEnv("TS_HOSTNAME", ""),
+		AuthKey:            cmp.Or(os.Getenv("TS_AUTHKEY"), os.Getenv("TS_AUTH_KEY")),
+		ClientID:           os.Getenv("TS_CLIENT_ID"),
+		ClientSecret:       os.Getenv("TS_CLIENT_SECRET"),
+		IDToken:            os.Getenv("TS_ID_TOKEN"),
+		Audience:           os.Getenv("TS_AUDIENCE"),
+		Hostname:           os.Getenv("TS_HOSTNAME"),
 		Routes:             defaultEnvStringPointer("TS_ROUTES"),
-		ServeConfigPath:    defaultEnv("TS_SERVE_CONFIG", ""),
-		ProxyTargetIP:      defaultEnv("TS_DEST_IP", ""),
-		ProxyTargetDNSName: defaultEnv("TS_EXPERIMENTAL_DEST_DNS_NAME", ""),
-		TailnetTargetIP:    defaultEnv("TS_TAILNET_TARGET_IP", ""),
-		TailnetTargetFQDN:  defaultEnv("TS_TAILNET_TARGET_FQDN", ""),
-		DaemonExtraArgs:    defaultEnv("TS_TAILSCALED_EXTRA_ARGS", ""),
-		ExtraArgs:          defaultEnv("TS_EXTRA_ARGS", ""),
+		ServeConfigPath:    os.Getenv("TS_SERVE_CONFIG"),
+		ProxyTargetIP:      os.Getenv("TS_DEST_IP"),
+		ProxyTargetDNSName: os.Getenv("TS_EXPERIMENTAL_DEST_DNS_NAME"),
+		TailnetTargetIP:    os.Getenv("TS_TAILNET_TARGET_IP"),
+		TailnetTargetFQDN:  os.Getenv("TS_TAILNET_TARGET_FQDN"),
+		DaemonExtraArgs:    os.Getenv("TS_TAILSCALED_EXTRA_ARGS"),
+		ExtraArgs:          os.Getenv("TS_EXTRA_ARGS"),
 		InKubernetes:       os.Getenv("KUBERNETES_SERVICE_HOST") != "",
-		UserspaceMode:      defaultBool("TS_USERSPACE", true),
-		StateDir:           defaultEnv("TS_STATE_DIR", ""),
+		UserspaceMode:      def.Bool(os.Getenv("TS_USERSPACE"), true),
+		StateDir:           os.Getenv("TS_STATE_DIR"),
 		AcceptDNS:          defaultEnvBoolPointer("TS_ACCEPT_DNS"),
 		KubeSecret: func() string {
-			if os.Getenv("KUBERNETES_SERVICE_HOST") != "" {
-				return defaultEnv("TS_KUBE_SECRET", "tailscale")
+			if os.Getenv("KUBERNETES_SERVICE_HOST") == "" {
+				return os.Getenv("TS_KUBE_SECRET")
 			}
-			return defaultEnv("TS_KUBE_SECRET", "")
+			// An explicitly empty TS_KUBE_SECRET disables Secret storage, so
+			// unset and empty must stay distinguishable: def.LookupEnv keeps
+			// an explicit "" rather than falling back to the default.
+			return def.LookupEnv("TS_KUBE_SECRET", "tailscale")
 		}(),
-		SOCKSProxyAddr:                        defaultEnv("TS_SOCKS5_SERVER", ""),
-		HTTPProxyAddr:                         defaultEnv("TS_OUTBOUND_HTTP_PROXY_LISTEN", ""),
-		Socket:                                defaultEnv("TS_SOCKET", "/tmp/tailscaled.sock"),
-		AuthOnce:                              defaultBool("TS_AUTH_ONCE", false),
-		Root:                                  defaultEnv("TS_TEST_ONLY_ROOT", "/"),
+		SOCKSProxyAddr:                        os.Getenv("TS_SOCKS5_SERVER"),
+		HTTPProxyAddr:                         os.Getenv("TS_OUTBOUND_HTTP_PROXY_LISTEN"),
+		Socket:                                cmp.Or(os.Getenv("TS_SOCKET"), "/tmp/tailscaled.sock"),
+		AuthOnce:                              def.Bool(os.Getenv("TS_AUTH_ONCE"), false),
+		Root:                                  cmp.Or(os.Getenv("TS_TEST_ONLY_ROOT"), "/"),
 		TailscaledConfigFilePath:              tailscaledConfigFilePath(),
-		AllowProxyingClusterTrafficViaIngress: defaultBool("EXPERIMENTAL_ALLOW_PROXYING_CLUSTER_TRAFFIC_VIA_INGRESS", false),
-		PodIP:                                 defaultEnv("POD_IP", ""),
-		EnableForwardingOptimizations:         defaultBool("TS_EXPERIMENTAL_ENABLE_FORWARDING_OPTIMIZATIONS", false),
-		HealthCheckAddrPort:                   defaultEnv("TS_HEALTHCHECK_ADDR_PORT", ""),
-		LocalAddrPort:                         defaultEnv("TS_LOCAL_ADDR_PORT", "[::]:9002"),
-		MetricsEnabled:                        defaultBool("TS_ENABLE_METRICS", false),
-		HealthCheckEnabled:                    defaultBool("TS_ENABLE_HEALTH_CHECK", false),
-		DebugAddrPort:                         defaultEnv("TS_DEBUG_ADDR_PORT", ""),
-		EgressProxiesCfgPath:                  defaultEnv("TS_EGRESS_PROXIES_CONFIG_PATH", ""),
-		IngressProxiesCfgPath:                 defaultEnv("TS_INGRESS_PROXIES_CONFIG_PATH", ""),
-		PodUID:                                defaultEnv("POD_UID", ""),
+		AllowProxyingClusterTrafficViaIngress: def.Bool(os.Getenv("EXPERIMENTAL_ALLOW_PROXYING_CLUSTER_TRAFFIC_VIA_INGRESS"), false),
+		PodIP:                                 os.Getenv("POD_IP"),
+		EnableForwardingOptimizations:         def.Bool(os.Getenv("TS_EXPERIMENTAL_ENABLE_FORWARDING_OPTIMIZATIONS"), false),
+		HealthCheckAddrPort:                   os.Getenv("TS_HEALTHCHECK_ADDR_PORT"),
+		LocalAddrPort:                         cmp.Or(os.Getenv("TS_LOCAL_ADDR_PORT"), "[::]:9002"),
+		MetricsEnabled:                        def.Bool(os.Getenv("TS_ENABLE_METRICS"), false),
+		HealthCheckEnabled:                    def.Bool(os.Getenv("TS_ENABLE_HEALTH_CHECK"), false),
+		DebugAddrPort:                         os.Getenv("TS_DEBUG_ADDR_PORT"),
+		EgressProxiesCfgPath:                  os.Getenv("TS_EGRESS_PROXIES_CONFIG_PATH"),
+		IngressProxiesCfgPath:                 os.Getenv("TS_INGRESS_PROXIES_CONFIG_PATH"),
+		PodUID:                                os.Getenv("POD_UID"),
 	}
 
 	podIPs, ok := os.LookupEnv("POD_IPS")
@@ -153,7 +158,7 @@ func configFromEnv() (*settings, error) {
 
 	// If cert share is enabled, set the replica as read or write. Only 0th
 	// replica should be able to write.
-	isInCertShareMode := defaultBool("TS_EXPERIMENTAL_CERT_SHARE", false)
+	isInCertShareMode := def.Bool(os.Getenv("TS_EXPERIMENTAL_CERT_SHARE"), false)
 	if isInCertShareMode {
 		cfg.CertShareMode = "ro"
 		podName := os.Getenv("POD_NAME")
@@ -454,15 +459,6 @@ func (cfg *settings) egressSvcsTerminateEPEnabled() bool {
 	return cfg.LocalAddrPort != "" && cfg.EgressProxiesCfgPath != ""
 }
 
-// defaultEnv returns the value of the given envvar name, or defVal if
-// unset.
-func defaultEnv(name, defVal string) string {
-	if v, ok := os.LookupEnv(name); ok {
-		return v
-	}
-	return defVal
-}
-
 // defaultEnvStringPointer returns a pointer to the given envvar value if set, else
 // returns nil. This is useful in cases where we need to distinguish between a
 // variable being set to empty string vs unset.
@@ -484,23 +480,3 @@ func defaultEnvBoolPointer(name string) *bool {
 	}
 	return &ret
 }
-
-func defaultEnvs(names []string, defVal string) string {
-	for _, name := range names {
-		if v, ok := os.LookupEnv(name); ok {
-			return v
-		}
-	}
-	return defVal
-}
-
-// defaultBool returns the boolean value of the given envvar name, or
-// defVal if unset or not a bool.
-func defaultBool(name string, defVal bool) bool {
-	v := os.Getenv(name)
-	ret, err := strconv.ParseBool(v)
-	if err != nil {
-		return defVal
-	}
-	return ret
-}
diff --git a/cmd/containerboot/settings_test.go b/cmd/containerboot/settings_test.go
index eca50101b..c2a61b85f 100644
--- a/cmd/containerboot/settings_test.go
+++ b/cmd/containerboot/settings_test.go
@@ -7,6 +7,7 @@ package main
 
 import (
 	"net/netip"
+	"os"
 	"strings"
 	"testing"
 )
@@ -228,6 +229,78 @@ func TestValidateAuthMethods(t *testing.T) {
 	}
 }
 
+func TestConfigFromEnvEmptyDefaults(t *testing.T) {
+	tests := []struct {
+		env  string
+		get  func(*settings) string
+		want string
+	}{
+		{
+			env:  "TS_SOCKET",
+			get:  func(c *settings) string { return c.Socket },
+			want: "/tmp/tailscaled.sock",
+		},
+		{
+			env:  "TS_LOCAL_ADDR_PORT",
+			get:  func(c *settings) string { return c.LocalAddrPort },
+			want: "[::]:9002",
+		},
+		{
+			env:  "TS_TEST_ONLY_ROOT",
+			get:  func(c *settings) string { return c.Root },
+			want: "/",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.env, func(t *testing.T) {
+			t.Setenv(tt.env, "")
+			cfg, err := configFromEnv()
+			if err != nil {
+				t.Fatal(err)
+			}
+			if got := tt.get(cfg); got != tt.want {
+				t.Errorf(`%s set to empty "": got %q, want default %q`, tt.env, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestConfigFromEnvKubeSecret(t *testing.T) {
+	tests := []struct {
+		name         string
+		inKubernetes bool
+		unset        bool
+		value        string
+		want         string
+	}{
+		{name: "in_kubernetes_unset", inKubernetes: true, unset: true, want: "tailscale"},
+		{name: "in_kubernetes_empty", inKubernetes: true, value: "", want: ""},
+		{name: "in_kubernetes_set", inKubernetes: true, value: "custom", want: "custom"},
+		{name: "not_in_kubernetes_unset", inKubernetes: false, unset: true, want: ""},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// t.Setenv registers a t.Cleanup to restore the original value, so
+			// route the unset cases through it rather than a bare os.Unsetenv.
+			t.Setenv("KUBERNETES_SERVICE_HOST", "10.96.0.1")
+			if !tt.inKubernetes {
+				os.Unsetenv("KUBERNETES_SERVICE_HOST")
+			}
+			t.Setenv("TS_KUBE_SECRET", tt.value)
+			if tt.unset {
+				os.Unsetenv("TS_KUBE_SECRET")
+			}
+			cfg, err := configFromEnv()
+			if err != nil {
+				t.Fatal(err)
+			}
+			if cfg.KubeSecret != tt.want {
+				t.Errorf("KubeSecret = %q, want %q", cfg.KubeSecret, tt.want)
+			}
+		})
+	}
+}
+
 func TestHandlesKubeIPV6(t *testing.T) {
 	t.Setenv("TS_LOCAL_ADDR_PORT", "fd7a:115c:a1e0::6c34:352:9002")
 	t.Setenv("POD_IPS", "fd7a:115c:a1e0::6c34:352")
diff --git a/cmd/containerboot/tailscaled.go b/cmd/containerboot/tailscaled.go
index 6f4ed77e7..379dd3eeb 100644
--- a/cmd/containerboot/tailscaled.go
+++ b/cmd/containerboot/tailscaled.go
@@ -150,7 +150,15 @@ func tailscaleUp(ctx context.Context, cfg *settings) error {
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr
 	if err := cmd.Run(); err != nil {
-		return fmt.Errorf("tailscale up failed: %v", err)
+		if ctxErr := ctx.Err(); ctxErr != nil {
+			// A canceled context kills the command, and cmd.Run can
+			// report the subprocess's death ("signal: killed") rather
+			// than the context error that caused it. Return the
+			// context error so that callers (and ultimately main) can
+			// recognize a graceful shutdown with errors.Is.
+			return fmt.Errorf("tailscale up failed: %w", ctxErr)
+		}
+		return fmt.Errorf("tailscale up failed: %w", err)
 	}
 	return nil
 }
@@ -180,7 +188,11 @@ func tailscaleSet(ctx context.Context, cfg *settings) error {
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr
 	if err := cmd.Run(); err != nil {
-		return fmt.Errorf("tailscale set failed: %v", err)
+		if ctxErr := ctx.Err(); ctxErr != nil {
+			// See the equivalent check in tailscaleUp.
+			return fmt.Errorf("tailscale set failed: %w", ctxErr)
+		}
+		return fmt.Errorf("tailscale set failed: %w", err)
 	}
 	return nil
 }
diff --git a/cmd/derper/bootstrap_dns_test.go b/cmd/derper/bootstrap_dns_test.go
index 5b765f6d3..2055b9751 100644
--- a/cmd/derper/bootstrap_dns_test.go
+++ b/cmd/derper/bootstrap_dns_test.go
@@ -41,8 +41,28 @@ func (b *bitbucketResponseWriter) Write(p []byte) (int, error) { return len(p),
 
 func (b *bitbucketResponseWriter) WriteHeader(statusCode int) {}
 
+// setDNSCache sets the published DNS cache for tests.
+func setDNSCache(tb testing.TB, m *dnsEntryMap) {
+	tb.Helper()
+	j, err := json.Marshal(m.IPs)
+	if err != nil {
+		tb.Fatal(err)
+	}
+	tstest.AssertNotParallel(tb)
+	dnsCache.Store(m)
+	dnsCacheBytes.Store(j)
+	tb.Cleanup(func() {
+		dnsCache.Store(nil)
+		dnsCacheBytes.Store(nil)
+	})
+}
+
 func getBootstrapDNS(t *testing.T, q string) map[string][]net.IP {
 	t.Helper()
+	tstest.AssertNotParallel(t)
+	if dnsCache.Load() == nil {
+		t.Fatal("dnsCache not initialized; call setDNSCache before getBootstrapDNS")
+	}
 	req, _ := http.NewRequest("GET", "https://localhost/bootstrap-dns?q="+url.QueryEscape(q), nil)
 	w := httptest.NewRecorder()
 	handleBootstrapDNS(w, req)
@@ -100,7 +120,8 @@ func TestUnpublishedDNS(t *testing.T) {
 	}
 }
 
-func resetMetrics() {
+func resetMetrics(tb testing.TB) {
+	tstest.AssertNotParallel(tb)
 	publishedDNSHits.Set(0)
 	publishedDNSMisses.Set(0)
 	unpublishedDNSHits.Set(0)
@@ -114,8 +135,7 @@ func TestUnpublishedDNSEmptyList(t *testing.T) {
 	pub := &dnsEntryMap{
 		IPs: map[string][]net.IP{"tailscale.com": {net.IPv4(10, 10, 10, 10)}},
 	}
-	dnsCache.Store(pub)
-	dnsCacheBytes.Store([]byte(`{"tailscale.com":["10.10.10.10"]}`))
+	setDNSCache(t, pub)
 
 	unpublishedDNSCache.Store(&dnsEntryMap{
 		IPs: map[string][]net.IP{
@@ -131,7 +151,7 @@ func TestUnpublishedDNSEmptyList(t *testing.T) {
 	t.Run("CacheMiss", func(t *testing.T) {
 		// One domain in map but empty, one not in map at all
 		for _, q := range []string{"log.tailscale.com", "login.tailscale.com"} {
-			resetMetrics()
+			resetMetrics(t)
 			ips := getBootstrapDNS(t, q)
 
 			// Expected our public map to be returned on a cache miss
@@ -149,7 +169,7 @@ func TestUnpublishedDNSEmptyList(t *testing.T) {
 
 	// Verify that we do get a valid response and metric.
 	t.Run("CacheHit", func(t *testing.T) {
-		resetMetrics()
+		resetMetrics(t)
 		ips := getBootstrapDNS(t, "controlplane.tailscale.com")
 		want := map[string][]net.IP{"controlplane.tailscale.com": {net.IPv4(1, 2, 3, 4)}}
 		if !reflect.DeepEqual(ips, want) {
@@ -166,8 +186,10 @@ func TestUnpublishedDNSEmptyList(t *testing.T) {
 }
 
 func TestLookupMetric(t *testing.T) {
+	setDNSCache(t, &dnsEntryMap{})
+
 	d := []string{"a.io", "b.io", "c.io", "d.io", "e.io", "e.io", "e.io", "a.io"}
-	resetMetrics()
+	resetMetrics(t)
 	for _, q := range d {
 		_ = getBootstrapDNS(t, q)
 	}
diff --git a/cmd/derper/cert.go b/cmd/derper/cert.go
index 979c0d671..d12a457c2 100644
--- a/cmd/derper/cert.go
+++ b/cmd/derper/cert.go
@@ -23,6 +23,7 @@ import (
 	"os"
 	"path/filepath"
 	"regexp"
+	"slices"
 	"time"
 
 	"golang.org/x/crypto/acme"
@@ -35,21 +36,34 @@ var unsafeHostnameCharacters = regexp.MustCompile(`[^a-zA-Z0-9-\.]`)
 type certProvider interface {
 	// TLSConfig creates a new TLS config suitable for net/http.Server servers.
 	//
-	// The returned Config must have a GetCertificate function set and that
-	// function must return a unique *tls.Certificate for each call. The
-	// returned *tls.Certificate will be mutated by the caller to append to the
-	// (*tls.Certificate).Certificate field.
+	// The returned Config must have a GetCertificate function set. The
+	// *tls.Certificate values it returns may be shared and cached, so
+	// callers must not mutate them.
 	TLSConfig() *tls.Config
 	// HTTPHandler handle ACME related request, if any.
 	HTTPHandler(fallback http.Handler) http.Handler
 }
 
-func certProviderByCertMode(mode, dir, hostname, eabKID, eabKey, email string) (certProvider, error) {
+func certProviderByCertMode(mode, dir, hostname string, ipCerts bool, eabKID, eabKey, email string) (certProvider, error) {
 	if dir == "" {
 		return nil, errors.New("missing required --certdir flag")
 	}
+	if ipCerts && mode != "letsencrypt" {
+		return nil, errors.New("--acme-ip-certs requires --certmode=letsencrypt")
+	}
 	switch mode {
 	case "letsencrypt", "gcp":
+		if net.ParseIP(hostname) != nil {
+			if mode == "gcp" {
+				return nil, errors.New("--certmode=gcp requires --hostname to be a DNS name, not an IP address")
+			}
+			if !ipCerts {
+				return nil, errors.New("--hostname is an IP address; use --certmode=manual for a self-signed cert, or set --acme-ip-certs to get LetsEncrypt IP address certs")
+			}
+			// IP-only server: certs are issued on demand per
+			// connection, so there is no hostname cert provider.
+			return newIPCertManager(dir, email, "", nil)
+		}
 		certManager := &autocert.Manager{
 			Prompt:     autocert.AcceptTOS,
 			HostPolicy: autocert.HostWhitelist(hostname),
@@ -82,6 +96,9 @@ func certProviderByCertMode(mode, dir, hostname, eabKID, eabKey, email string) (
 		} else if hostname == "derp.tailscale.com" {
 			certManager.Email = "security@tailscale.com"
 		}
+		if ipCerts {
+			return newIPCertManager(dir, email, "", certManager)
+		}
 		return certManager, nil
 	case "manual":
 		return NewManualCertManager(dir, hostname)
@@ -157,12 +174,11 @@ func (m *manualCertManager) getCertificate(hi *tls.ClientHelloInfo) (*tls.Certif
 		return nil, fmt.Errorf("cert mismatch with hostname: %q", hi.ServerName)
 	}
 
-	// Return a shallow copy of the cert so the caller can append to its
-	// Certificate field.
-	certCopy := new(tls.Certificate)
-	*certCopy = *m.cert
-	certCopy.Certificate = certCopy.Certificate[:len(certCopy.Certificate):len(certCopy.Certificate)]
-	return certCopy, nil
+	// Return a shallow copy of the cert with a capacity-clamped chain
+	// so callers can never mutate the manager's long-lived certificate.
+	certCopy := *m.cert
+	certCopy.Certificate = slices.Clip(certCopy.Certificate)
+	return &certCopy, nil
 }
 
 func (m *manualCertManager) HTTPHandler(fallback http.Handler) http.Handler {
diff --git a/cmd/derper/cert_test.go b/cmd/derper/cert_test.go
index e111ed76b..1b359385a 100644
--- a/cmd/derper/cert_test.go
+++ b/cmd/derper/cert_test.go
@@ -91,7 +91,7 @@ func TestCertIP(t *testing.T) {
 		t.Fatalf("Error closing key.pem: %v", err)
 	}
 
-	cp, err := certProviderByCertMode("manual", dir, hostname, "", "", "")
+	cp, err := certProviderByCertMode("manual", dir, hostname, false, "", "", "")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -174,25 +174,25 @@ func TestGCPCertMode(t *testing.T) {
 	dir := t.TempDir()
 
 	// Missing EAB credentials
-	_, err := certProviderByCertMode("gcp", dir, "test.example.com", "", "", "test@example.com")
+	_, err := certProviderByCertMode("gcp", dir, "test.example.com", false, "", "", "test@example.com")
 	if err == nil {
 		t.Fatal("expected error when EAB credentials are missing")
 	}
 
 	// Missing email
-	_, err = certProviderByCertMode("gcp", dir, "test.example.com", "kid", "dGVzdC1rZXk", "")
+	_, err = certProviderByCertMode("gcp", dir, "test.example.com", false, "kid", "dGVzdC1rZXk", "")
 	if err == nil {
 		t.Fatal("expected error when email is missing")
 	}
 
 	// Invalid base64
-	_, err = certProviderByCertMode("gcp", dir, "test.example.com", "kid", "not-valid!", "test@example.com")
+	_, err = certProviderByCertMode("gcp", dir, "test.example.com", false, "kid", "not-valid!", "test@example.com")
 	if err == nil {
 		t.Fatal("expected error for invalid base64")
 	}
 
 	// Valid base64url (no padding)
-	cp, err := certProviderByCertMode("gcp", dir, "test.example.com", "kid", "dGVzdC1rZXk", "test@example.com")
+	cp, err := certProviderByCertMode("gcp", dir, "test.example.com", false, "kid", "dGVzdC1rZXk", "test@example.com")
 	if err != nil {
 		t.Fatalf("base64url: %v", err)
 	}
@@ -201,7 +201,7 @@ func TestGCPCertMode(t *testing.T) {
 	}
 
 	// Valid standard base64 (with padding, gcloud format)
-	cp, err = certProviderByCertMode("gcp", dir, "test.example.com", "kid", "dGVzdC1rZXk=", "test@example.com")
+	cp, err = certProviderByCertMode("gcp", dir, "test.example.com", false, "kid", "dGVzdC1rZXk=", "test@example.com")
 	if err != nil {
 		t.Fatalf("base64: %v", err)
 	}
diff --git a/cmd/derper/depaware.txt b/cmd/derper/depaware.txt
index ec59c7264..865dbab42 100644
--- a/cmd/derper/depaware.txt
+++ b/cmd/derper/depaware.txt
@@ -6,10 +6,9 @@ tailscale.com/cmd/derper dependencies: (generated by github.com/tailscale/depawa
         github.com/axiomhq/hyperloglog                               from tailscale.com/derp/derpserver
         github.com/beorn7/perks/quantile                             from github.com/prometheus/client_golang/prometheus
      💣 github.com/cespare/xxhash/v2                                 from github.com/prometheus/client_golang/prometheus
-        github.com/coder/websocket                                   from tailscale.com/cmd/derper+
+        github.com/coder/websocket                                   from tailscale.com/derp/derpserver+
         github.com/coder/websocket/internal/errd                     from github.com/coder/websocket
         github.com/coder/websocket/internal/util                     from github.com/coder/websocket
-        github.com/coder/websocket/internal/xsync                    from github.com/coder/websocket
         github.com/creachadair/msync/throttle                        from github.com/tailscale/setec/client/setec
    W 💣 github.com/dblohm7/wingoes                                   from tailscale.com/util/winutil
         github.com/dgryski/go-metro                                  from github.com/axiomhq/hyperloglog
@@ -20,6 +19,8 @@ tailscale.com/cmd/derper dependencies: (generated by github.com/tailscale/depawa
         github.com/go-json-experiment/json/internal/jsonopts         from github.com/go-json-experiment/json+
         github.com/go-json-experiment/json/internal/jsonwire         from github.com/go-json-experiment/json+
         github.com/go-json-experiment/json/jsontext                  from github.com/go-json-experiment/json+
+        github.com/go-json-experiment/json/v1                        from tailscale.com/net/routecheck+
+     💣 github.com/go4org/hashtriemap                                from tailscale.com/derp/derpserver
         github.com/golang/groupcache/lru                             from tailscale.com/net/dnscache
         github.com/hdevalence/ed25519consensus                       from tailscale.com/tka
    L 💣 github.com/jsimonetti/rtnetlink                              from tailscale.com/net/netmon
@@ -90,6 +91,7 @@ tailscale.com/cmd/derper dependencies: (generated by github.com/tailscale/depawa
         tailscale.com/envknob                                        from tailscale.com/client/local+
         tailscale.com/feature                                        from tailscale.com/tsweb+
         tailscale.com/feature/buildfeatures                          from tailscale.com/feature+
+        tailscale.com/feature/serviceclientprefs/serviceclient       from tailscale.com/client/local
         tailscale.com/health                                         from tailscale.com/net/tlsdial+
         tailscale.com/hostinfo                                       from tailscale.com/net/netmon+
         tailscale.com/ipn                                            from tailscale.com/client/local
@@ -106,19 +108,23 @@ tailscale.com/cmd/derper dependencies: (generated by github.com/tailscale/depawa
      💣 tailscale.com/net/netns                                      from tailscale.com/derp/derphttp
         tailscale.com/net/netutil                                    from tailscale.com/client/local
         tailscale.com/net/netx                                       from tailscale.com/net/dnscache+
+        tailscale.com/net/routecheck                                 from tailscale.com/client/local
+        tailscale.com/net/routecheck/peernode                        from tailscale.com/net/routecheck
         tailscale.com/net/sockstats                                  from tailscale.com/derp/derphttp
         tailscale.com/net/stun                                       from tailscale.com/net/stunserver
         tailscale.com/net/stunserver                                 from tailscale.com/cmd/derper
    L    tailscale.com/net/tcpinfo                                    from tailscale.com/derp/derpserver
         tailscale.com/net/tlsdial                                    from tailscale.com/derp/derphttp
         tailscale.com/net/tlsdial/blockblame                         from tailscale.com/net/tlsdial
+        tailscale.com/net/traffic                                    from tailscale.com/net/routecheck
         tailscale.com/net/tsaddr                                     from tailscale.com/ipn+
         tailscale.com/net/udprelay/status                            from tailscale.com/client/local
-        tailscale.com/net/wsconn                                     from tailscale.com/cmd/derper
+        tailscale.com/net/wsconn                                     from tailscale.com/derp/derpserver
         tailscale.com/paths                                          from tailscale.com/client/local
      💣 tailscale.com/safesocket                                     from tailscale.com/client/local
         tailscale.com/syncs                                          from tailscale.com/cmd/derper+
         tailscale.com/tailcfg                                        from tailscale.com/client/local+
+        tailscale.com/tempfork/acme                                  from tailscale.com/cmd/derper
         tailscale.com/tka                                            from tailscale.com/client/local+
         tailscale.com/tsconst                                        from tailscale.com/net/netmon+
         tailscale.com/tstime                                         from tailscale.com/derp+
@@ -134,7 +140,7 @@ tailscale.com/cmd/derper dependencies: (generated by github.com/tailscale/depawa
         tailscale.com/types/key                                      from tailscale.com/client/local+
         tailscale.com/types/lazy                                     from tailscale.com/version+
         tailscale.com/types/logger                                   from tailscale.com/cmd/derper+
-        tailscale.com/types/netmap                                   from tailscale.com/ipn
+        tailscale.com/types/netmap                                   from tailscale.com/ipn+
         tailscale.com/types/opt                                      from tailscale.com/envknob+
         tailscale.com/types/persist                                  from tailscale.com/ipn+
         tailscale.com/types/preftype                                 from tailscale.com/ipn
@@ -163,7 +169,7 @@ tailscale.com/cmd/derper dependencies: (generated by github.com/tailscale/depawa
         tailscale.com/util/syspolicy/pkey                            from tailscale.com/ipn+
         tailscale.com/util/syspolicy/policyclient                    from tailscale.com/ipn
         tailscale.com/util/syspolicy/ptype                           from tailscale.com/util/syspolicy/policyclient+
-        tailscale.com/util/syspolicy/setting                         from tailscale.com/client/local
+        tailscale.com/util/syspolicy/setting                         from tailscale.com/client/local+
         tailscale.com/util/testenv                                   from tailscale.com/net/bakedroots+
         tailscale.com/util/usermetric                                from tailscale.com/health
         tailscale.com/util/vizerror                                  from tailscale.com/tailcfg+
@@ -243,22 +249,22 @@ tailscale.com/cmd/derper dependencies: (generated by github.com/tailscale/depawa
         crypto/internal/boring/bbig                                  from crypto/ecdsa+
         crypto/internal/boring/sig                                   from crypto/internal/boring
         crypto/internal/constanttime                                 from crypto/internal/fips140/edwards25519+
-        crypto/internal/fips140                                      from crypto/internal/fips140/aes+
+        crypto/internal/fips140                                      from crypto/fips140+
         crypto/internal/fips140/aes                                  from crypto/aes+
         crypto/internal/fips140/aes/gcm                              from crypto/cipher+
         crypto/internal/fips140/alias                                from crypto/cipher+
         crypto/internal/fips140/bigmod                               from crypto/internal/fips140/ecdsa+
-        crypto/internal/fips140/check                                from crypto/internal/fips140/aes+
-        crypto/internal/fips140/drbg                                 from crypto/internal/fips140/aes/gcm+
+        crypto/internal/fips140/check                                from crypto/fips140+
+        crypto/internal/fips140/drbg                                 from crypto/hpke+
         crypto/internal/fips140/ecdh                                 from crypto/ecdh
         crypto/internal/fips140/ecdsa                                from crypto/ecdsa
         crypto/internal/fips140/ed25519                              from crypto/ed25519
         crypto/internal/fips140/edwards25519                         from crypto/internal/fips140/ed25519
         crypto/internal/fips140/edwards25519/field                   from crypto/ecdh+
-        crypto/internal/fips140/hkdf                                 from crypto/internal/fips140/tls13+
+        crypto/internal/fips140/hkdf                                 from crypto/hkdf+
         crypto/internal/fips140/hmac                                 from crypto/hmac+
         crypto/internal/fips140/mlkem                                from crypto/mlkem
-        crypto/internal/fips140/nistec                               from crypto/elliptic+
+        crypto/internal/fips140/nistec                               from crypto/ecdsa+
         crypto/internal/fips140/nistec/fiat                          from crypto/internal/fips140/nistec
         crypto/internal/fips140/rsa                                  from crypto/rsa
         crypto/internal/fips140/sha256                               from crypto/internal/fips140/check+
@@ -309,8 +315,8 @@ tailscale.com/cmd/derper dependencies: (generated by github.com/tailscale/depawa
         go/token                                                     from google.golang.org/protobuf/internal/strs
         hash                                                         from crypto+
         hash/crc32                                                   from compress/gzip+
-        hash/fnv                                                     from google.golang.org/protobuf/internal/detrand
-        hash/maphash                                                 from go4.org/mem
+        hash/fnv                                                     from google.golang.org/protobuf/internal/detrand+
+        hash/maphash                                                 from go4.org/mem+
         html                                                         from net/http/pprof+
         html/template                                                from tailscale.com/cmd/derper+
         internal/abi                                                 from crypto/x509/internal/macos+
@@ -324,13 +330,13 @@ tailscale.com/cmd/derper dependencies: (generated by github.com/tailscale/depawa
         internal/filepathlite                                        from os+
         internal/fmtsort                                             from fmt+
         internal/goarch                                              from crypto/internal/fips140deps/cpu+
-        internal/godebug                                             from crypto/internal/fips140deps/godebug+
+        internal/godebug                                             from crypto/ed25519+
         internal/godebugs                                            from internal/godebug+
         internal/goexperiment                                        from net/http/pprof+
         internal/goos                                                from crypto/x509+
         internal/msan                                                from internal/runtime/maps+
         internal/nettrace                                            from net+
-        internal/oserror                                             from io/fs+
+        internal/oserror                                             from internal/syscall/windows+
         internal/poll                                                from net+
         internal/profile                                             from net/http/pprof
         internal/profilerecord                                       from runtime+
@@ -340,9 +346,9 @@ tailscale.com/cmd/derper dependencies: (generated by github.com/tailscale/depawa
         internal/runtime/atomic                                      from internal/runtime/exithook+
    L    internal/runtime/cgroup                                      from runtime
         internal/runtime/exithook                                    from runtime
-        internal/runtime/gc                                          from runtime+
+        internal/runtime/gc                                          from internal/runtime/gc/scan+
         internal/runtime/gc/scan                                     from runtime
-        internal/runtime/maps                                        from reflect+
+        internal/runtime/maps                                        from hash/maphash+
         internal/runtime/math                                        from internal/runtime/maps+
         internal/runtime/pprof/label                                 from runtime+
         internal/runtime/sys                                         from crypto/subtle+
@@ -356,7 +362,7 @@ tailscale.com/cmd/derper dependencies: (generated by github.com/tailscale/depawa
         internal/synctest                                            from sync
         internal/syscall/execenv                                     from os+
   LD    internal/syscall/unix                                        from crypto/internal/sysrand+
-   W    internal/syscall/windows                                     from crypto/internal/sysrand+
+   W    internal/syscall/windows                                     from crypto/internal/fips140deps/time+
    W    internal/syscall/windows/registry                            from mime+
    W    internal/syscall/windows/sysdll                              from internal/syscall/windows+
         internal/testlog                                             from os
diff --git a/cmd/derper/derper.go b/cmd/derper/derper.go
index 429aff361..bae4d9f01 100644
--- a/cmd/derper/derper.go
+++ b/cmd/derper/derper.go
@@ -62,10 +62,11 @@ var (
 	configPath  = flag.String("c", "", "config file path")
 	certMode    = flag.String("certmode", "letsencrypt", "mode for getting a cert. possible options: manual, letsencrypt, gcp")
 	certDir     = flag.String("certdir", tsweb.DefaultCertDir("derper-certs"), "directory to store ACME (e.g. LetsEncrypt) certs, if addr's port is :443")
-	hostname    = flag.String("hostname", "derp.tailscale.com", "TLS host name for certs, if addr's port is :443. When --certmode=manual, this can be an IP address to avoid SNI checks")
+	hostname    = flag.String("hostname", "derp.tailscale.com", "TLS host name for certs, if addr's port is :443. It can be an IP address when --certmode=manual (to avoid SNI checks) or when --acme-ip-certs is set (to run an IP-only server with no hostname cert)")
 	acmeEABKid  = flag.String("acme-eab-kid", "", "ACME External Account Binding (EAB) Key ID (required for --certmode=gcp)")
 	acmeEABKey  = flag.String("acme-eab-key", "", "ACME External Account Binding (EAB) HMAC key, base64-encoded (required for --certmode=gcp)")
 	acmeEmail   = flag.String("acme-email", "", "ACME account contact email address (required for --certmode=gcp, optional for letsencrypt)")
+	acmeIPCerts = flag.Bool("acme-ip-certs", false, "whether to serve LetsEncrypt certs for the server's IP addresses: when a client connects by IP address (sending no TLS SNI, or an IP address SNI matching the connection's destination IP), get and serve a LetsEncrypt cert for that IP, using the short-lived (~6 day) ACME certificate profile. This works for both IPv4 and IPv6 with no per-address configuration. It requires --certmode=letsencrypt and the ACME server must be able to reach port 80 at each such IP for the HTTP-01 challenge.")
 	runSTUN     = flag.Bool("stun", true, "whether to run a STUN server. It will bind to the same IP (if any) as the --addr flag value.")
 	runDERP     = flag.Bool("derp", true, "whether to run a DERP server. The only reason to set this false is if you're decommissioning a server but want to keep its bootstrap DNS functionality still running.")
 	flagHome    = flag.String("home", "", "what to serve at the root path. It may be left empty (the default, for a default homepage), \"blank\" for a blank page, or a URL to redirect to")
@@ -87,8 +88,7 @@ var (
 	acceptConnLimit = flag.Float64("accept-connection-limit", math.Inf(+1), "rate limit for accepting new connection")
 	acceptConnBurst = flag.Int("accept-connection-burst", math.MaxInt, "burst limit for accepting new connection")
 
-	perClientRateLimit = flag.Uint("per-client-rate-limit", 0, "per-client receive rate limit in bytes/sec; 0 means unlimited. Mesh peers are exempt.")
-	perClientRateBurst = flag.Uint("per-client-rate-burst", 0, "per-client receive rate burst in bytes; 0 defaults to 2x the rate limit (only relevant when using nonzero --per-client-rate-limit)")
+	rateConfigPath = flag.String("rate-config", "", "if non-empty, path to JSON rate limit config file. Rate limiting is experimental and subject to change. Configuration is reloaded on SIGHUP.")
 
 	// tcpKeepAlive is intentionally long, to reduce battery cost. There is an L7 keepalive on a higher frequency schedule.
 	tcpKeepAlive = flag.Duration("tcp-keepalive-time", 10*time.Minute, "TCP keepalive time")
@@ -195,12 +195,11 @@ func main() {
 	s.SetVerifyClientURL(*verifyClientURL)
 	s.SetVerifyClientURLFailOpen(*verifyFailOpen)
 	s.SetTCPWriteTimeout(*tcpWriteTimeout)
-	if *perClientRateLimit > 0 {
-		burst := *perClientRateBurst
-		if burst < 1 {
-			burst = *perClientRateLimit * 2
+	if *rateConfigPath != "" {
+		if err := s.LoadAndApplyRateConfig(*rateConfigPath); err != nil {
+			log.Fatalf("derper: loading rate config: %v", err)
 		}
-		s.SetPerClientRateLimit(*perClientRateLimit, burst)
+		go watchRateConfig(ctx, s, *rateConfigPath)
 	}
 
 	var meshKey string
@@ -254,7 +253,7 @@ func main() {
 	if err := startMesh(s); err != nil {
 		log.Fatalf("startMesh: %v", err)
 	}
-	expvar.Publish("derp", s.ExpVar())
+	expvar.Publish("derp", s.ExpVar(*rateConfigPath != ""))
 
 	handleHome, ok := getHomeHandler(*flagHome)
 	if !ok {
@@ -264,7 +263,7 @@ func main() {
 	mux := http.NewServeMux()
 	if *runDERP {
 		derpHandler := derpserver.Handler(s)
-		derpHandler = addWebSocketSupport(s, derpHandler)
+		derpHandler = derpserver.AddWebSocketSupport(s, derpHandler)
 		mux.Handle("/derp", derpHandler)
 	} else {
 		mux.Handle("/derp", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -351,20 +350,12 @@ func main() {
 	if serveTLS {
 		log.Printf("derper: serving on %s with TLS", *addr)
 		var certManager certProvider
-		certManager, err = certProviderByCertMode(*certMode, *certDir, *hostname, *acmeEABKid, *acmeEABKey, *acmeEmail)
+		certManager, err = certProviderByCertMode(*certMode, *certDir, *hostname, *acmeIPCerts, *acmeEABKid, *acmeEABKey, *acmeEmail)
 		if err != nil {
 			log.Fatalf("derper: can not start cert provider: %v", err)
 		}
 		httpsrv.TLSConfig = certManager.TLSConfig()
-		getCert := httpsrv.TLSConfig.GetCertificate
-		httpsrv.TLSConfig.GetCertificate = func(hi *tls.ClientHelloInfo) (*tls.Certificate, error) {
-			cert, err := getCert(hi)
-			if err != nil {
-				return nil, err
-			}
-			cert.Certificate = append(cert.Certificate, s.MetaCert())
-			return cert, nil
-		}
+		s.ModifyTLSConfigToAddMetaCert(httpsrv.TLSConfig)
 		// Disable TLS 1.0 and 1.1, which are obsolete and have security issues.
 		httpsrv.TLSConfig.MinVersion = tls.VersionTLS12
 		httpsrv.Handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -436,6 +427,27 @@ func main() {
 	}
 }
 
+// watchRateConfig listens for SIGHUP signals and reloads the rate config
+// file on each signal, applying it to the server. It returns when ctx is done.
+func watchRateConfig(ctx context.Context, s *derpserver.Server, path string) {
+	sighup := make(chan os.Signal, 1)
+	signal.Notify(sighup, syscall.SIGHUP)
+	defer signal.Stop(sighup)
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-sighup:
+			log.Printf("derper: received SIGHUP, reloading rate config from %s", path)
+			if err := s.LoadAndApplyRateConfig(path); err != nil {
+				log.Printf("derper: rate config reload failed: %v", err)
+				continue
+			}
+			log.Printf("derper: rate config reloaded successfully")
+		}
+	}
+}
+
 var validProdHostname = regexp.MustCompile(`^derp([^.]*)\.tailscale\.com\.?$`)
 
 func prodAutocertHostPolicy(_ context.Context, host string) error {
diff --git a/cmd/derper/ipcert.go b/cmd/derper/ipcert.go
new file mode 100644
index 000000000..b3b4192de
--- /dev/null
+++ b/cmd/derper/ipcert.go
@@ -0,0 +1,497 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package main
+
+import (
+	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/json"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"io"
+	"log"
+	"net"
+	"net/http"
+	"net/netip"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+	"sync"
+	"time"
+
+	"tailscale.com/atomicfile"
+	"tailscale.com/tailcfg"
+	"tailscale.com/tempfork/acme"
+)
+
+// shortlivedProfile is the ACME certificate profile required by
+// LetsEncrypt for IP address certificates. Certificates issued under
+// it are valid for about six days.
+// See https://letsencrypt.org/docs/profiles/.
+const shortlivedProfile = "shortlived"
+
+// ipCertManager is a certProvider that obtains and renews LetsEncrypt
+// TLS certificates for the server's IP addresses on demand, using the
+// short-lived ACME certificate profile and the HTTP-01 challenge
+// served on the derper's plaintext HTTP port.
+//
+// Clients connecting to an IP address usually send no SNI, so the
+// requested IP address is taken from the TCP connection's local
+// address. That works for however many IPv4 and IPv6 addresses the
+// server has, with no configuration. Clients that do send an IP
+// address in the SNI get a certificate only if it matches the
+// connection's local address, so a client can never make us request a
+// certificate for an address that isn't ours.
+//
+// Connections with a DNS name in the SNI are passed through to the
+// optional next provider (the regular autocert manager for the
+// --hostname certificate), if any.
+type ipCertManager struct {
+	certDir string
+	email   string // optional ACME account contact
+	client  *acme.Client
+	next    certProvider // provider for DNS hostname connections, or nil
+	nextTLS *tls.Config  // next.TLSConfig(), or nil
+
+	mu     sync.Mutex
+	certs  map[netip.Addr]*ipCertEntry
+	tokens map[string]string // HTTP-01 challenge URL path => response body
+}
+
+// ipCertEntry is the issuance state for one IP address.
+// All fields are guarded by ipCertManager.mu.
+type ipCertEntry struct {
+	cert *tls.Certificate // current cert with Leaf set, or nil if not yet issued
+
+	flight      chan struct{} // non-nil while an issuance is running; closed when it finishes
+	flightErr   error         // result of the last finished issuance
+	nextAttempt time.Time     // earliest time of the next issuance attempt, after a failure
+	retryDelay  time.Duration // backoff to apply after the next failure
+}
+
+// newIPCertManager returns an ipCertManager storing its ACME account
+// key and issued certificates in certdir.
+//
+// If directoryURL is empty, the LetsEncrypt production directory is
+// used; tests point it at a fake ACME server. If next is non-nil,
+// connections with a DNS name in the SNI are served by it.
+func newIPCertManager(certdir, email, directoryURL string, next certProvider) (*ipCertManager, error) {
+	if err := os.MkdirAll(certdir, 0700); err != nil {
+		return nil, err
+	}
+	accountKey, err := loadOrCreateAccountKey(filepath.Join(certdir, "acme-account.key"))
+	if err != nil {
+		return nil, fmt.Errorf("ACME account key: %w", err)
+	}
+	m := &ipCertManager{
+		certDir: certdir,
+		email:   email,
+		client: &acme.Client{
+			Key:          accountKey,
+			DirectoryURL: directoryURL,
+			UserAgent:    "tailscale-derper",
+		},
+		next:   next,
+		certs:  make(map[netip.Addr]*ipCertEntry),
+		tokens: make(map[string]string),
+	}
+	if next != nil {
+		m.nextTLS = next.TLSConfig()
+	}
+	go m.renewLoop()
+	return m, nil
+}
+
+func loadOrCreateAccountKey(path string) (*ecdsa.PrivateKey, error) {
+	if pemBytes, err := os.ReadFile(path); err == nil {
+		block, _ := pem.Decode(pemBytes)
+		if block == nil {
+			return nil, fmt.Errorf("invalid PEM in %s", path)
+		}
+		return x509.ParseECPrivateKey(block.Bytes)
+	} else if !os.IsNotExist(err) {
+		return nil, err
+	}
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		return nil, err
+	}
+	der, err := x509.MarshalECPrivateKey(key)
+	if err != nil {
+		return nil, err
+	}
+	pemBytes := pem.EncodeToMemory(&pem.Block{Type: "EC PRIVATE KEY", Bytes: der})
+	if err := atomicfile.WriteFile(path, pemBytes, 0600); err != nil {
+		return nil, err
+	}
+	return key, nil
+}
+
+// certPaths returns the cert and key file paths for ip in m.certDir.
+// Colons in IPv6 addresses are replaced with dots to keep the names
+// filesystem-safe.
+func (m *ipCertManager) certPaths(ip netip.Addr) (crtPath, keyPath string) {
+	base := strings.ReplaceAll(ip.String(), ":", ".")
+	return filepath.Join(m.certDir, base+".crt"), filepath.Join(m.certDir, base+".key")
+}
+
+func (m *ipCertManager) TLSConfig() *tls.Config {
+	var conf *tls.Config
+	if m.nextTLS != nil {
+		conf = m.nextTLS.Clone()
+	} else {
+		conf = &tls.Config{
+			NextProtos: []string{
+				"http/1.1",
+			},
+		}
+	}
+	conf.GetCertificate = m.getCertificate
+	return conf
+}
+
+// connLocalIP returns the local (server side) IP address of the
+// connection that sent the ClientHello.
+func connLocalIP(hi *tls.ClientHelloInfo) (netip.Addr, bool) {
+	if hi.Conn == nil {
+		return netip.Addr{}, false
+	}
+	ta, ok := hi.Conn.LocalAddr().(*net.TCPAddr)
+	if !ok {
+		return netip.Addr{}, false
+	}
+	ip := ta.AddrPort().Addr().Unmap()
+	return ip, ip.IsValid()
+}
+
+func (m *ipCertManager) getCertificate(hi *tls.ClientHelloInfo) (*tls.Certificate, error) {
+	connIP, connIPOK := connLocalIP(hi)
+	if hi.ServerName != "" {
+		sniIP, err := netip.ParseAddr(hi.ServerName)
+		if err != nil {
+			// The SNI is a DNS name; let the hostname provider handle it.
+			if m.nextTLS != nil && m.nextTLS.GetCertificate != nil {
+				return m.nextTLS.GetCertificate(hi)
+			}
+			return nil, fmt.Errorf("no certificate for hostname %q; this server only serves IP address certificates", hi.ServerName)
+		}
+		if !connIPOK || sniIP.Unmap() != connIP {
+			return nil, fmt.Errorf("requested certificate for IP %v does not match the connection's IP address", sniIP)
+		}
+	}
+	if !connIPOK {
+		return nil, errors.New("unable to determine the connection's local IP address")
+	}
+	ctx := hi.Context()
+	if ctx == nil {
+		ctx = context.Background()
+	}
+	return m.certForIP(ctx, connIP)
+}
+
+// certForIP returns the current certificate for ip, obtaining one
+// first if there is no unexpired certificate for it. Concurrent
+// callers for the same IP share a single issuance.
+func (m *ipCertManager) certForIP(ctx context.Context, ip netip.Addr) (*tls.Certificate, error) {
+	m.mu.Lock()
+	e := m.entryLocked(ip)
+	if e.cert != nil && time.Now().Before(e.cert.Leaf.NotAfter) {
+		defer m.mu.Unlock()
+		return clipCert(e.cert), nil
+	}
+	if e.flight == nil && time.Now().Before(e.nextAttempt) {
+		m.mu.Unlock()
+		return nil, fmt.Errorf("cert issuance for %v failed recently; next attempt no earlier than %v", ip, e.nextAttempt.Format(time.RFC3339))
+	}
+	flight := m.startFlightLocked(ip, e)
+	m.mu.Unlock()
+
+	select {
+	case <-flight:
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	}
+
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if e.cert == nil {
+		return nil, e.flightErr
+	}
+	return clipCert(e.cert), nil
+}
+
+func (m *ipCertManager) entryLocked(ip netip.Addr) *ipCertEntry {
+	e, ok := m.certs[ip]
+	if !ok {
+		e = &ipCertEntry{}
+		m.certs[ip] = e
+	}
+	return e
+}
+
+// clipCert returns a shallow copy of cert with a capacity-clamped
+// chain so callers can never mutate the manager's long-lived
+// certificate.
+func clipCert(cert *tls.Certificate) *tls.Certificate {
+	certCopy := *cert
+	certCopy.Certificate = slices.Clip(certCopy.Certificate)
+	return &certCopy
+}
+
+// startFlightLocked starts an issuance for ip if none is running and
+// returns a channel that is closed when it finishes.
+func (m *ipCertManager) startFlightLocked(ip netip.Addr, e *ipCertEntry) chan struct{} {
+	if e.flight != nil {
+		return e.flight
+	}
+	done := make(chan struct{})
+	e.flight = done
+	go func() {
+		err := m.issue(ip)
+		m.mu.Lock()
+		defer m.mu.Unlock()
+		e.flight = nil
+		e.flightErr = err
+		if err != nil {
+			if e.retryDelay == 0 {
+				e.retryDelay = time.Minute
+			}
+			e.nextAttempt = time.Now().Add(e.retryDelay)
+			e.retryDelay = min(e.retryDelay*2, 30*time.Minute)
+			log.Printf("derper: acme: getting cert for %v: %v (next attempt in %v)", ip, err, time.Until(e.nextAttempt).Round(time.Second))
+		} else {
+			e.retryDelay = 0
+			e.nextAttempt = time.Time{}
+		}
+		close(done)
+	}()
+	return done
+}
+
+// issue obtains a certificate for ip, preferring a still-fresh one
+// cached on disk over a new ACME order.
+func (m *ipCertManager) issue(ip netip.Addr) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Minute)
+	defer cancel()
+	if cert, err := m.loadCachedCert(ip); err == nil && !certNeedsRenewal(cert.Leaf) {
+		m.mu.Lock()
+		m.entryLocked(ip).cert = cert
+		m.mu.Unlock()
+		log.Printf("derper: acme: loaded cached cert for %v (expires %v)", ip, cert.Leaf.NotAfter)
+		return nil
+	}
+	return m.obtainCert(ctx, ip)
+}
+
+// loadCachedCert loads a previously issued certificate for ip from
+// disk, if present and still valid.
+func (m *ipCertManager) loadCachedCert(ip netip.Addr) (*tls.Certificate, error) {
+	crtPath, keyPath := m.certPaths(ip)
+	cert, err := tls.LoadX509KeyPair(crtPath, keyPath)
+	if err != nil {
+		return nil, err
+	}
+	leaf, err := x509.ParseCertificate(cert.Certificate[0])
+	if err != nil {
+		return nil, err
+	}
+	now := time.Now()
+	if now.Before(leaf.NotBefore) || now.After(leaf.NotAfter) {
+		return nil, fmt.Errorf("cached cert is expired or not yet valid (NotAfter %v)", leaf.NotAfter)
+	}
+	if err := leaf.VerifyHostname(ip.String()); err != nil {
+		return nil, err
+	}
+	cert.Leaf = leaf
+	return &cert, nil
+}
+
+// HTTPHandler returns a handler serving HTTP-01 challenge responses on
+// the derper's plaintext HTTP port, sending all other requests to the
+// next provider's handler, if any, and otherwise to fallback.
+func (m *ipCertManager) HTTPHandler(fallback http.Handler) http.Handler {
+	if m.next != nil {
+		fallback = m.next.HTTPHandler(fallback)
+	}
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if !strings.HasPrefix(r.URL.Path, "/.well-known/acme-challenge/") {
+			fallback.ServeHTTP(w, r)
+			return
+		}
+		m.mu.Lock()
+		response, ok := m.tokens[r.URL.Path]
+		m.mu.Unlock()
+		if !ok {
+			http.NotFound(w, r)
+			return
+		}
+		w.Header().Set("Content-Type", "text/plain")
+		io.WriteString(w, response)
+	})
+}
+
+func (m *ipCertManager) setToken(path, response string) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.tokens[path] = response
+}
+
+func (m *ipCertManager) deleteToken(path string) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	delete(m.tokens, path)
+}
+
+// certNeedsRenewal reports whether leaf has less than a third of its
+// lifetime remaining. LetsEncrypt short-lived certs are valid for
+// about six days, so renewal happens roughly every four.
+func certNeedsRenewal(leaf *x509.Certificate) bool {
+	total := leaf.NotAfter.Sub(leaf.NotBefore)
+	return time.Until(leaf.NotAfter) < total/3
+}
+
+// renewLoop runs for the lifetime of the process, renewing each issued
+// certificate as it approaches expiry.
+func (m *ipCertManager) renewLoop() {
+	for {
+		time.Sleep(time.Hour)
+		m.mu.Lock()
+		now := time.Now()
+		for ip, e := range m.certs {
+			if e.cert != nil && certNeedsRenewal(e.cert.Leaf) && e.flight == nil && now.After(e.nextAttempt) {
+				m.startFlightLocked(ip, e)
+			}
+		}
+		m.mu.Unlock()
+	}
+}
+
+// obtainCert does one ACME issuance flow for ip: it registers the
+// account if needed, orders a short-lived profile certificate for the
+// IP address identifier, fulfills the HTTP-01 challenges, and installs
+// and caches the issued certificate.
+func (m *ipCertManager) obtainCert(ctx context.Context, ip netip.Addr) error {
+	ipStr := ip.String()
+
+	var contact []string
+	if m.email != "" {
+		contact = []string{"mailto:" + m.email}
+	}
+	_, err := m.client.Register(ctx, &acme.Account{Contact: contact}, acme.AcceptTOS)
+	if err != nil && !errors.Is(err, acme.ErrAccountAlreadyExists) {
+		return fmt.Errorf("register: %w", err)
+	}
+
+	order, err := m.client.AuthorizeOrder(ctx, acme.IPIDs(ipStr), acme.WithOrderProfile(shortlivedProfile))
+	if err != nil {
+		return fmt.Errorf("new order: %w", err)
+	}
+	for _, authzURL := range order.AuthzURLs {
+		if err := m.fulfillAuthz(ctx, authzURL); err != nil {
+			return err
+		}
+	}
+	order, err = m.client.WaitOrder(ctx, order.URI)
+	if err != nil {
+		return fmt.Errorf("waiting for order: %w", err)
+	}
+
+	certKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		return err
+	}
+	csr, err := x509.CreateCertificateRequest(rand.Reader, &x509.CertificateRequest{
+		IPAddresses: []net.IP{ip.AsSlice()},
+	}, certKey)
+	if err != nil {
+		return err
+	}
+	der, _, err := m.client.CreateOrderCert(ctx, order.FinalizeURL, csr, true)
+	if err != nil {
+		return fmt.Errorf("finalizing order: %w", err)
+	}
+	leaf, err := x509.ParseCertificate(der[0])
+	if err != nil {
+		return fmt.Errorf("parsing issued cert: %w", err)
+	}
+	if err := leaf.VerifyHostname(ipStr); err != nil {
+		return fmt.Errorf("issued cert: %w", err)
+	}
+
+	keyDER, err := x509.MarshalECPrivateKey(certKey)
+	if err != nil {
+		return err
+	}
+	keyPEM := pem.EncodeToMemory(&pem.Block{Type: "EC PRIVATE KEY", Bytes: keyDER})
+	var chainPEM []byte
+	for _, b := range der {
+		chainPEM = append(chainPEM, pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: b})...)
+	}
+	crtPath, keyPath := m.certPaths(ip)
+	if err := atomicfile.WriteFile(keyPath, keyPEM, 0600); err != nil {
+		return err
+	}
+	if err := atomicfile.WriteFile(crtPath, chainPEM, 0644); err != nil {
+		return err
+	}
+
+	m.mu.Lock()
+	m.entryLocked(ip).cert = &tls.Certificate{
+		Certificate: der,
+		PrivateKey:  certKey,
+		Leaf:        leaf,
+	}
+	m.mu.Unlock()
+
+	dn := &tailcfg.DERPNode{
+		Name:     "custom",
+		RegionID: 900,
+		HostName: ipStr,
+	}
+	dnJSON, _ := json.Marshal(dn)
+	log.Printf("derper: acme: got cert for %v (expires %v). Configure it in DERPMap using (https://tailscale.com/s/custom-derp):\n  %s", ip, leaf.NotAfter, dnJSON)
+	return nil
+}
+
+// fulfillAuthz completes the HTTP-01 challenge for one authorization,
+// if it is still pending.
+func (m *ipCertManager) fulfillAuthz(ctx context.Context, authzURL string) error {
+	authz, err := m.client.GetAuthorization(ctx, authzURL)
+	if err != nil {
+		return fmt.Errorf("getting authorization: %w", err)
+	}
+	if authz.Status != acme.StatusPending {
+		return nil
+	}
+	var challenge *acme.Challenge
+	for _, c := range authz.Challenges {
+		if c.Type == "http-01" {
+			challenge = c
+			break
+		}
+	}
+	if challenge == nil {
+		return errors.New("authorization offers no http-01 challenge")
+	}
+	response, err := m.client.HTTP01ChallengeResponse(challenge.Token)
+	if err != nil {
+		return err
+	}
+	path := m.client.HTTP01ChallengePath(challenge.Token)
+	m.setToken(path, response)
+	defer m.deleteToken(path)
+	if _, err := m.client.Accept(ctx, challenge); err != nil {
+		return fmt.Errorf("accepting challenge: %w", err)
+	}
+	if _, err := m.client.WaitAuthorization(ctx, authz.URI); err != nil {
+		return fmt.Errorf("waiting for authorization: %w", err)
+	}
+	return nil
+}
diff --git a/cmd/derper/ipcert_test.go b/cmd/derper/ipcert_test.go
new file mode 100644
index 000000000..b3deb3fdd
--- /dev/null
+++ b/cmd/derper/ipcert_test.go
@@ -0,0 +1,486 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package main
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/base64"
+	"encoding/json"
+	"encoding/pem"
+	"fmt"
+	"io"
+	"math/big"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+)
+
+// fakeIPACME is a minimal fake ACME (RFC 8555) certificate authority
+// for testing ipCertManager. It implements just enough of the protocol
+// for http-01 order flows with IP address identifiers and the
+// "shortlived" profile: one order at a time, no JWS signature
+// verification, no nonce tracking.
+type fakeIPACME struct {
+	t             *testing.T
+	srv           *httptest.Server
+	challengeBase string // base URL at which http-01 challenges are fetched
+
+	caKey  *ecdsa.PrivateKey
+	caCert *x509.Certificate
+
+	mu          sync.Mutex
+	orders      int    // number of orders created
+	gotProfile  string // profile of the last order
+	gotIDType   string // identifier type of the last order
+	gotIDValue  string // identifier value of the last order
+	authzStatus string // "pending" or "valid"
+	orderStatus string // "pending", "ready", or "valid"
+	token       string
+	certPEM     []byte
+}
+
+func newFakeIPACME(t *testing.T) *fakeIPACME {
+	caKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	caTmpl := &x509.Certificate{
+		SerialNumber:          big.NewInt(1),
+		Subject:               pkix.Name{CommonName: "fake IP ACME root"},
+		NotBefore:             time.Now().Add(-time.Hour),
+		NotAfter:              time.Now().Add(24 * time.Hour),
+		IsCA:                  true,
+		KeyUsage:              x509.KeyUsageCertSign,
+		BasicConstraintsValid: true,
+	}
+	caDER, err := x509.CreateCertificate(rand.Reader, caTmpl, caTmpl, &caKey.PublicKey, caKey)
+	if err != nil {
+		t.Fatal(err)
+	}
+	caCert, err := x509.ParseCertificate(caDER)
+	if err != nil {
+		t.Fatal(err)
+	}
+	f := &fakeIPACME{
+		t:      t,
+		caKey:  caKey,
+		caCert: caCert,
+	}
+	f.srv = httptest.NewServer(http.HandlerFunc(f.serveHTTP))
+	t.Cleanup(f.srv.Close)
+	return f
+}
+
+func (f *fakeIPACME) directoryURL() string { return f.srv.URL + "/directory" }
+
+func (f *fakeIPACME) numOrders() int {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return f.orders
+}
+
+func (f *fakeIPACME) serveHTTP(w http.ResponseWriter, r *http.Request) {
+	w.Header().Set("Replay-Nonce", "test-nonce")
+	writeJSON := func(v any) {
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(v)
+	}
+	orderJSON := func() any {
+		return map[string]any{
+			"status":         f.orderStatus,
+			"identifiers":    []map[string]string{{"type": f.gotIDType, "value": f.gotIDValue}},
+			"authorizations": []string{f.srv.URL + "/authz/1"},
+			"finalize":       f.srv.URL + "/finalize/1",
+			"certificate":    f.srv.URL + "/cert/1",
+		}
+	}
+	switch {
+	case r.URL.Path == "/directory":
+		writeJSON(map[string]any{
+			"newNonce":   f.srv.URL + "/new-nonce",
+			"newAccount": f.srv.URL + "/new-account",
+			"newOrder":   f.srv.URL + "/new-order",
+			"revokeCert": f.srv.URL + "/revoke-cert",
+			"keyChange":  f.srv.URL + "/key-change",
+			"meta": map[string]any{
+				"profiles": map[string]string{
+					"classic":         "the default profile",
+					shortlivedProfile: "six day certificates",
+				},
+			},
+		})
+	case r.URL.Path == "/new-nonce":
+		// The Replay-Nonce header was already set above.
+	case r.URL.Path == "/new-account":
+		w.Header().Set("Location", f.srv.URL+"/account/1")
+		w.WriteHeader(http.StatusCreated)
+		writeJSON(map[string]any{"status": "valid"})
+	case r.URL.Path == "/new-order":
+		var req struct {
+			Identifiers []struct{ Type, Value string } `json:"identifiers"`
+			Profile     string                         `json:"profile"`
+		}
+		if err := decodeJWSPayload(r, &req); err != nil {
+			f.t.Errorf("new-order payload: %v", err)
+		}
+		f.mu.Lock()
+		f.orders++
+		f.gotProfile = req.Profile
+		if len(req.Identifiers) == 1 {
+			f.gotIDType = req.Identifiers[0].Type
+			f.gotIDValue = req.Identifiers[0].Value
+		}
+		f.authzStatus = "pending"
+		f.orderStatus = "pending"
+		f.token = fmt.Sprintf("tok-%d", f.orders)
+		f.mu.Unlock()
+		w.Header().Set("Location", f.srv.URL+"/order/1")
+		w.WriteHeader(http.StatusCreated)
+		writeJSON(orderJSON())
+	case r.URL.Path == "/authz/1":
+		f.mu.Lock()
+		defer f.mu.Unlock()
+		writeJSON(map[string]any{
+			"status":     f.authzStatus,
+			"identifier": map[string]string{"type": f.gotIDType, "value": f.gotIDValue},
+			"challenges": []map[string]string{{
+				"type":   "http-01",
+				"url":    f.srv.URL + "/chal/1",
+				"token":  f.token,
+				"status": f.authzStatus,
+			}},
+		})
+	case r.URL.Path == "/chal/1":
+		if err := f.validateChallenge(); err != nil {
+			f.t.Errorf("challenge validation: %v", err)
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+		f.mu.Lock()
+		f.authzStatus = "valid"
+		f.orderStatus = "ready"
+		f.mu.Unlock()
+		writeJSON(map[string]any{"type": "http-01", "status": "valid", "token": f.token})
+	case r.URL.Path == "/order/1":
+		f.mu.Lock()
+		defer f.mu.Unlock()
+		w.Header().Set("Location", f.srv.URL+"/order/1")
+		writeJSON(orderJSON())
+	case r.URL.Path == "/finalize/1":
+		var req struct {
+			CSR string `json:"csr"`
+		}
+		if err := decodeJWSPayload(r, &req); err != nil {
+			f.t.Errorf("finalize payload: %v", err)
+		}
+		if err := f.issueCert(req.CSR); err != nil {
+			f.t.Errorf("issuing cert: %v", err)
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+		f.mu.Lock()
+		f.orderStatus = "valid"
+		f.mu.Unlock()
+		w.Header().Set("Location", f.srv.URL+"/order/1")
+		writeJSON(orderJSON())
+	case r.URL.Path == "/cert/1":
+		f.mu.Lock()
+		defer f.mu.Unlock()
+		w.Header().Set("Content-Type", "application/pem-certificate-chain")
+		w.Write(f.certPEM)
+	default:
+		f.t.Errorf("unexpected request: %s %s", r.Method, r.URL.Path)
+		http.NotFound(w, r)
+	}
+}
+
+// validateChallenge fetches the http-01 challenge response from the
+// server under test, standing in for the CA dialing port 80 at the IP
+// address being validated.
+func (f *fakeIPACME) validateChallenge() error {
+	f.mu.Lock()
+	token := f.token
+	base := f.challengeBase
+	f.mu.Unlock()
+	res, err := http.Get(base + "/.well-known/acme-challenge/" + token)
+	if err != nil {
+		return err
+	}
+	defer res.Body.Close()
+	if res.StatusCode != http.StatusOK {
+		return fmt.Errorf("status %d", res.StatusCode)
+	}
+	body, err := io.ReadAll(res.Body)
+	if err != nil {
+		return err
+	}
+	if !strings.HasPrefix(string(body), token+".") {
+		return fmt.Errorf("challenge response %q does not start with %q", body, token+".")
+	}
+	return nil
+}
+
+// issueCert signs a certificate for the CSR (base64url DER), valid for
+// six days like a LetsEncrypt shortlived profile certificate.
+func (f *fakeIPACME) issueCert(csrB64 string) error {
+	csrDER, err := base64.RawURLEncoding.DecodeString(csrB64)
+	if err != nil {
+		return err
+	}
+	csr, err := x509.ParseCertificateRequest(csrDER)
+	if err != nil {
+		return err
+	}
+	if len(csr.IPAddresses) != 1 {
+		return fmt.Errorf("CSR has %d IP addresses; want 1", len(csr.IPAddresses))
+	}
+	tmpl := &x509.Certificate{
+		SerialNumber: big.NewInt(2),
+		IPAddresses:  csr.IPAddresses,
+		NotBefore:    time.Now().Add(-time.Minute),
+		NotAfter:     time.Now().Add(6 * 24 * time.Hour),
+		KeyUsage:     x509.KeyUsageDigitalSignature,
+		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+	}
+	der, err := x509.CreateCertificate(rand.Reader, tmpl, f.caCert, csr.PublicKey, f.caKey)
+	if err != nil {
+		return err
+	}
+	var buf []byte
+	buf = append(buf, pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der})...)
+	buf = append(buf, pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: f.caCert.Raw})...)
+	f.mu.Lock()
+	f.certPEM = buf
+	f.mu.Unlock()
+	return nil
+}
+
+// decodeJWSPayload decodes the payload of a JWS-encoded ACME request
+// without verifying its signature.
+func decodeJWSPayload(r *http.Request, v any) error {
+	var req struct{ Payload string }
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		return err
+	}
+	b, err := base64.RawURLEncoding.DecodeString(req.Payload)
+	if err != nil {
+		return err
+	}
+	return json.Unmarshal(b, v)
+}
+
+// ipConn is a stub net.Conn whose LocalAddr is the given IP, standing
+// in for the accepted TLS connection whose destination address decides
+// which certificate to serve.
+type ipConn struct {
+	net.Conn
+	local net.Addr
+}
+
+func (c ipConn) LocalAddr() net.Addr { return c.local }
+
+// helloFor returns a ClientHelloInfo as ipCertManager.getCertificate
+// would see it for a connection to localIP with the given SNI value.
+func helloFor(t *testing.T, localIP, sni string) *tls.ClientHelloInfo {
+	t.Helper()
+	ip := net.ParseIP(localIP)
+	if ip == nil {
+		t.Fatalf("bad IP %q", localIP)
+	}
+	return &tls.ClientHelloInfo{
+		ServerName: sni,
+		Conn:       ipConn{local: &net.TCPAddr{IP: ip, Port: 443}},
+	}
+}
+
+// stubCertProvider is a certProvider returning a fixed certificate,
+// standing in for the autocert manager handling DNS hostname
+// connections.
+type stubCertProvider struct {
+	cert *tls.Certificate
+}
+
+func (p *stubCertProvider) TLSConfig() *tls.Config {
+	return &tls.Config{
+		GetCertificate: func(hi *tls.ClientHelloInfo) (*tls.Certificate, error) {
+			return p.cert, nil
+		},
+	}
+}
+
+func (p *stubCertProvider) HTTPHandler(fallback http.Handler) http.Handler { return fallback }
+
+// TestIPCertManager exercises the on-demand issuance flow of
+// ipCertManager against a fake ACME CA: certs are ordered for whatever
+// IP address a connection arrives on (IPv4 and IPv6), with the
+// shortlived profile, answering the http-01 challenge, and reusing the
+// on-disk cache.
+func TestIPCertManager(t *testing.T) {
+	const ip4 = "203.0.113.7"
+	const ip6 = "2001:db8::7"
+	dir := t.TempDir()
+	ca := newFakeIPACME(t)
+
+	m, err := newIPCertManager(dir, "test@example.com", ca.directoryURL(), nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Serve the manager's HTTP-01 challenge handler like derper's port
+	// 80 listener does.
+	challengeSrv := httptest.NewServer(m.HTTPHandler(http.NotFoundHandler()))
+	defer challengeSrv.Close()
+	ca.challengeBase = challengeSrv.URL
+
+	// A connection to the IPv4 address with no SNI mints a cert for it.
+	cert, err := m.getCertificate(helloFor(t, ip4, ""))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := cert.Leaf.VerifyHostname(ip4); err != nil {
+		t.Errorf("issued cert not valid for %v: %v", ip4, err)
+	}
+	if got, want := ca.gotProfile, shortlivedProfile; got != want {
+		t.Errorf("order profile = %q; want %q", got, want)
+	}
+	if ca.gotIDType != "ip" || ca.gotIDValue != ip4 {
+		t.Errorf("order identifier = %q %q; want %q %q", ca.gotIDType, ca.gotIDValue, "ip", ip4)
+	}
+	if n := ca.numOrders(); n != 1 {
+		t.Errorf("orders created = %d; want 1", n)
+	}
+
+	// A connection to the IPv6 address mints a second, separate cert.
+	cert6, err := m.getCertificate(helloFor(t, ip6, ""))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := cert6.Leaf.VerifyHostname(ip6); err != nil {
+		t.Errorf("issued cert not valid for %v: %v", ip6, err)
+	}
+	if ca.gotIDType != "ip" || ca.gotIDValue != ip6 {
+		t.Errorf("order identifier = %q %q; want %q %q", ca.gotIDType, ca.gotIDValue, "ip", ip6)
+	}
+	if n := ca.numOrders(); n != 2 {
+		t.Errorf("orders created = %d; want 2", n)
+	}
+
+	// An SNI containing the connection's own IP address is served from
+	// the cache.
+	if _, err := m.getCertificate(helloFor(t, ip4, ip4)); err != nil {
+		t.Errorf("getCertificate with matching IP SNI: %v", err)
+	}
+	if n := ca.numOrders(); n != 2 {
+		t.Errorf("orders created after cached hit = %d; want 2", n)
+	}
+
+	// An SNI naming some other IP address is rejected.
+	if _, err := m.getCertificate(helloFor(t, ip4, "203.0.113.8")); err == nil {
+		t.Error("getCertificate with mismatched IP SNI succeeded; want error")
+	}
+
+	// A DNS name SNI has no provider to go to here.
+	if _, err := m.getCertificate(helloFor(t, ip4, "derp.example.com")); err == nil {
+		t.Error("getCertificate with DNS SNI and no next provider succeeded; want error")
+	}
+
+	// A second manager over the same cert directory must use the
+	// on-disk cache rather than creating more orders.
+	m2, err := newIPCertManager(dir, "test@example.com", ca.directoryURL(), nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	cachedCert, err := m2.getCertificate(helloFor(t, ip4, ""))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := cachedCert.Leaf.VerifyHostname(ip4); err != nil {
+		t.Errorf("cached cert not valid for %v: %v", ip4, err)
+	}
+	if n := ca.numOrders(); n != 2 {
+		t.Errorf("orders created after cache reuse = %d; want 2", n)
+	}
+
+	// Non-challenge requests go to the fallback handler.
+	rec := httptest.NewRecorder()
+	m.HTTPHandler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		io.WriteString(w, "fallback")
+	})).ServeHTTP(rec, httptest.NewRequest("GET", "/other", nil))
+	if got := rec.Body.String(); got != "fallback" {
+		t.Errorf("fallback body = %q; want %q", got, "fallback")
+	}
+}
+
+// TestIPCertManagerNextProvider verifies that connections with a DNS
+// name in the SNI are passed through to the next provider.
+func TestIPCertManagerNextProvider(t *testing.T) {
+	dir := t.TempDir()
+	ca := newFakeIPACME(t)
+	stubCert := &tls.Certificate{}
+	m, err := newIPCertManager(dir, "", ca.directoryURL(), &stubCertProvider{cert: stubCert})
+	if err != nil {
+		t.Fatal(err)
+	}
+	got, err := m.getCertificate(helloFor(t, "203.0.113.7", "derp.example.com"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got != stubCert {
+		t.Errorf("DNS SNI returned %p; want the next provider's cert %p", got, stubCert)
+	}
+	if n := ca.numOrders(); n != 0 {
+		t.Errorf("orders created = %d; want 0", n)
+	}
+}
+
+// TestCertModeIPCertsGating verifies the flag validation around
+// --acme-ip-certs and IP address hostnames.
+func TestCertModeIPCertsGating(t *testing.T) {
+	tests := []struct {
+		name    string
+		mode    string
+		host    string
+		ipCerts bool
+		wantErr string // or empty to expect success
+	}{
+		{"letsencrypt_ip_no_flag", "letsencrypt", "1.2.3.4", false, "--acme-ip-certs"},
+		{"gcp_ip", "gcp", "1.2.3.4", false, "--certmode=gcp requires --hostname to be a DNS name"},
+		{"gcp_flag", "gcp", "1.2.3.4", true, "--acme-ip-certs requires --certmode=letsencrypt"},
+		{"manual_flag", "manual", "1.2.3.4", true, "--acme-ip-certs requires --certmode=letsencrypt"},
+		{"letsencrypt_ip_flag", "letsencrypt", "1.2.3.4", true, ""},
+		{"letsencrypt_hostname_flag", "letsencrypt", "derp.example.com", true, ""},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cp, err := certProviderByCertMode(tt.mode, t.TempDir(), tt.host, tt.ipCerts, "", "", "")
+			if tt.wantErr == "" {
+				if err != nil {
+					t.Fatalf("certProviderByCertMode(%q, %q, ipCerts=%v) = %v; want success", tt.mode, tt.host, tt.ipCerts, err)
+				}
+				m, ok := cp.(*ipCertManager)
+				if !ok {
+					t.Fatalf("provider type = %T; want *ipCertManager", cp)
+				}
+				wantNext := net.ParseIP(tt.host) == nil
+				if gotNext := m.next != nil; gotNext != wantNext {
+					t.Errorf("has next provider = %v; want %v", gotNext, wantNext)
+				}
+				return
+			}
+			if err == nil || !strings.Contains(err.Error(), tt.wantErr) {
+				t.Errorf("certProviderByCertMode(%q, %q, ipCerts=%v) error = %v; want contains %q",
+					tt.mode, tt.host, tt.ipCerts, err, tt.wantErr)
+			}
+		})
+	}
+}
diff --git a/cmd/fbstatus/fbstatus.go b/cmd/fbstatus/fbstatus.go
new file mode 100644
index 000000000..af17e7944
--- /dev/null
+++ b/cmd/fbstatus/fbstatus.go
@@ -0,0 +1,821 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build linux
+
+// fbstatus is a Linux framebuffer status display for the Tailscale
+// appliance. It draws the Tailscale logo, the tailscaled backend state,
+// the device's tailnet IP addresses, and (when the device needs to be
+// logged in) a QR code containing the login URL so a user can enroll
+// the appliance into a tailnet by pointing their phone camera at the
+// screen.
+//
+// fbstatus accesses the framebuffer via the Linux UAPI in
+// include/uapi/linux/fb.h: FBIOGET_VSCREENINFO and FBIOGET_FSCREENINFO
+// ioctls plus an mmap of /dev/fb0. Only 32-bit truecolor framebuffers
+// (the Raspberry Pi default) are supported.
+package main
+
+import (
+	"bytes"
+	"context"
+	_ "embed"
+	"encoding/binary"
+	"flag"
+	"fmt"
+	"image"
+	"image/color"
+	"image/draw"
+	"image/png"
+	"log"
+	"net"
+	"net/http"
+	"net/netip"
+	"net/url"
+	"os"
+	"os/exec"
+	"os/signal"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"sync/atomic"
+	"syscall"
+	"time"
+	"unsafe"
+
+	"github.com/skip2/go-qrcode"
+	xdraw "golang.org/x/image/draw"
+	"golang.org/x/image/font"
+	"golang.org/x/image/font/basicfont"
+	"golang.org/x/image/math/fixed"
+	"golang.org/x/sys/unix"
+	"tailscale.com/client/local"
+	"tailscale.com/ipn"
+	"tailscale.com/util/cloudenv"
+)
+
+//go:embed tailscale.png
+var tailscalePNG []byte
+
+// Linux framebuffer ioctl numbers, from include/uapi/linux/fb.h.
+const (
+	fbioGetVScreenInfo = 0x4600
+	fbioGetFScreenInfo = 0x4602
+)
+
+// Linux VT ioctl numbers and KD_* modes, from include/uapi/linux/kd.h
+// and include/uapi/linux/vt.h.
+const (
+	kdSetMode    = 0x4B3A
+	kdGraphics   = 1
+	kdText       = 0
+	vtActivate   = 0x5606
+	vtWaitActive = 0x5607
+)
+
+// Byte offsets into the raw fb_var_screeninfo struct returned by
+// FBIOGET_VSCREENINFO. All fields we read are little-endian uint32.
+const (
+	vsOffXres         = 0
+	vsOffYres         = 4
+	vsOffBitsPerPixel = 24
+	vsOffRedOffset    = 32 // start of struct fb_bitfield red
+	vsOffGreenOffset  = 44 // start of struct fb_bitfield green
+	vsOffBlueOffset   = 56 // start of struct fb_bitfield blue
+)
+
+// Byte offsets into the raw fb_fix_screeninfo struct returned by
+// FBIOGET_FSCREENINFO. Layout assumes a 64-bit kernel (the gokrazy
+// appliance targets — arm64/amd64 — are both 64-bit). smem_start and
+// mmio_start are "unsigned long", which is 8 bytes on 64-bit.
+const (
+	fsOffSmemLen    = 24
+	fsOffLineLength = 48
+)
+
+var flagFB = flag.String("fb", "/dev/fb0", "framebuffer device to draw to")
+
+// noFramebufferReason reports whether this host lacks a usable Linux
+// framebuffer, along with a short human-readable explanation. If the
+// framebuffer device is missing, or we're running on a cloud (currently
+// only AWS) whose instances don't expose one, we return true.
+func noFramebufferReason(fbPath string) (string, bool) {
+	if cloudenv.Get() == cloudenv.AWS {
+		return "running on AWS (no framebuffer)", true
+	}
+	if _, err := os.Stat(fbPath); err != nil {
+		return fmt.Sprintf("no framebuffer at %s: %v", fbPath, err), true
+	}
+	return "", false
+}
+
+func main() {
+	flag.Parse()
+	log.SetFlags(log.LstdFlags | log.Lmicroseconds)
+	if err := run(); err != nil {
+		log.Fatal(err)
+	}
+}
+
+func run() error {
+	// Bail out early on cloud VMs that don't ship a framebuffer. We
+	// still kick off breakglass once DHCP succeeds (otherwise the
+	// appliance is unreachable — breakglass declares DontStartOnBoot
+	// and only runs when fbstatus pokes the supervisor), then exit
+	// 125 so the gokrazy supervisor stops respawning us. See
+	// https://gokrazy.org/development/process-interface/.
+	if reason, ok := noFramebufferReason(*flagFB); ok {
+		log.Printf("%s; starting breakglass after DHCP then exiting 125", reason)
+		startBreakglassAfterDHCP(&uiState{})
+		log.Printf("breakglass started; exiting 125 so gokrazy won't respawn fbstatus")
+		os.Exit(125)
+	}
+
+	if restore, err := claimVTGraphics(); err != nil {
+		log.Printf("could not put VT into graphics mode (fbcon may overdraw): %v", err)
+	} else {
+		defer restore()
+	}
+
+	fb, err := openFramebuffer(*flagFB)
+	if err != nil {
+		return fmt.Errorf("open framebuffer: %w", err)
+	}
+	defer fb.Close()
+	log.Printf("framebuffer %s: %dx%d, %d bpp, line=%d, RGB offsets %d/%d/%d",
+		*flagFB, fb.width, fb.height, fb.bpp, fb.lineLength,
+		fb.redShift, fb.greenShift, fb.blueShift)
+
+	logo, err := png.Decode(bytes.NewReader(tailscalePNG))
+	if err != nil {
+		return fmt.Errorf("decoding embedded logo: %w", err)
+	}
+
+	ctx, cancel := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+	defer cancel()
+
+	var lc local.Client
+	st := &uiState{fb: fb, logo: logo}
+	st.updateLAN()
+	st.render()
+
+	go st.pollLAN(ctx)
+	go startBreakglassAfterDHCP(st)
+	go watchKeyboardForConsole(ctx, st)
+
+	for ctx.Err() == nil {
+		if err := watchBusOnce(ctx, &lc, st); err != nil && ctx.Err() == nil {
+			log.Printf("ipn watch: %v; retrying in 2s", err)
+			select {
+			case <-ctx.Done():
+			case <-time.After(2 * time.Second):
+			}
+		}
+	}
+	return nil
+}
+
+func watchBusOnce(ctx context.Context, lc *local.Client, st *uiState) error {
+	w, err := lc.WatchIPNBus(ctx,
+		ipn.NotifyInitialState|ipn.NotifyInitialPrefs|ipn.NotifyInitialStatus)
+	if err != nil {
+		return err
+	}
+	defer w.Close()
+
+	loginRequested := false
+
+	for ctx.Err() == nil {
+		n, err := w.Next()
+		if err != nil {
+			return err
+		}
+		if n.State != nil {
+			st.state = *n.State
+			// On a fresh appliance, tailscaled enters NeedsLogin but
+			// does not generate a login URL until someone asks. Trigger
+			// an interactive login so the control server sends us a URL
+			// (and thus a QR code appears on the display).
+			if *n.State == ipn.NeedsLogin && !loginRequested {
+				loginRequested = true
+				go func() {
+					if err := lc.StartLoginInteractive(ctx); err != nil {
+						log.Printf("StartLoginInteractive: %v", err)
+					}
+				}()
+			}
+		}
+		if n.BrowseToURL != nil {
+			st.loginURL = *n.BrowseToURL
+		}
+		if n.InitialStatus != nil {
+			st.ips = append(st.ips[:0], n.InitialStatus.TailscaleIPs...)
+		}
+		if n.SelfChange != nil {
+			st.ips = st.ips[:0]
+			for _, p := range n.SelfChange.Addresses {
+				st.ips = append(st.ips, p.Addr())
+			}
+		}
+		st.render()
+	}
+	return ctx.Err()
+}
+
+// updateLAN scans network interfaces for a non-loopback interface with a
+// hardware address, updating st.lanIP and st.lanMAC. Shows the MAC even
+// if DHCP hasn't assigned an IP yet.
+func (st *uiState) updateLAN() {
+	ifaces, err := net.Interfaces()
+	if err != nil {
+		return
+	}
+	var bestMAC string
+	var bestIP string
+	for _, iface := range ifaces {
+		if iface.Flags&net.FlagLoopback != 0 {
+			continue
+		}
+		if len(iface.HardwareAddr) == 0 {
+			continue
+		}
+		if bestMAC == "" {
+			bestMAC = iface.HardwareAddr.String()
+		}
+		if iface.Flags&net.FlagUp == 0 {
+			continue
+		}
+		// Prefer the first UP interface with a MAC.
+		if bestMAC != iface.HardwareAddr.String() && bestIP == "" {
+			bestMAC = iface.HardwareAddr.String()
+		}
+		addrs, err := iface.Addrs()
+		if err != nil {
+			continue
+		}
+		for _, addr := range addrs {
+			if ipnet, ok := addr.(*net.IPNet); ok && ipnet.IP.To4() != nil {
+				bestMAC = iface.HardwareAddr.String()
+				bestIP = ipnet.IP.String()
+			}
+		}
+	}
+	st.lanMAC = bestMAC
+	st.lanIP = bestIP
+}
+
+// startBreakglassAfterDHCP waits until a LAN IP is assigned (meaning DHCP
+// succeeded), then restarts breakglass. This ensures breakglass sees the
+// real LAN address in PrivateInterfaceAddrs and binds to it, rather than
+// only binding to 127.0.0.1.
+func startBreakglassAfterDHCP(st *uiState) {
+	for {
+		st.updateLAN()
+		if st.lanIP != "" {
+			break
+		}
+		time.Sleep(time.Second)
+	}
+	startBreakglass()
+}
+
+// startBreakglass asks the gokrazy init HTTP API (over its unix socket) to
+// restart the breakglass service so it actually runs. By default breakglass
+// calls DontStartOnBoot and exits on the first launch attempt; this poke
+// tells the supervisor to try again (without GOKRAZY_FIRST_START=1).
+func startBreakglass() {
+	const sock = "/run/gokrazy-http.sock"
+	hc := &http.Client{
+		Transport: &http.Transport{
+			DialContext: func(ctx context.Context, _, _ string) (net.Conn, error) {
+				var d net.Dialer
+				return d.DialContext(ctx, "unix", sock)
+			},
+		},
+	}
+	form := url.Values{
+		"path":      {"/user/breakglass"},
+		"xsrftoken": {"1"},
+	}
+	req, err := http.NewRequest("POST", "http://gokrazy/restart", strings.NewReader(form.Encode()))
+	if err != nil {
+		log.Printf("startBreakglass: %v", err)
+		return
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.AddCookie(&http.Cookie{Name: "gokrazy_xsrf", Value: "1"})
+	resp, err := hc.Do(req)
+	if err != nil {
+		log.Printf("startBreakglass: %v", err)
+		return
+	}
+	resp.Body.Close()
+	if resp.StatusCode < 300 || resp.StatusCode == http.StatusSeeOther {
+		log.Printf("startBreakglass: restarted (status %s)", resp.Status)
+	} else {
+		log.Printf("startBreakglass: unexpected status %s", resp.Status)
+	}
+}
+
+// watchKeyboardForConsole monitors keyboard input devices for VT-switching
+// accelerators.
+//   - Ctrl-Alt-F2 (or plain Esc — easier to type in NoVNC where the
+//     Ctrl-Alt-Fn sequence doesn't always propagate) switches to VT2, a
+//     text-mode busybox shell. When that shell exits, we switch back
+//     automatically.
+//   - Ctrl-Alt-F1 switches back to VT1 (fbstatus graphics mode).
+//
+// This mirrors standard Linux VT switching conventions plus a NoVNC-
+// friendly shortcut.
+func watchKeyboardForConsole(ctx context.Context, st *uiState) {
+	kbdPath := findKeyboard()
+	if kbdPath == "" {
+		log.Printf("no keyboard found for VT switching")
+		return
+	}
+	kbd, err := os.Open(kbdPath)
+	if err != nil {
+		log.Printf("open keyboard %s: %v", kbdPath, err)
+		return
+	}
+	defer kbd.Close()
+
+	ttyFile, err := os.OpenFile("/dev/tty0", os.O_RDWR, 0)
+	if err != nil {
+		log.Printf("open /dev/tty0 for VT switch: %v", err)
+		return
+	}
+	defer ttyFile.Close()
+	ttyFd := int(ttyFile.Fd())
+
+	log.Printf("watching %s for Ctrl-Alt-F1/F2 and Esc (VT switching)", kbdPath)
+
+	// Linux input_event has the same layout on both arm64 and amd64
+	// (24 bytes: two uint64 timestamps + uint16 type + uint16 code +
+	// int32 value), so this parser handles both the Pi and Proxmox VM.
+	const evSize = 24
+	const evKey = 1  // EV_KEY
+	const keyEsc = 1 // KEY_ESC
+	const keyF1 = 59 // KEY_F1
+	const keyF2 = 60 // KEY_F2
+	const keyLeftCtrl = 29
+	const keyLeftAlt = 56
+	const keyRightCtrl = 97
+	const keyRightAlt = 100
+	const keyPress = 1
+
+	buf := make([]byte, evSize)
+	var ctrlHeld, altHeld bool
+
+	switchToFbstatus := func() {
+		st.paused.Store(false)
+		syscall.Syscall(syscall.SYS_IOCTL, uintptr(ttyFd), vtActivate, 1)
+		syscall.Syscall(syscall.SYS_IOCTL, uintptr(ttyFd), vtWaitActive, 1)
+		ioctlSetInt(ttyFile, kdSetMode, kdGraphics)
+		st.render()
+	}
+	switchToShell := func(reason string) {
+		st.paused.Store(true)
+		ioctlSetInt(ttyFile, kdSetMode, kdText)
+		syscall.Syscall(syscall.SYS_IOCTL, uintptr(ttyFd), vtActivate, 2)
+		syscall.Syscall(syscall.SYS_IOCTL, uintptr(ttyFd), vtWaitActive, 2)
+		go ensureShellOnVT2(switchToFbstatus)
+		log.Printf("%s: switched to text console", reason)
+	}
+
+	for ctx.Err() == nil {
+		n, err := kbd.Read(buf)
+		if err != nil || n < evSize {
+			continue
+		}
+		evType := binary.LittleEndian.Uint16(buf[16:18])
+		evCode := binary.LittleEndian.Uint16(buf[18:20])
+		evValue := int32(binary.LittleEndian.Uint32(buf[20:24]))
+
+		if evType != evKey {
+			continue
+		}
+
+		pressed := evValue == keyPress
+		released := evValue == 0
+
+		switch evCode {
+		case keyLeftCtrl, keyRightCtrl:
+			if pressed {
+				ctrlHeld = true
+			} else if released {
+				ctrlHeld = false
+			}
+		case keyLeftAlt, keyRightAlt:
+			if pressed {
+				altHeld = true
+			} else if released {
+				altHeld = false
+			}
+		case keyEsc:
+			if pressed && !ctrlHeld && !altHeld {
+				// Bare Esc: NoVNC-friendly shortcut to the shell.
+				switchToShell("Esc")
+			}
+		case keyF1:
+			if pressed && ctrlHeld && altHeld {
+				switchToFbstatus()
+				log.Printf("Ctrl-Alt-F1: switched to fbstatus")
+			}
+		case keyF2:
+			if pressed && ctrlHeld && altHeld {
+				switchToShell("Ctrl-Alt-F2")
+			}
+		}
+	}
+}
+
+// ensureShellOnVT2 spawns a busybox ash shell on /dev/tty2 if one isn't
+// already running. The shell gets the VT2 tty as its controlling terminal
+// so keyboard input on VT2 goes to it. When the shell exits, onExit is
+// called (typically to switch back to VT1 / fbstatus graphics mode).
+var shellOnVT2Running atomic.Bool
+
+func ensureShellOnVT2(onExit func()) {
+	if !shellOnVT2Running.CompareAndSwap(false, true) {
+		return
+	}
+	go func() {
+		defer shellOnVT2Running.Store(false)
+		defer func() {
+			if onExit != nil {
+				onExit()
+			}
+		}()
+		shell := "/tmp/serial-busybox/ash"
+		if _, err := os.Stat(shell); err != nil {
+			log.Printf("no shell at %s for VT2", shell)
+			return
+		}
+		tty, err := os.OpenFile("/dev/tty2", os.O_RDWR, 0)
+		if err != nil {
+			log.Printf("open /dev/tty2: %v", err)
+			return
+		}
+		defer tty.Close()
+		cmd := exec.Command(shell)
+		cmd.Stdin = tty
+		cmd.Stdout = tty
+		cmd.Stderr = tty
+		cmd.SysProcAttr = &syscall.SysProcAttr{
+			Setsid:  true,
+			Setctty: true,
+			Ctty:    0, // index into cmd's file descriptors (stdin = tty)
+		}
+		cmd.Env = append(os.Environ(), "TERM=linux", "HOME=/tmp", "PATH=/tmp/serial-busybox:/user:/gokrazy")
+		log.Printf("starting shell on VT2")
+		if err := cmd.Run(); err != nil {
+			log.Printf("shell on VT2 exited: %v", err)
+		}
+	}()
+}
+
+// findKeyboard looks for a keyboard among /dev/input/event* devices by
+// checking that the device's key capability bitmap has KEY_ESC set. The
+// alternative "any non-zero key bitmap" check picks up the ACPI power
+// button (which advertises KEY_POWER but no Esc) and misses the real
+// keyboard on amd64 Proxmox VMs, where the AT keyboard is event1 but
+// event0 is Power Button.
+func findKeyboard() string {
+	matches, _ := filepath.Glob("/dev/input/event*")
+	for _, path := range matches {
+		name := filepath.Base(path)
+		capData, err := os.ReadFile("/sys/class/input/" + name + "/device/capabilities/key")
+		if err != nil {
+			continue
+		}
+		fields := strings.Fields(strings.TrimSpace(string(capData)))
+		if len(fields) == 0 {
+			continue
+		}
+		// The kernel prints capability bitmaps as space-separated 64-bit
+		// hex chunks, most-significant chunk first. The last chunk holds
+		// bits 0..63. KEY_ESC = 1, so its bit-mask is 1<<1 == 0x2.
+		low, err := strconv.ParseUint(fields[len(fields)-1], 16, 64)
+		if err != nil {
+			continue
+		}
+		const keyEscBit = 1 << 1
+		if low&keyEscBit != 0 {
+			return path
+		}
+	}
+	return ""
+}
+
+// pollLAN periodically refreshes LAN info and re-renders.
+func (st *uiState) pollLAN(ctx context.Context) {
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-time.After(5 * time.Second):
+			st.updateLAN()
+			st.render()
+		}
+	}
+}
+
+// uiState is the most-recently-known view of the appliance state that
+// gets rendered to the framebuffer on each notify.
+type uiState struct {
+	fb   *framebuffer
+	logo image.Image
+
+	state    ipn.State
+	loginURL string
+	ips      []netip.Addr
+
+	lanIP  string // LAN IPv4 address (from DHCP)
+	lanMAC string // MAC address of the primary interface
+
+	paused atomic.Bool // when true, render() is a no-op (VT switched away)
+}
+
+var (
+	bgColor   = color.RGBA{0x10, 0x12, 0x20, 0xff} // near-black slate
+	fgColor   = color.RGBA{0xff, 0xff, 0xff, 0xff}
+	dimColor  = color.RGBA{0xa0, 0xa6, 0xb8, 0xff}
+	stateOK   = color.RGBA{0x4a, 0xc8, 0x82, 0xff} // green for Running
+	stateWait = color.RGBA{0xf0, 0xc8, 0x60, 0xff} // amber for NeedsLogin/Starting
+)
+
+// render composes the current state into an in-memory image and blits
+// it to the framebuffer.
+func (st *uiState) render() {
+	if st.paused.Load() {
+		return
+	}
+	w, h := st.fb.width, st.fb.height
+	img := image.NewRGBA(image.Rect(0, 0, w, h))
+	draw.Draw(img, img.Bounds(), &image.Uniform{C: bgColor}, image.Point{}, draw.Src)
+
+	shortSide := min(w, h)
+
+	// Logo, scaled to ~25% of the shorter dimension, centered
+	// horizontally near the top.
+	logoSize := shortSide / 4
+	logoRect := image.Rect(0, 0, logoSize, logoSize).Add(image.Point{
+		X: (w - logoSize) / 2,
+		Y: shortSide / 16,
+	})
+	xdraw.ApproxBiLinear.Scale(img, logoRect, st.logo, st.logo.Bounds(), xdraw.Over, nil)
+
+	lineH := basicfont.Face7x13.Metrics().Height.Ceil()
+	textTop := logoRect.Max.Y + shortSide/24
+
+	// Hide the state line when the QR code is visible (the "Scan to
+	// enroll" label is clear enough context).
+	showState := !(st.state == ipn.NeedsLogin && st.loginURL != "")
+	if showState {
+		stateColor := dimColor
+		switch st.state {
+		case ipn.Running:
+			stateColor = stateOK
+		case ipn.NeedsLogin, ipn.Starting, ipn.NoState:
+			stateColor = stateWait
+		}
+		drawCenteredScaled(img, fmt.Sprintf("State: %s", stateLabel(st.state)),
+			stateColor, w/2, textTop, 3)
+	}
+
+	y := textTop + 3*lineH + shortSide/40
+
+	if len(st.ips) > 0 {
+		drawCenteredScaled(img, "Tailscale IPs:", dimColor, w/2, y, 2)
+		y += 2 * lineH
+		for _, a := range st.ips {
+			drawCenteredScaled(img, a.String(), fgColor, w/2, y, 2)
+			y += 2*lineH + 4
+		}
+	}
+
+	// QR code with the login URL when enrollment is needed.
+	if st.state == ipn.NeedsLogin && st.loginURL != "" {
+		qrSize := shortSide / 2
+		q, err := qrcode.New(st.loginURL, qrcode.Medium)
+		if err != nil {
+			log.Printf("qr encode %q: %v", st.loginURL, err)
+		} else {
+			q.DisableBorder = false
+			qrImg := q.Image(qrSize)
+			qrRect := qrImg.Bounds().Add(image.Point{
+				X: (w - qrSize) / 2,
+				Y: h - qrSize - shortSide/16,
+			})
+			draw.Draw(img, qrRect, qrImg, qrImg.Bounds().Min, draw.Src)
+			drawCenteredScaled(img, "Scan to enroll this device",
+				fgColor, w/2, qrRect.Min.Y-lineH*2-8, 2)
+		}
+	}
+
+	// LAN status pinned to the bottom-left corner.
+	{
+		lanY := h - lineH - 4
+		var lanText string
+		if st.lanIP != "" {
+			lanText = "LAN IP: " + st.lanIP
+		} else if st.lanMAC != "" {
+			lanText = "Waiting for DHCP (" + st.lanMAC + ")"
+		}
+		if lanText != "" {
+			face := basicfont.Face7x13
+			textW := font.MeasureString(face, lanText).Ceil()
+			small := image.NewRGBA(image.Rect(0, 0, textW, lineH))
+			d := font.Drawer{
+				Dst:  small,
+				Src:  &image.Uniform{C: dimColor},
+				Face: face,
+				Dot:  fixed.P(0, face.Metrics().Ascent.Ceil()),
+			}
+			d.DrawString(lanText)
+			dstRect := image.Rect(4, lanY, 4+textW, lanY+lineH)
+			draw.Draw(img, dstRect, small, image.Point{}, draw.Over)
+		}
+	}
+
+	st.fb.blit(img)
+}
+
+// drawCenteredScaled draws s with basicfont.Face7x13 at the given
+// integer pixel scale, centered horizontally on x at top y, in col.
+func drawCenteredScaled(dst *image.RGBA, s string, col color.Color, x, y, scale int) {
+	if s == "" {
+		return
+	}
+	face := basicfont.Face7x13
+	width := font.MeasureString(face, s).Ceil()
+	height := face.Metrics().Height.Ceil()
+
+	small := image.NewRGBA(image.Rect(0, 0, width, height))
+	d := font.Drawer{
+		Dst:  small,
+		Src:  &image.Uniform{C: col},
+		Face: face,
+		Dot:  fixed.P(0, face.Metrics().Ascent.Ceil()),
+	}
+	d.DrawString(s)
+
+	scaledW, scaledH := width*scale, height*scale
+	dstRect := image.Rect(0, 0, scaledW, scaledH).Add(image.Point{
+		X: x - scaledW/2,
+		Y: y,
+	})
+	xdraw.NearestNeighbor.Scale(dst, dstRect, small, small.Bounds(), xdraw.Over, nil)
+}
+
+func stateLabel(s ipn.State) string {
+	switch s {
+	case ipn.NoState, ipn.Starting:
+		return "starting"
+	case ipn.NeedsLogin:
+		return "needs login"
+	case ipn.NeedsMachineAuth:
+		return "needs machine auth"
+	case ipn.Stopped:
+		return "stopped"
+	case ipn.Running:
+		return "running"
+	}
+	return strings.ToLower(s.String())
+}
+
+// framebuffer is an mmap'd Linux framebuffer device.
+type framebuffer struct {
+	f          *os.File
+	mem        []byte
+	width      int
+	height     int
+	bpp        int
+	lineLength int
+
+	// Bit offsets into a 32-bit pixel for each channel, from the
+	// fb_bitfield values returned by FBIOGET_VSCREENINFO.
+	redShift   uint32
+	greenShift uint32
+	blueShift  uint32
+}
+
+// openFramebuffer opens path, queries dimensions and pixel format via
+// the FBIOGET_* ioctls, and mmaps the framebuffer memory.
+//
+// Only 32-bits-per-pixel framebuffers are supported. Raspberry Pi 3/4/5
+// default to that.
+func openFramebuffer(path string) (*framebuffer, error) {
+	f, err := os.OpenFile(path, os.O_RDWR, 0)
+	if err != nil {
+		return nil, err
+	}
+	var (
+		vbuf [160]byte // fb_var_screeninfo
+		fbuf [80]byte  // fb_fix_screeninfo
+	)
+	if err := ioctlGet(f, fbioGetVScreenInfo, vbuf[:]); err != nil {
+		f.Close()
+		return nil, fmt.Errorf("FBIOGET_VSCREENINFO: %w", err)
+	}
+	if err := ioctlGet(f, fbioGetFScreenInfo, fbuf[:]); err != nil {
+		f.Close()
+		return nil, fmt.Errorf("FBIOGET_FSCREENINFO: %w", err)
+	}
+
+	fb := &framebuffer{
+		f:          f,
+		width:      int(binary.LittleEndian.Uint32(vbuf[vsOffXres:])),
+		height:     int(binary.LittleEndian.Uint32(vbuf[vsOffYres:])),
+		bpp:        int(binary.LittleEndian.Uint32(vbuf[vsOffBitsPerPixel:])),
+		lineLength: int(binary.LittleEndian.Uint32(fbuf[fsOffLineLength:])),
+		redShift:   binary.LittleEndian.Uint32(vbuf[vsOffRedOffset:]),
+		greenShift: binary.LittleEndian.Uint32(vbuf[vsOffGreenOffset:]),
+		blueShift:  binary.LittleEndian.Uint32(vbuf[vsOffBlueOffset:]),
+	}
+	if fb.bpp != 32 {
+		f.Close()
+		return nil, fmt.Errorf("unsupported framebuffer bpp %d (only 32 is supported)", fb.bpp)
+	}
+
+	memLen := int(binary.LittleEndian.Uint32(fbuf[fsOffSmemLen:]))
+	mem, err := unix.Mmap(int(f.Fd()), 0, memLen,
+		unix.PROT_READ|unix.PROT_WRITE, unix.MAP_SHARED)
+	if err != nil {
+		f.Close()
+		return nil, fmt.Errorf("mmap %s: %w", path, err)
+	}
+	fb.mem = mem
+	return fb, nil
+}
+
+func (fb *framebuffer) Close() error {
+	if fb.mem != nil {
+		unix.Munmap(fb.mem)
+		fb.mem = nil
+	}
+	return fb.f.Close()
+}
+
+// blit copies img into the mapped framebuffer, packing each
+// image.RGBA pixel into the framebuffer's per-channel bit layout.
+func (fb *framebuffer) blit(img *image.RGBA) {
+	srcStride := img.Stride
+	for y := 0; y < fb.height; y++ {
+		srcRow := img.Pix[y*srcStride : y*srcStride+fb.width*4]
+		dstRow := fb.mem[y*fb.lineLength:]
+		for x := 0; x < fb.width; x++ {
+			r := uint32(srcRow[x*4+0])
+			g := uint32(srcRow[x*4+1])
+			b := uint32(srcRow[x*4+2])
+			px := r<<fb.redShift | g<<fb.greenShift | b<<fb.blueShift
+			binary.LittleEndian.PutUint32(dstRow[x*4:], px)
+		}
+	}
+}
+
+// claimVTGraphics puts the active virtual terminal into KD_GRAPHICS so
+// the kernel's framebuffer console (fbcon) stops drawing on /dev/fb0
+// while fbstatus owns it. It returns a function that restores KD_TEXT.
+//
+// The Linux kernel applies VT mode to whatever VT is current; the open
+// path /dev/tty0 always refers to the foreground VT, which on a
+// headless gokrazy appliance is the only VT.
+func claimVTGraphics() (restore func(), err error) {
+	f, err := os.OpenFile("/dev/tty0", os.O_RDWR, 0)
+	if err != nil {
+		return nil, err
+	}
+	if err := ioctlSetInt(f, kdSetMode, kdGraphics); err != nil {
+		f.Close()
+		return nil, fmt.Errorf("KDSETMODE KD_GRAPHICS: %w", err)
+	}
+	return func() {
+		if err := ioctlSetInt(f, kdSetMode, kdText); err != nil {
+			log.Printf("KDSETMODE KD_TEXT on shutdown: %v", err)
+		}
+		f.Close()
+	}, nil
+}
+
+// ioctlSetInt runs an ioctl with a single integer arg, like KDSETMODE.
+func ioctlSetInt(f *os.File, req uintptr, arg uintptr) error {
+	_, _, errno := syscall.Syscall(syscall.SYS_IOCTL, f.Fd(), req, arg)
+	if errno != 0 {
+		return errno
+	}
+	return nil
+}
+
+// ioctlGet runs an ioctl that fills a struct of len(buf) bytes in buf.
+// Used for the FBIOGET_* ioctls; on success buf holds the kernel's
+// fb_*_screeninfo struct.
+func ioctlGet(f *os.File, req uintptr, buf []byte) error {
+	_, _, errno := syscall.Syscall(syscall.SYS_IOCTL, f.Fd(), req,
+		uintptr(unsafe.Pointer(&buf[0])))
+	if errno != 0 {
+		return errno
+	}
+	return nil
+}
diff --git a/cmd/fbstatus/fbstatus_other.go b/cmd/fbstatus/fbstatus_other.go
new file mode 100644
index 000000000..2809d3084
--- /dev/null
+++ b/cmd/fbstatus/fbstatus_other.go
@@ -0,0 +1,17 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !linux
+
+package main
+
+import (
+	"fmt"
+	"os"
+	"runtime"
+)
+
+func main() {
+	fmt.Fprintf(os.Stderr, "fbstatus is only supported on Linux (got %s)\n", runtime.GOOS)
+	os.Exit(1)
+}
diff --git a/cmd/fbstatus/tailscale.png b/cmd/fbstatus/tailscale.png
new file mode 100644
index 000000000..d476e88fc
Binary files /dev/null and b/cmd/fbstatus/tailscale.png differ
diff --git a/cmd/gitops-pusher/gitops-pusher.go b/cmd/gitops-pusher/gitops-pusher.go
index 11448e30d..e3cfa70db 100644
--- a/cmd/gitops-pusher/gitops-pusher.go
+++ b/cmd/gitops-pusher/gitops-pusher.go
@@ -26,7 +26,7 @@ import (
 	"github.com/tailscale/hujson"
 	"golang.org/x/oauth2/clientcredentials"
 	tsclient "tailscale.com/client/tailscale"
-	_ "tailscale.com/feature/condregister/identityfederation"
+	_ "tailscale.com/feature/identityfederation"
 	"tailscale.com/internal/client/tailscale"
 	"tailscale.com/util/httpm"
 )
@@ -255,7 +255,11 @@ func getCredentials() (*http.Client, string) {
 		} else if idok && idToken != "" && oiok && oauthId != "" {
 			if exchangeJWTForToken, ok := tailscale.HookExchangeJWTForTokenViaWIF.GetOk(); ok {
 				var err error
-				apiKeyEnv, err = exchangeJWTForToken(context.Background(), fmt.Sprintf("https://%s", *apiServer), oauthId, idToken)
+				apiKeyEnv, err = exchangeJWTForToken(context.Background(), tailscale.ExchangeJWTForTokenWIFArgs{
+					BaseURL:  fmt.Sprintf("https://%s", *apiServer),
+					ClientID: oauthId,
+					IDToken:  idToken,
+				})
 				if err != nil {
 					log.Fatal(err)
 				}
diff --git a/cmd/hello/hello.go b/cmd/hello/hello.go
index 710de49cd..45eb7751c 100644
--- a/cmd/hello/hello.go
+++ b/cmd/hello/hello.go
@@ -5,212 +5,16 @@
 package main // import "tailscale.com/cmd/hello"
 
 import (
-	"context"
-	"crypto/tls"
-	_ "embed"
-	"encoding/json"
-	"errors"
-	"flag"
-	"html/template"
 	"log"
-	"net/http"
-	"os"
-	"strings"
-	"time"
 
-	"tailscale.com/client/local"
-	"tailscale.com/client/tailscale/apitype"
-	"tailscale.com/tailcfg"
+	"tailscale.com/cmd/hello/helloserver"
 )
 
-var (
-	httpAddr  = flag.String("http", ":80", "address to run an HTTP server on, or empty for none")
-	httpsAddr = flag.String("https", ":443", "address to run an HTTPS server on, or empty for none")
-	testIP    = flag.String("test-ip", "", "if non-empty, look up IP and exit before running a server")
-)
-
-//go:embed hello.tmpl.html
-var embeddedTemplate string
-
-var localClient local.Client
-
 func main() {
-	flag.Parse()
-	if *testIP != "" {
-		res, err := localClient.WhoIs(context.Background(), *testIP)
-		if err != nil {
-			log.Fatal(err)
-		}
-		e := json.NewEncoder(os.Stdout)
-		e.SetIndent("", "\t")
-		e.Encode(res)
-		return
+	s := &helloserver.Server{
+		HTTPAddr:  ":80",
+		HTTPSAddr: ":443",
 	}
-	if devMode() {
-		// Parse it optimistically
-		var err error
-		tmpl, err = template.New("home").Parse(embeddedTemplate)
-		if err != nil {
-			log.Printf("ignoring template error in dev mode: %v", err)
-		}
-	} else {
-		if embeddedTemplate == "" {
-			log.Fatalf("embeddedTemplate is empty; must be build with Go 1.16+")
-		}
-		tmpl = template.Must(template.New("home").Parse(embeddedTemplate))
-	}
-
-	http.HandleFunc("/", root)
 	log.Printf("Starting hello server.")
-
-	errc := make(chan error, 1)
-	if *httpAddr != "" {
-		log.Printf("running HTTP server on %s", *httpAddr)
-		go func() {
-			errc <- http.ListenAndServe(*httpAddr, nil)
-		}()
-	}
-	if *httpsAddr != "" {
-		log.Printf("running HTTPS server on %s", *httpsAddr)
-		go func() {
-			hs := &http.Server{
-				Addr: *httpsAddr,
-				TLSConfig: &tls.Config{
-					GetCertificate: func(hi *tls.ClientHelloInfo) (*tls.Certificate, error) {
-						switch hi.ServerName {
-						case "hello.ts.net":
-							return localClient.GetCertificate(hi)
-						case "hello.ipn.dev":
-							c, err := tls.LoadX509KeyPair(
-								"/etc/hello/hello.ipn.dev.crt",
-								"/etc/hello/hello.ipn.dev.key",
-							)
-							if err != nil {
-								return nil, err
-							}
-							return &c, nil
-						}
-						return nil, errors.New("invalid SNI name")
-					},
-				},
-				IdleTimeout:       30 * time.Second,
-				ReadHeaderTimeout: 20 * time.Second,
-				MaxHeaderBytes:    10 << 10,
-			}
-			errc <- hs.ListenAndServeTLS("", "")
-		}()
-	}
-	log.Fatal(<-errc)
-}
-
-func devMode() bool { return *httpsAddr == "" && *httpAddr != "" }
-
-func getTmpl() (*template.Template, error) {
-	if devMode() {
-		tmplData, err := os.ReadFile("hello.tmpl.html")
-		if os.IsNotExist(err) {
-			log.Printf("using baked-in template in dev mode; can't find hello.tmpl.html in current directory")
-			return tmpl, nil
-		}
-		return template.New("home").Parse(string(tmplData))
-	}
-	return tmpl, nil
-}
-
-// tmpl is the template used in prod mode.
-// In dev mode it's only used if the template file doesn't exist on disk.
-// It's initialized by main after flag parsing.
-var tmpl *template.Template
-
-type tmplData struct {
-	DisplayName   string // "Foo Barberson"
-	LoginName     string // "foo@bar.com"
-	ProfilePicURL string // "https://..."
-	MachineName   string // "imac5k"
-	MachineOS     string // "Linux"
-	IP            string // "100.2.3.4"
-}
-
-func tailscaleIP(who *apitype.WhoIsResponse) string {
-	if who == nil {
-		return ""
-	}
-	vals, err := tailcfg.UnmarshalNodeCapJSON[string](who.Node.CapMap, tailcfg.NodeAttrNativeIPV4)
-	if err == nil && len(vals) > 0 {
-		return vals[0]
-	}
-	for _, nodeIP := range who.Node.Addresses {
-		if nodeIP.Addr().Is4() && nodeIP.IsSingleIP() {
-			return nodeIP.Addr().String()
-		}
-	}
-	for _, nodeIP := range who.Node.Addresses {
-		if nodeIP.IsSingleIP() {
-			return nodeIP.Addr().String()
-		}
-	}
-	return ""
-}
-
-func root(w http.ResponseWriter, r *http.Request) {
-	if r.TLS == nil && *httpsAddr != "" {
-		host := r.Host
-		if strings.Contains(r.Host, "100.101.102.103") ||
-			strings.Contains(r.Host, "hello.ipn.dev") {
-			host = "hello.ts.net"
-		}
-		http.Redirect(w, r, "https://"+host, http.StatusFound)
-		return
-	}
-	if r.RequestURI != "/" {
-		http.Redirect(w, r, "/", http.StatusFound)
-		return
-	}
-	if r.TLS != nil && *httpsAddr != "" && strings.Contains(r.Host, "hello.ipn.dev") {
-		http.Redirect(w, r, "https://hello.ts.net", http.StatusFound)
-		return
-	}
-	tmpl, err := getTmpl()
-	if err != nil {
-		w.Header().Set("Content-Type", "text/plain")
-		http.Error(w, "template error: "+err.Error(), 500)
-		return
-	}
-
-	who, err := localClient.WhoIs(r.Context(), r.RemoteAddr)
-	var data tmplData
-	if err != nil {
-		if devMode() {
-			log.Printf("warning: using fake data in dev mode due to whois lookup error: %v", err)
-			data = tmplData{
-				DisplayName:   "Taily Scalerson",
-				LoginName:     "taily@scaler.son",
-				ProfilePicURL: "https://placekitten.com/200/200",
-				MachineName:   "scaled",
-				MachineOS:     "Linux",
-				IP:            "100.1.2.3",
-			}
-		} else {
-			log.Printf("whois(%q) error: %v", r.RemoteAddr, err)
-			http.Error(w, "Your Tailscale works, but we failed to look you up.", 500)
-			return
-		}
-	} else {
-		data = tmplData{
-			DisplayName:   who.UserProfile.DisplayName,
-			LoginName:     who.UserProfile.LoginName,
-			ProfilePicURL: who.UserProfile.ProfilePicURL,
-			MachineName:   firstLabel(who.Node.ComputedName),
-			MachineOS:     who.Node.Hostinfo.OS(),
-			IP:            tailscaleIP(who),
-		}
-	}
-	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-	tmpl.Execute(w, data)
-}
-
-// firstLabel s up until the first period, if any.
-func firstLabel(s string) string {
-	s, _, _ = strings.Cut(s, ".")
-	return s
+	log.Fatal(s.Run())
 }
diff --git a/cmd/hello/hello.tmpl.html b/cmd/hello/hello.tmpl.html
deleted file mode 100644
index 3ecd1b58a..000000000
--- a/cmd/hello/hello.tmpl.html
+++ /dev/null
@@ -1,438 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-<head>
-  <meta charset="utf-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0">
-  <title>Hello from Tailscale</title>
-  <style>
-    html,
-    body {
-      margin: 0;
-      padding: 0;
-    }
-
-    body {
-      font-family: Inter, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
-      font-size: 100%;
-      -webkit-font-smoothing: antialiased;
-      -moz-osx-font-smoothing: grayscale;
-    }
-
-    html,
-    body,
-    main {
-      height: 100%;
-    }
-
-    *,
-    ::before,
-    ::after {
-      box-sizing: border-box;
-      border-width: 0;
-      border-style: solid;
-      border-color: #dad6d5;
-    }
-
-    h1,
-    h2,
-    h3,
-    h4,
-    h5,
-    h6 {
-      margin: 0;
-      font-size: 1rem;
-      font-weight: inherit;
-    }
-
-    a {
-      color: inherit;
-    }
-
-    p {
-      margin: 0;
-    }
-
-    main {
-      display: flex;
-      flex-direction: column;
-      justify-content: center;
-      align-items: center;
-      max-width: 24rem;
-      width: 95%;
-      margin-left: auto;
-      margin-right: auto;
-    }
-
-    .p-2 {
-      padding: 0.5rem;
-    }
-
-    .p-4 {
-      padding: 1rem;
-    }
-
-    .px-2 {
-      padding-left: 0.5rem;
-      padding-right: 0.5rem;
-    }
-
-    .pl-3 {
-      padding-left: 0.75rem;
-    }
-
-    .pr-3 {
-      padding-right: 0.75rem;
-    }
-
-    .pt-4 {
-      padding-top: 1rem;
-    }
-
-    .mr-2 {
-      margin-right: 0.5rem;
-      ;
-    }
-
-    .mb-1 {
-      margin-bottom: 0.25rem;
-    }
-
-    .mb-2 {
-      margin-bottom: 0.5rem;
-    }
-
-    .mb-4 {
-      margin-bottom: 1rem;
-    }
-
-    .mb-6 {
-      margin-bottom: 1.5rem;
-    }
-
-    .mb-8 {
-      margin-bottom: 2rem;
-    }
-
-    .mb-12 {
-      margin-bottom: 3rem;
-    }
-
-    .width-full {
-      width: 100%;
-    }
-
-    .min-width-0 {
-      min-width: 0;
-    }
-
-    .rounded-lg {
-      border-radius: 0.5rem;
-    }
-
-    .relative {
-      position: relative;
-    }
-
-    .flex {
-      display: flex;
-    }
-
-    .justify-between {
-      justify-content: space-between;
-    }
-
-    .items-center {
-      align-items: center;
-    }
-
-    .border {
-      border-width: 1px;
-    }
-
-    .border-t-1 {
-      border-top-width: 1px;
-    }
-
-    .border-gray-100 {
-      border-color: #f7f5f4;
-    }
-
-    .border-gray-200 {
-      border-color: #eeebea;
-    }
-
-    .border-gray-300 {
-      border-color: #dad6d5;
-    }
-
-    .bg-white {
-      background-color: white;
-    }
-
-    .bg-gray-0 {
-      background-color: #faf9f8;
-    }
-
-    .bg-gray-100 {
-      background-color: #f7f5f4;
-    }
-
-    .text-green-600 {
-      color: #0d4b3b;
-    }
-
-    .text-blue-600 {
-      color: #3f5db3;
-    }
-
-    .hover\:text-blue-800:hover {
-      color: #253570;
-    }
-
-    .text-gray-600 {
-      color: #444342;
-    }
-
-    .text-gray-700 {
-      color: #2e2d2d;
-    }
-
-    .text-gray-800 {
-      color: #232222;
-    }
-
-    .text-center {
-      text-align: center;
-    }
-
-    .text-sm {
-      font-size: 0.875rem;
-    }
-
-    .font-title {
-      font-size: 1.25rem;
-      letter-spacing: -0.025em;
-    }
-
-    .font-semibold {
-      font-weight: 600;
-    }
-
-    .font-medium {
-      font-weight: 500;
-    }
-
-    .font-regular {
-      font-weight: 400;
-    }
-
-    .truncate {
-      overflow: hidden;
-      text-overflow: ellipsis;
-      white-space: nowrap;
-    }
-
-    .overflow-hidden {
-      overflow: hidden;
-    }
-
-    .profile-pic {
-      width: 2.5rem;
-      height: 2.5rem;
-      border-radius: 9999px;
-      background-size: cover;
-      margin-right: 0.5rem;
-      flex-shrink: 0;
-    }
-
-    .panel {
-      box-shadow: 0 20px 25px -5px rgba(0, 0, 0, 0.1), 0 10px 10px -5px rgba(0, 0, 0, 0.04);
-    }
-
-    .animate .panel {
-      transform: translateY(10%);
-      box-shadow: 0 20px 25px -5px rgba(0, 0, 0, 0.0), 0 10px 10px -5px rgba(0, 0, 0, 0.0);
-      transition: transform 1200ms ease, opacity 1200ms ease, box-shadow 1200ms ease;
-    }
-
-    .animate .panel-interior {
-      opacity: 0.0;
-      transition: opacity 1200ms ease;
-    }
-
-    .animate .logo {
-      transform: translateY(2rem);
-      opacity: 0.0;
-      transition: transform 1200ms ease, opacity 1200ms ease;
-    }
-
-    .animate .header-title {
-      transform: translateY(1.6rem);
-      opacity: 0.0;
-      transition: transform 1200ms ease, opacity 1200ms ease;
-    }
-
-    .animate .header-text {
-      transform: translateY(1.2rem);
-      opacity: 0.0;
-      transition: transform 1200ms ease, opacity 1200ms ease;
-    }
-
-    .animate .footer {
-      transform: translateY(-0.5rem);
-      opacity: 0.0;
-      transition: transform 1200ms ease, opacity 1200ms ease;
-    }
-
-    .animating .panel {
-      transform: translateY(0);
-      opacity: 1.0;
-      box-shadow: 0 20px 25px -5px rgba(0, 0, 0, 0.1), 0 10px 10px -5px rgba(0, 0, 0, 0.04);
-    }
-
-    .animating .panel-interior {
-      opacity: 1.0;
-    }
-
-    .animating .spinner {
-      opacity: 0.0;
-    }
-
-    .animating .logo,
-    .animating .header-title,
-    .animating .header-text,
-    .animating .footer {
-      transform: translateY(0);
-      opacity: 1.0;
-    }
-
-    .spinner {
-      display: inline-flex;
-      position: absolute;
-      top: 50%;
-      left: 50%;
-      transform: translate(-50%, -50%);
-      align-items: center;
-      transition: opacity 200ms ease;
-    }
-
-    .spinner span {
-      display: inline-block;
-      background-color: currentColor;
-      border-radius: 9999px;
-      animation-name: loading-dots-blink;
-      animation-duration: 1.4s;
-      animation-iteration-count: infinite;
-      animation-fill-mode: both;
-      width: 0.35em;
-      height: 0.35em;
-      margin: 0 0.15em;
-    }
-
-    .spinner span:nth-child(2) {
-      animation-delay: 200ms;
-    }
-
-    .spinner span:nth-child(3) {
-      animation-delay: 400ms;
-    }
-
-    .spinner {
-      display: none;
-    }
-
-    .animate .spinner {
-      display: inline-flex;
-    }
-
-    @keyframes loading-dots-blink {
-      0% {
-        opacity: 0.2;
-      }
-      20% {
-        opacity: 1;
-      }
-      100% {
-        opacity: 0.2;
-      }
-    }
-
-    @media (prefers-reduced-motion) {
-      * {
-        animation-duration: 0ms !important;
-        transition-duration: 0ms !important;
-        transition-delay: 0ms !important;
-      }
-    }
-  </style>
-</head>
-<body class="bg-gray-100">
-  <script>
-    (function() {
-      var lastSeen = localStorage.getItem("lastSeen");
-      if (!lastSeen) {
-        document.body.classList.add("animate");
-        window.addEventListener("load", function () {
-          setTimeout(function () {
-            document.body.classList.add("animating");
-            localStorage.setItem("lastSeen", Date.now());
-          }, 100);
-        });
-      }
-    })();
-  </script>
-  <main class="text-gray-800">
-    <svg class="logo mb-6" width="28" height="28" viewBox="0 0 22 22" fill="none" xmlns="http://www.w3.org/2000/svg">
-      <circle opacity="0.2" cx="3.4" cy="3.25" r="2.7" fill="currentColor" />
-      <circle cx="3.4" cy="11.3" r="2.7" fill="currentColor" />
-      <circle opacity="0.2" cx="3.4" cy="19.5" r="2.7" fill="currentColor" />
-      <circle cx="11.5" cy="11.3" r="2.7" fill="currentColor" />
-      <circle cx="11.5" cy="19.5" r="2.7" fill="currentColor" />
-      <circle opacity="0.2" cx="11.5" cy="3.25" r="2.7" fill="currentColor" />
-      <circle opacity="0.2" cx="19.5" cy="3.25" r="2.7" fill="currentColor" />
-      <circle cx="19.5" cy="11.3" r="2.7" fill="currentColor" />
-      <circle opacity="0.2" cx="19.5" cy="19.5" r="2.7" fill="currentColor" />
-    </svg>
-    <header class="mb-8 text-center">
-      <h1 class="header-title font-title font-semibold mb-2">You're connected over Tailscale!</h1>
-      <p class="header-text">This device is signed in as…</p>
-    </header>
-    <div class="panel relative bg-white rounded-lg width-full shadow-xl mb-8 p-4">
-      <div class="spinner text-gray-600">
-        <span></span>
-        <span></span>
-        <span></span>
-      </div>
-      <div class="panel-interior flex items-center width-full min-width-0 p-2 mb-4">
-        <div class="profile-pic bg-gray-100" style="background-image: url({{.ProfilePicURL}});"></div>
-        <div class="overflow-hidden">
-          {{ with .DisplayName }}
-          <h4 class="font-semibold truncate">{{.}}</h4>
-          {{ end }}
-          <h5 class="text-gray-600 truncate">{{.LoginName}}</h5>
-        </div>
-      </div>
-      <div
-        class="panel-interior border border-gray-200 bg-gray-0 rounded-lg p-2 pl-3 pr-3 mb-2 width-full flex justify-between items-center">
-        <div class="flex items-center min-width-0">
-          <svg class="text-gray-600 mr-2" xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 24 24" fill="none"
-            stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
-            <rect x="2" y="2" width="20" height="8" rx="2" ry="2"></rect>
-            <rect x="2" y="14" width="20" height="8" rx="2" ry="2"></rect>
-            <line x1="6" y1="6" x2="6.01" y2="6"></line>
-            <line x1="6" y1="18" x2="6.01" y2="18"></line>
-          </svg>
-          <h4 class="font-semibold truncate mr-2">{{.MachineName}}</h4>
-        </div>
-        <h5>{{.IP}}</h5>
-      </div>
-    </div>
-    <footer class="footer text-gray-600 text-center mb-12">
-      <p>Read about <a href="https://tailscale.com/kb/1017/install#advanced-features" class="text-blue-600 hover:text-blue-800"
-          target="_blank">what you can do next &rarr;</a></p>
-      <p>Read about <a href="https://tailscale.com/kb/1073/hello" class="text-blue-600 hover:text-blue-800"
-          target="_blank">the Hello service &rarr;</a></p>
-    </footer>
-  </main>
-</body>
-</html>
diff --git a/cmd/hello/helloserver/hello.tmpl.html b/cmd/hello/helloserver/hello.tmpl.html
new file mode 100644
index 000000000..0f74d116f
--- /dev/null
+++ b/cmd/hello/helloserver/hello.tmpl.html
@@ -0,0 +1,71 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0">
+  <title>Hello from Tailscale</title>
+  <link type="text/css" rel="stylesheet" href="/static/style.css">
+  <script src="/static/script.js" defer></script>
+</head>
+<body class="bg-gray-100">
+  <main class="text-gray-800">
+    <svg class="logo mb-6" width="28" height="28" viewBox="0 0 22 22" fill="none" xmlns="http://www.w3.org/2000/svg">
+      <circle opacity="0.2" cx="3.4" cy="3.25" r="2.7" fill="currentColor" />
+      <circle cx="3.4" cy="11.3" r="2.7" fill="currentColor" />
+      <circle opacity="0.2" cx="3.4" cy="19.5" r="2.7" fill="currentColor" />
+      <circle cx="11.5" cy="11.3" r="2.7" fill="currentColor" />
+      <circle cx="11.5" cy="19.5" r="2.7" fill="currentColor" />
+      <circle opacity="0.2" cx="11.5" cy="3.25" r="2.7" fill="currentColor" />
+      <circle opacity="0.2" cx="19.5" cy="3.25" r="2.7" fill="currentColor" />
+      <circle cx="19.5" cy="11.3" r="2.7" fill="currentColor" />
+      <circle opacity="0.2" cx="19.5" cy="19.5" r="2.7" fill="currentColor" />
+    </svg>
+    <header class="mb-8 text-center">
+      <h1 class="header-title font-title font-semibold mb-2">You're connected over Tailscale!</h1>
+      <p class="header-text">This device is signed in as…</p>
+    </header>
+    <div class="panel relative bg-white rounded-lg width-full shadow-xl mb-8 p-4">
+      <div class="spinner text-gray-600">
+        <span></span>
+        <span></span>
+        <span></span>
+      </div>
+      <div class="panel-interior flex items-center width-full min-width-0 p-2 mb-4">
+        <div class="profile-pic bg-gray-100">
+            <img
+                    src="{{.ProfilePicURL}}"
+                    alt="Profile picture"
+                    class="profile-pic-img"
+            >
+        </div>
+        <div class="overflow-hidden">
+          {{ with .DisplayName }}
+          <h4 class="font-semibold truncate">{{.}}</h4>
+          {{ end }}
+          <h5 class="text-gray-600 truncate">{{.LoginName}}</h5>
+        </div>
+      </div>
+      <div
+        class="panel-interior border border-gray-200 bg-gray-0 rounded-lg p-2 pl-3 pr-3 mb-2 width-full flex justify-between items-center">
+        <div class="flex items-center min-width-0">
+          <svg class="text-gray-600 mr-2" xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 24 24" fill="none"
+            stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+            <rect x="2" y="2" width="20" height="8" rx="2" ry="2"></rect>
+            <rect x="2" y="14" width="20" height="8" rx="2" ry="2"></rect>
+            <line x1="6" y1="6" x2="6.01" y2="6"></line>
+            <line x1="6" y1="18" x2="6.01" y2="18"></line>
+          </svg>
+          <h4 class="font-semibold truncate mr-2">{{.MachineName}}</h4>
+        </div>
+        <h5>{{.IP}}</h5>
+      </div>
+    </div>
+    <footer class="footer text-gray-600 text-center mb-12">
+      <p>Read about <a href="https://tailscale.com/kb/1017/install#advanced-features" class="text-blue-600 hover:text-blue-800"
+          target="_blank">what you can do next &rarr;</a></p>
+      <p>Read about <a href="https://tailscale.com/kb/1073/hello" class="text-blue-600 hover:text-blue-800"
+          target="_blank">the Hello service &rarr;</a></p>
+    </footer>
+  </main>
+</body>
+</html>
diff --git a/cmd/hello/helloserver/helloserver.go b/cmd/hello/helloserver/helloserver.go
new file mode 100644
index 000000000..41e7dbce2
--- /dev/null
+++ b/cmd/hello/helloserver/helloserver.go
@@ -0,0 +1,157 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package helloserver implements the HTTP server behind hello.ts.net.
+package helloserver
+
+import (
+	"crypto/tls"
+	"embed"
+	"html/template"
+	"log"
+	"net/http"
+	"strings"
+	"time"
+
+	"tailscale.com/client/local"
+	"tailscale.com/client/tailscale/apitype"
+	"tailscale.com/tailcfg"
+)
+
+//go:embed hello.tmpl.html
+var embeddedTemplate string
+
+//go:embed static/*
+var staticFiles embed.FS
+
+var staticHandler = http.FileServerFS(staticFiles)
+
+var tmpl = template.Must(template.New("home").Parse(embeddedTemplate))
+
+// Server is an HTTP server for hello.ts.net.
+//
+// The zero value is not valid; populate at least one of HTTPAddr or HTTPSAddr
+// before calling Run.
+type Server struct {
+	// HTTPAddr is the address to run an HTTP server on, or empty for none.
+	HTTPAddr string
+
+	// HTTPSAddr is the address to run an HTTPS server on, or empty for none.
+	HTTPSAddr string
+
+	// LocalClient is used to look up the identity of incoming requests and
+	// to obtain TLS certificates. If nil, the zero value of local.Client is
+	// used.
+	LocalClient *local.Client
+}
+
+func (s *Server) localClient() *local.Client {
+	if s.LocalClient != nil {
+		return s.LocalClient
+	}
+	return &local.Client{}
+}
+
+// Run starts the configured HTTP and HTTPS servers and blocks until one of
+// them returns an error.
+func (s *Server) Run() error {
+	errc := make(chan error, 1)
+	if s.HTTPAddr != "" {
+		log.Printf("running HTTP server on %s", s.HTTPAddr)
+		go func() {
+			errc <- http.ListenAndServe(s.HTTPAddr, s)
+		}()
+	}
+	if s.HTTPSAddr != "" {
+		log.Printf("running HTTPS server on %s", s.HTTPSAddr)
+		go func() {
+			hs := &http.Server{
+				Addr:    s.HTTPSAddr,
+				Handler: s,
+				TLSConfig: &tls.Config{
+					GetCertificate: s.localClient().GetCertificate,
+				},
+				IdleTimeout:       30 * time.Second,
+				ReadHeaderTimeout: 20 * time.Second,
+				MaxHeaderBytes:    10 << 10,
+			}
+			errc <- hs.ListenAndServeTLS("", "")
+		}()
+	}
+	return <-errc
+}
+
+type tmplData struct {
+	DisplayName   string // "Foo Barberson"
+	LoginName     string // "foo@bar.com"
+	ProfilePicURL string // "https://..."
+	MachineName   string // "imac5k"
+	MachineOS     string // "Linux"
+	IP            string // "100.2.3.4"
+}
+
+func tailscaleIP(who *apitype.WhoIsResponse) string {
+	if who == nil {
+		return ""
+	}
+	vals, err := tailcfg.UnmarshalNodeCapJSON[string](who.Node.CapMap, tailcfg.NodeAttrNativeIPV4)
+	if err == nil && len(vals) > 0 {
+		return vals[0]
+	}
+	for _, nodeIP := range who.Node.Addresses {
+		if nodeIP.Addr().Is4() && nodeIP.IsSingleIP() {
+			return nodeIP.Addr().String()
+		}
+	}
+	for _, nodeIP := range who.Node.Addresses {
+		if nodeIP.IsSingleIP() {
+			return nodeIP.Addr().String()
+		}
+	}
+	return ""
+}
+
+// ServeHTTP implements http.Handler.
+func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	if r.TLS == nil && s.HTTPSAddr != "" {
+		host := r.Host
+		if strings.Contains(r.Host, "100.101.102.103") {
+			host = "hello.ts.net"
+		}
+		http.Redirect(w, r, "https://"+host, http.StatusFound)
+		return
+	}
+
+	if strings.HasPrefix(r.RequestURI, "/static/") {
+		staticHandler.ServeHTTP(w, r)
+		return
+	}
+
+	if r.RequestURI != "/" {
+		http.Redirect(w, r, "/", http.StatusFound)
+		return
+	}
+
+	who, err := s.localClient().WhoIs(r.Context(), r.RemoteAddr)
+	if err != nil {
+		log.Printf("whois(%q) error: %v", r.RemoteAddr, err)
+		http.Error(w, "Your Tailscale works, but we failed to look you up.", 500)
+		return
+	}
+	data := tmplData{
+		DisplayName:   who.UserProfile.DisplayName,
+		LoginName:     who.UserProfile.LoginName,
+		ProfilePicURL: who.UserProfile.ProfilePicURL,
+		MachineName:   firstLabel(who.Node.ComputedName),
+		MachineOS:     who.Node.Hostinfo.OS(),
+		IP:            tailscaleIP(who),
+	}
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	tmpl.Execute(w, data)
+}
+
+// firstLabel returns s up until the first period, if any.
+func firstLabel(s string) string {
+	s, _, _ = strings.Cut(s, ".")
+	return s
+}
diff --git a/cmd/hello/helloserver/static/script.js b/cmd/hello/helloserver/static/script.js
new file mode 100644
index 000000000..db9bcd0f3
--- /dev/null
+++ b/cmd/hello/helloserver/static/script.js
@@ -0,0 +1,12 @@
+(function () {
+    var lastSeen = localStorage.getItem("lastSeen");
+    if (!lastSeen) {
+        document.body.classList.add("animate");
+        window.addEventListener("load", function () {
+            setTimeout(function () {
+                document.body.classList.add("animating");
+                localStorage.setItem("lastSeen", Date.now());
+            }, 100);
+        });
+    }
+})();
diff --git a/cmd/hello/helloserver/static/style.css b/cmd/hello/helloserver/static/style.css
new file mode 100644
index 000000000..8ad55edc6
--- /dev/null
+++ b/cmd/hello/helloserver/static/style.css
@@ -0,0 +1,366 @@
+html,
+body {
+    margin: 0;
+    padding: 0;
+}
+
+body {
+    font-family: Inter, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+    font-size: 100%;
+    -webkit-font-smoothing: antialiased;
+    -moz-osx-font-smoothing: grayscale;
+}
+
+html,
+body,
+main {
+    height: 100%;
+}
+
+*,
+::before,
+::after {
+    box-sizing: border-box;
+    border-width: 0;
+    border-style: solid;
+    border-color: #dad6d5;
+}
+
+h1,
+h2,
+h3,
+h4,
+h5,
+h6 {
+    margin: 0;
+    font-size: 1rem;
+    font-weight: inherit;
+}
+
+a {
+    color: inherit;
+}
+
+p {
+    margin: 0;
+}
+
+main {
+    display: flex;
+    flex-direction: column;
+    justify-content: center;
+    align-items: center;
+    max-width: 24rem;
+    width: 95%;
+    margin-left: auto;
+    margin-right: auto;
+}
+
+.p-2 {
+    padding: 0.5rem;
+}
+
+.p-4 {
+    padding: 1rem;
+}
+
+.px-2 {
+    padding-left: 0.5rem;
+    padding-right: 0.5rem;
+}
+
+.pl-3 {
+    padding-left: 0.75rem;
+}
+
+.pr-3 {
+    padding-right: 0.75rem;
+}
+
+.pt-4 {
+    padding-top: 1rem;
+}
+
+.mr-2 {
+    margin-right: 0.5rem;
+;
+}
+
+.mb-1 {
+    margin-bottom: 0.25rem;
+}
+
+.mb-2 {
+    margin-bottom: 0.5rem;
+}
+
+.mb-4 {
+    margin-bottom: 1rem;
+}
+
+.mb-6 {
+    margin-bottom: 1.5rem;
+}
+
+.mb-8 {
+    margin-bottom: 2rem;
+}
+
+.mb-12 {
+    margin-bottom: 3rem;
+}
+
+.width-full {
+    width: 100%;
+}
+
+.min-width-0 {
+    min-width: 0;
+}
+
+.rounded-lg {
+    border-radius: 0.5rem;
+}
+
+.relative {
+    position: relative;
+}
+
+.flex {
+    display: flex;
+}
+
+.justify-between {
+    justify-content: space-between;
+}
+
+.items-center {
+    align-items: center;
+}
+
+.border {
+    border-width: 1px;
+}
+
+.border-t-1 {
+    border-top-width: 1px;
+}
+
+.border-gray-100 {
+    border-color: #f7f5f4;
+}
+
+.border-gray-200 {
+    border-color: #eeebea;
+}
+
+.border-gray-300 {
+    border-color: #dad6d5;
+}
+
+.bg-white {
+    background-color: white;
+}
+
+.bg-gray-0 {
+    background-color: #faf9f8;
+}
+
+.bg-gray-100 {
+    background-color: #f7f5f4;
+}
+
+.text-green-600 {
+    color: #0d4b3b;
+}
+
+.text-blue-600 {
+    color: #3f5db3;
+}
+
+.hover\:text-blue-800:hover {
+    color: #253570;
+}
+
+.text-gray-600 {
+    color: #444342;
+}
+
+.text-gray-700 {
+    color: #2e2d2d;
+}
+
+.text-gray-800 {
+    color: #232222;
+}
+
+.text-center {
+    text-align: center;
+}
+
+.text-sm {
+    font-size: 0.875rem;
+}
+
+.font-title {
+    font-size: 1.25rem;
+    letter-spacing: -0.025em;
+}
+
+.font-semibold {
+    font-weight: 600;
+}
+
+.font-medium {
+    font-weight: 500;
+}
+
+.font-regular {
+    font-weight: 400;
+}
+
+.truncate {
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+}
+
+.overflow-hidden {
+    overflow: hidden;
+}
+
+.profile-pic {
+    width: 2.5rem;
+    height: 2.5rem;
+    background-size: cover;
+    margin-right: 0.5rem;
+    flex-shrink: 0;
+}
+
+.profile-pic-img {
+    width: 100%;
+    height: 100%;
+    object-fit: cover;
+    display: block;
+    border-radius: 9999px;
+}
+
+.panel {
+    box-shadow: 0 20px 25px -5px rgba(0, 0, 0, 0.1), 0 10px 10px -5px rgba(0, 0, 0, 0.04);
+}
+
+.animate .panel {
+    transform: translateY(10%);
+    box-shadow: 0 20px 25px -5px rgba(0, 0, 0, 0.0), 0 10px 10px -5px rgba(0, 0, 0, 0.0);
+    transition: transform 1200ms ease, opacity 1200ms ease, box-shadow 1200ms ease;
+}
+
+.animate .panel-interior {
+    opacity: 0.0;
+    transition: opacity 1200ms ease;
+}
+
+.animate .logo {
+    transform: translateY(2rem);
+    opacity: 0.0;
+    transition: transform 1200ms ease, opacity 1200ms ease;
+}
+
+.animate .header-title {
+    transform: translateY(1.6rem);
+    opacity: 0.0;
+    transition: transform 1200ms ease, opacity 1200ms ease;
+}
+
+.animate .header-text {
+    transform: translateY(1.2rem);
+    opacity: 0.0;
+    transition: transform 1200ms ease, opacity 1200ms ease;
+}
+
+.animate .footer {
+    transform: translateY(-0.5rem);
+    opacity: 0.0;
+    transition: transform 1200ms ease, opacity 1200ms ease;
+}
+
+.animating .panel {
+    transform: translateY(0);
+    opacity: 1.0;
+    box-shadow: 0 20px 25px -5px rgba(0, 0, 0, 0.1), 0 10px 10px -5px rgba(0, 0, 0, 0.04);
+}
+
+.animating .panel-interior {
+    opacity: 1.0;
+}
+
+.animating .spinner {
+    opacity: 0.0;
+}
+
+.animating .logo,
+.animating .header-title,
+.animating .header-text,
+.animating .footer {
+    transform: translateY(0);
+    opacity: 1.0;
+}
+
+.spinner {
+    display: inline-flex;
+    position: absolute;
+    top: 50%;
+    left: 50%;
+    transform: translate(-50%, -50%);
+    align-items: center;
+    transition: opacity 200ms ease;
+}
+
+.spinner span {
+    display: inline-block;
+    background-color: currentColor;
+    border-radius: 9999px;
+    animation-name: loading-dots-blink;
+    animation-duration: 1.4s;
+    animation-iteration-count: infinite;
+    animation-fill-mode: both;
+    width: 0.35em;
+    height: 0.35em;
+    margin: 0 0.15em;
+}
+
+.spinner span:nth-child(2) {
+    animation-delay: 200ms;
+}
+
+.spinner span:nth-child(3) {
+    animation-delay: 400ms;
+}
+
+.spinner {
+    display: none;
+}
+
+.animate .spinner {
+    display: inline-flex;
+}
+
+@keyframes loading-dots-blink {
+    0% {
+        opacity: 0.2;
+    }
+    20% {
+        opacity: 1;
+    }
+    100% {
+        opacity: 0.2;
+    }
+}
+
+@media (prefers-reduced-motion) {
+    * {
+        animation-duration: 0ms !important;
+        transition-duration: 0ms !important;
+        transition-delay: 0ms !important;
+    }
+}
diff --git a/cmd/k8s-nameserver/main.go b/cmd/k8s-nameserver/main.go
index 1b219fb1a..1e6a1dea9 100644
--- a/cmd/k8s-nameserver/main.go
+++ b/cmd/k8s-nameserver/main.go
@@ -29,7 +29,7 @@ import (
 const (
 	// tsNetDomain is the domain that this DNS nameserver has registered a handler for.
 	tsNetDomain = "ts.net"
-	// addr is the the address that the UDP and TCP listeners will listen on.
+	// addr is the address that the UDP and TCP listeners will listen on.
 	addr = ":1053"
 	// defaultTTL is the default TTL for DNS records in seconds.
 	// Set to 0 to disable caching. Can be increased when usage patterns are better understood.
diff --git a/cmd/k8s-operator/api-server-proxy-pg.go b/cmd/k8s-operator/api-server-proxy-pg.go
index ac2f73577..37260c7a0 100644
--- a/cmd/k8s-operator/api-server-proxy-pg.go
+++ b/cmd/k8s-operator/api-server-proxy-pg.go
@@ -436,14 +436,16 @@ func exclusiveOwnerAnnotations(pg *tsapi.ProxyGroup, operatorID string, svc *tai
 	}
 	if svc == nil {
 		c := ownerAnnotationValue{OwnerRefs: []OwnerRef{ref}}
-		json, err := json.Marshal(c)
+		data, err := json.Marshal(c)
 		if err != nil {
-			return nil, fmt.Errorf("[unexpected] unable to marshal Tailscale Service's owner annotation contents: %w, please report this", err)
+			return nil, fmt.Errorf("failed to marshal Tailscale Service's owner annotation contents: %w", err)
 		}
+
 		return map[string]string{
-			ownerAnnotation: string(json),
+			ownerAnnotation: string(data),
 		}, nil
 	}
+
 	o, err := parseOwnerAnnotation(svc)
 	if err != nil {
 		return nil, err
@@ -451,15 +453,19 @@ func exclusiveOwnerAnnotations(pg *tsapi.ProxyGroup, operatorID string, svc *tai
 	if o == nil || len(o.OwnerRefs) == 0 {
 		return nil, fmt.Errorf("Tailscale Service %s exists, but does not contain owner annotation with owner references; not proceeding as this is likely a resource created by something other than the Tailscale Kubernetes operator", svc.Name)
 	}
+
 	if len(o.OwnerRefs) > 1 || o.OwnerRefs[0].OperatorID != operatorID {
 		return nil, fmt.Errorf("Tailscale Service %s is already owned by other operator(s) and cannot be shared across multiple clusters; configure a difference Service name to continue", svc.Name)
 	}
+
 	if o.OwnerRefs[0].Resource == nil {
 		return nil, fmt.Errorf("Tailscale Service %s exists, but does not reference an owning resource; not proceeding as this is likely a Service already owned by an Ingress", svc.Name)
 	}
+
 	if o.OwnerRefs[0].Resource.Kind != "ProxyGroup" || o.OwnerRefs[0].Resource.UID != string(pg.UID) {
 		return nil, fmt.Errorf("Tailscale Service %s is already owned by another resource: %#v; configure a difference Service name to continue", svc.Name, o.OwnerRefs[0].Resource)
 	}
+
 	if o.OwnerRefs[0].Resource.Name != pg.Name {
 		// ProxyGroup name can be updated in place.
 		o.OwnerRefs[0].Resource.Name = pg.Name
diff --git a/cmd/k8s-operator/connector.go b/cmd/k8s-operator/connector.go
index 0c2d32482..323dc7b86 100644
--- a/cmd/k8s-operator/connector.go
+++ b/cmd/k8s-operator/connector.go
@@ -29,6 +29,8 @@ import (
 	tsoperator "tailscale.com/k8s-operator"
 	tsapi "tailscale.com/k8s-operator/apis/v1alpha1"
 	"tailscale.com/kube/kubetypes"
+	"tailscale.com/net/netutil"
+	"tailscale.com/net/tsaddr"
 	"tailscale.com/tstime"
 	"tailscale.com/util/clientmetric"
 	"tailscale.com/util/set"
@@ -356,6 +358,11 @@ func validateRoutes(routes tsapi.Routes) error {
 		if pfx.Masked() != pfx {
 			errs = append(errs, fmt.Errorf("route %s has non-address bits set; expected %s", pfx, pfx.Masked()))
 		}
+		if tsaddr.IsViaPrefix(pfx) {
+			if err := netutil.ValidateViaPrefix(pfx); err != nil {
+				errs = append(errs, err)
+			}
+		}
 	}
 	return errors.Join(errs...)
 }
diff --git a/cmd/k8s-operator/connector_test.go b/cmd/k8s-operator/connector_test.go
index 69e8e287d..b366dac38 100644
--- a/cmd/k8s-operator/connector_test.go
+++ b/cmd/k8s-operator/connector_test.go
@@ -145,6 +145,22 @@ func TestConnector(t *testing.T) {
 	expectReconciled(t, cr, "", "test")
 	expectEqual(t, fc, expectedSTS(t, fc, opts), removeResourceReqs)
 
+	// Set an invalid 4via6 route (site ID too large).
+	mustUpdate[tsapi.Connector](t, fc, "", "test", func(conn *tsapi.Connector) {
+		conn.Spec.SubnetRouter.AdvertiseRoutes = []tsapi.Route{"fd7a:115c:a1e0:b1a:1:0:a2c:0/116"}
+	})
+	expectReconciled(t, cr, "", "test")
+	// STS should still have the previous valid route, unchanged.
+	expectEqual(t, fc, expectedSTS(t, fc, opts), removeResourceReqs)
+
+	// Set a valid 4via6 route.
+	mustUpdate[tsapi.Connector](t, fc, "", "test", func(conn *tsapi.Connector) {
+		conn.Spec.SubnetRouter.AdvertiseRoutes = []tsapi.Route{"fd7a:115c:a1e0:b1a:0:1:a2c:0/116"}
+	})
+	opts.subnetRoutes = "fd7a:115c:a1e0:b1a:0:1:a2c:0/116"
+	expectReconciled(t, cr, "", "test")
+	expectEqual(t, fc, expectedSTS(t, fc, opts), removeResourceReqs)
+
 	// Delete the Connector.
 	if err = fc.Delete(context.Background(), cn); err != nil {
 		t.Fatalf("error deleting Connector: %v", err)
diff --git a/cmd/k8s-operator/depaware.txt b/cmd/k8s-operator/depaware.txt
index 2b6884683..51222b6b0 100644
--- a/cmd/k8s-operator/depaware.txt
+++ b/cmd/k8s-operator/depaware.txt
@@ -6,84 +6,12 @@ tailscale.com/cmd/k8s-operator dependencies: (generated by github.com/tailscale/
    W 💣 github.com/alexbrainman/sspi                                 from github.com/alexbrainman/sspi/internal/common+
    W    github.com/alexbrainman/sspi/internal/common                 from github.com/alexbrainman/sspi/negotiate
    W 💣 github.com/alexbrainman/sspi/negotiate                       from tailscale.com/net/tshttpproxy
-        github.com/aws/aws-sdk-go-v2/aws                             from github.com/aws/aws-sdk-go-v2/aws/defaults+
-        github.com/aws/aws-sdk-go-v2/aws/defaults                    from github.com/aws/aws-sdk-go-v2/service/sso+
-        github.com/aws/aws-sdk-go-v2/aws/middleware                  from github.com/aws/aws-sdk-go-v2/aws/retry+
-        github.com/aws/aws-sdk-go-v2/aws/protocol/query              from github.com/aws/aws-sdk-go-v2/service/sts
-        github.com/aws/aws-sdk-go-v2/aws/protocol/restjson           from github.com/aws/aws-sdk-go-v2/service/sso+
-        github.com/aws/aws-sdk-go-v2/aws/protocol/xml                from github.com/aws/aws-sdk-go-v2/service/sts
-        github.com/aws/aws-sdk-go-v2/aws/ratelimit                   from github.com/aws/aws-sdk-go-v2/aws/retry
-        github.com/aws/aws-sdk-go-v2/aws/retry                       from github.com/aws/aws-sdk-go-v2/credentials/endpointcreds/internal/client+
-        github.com/aws/aws-sdk-go-v2/aws/signer/internal/v4          from github.com/aws/aws-sdk-go-v2/aws/signer/v4
-        github.com/aws/aws-sdk-go-v2/aws/signer/v4                   from github.com/aws/aws-sdk-go-v2/internal/auth/smithy+
-        github.com/aws/aws-sdk-go-v2/aws/transport/http              from github.com/aws/aws-sdk-go-v2/config+
-        github.com/aws/aws-sdk-go-v2/config                          from tailscale.com/wif
-        github.com/aws/aws-sdk-go-v2/credentials                     from github.com/aws/aws-sdk-go-v2/config
-        github.com/aws/aws-sdk-go-v2/credentials/ec2rolecreds        from github.com/aws/aws-sdk-go-v2/config
-        github.com/aws/aws-sdk-go-v2/credentials/endpointcreds       from github.com/aws/aws-sdk-go-v2/config
-        github.com/aws/aws-sdk-go-v2/credentials/endpointcreds/internal/client from github.com/aws/aws-sdk-go-v2/credentials/endpointcreds
-        github.com/aws/aws-sdk-go-v2/credentials/processcreds        from github.com/aws/aws-sdk-go-v2/config
-        github.com/aws/aws-sdk-go-v2/credentials/ssocreds            from github.com/aws/aws-sdk-go-v2/config
-        github.com/aws/aws-sdk-go-v2/credentials/stscreds            from github.com/aws/aws-sdk-go-v2/config
-        github.com/aws/aws-sdk-go-v2/feature/ec2/imds                from github.com/aws/aws-sdk-go-v2/config+
-        github.com/aws/aws-sdk-go-v2/feature/ec2/imds/internal/config from github.com/aws/aws-sdk-go-v2/feature/ec2/imds
-        github.com/aws/aws-sdk-go-v2/internal/auth                   from github.com/aws/aws-sdk-go-v2/aws/signer/v4+
-        github.com/aws/aws-sdk-go-v2/internal/auth/smithy            from github.com/aws/aws-sdk-go-v2/service/sso+
-        github.com/aws/aws-sdk-go-v2/internal/configsources          from github.com/aws/aws-sdk-go-v2/service/sso+
-        github.com/aws/aws-sdk-go-v2/internal/context                from github.com/aws/aws-sdk-go-v2/aws/retry+
-        github.com/aws/aws-sdk-go-v2/internal/endpoints              from github.com/aws/aws-sdk-go-v2/service/sso+
-        github.com/aws/aws-sdk-go-v2/internal/endpoints/awsrulesfn   from github.com/aws/aws-sdk-go-v2/service/sso+
-        github.com/aws/aws-sdk-go-v2/internal/endpoints/v2           from github.com/aws/aws-sdk-go-v2/service/sso/internal/endpoints+
-        github.com/aws/aws-sdk-go-v2/internal/ini                    from github.com/aws/aws-sdk-go-v2/config
-        github.com/aws/aws-sdk-go-v2/internal/middleware             from github.com/aws/aws-sdk-go-v2/service/sso+
-        github.com/aws/aws-sdk-go-v2/internal/rand                   from github.com/aws/aws-sdk-go-v2/aws+
-        github.com/aws/aws-sdk-go-v2/internal/sdk                    from github.com/aws/aws-sdk-go-v2/aws+
-        github.com/aws/aws-sdk-go-v2/internal/sdkio                  from github.com/aws/aws-sdk-go-v2/credentials/processcreds
-        github.com/aws/aws-sdk-go-v2/internal/shareddefaults         from github.com/aws/aws-sdk-go-v2/config+
-        github.com/aws/aws-sdk-go-v2/internal/strings                from github.com/aws/aws-sdk-go-v2/aws/signer/internal/v4
-        github.com/aws/aws-sdk-go-v2/internal/sync/singleflight      from github.com/aws/aws-sdk-go-v2/aws
-        github.com/aws/aws-sdk-go-v2/internal/timeconv               from github.com/aws/aws-sdk-go-v2/aws/retry
-        github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding from github.com/aws/aws-sdk-go-v2/service/sts
-        github.com/aws/aws-sdk-go-v2/service/internal/presigned-url  from github.com/aws/aws-sdk-go-v2/service/sts
-        github.com/aws/aws-sdk-go-v2/service/sso                     from github.com/aws/aws-sdk-go-v2/config+
-        github.com/aws/aws-sdk-go-v2/service/sso/internal/endpoints  from github.com/aws/aws-sdk-go-v2/service/sso
-        github.com/aws/aws-sdk-go-v2/service/sso/types               from github.com/aws/aws-sdk-go-v2/service/sso
-        github.com/aws/aws-sdk-go-v2/service/ssooidc                 from github.com/aws/aws-sdk-go-v2/config+
-        github.com/aws/aws-sdk-go-v2/service/ssooidc/internal/endpoints from github.com/aws/aws-sdk-go-v2/service/ssooidc
-        github.com/aws/aws-sdk-go-v2/service/ssooidc/types           from github.com/aws/aws-sdk-go-v2/service/ssooidc
-        github.com/aws/aws-sdk-go-v2/service/sts                     from github.com/aws/aws-sdk-go-v2/config+
-        github.com/aws/aws-sdk-go-v2/service/sts/internal/endpoints  from github.com/aws/aws-sdk-go-v2/service/sts
-        github.com/aws/aws-sdk-go-v2/service/sts/types               from github.com/aws/aws-sdk-go-v2/credentials/stscreds+
-        github.com/aws/smithy-go                                     from github.com/aws/aws-sdk-go-v2/aws/protocol/restjson+
-        github.com/aws/smithy-go/auth                                from github.com/aws/aws-sdk-go-v2/internal/auth+
-        github.com/aws/smithy-go/auth/bearer                         from github.com/aws/aws-sdk-go-v2/aws+
-        github.com/aws/smithy-go/context                             from github.com/aws/smithy-go/auth/bearer
-        github.com/aws/smithy-go/document                            from github.com/aws/aws-sdk-go-v2/service/sso+
-        github.com/aws/smithy-go/encoding                            from github.com/aws/smithy-go/encoding/json+
-        github.com/aws/smithy-go/encoding/httpbinding                from github.com/aws/aws-sdk-go-v2/aws/protocol/query+
-        github.com/aws/smithy-go/encoding/json                       from github.com/aws/aws-sdk-go-v2/service/ssooidc
-        github.com/aws/smithy-go/encoding/xml                        from github.com/aws/aws-sdk-go-v2/service/sts
-        github.com/aws/smithy-go/endpoints                           from github.com/aws/aws-sdk-go-v2/service/sso+
-        github.com/aws/smithy-go/endpoints/private/rulesfn           from github.com/aws/aws-sdk-go-v2/service/sts
-        github.com/aws/smithy-go/internal/sync/singleflight          from github.com/aws/smithy-go/auth/bearer
-        github.com/aws/smithy-go/io                                  from github.com/aws/aws-sdk-go-v2/feature/ec2/imds+
-        github.com/aws/smithy-go/logging                             from github.com/aws/aws-sdk-go-v2/aws+
-        github.com/aws/smithy-go/metrics                             from github.com/aws/aws-sdk-go-v2/aws/retry+
-        github.com/aws/smithy-go/middleware                          from github.com/aws/aws-sdk-go-v2/aws+
-        github.com/aws/smithy-go/private/requestcompression          from github.com/aws/aws-sdk-go-v2/config
-        github.com/aws/smithy-go/ptr                                 from github.com/aws/aws-sdk-go-v2/aws+
-        github.com/aws/smithy-go/rand                                from github.com/aws/aws-sdk-go-v2/aws/middleware
-        github.com/aws/smithy-go/time                                from github.com/aws/aws-sdk-go-v2/service/sso+
-        github.com/aws/smithy-go/tracing                             from github.com/aws/aws-sdk-go-v2/aws/middleware+
-        github.com/aws/smithy-go/transport/http                      from github.com/aws/aws-sdk-go-v2/aws+
-        github.com/aws/smithy-go/transport/http/internal/io          from github.com/aws/smithy-go/transport/http
         github.com/beorn7/perks/quantile                             from github.com/prometheus/client_golang/prometheus
         github.com/blang/semver/v4                                   from k8s.io/component-base/metrics
      💣 github.com/cespare/xxhash/v2                                 from github.com/prometheus/client_golang/prometheus+
         github.com/coder/websocket                                   from tailscale.com/util/eventbus
         github.com/coder/websocket/internal/errd                     from github.com/coder/websocket
         github.com/coder/websocket/internal/util                     from github.com/coder/websocket
-        github.com/coder/websocket/internal/xsync                    from github.com/coder/websocket
         github.com/creachadair/msync/trigger                         from tailscale.com/logtail
      💣 github.com/davecgh/go-spew/spew                              from k8s.io/apimachinery/pkg/util/dump
    W 💣 github.com/dblohm7/wingoes                                   from tailscale.com/net/tshttpproxy+
@@ -113,6 +41,7 @@ tailscale.com/cmd/k8s-operator dependencies: (generated by github.com/tailscale/
         github.com/go-json-experiment/json/internal/jsonopts         from github.com/go-json-experiment/json/jsontext+
         github.com/go-json-experiment/json/internal/jsonwire         from github.com/go-json-experiment/json/jsontext+
         github.com/go-json-experiment/json/jsontext                  from tailscale.com/logtail+
+        github.com/go-json-experiment/json/v1                        from tailscale.com/net/routecheck+
         github.com/go-logr/logr                                      from github.com/go-logr/logr/slogr+
         github.com/go-logr/logr/slogr                                from github.com/go-logr/zapr
         github.com/go-logr/zapr                                      from sigs.k8s.io/controller-runtime/pkg/log/zap+
@@ -130,7 +59,7 @@ tailscale.com/cmd/k8s-operator dependencies: (generated by github.com/tailscale/
         github.com/google/gnostic-models/jsonschema                  from github.com/google/gnostic-models/compiler
         github.com/google/gnostic-models/openapiv2                   from k8s.io/client-go/discovery+
         github.com/google/gnostic-models/openapiv3                   from k8s.io/kube-openapi/pkg/handler3+
-        github.com/google/uuid                                       from github.com/prometheus-community/pro-bing+
+        github.com/google/uuid                                       from k8s.io/apimachinery/pkg/util/uuid+
         github.com/hdevalence/ed25519consensus                       from tailscale.com/tka
         github.com/huin/goupnp                                       from github.com/huin/goupnp/dcps/internetgateway2+
         github.com/huin/goupnp/dcps/internetgateway2                 from tailscale.com/net/portmapper
@@ -164,7 +93,6 @@ tailscale.com/cmd/k8s-operator dependencies: (generated by github.com/tailscale/
         github.com/pires/go-proxyproto                               from tailscale.com/ipn/ipnlocal+
         github.com/pkg/errors                                        from github.com/evanphx/json-patch/v5+
         github.com/pmezard/go-difflib/difflib                        from k8s.io/apimachinery/pkg/util/diff
-   D    github.com/prometheus-community/pro-bing                     from tailscale.com/wgengine/netstack
         github.com/prometheus/client_golang/internal/github.com/golang/gddo/httputil from github.com/prometheus/client_golang/prometheus/promhttp
         github.com/prometheus/client_golang/internal/github.com/golang/gddo/httputil/header from github.com/prometheus/client_golang/internal/github.com/golang/gddo/httputil
      💣 github.com/prometheus/client_golang/prometheus               from github.com/prometheus/client_golang/prometheus/collectors+
@@ -180,7 +108,7 @@ tailscale.com/cmd/k8s-operator dependencies: (generated by github.com/tailscale/
   LD    github.com/prometheus/procfs/internal/util                   from github.com/prometheus/procfs
    L 💣 github.com/safchain/ethtool                                  from tailscale.com/net/netkernelconf
         github.com/spf13/pflag                                       from k8s.io/client-go/tools/clientcmd+
-   W 💣 github.com/tailscale/certstore                               from tailscale.com/control/controlclient
+  DW 💣 github.com/tailscale/certstore                               from tailscale.com/control/controlclient
    W 💣 github.com/tailscale/go-winio                                from tailscale.com/safesocket
    W 💣 github.com/tailscale/go-winio/internal/fs                    from github.com/tailscale/go-winio
    W 💣 github.com/tailscale/go-winio/internal/socket                from github.com/tailscale/go-winio
@@ -802,22 +730,23 @@ tailscale.com/cmd/k8s-operator dependencies: (generated by github.com/tailscale/
         tailscale.com/envknob                                        from tailscale.com/client/local+
         tailscale.com/envknob/featureknob                            from tailscale.com/client/web+
         tailscale.com/feature                                        from tailscale.com/ipn/ipnext+
+        tailscale.com/feature/acme                                   from tailscale.com/tsnet
         tailscale.com/feature/buildfeatures                          from tailscale.com/wgengine/magicsock+
         tailscale.com/feature/c2n                                    from tailscale.com/tsnet
         tailscale.com/feature/condlite/expvar                        from tailscale.com/wgengine/magicsock
-        tailscale.com/feature/condregister/identityfederation        from tailscale.com/tsnet
+        tailscale.com/feature/condregister/netlog                    from tailscale.com/tsnet
         tailscale.com/feature/condregister/oauthkey                  from tailscale.com/tsnet
         tailscale.com/feature/condregister/portmapper                from tailscale.com/tsnet
         tailscale.com/feature/condregister/useproxy                  from tailscale.com/tsnet
-        tailscale.com/feature/identityfederation                     from tailscale.com/feature/condregister/identityfederation
+        tailscale.com/feature/netlog                                 from tailscale.com/feature/condregister/netlog
         tailscale.com/feature/oauthkey                               from tailscale.com/feature/condregister/oauthkey
         tailscale.com/feature/portmapper                             from tailscale.com/feature/condregister/portmapper
-        tailscale.com/feature/syspolicy                              from tailscale.com/logpolicy
+        tailscale.com/feature/serviceclientprefs/serviceclient       from tailscale.com/client/local
         tailscale.com/feature/useproxy                               from tailscale.com/feature/condregister/useproxy
         tailscale.com/health                                         from tailscale.com/control/controlclient+
         tailscale.com/health/healthmsg                               from tailscale.com/ipn/ipnlocal
         tailscale.com/hostinfo                                       from tailscale.com/client/web+
-        tailscale.com/internal/client/tailscale                      from tailscale.com/feature/identityfederation+
+        tailscale.com/internal/client/tailscale                      from tailscale.com/feature/oauthkey+
         tailscale.com/ipn                                            from tailscale.com/client/local+
         tailscale.com/ipn/conffile                                   from tailscale.com/ipn/ipnlocal+
      💣 tailscale.com/ipn/ipnauth                                    from tailscale.com/ipn/ipnlocal+
@@ -826,16 +755,18 @@ tailscale.com/cmd/k8s-operator dependencies: (generated by github.com/tailscale/
         tailscale.com/ipn/ipnlocal/netmapcache                       from tailscale.com/ipn/ipnlocal
         tailscale.com/ipn/ipnstate                                   from tailscale.com/client/local+
         tailscale.com/ipn/localapi                                   from tailscale.com/tsnet
-        tailscale.com/ipn/store                                      from tailscale.com/ipn/ipnlocal+
+        tailscale.com/ipn/store                                      from tailscale.com/ipn/store/kubestore+
         tailscale.com/ipn/store/kubestore                            from tailscale.com/cmd/k8s-operator
         tailscale.com/ipn/store/mem                                  from tailscale.com/ipn/ipnlocal+
         tailscale.com/k8s-operator                                   from tailscale.com/cmd/k8s-operator+
         tailscale.com/k8s-operator/api-proxy                         from tailscale.com/cmd/k8s-operator
         tailscale.com/k8s-operator/apis                              from tailscale.com/k8s-operator/apis/v1alpha1
         tailscale.com/k8s-operator/apis/v1alpha1                     from tailscale.com/cmd/k8s-operator+
-        tailscale.com/k8s-operator/reconciler                        from tailscale.com/k8s-operator/reconciler/tailnet
+        tailscale.com/k8s-operator/reconciler                        from tailscale.com/k8s-operator/reconciler/tailnet+
+        tailscale.com/k8s-operator/reconciler/peerrelay              from tailscale.com/cmd/k8s-operator
         tailscale.com/k8s-operator/reconciler/proxygrouppolicy       from tailscale.com/cmd/k8s-operator
         tailscale.com/k8s-operator/reconciler/tailnet                from tailscale.com/cmd/k8s-operator
+        tailscale.com/k8s-operator/reconciler/tailscaled             from tailscale.com/k8s-operator/reconciler/peerrelay
         tailscale.com/k8s-operator/sessionrecording                  from tailscale.com/k8s-operator/api-proxy
         tailscale.com/k8s-operator/sessionrecording/spdy             from tailscale.com/k8s-operator/sessionrecording
         tailscale.com/k8s-operator/sessionrecording/tsrecorder       from tailscale.com/k8s-operator/sessionrecording+
@@ -856,7 +787,6 @@ tailscale.com/cmd/k8s-operator dependencies: (generated by github.com/tailscale/
         tailscale.com/metrics                                        from tailscale.com/tsweb+
         tailscale.com/net/bakedroots                                 from tailscale.com/net/tlsdial+
      💣 tailscale.com/net/batching                                   from tailscale.com/wgengine/magicsock
-        tailscale.com/net/captivedetection                           from tailscale.com/ipn/ipnlocal+
         tailscale.com/net/dns                                        from tailscale.com/ipn/ipnlocal+
         tailscale.com/net/dns/publicdns                              from tailscale.com/net/dns+
         tailscale.com/net/dns/resolvconffile                         from tailscale.com/cmd/k8s-operator+
@@ -867,7 +797,7 @@ tailscale.com/cmd/k8s-operator dependencies: (generated by github.com/tailscale/
         tailscale.com/net/ipset                                      from tailscale.com/ipn/ipnlocal+
         tailscale.com/net/memnet                                     from tailscale.com/tsnet
         tailscale.com/net/netaddr                                    from tailscale.com/ipn+
-        tailscale.com/net/netcheck                                   from tailscale.com/ipn/ipnlocal+
+        tailscale.com/net/netcheck                                   from tailscale.com/wgengine/magicsock
         tailscale.com/net/neterror                                   from tailscale.com/net/dns/resolver+
         tailscale.com/net/netkernelconf                              from tailscale.com/ipn/ipnlocal
         tailscale.com/net/netknob                                    from tailscale.com/logpolicy+
@@ -881,12 +811,16 @@ tailscale.com/cmd/k8s-operator dependencies: (generated by github.com/tailscale/
         tailscale.com/net/portmapper                                 from tailscale.com/feature/portmapper
         tailscale.com/net/portmapper/portmappertype                  from tailscale.com/net/netcheck+
         tailscale.com/net/proxymux                                   from tailscale.com/tsnet
+        tailscale.com/net/routecheck                                 from tailscale.com/client/local+
+        tailscale.com/net/routecheck/peernode                        from tailscale.com/ipn/ipnlocal+
+        tailscale.com/net/routemanager                               from tailscale.com/ipn/ipnlocal+
      💣 tailscale.com/net/sockopts                                   from tailscale.com/wgengine/magicsock
         tailscale.com/net/socks5                                     from tailscale.com/tsnet
         tailscale.com/net/sockstats                                  from tailscale.com/control/controlclient+
         tailscale.com/net/stun                                       from tailscale.com/ipn/localapi+
         tailscale.com/net/tlsdial                                    from tailscale.com/control/controlclient+
         tailscale.com/net/tlsdial/blockblame                         from tailscale.com/net/tlsdial
+        tailscale.com/net/traffic                                    from tailscale.com/ipn/ipnlocal+
         tailscale.com/net/tsaddr                                     from tailscale.com/client/web+
         tailscale.com/net/tsdial                                     from tailscale.com/control/controlclient+
      💣 tailscale.com/net/tshttpproxy                                from tailscale.com/feature/useproxy
@@ -900,7 +834,7 @@ tailscale.com/cmd/k8s-operator dependencies: (generated by github.com/tailscale/
         tailscale.com/sessionrecording                               from tailscale.com/k8s-operator/sessionrecording+
         tailscale.com/syncs                                          from tailscale.com/control/controlknobs+
         tailscale.com/tailcfg                                        from tailscale.com/client/local+
-        tailscale.com/tempfork/acme                                  from tailscale.com/ipn/ipnlocal
+        tailscale.com/tempfork/acme                                  from tailscale.com/feature/acme
         tailscale.com/tempfork/heap                                  from tailscale.com/wgengine/magicsock
         tailscale.com/tempfork/httprec                               from tailscale.com/feature/c2n
         tailscale.com/tka                                            from tailscale.com/client/local+
@@ -910,7 +844,7 @@ tailscale.com/cmd/k8s-operator dependencies: (generated by github.com/tailscale/
         tailscale.com/tstime                                         from tailscale.com/cmd/k8s-operator+
         tailscale.com/tstime/mono                                    from tailscale.com/net/tstun+
         tailscale.com/tstime/rate                                    from tailscale.com/wgengine/filter
-        tailscale.com/tsweb                                          from tailscale.com/util/eventbus
+        tailscale.com/tsweb                                          from tailscale.com/util/eventbus+
         tailscale.com/tsweb/varz                                     from tailscale.com/util/usermetric+
         tailscale.com/types/appctype                                 from tailscale.com/ipn/ipnlocal+
         tailscale.com/types/bools                                    from tailscale.com/tsnet+
@@ -922,7 +856,7 @@ tailscale.com/cmd/k8s-operator dependencies: (generated by github.com/tailscale/
         tailscale.com/types/lazy                                     from tailscale.com/ipn/ipnlocal+
         tailscale.com/types/logger                                   from tailscale.com/appc+
         tailscale.com/types/logid                                    from tailscale.com/ipn/ipnlocal+
-        tailscale.com/types/mapx                                     from tailscale.com/ipn/ipnext
+        tailscale.com/types/mapx                                     from tailscale.com/ipn/ipnext+
         tailscale.com/types/netlogfunc                               from tailscale.com/net/tstun+
         tailscale.com/types/netlogtype                               from tailscale.com/wgengine/netlog
         tailscale.com/types/netmap                                   from tailscale.com/control/controlclient+
@@ -944,6 +878,7 @@ tailscale.com/cmd/k8s-operator dependencies: (generated by github.com/tailscale/
   LW    tailscale.com/util/cmpver                                    from tailscale.com/net/dns+
         tailscale.com/util/ctxkey                                    from tailscale.com/client/tailscale/apitype+
      💣 tailscale.com/util/deephash                                  from tailscale.com/util/syspolicy/setting
+        tailscale.com/util/def                                       from tailscale.com/ipn/localapi
    L 💣 tailscale.com/util/dirwalk                                   from tailscale.com/metrics
         tailscale.com/util/dnsname                                   from tailscale.com/appc+
         tailscale.com/util/eventbus                                  from tailscale.com/tsd+
@@ -966,16 +901,15 @@ tailscale.com/cmd/k8s-operator dependencies: (generated by github.com/tailscale/
         tailscale.com/util/set                                       from tailscale.com/cmd/k8s-operator+
         tailscale.com/util/singleflight                              from tailscale.com/control/controlclient+
         tailscale.com/util/slicesx                                   from tailscale.com/appc+
-        tailscale.com/util/syspolicy                                 from tailscale.com/feature/syspolicy
         tailscale.com/util/syspolicy/internal                        from tailscale.com/util/syspolicy/setting+
         tailscale.com/util/syspolicy/internal/loggerx                from tailscale.com/util/syspolicy/internal/metrics+
         tailscale.com/util/syspolicy/internal/metrics                from tailscale.com/util/syspolicy/source
         tailscale.com/util/syspolicy/pkey                            from tailscale.com/control/controlclient+
         tailscale.com/util/syspolicy/policyclient                    from tailscale.com/control/controlclient+
-        tailscale.com/util/syspolicy/ptype                           from tailscale.com/util/syspolicy+
-        tailscale.com/util/syspolicy/rsop                            from tailscale.com/util/syspolicy+
-        tailscale.com/util/syspolicy/setting                         from tailscale.com/util/syspolicy+
-        tailscale.com/util/syspolicy/source                          from tailscale.com/util/syspolicy+
+        tailscale.com/util/syspolicy/ptype                           from tailscale.com/ipn/ipnlocal+
+        tailscale.com/util/syspolicy/rsop                            from tailscale.com/ipn/localapi
+        tailscale.com/util/syspolicy/setting                         from tailscale.com/client/local+
+        tailscale.com/util/syspolicy/source                          from tailscale.com/util/syspolicy/rsop
         tailscale.com/util/testenv                                   from tailscale.com/control/controlclient+
         tailscale.com/util/truncate                                  from tailscale.com/logtail
         tailscale.com/util/usermetric                                from tailscale.com/health+
@@ -992,15 +926,13 @@ tailscale.com/cmd/k8s-operator dependencies: (generated by github.com/tailscale/
         tailscale.com/wgengine/filter                                from tailscale.com/control/controlclient+
         tailscale.com/wgengine/filter/filtertype                     from tailscale.com/types/netmap+
      💣 tailscale.com/wgengine/magicsock                             from tailscale.com/ipn/ipnlocal+
-        tailscale.com/wgengine/netlog                                from tailscale.com/wgengine
+        tailscale.com/wgengine/netlog                                from tailscale.com/feature/netlog
         tailscale.com/wgengine/netstack                              from tailscale.com/tsnet
         tailscale.com/wgengine/netstack/gro                          from tailscale.com/net/tstun+
         tailscale.com/wgengine/router                                from tailscale.com/ipn/ipnlocal+
         tailscale.com/wgengine/wgcfg                                 from tailscale.com/ipn/ipnlocal+
-        tailscale.com/wgengine/wgcfg/nmcfg                           from tailscale.com/ipn/ipnlocal
      💣 tailscale.com/wgengine/wgint                                 from tailscale.com/wgengine+
         tailscale.com/wgengine/wglog                                 from tailscale.com/wgengine
-        tailscale.com/wif                                            from tailscale.com/feature/identityfederation
         golang.org/x/crypto/argon2                                   from tailscale.com/tka
         golang.org/x/crypto/blake2b                                  from golang.org/x/crypto/argon2+
         golang.org/x/crypto/blake2s                                  from github.com/tailscale/wireguard-go/device+
@@ -1023,19 +955,20 @@ tailscale.com/cmd/k8s-operator dependencies: (generated by github.com/tailscale/
         golang.org/x/net/http/httpproxy                              from tailscale.com/net/tshttpproxy
         golang.org/x/net/http2                                       from k8s.io/apimachinery/pkg/util/net+
         golang.org/x/net/http2/hpack                                 from golang.org/x/net/http2+
-        golang.org/x/net/icmp                                        from github.com/prometheus-community/pro-bing+
+        golang.org/x/net/icmp                                        from tailscale.com/net/ping
         golang.org/x/net/idna                                        from golang.org/x/net/http/httpguts+
         golang.org/x/net/internal/httpcommon                         from golang.org/x/net/http2
+        golang.org/x/net/internal/httpsfv                            from golang.org/x/net/http2
         golang.org/x/net/internal/iana                               from golang.org/x/net/icmp+
-        golang.org/x/net/internal/socket                             from golang.org/x/net/icmp+
+        golang.org/x/net/internal/socket                             from golang.org/x/net/ipv4+
         golang.org/x/net/internal/socks                              from golang.org/x/net/proxy
-        golang.org/x/net/ipv4                                        from github.com/prometheus-community/pro-bing+
-        golang.org/x/net/ipv6                                        from github.com/prometheus-community/pro-bing+
+        golang.org/x/net/ipv4                                        from github.com/tailscale/wireguard-go/conn+
+        golang.org/x/net/ipv6                                        from github.com/tailscale/wireguard-go/conn+
         golang.org/x/net/proxy                                       from tailscale.com/net/netns
    D    golang.org/x/net/route                                       from tailscale.com/net/netmon+
         golang.org/x/net/websocket                                   from tailscale.com/k8s-operator/sessionrecording/ws
         golang.org/x/oauth2                                          from golang.org/x/oauth2/clientcredentials+
-        golang.org/x/oauth2/clientcredentials                        from tailscale.com/cmd/k8s-operator+
+        golang.org/x/oauth2/clientcredentials                        from tailscale.com/client/tailscale/v2+
         golang.org/x/oauth2/internal                                 from golang.org/x/oauth2+
         golang.org/x/sync/errgroup                                   from github.com/mdlayher/socket+
         golang.org/x/sys/cpu                                         from github.com/tailscale/certstore+
@@ -1092,22 +1025,22 @@ tailscale.com/cmd/k8s-operator dependencies: (generated by github.com/tailscale/
         crypto/internal/boring/bbig                                  from crypto/ecdsa+
         crypto/internal/boring/sig                                   from crypto/internal/boring
         crypto/internal/constanttime                                 from crypto/internal/fips140/edwards25519+
-        crypto/internal/fips140                                      from crypto/internal/fips140/aes+
+        crypto/internal/fips140                                      from crypto/fips140+
         crypto/internal/fips140/aes                                  from crypto/aes+
         crypto/internal/fips140/aes/gcm                              from crypto/cipher+
         crypto/internal/fips140/alias                                from crypto/cipher+
         crypto/internal/fips140/bigmod                               from crypto/internal/fips140/ecdsa+
-        crypto/internal/fips140/check                                from crypto/internal/fips140/aes+
-        crypto/internal/fips140/drbg                                 from crypto/internal/fips140/aes/gcm+
+        crypto/internal/fips140/check                                from crypto/fips140+
+        crypto/internal/fips140/drbg                                 from crypto/hpke+
         crypto/internal/fips140/ecdh                                 from crypto/ecdh
         crypto/internal/fips140/ecdsa                                from crypto/ecdsa
         crypto/internal/fips140/ed25519                              from crypto/ed25519
         crypto/internal/fips140/edwards25519                         from crypto/internal/fips140/ed25519
         crypto/internal/fips140/edwards25519/field                   from crypto/ecdh+
-        crypto/internal/fips140/hkdf                                 from crypto/internal/fips140/tls13+
+        crypto/internal/fips140/hkdf                                 from crypto/hkdf+
         crypto/internal/fips140/hmac                                 from crypto/hmac+
         crypto/internal/fips140/mlkem                                from crypto/mlkem
-        crypto/internal/fips140/nistec                               from crypto/elliptic+
+        crypto/internal/fips140/nistec                               from crypto/ecdsa+
         crypto/internal/fips140/nistec/fiat                          from crypto/internal/fips140/nistec
         crypto/internal/fips140/rsa                                  from crypto/rsa
         crypto/internal/fips140/sha256                               from crypto/internal/fips140/check+
@@ -1137,7 +1070,7 @@ tailscale.com/cmd/k8s-operator dependencies: (generated by github.com/tailscale/
         crypto/sha3                                                  from crypto/internal/fips140hash+
         crypto/sha512                                                from crypto/ecdsa+
         crypto/subtle                                                from crypto/cipher+
-        crypto/tls                                                   from github.com/prometheus-community/pro-bing+
+        crypto/tls                                                   from github.com/prometheus/client_golang/prometheus/promhttp+
         crypto/tls/internal/fips140tls                               from crypto/tls
         crypto/x509                                                  from crypto/tls+
    D    crypto/x509/internal/macos                                   from crypto/x509
@@ -1172,7 +1105,7 @@ tailscale.com/cmd/k8s-operator dependencies: (generated by github.com/tailscale/
         hash                                                         from compress/zlib+
         hash/adler32                                                 from compress/zlib
         hash/crc32                                                   from compress/gzip+
-        hash/fnv                                                     from google.golang.org/protobuf/internal/detrand
+        hash/fnv                                                     from google.golang.org/protobuf/internal/detrand+
         hash/maphash                                                 from go4.org/mem
         html                                                         from html/template+
         html/template                                                from tailscale.com/util/eventbus
@@ -1187,14 +1120,14 @@ tailscale.com/cmd/k8s-operator dependencies: (generated by github.com/tailscale/
         internal/filepathlite                                        from os+
         internal/fmtsort                                             from fmt+
         internal/goarch                                              from crypto/internal/fips140deps/cpu+
-        internal/godebug                                             from crypto/internal/fips140deps/godebug+
+        internal/godebug                                             from crypto/ed25519+
         internal/godebugs                                            from internal/godebug+
         internal/goexperiment                                        from net/http/pprof+
         internal/goos                                                from crypto/x509+
         internal/lazyregexp                                          from go/doc
         internal/msan                                                from internal/runtime/maps+
         internal/nettrace                                            from net+
-        internal/oserror                                             from io/fs+
+        internal/oserror                                             from internal/syscall/windows+
         internal/poll                                                from net+
         internal/profile                                             from net/http/pprof
         internal/profilerecord                                       from runtime+
@@ -1204,9 +1137,9 @@ tailscale.com/cmd/k8s-operator dependencies: (generated by github.com/tailscale/
         internal/runtime/atomic                                      from internal/runtime/exithook+
    L    internal/runtime/cgroup                                      from runtime
         internal/runtime/exithook                                    from runtime
-        internal/runtime/gc                                          from runtime+
+        internal/runtime/gc                                          from internal/runtime/gc/scan+
         internal/runtime/gc/scan                                     from runtime
-        internal/runtime/maps                                        from reflect+
+        internal/runtime/maps                                        from hash/maphash+
         internal/runtime/math                                        from internal/runtime/maps+
         internal/runtime/pprof/label                                 from runtime+
         internal/runtime/sys                                         from crypto/subtle+
@@ -1220,7 +1153,7 @@ tailscale.com/cmd/k8s-operator dependencies: (generated by github.com/tailscale/
         internal/synctest                                            from sync
         internal/syscall/execenv                                     from os+
   LD    internal/syscall/unix                                        from crypto/internal/sysrand+
-   W    internal/syscall/windows                                     from crypto/internal/sysrand+
+   W    internal/syscall/windows                                     from crypto/internal/fips140deps/time+
    W    internal/syscall/windows/registry                            from mime+
    W    internal/syscall/windows/sysdll                              from internal/syscall/windows+
         internal/testlog                                             from os
@@ -1228,7 +1161,7 @@ tailscale.com/cmd/k8s-operator dependencies: (generated by github.com/tailscale/
         internal/unsafeheader                                        from internal/reflectlite+
         io                                                           from bufio+
         io/fs                                                        from crypto/x509+
-        io/ioutil                                                    from github.com/godbus/dbus/v5+
+        io/ioutil                                                    from github.com/google/gnostic-models/compiler+
         iter                                                         from go/ast+
         log                                                          from expvar+
         log/internal                                                 from log+
@@ -1246,7 +1179,7 @@ tailscale.com/cmd/k8s-operator dependencies: (generated by github.com/tailscale/
         mime/quotedprintable                                         from mime/multipart
         net                                                          from crypto/tls+
         net/http                                                     from expvar+
-        net/http/httptrace                                           from github.com/prometheus-community/pro-bing+
+        net/http/httptrace                                           from github.com/prometheus/client_golang/prometheus/promhttp+
         net/http/httputil                                            from tailscale.com/client/web+
         net/http/internal                                            from net/http+
         net/http/internal/ascii                                      from net/http+
@@ -1265,7 +1198,7 @@ tailscale.com/cmd/k8s-operator dependencies: (generated by github.com/tailscale/
         regexp                                                       from github.com/davecgh/go-spew/spew+
         regexp/syntax                                                from regexp
         runtime                                                      from crypto/internal/fips140+
-        runtime/debug                                                from github.com/coder/websocket/internal/xsync+
+        runtime/debug                                                from github.com/klauspost/compress/zstd+
         runtime/metrics                                              from github.com/prometheus/client_golang/prometheus+
         runtime/pprof                                                from net/http/pprof+
         runtime/trace                                                from net/http/pprof
diff --git a/cmd/k8s-operator/deploy/chart/templates/.gitignore b/cmd/k8s-operator/deploy/chart/templates/.gitignore
index 185ea9e2b..ccdea8702 100644
--- a/cmd/k8s-operator/deploy/chart/templates/.gitignore
+++ b/cmd/k8s-operator/deploy/chart/templates/.gitignore
@@ -10,3 +10,4 @@
 /recorder.yaml
 /tailnet.yaml 
 /proxygrouppolicy.yaml
+/peerrelay.yaml
diff --git a/cmd/k8s-operator/deploy/chart/templates/deployment.yaml b/cmd/k8s-operator/deploy/chart/templates/deployment.yaml
index 0c0cb64cb..d8c3803d5 100644
--- a/cmd/k8s-operator/deploy/chart/templates/deployment.yaml
+++ b/cmd/k8s-operator/deploy/chart/templates/deployment.yaml
@@ -6,6 +6,9 @@ kind: Deployment
 metadata:
   name: operator
   namespace: {{ .Release.Namespace }}
+  {{- if .Values.annotations }}
+  annotations: {{- toYaml .Values.annotations | nindent 4 }}
+  {{- end }}
 spec:
   replicas: 1
   strategy:
@@ -78,6 +81,10 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: metadata.namespace
+            - name: OPERATOR_SERVICE_ACCOUNT_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.serviceAccountName
             - name: OPERATOR_LOGIN_SERVER
               value: {{ .Values.loginServer }}
             - name: OPERATOR_INGRESS_CLASS_NAME
@@ -117,6 +124,8 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: metadata.uid
+            - name: OPERATOR_SHARED_ACME_ACCOUNT_KEY
+              value: {{ .Values.operatorConfig.sharedACMEAccountKey | quote }}
             {{- with .Values.operatorConfig.extraEnv }}
             {{- toYaml . | nindent 12 }}
             {{- end }}
@@ -146,3 +155,6 @@ spec:
       tolerations:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- with .Values.operatorConfig.priorityClassName }}
+      priorityClassName: {{ . }}
+      {{- end }}
diff --git a/cmd/k8s-operator/deploy/chart/templates/operator-rbac.yaml b/cmd/k8s-operator/deploy/chart/templates/operator-rbac.yaml
index 4d59b4aad..847109c40 100644
--- a/cmd/k8s-operator/deploy/chart/templates/operator-rbac.yaml
+++ b/cmd/k8s-operator/deploy/chart/templates/operator-rbac.yaml
@@ -40,6 +40,9 @@ rules:
 - apiGroups: ["tailscale.com"]
   resources: ["tailnets", "tailnets/status"]
   verbs: ["get", "list", "watch", "update"]
+- apiGroups: ["tailscale.com"]
+  resources: ["peerrelays", "peerrelays/status"]
+  verbs: ["get", "list", "watch", "update"]
 - apiGroups: ["tailscale.com"]
   resources: ["proxygrouppolicies", "proxygrouppolicies/status"]
   verbs: ["get", "list", "watch", "update"]
@@ -76,6 +79,10 @@ rules:
 - apiGroups: [""]
   resources: ["secrets", "serviceaccounts", "configmaps"]
   verbs: ["create","delete","deletecollection","get","list","patch","update","watch"]
+- apiGroups: [""]
+  resources: ["serviceaccounts/token"]
+  resourceNames: ["operator"]
+  verbs: ["create"]
 - apiGroups: [""]
   resources: ["pods"]
   verbs: ["get","list","watch", "update"]
diff --git a/cmd/k8s-operator/deploy/chart/values.yaml b/cmd/k8s-operator/deploy/chart/values.yaml
index 8517d77aa..6cb0628dd 100644
--- a/cmd/k8s-operator/deploy/chart/values.yaml
+++ b/cmd/k8s-operator/deploy/chart/values.yaml
@@ -62,6 +62,9 @@ operatorConfig:
 
   resources: {}
 
+  # Specifies annotations for deployment
+  annotations: {}
+
   podAnnotations: {}
   podLabels: {}
 
@@ -72,6 +75,8 @@ operatorConfig:
 
   affinity: {}
 
+  priorityClassName: ""
+
   podSecurityContext: {}
 
   securityContext: {}
@@ -82,6 +87,13 @@ operatorConfig:
   # - name: EXTRA_VAR2
   #   value: "value2"
 
+  # Default for the tailscale.com/share-acme-account annotation on new
+  # ProxyGroups. When true, the operator provisions a shared per-tailnet
+  # ACME account key Secret and configures proxies to use it, preserving
+  # Let's Encrypt's ARI "replaces" renewal exemption across pod restarts
+  # and ProxyGroup recreation. See #18251.
+  sharedACMEAccountKey: false
+
 # In the case that you already have a tailscale ingressclass in your cluster (or vcluster), you can disable the creation here
 ingressClass:
   # Allows for customization of the ingress class name used by the operator to identify ingresses to reconcile. This does
diff --git a/cmd/k8s-operator/deploy/crds/tailscale.com_dnsconfigs.yaml b/cmd/k8s-operator/deploy/crds/tailscale.com_dnsconfigs.yaml
index a819aa651..4d6422ede 100644
--- a/cmd/k8s-operator/deploy/crds/tailscale.com_dnsconfigs.yaml
+++ b/cmd/k8s-operator/deploy/crds/tailscale.com_dnsconfigs.yaml
@@ -104,6 +104,884 @@ spec:
                       description: Pod configuration.
                       type: object
                       properties:
+                        affinity:
+                          description: If specified, applies affinity rules to the pods deployed by the DNSConfig resource.
+                          type: object
+                          properties:
+                            nodeAffinity:
+                              description: Describes node affinity scheduling rules for the pod.
+                              type: object
+                              properties:
+                                preferredDuringSchedulingIgnoredDuringExecution:
+                                  description: |-
+                                    The scheduler will prefer to schedule pods to nodes that satisfy
+                                    the affinity expressions specified by this field, but it may choose
+                                    a node that violates one or more of the expressions. The node that is
+                                    most preferred is the one with the greatest sum of weights, i.e.
+                                    for each node that meets all of the scheduling requirements (resource
+                                    request, requiredDuringScheduling affinity expressions, etc.),
+                                    compute a sum by iterating through the elements of this field and adding
+                                    "weight" to the sum if the node matches the corresponding matchExpressions; the
+                                    node(s) with the highest sum are the most preferred.
+                                  type: array
+                                  items:
+                                    description: |-
+                                      An empty preferred scheduling term matches all objects with implicit weight 0
+                                      (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
+                                    type: object
+                                    required:
+                                      - preference
+                                      - weight
+                                    properties:
+                                      preference:
+                                        description: A node selector term, associated with the corresponding weight.
+                                        type: object
+                                        properties:
+                                          matchExpressions:
+                                            description: A list of node selector requirements by node's labels.
+                                            type: array
+                                            items:
+                                              description: |-
+                                                A node selector requirement is a selector that contains values, a key, and an operator
+                                                that relates the key and values.
+                                              type: object
+                                              required:
+                                                - key
+                                                - operator
+                                              properties:
+                                                key:
+                                                  description: The label key that the selector applies to.
+                                                  type: string
+                                                operator:
+                                                  description: |-
+                                                    Represents a key's relationship to a set of values.
+                                                    Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                  type: string
+                                                values:
+                                                  description: |-
+                                                    An array of string values. If the operator is In or NotIn,
+                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                    the values array must be empty. If the operator is Gt or Lt, the values
+                                                    array must have a single element, which will be interpreted as an integer.
+                                                    This array is replaced during a strategic merge patch.
+                                                  type: array
+                                                  items:
+                                                    type: string
+                                                  x-kubernetes-list-type: atomic
+                                            x-kubernetes-list-type: atomic
+                                          matchFields:
+                                            description: A list of node selector requirements by node's fields.
+                                            type: array
+                                            items:
+                                              description: |-
+                                                A node selector requirement is a selector that contains values, a key, and an operator
+                                                that relates the key and values.
+                                              type: object
+                                              required:
+                                                - key
+                                                - operator
+                                              properties:
+                                                key:
+                                                  description: The label key that the selector applies to.
+                                                  type: string
+                                                operator:
+                                                  description: |-
+                                                    Represents a key's relationship to a set of values.
+                                                    Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                  type: string
+                                                values:
+                                                  description: |-
+                                                    An array of string values. If the operator is In or NotIn,
+                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                    the values array must be empty. If the operator is Gt or Lt, the values
+                                                    array must have a single element, which will be interpreted as an integer.
+                                                    This array is replaced during a strategic merge patch.
+                                                  type: array
+                                                  items:
+                                                    type: string
+                                                  x-kubernetes-list-type: atomic
+                                            x-kubernetes-list-type: atomic
+                                        x-kubernetes-map-type: atomic
+                                      weight:
+                                        description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
+                                        type: integer
+                                        format: int32
+                                  x-kubernetes-list-type: atomic
+                                requiredDuringSchedulingIgnoredDuringExecution:
+                                  description: |-
+                                    If the affinity requirements specified by this field are not met at
+                                    scheduling time, the pod will not be scheduled onto the node.
+                                    If the affinity requirements specified by this field cease to be met
+                                    at some point during pod execution (e.g. due to an update), the system
+                                    may or may not try to eventually evict the pod from its node.
+                                  type: object
+                                  required:
+                                    - nodeSelectorTerms
+                                  properties:
+                                    nodeSelectorTerms:
+                                      description: Required. A list of node selector terms. The terms are ORed.
+                                      type: array
+                                      items:
+                                        description: |-
+                                          A null or empty node selector term matches no objects. The requirements of
+                                          them are ANDed.
+                                          The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
+                                        type: object
+                                        properties:
+                                          matchExpressions:
+                                            description: A list of node selector requirements by node's labels.
+                                            type: array
+                                            items:
+                                              description: |-
+                                                A node selector requirement is a selector that contains values, a key, and an operator
+                                                that relates the key and values.
+                                              type: object
+                                              required:
+                                                - key
+                                                - operator
+                                              properties:
+                                                key:
+                                                  description: The label key that the selector applies to.
+                                                  type: string
+                                                operator:
+                                                  description: |-
+                                                    Represents a key's relationship to a set of values.
+                                                    Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                  type: string
+                                                values:
+                                                  description: |-
+                                                    An array of string values. If the operator is In or NotIn,
+                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                    the values array must be empty. If the operator is Gt or Lt, the values
+                                                    array must have a single element, which will be interpreted as an integer.
+                                                    This array is replaced during a strategic merge patch.
+                                                  type: array
+                                                  items:
+                                                    type: string
+                                                  x-kubernetes-list-type: atomic
+                                            x-kubernetes-list-type: atomic
+                                          matchFields:
+                                            description: A list of node selector requirements by node's fields.
+                                            type: array
+                                            items:
+                                              description: |-
+                                                A node selector requirement is a selector that contains values, a key, and an operator
+                                                that relates the key and values.
+                                              type: object
+                                              required:
+                                                - key
+                                                - operator
+                                              properties:
+                                                key:
+                                                  description: The label key that the selector applies to.
+                                                  type: string
+                                                operator:
+                                                  description: |-
+                                                    Represents a key's relationship to a set of values.
+                                                    Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                  type: string
+                                                values:
+                                                  description: |-
+                                                    An array of string values. If the operator is In or NotIn,
+                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                    the values array must be empty. If the operator is Gt or Lt, the values
+                                                    array must have a single element, which will be interpreted as an integer.
+                                                    This array is replaced during a strategic merge patch.
+                                                  type: array
+                                                  items:
+                                                    type: string
+                                                  x-kubernetes-list-type: atomic
+                                            x-kubernetes-list-type: atomic
+                                        x-kubernetes-map-type: atomic
+                                      x-kubernetes-list-type: atomic
+                                  x-kubernetes-map-type: atomic
+                            podAffinity:
+                              description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
+                              type: object
+                              properties:
+                                preferredDuringSchedulingIgnoredDuringExecution:
+                                  description: |-
+                                    The scheduler will prefer to schedule pods to nodes that satisfy
+                                    the affinity expressions specified by this field, but it may choose
+                                    a node that violates one or more of the expressions. The node that is
+                                    most preferred is the one with the greatest sum of weights, i.e.
+                                    for each node that meets all of the scheduling requirements (resource
+                                    request, requiredDuringScheduling affinity expressions, etc.),
+                                    compute a sum by iterating through the elements of this field and adding
+                                    "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                    node(s) with the highest sum are the most preferred.
+                                  type: array
+                                  items:
+                                    description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
+                                    type: object
+                                    required:
+                                      - podAffinityTerm
+                                      - weight
+                                    properties:
+                                      podAffinityTerm:
+                                        description: Required. A pod affinity term, associated with the corresponding weight.
+                                        type: object
+                                        required:
+                                          - topologyKey
+                                        properties:
+                                          labelSelector:
+                                            description: |-
+                                              A label query over a set of resources, in this case pods.
+                                              If it's null, this PodAffinityTerm matches with no Pods.
+                                            type: object
+                                            properties:
+                                              matchExpressions:
+                                                description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                type: array
+                                                items:
+                                                  description: |-
+                                                    A label selector requirement is a selector that contains values, a key, and an operator that
+                                                    relates the key and values.
+                                                  type: object
+                                                  required:
+                                                    - key
+                                                    - operator
+                                                  properties:
+                                                    key:
+                                                      description: key is the label key that the selector applies to.
+                                                      type: string
+                                                    operator:
+                                                      description: |-
+                                                        operator represents a key's relationship to a set of values.
+                                                        Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                      type: string
+                                                    values:
+                                                      description: |-
+                                                        values is an array of string values. If the operator is In or NotIn,
+                                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                        the values array must be empty. This array is replaced during a strategic
+                                                        merge patch.
+                                                      type: array
+                                                      items:
+                                                        type: string
+                                                      x-kubernetes-list-type: atomic
+                                                x-kubernetes-list-type: atomic
+                                              matchLabels:
+                                                description: |-
+                                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                type: object
+                                                additionalProperties:
+                                                  type: string
+                                            x-kubernetes-map-type: atomic
+                                          matchLabelKeys:
+                                            description: |-
+                                              MatchLabelKeys is a set of pod label keys to select which pods will
+                                              be taken into consideration. The keys are used to lookup values from the
+                                              incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                              to select the group of existing pods which pods will be taken into consideration
+                                              for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                              pod labels will be ignored. The default value is empty.
+                                              The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                              Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                            type: array
+                                            items:
+                                              type: string
+                                            x-kubernetes-list-type: atomic
+                                          mismatchLabelKeys:
+                                            description: |-
+                                              MismatchLabelKeys is a set of pod label keys to select which pods will
+                                              be taken into consideration. The keys are used to lookup values from the
+                                              incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                              to select the group of existing pods which pods will be taken into consideration
+                                              for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                              pod labels will be ignored. The default value is empty.
+                                              The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                              Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                            type: array
+                                            items:
+                                              type: string
+                                            x-kubernetes-list-type: atomic
+                                          namespaceSelector:
+                                            description: |-
+                                              A label query over the set of namespaces that the term applies to.
+                                              The term is applied to the union of the namespaces selected by this field
+                                              and the ones listed in the namespaces field.
+                                              null selector and null or empty namespaces list means "this pod's namespace".
+                                              An empty selector ({}) matches all namespaces.
+                                            type: object
+                                            properties:
+                                              matchExpressions:
+                                                description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                type: array
+                                                items:
+                                                  description: |-
+                                                    A label selector requirement is a selector that contains values, a key, and an operator that
+                                                    relates the key and values.
+                                                  type: object
+                                                  required:
+                                                    - key
+                                                    - operator
+                                                  properties:
+                                                    key:
+                                                      description: key is the label key that the selector applies to.
+                                                      type: string
+                                                    operator:
+                                                      description: |-
+                                                        operator represents a key's relationship to a set of values.
+                                                        Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                      type: string
+                                                    values:
+                                                      description: |-
+                                                        values is an array of string values. If the operator is In or NotIn,
+                                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                        the values array must be empty. This array is replaced during a strategic
+                                                        merge patch.
+                                                      type: array
+                                                      items:
+                                                        type: string
+                                                      x-kubernetes-list-type: atomic
+                                                x-kubernetes-list-type: atomic
+                                              matchLabels:
+                                                description: |-
+                                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                type: object
+                                                additionalProperties:
+                                                  type: string
+                                            x-kubernetes-map-type: atomic
+                                          namespaces:
+                                            description: |-
+                                              namespaces specifies a static list of namespace names that the term applies to.
+                                              The term is applied to the union of the namespaces listed in this field
+                                              and the ones selected by namespaceSelector.
+                                              null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                            type: array
+                                            items:
+                                              type: string
+                                            x-kubernetes-list-type: atomic
+                                          topologyKey:
+                                            description: |-
+                                              This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                              the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                              whose value of the label with key topologyKey matches that of any node on which any of the
+                                              selected pods is running.
+                                              Empty topologyKey is not allowed.
+                                            type: string
+                                      weight:
+                                        description: |-
+                                          weight associated with matching the corresponding podAffinityTerm,
+                                          in the range 1-100.
+                                        type: integer
+                                        format: int32
+                                  x-kubernetes-list-type: atomic
+                                requiredDuringSchedulingIgnoredDuringExecution:
+                                  description: |-
+                                    If the affinity requirements specified by this field are not met at
+                                    scheduling time, the pod will not be scheduled onto the node.
+                                    If the affinity requirements specified by this field cease to be met
+                                    at some point during pod execution (e.g. due to a pod label update), the
+                                    system may or may not try to eventually evict the pod from its node.
+                                    When there are multiple elements, the lists of nodes corresponding to each
+                                    podAffinityTerm are intersected, i.e. all terms must be satisfied.
+                                  type: array
+                                  items:
+                                    description: |-
+                                      Defines a set of pods (namely those matching the labelSelector
+                                      relative to the given namespace(s)) that this pod should be
+                                      co-located (affinity) or not co-located (anti-affinity) with,
+                                      where co-located is defined as running on a node whose value of
+                                      the label with key <topologyKey> matches that of any node on which
+                                      a pod of the set of pods is running
+                                    type: object
+                                    required:
+                                      - topologyKey
+                                    properties:
+                                      labelSelector:
+                                        description: |-
+                                          A label query over a set of resources, in this case pods.
+                                          If it's null, this PodAffinityTerm matches with no Pods.
+                                        type: object
+                                        properties:
+                                          matchExpressions:
+                                            description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                            type: array
+                                            items:
+                                              description: |-
+                                                A label selector requirement is a selector that contains values, a key, and an operator that
+                                                relates the key and values.
+                                              type: object
+                                              required:
+                                                - key
+                                                - operator
+                                              properties:
+                                                key:
+                                                  description: key is the label key that the selector applies to.
+                                                  type: string
+                                                operator:
+                                                  description: |-
+                                                    operator represents a key's relationship to a set of values.
+                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                  type: string
+                                                values:
+                                                  description: |-
+                                                    values is an array of string values. If the operator is In or NotIn,
+                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                    the values array must be empty. This array is replaced during a strategic
+                                                    merge patch.
+                                                  type: array
+                                                  items:
+                                                    type: string
+                                                  x-kubernetes-list-type: atomic
+                                            x-kubernetes-list-type: atomic
+                                          matchLabels:
+                                            description: |-
+                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                            type: object
+                                            additionalProperties:
+                                              type: string
+                                        x-kubernetes-map-type: atomic
+                                      matchLabelKeys:
+                                        description: |-
+                                          MatchLabelKeys is a set of pod label keys to select which pods will
+                                          be taken into consideration. The keys are used to lookup values from the
+                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                          to select the group of existing pods which pods will be taken into consideration
+                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                          pod labels will be ignored. The default value is empty.
+                                          The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                          Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                        type: array
+                                        items:
+                                          type: string
+                                        x-kubernetes-list-type: atomic
+                                      mismatchLabelKeys:
+                                        description: |-
+                                          MismatchLabelKeys is a set of pod label keys to select which pods will
+                                          be taken into consideration. The keys are used to lookup values from the
+                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                          to select the group of existing pods which pods will be taken into consideration
+                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                          pod labels will be ignored. The default value is empty.
+                                          The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                          Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                        type: array
+                                        items:
+                                          type: string
+                                        x-kubernetes-list-type: atomic
+                                      namespaceSelector:
+                                        description: |-
+                                          A label query over the set of namespaces that the term applies to.
+                                          The term is applied to the union of the namespaces selected by this field
+                                          and the ones listed in the namespaces field.
+                                          null selector and null or empty namespaces list means "this pod's namespace".
+                                          An empty selector ({}) matches all namespaces.
+                                        type: object
+                                        properties:
+                                          matchExpressions:
+                                            description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                            type: array
+                                            items:
+                                              description: |-
+                                                A label selector requirement is a selector that contains values, a key, and an operator that
+                                                relates the key and values.
+                                              type: object
+                                              required:
+                                                - key
+                                                - operator
+                                              properties:
+                                                key:
+                                                  description: key is the label key that the selector applies to.
+                                                  type: string
+                                                operator:
+                                                  description: |-
+                                                    operator represents a key's relationship to a set of values.
+                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                  type: string
+                                                values:
+                                                  description: |-
+                                                    values is an array of string values. If the operator is In or NotIn,
+                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                    the values array must be empty. This array is replaced during a strategic
+                                                    merge patch.
+                                                  type: array
+                                                  items:
+                                                    type: string
+                                                  x-kubernetes-list-type: atomic
+                                            x-kubernetes-list-type: atomic
+                                          matchLabels:
+                                            description: |-
+                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                            type: object
+                                            additionalProperties:
+                                              type: string
+                                        x-kubernetes-map-type: atomic
+                                      namespaces:
+                                        description: |-
+                                          namespaces specifies a static list of namespace names that the term applies to.
+                                          The term is applied to the union of the namespaces listed in this field
+                                          and the ones selected by namespaceSelector.
+                                          null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                        type: array
+                                        items:
+                                          type: string
+                                        x-kubernetes-list-type: atomic
+                                      topologyKey:
+                                        description: |-
+                                          This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                          the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                          whose value of the label with key topologyKey matches that of any node on which any of the
+                                          selected pods is running.
+                                          Empty topologyKey is not allowed.
+                                        type: string
+                                  x-kubernetes-list-type: atomic
+                            podAntiAffinity:
+                              description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
+                              type: object
+                              properties:
+                                preferredDuringSchedulingIgnoredDuringExecution:
+                                  description: |-
+                                    The scheduler will prefer to schedule pods to nodes that satisfy
+                                    the anti-affinity expressions specified by this field, but it may choose
+                                    a node that violates one or more of the expressions. The node that is
+                                    most preferred is the one with the greatest sum of weights, i.e.
+                                    for each node that meets all of the scheduling requirements (resource
+                                    request, requiredDuringScheduling anti-affinity expressions, etc.),
+                                    compute a sum by iterating through the elements of this field and subtracting
+                                    "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                    node(s) with the highest sum are the most preferred.
+                                  type: array
+                                  items:
+                                    description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
+                                    type: object
+                                    required:
+                                      - podAffinityTerm
+                                      - weight
+                                    properties:
+                                      podAffinityTerm:
+                                        description: Required. A pod affinity term, associated with the corresponding weight.
+                                        type: object
+                                        required:
+                                          - topologyKey
+                                        properties:
+                                          labelSelector:
+                                            description: |-
+                                              A label query over a set of resources, in this case pods.
+                                              If it's null, this PodAffinityTerm matches with no Pods.
+                                            type: object
+                                            properties:
+                                              matchExpressions:
+                                                description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                type: array
+                                                items:
+                                                  description: |-
+                                                    A label selector requirement is a selector that contains values, a key, and an operator that
+                                                    relates the key and values.
+                                                  type: object
+                                                  required:
+                                                    - key
+                                                    - operator
+                                                  properties:
+                                                    key:
+                                                      description: key is the label key that the selector applies to.
+                                                      type: string
+                                                    operator:
+                                                      description: |-
+                                                        operator represents a key's relationship to a set of values.
+                                                        Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                      type: string
+                                                    values:
+                                                      description: |-
+                                                        values is an array of string values. If the operator is In or NotIn,
+                                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                        the values array must be empty. This array is replaced during a strategic
+                                                        merge patch.
+                                                      type: array
+                                                      items:
+                                                        type: string
+                                                      x-kubernetes-list-type: atomic
+                                                x-kubernetes-list-type: atomic
+                                              matchLabels:
+                                                description: |-
+                                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                type: object
+                                                additionalProperties:
+                                                  type: string
+                                            x-kubernetes-map-type: atomic
+                                          matchLabelKeys:
+                                            description: |-
+                                              MatchLabelKeys is a set of pod label keys to select which pods will
+                                              be taken into consideration. The keys are used to lookup values from the
+                                              incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                              to select the group of existing pods which pods will be taken into consideration
+                                              for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                              pod labels will be ignored. The default value is empty.
+                                              The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                              Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                            type: array
+                                            items:
+                                              type: string
+                                            x-kubernetes-list-type: atomic
+                                          mismatchLabelKeys:
+                                            description: |-
+                                              MismatchLabelKeys is a set of pod label keys to select which pods will
+                                              be taken into consideration. The keys are used to lookup values from the
+                                              incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                              to select the group of existing pods which pods will be taken into consideration
+                                              for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                              pod labels will be ignored. The default value is empty.
+                                              The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                              Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                            type: array
+                                            items:
+                                              type: string
+                                            x-kubernetes-list-type: atomic
+                                          namespaceSelector:
+                                            description: |-
+                                              A label query over the set of namespaces that the term applies to.
+                                              The term is applied to the union of the namespaces selected by this field
+                                              and the ones listed in the namespaces field.
+                                              null selector and null or empty namespaces list means "this pod's namespace".
+                                              An empty selector ({}) matches all namespaces.
+                                            type: object
+                                            properties:
+                                              matchExpressions:
+                                                description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                type: array
+                                                items:
+                                                  description: |-
+                                                    A label selector requirement is a selector that contains values, a key, and an operator that
+                                                    relates the key and values.
+                                                  type: object
+                                                  required:
+                                                    - key
+                                                    - operator
+                                                  properties:
+                                                    key:
+                                                      description: key is the label key that the selector applies to.
+                                                      type: string
+                                                    operator:
+                                                      description: |-
+                                                        operator represents a key's relationship to a set of values.
+                                                        Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                      type: string
+                                                    values:
+                                                      description: |-
+                                                        values is an array of string values. If the operator is In or NotIn,
+                                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                        the values array must be empty. This array is replaced during a strategic
+                                                        merge patch.
+                                                      type: array
+                                                      items:
+                                                        type: string
+                                                      x-kubernetes-list-type: atomic
+                                                x-kubernetes-list-type: atomic
+                                              matchLabels:
+                                                description: |-
+                                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                type: object
+                                                additionalProperties:
+                                                  type: string
+                                            x-kubernetes-map-type: atomic
+                                          namespaces:
+                                            description: |-
+                                              namespaces specifies a static list of namespace names that the term applies to.
+                                              The term is applied to the union of the namespaces listed in this field
+                                              and the ones selected by namespaceSelector.
+                                              null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                            type: array
+                                            items:
+                                              type: string
+                                            x-kubernetes-list-type: atomic
+                                          topologyKey:
+                                            description: |-
+                                              This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                              the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                              whose value of the label with key topologyKey matches that of any node on which any of the
+                                              selected pods is running.
+                                              Empty topologyKey is not allowed.
+                                            type: string
+                                      weight:
+                                        description: |-
+                                          weight associated with matching the corresponding podAffinityTerm,
+                                          in the range 1-100.
+                                        type: integer
+                                        format: int32
+                                  x-kubernetes-list-type: atomic
+                                requiredDuringSchedulingIgnoredDuringExecution:
+                                  description: |-
+                                    If the anti-affinity requirements specified by this field are not met at
+                                    scheduling time, the pod will not be scheduled onto the node.
+                                    If the anti-affinity requirements specified by this field cease to be met
+                                    at some point during pod execution (e.g. due to a pod label update), the
+                                    system may or may not try to eventually evict the pod from its node.
+                                    When there are multiple elements, the lists of nodes corresponding to each
+                                    podAffinityTerm are intersected, i.e. all terms must be satisfied.
+                                  type: array
+                                  items:
+                                    description: |-
+                                      Defines a set of pods (namely those matching the labelSelector
+                                      relative to the given namespace(s)) that this pod should be
+                                      co-located (affinity) or not co-located (anti-affinity) with,
+                                      where co-located is defined as running on a node whose value of
+                                      the label with key <topologyKey> matches that of any node on which
+                                      a pod of the set of pods is running
+                                    type: object
+                                    required:
+                                      - topologyKey
+                                    properties:
+                                      labelSelector:
+                                        description: |-
+                                          A label query over a set of resources, in this case pods.
+                                          If it's null, this PodAffinityTerm matches with no Pods.
+                                        type: object
+                                        properties:
+                                          matchExpressions:
+                                            description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                            type: array
+                                            items:
+                                              description: |-
+                                                A label selector requirement is a selector that contains values, a key, and an operator that
+                                                relates the key and values.
+                                              type: object
+                                              required:
+                                                - key
+                                                - operator
+                                              properties:
+                                                key:
+                                                  description: key is the label key that the selector applies to.
+                                                  type: string
+                                                operator:
+                                                  description: |-
+                                                    operator represents a key's relationship to a set of values.
+                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                  type: string
+                                                values:
+                                                  description: |-
+                                                    values is an array of string values. If the operator is In or NotIn,
+                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                    the values array must be empty. This array is replaced during a strategic
+                                                    merge patch.
+                                                  type: array
+                                                  items:
+                                                    type: string
+                                                  x-kubernetes-list-type: atomic
+                                            x-kubernetes-list-type: atomic
+                                          matchLabels:
+                                            description: |-
+                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                            type: object
+                                            additionalProperties:
+                                              type: string
+                                        x-kubernetes-map-type: atomic
+                                      matchLabelKeys:
+                                        description: |-
+                                          MatchLabelKeys is a set of pod label keys to select which pods will
+                                          be taken into consideration. The keys are used to lookup values from the
+                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                          to select the group of existing pods which pods will be taken into consideration
+                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                          pod labels will be ignored. The default value is empty.
+                                          The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                          Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                        type: array
+                                        items:
+                                          type: string
+                                        x-kubernetes-list-type: atomic
+                                      mismatchLabelKeys:
+                                        description: |-
+                                          MismatchLabelKeys is a set of pod label keys to select which pods will
+                                          be taken into consideration. The keys are used to lookup values from the
+                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                          to select the group of existing pods which pods will be taken into consideration
+                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                          pod labels will be ignored. The default value is empty.
+                                          The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                          Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                        type: array
+                                        items:
+                                          type: string
+                                        x-kubernetes-list-type: atomic
+                                      namespaceSelector:
+                                        description: |-
+                                          A label query over the set of namespaces that the term applies to.
+                                          The term is applied to the union of the namespaces selected by this field
+                                          and the ones listed in the namespaces field.
+                                          null selector and null or empty namespaces list means "this pod's namespace".
+                                          An empty selector ({}) matches all namespaces.
+                                        type: object
+                                        properties:
+                                          matchExpressions:
+                                            description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                            type: array
+                                            items:
+                                              description: |-
+                                                A label selector requirement is a selector that contains values, a key, and an operator that
+                                                relates the key and values.
+                                              type: object
+                                              required:
+                                                - key
+                                                - operator
+                                              properties:
+                                                key:
+                                                  description: key is the label key that the selector applies to.
+                                                  type: string
+                                                operator:
+                                                  description: |-
+                                                    operator represents a key's relationship to a set of values.
+                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                  type: string
+                                                values:
+                                                  description: |-
+                                                    values is an array of string values. If the operator is In or NotIn,
+                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                    the values array must be empty. This array is replaced during a strategic
+                                                    merge patch.
+                                                  type: array
+                                                  items:
+                                                    type: string
+                                                  x-kubernetes-list-type: atomic
+                                            x-kubernetes-list-type: atomic
+                                          matchLabels:
+                                            description: |-
+                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                            type: object
+                                            additionalProperties:
+                                              type: string
+                                        x-kubernetes-map-type: atomic
+                                      namespaces:
+                                        description: |-
+                                          namespaces specifies a static list of namespace names that the term applies to.
+                                          The term is applied to the union of the namespaces listed in this field
+                                          and the ones selected by namespaceSelector.
+                                          null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                        type: array
+                                        items:
+                                          type: string
+                                        x-kubernetes-list-type: atomic
+                                      topologyKey:
+                                        description: |-
+                                          This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                          the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                          whose value of the label with key topologyKey matches that of any node on which any of the
+                                          selected pods is running.
+                                          Empty topologyKey is not allowed.
+                                        type: string
+                                  x-kubernetes-list-type: atomic
+                        nodeSelector:
+                          description: If specified, applies node selector rules to the pods deployed by the DNSConfig resource.
+                          type: object
+                          additionalProperties:
+                            type: string
                         tolerations:
                           description: If specified, applies tolerations to the pods deployed by the DNSConfig resource.
                           type: array
diff --git a/cmd/k8s-operator/deploy/crds/tailscale.com_peerrelays.yaml b/cmd/k8s-operator/deploy/crds/tailscale.com_peerrelays.yaml
new file mode 100644
index 000000000..7b8247b7d
--- /dev/null
+++ b/cmd/k8s-operator/deploy/crds/tailscale.com_peerrelays.yaml
@@ -0,0 +1,264 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.17.0
+  name: peerrelays.tailscale.com
+spec:
+  group: tailscale.com
+  names:
+    kind: PeerRelay
+    listKind: PeerRelayList
+    plural: peerrelays
+    shortNames:
+      - pr
+    singular: peerrelay
+  scope: Cluster
+  versions:
+    - additionalPrinterColumns:
+        - jsonPath: .metadata.creationTimestamp
+          name: Age
+          type: date
+        - description: Status of the deployed PeerRelay resources.
+          jsonPath: .status.conditions[?(@.type == "PeerRelayReady")].reason
+          name: Status
+          type: string
+        - description: Public addresses the peer relay replicas are reachable on.
+          jsonPath: .status.endpoints[*].address
+          name: Endpoints
+          type: string
+      name: v1alpha1
+      schema:
+        openAPIV3Schema:
+          type: object
+          required:
+            - metadata
+            - spec
+          properties:
+            apiVersion:
+              description: |-
+                APIVersion defines the versioned schema of this representation of an object.
+                Servers should convert recognized schemas to the latest internal value, and
+                may reject unrecognized values.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+              type: string
+            kind:
+              description: |-
+                Kind is a string value representing the REST resource this object represents.
+                Servers may infer this from the endpoint the client submits requests to.
+                Cannot be updated.
+                In CamelCase.
+                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: |-
+                Spec describes the desired state of the PeerRelay.
+                More info:
+                https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+              type: object
+              properties:
+                aws:
+                  description: |-
+                    AWS contains configuration for pinning each replica to a specific AWS Elastic IP and subnet. Only meaningful
+                    when running on EKS with the AWS Load Balancer Controller. When set, the per-replica values override any
+                    aws-load-balancer-eip-allocations or aws-load-balancer-subnets values supplied via spec.service.annotations.
+                  type: object
+                  required:
+                    - elasticIPs
+                  properties:
+                    elasticIPs:
+                      description: |-
+                        ElasticIPs pins each replica to a specific AWS EIP allocation and subnet. Only meaningful when Network Load
+                        Balancers are provisioned by the AWS Load Balancer Controller. ElasticIPs supplies one allocation-subnet pair
+                        per replica: replica N uses ElasticIPs[N]. The list must be at least as long as spec.replicas so every replica
+                        has a distinct EIP; extra entries are permitted so that scale-up doesn't immediately trip validation.
+
+                        When set, the reconciler stamps
+                        service.beta.kubernetes.io/aws-load-balancer-eip-allocations and
+                        service.beta.kubernetes.io/aws-load-balancer-subnets on each per-replica Service, overriding any values in
+                        spec.service.annotations.
+                      type: array
+                      minItems: 1
+                      items:
+                        description: PeerRelayAWSElasticIP pairs an EIP allocation with the subnet in the same AZ.
+                        type: object
+                        required:
+                          - allocationID
+                          - subnetID
+                        properties:
+                          allocationID:
+                            description: |-
+                              AllocationID is the AWS EIP allocation ID (e.g. eipalloc-0123abcd) whose public IP this replica is reachable
+                              on. Stamped as service.beta.kubernetes.io/aws-load-balancer-eip-allocations on the replica's Service.
+                            type: string
+                            pattern: ^eipalloc-[0-9a-f]+$
+                          subnetID:
+                            description: |-
+                              SubnetID is the AWS subnet in the same availability zone as AllocationID (e.g. subnet-0123abcd). Stamped as
+                              service.beta.kubernetes.io/aws-load-balancer-subnets on the replica's Service so the NLB is provisioned in
+                              the same AZ as the EIP.
+                            type: string
+                            pattern: ^subnet-[0-9a-f]+$
+                      x-kubernetes-list-type: atomic
+                hostnamePrefix:
+                  description: |-
+                    HostnamePrefix specifies the hostname prefix for each
+                    replica. Each device will have the integer number
+                    from its StatefulSet pod appended to this prefix to form the full hostname.
+                    HostnamePrefix can contain lower case letters, numbers and dashes, it
+                    must not start with a dash and must be between 1 and 62 characters long.
+                  type: string
+                  pattern: ^[a-z0-9][a-z0-9-]{0,61}$
+                proxyClass:
+                  description: |-
+                    ProxyClass is the name of the ProxyClass custom resource that
+                    contains configuration options that should be applied to the
+                    resources created for this PeerRelay. If unset, the operator will
+                    create resources with the default configuration.
+                  type: string
+                replicas:
+                  description: |-
+                    Replicas specifies how many devices to create. Set this to enable
+                    high availability for peer relays.
+                    https://tailscale.com/kb/1115/high-availability. Defaults to 1.
+                  type: integer
+                  format: int32
+                  default: 1
+                  minimum: 0
+                service:
+                  description: Service contains configuration values to modify the LoadBalancer service used to expose the peer relay.
+                  type: object
+                  properties:
+                    annotations:
+                      description: |-
+                        Annotations to apply to the LoadBalancer service. Any annotations that conflict with those used by known
+                        cloud providers to ensure IP addresses rather than DNS names are ignored.
+                      type: object
+                      additionalProperties:
+                        type: string
+                tags:
+                  description: |-
+                    Tags that the Tailscale node will be tagged with.
+                    Defaults to [tag:k8s].
+                    To autoapprove the device defined by a PeerRelay,
+                    you can configure Tailscale ACLs to give these tags the necessary
+                    permissions.
+                    See https://tailscale.com/kb/1337/acl-syntax#autoapprovers.
+                    If you specify custom tags here, you must also make the operator an owner of these tags.
+                    See  https://tailscale.com/kb/1236/kubernetes-operator/#setting-up-the-kubernetes-operator.
+                    Tags cannot be changed once a PeerRelay node has been created.
+                    Tag values must be in form ^tag:[a-zA-Z][a-zA-Z0-9-]*$.
+                  type: array
+                  items:
+                    type: string
+                    pattern: ^tag:[a-zA-Z][a-zA-Z0-9-]*$
+                tailnet:
+                  description: |-
+                    Tailnet specifies the tailnet this PeerRelay should join. If blank, the default tailnet is used. When set, this
+                    name must match that of a valid Tailnet resource. This field is immutable and cannot be changed once set.
+                  type: string
+                  x-kubernetes-validations:
+                    - rule: self == oldSelf
+                      message: PeerRelay tailnet is immutable
+              x-kubernetes-validations:
+                - rule: '!has(self.aws) || !has(self.aws.elasticIPs) || self.aws.elasticIPs.size() >= self.replicas'
+                  message: spec.aws.elasticIPs must contain at least one entry per replica
+            status:
+              description: |-
+                Status describes the status of the PeerRelay. This is set
+                and managed by the Tailscale operator.
+              type: object
+              properties:
+                conditions:
+                  type: array
+                  items:
+                    description: Condition contains details for one aspect of the current state of this API Resource.
+                    type: object
+                    required:
+                      - lastTransitionTime
+                      - message
+                      - reason
+                      - status
+                      - type
+                    properties:
+                      lastTransitionTime:
+                        description: |-
+                          lastTransitionTime is the last time the condition transitioned from one status to another.
+                          This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                        type: string
+                        format: date-time
+                      message:
+                        description: |-
+                          message is a human readable message indicating details about the transition.
+                          This may be an empty string.
+                        type: string
+                        maxLength: 32768
+                      observedGeneration:
+                        description: |-
+                          observedGeneration represents the .metadata.generation that the condition was set based upon.
+                          For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                          with respect to the current state of the instance.
+                        type: integer
+                        format: int64
+                        minimum: 0
+                      reason:
+                        description: |-
+                          reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                          Producers of specific condition types may define expected values and meanings for this field,
+                          and whether the values are considered a guaranteed API.
+                          The value should be a CamelCase string.
+                          This field may not be empty.
+                        type: string
+                        maxLength: 1024
+                        minLength: 1
+                        pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      status:
+                        description: status of the condition, one of True, False, Unknown.
+                        type: string
+                        enum:
+                          - "True"
+                          - "False"
+                          - Unknown
+                      type:
+                        description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                        type: string
+                        maxLength: 316
+                        pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                  x-kubernetes-list-map-keys:
+                    - type
+                  x-kubernetes-list-type: map
+                endpoints:
+                  description: |-
+                    Endpoints lists the public address:port pairs each peer relay replica is reachable on. There is one entry
+                    per replica whose LoadBalancer Service has been assigned a public address; entries appear as the underlying
+                    cloud provisions each Service.
+                  type: array
+                  items:
+                    type: object
+                    required:
+                      - address
+                      - port
+                      - replica
+                    properties:
+                      address:
+                        description: |-
+                          Address is the public IP or hostname the cloud has allocated for this replica's LoadBalancer Service.
+                          Peers reach this relay by connecting to Address:Port over UDP.
+                        type: string
+                      port:
+                        description: Port is the UDP port the peer relay listens on.
+                        type: integer
+                        format: int32
+                      replica:
+                        description: Replica is the zero-based index of the peer relay replica this endpoint targets.
+                        type: integer
+                        format: int32
+                  x-kubernetes-list-map-keys:
+                    - replica
+                  x-kubernetes-list-type: map
+      served: true
+      storage: true
+      subresources:
+        status: {}
diff --git a/cmd/k8s-operator/deploy/crds/tailscale.com_tailnets.yaml b/cmd/k8s-operator/deploy/crds/tailscale.com_tailnets.yaml
index 200d83943..5e6dd5880 100644
--- a/cmd/k8s-operator/deploy/crds/tailscale.com_tailnets.yaml
+++ b/cmd/k8s-operator/deploy/crds/tailscale.com_tailnets.yaml
@@ -58,15 +58,18 @@ spec:
                 - credentials
               properties:
                 credentials:
-                  description: Denotes the location of the OAuth credentials to use for authenticating with this Tailnet.
+                  description: Denotes the location of the credentials to use for authenticating with this Tailnet.
                   type: object
                   required:
                     - secretName
                   properties:
                     secretName:
                       description: |-
-                        The name of the secret containing the OAuth credentials. This secret must contain two fields "client_id" and
-                        "client_secret".
+                        The name of the secret containing the credentials used to authenticate with this Tailnet. The secret must always
+                        contain a "client_id" field. To authenticate with a static OAuth client, also set "client_secret". To authenticate
+                        via workload identity federation, set "audience" to the audience value expected by the Tailscale OAuth
+                        client; the operator will mint a ServiceAccount token for itself with that audience and exchange it for an API
+                        token. "client_secret" and "audience" are mutually exclusive.
                       type: string
                 loginUrl:
                   description: URL of the control plane to be used by all resources managed by the operator using this Tailnet.
diff --git a/cmd/k8s-operator/deploy/manifests/operator.yaml b/cmd/k8s-operator/deploy/manifests/operator.yaml
index 597641bde..03502be4c 100644
--- a/cmd/k8s-operator/deploy/manifests/operator.yaml
+++ b/cmd/k8s-operator/deploy/manifests/operator.yaml
@@ -442,6 +442,884 @@ spec:
                                     pod:
                                         description: Pod configuration.
                                         properties:
+                                            affinity:
+                                                description: If specified, applies affinity rules to the pods deployed by the DNSConfig resource.
+                                                properties:
+                                                    nodeAffinity:
+                                                        description: Describes node affinity scheduling rules for the pod.
+                                                        properties:
+                                                            preferredDuringSchedulingIgnoredDuringExecution:
+                                                                description: |-
+                                                                    The scheduler will prefer to schedule pods to nodes that satisfy
+                                                                    the affinity expressions specified by this field, but it may choose
+                                                                    a node that violates one or more of the expressions. The node that is
+                                                                    most preferred is the one with the greatest sum of weights, i.e.
+                                                                    for each node that meets all of the scheduling requirements (resource
+                                                                    request, requiredDuringScheduling affinity expressions, etc.),
+                                                                    compute a sum by iterating through the elements of this field and adding
+                                                                    "weight" to the sum if the node matches the corresponding matchExpressions; the
+                                                                    node(s) with the highest sum are the most preferred.
+                                                                items:
+                                                                    description: |-
+                                                                        An empty preferred scheduling term matches all objects with implicit weight 0
+                                                                        (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
+                                                                    properties:
+                                                                        preference:
+                                                                            description: A node selector term, associated with the corresponding weight.
+                                                                            properties:
+                                                                                matchExpressions:
+                                                                                    description: A list of node selector requirements by node's labels.
+                                                                                    items:
+                                                                                        description: |-
+                                                                                            A node selector requirement is a selector that contains values, a key, and an operator
+                                                                                            that relates the key and values.
+                                                                                        properties:
+                                                                                            key:
+                                                                                                description: The label key that the selector applies to.
+                                                                                                type: string
+                                                                                            operator:
+                                                                                                description: |-
+                                                                                                    Represents a key's relationship to a set of values.
+                                                                                                    Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                                                                type: string
+                                                                                            values:
+                                                                                                description: |-
+                                                                                                    An array of string values. If the operator is In or NotIn,
+                                                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                                                    the values array must be empty. If the operator is Gt or Lt, the values
+                                                                                                    array must have a single element, which will be interpreted as an integer.
+                                                                                                    This array is replaced during a strategic merge patch.
+                                                                                                items:
+                                                                                                    type: string
+                                                                                                type: array
+                                                                                                x-kubernetes-list-type: atomic
+                                                                                        required:
+                                                                                            - key
+                                                                                            - operator
+                                                                                        type: object
+                                                                                    type: array
+                                                                                    x-kubernetes-list-type: atomic
+                                                                                matchFields:
+                                                                                    description: A list of node selector requirements by node's fields.
+                                                                                    items:
+                                                                                        description: |-
+                                                                                            A node selector requirement is a selector that contains values, a key, and an operator
+                                                                                            that relates the key and values.
+                                                                                        properties:
+                                                                                            key:
+                                                                                                description: The label key that the selector applies to.
+                                                                                                type: string
+                                                                                            operator:
+                                                                                                description: |-
+                                                                                                    Represents a key's relationship to a set of values.
+                                                                                                    Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                                                                type: string
+                                                                                            values:
+                                                                                                description: |-
+                                                                                                    An array of string values. If the operator is In or NotIn,
+                                                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                                                    the values array must be empty. If the operator is Gt or Lt, the values
+                                                                                                    array must have a single element, which will be interpreted as an integer.
+                                                                                                    This array is replaced during a strategic merge patch.
+                                                                                                items:
+                                                                                                    type: string
+                                                                                                type: array
+                                                                                                x-kubernetes-list-type: atomic
+                                                                                        required:
+                                                                                            - key
+                                                                                            - operator
+                                                                                        type: object
+                                                                                    type: array
+                                                                                    x-kubernetes-list-type: atomic
+                                                                            type: object
+                                                                            x-kubernetes-map-type: atomic
+                                                                        weight:
+                                                                            description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
+                                                                            format: int32
+                                                                            type: integer
+                                                                    required:
+                                                                        - preference
+                                                                        - weight
+                                                                    type: object
+                                                                type: array
+                                                                x-kubernetes-list-type: atomic
+                                                            requiredDuringSchedulingIgnoredDuringExecution:
+                                                                description: |-
+                                                                    If the affinity requirements specified by this field are not met at
+                                                                    scheduling time, the pod will not be scheduled onto the node.
+                                                                    If the affinity requirements specified by this field cease to be met
+                                                                    at some point during pod execution (e.g. due to an update), the system
+                                                                    may or may not try to eventually evict the pod from its node.
+                                                                properties:
+                                                                    nodeSelectorTerms:
+                                                                        description: Required. A list of node selector terms. The terms are ORed.
+                                                                        items:
+                                                                            description: |-
+                                                                                A null or empty node selector term matches no objects. The requirements of
+                                                                                them are ANDed.
+                                                                                The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
+                                                                            properties:
+                                                                                matchExpressions:
+                                                                                    description: A list of node selector requirements by node's labels.
+                                                                                    items:
+                                                                                        description: |-
+                                                                                            A node selector requirement is a selector that contains values, a key, and an operator
+                                                                                            that relates the key and values.
+                                                                                        properties:
+                                                                                            key:
+                                                                                                description: The label key that the selector applies to.
+                                                                                                type: string
+                                                                                            operator:
+                                                                                                description: |-
+                                                                                                    Represents a key's relationship to a set of values.
+                                                                                                    Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                                                                type: string
+                                                                                            values:
+                                                                                                description: |-
+                                                                                                    An array of string values. If the operator is In or NotIn,
+                                                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                                                    the values array must be empty. If the operator is Gt or Lt, the values
+                                                                                                    array must have a single element, which will be interpreted as an integer.
+                                                                                                    This array is replaced during a strategic merge patch.
+                                                                                                items:
+                                                                                                    type: string
+                                                                                                type: array
+                                                                                                x-kubernetes-list-type: atomic
+                                                                                        required:
+                                                                                            - key
+                                                                                            - operator
+                                                                                        type: object
+                                                                                    type: array
+                                                                                    x-kubernetes-list-type: atomic
+                                                                                matchFields:
+                                                                                    description: A list of node selector requirements by node's fields.
+                                                                                    items:
+                                                                                        description: |-
+                                                                                            A node selector requirement is a selector that contains values, a key, and an operator
+                                                                                            that relates the key and values.
+                                                                                        properties:
+                                                                                            key:
+                                                                                                description: The label key that the selector applies to.
+                                                                                                type: string
+                                                                                            operator:
+                                                                                                description: |-
+                                                                                                    Represents a key's relationship to a set of values.
+                                                                                                    Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                                                                type: string
+                                                                                            values:
+                                                                                                description: |-
+                                                                                                    An array of string values. If the operator is In or NotIn,
+                                                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                                                    the values array must be empty. If the operator is Gt or Lt, the values
+                                                                                                    array must have a single element, which will be interpreted as an integer.
+                                                                                                    This array is replaced during a strategic merge patch.
+                                                                                                items:
+                                                                                                    type: string
+                                                                                                type: array
+                                                                                                x-kubernetes-list-type: atomic
+                                                                                        required:
+                                                                                            - key
+                                                                                            - operator
+                                                                                        type: object
+                                                                                    type: array
+                                                                                    x-kubernetes-list-type: atomic
+                                                                            type: object
+                                                                            x-kubernetes-map-type: atomic
+                                                                        type: array
+                                                                        x-kubernetes-list-type: atomic
+                                                                required:
+                                                                    - nodeSelectorTerms
+                                                                type: object
+                                                                x-kubernetes-map-type: atomic
+                                                        type: object
+                                                    podAffinity:
+                                                        description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
+                                                        properties:
+                                                            preferredDuringSchedulingIgnoredDuringExecution:
+                                                                description: |-
+                                                                    The scheduler will prefer to schedule pods to nodes that satisfy
+                                                                    the affinity expressions specified by this field, but it may choose
+                                                                    a node that violates one or more of the expressions. The node that is
+                                                                    most preferred is the one with the greatest sum of weights, i.e.
+                                                                    for each node that meets all of the scheduling requirements (resource
+                                                                    request, requiredDuringScheduling affinity expressions, etc.),
+                                                                    compute a sum by iterating through the elements of this field and adding
+                                                                    "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                                                    node(s) with the highest sum are the most preferred.
+                                                                items:
+                                                                    description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
+                                                                    properties:
+                                                                        podAffinityTerm:
+                                                                            description: Required. A pod affinity term, associated with the corresponding weight.
+                                                                            properties:
+                                                                                labelSelector:
+                                                                                    description: |-
+                                                                                        A label query over a set of resources, in this case pods.
+                                                                                        If it's null, this PodAffinityTerm matches with no Pods.
+                                                                                    properties:
+                                                                                        matchExpressions:
+                                                                                            description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                                                            items:
+                                                                                                description: |-
+                                                                                                    A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                                                    relates the key and values.
+                                                                                                properties:
+                                                                                                    key:
+                                                                                                        description: key is the label key that the selector applies to.
+                                                                                                        type: string
+                                                                                                    operator:
+                                                                                                        description: |-
+                                                                                                            operator represents a key's relationship to a set of values.
+                                                                                                            Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                                                        type: string
+                                                                                                    values:
+                                                                                                        description: |-
+                                                                                                            values is an array of string values. If the operator is In or NotIn,
+                                                                                                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                                                            the values array must be empty. This array is replaced during a strategic
+                                                                                                            merge patch.
+                                                                                                        items:
+                                                                                                            type: string
+                                                                                                        type: array
+                                                                                                        x-kubernetes-list-type: atomic
+                                                                                                required:
+                                                                                                    - key
+                                                                                                    - operator
+                                                                                                type: object
+                                                                                            type: array
+                                                                                            x-kubernetes-list-type: atomic
+                                                                                        matchLabels:
+                                                                                            additionalProperties:
+                                                                                                type: string
+                                                                                            description: |-
+                                                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                                                            type: object
+                                                                                    type: object
+                                                                                    x-kubernetes-map-type: atomic
+                                                                                matchLabelKeys:
+                                                                                    description: |-
+                                                                                        MatchLabelKeys is a set of pod label keys to select which pods will
+                                                                                        be taken into consideration. The keys are used to lookup values from the
+                                                                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                                                                        to select the group of existing pods which pods will be taken into consideration
+                                                                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                                                        pod labels will be ignored. The default value is empty.
+                                                                                        The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                                                                        Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                                                                    items:
+                                                                                        type: string
+                                                                                    type: array
+                                                                                    x-kubernetes-list-type: atomic
+                                                                                mismatchLabelKeys:
+                                                                                    description: |-
+                                                                                        MismatchLabelKeys is a set of pod label keys to select which pods will
+                                                                                        be taken into consideration. The keys are used to lookup values from the
+                                                                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                                                                        to select the group of existing pods which pods will be taken into consideration
+                                                                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                                                        pod labels will be ignored. The default value is empty.
+                                                                                        The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                                                                        Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                                                                    items:
+                                                                                        type: string
+                                                                                    type: array
+                                                                                    x-kubernetes-list-type: atomic
+                                                                                namespaceSelector:
+                                                                                    description: |-
+                                                                                        A label query over the set of namespaces that the term applies to.
+                                                                                        The term is applied to the union of the namespaces selected by this field
+                                                                                        and the ones listed in the namespaces field.
+                                                                                        null selector and null or empty namespaces list means "this pod's namespace".
+                                                                                        An empty selector ({}) matches all namespaces.
+                                                                                    properties:
+                                                                                        matchExpressions:
+                                                                                            description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                                                            items:
+                                                                                                description: |-
+                                                                                                    A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                                                    relates the key and values.
+                                                                                                properties:
+                                                                                                    key:
+                                                                                                        description: key is the label key that the selector applies to.
+                                                                                                        type: string
+                                                                                                    operator:
+                                                                                                        description: |-
+                                                                                                            operator represents a key's relationship to a set of values.
+                                                                                                            Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                                                        type: string
+                                                                                                    values:
+                                                                                                        description: |-
+                                                                                                            values is an array of string values. If the operator is In or NotIn,
+                                                                                                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                                                            the values array must be empty. This array is replaced during a strategic
+                                                                                                            merge patch.
+                                                                                                        items:
+                                                                                                            type: string
+                                                                                                        type: array
+                                                                                                        x-kubernetes-list-type: atomic
+                                                                                                required:
+                                                                                                    - key
+                                                                                                    - operator
+                                                                                                type: object
+                                                                                            type: array
+                                                                                            x-kubernetes-list-type: atomic
+                                                                                        matchLabels:
+                                                                                            additionalProperties:
+                                                                                                type: string
+                                                                                            description: |-
+                                                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                                                            type: object
+                                                                                    type: object
+                                                                                    x-kubernetes-map-type: atomic
+                                                                                namespaces:
+                                                                                    description: |-
+                                                                                        namespaces specifies a static list of namespace names that the term applies to.
+                                                                                        The term is applied to the union of the namespaces listed in this field
+                                                                                        and the ones selected by namespaceSelector.
+                                                                                        null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                                                                    items:
+                                                                                        type: string
+                                                                                    type: array
+                                                                                    x-kubernetes-list-type: atomic
+                                                                                topologyKey:
+                                                                                    description: |-
+                                                                                        This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                                                                        the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                                                                        whose value of the label with key topologyKey matches that of any node on which any of the
+                                                                                        selected pods is running.
+                                                                                        Empty topologyKey is not allowed.
+                                                                                    type: string
+                                                                            required:
+                                                                                - topologyKey
+                                                                            type: object
+                                                                        weight:
+                                                                            description: |-
+                                                                                weight associated with matching the corresponding podAffinityTerm,
+                                                                                in the range 1-100.
+                                                                            format: int32
+                                                                            type: integer
+                                                                    required:
+                                                                        - podAffinityTerm
+                                                                        - weight
+                                                                    type: object
+                                                                type: array
+                                                                x-kubernetes-list-type: atomic
+                                                            requiredDuringSchedulingIgnoredDuringExecution:
+                                                                description: |-
+                                                                    If the affinity requirements specified by this field are not met at
+                                                                    scheduling time, the pod will not be scheduled onto the node.
+                                                                    If the affinity requirements specified by this field cease to be met
+                                                                    at some point during pod execution (e.g. due to a pod label update), the
+                                                                    system may or may not try to eventually evict the pod from its node.
+                                                                    When there are multiple elements, the lists of nodes corresponding to each
+                                                                    podAffinityTerm are intersected, i.e. all terms must be satisfied.
+                                                                items:
+                                                                    description: |-
+                                                                        Defines a set of pods (namely those matching the labelSelector
+                                                                        relative to the given namespace(s)) that this pod should be
+                                                                        co-located (affinity) or not co-located (anti-affinity) with,
+                                                                        where co-located is defined as running on a node whose value of
+                                                                        the label with key <topologyKey> matches that of any node on which
+                                                                        a pod of the set of pods is running
+                                                                    properties:
+                                                                        labelSelector:
+                                                                            description: |-
+                                                                                A label query over a set of resources, in this case pods.
+                                                                                If it's null, this PodAffinityTerm matches with no Pods.
+                                                                            properties:
+                                                                                matchExpressions:
+                                                                                    description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                                                    items:
+                                                                                        description: |-
+                                                                                            A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                                            relates the key and values.
+                                                                                        properties:
+                                                                                            key:
+                                                                                                description: key is the label key that the selector applies to.
+                                                                                                type: string
+                                                                                            operator:
+                                                                                                description: |-
+                                                                                                    operator represents a key's relationship to a set of values.
+                                                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                                                type: string
+                                                                                            values:
+                                                                                                description: |-
+                                                                                                    values is an array of string values. If the operator is In or NotIn,
+                                                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                                                    the values array must be empty. This array is replaced during a strategic
+                                                                                                    merge patch.
+                                                                                                items:
+                                                                                                    type: string
+                                                                                                type: array
+                                                                                                x-kubernetes-list-type: atomic
+                                                                                        required:
+                                                                                            - key
+                                                                                            - operator
+                                                                                        type: object
+                                                                                    type: array
+                                                                                    x-kubernetes-list-type: atomic
+                                                                                matchLabels:
+                                                                                    additionalProperties:
+                                                                                        type: string
+                                                                                    description: |-
+                                                                                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                                        map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                                        operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                                                    type: object
+                                                                            type: object
+                                                                            x-kubernetes-map-type: atomic
+                                                                        matchLabelKeys:
+                                                                            description: |-
+                                                                                MatchLabelKeys is a set of pod label keys to select which pods will
+                                                                                be taken into consideration. The keys are used to lookup values from the
+                                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                                                                to select the group of existing pods which pods will be taken into consideration
+                                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                                                pod labels will be ignored. The default value is empty.
+                                                                                The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                                                                Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                                                            items:
+                                                                                type: string
+                                                                            type: array
+                                                                            x-kubernetes-list-type: atomic
+                                                                        mismatchLabelKeys:
+                                                                            description: |-
+                                                                                MismatchLabelKeys is a set of pod label keys to select which pods will
+                                                                                be taken into consideration. The keys are used to lookup values from the
+                                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                                                                to select the group of existing pods which pods will be taken into consideration
+                                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                                                pod labels will be ignored. The default value is empty.
+                                                                                The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                                                                Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                                                            items:
+                                                                                type: string
+                                                                            type: array
+                                                                            x-kubernetes-list-type: atomic
+                                                                        namespaceSelector:
+                                                                            description: |-
+                                                                                A label query over the set of namespaces that the term applies to.
+                                                                                The term is applied to the union of the namespaces selected by this field
+                                                                                and the ones listed in the namespaces field.
+                                                                                null selector and null or empty namespaces list means "this pod's namespace".
+                                                                                An empty selector ({}) matches all namespaces.
+                                                                            properties:
+                                                                                matchExpressions:
+                                                                                    description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                                                    items:
+                                                                                        description: |-
+                                                                                            A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                                            relates the key and values.
+                                                                                        properties:
+                                                                                            key:
+                                                                                                description: key is the label key that the selector applies to.
+                                                                                                type: string
+                                                                                            operator:
+                                                                                                description: |-
+                                                                                                    operator represents a key's relationship to a set of values.
+                                                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                                                type: string
+                                                                                            values:
+                                                                                                description: |-
+                                                                                                    values is an array of string values. If the operator is In or NotIn,
+                                                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                                                    the values array must be empty. This array is replaced during a strategic
+                                                                                                    merge patch.
+                                                                                                items:
+                                                                                                    type: string
+                                                                                                type: array
+                                                                                                x-kubernetes-list-type: atomic
+                                                                                        required:
+                                                                                            - key
+                                                                                            - operator
+                                                                                        type: object
+                                                                                    type: array
+                                                                                    x-kubernetes-list-type: atomic
+                                                                                matchLabels:
+                                                                                    additionalProperties:
+                                                                                        type: string
+                                                                                    description: |-
+                                                                                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                                        map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                                        operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                                                    type: object
+                                                                            type: object
+                                                                            x-kubernetes-map-type: atomic
+                                                                        namespaces:
+                                                                            description: |-
+                                                                                namespaces specifies a static list of namespace names that the term applies to.
+                                                                                The term is applied to the union of the namespaces listed in this field
+                                                                                and the ones selected by namespaceSelector.
+                                                                                null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                                                            items:
+                                                                                type: string
+                                                                            type: array
+                                                                            x-kubernetes-list-type: atomic
+                                                                        topologyKey:
+                                                                            description: |-
+                                                                                This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                                                                the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                                                                whose value of the label with key topologyKey matches that of any node on which any of the
+                                                                                selected pods is running.
+                                                                                Empty topologyKey is not allowed.
+                                                                            type: string
+                                                                    required:
+                                                                        - topologyKey
+                                                                    type: object
+                                                                type: array
+                                                                x-kubernetes-list-type: atomic
+                                                        type: object
+                                                    podAntiAffinity:
+                                                        description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
+                                                        properties:
+                                                            preferredDuringSchedulingIgnoredDuringExecution:
+                                                                description: |-
+                                                                    The scheduler will prefer to schedule pods to nodes that satisfy
+                                                                    the anti-affinity expressions specified by this field, but it may choose
+                                                                    a node that violates one or more of the expressions. The node that is
+                                                                    most preferred is the one with the greatest sum of weights, i.e.
+                                                                    for each node that meets all of the scheduling requirements (resource
+                                                                    request, requiredDuringScheduling anti-affinity expressions, etc.),
+                                                                    compute a sum by iterating through the elements of this field and subtracting
+                                                                    "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                                                    node(s) with the highest sum are the most preferred.
+                                                                items:
+                                                                    description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
+                                                                    properties:
+                                                                        podAffinityTerm:
+                                                                            description: Required. A pod affinity term, associated with the corresponding weight.
+                                                                            properties:
+                                                                                labelSelector:
+                                                                                    description: |-
+                                                                                        A label query over a set of resources, in this case pods.
+                                                                                        If it's null, this PodAffinityTerm matches with no Pods.
+                                                                                    properties:
+                                                                                        matchExpressions:
+                                                                                            description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                                                            items:
+                                                                                                description: |-
+                                                                                                    A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                                                    relates the key and values.
+                                                                                                properties:
+                                                                                                    key:
+                                                                                                        description: key is the label key that the selector applies to.
+                                                                                                        type: string
+                                                                                                    operator:
+                                                                                                        description: |-
+                                                                                                            operator represents a key's relationship to a set of values.
+                                                                                                            Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                                                        type: string
+                                                                                                    values:
+                                                                                                        description: |-
+                                                                                                            values is an array of string values. If the operator is In or NotIn,
+                                                                                                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                                                            the values array must be empty. This array is replaced during a strategic
+                                                                                                            merge patch.
+                                                                                                        items:
+                                                                                                            type: string
+                                                                                                        type: array
+                                                                                                        x-kubernetes-list-type: atomic
+                                                                                                required:
+                                                                                                    - key
+                                                                                                    - operator
+                                                                                                type: object
+                                                                                            type: array
+                                                                                            x-kubernetes-list-type: atomic
+                                                                                        matchLabels:
+                                                                                            additionalProperties:
+                                                                                                type: string
+                                                                                            description: |-
+                                                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                                                            type: object
+                                                                                    type: object
+                                                                                    x-kubernetes-map-type: atomic
+                                                                                matchLabelKeys:
+                                                                                    description: |-
+                                                                                        MatchLabelKeys is a set of pod label keys to select which pods will
+                                                                                        be taken into consideration. The keys are used to lookup values from the
+                                                                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                                                                        to select the group of existing pods which pods will be taken into consideration
+                                                                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                                                        pod labels will be ignored. The default value is empty.
+                                                                                        The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                                                                        Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                                                                    items:
+                                                                                        type: string
+                                                                                    type: array
+                                                                                    x-kubernetes-list-type: atomic
+                                                                                mismatchLabelKeys:
+                                                                                    description: |-
+                                                                                        MismatchLabelKeys is a set of pod label keys to select which pods will
+                                                                                        be taken into consideration. The keys are used to lookup values from the
+                                                                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                                                                        to select the group of existing pods which pods will be taken into consideration
+                                                                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                                                        pod labels will be ignored. The default value is empty.
+                                                                                        The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                                                                        Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                                                                    items:
+                                                                                        type: string
+                                                                                    type: array
+                                                                                    x-kubernetes-list-type: atomic
+                                                                                namespaceSelector:
+                                                                                    description: |-
+                                                                                        A label query over the set of namespaces that the term applies to.
+                                                                                        The term is applied to the union of the namespaces selected by this field
+                                                                                        and the ones listed in the namespaces field.
+                                                                                        null selector and null or empty namespaces list means "this pod's namespace".
+                                                                                        An empty selector ({}) matches all namespaces.
+                                                                                    properties:
+                                                                                        matchExpressions:
+                                                                                            description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                                                            items:
+                                                                                                description: |-
+                                                                                                    A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                                                    relates the key and values.
+                                                                                                properties:
+                                                                                                    key:
+                                                                                                        description: key is the label key that the selector applies to.
+                                                                                                        type: string
+                                                                                                    operator:
+                                                                                                        description: |-
+                                                                                                            operator represents a key's relationship to a set of values.
+                                                                                                            Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                                                        type: string
+                                                                                                    values:
+                                                                                                        description: |-
+                                                                                                            values is an array of string values. If the operator is In or NotIn,
+                                                                                                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                                                            the values array must be empty. This array is replaced during a strategic
+                                                                                                            merge patch.
+                                                                                                        items:
+                                                                                                            type: string
+                                                                                                        type: array
+                                                                                                        x-kubernetes-list-type: atomic
+                                                                                                required:
+                                                                                                    - key
+                                                                                                    - operator
+                                                                                                type: object
+                                                                                            type: array
+                                                                                            x-kubernetes-list-type: atomic
+                                                                                        matchLabels:
+                                                                                            additionalProperties:
+                                                                                                type: string
+                                                                                            description: |-
+                                                                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                                                            type: object
+                                                                                    type: object
+                                                                                    x-kubernetes-map-type: atomic
+                                                                                namespaces:
+                                                                                    description: |-
+                                                                                        namespaces specifies a static list of namespace names that the term applies to.
+                                                                                        The term is applied to the union of the namespaces listed in this field
+                                                                                        and the ones selected by namespaceSelector.
+                                                                                        null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                                                                    items:
+                                                                                        type: string
+                                                                                    type: array
+                                                                                    x-kubernetes-list-type: atomic
+                                                                                topologyKey:
+                                                                                    description: |-
+                                                                                        This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                                                                        the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                                                                        whose value of the label with key topologyKey matches that of any node on which any of the
+                                                                                        selected pods is running.
+                                                                                        Empty topologyKey is not allowed.
+                                                                                    type: string
+                                                                            required:
+                                                                                - topologyKey
+                                                                            type: object
+                                                                        weight:
+                                                                            description: |-
+                                                                                weight associated with matching the corresponding podAffinityTerm,
+                                                                                in the range 1-100.
+                                                                            format: int32
+                                                                            type: integer
+                                                                    required:
+                                                                        - podAffinityTerm
+                                                                        - weight
+                                                                    type: object
+                                                                type: array
+                                                                x-kubernetes-list-type: atomic
+                                                            requiredDuringSchedulingIgnoredDuringExecution:
+                                                                description: |-
+                                                                    If the anti-affinity requirements specified by this field are not met at
+                                                                    scheduling time, the pod will not be scheduled onto the node.
+                                                                    If the anti-affinity requirements specified by this field cease to be met
+                                                                    at some point during pod execution (e.g. due to a pod label update), the
+                                                                    system may or may not try to eventually evict the pod from its node.
+                                                                    When there are multiple elements, the lists of nodes corresponding to each
+                                                                    podAffinityTerm are intersected, i.e. all terms must be satisfied.
+                                                                items:
+                                                                    description: |-
+                                                                        Defines a set of pods (namely those matching the labelSelector
+                                                                        relative to the given namespace(s)) that this pod should be
+                                                                        co-located (affinity) or not co-located (anti-affinity) with,
+                                                                        where co-located is defined as running on a node whose value of
+                                                                        the label with key <topologyKey> matches that of any node on which
+                                                                        a pod of the set of pods is running
+                                                                    properties:
+                                                                        labelSelector:
+                                                                            description: |-
+                                                                                A label query over a set of resources, in this case pods.
+                                                                                If it's null, this PodAffinityTerm matches with no Pods.
+                                                                            properties:
+                                                                                matchExpressions:
+                                                                                    description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                                                    items:
+                                                                                        description: |-
+                                                                                            A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                                            relates the key and values.
+                                                                                        properties:
+                                                                                            key:
+                                                                                                description: key is the label key that the selector applies to.
+                                                                                                type: string
+                                                                                            operator:
+                                                                                                description: |-
+                                                                                                    operator represents a key's relationship to a set of values.
+                                                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                                                type: string
+                                                                                            values:
+                                                                                                description: |-
+                                                                                                    values is an array of string values. If the operator is In or NotIn,
+                                                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                                                    the values array must be empty. This array is replaced during a strategic
+                                                                                                    merge patch.
+                                                                                                items:
+                                                                                                    type: string
+                                                                                                type: array
+                                                                                                x-kubernetes-list-type: atomic
+                                                                                        required:
+                                                                                            - key
+                                                                                            - operator
+                                                                                        type: object
+                                                                                    type: array
+                                                                                    x-kubernetes-list-type: atomic
+                                                                                matchLabels:
+                                                                                    additionalProperties:
+                                                                                        type: string
+                                                                                    description: |-
+                                                                                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                                        map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                                        operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                                                    type: object
+                                                                            type: object
+                                                                            x-kubernetes-map-type: atomic
+                                                                        matchLabelKeys:
+                                                                            description: |-
+                                                                                MatchLabelKeys is a set of pod label keys to select which pods will
+                                                                                be taken into consideration. The keys are used to lookup values from the
+                                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                                                                to select the group of existing pods which pods will be taken into consideration
+                                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                                                pod labels will be ignored. The default value is empty.
+                                                                                The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                                                                Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                                                            items:
+                                                                                type: string
+                                                                            type: array
+                                                                            x-kubernetes-list-type: atomic
+                                                                        mismatchLabelKeys:
+                                                                            description: |-
+                                                                                MismatchLabelKeys is a set of pod label keys to select which pods will
+                                                                                be taken into consideration. The keys are used to lookup values from the
+                                                                                incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                                                                to select the group of existing pods which pods will be taken into consideration
+                                                                                for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                                                                pod labels will be ignored. The default value is empty.
+                                                                                The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                                                                Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                                                            items:
+                                                                                type: string
+                                                                            type: array
+                                                                            x-kubernetes-list-type: atomic
+                                                                        namespaceSelector:
+                                                                            description: |-
+                                                                                A label query over the set of namespaces that the term applies to.
+                                                                                The term is applied to the union of the namespaces selected by this field
+                                                                                and the ones listed in the namespaces field.
+                                                                                null selector and null or empty namespaces list means "this pod's namespace".
+                                                                                An empty selector ({}) matches all namespaces.
+                                                                            properties:
+                                                                                matchExpressions:
+                                                                                    description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                                                                    items:
+                                                                                        description: |-
+                                                                                            A label selector requirement is a selector that contains values, a key, and an operator that
+                                                                                            relates the key and values.
+                                                                                        properties:
+                                                                                            key:
+                                                                                                description: key is the label key that the selector applies to.
+                                                                                                type: string
+                                                                                            operator:
+                                                                                                description: |-
+                                                                                                    operator represents a key's relationship to a set of values.
+                                                                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                                                                type: string
+                                                                                            values:
+                                                                                                description: |-
+                                                                                                    values is an array of string values. If the operator is In or NotIn,
+                                                                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                                                                    the values array must be empty. This array is replaced during a strategic
+                                                                                                    merge patch.
+                                                                                                items:
+                                                                                                    type: string
+                                                                                                type: array
+                                                                                                x-kubernetes-list-type: atomic
+                                                                                        required:
+                                                                                            - key
+                                                                                            - operator
+                                                                                        type: object
+                                                                                    type: array
+                                                                                    x-kubernetes-list-type: atomic
+                                                                                matchLabels:
+                                                                                    additionalProperties:
+                                                                                        type: string
+                                                                                    description: |-
+                                                                                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                                                        map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                                                        operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                                                    type: object
+                                                                            type: object
+                                                                            x-kubernetes-map-type: atomic
+                                                                        namespaces:
+                                                                            description: |-
+                                                                                namespaces specifies a static list of namespace names that the term applies to.
+                                                                                The term is applied to the union of the namespaces listed in this field
+                                                                                and the ones selected by namespaceSelector.
+                                                                                null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                                                            items:
+                                                                                type: string
+                                                                            type: array
+                                                                            x-kubernetes-list-type: atomic
+                                                                        topologyKey:
+                                                                            description: |-
+                                                                                This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                                                                the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                                                                whose value of the label with key topologyKey matches that of any node on which any of the
+                                                                                selected pods is running.
+                                                                                Empty topologyKey is not allowed.
+                                                                            type: string
+                                                                    required:
+                                                                        - topologyKey
+                                                                    type: object
+                                                                type: array
+                                                                x-kubernetes-list-type: atomic
+                                                        type: object
+                                                type: object
+                                            nodeSelector:
+                                                additionalProperties:
+                                                    type: string
+                                                description: If specified, applies node selector rules to the pods deployed by the DNSConfig resource.
+                                                type: object
                                             tolerations:
                                                 description: If specified, applies tolerations to the pods deployed by the DNSConfig resource.
                                                 items:
@@ -585,6 +1463,271 @@ spec:
 ---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
+metadata:
+    annotations:
+        controller-gen.kubebuilder.io/version: v0.17.0
+    name: peerrelays.tailscale.com
+spec:
+    group: tailscale.com
+    names:
+        kind: PeerRelay
+        listKind: PeerRelayList
+        plural: peerrelays
+        shortNames:
+            - pr
+        singular: peerrelay
+    scope: Cluster
+    versions:
+        - additionalPrinterColumns:
+            - jsonPath: .metadata.creationTimestamp
+              name: Age
+              type: date
+            - description: Status of the deployed PeerRelay resources.
+              jsonPath: .status.conditions[?(@.type == "PeerRelayReady")].reason
+              name: Status
+              type: string
+            - description: Public addresses the peer relay replicas are reachable on.
+              jsonPath: .status.endpoints[*].address
+              name: Endpoints
+              type: string
+          name: v1alpha1
+          schema:
+            openAPIV3Schema:
+                properties:
+                    apiVersion:
+                        description: |-
+                            APIVersion defines the versioned schema of this representation of an object.
+                            Servers should convert recognized schemas to the latest internal value, and
+                            may reject unrecognized values.
+                            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+                        type: string
+                    kind:
+                        description: |-
+                            Kind is a string value representing the REST resource this object represents.
+                            Servers may infer this from the endpoint the client submits requests to.
+                            Cannot be updated.
+                            In CamelCase.
+                            More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+                        type: string
+                    metadata:
+                        type: object
+                    spec:
+                        description: |-
+                            Spec describes the desired state of the PeerRelay.
+                            More info:
+                            https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+                        properties:
+                            aws:
+                                description: |-
+                                    AWS contains configuration for pinning each replica to a specific AWS Elastic IP and subnet. Only meaningful
+                                    when running on EKS with the AWS Load Balancer Controller. When set, the per-replica values override any
+                                    aws-load-balancer-eip-allocations or aws-load-balancer-subnets values supplied via spec.service.annotations.
+                                properties:
+                                    elasticIPs:
+                                        description: |-
+                                            ElasticIPs pins each replica to a specific AWS EIP allocation and subnet. Only meaningful when Network Load
+                                            Balancers are provisioned by the AWS Load Balancer Controller. ElasticIPs supplies one allocation-subnet pair
+                                            per replica: replica N uses ElasticIPs[N]. The list must be at least as long as spec.replicas so every replica
+                                            has a distinct EIP; extra entries are permitted so that scale-up doesn't immediately trip validation.
+
+                                            When set, the reconciler stamps
+                                            service.beta.kubernetes.io/aws-load-balancer-eip-allocations and
+                                            service.beta.kubernetes.io/aws-load-balancer-subnets on each per-replica Service, overriding any values in
+                                            spec.service.annotations.
+                                        items:
+                                            description: PeerRelayAWSElasticIP pairs an EIP allocation with the subnet in the same AZ.
+                                            properties:
+                                                allocationID:
+                                                    description: |-
+                                                        AllocationID is the AWS EIP allocation ID (e.g. eipalloc-0123abcd) whose public IP this replica is reachable
+                                                        on. Stamped as service.beta.kubernetes.io/aws-load-balancer-eip-allocations on the replica's Service.
+                                                    pattern: ^eipalloc-[0-9a-f]+$
+                                                    type: string
+                                                subnetID:
+                                                    description: |-
+                                                        SubnetID is the AWS subnet in the same availability zone as AllocationID (e.g. subnet-0123abcd). Stamped as
+                                                        service.beta.kubernetes.io/aws-load-balancer-subnets on the replica's Service so the NLB is provisioned in
+                                                        the same AZ as the EIP.
+                                                    pattern: ^subnet-[0-9a-f]+$
+                                                    type: string
+                                            required:
+                                                - allocationID
+                                                - subnetID
+                                            type: object
+                                        minItems: 1
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                required:
+                                    - elasticIPs
+                                type: object
+                            hostnamePrefix:
+                                description: |-
+                                    HostnamePrefix specifies the hostname prefix for each
+                                    replica. Each device will have the integer number
+                                    from its StatefulSet pod appended to this prefix to form the full hostname.
+                                    HostnamePrefix can contain lower case letters, numbers and dashes, it
+                                    must not start with a dash and must be between 1 and 62 characters long.
+                                pattern: ^[a-z0-9][a-z0-9-]{0,61}$
+                                type: string
+                            proxyClass:
+                                description: |-
+                                    ProxyClass is the name of the ProxyClass custom resource that
+                                    contains configuration options that should be applied to the
+                                    resources created for this PeerRelay. If unset, the operator will
+                                    create resources with the default configuration.
+                                type: string
+                            replicas:
+                                default: 1
+                                description: |-
+                                    Replicas specifies how many devices to create. Set this to enable
+                                    high availability for peer relays.
+                                    https://tailscale.com/kb/1115/high-availability. Defaults to 1.
+                                format: int32
+                                minimum: 0
+                                type: integer
+                            service:
+                                description: Service contains configuration values to modify the LoadBalancer service used to expose the peer relay.
+                                properties:
+                                    annotations:
+                                        additionalProperties:
+                                            type: string
+                                        description: |-
+                                            Annotations to apply to the LoadBalancer service. Any annotations that conflict with those used by known
+                                            cloud providers to ensure IP addresses rather than DNS names are ignored.
+                                        type: object
+                                type: object
+                            tags:
+                                description: |-
+                                    Tags that the Tailscale node will be tagged with.
+                                    Defaults to [tag:k8s].
+                                    To autoapprove the device defined by a PeerRelay,
+                                    you can configure Tailscale ACLs to give these tags the necessary
+                                    permissions.
+                                    See https://tailscale.com/kb/1337/acl-syntax#autoapprovers.
+                                    If you specify custom tags here, you must also make the operator an owner of these tags.
+                                    See  https://tailscale.com/kb/1236/kubernetes-operator/#setting-up-the-kubernetes-operator.
+                                    Tags cannot be changed once a PeerRelay node has been created.
+                                    Tag values must be in form ^tag:[a-zA-Z][a-zA-Z0-9-]*$.
+                                items:
+                                    pattern: ^tag:[a-zA-Z][a-zA-Z0-9-]*$
+                                    type: string
+                                type: array
+                            tailnet:
+                                description: |-
+                                    Tailnet specifies the tailnet this PeerRelay should join. If blank, the default tailnet is used. When set, this
+                                    name must match that of a valid Tailnet resource. This field is immutable and cannot be changed once set.
+                                type: string
+                                x-kubernetes-validations:
+                                    - message: PeerRelay tailnet is immutable
+                                      rule: self == oldSelf
+                        type: object
+                        x-kubernetes-validations:
+                            - message: spec.aws.elasticIPs must contain at least one entry per replica
+                              rule: '!has(self.aws) || !has(self.aws.elasticIPs) || self.aws.elasticIPs.size() >= self.replicas'
+                    status:
+                        description: |-
+                            Status describes the status of the PeerRelay. This is set
+                            and managed by the Tailscale operator.
+                        properties:
+                            conditions:
+                                items:
+                                    description: Condition contains details for one aspect of the current state of this API Resource.
+                                    properties:
+                                        lastTransitionTime:
+                                            description: |-
+                                                lastTransitionTime is the last time the condition transitioned from one status to another.
+                                                This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                                            format: date-time
+                                            type: string
+                                        message:
+                                            description: |-
+                                                message is a human readable message indicating details about the transition.
+                                                This may be an empty string.
+                                            maxLength: 32768
+                                            type: string
+                                        observedGeneration:
+                                            description: |-
+                                                observedGeneration represents the .metadata.generation that the condition was set based upon.
+                                                For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                                                with respect to the current state of the instance.
+                                            format: int64
+                                            minimum: 0
+                                            type: integer
+                                        reason:
+                                            description: |-
+                                                reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                                                Producers of specific condition types may define expected values and meanings for this field,
+                                                and whether the values are considered a guaranteed API.
+                                                The value should be a CamelCase string.
+                                                This field may not be empty.
+                                            maxLength: 1024
+                                            minLength: 1
+                                            pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                                            type: string
+                                        status:
+                                            description: status of the condition, one of True, False, Unknown.
+                                            enum:
+                                                - "True"
+                                                - "False"
+                                                - Unknown
+                                            type: string
+                                        type:
+                                            description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                                            maxLength: 316
+                                            pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                                            type: string
+                                    required:
+                                        - lastTransitionTime
+                                        - message
+                                        - reason
+                                        - status
+                                        - type
+                                    type: object
+                                type: array
+                                x-kubernetes-list-map-keys:
+                                    - type
+                                x-kubernetes-list-type: map
+                            endpoints:
+                                description: |-
+                                    Endpoints lists the public address:port pairs each peer relay replica is reachable on. There is one entry
+                                    per replica whose LoadBalancer Service has been assigned a public address; entries appear as the underlying
+                                    cloud provisions each Service.
+                                items:
+                                    properties:
+                                        address:
+                                            description: |-
+                                                Address is the public IP or hostname the cloud has allocated for this replica's LoadBalancer Service.
+                                                Peers reach this relay by connecting to Address:Port over UDP.
+                                            type: string
+                                        port:
+                                            description: Port is the UDP port the peer relay listens on.
+                                            format: int32
+                                            type: integer
+                                        replica:
+                                            description: Replica is the zero-based index of the peer relay replica this endpoint targets.
+                                            format: int32
+                                            type: integer
+                                    required:
+                                        - address
+                                        - port
+                                        - replica
+                                    type: object
+                                type: array
+                                x-kubernetes-list-map-keys:
+                                    - replica
+                                x-kubernetes-list-type: map
+                        type: object
+                required:
+                    - metadata
+                    - spec
+                type: object
+          served: true
+          storage: true
+          subresources:
+            status: {}
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
 metadata:
     annotations:
         controller-gen.kubebuilder.io/version: v0.17.0
@@ -5273,12 +6416,15 @@ spec:
                             https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
                         properties:
                             credentials:
-                                description: Denotes the location of the OAuth credentials to use for authenticating with this Tailnet.
+                                description: Denotes the location of the credentials to use for authenticating with this Tailnet.
                                 properties:
                                     secretName:
                                         description: |-
-                                            The name of the secret containing the OAuth credentials. This secret must contain two fields "client_id" and
-                                            "client_secret".
+                                            The name of the secret containing the credentials used to authenticate with this Tailnet. The secret must always
+                                            contain a "client_id" field. To authenticate with a static OAuth client, also set "client_secret". To authenticate
+                                            via workload identity federation, set "audience" to the audience value expected by the Tailscale OAuth
+                                            client; the operator will mint a ServiceAccount token for itself with that audience and exchange it for an API
+                                            token. "client_secret" and "audience" are mutually exclusive.
                                         type: string
                                 required:
                                     - secretName
@@ -5454,6 +6600,16 @@ rules:
         - list
         - watch
         - update
+    - apiGroups:
+        - tailscale.com
+      resources:
+        - peerrelays
+        - peerrelays/status
+      verbs:
+        - get
+        - list
+        - watch
+        - update
     - apiGroups:
         - tailscale.com
       resources:
@@ -5531,6 +6687,14 @@ rules:
         - patch
         - update
         - watch
+    - apiGroups:
+        - ""
+      resourceNames:
+        - operator
+      resources:
+        - serviceaccounts/token
+      verbs:
+        - create
     - apiGroups:
         - ""
       resources:
@@ -5682,6 +6846,10 @@ spec:
                       valueFrom:
                         fieldRef:
                             fieldPath: metadata.namespace
+                    - name: OPERATOR_SERVICE_ACCOUNT_NAME
+                      valueFrom:
+                        fieldRef:
+                            fieldPath: spec.serviceAccountName
                     - name: OPERATOR_LOGIN_SERVER
                       value: null
                     - name: OPERATOR_INGRESS_CLASS_NAME
@@ -5706,6 +6874,8 @@ spec:
                       valueFrom:
                         fieldRef:
                             fieldPath: metadata.uid
+                    - name: OPERATOR_SHARED_ACME_ACCOUNT_KEY
+                      value: "false"
                   image: tailscale/k8s-operator:stable
                   imagePullPolicy: Always
                   name: operator
diff --git a/cmd/k8s-operator/dnsrecords.go b/cmd/k8s-operator/dnsrecords.go
index e75bcd4c2..762223df8 100644
--- a/cmd/k8s-operator/dnsrecords.go
+++ b/cmd/k8s-operator/dnsrecords.go
@@ -22,6 +22,7 @@ import (
 	"k8s.io/utils/net"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+
 	operatorutils "tailscale.com/k8s-operator"
 	tsapi "tailscale.com/k8s-operator/apis/v1alpha1"
 	"tailscale.com/util/mak"
@@ -106,6 +107,7 @@ func (dnsRR *dnsRecordsReconciler) Reconcile(ctx context.Context, req reconcile.
 	if err := dnsRR.maybeProvision(ctx, proxySvc, logger); err != nil {
 		if strings.Contains(err.Error(), optimisticLockErrorMsg) {
 			logger.Infof("optimistic lock error, retrying: %s", err)
+			return reconcile.Result{RequeueAfter: shortRequeue}, nil
 		} else {
 			return reconcile.Result{}, err
 		}
@@ -281,19 +283,26 @@ func (dnsRR *dnsRecordsReconciler) fqdnForDNSRecord(ctx context.Context, proxySv
 		if err := dnsRR.Get(ctx, parentName, ing); err != nil {
 			return "", err
 		}
+
 		if len(ing.Status.LoadBalancer.Ingress) == 0 {
 			return "", nil
 		}
+
 		return ing.Status.LoadBalancer.Ingress[0].Hostname, nil
 	}
+
 	if isManagedByType(proxySvc, serviceTypeSvc) {
-		svc := new(corev1.Service)
-		if err := dnsRR.Get(ctx, parentName, svc); apierrors.IsNotFound(err) {
-			logger.Infof("[unexpected] parent Service for egress proxy %s not found", proxySvc.Name)
+		var svc corev1.Service
+
+		err := dnsRR.Get(ctx, parentName, &svc)
+		switch {
+		case apierrors.IsNotFound(err):
+			logger.Warnf("parent Service for egress proxy %q not found", proxySvc.Name)
 			return "", nil
-		} else if err != nil {
+		case err != nil:
 			return "", err
 		}
+
 		return svc.Annotations[AnnotationTailnetTargetFQDN], nil
 	}
 	return "", nil
@@ -303,28 +312,31 @@ func (dnsRR *dnsRecordsReconciler) fqdnForDNSRecord(ctx context.Context, proxySv
 // ConfigMap. At this point the in-cluster ts.net nameserver is expected to be
 // successfully created together with the ConfigMap.
 func (dnsRR *dnsRecordsReconciler) updateDNSConfig(ctx context.Context, update func(*operatorutils.Records)) error {
-	cm := &corev1.ConfigMap{}
-	err := dnsRR.Get(ctx, types.NamespacedName{Name: operatorutils.DNSRecordsCMName, Namespace: dnsRR.tsNamespace}, cm)
-	if apierrors.IsNotFound(err) {
-		dnsRR.logger.Info("[unexpected] dnsrecords ConfigMap not found in cluster. Not updating DNS records. Please open an issue and attach operator logs.")
+	var cm corev1.ConfigMap
+	err := dnsRR.Get(ctx, types.NamespacedName{Name: operatorutils.DNSRecordsCMName, Namespace: dnsRR.tsNamespace}, &cm)
+	switch {
+	case apierrors.IsNotFound(err):
+		dnsRR.logger.Warn("dnsrecords ConfigMap not found in cluster. Not updating DNS records. Please open an issue and attach operator logs.")
 		return nil
+	case err != nil:
+		return fmt.Errorf("failed to retrieve dnsrecords ConfigMap: %w", err)
 	}
-	if err != nil {
-		return fmt.Errorf("error retrieving dnsrecords ConfigMap: %w", err)
-	}
+
 	dnsRecords := operatorutils.Records{Version: operatorutils.Alpha1Version, IP4: map[string][]string{}}
 	if cm.Data != nil && cm.Data[operatorutils.DNSRecordsCMKey] != "" {
-		if err := json.Unmarshal([]byte(cm.Data[operatorutils.DNSRecordsCMKey]), &dnsRecords); err != nil {
+		if err = json.Unmarshal([]byte(cm.Data[operatorutils.DNSRecordsCMKey]), &dnsRecords); err != nil {
 			return err
 		}
 	}
+
 	update(&dnsRecords)
 	dnsRecordsBs, err := json.Marshal(dnsRecords)
 	if err != nil {
 		return fmt.Errorf("error marshalling DNS records: %w", err)
 	}
+
 	mak.Set(&cm.Data, operatorutils.DNSRecordsCMKey, string(dnsRecordsBs))
-	return dnsRR.Update(ctx, cm)
+	return dnsRR.Update(ctx, &cm)
 }
 
 // isSvcForFQDNEgressProxy returns true if the Service is a headless Service
diff --git a/cmd/k8s-operator/dnsrecords_test.go b/cmd/k8s-operator/dnsrecords_test.go
index c6c5ee029..a2a612351 100644
--- a/cmd/k8s-operator/dnsrecords_test.go
+++ b/cmd/k8s-operator/dnsrecords_test.go
@@ -8,6 +8,7 @@ package main
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"testing"
 
@@ -21,6 +22,8 @@ import (
 	"k8s.io/apimachinery/pkg/util/intstr"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+	"sigs.k8s.io/controller-runtime/pkg/client/interceptor"
+	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 	operatorutils "tailscale.com/k8s-operator"
 	tsapi "tailscale.com/k8s-operator/apis/v1alpha1"
 	"tailscale.com/kube/kubetypes"
@@ -290,6 +293,88 @@ func TestDNSRecordsReconcilerErrorCases(t *testing.T) {
 	}
 }
 
+func TestDNSRecordsReconcilerOptimisticLockError(t *testing.T) {
+	zl, err := zap.NewDevelopment()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	funcs := interceptor.Funcs{
+		Update: func(ctx context.Context, client client.WithWatch, obj client.Object, opts ...client.UpdateOption) error {
+			return errors.New(optimisticLockErrorMsg)
+		},
+	}
+
+	dnsCfg := &tsapi.DNSConfig{
+		ObjectMeta: metav1.ObjectMeta{Name: "test"},
+		TypeMeta:   metav1.TypeMeta{Kind: "DNSConfig"},
+		Spec:       tsapi.DNSConfigSpec{Nameserver: &tsapi.Nameserver{}},
+	}
+	dnsCfg.Status.Conditions = append(dnsCfg.Status.Conditions, metav1.Condition{
+		Type:   string(tsapi.NameserverReady),
+		Status: metav1.ConditionTrue,
+	})
+
+	egressSvc := &corev1.Service{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "lock-service",
+			Namespace: "default",
+			Annotations: map[string]string{
+				AnnotationTailnetTargetFQDN: "lock-service.example.ts.net",
+			},
+		},
+		Spec: corev1.ServiceSpec{
+			Type:         corev1.ServiceTypeExternalName,
+			ExternalName: "unused",
+		},
+	}
+
+	proxyGroupEgressSvc := &corev1.Service{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "ts-proxygroup-egress-abcd1",
+			Namespace: "tailscale",
+			Labels: map[string]string{
+				kubetypes.LabelManaged: "true",
+				LabelParentName:        "lock-service",
+				LabelParentNamespace:   "default",
+				LabelParentType:        "svc",
+				labelProxyGroup:        "test-proxy-group",
+				labelSvcType:           typeEgress,
+			},
+		},
+	}
+
+	f := fake.NewClientBuilder().
+		WithInterceptorFuncs(funcs).
+		WithScheme(tsapi.GlobalScheme).
+		WithObjects(dnsCfg, proxyGroupEgressSvc, egressSvc).
+		WithStatusSubresource(dnsCfg).
+		Build()
+
+	dnsRR := &dnsRecordsReconciler{
+		Client:      f,
+		tsNamespace: "tailscale",
+		logger:      zl.Sugar(),
+	}
+
+	namespacedName := types.NamespacedName{
+		Namespace: proxyGroupEgressSvc.GetNamespace(),
+		Name:      proxyGroupEgressSvc.GetName(),
+	}
+
+	res, err := dnsRR.Reconcile(t.Context(), reconcile.Request{
+		NamespacedName: namespacedName,
+	})
+
+	if err != nil {
+		t.Errorf("expected requeueAfter in result, got error: %s", err)
+	}
+
+	if res.RequeueAfter == 0 {
+		t.Errorf("exptected requeueAfter in result to be > 0, got %d", res.RequeueAfter)
+	}
+}
+
 func TestDNSRecordsReconcilerDualStack(t *testing.T) {
 	// Test dual-stack (IPv4 and IPv6) scenarios
 	zl, err := zap.NewDevelopment()
diff --git a/cmd/k8s-operator/e2e/ingress_test.go b/cmd/k8s-operator/e2e/ingress_test.go
index 4eb813a77..bef24ca5a 100644
--- a/cmd/k8s-operator/e2e/ingress_test.go
+++ b/cmd/k8s-operator/e2e/ingress_test.go
@@ -17,9 +17,11 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
+	"tailscale.com/client/tailscale/v2"
 	kube "tailscale.com/k8s-operator"
 	tsapi "tailscale.com/k8s-operator/apis/v1alpha1"
 	"tailscale.com/kube/kubetypes"
+	"tailscale.com/tsnet"
 	"tailscale.com/tstest"
 	"tailscale.com/util/httpm"
 )
@@ -31,12 +33,12 @@ func TestL3Ingress(t *testing.T) {
 	}
 
 	// Apply nginx
-	createAndCleanup(t, kubeClient, nginxDeployment(ns, "nginx"))
+	nginx := nginxDeployment(ns)
+	createAndCleanup(t, kubeClient, nginx)
 	// Apply service to expose it as ingress
-	name := generateName("test-ingress")
 	svc := &corev1.Service{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:      name,
+			Name:      generateName("test-ingress"),
 			Namespace: ns,
 			Annotations: map[string]string{
 				"tailscale.com/expose": "true",
@@ -44,7 +46,7 @@ func TestL3Ingress(t *testing.T) {
 		},
 		Spec: corev1.ServiceSpec{
 			Selector: map[string]string{
-				"app.kubernetes.io/name": "nginx",
+				"app.kubernetes.io/name": nginx.Name,
 			},
 			Ports: []corev1.ServicePort{
 				{
@@ -58,7 +60,7 @@ func TestL3Ingress(t *testing.T) {
 	createAndCleanup(t, kubeClient, svc)
 
 	if err := tstest.WaitFor(time.Minute, func() error {
-		maybeReadySvc := &corev1.Service{ObjectMeta: objectMeta(ns, name)}
+		maybeReadySvc := &corev1.Service{ObjectMeta: objectMeta(ns, svc.Name)}
 		if err := get(t.Context(), kubeClient, maybeReadySvc); err != nil {
 			return err
 		}
@@ -79,7 +81,7 @@ func TestL3Ingress(t *testing.T) {
 		if err := kubeClient.List(t.Context(), &secrets,
 			client.InNamespace("tailscale"),
 			client.MatchingLabels{
-				"tailscale.com/parent-resource":    name,
+				"tailscale.com/parent-resource":    svc.Name,
 				"tailscale.com/parent-resource-ns": ns,
 			},
 		); err != nil {
@@ -109,33 +111,34 @@ func TestL3HAIngress(t *testing.T) {
 	}
 
 	// Apply nginx.
-	createAndCleanup(t, kubeClient, nginxDeployment(ns, "nginx"))
+	nginx := nginxDeployment(ns)
+	createAndCleanup(t, kubeClient, nginx)
 
 	// Create an ingress ProxyGroup.
-	createAndCleanup(t, kubeClient, &tsapi.ProxyGroup{
+	pg := &tsapi.ProxyGroup{
 		ObjectMeta: metav1.ObjectMeta{
-			Name: "ingress",
+			Name: generateName("ingress"),
 		},
 		Spec: tsapi.ProxyGroupSpec{
 			Type: tsapi.ProxyGroupTypeIngress,
 		},
-	})
+	}
+	createAndCleanup(t, kubeClient, pg)
 
 	// Apply a Service to expose nginx via the ProxyGroup.
-	name := generateName("test-ingress")
 	svc := &corev1.Service{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:      name,
+			Name:      generateName("test-ingress"),
 			Namespace: ns,
 			Annotations: map[string]string{
-				"tailscale.com/proxy-group": "ingress",
+				"tailscale.com/proxy-group": pg.Name,
 			},
 		},
 		Spec: corev1.ServiceSpec{
 			Type:              corev1.ServiceTypeLoadBalancer,
 			LoadBalancerClass: new("tailscale"),
 			Selector: map[string]string{
-				"app.kubernetes.io/name": "nginx",
+				"app.kubernetes.io/name": nginx.Name,
 			},
 			Ports: []corev1.ServicePort{
 				{
@@ -150,12 +153,12 @@ func TestL3HAIngress(t *testing.T) {
 
 	var svcIPv4 string
 	forceReconcile := triggerReconcile(t,
-		client.ObjectKey{Namespace: ns, Name: name},
+		client.ObjectKey{Namespace: ns, Name: svc.Name},
 		&corev1.Service{}, 30*time.Second)
 
 	// Wait for Service to be ready
 	if err := tstest.WaitFor(5*time.Minute, func() error {
-		maybeReadySvc := &corev1.Service{ObjectMeta: objectMeta(ns, name)}
+		maybeReadySvc := &corev1.Service{ObjectMeta: objectMeta(ns, svc.Name)}
 		forceReconcile()
 		if err := get(t.Context(), kubeClient, maybeReadySvc); err != nil {
 			return err
@@ -186,15 +189,16 @@ func TestL7Ingress(t *testing.T) {
 	}
 
 	// Apply nginx Deployment and Service.
-	createAndCleanup(t, kubeClient, nginxDeployment(ns, "nginx"))
+	nginx := nginxDeployment(ns)
+	createAndCleanup(t, kubeClient, nginx)
 	createAndCleanup(t, kubeClient, &corev1.Service{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:      "nginx",
+			Name:      nginx.Name,
 			Namespace: ns,
 		},
 		Spec: corev1.ServiceSpec{
 			Selector: map[string]string{
-				"app.kubernetes.io/name": "nginx",
+				"app.kubernetes.io/name": nginx.Name,
 			},
 			Ports: []corev1.ServicePort{
 				{
@@ -206,13 +210,12 @@ func TestL7Ingress(t *testing.T) {
 	})
 
 	// Apply Ingress to expose nginx.
-	name := generateName("test-ingress")
-	ingress := l7Ingress(ns, name, map[string]string{})
+	ingress := l7Ingress(ns, nginx.Name, map[string]string{})
 	createAndCleanup(t, kubeClient, ingress)
 
 	t.Log("Waiting for the Ingress to be ready...")
 
-	hostname, err := waitForIngressHostname(t, ns, name)
+	hostname, err := waitForIngressHostname(t, ns, ingress.Name)
 	if err != nil {
 		t.Fatalf("error waiting for Ingress hostname: %v", err)
 	}
@@ -228,15 +231,16 @@ func TestL7HAIngress(t *testing.T) {
 	}
 
 	// Apply nginx Deployment and Service.
-	createAndCleanup(t, kubeClient, nginxDeployment(ns, "nginx"))
+	nginx := nginxDeployment(ns)
+	createAndCleanup(t, kubeClient, nginx)
 	createAndCleanup(t, kubeClient, &corev1.Service{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:      "nginx",
+			Name:      nginx.Name,
 			Namespace: ns,
 		},
 		Spec: corev1.ServiceSpec{
 			Selector: map[string]string{
-				"app.kubernetes.io/name": "nginx",
+				"app.kubernetes.io/name": nginx.Name,
 			},
 			Ports: []corev1.ServicePort{
 				{
@@ -248,23 +252,23 @@ func TestL7HAIngress(t *testing.T) {
 	})
 
 	// Create ProxyGroup that the Ingress will reference.
-	createAndCleanup(t, kubeClient, &tsapi.ProxyGroup{
+	pg := &tsapi.ProxyGroup{
 		ObjectMeta: metav1.ObjectMeta{
-			Name: "ingress",
+			Name: generateName("ingress"),
 		},
 		Spec: tsapi.ProxyGroupSpec{
 			Type: tsapi.ProxyGroupTypeIngress,
 		},
-	})
+	}
+	createAndCleanup(t, kubeClient, pg)
 
 	// Apply Ingress to expose nginx.
-	name := generateName("test-ingress")
-	ingress := l7Ingress(ns, name, map[string]string{"tailscale.com/proxy-group": "ingress"})
+	ingress := l7Ingress(ns, nginx.Name, map[string]string{"tailscale.com/proxy-group": pg.Name})
 	createAndCleanup(t, kubeClient, ingress)
 
 	t.Log("Waiting for the Ingress to be ready...")
 
-	hostname, err := waitForIngressHostname(t, ns, name)
+	hostname, err := waitForIngressHostname(t, ns, ingress.Name)
 	if err != nil {
 		t.Fatalf("error waiting for Ingress hostname: %v", err)
 	}
@@ -274,7 +278,88 @@ func TestL7HAIngress(t *testing.T) {
 	}
 }
 
-func l7Ingress(namespace, name string, annotations map[string]string) *networkingv1.Ingress {
+func TestL7HAIngressMultiTailnet(t *testing.T) {
+	if tnClient == nil || secondTNClient == nil {
+		t.Skip("TestL7HAIngressMultiTailnet requires a working tailnet client for a first and second tailnet")
+	}
+
+	// Apply nginx Deployment and Service.
+	nginx := nginxDeployment(ns)
+	createAndCleanup(t, kubeClient, nginx)
+	createAndCleanup(t, kubeClient, &corev1.Service{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      nginx.Name,
+			Namespace: ns,
+		},
+		Spec: corev1.ServiceSpec{
+			Selector: map[string]string{
+				"app.kubernetes.io/name": nginx.Name,
+			},
+			Ports: []corev1.ServicePort{
+				{
+					Name: "http",
+					Port: 80,
+				},
+			},
+		},
+	})
+
+	// Create Ingress ProxyGroup for each Tailnet.
+	firstTailnetPG := &tsapi.ProxyGroup{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: generateName("first-tailnet"),
+		},
+		Spec: tsapi.ProxyGroupSpec{
+			Type: tsapi.ProxyGroupTypeIngress,
+		},
+	}
+	createAndCleanup(t, kubeClient, firstTailnetPG)
+	secondTailnetPG := &tsapi.ProxyGroup{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: generateName("second-tailnet"),
+		},
+		Spec: tsapi.ProxyGroupSpec{
+			Type:    tsapi.ProxyGroupTypeIngress,
+			Tailnet: "second-tailnet",
+		},
+	}
+	createAndCleanup(t, kubeClient, secondTailnetPG)
+
+	if err := verifyProxyGroupTailnet(t, firstTailnetPG, tnClient); err != nil {
+		t.Fatalf("verifying ProxyGroup %s is registered to the correct tailnet: %v", firstTailnetPG.Name, err)
+	}
+	if err := verifyProxyGroupTailnet(t, secondTailnetPG, secondTNClient); err != nil {
+		t.Fatalf("verifying ProxyGroup %s is registered to the correct tailnet: %v", secondTailnetPG.Name, err)
+	}
+
+	// Apply Ingress to expose nginx.
+	ingress := l7Ingress(ns, nginx.Name, map[string]string{
+		"tailscale.com/proxy-group": secondTailnetPG.Name,
+	})
+	createAndCleanup(t, kubeClient, ingress)
+
+	// Check that the tailscale (VIP) Service has been created in the expected Tailnet.
+	svcName := "svc:" + ingress.Name
+	if err := tstest.WaitFor(3*time.Minute, func() error {
+		_, err := secondTSClient.VIPServices().Get(t.Context(), svcName)
+		if tailscale.IsNotFound(err) {
+			return fmt.Errorf("Tailscale service %q not yet in expected tailnet", svcName)
+		}
+		return err
+	}); err != nil {
+		t.Fatalf("Tailscale service %q never appeared in expected tailnet: %v", svcName, err)
+	}
+	hostname, err := waitForIngressHostname(t, ns, ingress.Name)
+	if err != nil {
+		t.Fatalf("error waiting for Ingress hostname: %v", err)
+	}
+	if err := testIngressIsReachable(t, newHTTPClient(secondTNClient), fmt.Sprintf("https://%s:443", hostname)); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func l7Ingress(namespace, svc string, annotations map[string]string) *networkingv1.Ingress {
+	name := generateName("test-ingress")
 	ingress := &networkingv1.Ingress{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:        name,
@@ -296,7 +381,7 @@ func l7Ingress(namespace, name string, annotations map[string]string) *networkin
 									PathType: new(networkingv1.PathTypePrefix),
 									Backend: networkingv1.IngressBackend{
 										Service: &networkingv1.IngressServiceBackend{
-											Name: "nginx",
+											Name: svc,
 											Port: networkingv1.ServiceBackendPort{
 												Number: 80,
 											},
@@ -313,26 +398,27 @@ func l7Ingress(namespace, name string, annotations map[string]string) *networkin
 	return ingress
 }
 
-func nginxDeployment(namespace, name string) *appsv1.Deployment {
+func nginxDeployment(namespace string) *appsv1.Deployment {
+	name := generateName("nginx")
 	return &appsv1.Deployment{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      name,
 			Namespace: namespace,
 			Labels: map[string]string{
-				"app.kubernetes.io/name": "nginx",
+				"app.kubernetes.io/name": name,
 			},
 		},
 		Spec: appsv1.DeploymentSpec{
 			Replicas: new(int32(1)),
 			Selector: &metav1.LabelSelector{
 				MatchLabels: map[string]string{
-					"app.kubernetes.io/name": "nginx",
+					"app.kubernetes.io/name": name,
 				},
 			},
 			Template: corev1.PodTemplateSpec{
 				ObjectMeta: metav1.ObjectMeta{
 					Labels: map[string]string{
-						"app.kubernetes.io/name": "nginx",
+						"app.kubernetes.io/name": name,
 					},
 				},
 				Spec: corev1.PodSpec{
@@ -406,6 +492,56 @@ func testIngressIsReachable(t *testing.T, httpClient *http.Client, url string) e
 	return nil
 }
 
+// verifyProxyGroupTailnet verifies that a ProxyGroup is registered to the correct tailnet.
+// This is done by getting the expected tailnet domain for the tailnet client,
+// and comparing this with the actual device fqdn in the ProxyGroup state secret.
+func verifyProxyGroupTailnet(t *testing.T, pg *tsapi.ProxyGroup, cl *tsnet.Server) error {
+	t.Helper()
+	// Determine the expected tailnet Magic DNS Name.
+	lc, err := cl.LocalClient()
+	if err != nil {
+		return err
+	}
+	status, err := lc.Status(t.Context())
+	if err != nil {
+		return err
+	}
+	_, expectedTailnet, ok := strings.Cut(strings.TrimSuffix(status.Self.DNSName, "."), ".")
+	if !ok {
+		return fmt.Errorf("unexpected DNSName format %q", status.Self.DNSName)
+	}
+	// Read the device FQDN from the first state secret for the ProxyGroup,
+	// and verify that this matches the expected tailnet.
+	if err := tstest.WaitFor(3*time.Minute, func() error {
+		var secrets corev1.SecretList
+		if err := kubeClient.List(t.Context(), &secrets,
+			client.InNamespace("tailscale"),
+			client.MatchingLabels{
+				kubetypes.LabelSecretType:            kubetypes.LabelSecretTypeState,
+				"tailscale.com/parent-resource-type": "proxygroup",
+				"tailscale.com/parent-resource":      pg.Name,
+			},
+		); err != nil {
+			return err
+		}
+		if len(secrets.Items) == 0 {
+			return fmt.Errorf("no state secrets found for ProxyGroup %q yet", pg.Name)
+		}
+		fqdn := strings.TrimSuffix(string(secrets.Items[0].Data[kubetypes.KeyDeviceFQDN]), ".")
+		_, tailnet, ok := strings.Cut(fqdn, ".")
+		if !ok {
+			return fmt.Errorf("ProxyGroup %q: device FQDN %q has no domain yet", pg.Name, fqdn)
+		}
+		if tailnet != expectedTailnet {
+			return fmt.Errorf("ProxyGroup %q on wrong tailnet: got domain %q, want %q", pg.Name, tailnet, expectedTailnet)
+		}
+		return nil
+	}); err != nil {
+		return fmt.Errorf("ProxyGroup %q not on expected tailnet: %v", pg.Name, err)
+	}
+	return nil
+}
+
 func waitForIngressHostname(t *testing.T, namespace, name string) (string, error) {
 	t.Helper()
 	var hostname string
diff --git a/cmd/k8s-operator/e2e/main_test.go b/cmd/k8s-operator/e2e/main_test.go
index 02f614014..9eab9e301 100644
--- a/cmd/k8s-operator/e2e/main_test.go
+++ b/cmd/k8s-operator/e2e/main_test.go
@@ -54,7 +54,7 @@ func createAndCleanup(t *testing.T, cl client.Client, obj client.Object) {
 	t.Cleanup(func() {
 		// Use context.Background() for cleanup, as t.Context() is cancelled
 		// just before cleanup functions are called.
-		if err = cl.Delete(context.Background(), obj); err != nil {
+		if err := cl.Delete(context.Background(), obj); err != nil {
 			t.Errorf("error cleaning up %s %s/%s: %s", obj.GetObjectKind().GroupVersionKind(), obj.GetNamespace(), obj.GetName(), err)
 		}
 	})
@@ -69,7 +69,7 @@ func createAndCleanupErr(t *testing.T, cl client.Client, obj client.Object) erro
 	}
 
 	t.Cleanup(func() {
-		if err = cl.Delete(context.Background(), obj); err != nil {
+		if err := cl.Delete(context.Background(), obj); err != nil {
 			t.Errorf("error cleaning up %s %s/%s: %s", obj.GetObjectKind().GroupVersionKind(), obj.GetNamespace(), obj.GetName(), err)
 		}
 	})
diff --git a/cmd/k8s-operator/e2e/setup.go b/cmd/k8s-operator/e2e/setup.go
index 55d4652d8..0d4ca80ad 100644
--- a/cmd/k8s-operator/e2e/setup.go
+++ b/cmd/k8s-operator/e2e/setup.go
@@ -4,6 +4,7 @@
 package e2e
 
 import (
+	"bytes"
 	"context"
 	"crypto/rand"
 	"crypto/tls"
@@ -39,6 +40,7 @@ import (
 	"helm.sh/helm/v3/pkg/release"
 	"helm.sh/helm/v3/pkg/storage/driver"
 	corev1 "k8s.io/api/core/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/watch"
 	"k8s.io/client-go/rest"
@@ -69,10 +71,13 @@ const (
 )
 
 var (
-	tsClient   *tailscale.Client // For API calls to control.
-	tnClient   *tsnet.Server     // For testing real tailnet traffic.
-	restCfg    *rest.Config      // For constructing a client-go client if necessary.
-	kubeClient client.WithWatch  // For k8s API calls.
+	tsClient           *tailscale.Client // For API calls to control.
+	tnClient           *tsnet.Server     // For testing real tailnet traffic on first tailnet.
+	secondTSClient     *tailscale.Client // For API calls to the secondary tailnet (_second_tailnet).
+	secondTNClient     *tsnet.Server     // For testing real tailnet traffic on second tailnet.
+	restCfg            *rest.Config      // For constructing a client-go client if necessary.
+	kubeClient         client.WithWatch  // For k8s API calls.
+	clusterLoginServer string
 
 	//go:embed certs/pebble.minica.crt
 	pebbleMiniCACert []byte
@@ -157,11 +162,11 @@ func runTests(m *testing.M) (int, error) {
 	}
 
 	var (
-		clusterLoginServer     string   // Login server from cluster Pod point of view.
-		clientID, clientSecret string   // OAuth client for the operator to use.
+		clientID, clientSecret string   // OAuth client for the first tailnet (for the operator to use).
 		caPaths                []string // Extra CA cert file paths to add to images.
 
-		certsDir = filepath.Join(tmp, "certs") // Directory containing extra CA certs to add to images.
+		certsDir                           = filepath.Join(tmp, "certs") // Directory containing extra CA certs to add to images.
+		secondClientID, secondClientSecret string                        // OAuth client for the second tailnet (for the operator to use).
 	)
 	if *fDevcontrol {
 		// Deploy pebble and get its certs.
@@ -279,7 +284,7 @@ func runTests(m *testing.M) (int, error) {
 			return 0, fmt.Errorf("failed to set policy file: %w", err)
 		}
 
-		logger.Infof("ACLs configured")
+		logger.Info("ACLs configured for first tailnet")
 
 		key, err := tsClient.Keys().CreateOAuthClient(ctx, tailscale.CreateOAuthClientRequest{
 			Scopes:      []string{"auth_keys", "devices:core", "services"},
@@ -287,36 +292,77 @@ func runTests(m *testing.M) (int, error) {
 			Description: "k8s-operator client for e2e tests",
 		})
 		if err != nil {
-			return 0, fmt.Errorf("failed to marshal OAuth client creation request: %w", err)
+			return 0, fmt.Errorf("failed to create OAuth client for first tailnet: %w", err)
 		}
-
 		clientID = key.ID
 		clientSecret = key.Key
+
+		logger.Info("OAuth credentials set for first tailnet")
+
+		// Create second tailnet. The bootstrap credentials returned have 'all' permissions-
+		// they are used for administrative actions and to create a separately scoped
+		// Oauth client for the k8s operator.
+		bootstrapClient, err := createTailnet(ctx, tsClient)
+		if err != nil {
+			return 0, fmt.Errorf("failed to create second tailnet: %w", err)
+		}
+
+		// Set HTTPS on second tailnet.
+		err = bootstrapClient.TailnetSettings().Update(ctx, tailscale.UpdateTailnetSettingsRequest{HTTPSEnabled: new(true)})
+		if err != nil {
+			return 0, fmt.Errorf("failed to configure https for second tailnet: %w", err)
+		}
+		logger.Info("HTTPS settings configured for second tailnet")
+
+		// Set ACLs for second tailnet.
+		if err = bootstrapClient.PolicyFile().Set(ctx, string(requiredACLs), ""); err != nil {
+			return 0, fmt.Errorf("failed to set policy file: %w", err)
+		}
+
+		logger.Info("ACLs configured for second tailnet")
+
+		// Create an OAuth client for the second tailnet to be used
+		// by the k8s-operator.
+		secondKey, err := bootstrapClient.Keys().CreateOAuthClient(ctx, tailscale.CreateOAuthClientRequest{
+			Scopes:      []string{"auth_keys", "devices:core", "services"},
+			Tags:        []string{"tag:k8s-operator"},
+			Description: "k8s-operator client for e2e tests",
+		})
+		if err != nil {
+			return 0, fmt.Errorf("failed to create OAuth client for second tailnet: %w", err)
+		}
+		secondClientID = secondKey.ID
+		secondClientSecret = secondKey.Key
+
+		secondTSClient, err = tailscaleClientFromSecret(ctx, "http://localhost:31544", secondClientID, secondClientSecret)
+		if err != nil {
+			return 0, fmt.Errorf("failed to set up second tailnet client: %w", err)
+		}
+
 	} else {
 		clientSecret = os.Getenv("TS_API_CLIENT_SECRET")
 		if clientSecret == "" {
 			return 0, fmt.Errorf("must use --devcontrol or set TS_API_CLIENT_SECRET to an OAuth client suitable for the operator")
 		}
-		// Format is "tskey-client-<id>-<random>".
-		parts := strings.Split(clientSecret, "-")
-		if len(parts) != 4 {
-			return 0, fmt.Errorf("TS_API_CLIENT_SECRET is not valid")
-		}
-		clientID = parts[2]
-		credentials := clientcredentials.Config{
-			ClientID:     clientID,
-			ClientSecret: clientSecret,
-			TokenURL:     fmt.Sprintf("%s/api/v2/oauth/token", ipn.DefaultControlURL),
-			Scopes:       []string{"auth_keys"},
-		}
-		tk, err := credentials.Token(ctx)
+		clientID, err = clientIDFromSecret(clientSecret)
 		if err != nil {
-			return 0, fmt.Errorf("failed to get OAuth token: %w", err)
+			return 0, fmt.Errorf("failed to get client id from secret: %w", err)
 		}
-		// An access token will last for an hour which is plenty of time for
-		// the tests to run. No need for token refresh logic.
-		tsClient = &tailscale.Client{
-			APIKey: tk.AccessToken,
+		tsClient, err = tailscaleClientFromSecret(ctx, ipn.DefaultControlURL, clientID, clientSecret)
+		if err != nil {
+			return 0, fmt.Errorf("failed to set up first tailnet client: %w", err)
+		}
+		secondClientSecret = os.Getenv("SECOND_TS_API_CLIENT_SECRET")
+		if secondClientSecret == "" {
+			return 0, fmt.Errorf("must use --devcontrol or set SECOND_TS_API_CLIENT_SECRET to an OAuth client suitable for the operator")
+		}
+		secondClientID, err = clientIDFromSecret(secondClientSecret)
+		if err != nil {
+			return 0, fmt.Errorf("failed to get client id from secret: %w", err)
+		}
+		secondTSClient, err = tailscaleClientFromSecret(ctx, ipn.DefaultControlURL, secondClientID, secondClientSecret)
+		if err != nil {
+			return 0, fmt.Errorf("failed to set up second tailnet client: %w", err)
 		}
 	}
 
@@ -446,10 +492,16 @@ func runTests(m *testing.M) (int, error) {
 
 	authKey, err := tsClient.Keys().CreateAuthKey(ctx, tailscale.CreateKeyRequest{Capabilities: caps})
 	if err != nil {
-		return 0, err
+		return 0, fmt.Errorf("failed to create auth key for first tailnet: %w", err)
 	}
 	defer tsClient.Keys().Delete(context.Background(), authKey.ID)
 
+	secondAuthKey, err := secondTSClient.Keys().CreateAuthKey(ctx, tailscale.CreateKeyRequest{Capabilities: caps})
+	if err != nil {
+		return 0, fmt.Errorf("failed to create auth key for second tailnet: %w", err)
+	}
+	defer secondTSClient.Keys().Delete(context.Background(), secondAuthKey.ID)
+
 	tnClient = &tsnet.Server{
 		ControlURL: tsClient.BaseURL.String(),
 		Hostname:   "test-proxy",
@@ -463,9 +515,64 @@ func runTests(m *testing.M) (int, error) {
 	}
 	defer tnClient.Close()
 
+	secondTNClient = &tsnet.Server{
+		ControlURL: secondTSClient.BaseURL.String(),
+		Hostname:   "test-proxy",
+		Ephemeral:  true,
+		Store:      &mem.Store{},
+		AuthKey:    secondAuthKey.Key,
+	}
+	_, err = secondTNClient.Up(ctx)
+	if err != nil {
+		return 0, err
+	}
+	defer secondTNClient.Close()
+
+	// Create the tailnet Secret in the tailscale namespace.
+	secret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "second-tailnet-credentials",
+			Namespace: "tailscale",
+		},
+		Data: map[string][]byte{
+			"client_id":     []byte(secondClientID),
+			"client_secret": []byte(secondClientSecret),
+		},
+	}
+	if err := createOrUpdate(ctx, kubeClient, secret); err != nil {
+		return 0, fmt.Errorf("failed to create second-tailnet-credentials Secret: %w", err)
+	}
+	defer kubeClient.Delete(context.Background(), secret)
+
+	// Create the Tailnet resource.
+	tn := &tsapi.Tailnet{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "second-tailnet",
+		},
+		Spec: tsapi.TailnetSpec{
+			LoginURL: clusterLoginServer,
+			Credentials: tsapi.TailnetCredentials{
+				SecretName: "second-tailnet-credentials",
+			},
+		},
+	}
+	if err := createOrUpdate(ctx, kubeClient, tn); err != nil {
+		return 0, fmt.Errorf("failed to create second-tailnet Tailnet: %w", err)
+	}
+	defer kubeClient.Delete(context.Background(), tn)
+
 	return m.Run(), nil
 }
 
+func clientIDFromSecret(clientSecret string) (string, error) {
+	// Format is "tskey-client-<id>-<random>".
+	parts := strings.Split(clientSecret, "-")
+	if len(parts) != 4 {
+		return "", fmt.Errorf("secret is not valid")
+	}
+	return parts[2], nil
+}
+
 func upgraderOrInstaller(cfg *action.Configuration, releaseName string) helmInstallerFunc {
 	hist := action.NewHistory(cfg)
 	hist.Max = 1
@@ -724,3 +831,65 @@ func buildImage(ctx context.Context, dir, repo, target, tag string, extraCACerts
 
 	return nil
 }
+
+func createOrUpdate(ctx context.Context, cl client.Client, obj client.Object) error {
+	if err := cl.Create(ctx, obj); err != nil {
+		if !apierrors.IsAlreadyExists(err) {
+			return err
+		}
+		return cl.Update(ctx, obj)
+	}
+	return nil
+}
+
+// createTailnet creates a new tailnet and returns a tailscale.Client
+// authenticated against it using the bootstrap credentials included in the
+// creation response.
+func createTailnet(ctx context.Context, tsClient *tailscale.Client) (*tailscale.Client, error) {
+	tailnetName := fmt.Sprintf("second-tailnet-%d", time.Now().Unix())
+	body, err := json.Marshal(map[string]any{"displayName": tailnetName})
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal tailnet creation request: %w", err)
+	}
+	// TODO(beckypauley): change to use a method on tailscale.Client once this is available.
+	req, _ := http.NewRequestWithContext(ctx, "POST", tsClient.BaseURL.String()+"/api/v2/organizations/-/tailnets", bytes.NewBuffer(body))
+	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", tsClient.APIKey))
+	resp, err := tsClient.HTTP.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create tailnet: %w", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		b, _ := io.ReadAll(resp.Body)
+		return nil, fmt.Errorf("HTTP %d creating tailnet: %s", resp.StatusCode, string(b))
+	}
+	var result struct {
+		OauthClient struct {
+			ID     string `json:"id"`
+			Secret string `json:"secret"`
+		} `json:"oauthClient"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+	return tailscaleClientFromSecret(ctx, tsClient.BaseURL.String(), result.OauthClient.ID, result.OauthClient.Secret)
+}
+
+// tailscaleClientFromSecret exchanges OAuth client credentials for an access token and
+// returns a tailscale.Client configured to use it. The token is valid for
+// one hour, which is sufficient for the tests to run. No need for refresh logic.
+func tailscaleClientFromSecret(ctx context.Context, baseURL, clientID, clientSecret string) (*tailscale.Client, error) {
+	cfg := clientcredentials.Config{
+		ClientID:     clientID,
+		ClientSecret: clientSecret,
+		TokenURL:     fmt.Sprintf("%s/api/v2/oauth/token", baseURL),
+	}
+	tk, err := cfg.Token(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get OAuth token for client %q: %w", clientID, err)
+	}
+	return &tailscale.Client{
+		APIKey:  tk.AccessToken,
+		BaseURL: must.Get(url.Parse(baseURL)),
+	}, nil
+}
diff --git a/cmd/k8s-operator/egress-eps.go b/cmd/k8s-operator/egress-eps.go
index a248ed888..1f02cfab9 100644
--- a/cmd/k8s-operator/egress-eps.go
+++ b/cmd/k8s-operator/egress-eps.go
@@ -20,6 +20,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+
 	"tailscale.com/kube/egressservices"
 )
 
@@ -90,9 +91,10 @@ func (er *egressEpsReconciler) Reconcile(ctx context.Context, req reconcile.Requ
 		lg.Debugf("No egress config found, likely because ProxyGroup has not been created")
 		return res, nil
 	}
-	cfg, ok := (*cfgs)[tailnetSvc]
+
+	cfg, ok := cfgs[tailnetSvc]
 	if !ok {
-		lg.Infof("[unexpected] configuration for tailnet service %s not found", tailnetSvc)
+		lg.Warnf("configuration for tailnet service %q not found", tailnetSvc)
 		return res, nil
 	}
 
@@ -104,16 +106,19 @@ func (er *egressEpsReconciler) Reconcile(ctx context.Context, req reconcile.Requ
 	}
 	newEndpoints := make([]discoveryv1.Endpoint, 0)
 	for _, pod := range podList.Items {
-		ready, err := er.podIsReadyToRouteTraffic(ctx, pod, &cfg, tailnetSvc, lg)
+		ready, err := er.podIsReadyToRouteTraffic(ctx, pod, &cfg, tailnetSvc, eps.AddressType, lg)
 		if err != nil {
 			return res, fmt.Errorf("error verifying if Pod is ready to route traffic: %w", err)
 		}
 		if !ready {
 			continue // maybe next time
 		}
-		podIP, err := podIPv4(&pod) // we currently only support IPv4
+		podIP, err := podIPForFamily(&pod, eps.AddressType)
 		if err != nil {
-			return res, fmt.Errorf("error determining IPv4 address for Pod: %w", err)
+			return res, fmt.Errorf("error determining Pod IP for %s EndpointSlice: %w", eps.AddressType, err)
+		}
+		if podIP == "" {
+			continue // Pod doesn't have an IP for this address family
 		}
 		newEndpoints = append(newEndpoints, discoveryv1.Endpoint{
 			Hostname:  (*string)(&pod.UID),
@@ -129,21 +134,25 @@ func (er *egressEpsReconciler) Reconcile(ctx context.Context, req reconcile.Requ
 	// run a cleanup for deleted Pods etc.
 	eps.Endpoints = newEndpoints
 	if !reflect.DeepEqual(eps, oldEps) {
-		lg.Infof("Updating EndpointSlice to ensure traffic is routed to ready proxy Pods")
-		if err := er.Update(ctx, eps); err != nil {
+		lg.Info("Updating EndpointSlice to ensure traffic is routed to ready proxy Pods")
+		if err = er.Update(ctx, eps); err != nil {
 			return res, fmt.Errorf("error updating EndpointSlice: %w", err)
 		}
 	}
+
 	return res, nil
 }
 
-func podIPv4(pod *corev1.Pod) (string, error) {
+func podIPForFamily(pod *corev1.Pod, addrType discoveryv1.AddressType) (string, error) {
 	for _, ip := range pod.Status.PodIPs {
 		parsed, err := netip.ParseAddr(ip.IP)
 		if err != nil {
 			return "", fmt.Errorf("error parsing IP address %s: %w", ip, err)
 		}
-		if parsed.Is4() {
+		switch {
+		case addrType == discoveryv1.AddressTypeIPv4 && parsed.Is4():
+			return parsed.String(), nil
+		case addrType == discoveryv1.AddressTypeIPv6 && parsed.Is6():
 			return parsed.String(), nil
 		}
 	}
@@ -153,61 +162,76 @@ func podIPv4(pod *corev1.Pod) (string, error) {
 // podIsReadyToRouteTraffic returns true if it appears that the proxy Pod has configured firewall rules to be able to
 // route traffic to the given tailnet service. It retrieves the proxy's state Secret and compares the tailnet service
 // status written there to the desired service configuration.
-func (er *egressEpsReconciler) podIsReadyToRouteTraffic(ctx context.Context, pod corev1.Pod, cfg *egressservices.Config, tailnetSvcName string, lg *zap.SugaredLogger) (bool, error) {
+func (er *egressEpsReconciler) podIsReadyToRouteTraffic(ctx context.Context, pod corev1.Pod, cfg *egressservices.Config, tailnetSvcName string, addrType discoveryv1.AddressType, lg *zap.SugaredLogger) (bool, error) {
 	lg = lg.With("proxy_pod", pod.Name)
-	lg.Debugf("checking whether proxy is ready to route to egress service")
+	lg.Debug("checking whether proxy is ready to route to egress service")
 	if !pod.DeletionTimestamp.IsZero() {
-		lg.Debugf("proxy Pod is being deleted, ignore")
+		lg.Debug("proxy Pod is being deleted, ignore")
 		return false, nil
 	}
-	podIP, err := podIPv4(&pod)
-	if err != nil {
+	podIP, err := podIPForFamily(&pod, addrType)
+	switch {
+	case err != nil:
 		return false, fmt.Errorf("error determining Pod IP address: %v", err)
-	}
-	if podIP == "" {
-		lg.Infof("[unexpected] Pod does not have an IPv4 address, and IPv6 is not currently supported")
+	case podIP == "":
+		lg.Debugf("Pod does not have an address for family %s", addrType)
 		return false, nil
 	}
+
 	stateS := &corev1.Secret{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      pod.Name,
 			Namespace: pod.Namespace,
 		},
 	}
+
 	err = er.Get(ctx, client.ObjectKeyFromObject(stateS), stateS)
-	if apierrors.IsNotFound(err) {
-		lg.Debugf("proxy does not have a state Secret, waiting...")
+	switch {
+	case apierrors.IsNotFound(err):
+		lg.Debug("proxy does not yet have a state Secret, waiting...")
 		return false, nil
+	case err != nil:
+		return false, fmt.Errorf("error retrieving state Secret: %w", err)
 	}
-	if err != nil {
-		return false, fmt.Errorf("error getting state Secret: %w", err)
-	}
+
 	svcStatusBS := stateS.Data[egressservices.KeyEgressServices]
 	if len(svcStatusBS) == 0 {
-		lg.Debugf("proxy's state Secret does not contain egress services status, waiting...")
+		lg.Debug("proxy's state Secret does not contain egress services status, waiting...")
 		return false, nil
 	}
+
 	svcStatus := &egressservices.Status{}
-	if err := json.Unmarshal(svcStatusBS, svcStatus); err != nil {
+	if err = json.Unmarshal(svcStatusBS, svcStatus); err != nil {
 		return false, fmt.Errorf("error unmarshalling egress service status: %w", err)
 	}
-	if !strings.EqualFold(podIP, svcStatus.PodIPv4) {
-		lg.Infof("proxy's egress service status is for Pod IP %s, current proxy's Pod IP %s, waiting for the proxy to reconfigure...", svcStatus.PodIPv4, podIP)
+	var statusIP string
+	switch addrType {
+	case discoveryv1.AddressTypeIPv4:
+		statusIP = svcStatus.PodIPv4
+	case discoveryv1.AddressTypeIPv6:
+		statusIP = svcStatus.PodIPv6
+	}
+	if !strings.EqualFold(podIP, statusIP) {
+		lg.Infof("proxy's egress service status is for Pod IP %q, current proxy's Pod IP %q, waiting for the proxy to reconfigure...", statusIP, podIP)
 		return false, nil
 	}
-	st, ok := (*svcStatus).Services[tailnetSvcName]
+
+	st, ok := svcStatus.Services[tailnetSvcName]
 	if !ok {
 		lg.Infof("proxy's state Secret does not have egress service status, waiting...")
 		return false, nil
 	}
+
 	if !reflect.DeepEqual(cfg.TailnetTarget, st.TailnetTarget) {
-		lg.Infof("proxy has configured egress service for tailnet target %v, current target is %v, waiting for proxy to reconfigure...", st.TailnetTarget, cfg.TailnetTarget)
+		lg.Infof("proxy has configured egress service for tailnet target %q, current target is %q, waiting for proxy to reconfigure...", st.TailnetTarget, cfg.TailnetTarget)
 		return false, nil
 	}
+
 	if !reflect.DeepEqual(cfg.Ports, st.Ports) {
 		lg.Debugf("proxy has configured egress service for ports %#+v, wants ports %#+v, waiting for proxy to reconfigure", st.Ports, cfg.Ports)
 		return false, nil
 	}
-	lg.Debugf("proxy is ready to route traffic to egress service")
+
+	lg.Debug("proxy is ready to route traffic to egress service")
 	return true, nil
 }
diff --git a/cmd/k8s-operator/egress-eps_test.go b/cmd/k8s-operator/egress-eps_test.go
index 6335b4eb8..14ed38d34 100644
--- a/cmd/k8s-operator/egress-eps_test.go
+++ b/cmd/k8s-operator/egress-eps_test.go
@@ -98,7 +98,7 @@ func TestTailscaleEgressEndpointSlices(t *testing.T) {
 
 	t.Run("pods_are_ready_to_route_traffic", func(t *testing.T) {
 		pod, stateS := podAndSecretForProxyGroup("foo")
-		stBs := serviceStatusForPodIP(t, svc, pod.Status.PodIPs[0].IP, port)
+		stBs := serviceStatusForPodIPs(t, svc, pod.Status.PodIPs[0].IP, "", port)
 		mustUpdate(t, fc, "operator-ns", stateS.Name, func(s *corev1.Secret) {
 			mak.Set(&s.Data, egressservices.KeyEgressServices, stBs)
 		})
@@ -115,8 +115,8 @@ func TestTailscaleEgressEndpointSlices(t *testing.T) {
 		expectEqual(t, fc, eps)
 	})
 	t.Run("status_does_not_match_pod_ip", func(t *testing.T) {
-		_, stateS := podAndSecretForProxyGroup("foo")           // replica Pod has IP 10.0.0.1
-		stBs := serviceStatusForPodIP(t, svc, "10.0.0.2", port) // status is for a Pod with IP 10.0.0.2
+		_, stateS := podAndSecretForProxyGroup("foo")                // replica Pod has IP 10.0.0.1
+		stBs := serviceStatusForPodIPs(t, svc, "10.0.0.2", "", port) // status is for a Pod with IP 10.0.0.2
 		mustUpdate(t, fc, "operator-ns", stateS.Name, func(s *corev1.Secret) {
 			mak.Set(&s.Data, egressservices.KeyEgressServices, stBs)
 		})
@@ -124,6 +124,117 @@ func TestTailscaleEgressEndpointSlices(t *testing.T) {
 		eps.Endpoints = []discoveryv1.Endpoint{}
 		expectEqual(t, fc, eps)
 	})
+
+	// Dual-stack.
+	epsV6 := &discoveryv1.EndpointSlice{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "foo-ipv6",
+			Namespace: "operator-ns",
+			Labels: map[string]string{
+				LabelParentName:      "test",
+				LabelParentNamespace: "default",
+				labelSvcType:         typeEgress,
+				labelProxyGroup:      "foo",
+			},
+		},
+		AddressType: discoveryv1.AddressTypeIPv6,
+	}
+	mustCreate(t, fc, epsV6)
+	t.Run("dual_stack_pod_ready_to_route", func(t *testing.T) {
+		mustDeleteAll(t, fc, &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "foo-0", Namespace: "operator-ns"}})
+		dualPod := &corev1.Pod{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "foo-0",
+				Namespace: "operator-ns",
+				Labels:    pgLabels("foo", nil),
+				UID:       "foo",
+			},
+			Status: corev1.PodStatus{
+				PodIPs: []corev1.PodIP{{IP: "10.0.0.1"}, {IP: "fd00::1"}},
+			},
+		}
+		mustCreate(t, fc, dualPod)
+		stBs := serviceStatusForPodIPs(t, svc, "10.0.0.1", "fd00::1", port)
+		mustUpdate(t, fc, "operator-ns", "foo-0", func(s *corev1.Secret) {
+			mak.Set(&s.Data, egressservices.KeyEgressServices, stBs)
+		})
+		expectReconciled(t, er, "operator-ns", "foo")
+		eps.Endpoints = []discoveryv1.Endpoint{{
+			Addresses: []string{"10.0.0.1"},
+			Hostname:  new("foo"),
+			Conditions: discoveryv1.EndpointConditions{
+				Serving:     new(true),
+				Ready:       new(true),
+				Terminating: new(false),
+			},
+		}}
+		expectEqual(t, fc, eps)
+		expectReconciled(t, er, "operator-ns", "foo-ipv6")
+		epsV6.Endpoints = []discoveryv1.Endpoint{{
+			Addresses: []string{"fd00::1"},
+			Hostname:  new("foo"),
+			Conditions: discoveryv1.EndpointConditions{
+				Serving:     new(true),
+				Ready:       new(true),
+				Terminating: new(false),
+			},
+		}}
+		expectEqual(t, fc, epsV6)
+	})
+
+	// IPv6-only.
+	t.Run("ipv4_only_pod_skipped_for_ipv6_slice", func(t *testing.T) {
+		mustDeleteAll(t, fc, &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "foo-0", Namespace: "operator-ns"}})
+		ipv4Pod, _ := podAndSecretForProxyGroup("foo")
+		mustCreate(t, fc, ipv4Pod)
+		stBs := serviceStatusForPodIPs(t, svc, "10.0.0.1", "", port)
+		mustUpdate(t, fc, "operator-ns", "foo-0", func(s *corev1.Secret) {
+			mak.Set(&s.Data, egressservices.KeyEgressServices, stBs)
+		})
+		expectReconciled(t, er, "operator-ns", "foo-ipv6")
+		// IPv4-only pod should not appear in the IPv6 EndpointSlice.
+		epsV6.Endpoints = []discoveryv1.Endpoint{}
+		expectEqual(t, fc, epsV6)
+	})
+	ipv6Pod := &corev1.Pod{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "foo-0",
+			Namespace: "operator-ns",
+			Labels:    pgLabels("foo", nil),
+			UID:       "foo",
+		},
+		Status: corev1.PodStatus{
+			PodIPs: []corev1.PodIP{{IP: "fd00::1"}},
+		},
+	}
+	t.Run("ipv6_status_does_not_match_pod_ip", func(t *testing.T) {
+		mustDeleteAll(t, fc, &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "foo-0", Namespace: "operator-ns"}})
+		mustCreate(t, fc, ipv6Pod)
+		stBs := serviceStatusForPodIPs(t, svc, "", "fd00::99", port)
+		mustUpdate(t, fc, "operator-ns", "foo-0", func(s *corev1.Secret) {
+			mak.Set(&s.Data, egressservices.KeyEgressServices, stBs)
+		})
+		expectReconciled(t, er, "operator-ns", "foo-ipv6")
+		epsV6.Endpoints = []discoveryv1.Endpoint{}
+		expectEqual(t, fc, epsV6)
+	})
+	t.Run("ipv6_pod_ready_to_route", func(t *testing.T) {
+		stBs := serviceStatusForPodIPs(t, svc, "", ipv6Pod.Status.PodIPs[0].IP, port)
+		mustUpdate(t, fc, "operator-ns", "foo-0", func(s *corev1.Secret) {
+			mak.Set(&s.Data, egressservices.KeyEgressServices, stBs)
+		})
+		expectReconciled(t, er, "operator-ns", "foo-ipv6")
+		epsV6.Endpoints = append(epsV6.Endpoints, discoveryv1.Endpoint{
+			Addresses: []string{"fd00::1"},
+			Hostname:  new("foo"),
+			Conditions: discoveryv1.EndpointConditions{
+				Serving:     new(true),
+				Ready:       new(true),
+				Terminating: new(false),
+			},
+		})
+		expectEqual(t, fc, epsV6)
+	})
 }
 
 func configMapForSvc(t *testing.T, svc *corev1.Service, p uint16) *corev1.ConfigMap {
@@ -157,7 +268,7 @@ func configMapForSvc(t *testing.T, svc *corev1.Service, p uint16) *corev1.Config
 	return cm
 }
 
-func serviceStatusForPodIP(t *testing.T, svc *corev1.Service, ip string, p uint16) []byte {
+func serviceStatusForPodIPs(t *testing.T, svc *corev1.Service, ipv4, ipv6 string, p uint16) []byte {
 	t.Helper()
 	ports := make(map[egressservices.PortMap]struct{})
 	for _, port := range svc.Spec.Ports {
@@ -172,7 +283,8 @@ func serviceStatusForPodIP(t *testing.T, svc *corev1.Service, ip string, p uint1
 	}
 	svcName := tailnetSvcName(svc)
 	st := egressservices.Status{
-		PodIPv4:  ip,
+		PodIPv4:  ipv4,
+		PodIPv6:  ipv6,
 		Services: map[string]*egressservices.ServiceStatus{svcName: &svcSt},
 	}
 	bs, err := json.Marshal(st)
diff --git a/cmd/k8s-operator/egress-pod-readiness.go b/cmd/k8s-operator/egress-pod-readiness.go
index a8f306353..acd68cb13 100644
--- a/cmd/k8s-operator/egress-pod-readiness.go
+++ b/cmd/k8s-operator/egress-pod-readiness.go
@@ -10,6 +10,7 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
+	"net/netip"
 	"slices"
 	"strings"
 	"sync/atomic"
@@ -23,6 +24,7 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+
 	tsapi "tailscale.com/k8s-operator/apis/v1alpha1"
 	"tailscale.com/kube/kubetypes"
 	"tailscale.com/tstime"
@@ -87,8 +89,9 @@ func (er *egressPodsReconciler) Reconcile(ctx context.Context, req reconcile.Req
 		lg.Debugf("Pod is being deleted, do nothing")
 		return res, nil
 	}
+
 	if pod.Labels[LabelParentType] != proxyTypeProxyGroup {
-		lg.Infof("[unexpected] reconciler called for a Pod that is not a ProxyGroup Pod")
+		lg.Warn("reconciler called for a Pod that is not a ProxyGroup Pod")
 		return res, nil
 	}
 
@@ -106,10 +109,12 @@ func (er *egressPodsReconciler) Reconcile(ctx context.Context, req reconcile.Req
 	if err := er.Get(ctx, types.NamespacedName{Name: proxyGroupName}, pg); err != nil {
 		return res, fmt.Errorf("error getting ProxyGroup %q: %w", proxyGroupName, err)
 	}
+
 	if pg.Spec.Type != typeEgress {
-		lg.Infof("[unexpected] reconciler called for %q ProxyGroup Pod", pg.Spec.Type)
+		lg.Warnf("reconciler called for %q ProxyGroup Pod", pg.Spec.Type)
 		return res, nil
 	}
+
 	// Get all ClusterIP Services for all egress targets exposed to cluster via this ProxyGroup.
 	lbls := map[string]string{
 		kubetypes.LabelManaged: "true",
@@ -223,13 +228,24 @@ func (er *egressPodsReconciler) lookupPodRouteViaSvc(ctx context.Context, pod *c
 		lg.Debugf("Pod does not have health check enabled, unable to verify if it is currently routable via Service")
 		return cannotVerify, nil
 	}
-	wantsIP, err := podIPv4(pod)
-	if err != nil {
-		return -1, fmt.Errorf("error determining Pod's IP address: %w", err)
-	}
-	if wantsIP == "" {
+	// Use the Pod's primary IP (PodIPs[0]) to identify this Pod in the health check
+	// response. The primary IP family is determined by the cluster's IP family configuration.
+
+	// Note: we do not control which IP family the request uses, so on a dual-stack
+	// cluster either IPv4 or IPv6 could be used. In either case, a matching IP header
+	// comfirms the request reached this Pod.
+	if len(pod.Status.PodIPs) == 0 || pod.Status.PodIPs[0].IP == "" {
 		return podNotReady, nil
 	}
+	wantsIP := pod.Status.PodIPs[0].IP
+	parsed, err := netip.ParseAddr(wantsIP)
+	if err != nil {
+		return -1, fmt.Errorf("error parsing Pod IP %q: %w", wantsIP, err)
+	}
+	header := kubetypes.PodIPv4Header
+	if parsed.Is6() {
+		header = kubetypes.PodIPv6Header
+	}
 
 	ctx, cancel := context.WithTimeout(ctx, time.Second*3)
 	defer cancel()
@@ -246,7 +262,7 @@ func (er *egressPodsReconciler) lookupPodRouteViaSvc(ctx context.Context, pod *c
 		return unreachable, nil
 	}
 	defer resp.Body.Close()
-	gotIP := resp.Header.Get(kubetypes.PodIPv4Header)
+	gotIP := resp.Header.Get(header)
 	if gotIP == "" {
 		lg.Debugf("Health check does not return Pod's IP header, unable to verify if Pod is currently routable via Service")
 		return cannotVerify, nil
diff --git a/cmd/k8s-operator/egress-pod-readiness_test.go b/cmd/k8s-operator/egress-pod-readiness_test.go
index 0cf9108f5..6a087031b 100644
--- a/cmd/k8s-operator/egress-pod-readiness_test.go
+++ b/cmd/k8s-operator/egress-pod-readiness_test.go
@@ -420,6 +420,44 @@ func TestEgressPodReadiness(t *testing.T) {
 		expectEqual(t, fc, pod)
 		mustDeleteAll(t, fc, pod, svc, svc2, svc3)
 	})
+	t.Run("ipv6_only_pod_already_routed_to", func(t *testing.T) {
+		pod := podTemplate.DeepCopy()
+		pod.Status.PodIPs = []corev1.PodIP{{IP: "fd00::2"}}
+
+		svc, hep := newSvc("svc", 9002)
+		mustCreateAll(t, fc, svc, pod)
+		resp := readyRespsV6("fd00::2", 1)
+		httpCl := fakeHTTPClient{
+			t:     t,
+			state: map[string][]fakeResponse{hep: resp},
+		}
+		rec.httpClient = &httpCl
+		expectReconciled(t, rec, "operator-ns", pod.Name)
+
+		podSetReady(pod, cl)
+		expectEqual(t, fc, pod)
+		mustDeleteAll(t, fc, pod, svc)
+	})
+	t.Run("dual_stack_pod", func(t *testing.T) {
+		pod := podTemplate.DeepCopy()
+		pod.Status.PodIPs = []corev1.PodIP{{IP: "10.0.0.2"}, {IP: "fd00::2"}}
+
+		svc, hep := newSvc("svc", 9002)
+		mustCreateAll(t, fc, svc, pod)
+		// Dual-stack pod: the reconciler uses PodIPs[0] (the primary IP),
+		// which in this case is IPv4.
+		resp := readyResps("10.0.0.2", 1)
+		httpCl := fakeHTTPClient{
+			t:     t,
+			state: map[string][]fakeResponse{hep: resp},
+		}
+		rec.httpClient = &httpCl
+		expectReconciled(t, rec, "operator-ns", pod.Name)
+
+		podSetReady(pod, cl)
+		expectEqual(t, fc, pod)
+		mustDeleteAll(t, fc, pod, svc)
+	})
 }
 
 func readyResps(ip string, num int) (resps []fakeResponse) {
@@ -429,6 +467,13 @@ func readyResps(ip string, num int) (resps []fakeResponse) {
 	return resps
 }
 
+func readyRespsV6(ip string, num int) (resps []fakeResponse) {
+	for range num {
+		resps = append(resps, fakeResponse{statusCode: 200, podIP: ip, header: kubetypes.PodIPv6Header})
+	}
+	return resps
+}
+
 func unreadyResps(ip string, num int) (resps []fakeResponse) {
 	for range num {
 		resps = append(resps, fakeResponse{statusCode: 503, podIP: ip})
@@ -513,7 +558,11 @@ func (f *fakeHTTPClient) Do(req *http.Request) (*http.Response, error) {
 		Header:     make(http.Header),
 		Body:       io.NopCloser(bytes.NewReader([]byte{})),
 	}
-	r.Header.Add(kubetypes.PodIPv4Header, resp.podIP)
+	h := kubetypes.PodIPv4Header
+	if resp.header != "" {
+		h = resp.header
+	}
+	r.Header.Add(h, resp.podIP)
 	return &r, nil
 }
 
@@ -521,4 +570,5 @@ type fakeResponse struct {
 	err        error
 	statusCode int
 	podIP      string // for the Pod IP header
+	header     string // header key to use; defaults to PodIPv4Header
 }
diff --git a/cmd/k8s-operator/egress-services-readiness.go b/cmd/k8s-operator/egress-services-readiness.go
index 965dc08f8..76a8fdb21 100644
--- a/cmd/k8s-operator/egress-services-readiness.go
+++ b/cmd/k8s-operator/egress-services-readiness.go
@@ -9,6 +9,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"slices"
 	"strings"
 
 	"go.uber.org/zap"
@@ -20,9 +21,11 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+
 	tsoperator "tailscale.com/k8s-operator"
 	tsapi "tailscale.com/k8s-operator/apis/v1alpha1"
 	"tailscale.com/tstime"
+	"tailscale.com/util/set"
 )
 
 const (
@@ -71,19 +74,57 @@ func (esrr *egressSvcsReadinessReconciler) Reconcile(ctx context.Context, req re
 	}()
 
 	crl := egressSvcChildResourceLabels(svc)
-	eps, err := getSingleObject[discoveryv1.EndpointSlice](ctx, esrr.Client, esrr.tsNamespace, crl)
-	if err != nil {
-		err = fmt.Errorf("error getting EndpointSlice: %w", err)
+	epsList := &discoveryv1.EndpointSliceList{}
+	if err = esrr.List(ctx, epsList, client.InNamespace(esrr.tsNamespace), client.MatchingLabels(crl)); err != nil {
+		err = fmt.Errorf("error listing EndpointSlices: %w", err)
 		reason = reasonReadinessCheckFailed
 		msg = err.Error()
 		return res, err
 	}
-	if eps == nil {
-		lg.Infof("EndpointSlice for Service does not yet exist, waiting...")
+	if len(epsList.Items) == 0 {
+		lg.Infof("EndpointSlices for Service do not yet exist, waiting...")
 		reason, msg = reasonClusterResourcesNotReady, reasonClusterResourcesNotReady
 		st = metav1.ConditionFalse
 		return res, nil
 	}
+	// If an EndpointSlice for an expected family is missing, we mark the Service as NotReady.
+	//
+	// Setting the NotReady condition here is also used for best-effort recovery. The
+	// egress-svcs-reconciler does not watch EndpointSlices, so a deleted EndpointSlice is only
+	// recreated when this status change re-triggers a Service reconcile.
+	//
+	// TODO(beckypauley): refactor so EndpointSlice recovery is not dependent on Service status.
+	clusterIPSvc, err := getSingleObject[corev1.Service](ctx, esrr.Client, esrr.tsNamespace, crl)
+	if err != nil {
+		err = fmt.Errorf("error retrieving ClusterIP Service: %w", err)
+		reason = reasonReadinessCheckFailed
+		msg = err.Error()
+		return res, err
+	}
+	if clusterIPSvc == nil {
+		lg.Infof("ClusterIP Service for egress Service does not yet exist, waiting...")
+		reason, msg = reasonClusterResourcesNotReady, reasonClusterResourcesNotReady
+		st = metav1.ConditionFalse
+		return res, nil
+	}
+	gotAddrTypes := make(set.Set[discoveryv1.AddressType], len(epsList.Items))
+	for _, eps := range epsList.Items {
+		gotAddrTypes.Add(eps.AddressType)
+	}
+	wantAddrTypes, err := addrTypesForClusterIPSvc(clusterIPSvc)
+	if err != nil {
+		reason = reasonReadinessCheckFailed
+		msg = err.Error()
+		return res, err
+	}
+	for _, wantAddrType := range wantAddrTypes {
+		if !gotAddrTypes.Contains(wantAddrType) {
+			lg.Infof("EndpointSlice for %s is missing, waiting...", wantAddrType)
+			reason, msg = reasonClusterResourcesNotReady, reasonClusterResourcesNotReady
+			st = metav1.ConditionFalse
+			return res, nil
+		}
+	}
 	pg := &tsapi.ProxyGroup{
 		ObjectMeta: metav1.ObjectMeta{
 			Name: svc.Annotations[AnnotationProxyGroup],
@@ -118,6 +159,7 @@ func (esrr *egressSvcsReadinessReconciler) Reconcile(ctx context.Context, req re
 	}
 	podLabels := pgLabels(pg.Name, nil)
 	var readyReplicas int32
+nextReplica:
 	for i := range replicas {
 		podLabels[appsv1.PodIndexLabel] = fmt.Sprintf("%d", i)
 		pod, err := getSingleObject[corev1.Pod](ctx, esrr.Client, esrr.tsNamespace, podLabels)
@@ -127,24 +169,24 @@ func (esrr *egressSvcsReadinessReconciler) Reconcile(ctx context.Context, req re
 			msg = err.Error()
 			return res, err
 		}
+
 		if pod == nil {
-			lg.Warnf("[unexpected] ProxyGroup is ready, but replica %d was not found", i)
+			lg.Warnf("ProxyGroup is ready, but replica %d was not found", i)
 			reason, msg = reasonClusterResourcesNotReady, reasonClusterResourcesNotReady
 			return res, nil
 		}
+
 		lg.Debugf("looking at Pod with IPs %v", pod.Status.PodIPs)
-		ready := false
-		for _, ep := range eps.Endpoints {
-			lg.Debugf("looking at endpoint with addresses %v", ep.Addresses)
-			if endpointReadyForPod(&ep, pod, lg) {
-				lg.Debugf("endpoint is ready for Pod")
-				ready = true
-				break
+		for _, eps := range epsList.Items {
+			lg.Debugf("looking at %s EndpointSlice %s", eps.AddressType, eps.Name)
+			if !slices.ContainsFunc(eps.Endpoints, func(ep discoveryv1.Endpoint) bool {
+				return endpointReadyForPod(&ep, pod, eps.AddressType, lg)
+			}) {
+				continue nextReplica
 			}
 		}
-		if ready {
-			readyReplicas++
-		}
+		lg.Debugf("endpoint is ready for Pod")
+		readyReplicas++
 	}
 	msg = fmt.Sprintf(msgReadyToRouteTemplate, readyReplicas, replicas)
 	if readyReplicas == 0 {
@@ -161,14 +203,18 @@ func (esrr *egressSvcsReadinessReconciler) Reconcile(ctx context.Context, req re
 	return res, nil
 }
 
-// endpointReadyForPod returns true if the endpoint is for the Pod's IPv4 address and is ready to serve traffic.
-// Endpoint must not be nil.
-func endpointReadyForPod(ep *discoveryv1.Endpoint, pod *corev1.Pod, lg *zap.SugaredLogger) bool {
-	podIP, err := podIPv4(pod)
+// endpointReadyForPod returns true if the endpoint is for the Pod's address (for the given address family)
+// and is ready to serve traffic. Endpoint must not be nil.
+func endpointReadyForPod(ep *discoveryv1.Endpoint, pod *corev1.Pod, addrType discoveryv1.AddressType, lg *zap.SugaredLogger) bool {
+	podIP, err := podIPForFamily(pod, addrType)
 	if err != nil {
-		lg.Warnf("[unexpected] error retrieving Pod's IPv4 address: %v", err)
+		lg.Warnf("error retrieving Pod's %s address: %v", addrType, err)
 		return false
 	}
+	if podIP == "" {
+		return false
+	}
+
 	// Currently we only ever set a single address on and Endpoint and nothing else is meant to modify this.
 	if len(ep.Addresses) != 1 {
 		return false
diff --git a/cmd/k8s-operator/egress-services-readiness_test.go b/cmd/k8s-operator/egress-services-readiness_test.go
index 96d76cc4e..c21a111d5 100644
--- a/cmd/k8s-operator/egress-services-readiness_test.go
+++ b/cmd/k8s-operator/egress-services-readiness_test.go
@@ -47,7 +47,14 @@ func TestEgressServiceReadiness(t *testing.T) {
 			},
 		},
 	}
-	fakeClusterIPSvc := &corev1.Service{ObjectMeta: metav1.ObjectMeta{Name: "my-app", Namespace: "operator-ns"}}
+	fakeClusterIPSvc := &corev1.Service{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "my-app",
+			Namespace: "operator-ns",
+			Labels:    egressSvcChildResourceLabels(egressSvc),
+		},
+		Spec: corev1.ServiceSpec{ClusterIPs: []string{"10.0.0.1"}},
+	}
 	labels := egressSvcEpsLabels(egressSvc, fakeClusterIPSvc)
 	eps := &discoveryv1.EndpointSlice{
 		ObjectMeta: metav1.ObjectMeta{
@@ -63,6 +70,7 @@ func TestEgressServiceReadiness(t *testing.T) {
 		},
 	}
 	mustCreate(t, fc, egressSvc)
+	mustCreate(t, fc, fakeClusterIPSvc)
 	setClusterNotReady(egressSvc, cl, zl.Sugar())
 	t.Run("endpointslice_does_not_exist", func(t *testing.T) {
 		expectReconciled(t, rec, "dev", "my-app")
@@ -117,6 +125,212 @@ func TestEgressServiceReadiness(t *testing.T) {
 	})
 }
 
+func TestEgressServiceReadinessDualStack(t *testing.T) {
+	fc := fake.NewClientBuilder().
+		WithScheme(tsapi.GlobalScheme).
+		WithStatusSubresource(&tsapi.ProxyGroup{}).
+		Build()
+	zl, _ := zap.NewDevelopment()
+	cl := tstest.NewClock(tstest.ClockOpts{})
+	rec := &egressSvcsReadinessReconciler{
+		tsNamespace: "operator-ns",
+		Client:      fc,
+		logger:      zl.Sugar(),
+		clock:       cl,
+	}
+	tailnetFQDN := "my-app.tailnetxyz.ts.net"
+	egressSvc := &corev1.Service{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "my-app",
+			Namespace: "dev",
+			Annotations: map[string]string{
+				AnnotationProxyGroup:        "dev",
+				AnnotationTailnetTargetFQDN: tailnetFQDN,
+			},
+		},
+	}
+	fakeClusterIPSvc := &corev1.Service{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "my-app",
+			Namespace: "operator-ns",
+			Labels:    egressSvcChildResourceLabels(egressSvc),
+		},
+		Spec: corev1.ServiceSpec{ClusterIPs: []string{"10.0.0.1", "fd00::1"}},
+	}
+	labels := egressSvcEpsLabels(egressSvc, fakeClusterIPSvc)
+	epsV4 := &discoveryv1.EndpointSlice{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "my-app-ipv4",
+			Namespace: "operator-ns",
+			Labels:    labels,
+		},
+		AddressType: discoveryv1.AddressTypeIPv4,
+	}
+	labelsV6 := egressSvcEpsLabels(egressSvc, fakeClusterIPSvc)
+	epsV6 := &discoveryv1.EndpointSlice{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "my-app-ipv6",
+			Namespace: "operator-ns",
+			Labels:    labelsV6,
+		},
+		AddressType: discoveryv1.AddressTypeIPv6,
+	}
+	pg := &tsapi.ProxyGroup{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "dev",
+		},
+		Spec: tsapi.ProxyGroupSpec{
+			Replicas: new(int32(1)),
+			Type:     tsapi.ProxyGroupTypeEgress,
+		},
+	}
+	mustCreate(t, fc, egressSvc)
+	mustCreate(t, fc, fakeClusterIPSvc)
+	mustCreate(t, fc, epsV4)
+	mustCreate(t, fc, epsV6)
+	mustCreate(t, fc, pg)
+	setPGReady(pg, cl, zl.Sugar())
+	mustUpdateStatus(t, fc, pg.Namespace, pg.Name, func(p *tsapi.ProxyGroup) {
+		p.Status = pg.Status
+	})
+
+	// Create a dual-stack pod.
+	p := pod(pg, 0)
+	p.Status.PodIPs = append(p.Status.PodIPs, corev1.PodIP{IP: "fd00::0"})
+	mustCreate(t, fc, p)
+	mustUpdateStatus(t, fc, p.Namespace, p.Name, func(existing *corev1.Pod) {
+		existing.Status.PodIPs = p.Status.PodIPs
+	})
+
+	t.Run("not_ready_missing_from_ipv6_slice", func(t *testing.T) {
+		setEndpointForReplicaWithIP("10.0.0.0", epsV4)
+		mustUpdate(t, fc, epsV4.Namespace, epsV4.Name, func(e *discoveryv1.EndpointSlice) {
+			e.Endpoints = epsV4.Endpoints
+		})
+		expectReconciled(t, rec, "dev", "my-app")
+		setNotReady(egressSvc, cl, zl.Sugar(), pgReplicas(pg))
+		expectEqual(t, fc, egressSvc)
+	})
+	t.Run("ready_in_both_slices", func(t *testing.T) {
+		setEndpointForReplicaWithIP("fd00::", epsV6)
+		mustUpdate(t, fc, epsV6.Namespace, epsV6.Name, func(e *discoveryv1.EndpointSlice) {
+			e.Endpoints = epsV6.Endpoints
+		})
+		expectReconciled(t, rec, "dev", "my-app")
+		setReady(egressSvc, cl, zl.Sugar(), pgReplicas(pg), pgReplicas(pg))
+		expectEqual(t, fc, egressSvc)
+	})
+	t.Run("not_ready_when_ipv6_slice_missing", func(t *testing.T) {
+		// Delete the IPv6 EndpointSlice while the ClusterIP Service still
+		// wants an IPv6 family; the Service should report NotReady even though
+		// the IPv4 EndpointSlice is healthy.
+		if err := fc.Delete(t.Context(), epsV6); err != nil {
+			t.Fatalf("error deleting IPv6 EndpointSlice: %v", err)
+		}
+		expectReconciled(t, rec, "dev", "my-app")
+		setClusterNotReady(egressSvc, cl, zl.Sugar())
+		expectEqual(t, fc, egressSvc)
+	})
+}
+
+func TestEgressServiceReadinessIPv6Only(t *testing.T) {
+	fc := fake.NewClientBuilder().
+		WithScheme(tsapi.GlobalScheme).
+		WithStatusSubresource(&tsapi.ProxyGroup{}).
+		Build()
+	zl, _ := zap.NewDevelopment()
+	cl := tstest.NewClock(tstest.ClockOpts{})
+	rec := &egressSvcsReadinessReconciler{
+		tsNamespace: "operator-ns",
+		Client:      fc,
+		logger:      zl.Sugar(),
+		clock:       cl,
+	}
+	egressSvc := &corev1.Service{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "my-app",
+			Namespace: "dev",
+			Annotations: map[string]string{
+				AnnotationProxyGroup:        "dev",
+				AnnotationTailnetTargetFQDN: "my-app.tailnetxyz.ts.net",
+			},
+		},
+	}
+	fakeClusterIPSvc := &corev1.Service{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "my-app",
+			Namespace: "operator-ns",
+			Labels:    egressSvcChildResourceLabels(egressSvc),
+		},
+		Spec: corev1.ServiceSpec{ClusterIPs: []string{"fd00::1"}},
+	}
+	labels := egressSvcEpsLabels(egressSvc, fakeClusterIPSvc)
+	eps := &discoveryv1.EndpointSlice{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "my-app-ipv6",
+			Namespace: "operator-ns",
+			Labels:    labels,
+		},
+		AddressType: discoveryv1.AddressTypeIPv6,
+	}
+	pg := &tsapi.ProxyGroup{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "dev",
+		},
+	}
+	mustCreate(t, fc, egressSvc)
+	mustCreate(t, fc, fakeClusterIPSvc)
+	mustCreate(t, fc, eps)
+	mustCreate(t, fc, pg)
+	setPGReady(pg, cl, zl.Sugar())
+	mustUpdateStatus(t, fc, pg.Namespace, pg.Name, func(p *tsapi.ProxyGroup) {
+		p.Status = pg.Status
+	})
+
+	// Create IPv6-only pods.
+	for i := range pgReplicas(pg) {
+		p := ipv6OnlyPod(pg, i)
+		mustCreate(t, fc, p)
+		mustUpdateStatus(t, fc, p.Namespace, p.Name, func(existing *corev1.Pod) {
+			existing.Status.PodIPs = p.Status.PodIPs
+		})
+	}
+
+	t.Run("no_ready_replicas", func(t *testing.T) {
+		expectReconciled(t, rec, "dev", "my-app")
+		setNotReady(egressSvc, cl, zl.Sugar(), pgReplicas(pg))
+		expectEqual(t, fc, egressSvc)
+	})
+	t.Run("all_replicas_ready", func(t *testing.T) {
+		for i := range pgReplicas(pg) {
+			p := ipv6OnlyPod(pg, i)
+			setEndpointForReplicaWithIP(p.Status.PodIPs[0].IP, eps)
+		}
+		mustUpdate(t, fc, eps.Namespace, eps.Name, func(e *discoveryv1.EndpointSlice) {
+			e.Endpoints = eps.Endpoints
+		})
+		setReady(egressSvc, cl, zl.Sugar(), pgReplicas(pg), pgReplicas(pg))
+		expectReconciled(t, rec, "dev", "my-app")
+		expectEqual(t, fc, egressSvc)
+	})
+}
+
+func ipv6OnlyPod(pg *tsapi.ProxyGroup, ordinal int32) *corev1.Pod {
+	labels := pgLabels(pg.Name, nil)
+	labels[appsv1.PodIndexLabel] = fmt.Sprintf("%d", ordinal)
+	ip := fmt.Sprintf("fd00::%d", ordinal+1) // +1 to avoid fd00::0 normalization issues
+	return &corev1.Pod{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      fmt.Sprintf("%s-%d", pg.Name, ordinal),
+			Namespace: "operator-ns",
+			Labels:    labels,
+		},
+		Status: corev1.PodStatus{
+			PodIPs: []corev1.PodIP{{IP: ip}},
+		},
+	}
+}
+
 func setClusterNotReady(svc *corev1.Service, cl tstime.Clock, lg *zap.SugaredLogger) {
 	tsoperator.SetServiceCondition(svc, tsapi.EgressSvcReady, metav1.ConditionFalse, reasonClusterResourcesNotReady, reasonClusterResourcesNotReady, cl, lg)
 }
@@ -166,3 +380,14 @@ func pod(pg *tsapi.ProxyGroup, ordinal int32) *corev1.Pod {
 		},
 	}
 }
+
+func setEndpointForReplicaWithIP(ip string, eps *discoveryv1.EndpointSlice) {
+	eps.Endpoints = append(eps.Endpoints, discoveryv1.Endpoint{
+		Addresses: []string{ip},
+		Conditions: discoveryv1.EndpointConditions{
+			Ready:       new(true),
+			Serving:     new(true),
+			Terminating: new(false),
+		},
+	})
+}
diff --git a/cmd/k8s-operator/egress-services.go b/cmd/k8s-operator/egress-services.go
index 4949db80a..f935fad64 100644
--- a/cmd/k8s-operator/egress-services.go
+++ b/cmd/k8s-operator/egress-services.go
@@ -12,6 +12,7 @@ import (
 	"errors"
 	"fmt"
 	"math/rand/v2"
+	"net/netip"
 	"reflect"
 	"slices"
 	"strings"
@@ -30,6 +31,7 @@ import (
 	"k8s.io/client-go/tools/record"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+
 	tsoperator "tailscale.com/k8s-operator"
 	tsapi "tailscale.com/k8s-operator/apis/v1alpha1"
 	"tailscale.com/kube/egressservices"
@@ -201,6 +203,10 @@ func (esr *egressSvcsReconciler) maybeProvision(ctx context.Context, svc *corev1
 		return nil
 	}
 
+	if err := esr.ensureEndpointSlices(ctx, svc, clusterIPSvc, lg); err != nil {
+		return err
+	}
+
 	// Update ExternalName Service to point at the ClusterIP Service.
 	clusterDomain := retrieveClusterDomain(esr.tsNamespace, lg)
 	clusterIPSvcFQDN := fmt.Sprintf("%s.%s.svc.%s", clusterIPSvc.Name, clusterIPSvc.Namespace, clusterDomain)
@@ -217,6 +223,60 @@ func (esr *egressSvcsReconciler) maybeProvision(ctx context.Context, svc *corev1
 	return nil
 }
 
+// addrTypesForClusterIPSvc returns the EndpointSlice address types (IP families)
+// that the given ClusterIP Service supports, derived from its ClusterIPs.
+// TODO(beckypauley): this could read Spec.IPFamilies directly instead of parsing
+// ClusterIPs to determine the family.
+func addrTypesForClusterIPSvc(clusterIPSvc *corev1.Service) ([]discoveryv1.AddressType, error) {
+	addrTypes := make([]discoveryv1.AddressType, 0, len(clusterIPSvc.Spec.ClusterIPs))
+	for _, clusterIP := range clusterIPSvc.Spec.ClusterIPs {
+		ip, err := netip.ParseAddr(clusterIP)
+		if err != nil {
+			return nil, fmt.Errorf("error parsing ClusterIP %q: %w", clusterIP, err)
+		}
+		addrType := discoveryv1.AddressTypeIPv4
+		if ip.Is6() {
+			addrType = discoveryv1.AddressTypeIPv6
+		}
+		addrTypes = append(addrTypes, addrType)
+	}
+	return addrTypes, nil
+}
+
+// ensureEndpointSlices ensures that EndpointSlices exist for the egress service
+// for each IP family supported by the cluster, and that their ports are up to
+// date.
+func (esr *egressSvcsReconciler) ensureEndpointSlices(ctx context.Context, svc, clusterIPSvc *corev1.Service, lg *zap.SugaredLogger) error {
+	crl := egressSvcEpsLabels(svc, clusterIPSvc)
+	// Only create EndpointSlices for IP families supported by the cluster.
+	addrTypes, err := addrTypesForClusterIPSvc(clusterIPSvc)
+	if err != nil {
+		return err
+	}
+	for _, addrType := range addrTypes {
+		eps := &discoveryv1.EndpointSlice{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      fmt.Sprintf("%s-%s", clusterIPSvc.Name, strings.ToLower(string(addrType))),
+				Namespace: esr.tsNamespace,
+				Labels:    crl,
+			},
+			AddressType: addrType,
+			Ports:       epsPortsFromSvc(clusterIPSvc),
+		}
+		if _, err := createOrUpdate(ctx, esr.Client, esr.tsNamespace, eps, func(e *discoveryv1.EndpointSlice) {
+			e.Labels = eps.Labels
+			e.AddressType = eps.AddressType
+			e.Ports = eps.Ports
+			for _, p := range e.Endpoints {
+				p.Conditions.Ready = nil
+			}
+		}); err != nil {
+			return fmt.Errorf("error ensuring %s EndpointSlice: %w", addrType, err)
+		}
+	}
+	return nil
+}
+
 func (esr *egressSvcsReconciler) provision(ctx context.Context, proxyGroupName string, svc, clusterIPSvc *corev1.Service, lg *zap.SugaredLogger) (*corev1.Service, bool, error) {
 	lg.Infof("updating configuration...")
 	usedPorts, err := esr.usedPortsForPG(ctx, proxyGroupName)
@@ -315,29 +375,6 @@ func (esr *egressSvcsReconciler) provision(ctx context.Context, proxyGroupName s
 		}
 	}
 
-	crl := egressSvcEpsLabels(svc, clusterIPSvc)
-	// TODO(irbekrm): support IPv6, but need to investigate how kube proxy
-	// sets up Service -> Pod routing when IPv6 is involved.
-	eps := &discoveryv1.EndpointSlice{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      fmt.Sprintf("%s-ipv4", clusterIPSvc.Name),
-			Namespace: esr.tsNamespace,
-			Labels:    crl,
-		},
-		AddressType: discoveryv1.AddressTypeIPv4,
-		Ports:       epsPortsFromSvc(clusterIPSvc),
-	}
-	if eps, err = createOrUpdate(ctx, esr.Client, esr.tsNamespace, eps, func(e *discoveryv1.EndpointSlice) {
-		e.Labels = eps.Labels
-		e.AddressType = eps.AddressType
-		e.Ports = eps.Ports
-		for _, p := range e.Endpoints {
-			p.Conditions.Ready = nil
-		}
-	}); err != nil {
-		return nil, false, fmt.Errorf("error ensuring EndpointSlice: %w", err)
-	}
-
 	cm, cfgs, err := egressSvcsConfigs(ctx, esr.Client, proxyGroupName, esr.tsNamespace)
 	if err != nil {
 		return nil, false, fmt.Errorf("error retrieving egress services configuration: %w", err)
@@ -347,11 +384,11 @@ func (esr *egressSvcsReconciler) provision(ctx context.Context, proxyGroupName s
 		return nil, false, nil
 	}
 	tailnetSvc := tailnetSvcName(svc)
-	gotCfg := (*cfgs)[tailnetSvc]
+	gotCfg := cfgs[tailnetSvc]
 	wantsCfg := egressSvcCfg(svc, clusterIPSvc, esr.tsNamespace, lg)
 	if !reflect.DeepEqual(gotCfg, wantsCfg) {
 		lg.Debugf("updating egress services ConfigMap %s", cm.Name)
-		mak.Set(cfgs, tailnetSvc, wantsCfg)
+		mak.Set(&cfgs, tailnetSvc, wantsCfg)
 		bs, err := json.Marshal(cfgs)
 		if err != nil {
 			return nil, false, fmt.Errorf("error marshalling egress services configs: %w", err)
@@ -485,19 +522,19 @@ func (esr *egressSvcsReconciler) ensureEgressSvcCfgDeleted(ctx context.Context,
 		lggr.Debugf("ConfigMap does not contain egress service configs")
 		return nil
 	}
-	cfgs := &egressservices.Configs{}
-	if err := json.Unmarshal(bs, cfgs); err != nil {
+	cfgs := egressservices.Configs{}
+	if err := json.Unmarshal(bs, &cfgs); err != nil {
 		return fmt.Errorf("error unmarshalling egress services configs")
 	}
 	tailnetSvc := tailnetSvcName(svc)
-	_, ok := (*cfgs)[tailnetSvc]
+	_, ok := cfgs[tailnetSvc]
 	if !ok {
 		lggr.Debugf("ConfigMap does not contain egress service config, likely because it was already deleted")
 		return nil
 	}
-	lggr.Infof("before deleting config %+#v", *cfgs)
-	delete(*cfgs, tailnetSvc)
-	lggr.Infof("after deleting config %+#v", *cfgs)
+	lggr.Infof("before deleting config %+#v", cfgs)
+	delete(cfgs, tailnetSvc)
+	lggr.Infof("after deleting config %+#v", cfgs)
 	bs, err := json.Marshal(cfgs)
 	if err != nil {
 		return fmt.Errorf("error marshalling egress services configs: %w", err)
@@ -649,7 +686,7 @@ func isEgressSvcForProxyGroup(obj client.Object) bool {
 
 // egressSvcConfig returns a ConfigMap that contains egress services configuration for the provided ProxyGroup as well
 // as unmarshalled configuration from the ConfigMap.
-func egressSvcsConfigs(ctx context.Context, cl client.Client, proxyGroupName, tsNamespace string) (cm *corev1.ConfigMap, cfgs *egressservices.Configs, err error) {
+func egressSvcsConfigs(ctx context.Context, cl client.Client, proxyGroupName, tsNamespace string) (cm *corev1.ConfigMap, cfgs egressservices.Configs, err error) {
 	name := pgEgressCMName(proxyGroupName)
 	cm = &corev1.ConfigMap{
 		ObjectMeta: metav1.ObjectMeta{
@@ -664,9 +701,9 @@ func egressSvcsConfigs(ctx context.Context, cl client.Client, proxyGroupName, ts
 	if err != nil {
 		return nil, nil, fmt.Errorf("error retrieving egress services ConfigMap %s: %v", name, err)
 	}
-	cfgs = &egressservices.Configs{}
+	cfgs = egressservices.Configs{}
 	if len(cm.BinaryData[egressservices.KeyEgressServices]) != 0 {
-		if err := json.Unmarshal(cm.BinaryData[egressservices.KeyEgressServices], cfgs); err != nil {
+		if err := json.Unmarshal(cm.BinaryData[egressservices.KeyEgressServices], &cfgs); err != nil {
 			return nil, nil, fmt.Errorf("error unmarshaling egress services config %v: %w", cm.BinaryData[egressservices.KeyEgressServices], err)
 		}
 	}
diff --git a/cmd/k8s-operator/egress-services_test.go b/cmd/k8s-operator/egress-services_test.go
index 8443a1573..20efe195d 100644
--- a/cmd/k8s-operator/egress-services_test.go
+++ b/cmd/k8s-operator/egress-services_test.go
@@ -21,6 +21,8 @@ import (
 	"k8s.io/apimachinery/pkg/util/intstr"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+	"sigs.k8s.io/controller-runtime/pkg/client/interceptor"
+
 	tsapi "tailscale.com/k8s-operator/apis/v1alpha1"
 	"tailscale.com/kube/egressservices"
 	"tailscale.com/tstest"
@@ -49,6 +51,9 @@ func TestTailscaleEgressServices(t *testing.T) {
 		WithScheme(tsapi.GlobalScheme).
 		WithObjects(pg, cm).
 		WithStatusSubresource(pg).
+		WithInterceptorFuncs(interceptor.Funcs{
+			Create: clusterIPInterceptor("10.96.0.1"),
+		}).
 		Build()
 	zl, err := zap.NewDevelopment()
 	if err != nil {
@@ -116,6 +121,23 @@ func TestTailscaleEgressServices(t *testing.T) {
 		validateReadyService(t, fc, esr, svc, clock, zl, cm)
 	})
 
+	t.Run("endpointslice_deletion_recovery", func(t *testing.T) {
+		name := findGenNameForEgressSvcResources(t, fc, svc)
+		epsName := fmt.Sprintf("%s-ipv4", name)
+		// Delete the EndpointSlice and verify it is recreated.
+		eps := &discoveryv1.EndpointSlice{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      epsName,
+				Namespace: "operator-ns",
+			},
+		}
+		if err := fc.Delete(t.Context(), eps); err != nil {
+			t.Fatalf("error deleting EndpointSlice: %v", err)
+		}
+		expectMissing[discoveryv1.EndpointSlice](t, fc, "operator-ns", epsName)
+		validateReadyService(t, fc, esr, svc, clock, zl, cm)
+	})
+
 	t.Run("delete_external_name_service", func(t *testing.T) {
 		name := findGenNameForEgressSvcResources(t, fc, svc)
 		if err := fc.Delete(context.Background(), svc); err != nil {
@@ -134,10 +156,10 @@ func validateReadyService(t *testing.T, fc client.WithWatch, esr *egressSvcsReco
 	expectReconciled(t, esr, "default", "test")
 	// Verify that a ClusterIP Service has been created.
 	name := findGenNameForEgressSvcResources(t, fc, svc)
-	expectEqual(t, fc, clusterIPSvc(name, svc), removeTargetPortsFromSvc)
+	expectEqual(t, fc, clusterIPSvc(name, svc), removeTargetPortsFromSvc, removeClusterIPsFromSvc)
 	clusterSvc := mustGetClusterIPSvc(t, fc, name)
 	// Verify that an EndpointSlice has been created.
-	expectEqual(t, fc, endpointSlice(name, svc, clusterSvc))
+	expectEqual(t, fc, endpointSlice(name, svc, clusterSvc, discoveryv1.AddressTypeIPv4))
 	// Verify that ConfigMap contains configuration for the new egress service.
 	mustHaveConfigForSvc(t, fc, svc, clusterSvc, cm, zl)
 	r := svcConfiguredReason(svc, true, zl.Sugar())
@@ -223,18 +245,22 @@ func mustGetClusterIPSvc(t *testing.T, cl client.Client, name string) *corev1.Se
 	return svc
 }
 
-func endpointSlice(name string, extNSvc, clusterIPSvc *corev1.Service) *discoveryv1.EndpointSlice {
+func endpointSlice(name string, extNSvc, clusterIPSvc *corev1.Service, addrType discoveryv1.AddressType) *discoveryv1.EndpointSlice {
 	labels := egressSvcChildResourceLabels(extNSvc)
 	labels[discoveryv1.LabelManagedBy] = "tailscale.com"
 	labels[discoveryv1.LabelServiceName] = name
+	suffix := "ipv4"
+	if addrType == discoveryv1.AddressTypeIPv6 {
+		suffix = "ipv6"
+	}
 	return &discoveryv1.EndpointSlice{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:      fmt.Sprintf("%s-ipv4", name),
+			Name:      fmt.Sprintf("%s-%s", name, suffix),
 			Namespace: "operator-ns",
 			Labels:    labels,
 		},
 		Ports:       portsForEndpointSlice(clusterIPSvc),
-		AddressType: discoveryv1.AddressTypeIPv4,
+		AddressType: addrType,
 	}
 }
 
@@ -284,13 +310,155 @@ func configFromCM(t *testing.T, cm *corev1.ConfigMap, svcName string) *egressser
 	if !ok {
 		return nil
 	}
-	cfgs := &egressservices.Configs{}
-	if err := json.Unmarshal(cfgBs, cfgs); err != nil {
+	cfgs := egressservices.Configs{}
+	if err := json.Unmarshal(cfgBs, &cfgs); err != nil {
 		t.Fatalf("error unmarshalling config: %v", err)
 	}
-	cfg, ok := (*cfgs)[svcName]
+	cfg, ok := cfgs[svcName]
 	if ok {
 		return &cfg
 	}
 	return nil
 }
+
+func TestTailscaleEgressServicesDualStack(t *testing.T) {
+	pg := &tsapi.ProxyGroup{
+		TypeMeta: metav1.TypeMeta{Kind: "ProxyGroup", APIVersion: "tailscale.com/v1alpha1"},
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "foo",
+			UID:  types.UID("1234-UID"),
+		},
+		Spec: tsapi.ProxyGroupSpec{
+			Replicas: pointer.To[int32](3),
+			Type:     tsapi.ProxyGroupTypeEgress,
+		},
+	}
+	cm := &corev1.ConfigMap{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      pgEgressCMName("foo"),
+			Namespace: "operator-ns",
+		},
+	}
+	fc := fake.NewClientBuilder().
+		WithScheme(tsapi.GlobalScheme).
+		WithObjects(pg, cm).
+		WithStatusSubresource(pg).
+		WithInterceptorFuncs(interceptor.Funcs{
+			Create: clusterIPInterceptor("10.96.0.1", "fd00::1"),
+		}).
+		Build()
+	zl, err := zap.NewDevelopment()
+	if err != nil {
+		t.Fatal(err)
+	}
+	clock := tstest.NewClock(tstest.ClockOpts{})
+
+	esr := &egressSvcsReconciler{
+		Client:      fc,
+		logger:      zl.Sugar(),
+		clock:       clock,
+		tsNamespace: "operator-ns",
+	}
+	svc := &corev1.Service{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test",
+			Namespace: "default",
+			UID:       types.UID("1234-UID"),
+			Annotations: map[string]string{
+				AnnotationTailnetTargetFQDN: "foo.bar.ts.net.",
+				AnnotationProxyGroup:        "foo",
+			},
+		},
+		Spec: corev1.ServiceSpec{
+			ExternalName: "placeholder",
+			Type:         corev1.ServiceTypeExternalName,
+			Selector:     nil,
+			Ports: []corev1.ServicePort{
+				{
+					Protocol: "TCP",
+					Port:     80,
+				},
+			},
+		},
+	}
+
+	t.Run("dual_stack_creates_both_endpoint_slices", func(t *testing.T) {
+		mustCreate(t, fc, svc)
+		expectReconciled(t, esr, "default", "test")
+		validateReadyService(t, fc, esr, svc, clock, zl, cm)
+		// Also verify the IPv6 EndpointSlice was created.
+		name := findGenNameForEgressSvcResources(t, fc, svc)
+		clusterSvc := mustGetClusterIPSvc(t, fc, name)
+		expectEqual(t, fc, endpointSlice(name, svc, clusterSvc, discoveryv1.AddressTypeIPv6))
+	})
+
+	t.Run("dual_stack_endpointslice_deletion_recovery", func(t *testing.T) {
+		name := findGenNameForEgressSvcResources(t, fc, svc)
+		// Delete both IPv4 and IPv6 EndpointSlices.
+		for _, suffix := range []string{"ipv4", "ipv6"} {
+			epsName := fmt.Sprintf("%s-%s", name, suffix)
+			eps := &discoveryv1.EndpointSlice{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      epsName,
+					Namespace: "operator-ns",
+				},
+			}
+			if err := fc.Delete(t.Context(), eps); err != nil {
+				t.Fatalf("error deleting EndpointSlice %s: %v", epsName, err)
+			}
+			expectMissing[discoveryv1.EndpointSlice](t, fc, "operator-ns", epsName)
+		}
+		// Reconcile should recreate both.
+		validateReadyService(t, fc, esr, svc, clock, zl, cm)
+		clusterSvc := mustGetClusterIPSvc(t, fc, name)
+		expectEqual(t, fc, endpointSlice(name, svc, clusterSvc, discoveryv1.AddressTypeIPv6))
+	})
+
+	t.Run("dual_stack_single_endpointslice_deletion_recovery", func(t *testing.T) {
+		name := findGenNameForEgressSvcResources(t, fc, svc)
+		// Delete only the IPv6 EndpointSlice.
+		epsName := fmt.Sprintf("%s-ipv6", name)
+		eps := &discoveryv1.EndpointSlice{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      epsName,
+				Namespace: "operator-ns",
+			},
+		}
+		if err := fc.Delete(t.Context(), eps); err != nil {
+			t.Fatalf("error deleting EndpointSlice %s: %v", epsName, err)
+		}
+		expectMissing[discoveryv1.EndpointSlice](t, fc, "operator-ns", epsName)
+		// Reconcile should recreate the missing IPv6 EndpointSlice while leaving
+		// the IPv4 one untouched.
+		validateReadyService(t, fc, esr, svc, clock, zl, cm)
+		clusterSvc := mustGetClusterIPSvc(t, fc, name)
+		expectEqual(t, fc, endpointSlice(name, svc, clusterSvc, discoveryv1.AddressTypeIPv6))
+		expectEqual(t, fc, endpointSlice(name, svc, clusterSvc, discoveryv1.AddressTypeIPv4))
+	})
+
+	t.Run("delete_dual_stack_service", func(t *testing.T) {
+		name := findGenNameForEgressSvcResources(t, fc, svc)
+		if err := fc.Delete(context.Background(), svc); err != nil {
+			t.Fatalf("error deleting ExternalName Service: %v", err)
+		}
+		expectReconciled(t, esr, "default", "test")
+		expectMissing[corev1.Service](t, fc, "operator-ns", name)
+		expectMissing[discoveryv1.EndpointSlice](t, fc, "operator-ns", fmt.Sprintf("%s-ipv4", name))
+		expectMissing[discoveryv1.EndpointSlice](t, fc, "operator-ns", fmt.Sprintf("%s-ipv6", name))
+		mustNotHaveConfigForSvc(t, fc, svc, cm)
+	})
+}
+
+// clusterIPInterceptor returns an interceptor.Funcs Create function that
+// simulates the API server assigning ClusterIPs to ClusterIP Services.
+// This is required because the reconciler iterates ClusterIPs to create
+// per-family EndpointSlices but the fake client does not assign ClusterIPs.
+func clusterIPInterceptor(clusterIPs ...string) func(ctx context.Context, c client.WithWatch, obj client.Object, opts ...client.CreateOption) error {
+	return func(ctx context.Context, c client.WithWatch, obj client.Object, opts ...client.CreateOption) error {
+		if svc, ok := obj.(*corev1.Service); ok && svc.Spec.Type == corev1.ServiceTypeClusterIP {
+			svc.Spec.ClusterIPs = clusterIPs
+			svc.Spec.ClusterIP = clusterIPs[0]
+		}
+		return c.Create(ctx, obj, opts...)
+	}
+}
diff --git a/cmd/k8s-operator/generate/main.go b/cmd/k8s-operator/generate/main.go
index 840812ea3..b3e44c117 100644
--- a/cmd/k8s-operator/generate/main.go
+++ b/cmd/k8s-operator/generate/main.go
@@ -28,6 +28,7 @@ const (
 	proxyGroupCRDPath                   = operatorDeploymentFilesPath + "/crds/tailscale.com_proxygroups.yaml"
 	tailnetCRDPath                      = operatorDeploymentFilesPath + "/crds/tailscale.com_tailnets.yaml"
 	proxyGroupPolicyCRDPath             = operatorDeploymentFilesPath + "/crds/tailscale.com_proxygrouppolicies.yaml"
+	peerRelayCRDPath                    = operatorDeploymentFilesPath + "/crds/tailscale.com_peerrelays.yaml"
 	helmTemplatesPath                   = operatorDeploymentFilesPath + "/chart/templates"
 	connectorCRDHelmTemplatePath        = helmTemplatesPath + "/connector.yaml"
 	proxyClassCRDHelmTemplatePath       = helmTemplatesPath + "/proxyclass.yaml"
@@ -36,6 +37,7 @@ const (
 	proxyGroupCRDHelmTemplatePath       = helmTemplatesPath + "/proxygroup.yaml"
 	tailnetCRDHelmTemplatePath          = helmTemplatesPath + "/tailnet.yaml"
 	proxyGroupPolicyCRDHelmTemplatePath = helmTemplatesPath + "/proxygrouppolicy.yaml"
+	peerRelayCRDHelmTemplatePath        = helmTemplatesPath + "/peerrelay.yaml"
 
 	helmConditionalStart = "{{ if .Values.installCRDs -}}\n"
 	helmConditionalEnd   = "{{- end -}}"
@@ -160,6 +162,7 @@ func generate(baseDir string) error {
 		{proxyGroupCRDPath, proxyGroupCRDHelmTemplatePath},
 		{tailnetCRDPath, tailnetCRDHelmTemplatePath},
 		{proxyGroupPolicyCRDPath, proxyGroupPolicyCRDHelmTemplatePath},
+		{peerRelayCRDPath, peerRelayCRDHelmTemplatePath},
 	} {
 		if err := addCRDToHelm(crd.crdPath, crd.templatePath); err != nil {
 			return fmt.Errorf("error adding %s CRD to Helm templates: %w", crd.crdPath, err)
@@ -178,6 +181,7 @@ func cleanup(baseDir string) error {
 		proxyGroupCRDHelmTemplatePath,
 		tailnetCRDHelmTemplatePath,
 		proxyGroupPolicyCRDHelmTemplatePath,
+		peerRelayCRDHelmTemplatePath,
 	} {
 		if err := os.Remove(filepath.Join(baseDir, path)); err != nil && !os.IsNotExist(err) {
 			return fmt.Errorf("error cleaning up %s: %w", path, err)
diff --git a/cmd/k8s-operator/ingress-for-pg.go b/cmd/k8s-operator/ingress-for-pg.go
index 37d0ed014..f76a7da2a 100644
--- a/cmd/k8s-operator/ingress-for-pg.go
+++ b/cmd/k8s-operator/ingress-for-pg.go
@@ -173,14 +173,14 @@ func (r *HAIngressReconciler) maybeProvision(ctx context.Context, hostname strin
 		logger.Infof("error validating tailscale IngressClass: %v.", err)
 		return false, nil
 	}
-	// Get and validate ProxyGroup readiness
+
+	// We only act on services that are annotated as using a proxy group.
 	pgName := ing.Annotations[AnnotationProxyGroup]
 	if pgName == "" {
-		logger.Infof("[unexpected] no ProxyGroup annotation, skipping Tailscale Service provisioning")
 		return false, nil
 	}
-	logger = logger.With("ProxyGroup", pgName)
 
+	logger = logger.With("ProxyGroup", pgName)
 	if !tsoperator.ProxyGroupAvailable(pg) {
 		logger.Infof("ProxyGroup is not (yet) ready")
 		return false, nil
@@ -455,8 +455,10 @@ func (r *HAIngressReconciler) maybeCleanupProxyGroup(ctx context.Context, logger
 	if err := r.List(ctx, ingList); err != nil {
 		return false, fmt.Errorf("listing Ingresses: %w", err)
 	}
-	serveConfigChanged := false
-	// For each Tailscale Service in serve config...
+
+	// Collect orphans first so we are not mutating cfg.Services during
+	// iteration.
+	var orphans []tailcfg.ServiceName
 	for tsSvcName := range cfg.Services {
 		// ...check if there is currently an Ingress with this hostname
 		found := false
@@ -469,40 +471,23 @@ func (r *HAIngressReconciler) maybeCleanupProxyGroup(ctx context.Context, logger
 		}
 
 		if !found {
-			logger.Infof("Tailscale Service %q is not owned by any Ingress, cleaning up", tsSvcName)
-			tsService, err := tsClient.VIPServices().Get(ctx, tsSvcName.String())
-			switch {
-			case tailscale.IsNotFound(err):
-				return false, nil
-			case err != nil:
-				return false, fmt.Errorf("getting Tailscale Service %q: %w", tsSvcName, err)
-			}
-
-			// Delete the Tailscale Service from control if necessary.
-			svcsChanged, err = r.cleanupTailscaleService(ctx, tsService, logger, tsClient)
-			if err != nil {
-				return false, fmt.Errorf("deleting Tailscale Service %q: %w", tsSvcName, err)
-			}
-
-			// Make sure the Tailscale Service is not advertised in tailscaled or serve config.
-			if err = r.maybeUpdateAdvertiseServicesConfig(ctx, tsSvcName, serviceAdvertisementOff, pg); err != nil {
-				return false, fmt.Errorf("failed to update tailscaled config services: %w", err)
-			}
-
-			_, ok := cfg.Services[tsSvcName]
-			if ok {
-				logger.Infof("Removing Tailscale Service %q from serve config", tsSvcName)
-				delete(cfg.Services, tsSvcName)
-				serveConfigChanged = true
-			}
-
-			if err = cleanupCertResources(ctx, r.Client, r.tsNamespace, tsSvcName, pg); err != nil {
-				return false, fmt.Errorf("failed to clean up cert resources: %w", err)
-			}
+			orphans = append(orphans, tsSvcName)
 		}
 	}
 
-	if serveConfigChanged {
+	// 1. Remove all orphans from serve config in a single ConfigMap Update
+	// so the proxy cancels every cert loop before we start deleting
+	// VIPServices, and we only pay one fsnotify propagation window.
+	updated := false
+	for _, tsSvcName := range orphans {
+		logger.Infof("Tailscale Service %q is not owned by any Ingress, cleaning up", tsSvcName)
+		_, ok := cfg.Services[tsSvcName]
+		if ok {
+			delete(cfg.Services, tsSvcName)
+			updated = true
+		}
+	}
+	if updated {
 		cfgBytes, err := json.Marshal(cfg)
 		if err != nil {
 			return false, fmt.Errorf("marshaling serve config: %w", err)
@@ -511,7 +496,37 @@ func (r *HAIngressReconciler) maybeCleanupProxyGroup(ctx context.Context, logger
 		if err := r.Update(ctx, cm); err != nil {
 			return false, fmt.Errorf("updating serve config: %w", err)
 		}
+		logger.Infof("Removed Tailscale Services from serve config: %v", orphans)
 	}
+
+	for _, tsSvcName := range orphans {
+		// 2. Unadvertise the Tailscale Service in tailscaled config.
+		if err := r.maybeUpdateAdvertiseServicesConfig(ctx, tsSvcName, serviceAdvertisementOff, pg); err != nil {
+			return svcsChanged, fmt.Errorf("failed to update tailscaled config services: %w", err)
+		}
+
+		// 3. Delete the Tailscale Service from the control plane.
+		tsService, err := tsClient.VIPServices().Get(ctx, tsSvcName.String())
+		switch {
+		case tailscale.IsNotFound(err):
+			// Already gone at the control plane; continue with cluster
+			// cleanup rather than aborting the sweep.
+		case err != nil:
+			return svcsChanged, fmt.Errorf("getting Tailscale Service %q: %w", tsSvcName, err)
+		default:
+			updated, err := r.cleanupTailscaleService(ctx, tsService, logger, tsClient)
+			if err != nil {
+				return svcsChanged, fmt.Errorf("deleting Tailscale Service %q: %w", tsSvcName, err)
+			}
+			svcsChanged = svcsChanged || updated
+		}
+
+		// 4. Clean up cluster cert resources.
+		if err := cleanupCertResources(ctx, r.Client, r.tsNamespace, tsSvcName, pg); err != nil {
+			return svcsChanged, fmt.Errorf("failed to clean up cert resources: %w", err)
+		}
+	}
+
 	return svcsChanged, nil
 }
 
@@ -519,6 +534,10 @@ func (r *HAIngressReconciler) maybeCleanupProxyGroup(ctx context.Context, logger
 // Ingress is being deleted or is unexposed. The cleanup is safe for a multi-cluster setup- the Tailscale Service is only
 // deleted if it does not contain any other owner references. If it does the cleanup only removes the owner reference
 // corresponding to this Ingress.
+//
+// Steps are ordered so the proxy cancels its cert loop (via serve config
+// removal) before the VIPService is deleted; otherwise the loop retries
+// against a domain the control plane no longer recognises.
 func (r *HAIngressReconciler) maybeCleanup(ctx context.Context, hostname string, ing *networkingv1.Ingress, logger *zap.SugaredLogger, tsClient tsclient.Client, pg *tsapi.ProxyGroup) (svcChanged bool, err error) {
 	logger.Debugf("Ensuring any resources for Ingress are cleaned up")
 	ix := slices.Index(ing.Finalizers, FinalizerNamePG)
@@ -543,49 +562,53 @@ func (r *HAIngressReconciler) maybeCleanup(ctx context.Context, hostname string,
 		err = r.deleteFinalizer(ctx, ing, logger)
 	}()
 
-	// 1. Check if there is a Tailscale Service associated with this Ingress.
 	cm, cfg, err := r.proxyGroupServeConfig(ctx, pg.Name)
 	if err != nil {
 		return false, fmt.Errorf("error getting ProxyGroup serve config: %w", err)
 	}
 
-	// Tailscale Service is always first added to serve config and only then created in the Tailscale API, so if it is not
-	// found in the serve config, we can assume that there is no Tailscale Service. (If the serve config does not exist at
-	// all, it is possible that the ProxyGroup has been deleted before cleaning up the Ingress, so carry on with
-	// cleanup).
-	if cfg != nil && cfg.Services != nil && cfg.Services[serviceName] == nil {
-		return false, nil
+	// 1. Remove the Tailscale Service from the proxy's serve config. The proxy
+	// picks up the change via fsnotify on the mounted ConfigMap and cancels
+	// its cert loop for this domain before we proceed to delete the
+	// VIPService.
+	if cfg != nil && cfg.Services != nil {
+		if _, ok := cfg.Services[serviceName]; ok {
+			logger.Infof("Removing TailscaleService %q from serve config for ProxyGroup %q", hostname, pg.Name)
+			delete(cfg.Services, serviceName)
+			cfgBytes, err := json.Marshal(cfg)
+			if err != nil {
+				return false, fmt.Errorf("error marshaling serve config: %w", err)
+			}
+			mak.Set(&cm.BinaryData, serveConfigKey, cfgBytes)
+			if err := r.Update(ctx, cm); err != nil {
+				return false, fmt.Errorf("error updating serve config: %w", err)
+			}
+		}
 	}
 
-	// 2. Clean up the Tailscale Service resources.
+	// 2. Unadvertise the Tailscale Service in each proxy's tailscaled config.
+	// Skipped if the ProxyGroup itself has been deleted (no config Secrets to
+	// update).
+	if cfg != nil {
+		if err = r.maybeUpdateAdvertiseServicesConfig(ctx, serviceName, serviceAdvertisementOff, pg); err != nil {
+			return false, fmt.Errorf("failed to update tailscaled config services: %w", err)
+		}
+	}
+
+	// 3. Delete the Tailscale Service from the control plane. By now the
+	// proxy has stopped serving HTTPS for the domain and stopped trying to
+	// renew its cert.
 	svcChanged, err = r.cleanupTailscaleService(ctx, svc, logger, tsClient)
 	if err != nil {
 		return false, fmt.Errorf("error deleting Tailscale Service: %w", err)
 	}
 
-	// 3. Clean up any cluster resources
+	// 4. Clean up cluster cert resources (TLS Secret + RBAC).
 	if err = cleanupCertResources(ctx, r.Client, r.tsNamespace, serviceName, pg); err != nil {
 		return false, fmt.Errorf("failed to clean up cert resources: %w", err)
 	}
 
-	if cfg == nil || cfg.Services == nil { // user probably deleted the ProxyGroup
-		return svcChanged, nil
-	}
-
-	// 4. Unadvertise the Tailscale Service in tailscaled config.
-	if err = r.maybeUpdateAdvertiseServicesConfig(ctx, serviceName, serviceAdvertisementOff, pg); err != nil {
-		return false, fmt.Errorf("failed to update tailscaled config services: %w", err)
-	}
-
-	// 5. Remove the Tailscale Service from the serve config for the ProxyGroup.
-	logger.Infof("Removing TailscaleService %q from serve config for ProxyGroup %q", hostname, pg.Name)
-	delete(cfg.Services, serviceName)
-	cfgBytes, err := json.Marshal(cfg)
-	if err != nil {
-		return false, fmt.Errorf("error marshaling serve config: %w", err)
-	}
-	mak.Set(&cm.BinaryData, serveConfigKey, cfgBytes)
-	return svcChanged, r.Update(ctx, cm)
+	return svcChanged, nil
 }
 
 func (r *HAIngressReconciler) deleteFinalizer(ctx context.Context, ing *networkingv1.Ingress, logger *zap.SugaredLogger) error {
@@ -685,9 +708,10 @@ func (r *HAIngressReconciler) validateIngress(ctx context.Context, ing *networki
 	// It is invalid to have multiple Ingress resources for the same Tailscale Service in one cluster.
 	ingList := &networkingv1.IngressList{}
 	if err := r.List(ctx, ingList); err != nil {
-		errs = append(errs, fmt.Errorf("[unexpected] error listing Ingresses: %w", err))
+		errs = append(errs, fmt.Errorf("failed to list ingresses: %w", err))
 		return errors.Join(errs...)
 	}
+
 	for _, i := range ingList.Items {
 		if r.shouldExpose(&i) && hostnameForIngress(&i) == hostname && i.UID != ing.UID {
 			errs = append(errs, fmt.Errorf("found duplicate Ingress %q for hostname %q - multiple Ingresses for the same hostname in the same cluster are not allowed", client.ObjectKeyFromObject(&i), hostname))
@@ -876,14 +900,16 @@ func ownerAnnotations(operatorID string, svc *tailscale.VIPService) (map[string]
 	}
 	if svc == nil {
 		c := ownerAnnotationValue{OwnerRefs: []OwnerRef{ref}}
-		json, err := json.Marshal(c)
+		data, err := json.Marshal(c)
 		if err != nil {
-			return nil, fmt.Errorf("[unexpected] unable to marshal Tailscale Service's owner annotation contents: %w, please report this", err)
+			return nil, fmt.Errorf("failed to marshal Tailscale Service's owner annotation contents: %w", err)
 		}
+
 		return map[string]string{
-			ownerAnnotation: string(json),
+			ownerAnnotation: string(data),
 		}, nil
 	}
+
 	o, err := parseOwnerAnnotation(svc)
 	if err != nil {
 		return nil, err
@@ -1081,7 +1107,7 @@ func certResourceLabels(pgName, domain string) map[string]string {
 	return map[string]string{
 		kubetypes.LabelManaged: "true",
 		labelProxyGroup:        pgName,
-		labelDomain:            domain,
+		labelDomain:            tsoperator.TruncateLabelValue(domain),
 	}
 }
 
diff --git a/cmd/k8s-operator/ingress.go b/cmd/k8s-operator/ingress.go
index 4952e789f..8ea6d2f47 100644
--- a/cmd/k8s-operator/ingress.go
+++ b/cmd/k8s-operator/ingress.go
@@ -8,6 +8,7 @@ package main
 import (
 	"context"
 	"fmt"
+	"net"
 	"slices"
 	"strings"
 	"sync"
@@ -364,7 +365,7 @@ func handlersForIngress(ctx context.Context, ing *networkingv1.Ingress, cl clien
 			proto = "https+insecure://"
 		}
 		mak.Set(&handlers, path, &ipn.HTTPHandler{
-			Proxy: proto + svc.Spec.ClusterIP + ":" + fmt.Sprint(port) + path,
+			Proxy: proto + net.JoinHostPort(svc.Spec.ClusterIP, fmt.Sprint(port)) + path,
 		})
 	}
 	addIngressBackend(ing.Spec.DefaultBackend, "/")
diff --git a/cmd/k8s-operator/ingress_test.go b/cmd/k8s-operator/ingress_test.go
index c2a1198cc..92065b43d 100644
--- a/cmd/k8s-operator/ingress_test.go
+++ b/cmd/k8s-operator/ingress_test.go
@@ -942,3 +942,91 @@ func TestTailscaleIngressWithHTTPRedirect(t *testing.T) {
 		t.Errorf("incorrect status ports after removing redirect: got %v, want %v", ing.Status.LoadBalancer.Ingress[0].Ports, wantPorts)
 	}
 }
+
+func TestTailscaleIngressIPv6(t *testing.T) {
+	fc := fake.NewFakeClient(ingressClass())
+	zl, err := zap.NewDevelopment()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Create a Service with an IPv6 ClusterIP
+	ipv6Svc := &corev1.Service{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-ipv6",
+			Namespace: "default",
+		},
+		Spec: corev1.ServiceSpec{
+			ClusterIP: "fda9:e575:6e22:2::25",
+			Ports: []corev1.ServicePort{
+				{
+					Port: 2283,
+					Name: "http",
+				},
+			},
+		},
+	}
+	mustCreate(t, fc, ipv6Svc)
+
+	// Create an Ingress that routes to the IPv6 service
+	ing := &networkingv1.Ingress{
+		TypeMeta: metav1.TypeMeta{Kind: "Ingress", APIVersion: "networking.k8s.io/v1"},
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-ipv6",
+			Namespace: "default",
+			UID:       "1234-UID-IPV6",
+		},
+		Spec: networkingv1.IngressSpec{
+			IngressClassName: new("tailscale"),
+			DefaultBackend: &networkingv1.IngressBackend{
+				Service: &networkingv1.IngressServiceBackend{
+					Name: "test-ipv6",
+					Port: networkingv1.ServiceBackendPort{
+						Number: 2283,
+					},
+				},
+			},
+		},
+	}
+	mustCreate(t, fc, ing)
+
+	ingR := &IngressReconciler{
+		Client:           fc,
+		ingressClassName: "tailscale",
+		ssr: &tailscaleSTSReconciler{
+			Client:            fc,
+			clients:           tsclient.NewProvider(&fakeTSClient{}),
+			tsnetServer:       &fakeTSNetServer{certDomains: []string{"test-host"}},
+			defaultTags:       []string{"tag:test"},
+			operatorNamespace: "operator-ns",
+			proxyImage:        "tailscale/tailscale",
+		},
+		logger: zl.Sugar(),
+	}
+
+	expectReconciled(t, ingR, "default", "test-ipv6")
+
+	// Verify the generated serveConfig has properly bracketed IPv6 address
+	fullName, _ := findGenName(t, fc, "default", "test-ipv6", "ingress")
+	opts := configOpts{
+		replicas:   new(int32(1)),
+		stsName:    "tailscale-ipv6-ingress-test-ipv6",
+		secretName: fullName,
+		namespace:  "default",
+		parentType: "ingress",
+		hostname:   "default-test-ipv6-ingress",
+		app:        kubetypes.AppIngressResource,
+		serveConfig: &ipn.ServeConfig{
+			TCP: map[uint16]*ipn.TCPPortHandler{443: {HTTPS: true}},
+			Web: map[ipn.HostPort]*ipn.WebServerConfig{
+				"${TS_CERT_DOMAIN}:443": {Handlers: map[string]*ipn.HTTPHandler{
+					"/": {Proxy: "http://[fda9:e575:6e22:2::25]:2283/"},
+				}},
+			},
+		},
+	}
+	// expectedSecret hardcodes the parent-resource label to "test", so fix it for our IPv6 test
+	secret := expectedSecret(t, fc, opts)
+	secret.Labels[LabelParentName] = "test-ipv6"
+	expectEqual(t, fc, secret)
+}
diff --git a/cmd/k8s-operator/metrics_resources.go b/cmd/k8s-operator/metrics_resources.go
index c7c329a7e..0f76693f4 100644
--- a/cmd/k8s-operator/metrics_resources.go
+++ b/cmd/k8s-operator/metrics_resources.go
@@ -19,6 +19,7 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
+	kube "tailscale.com/k8s-operator"
 	tsapi "tailscale.com/k8s-operator/apis/v1alpha1"
 	"tailscale.com/kube/kubetypes"
 )
@@ -54,7 +55,7 @@ type ServiceMonitorSpec struct {
 	JobLabel string `json:"jobLabel"`
 	// NamespaceSelector selects the namespace of Service(s) that this ServiceMonitor allows to scrape.
 	// https://github.com/prometheus-operator/prometheus-operator/blob/bb4514e0d5d69f20270e29cfd4ad39b87865ccdf/pkg/apis/monitoring/v1/servicemonitor_types.go#L88
-	NamespaceSelector ServiceMonitorNamespaceSelector `json:"namespaceSelector,omitempty"`
+	NamespaceSelector ServiceMonitorNamespaceSelector `json:"namespaceSelector"`
 	// Selector is the label selector for Service(s) that this ServiceMonitor allows to scrape.
 	// https://github.com/prometheus-operator/prometheus-operator/blob/bb4514e0d5d69f20270e29cfd4ad39b87865ccdf/pkg/apis/monitoring/v1/servicemonitor_types.go#L85
 	Selector metav1.LabelSelector `json:"selector"`
@@ -227,13 +228,13 @@ func metricsResourceLabels(opts *metricsOpts) map[string]string {
 		kubetypes.LabelManaged:   "true",
 		labelMetricsTarget:       opts.proxyStsName,
 		labelPromProxyType:       opts.proxyType,
-		labelPromProxyParentName: opts.proxyLabels[LabelParentName],
+		labelPromProxyParentName: kube.TruncateLabelValue(opts.proxyLabels[LabelParentName]),
 	}
 	// Include namespace label for proxies created for a namespaced type.
 	if isNamespacedProxyType(opts.proxyType) {
-		lbls[labelPromProxyParentNamespace] = opts.proxyLabels[LabelParentNamespace]
+		lbls[labelPromProxyParentNamespace] = kube.TruncateLabelValue(opts.proxyLabels[LabelParentNamespace])
 	}
-	lbls[labelPromJob] = promJobName(opts)
+	lbls[labelPromJob] = kube.TruncateLabelValue(promJobName(opts))
 	return lbls
 }
 
@@ -250,11 +251,11 @@ func promJobName(opts *metricsOpts) string {
 func metricsSvcSelector(proxyLabels map[string]string, proxyType string) map[string]string {
 	sel := map[string]string{
 		labelPromProxyType:       proxyType,
-		labelPromProxyParentName: proxyLabels[LabelParentName],
+		labelPromProxyParentName: kube.TruncateLabelValue(proxyLabels[LabelParentName]),
 	}
 	// Include namespace label for proxies created for a namespaced type.
 	if isNamespacedProxyType(proxyType) {
-		sel[labelPromProxyParentNamespace] = proxyLabels[LabelParentNamespace]
+		sel[labelPromProxyParentNamespace] = kube.TruncateLabelValue(proxyLabels[LabelParentNamespace])
 	}
 	return sel
 }
diff --git a/cmd/k8s-operator/nameserver.go b/cmd/k8s-operator/nameserver.go
index 869e5bb26..f5565e5d3 100644
--- a/cmd/k8s-operator/nameserver.go
+++ b/cmd/k8s-operator/nameserver.go
@@ -190,6 +190,8 @@ func (a *NameserverReconciler) maybeProvision(ctx context.Context, tsDNSCfg *tsa
 	}
 	if tsDNSCfg.Spec.Nameserver.Pod != nil {
 		dCfg.tolerations = tsDNSCfg.Spec.Nameserver.Pod.Tolerations
+		dCfg.affinity = tsDNSCfg.Spec.Nameserver.Pod.Affinity
+		dCfg.nodeSelector = tsDNSCfg.Spec.Nameserver.Pod.NodeSelector
 	}
 
 	for _, deployable := range []deployable{saDeployable, deployDeployable, svcDeployable, cmDeployable} {
@@ -217,14 +219,16 @@ type deployable struct {
 }
 
 type deployConfig struct {
-	replicas    int32
-	imageRepo   string
-	imageTag    string
-	labels      map[string]string
-	ownerRefs   []metav1.OwnerReference
-	namespace   string
-	clusterIP   string
-	tolerations []corev1.Toleration
+	replicas     int32
+	imageRepo    string
+	imageTag     string
+	labels       map[string]string
+	ownerRefs    []metav1.OwnerReference
+	namespace    string
+	clusterIP    string
+	tolerations  []corev1.Toleration
+	affinity     *corev1.Affinity
+	nodeSelector map[string]string
 }
 
 var (
@@ -250,6 +254,8 @@ var (
 			d.ObjectMeta.Labels = cfg.labels
 			d.ObjectMeta.OwnerReferences = cfg.ownerRefs
 			d.Spec.Template.Spec.Tolerations = cfg.tolerations
+			d.Spec.Template.Spec.Affinity = cfg.affinity
+			d.Spec.Template.Spec.NodeSelector = cfg.nodeSelector
 			updateF := func(oldD *appsv1.Deployment) {
 				oldD.Spec = d.Spec
 			}
diff --git a/cmd/k8s-operator/nameserver_test.go b/cmd/k8s-operator/nameserver_test.go
index e35c72fc0..3ec00d5ed 100644
--- a/cmd/k8s-operator/nameserver_test.go
+++ b/cmd/k8s-operator/nameserver_test.go
@@ -43,6 +43,9 @@ func TestNameserverReconciler(t *testing.T) {
 					ClusterIP: "5.4.3.2",
 				},
 				Pod: &tsapi.NameserverPod{
+					NodeSelector: map[string]string{
+						"foo": "bar",
+					},
 					Tolerations: []corev1.Toleration{
 						{
 							Key:      "some-key",
@@ -51,6 +54,23 @@ func TestNameserverReconciler(t *testing.T) {
 							Effect:   corev1.TaintEffectNoSchedule,
 						},
 					},
+					Affinity: &corev1.Affinity{
+						NodeAffinity: &corev1.NodeAffinity{
+							RequiredDuringSchedulingIgnoredDuringExecution: &corev1.NodeSelector{
+								NodeSelectorTerms: []corev1.NodeSelectorTerm{
+									{
+										MatchExpressions: []corev1.NodeSelectorRequirement{
+											{
+												Key:      "some-key",
+												Operator: corev1.NodeSelectorOpIn,
+												Values:   []string{"some-value"},
+											},
+										},
+									},
+								},
+							},
+						},
+					},
 				},
 			},
 		},
@@ -97,6 +117,26 @@ func TestNameserverReconciler(t *testing.T) {
 				Effect:   corev1.TaintEffectNoSchedule,
 			},
 		}
+		wantsDeploy.Spec.Template.Spec.Affinity = &corev1.Affinity{
+			NodeAffinity: &corev1.NodeAffinity{
+				RequiredDuringSchedulingIgnoredDuringExecution: &corev1.NodeSelector{
+					NodeSelectorTerms: []corev1.NodeSelectorTerm{
+						{
+							MatchExpressions: []corev1.NodeSelectorRequirement{
+								{
+									Key:      "some-key",
+									Operator: corev1.NodeSelectorOpIn,
+									Values:   []string{"some-value"},
+								},
+							},
+						},
+					},
+				},
+			},
+		}
+		wantsDeploy.Spec.Template.Spec.NodeSelector = map[string]string{
+			"foo": "bar",
+		}
 
 		expectEqual(t, fc, wantsDeploy)
 	})
diff --git a/cmd/k8s-operator/operator.go b/cmd/k8s-operator/operator.go
index c0ef96a68..1663046f4 100644
--- a/cmd/k8s-operator/operator.go
+++ b/cmd/k8s-operator/operator.go
@@ -55,6 +55,7 @@ import (
 	"tailscale.com/ipn/store/kubestore"
 	apiproxy "tailscale.com/k8s-operator/api-proxy"
 	tsapi "tailscale.com/k8s-operator/apis/v1alpha1"
+	"tailscale.com/k8s-operator/reconciler/peerrelay"
 	"tailscale.com/k8s-operator/reconciler/proxygrouppolicy"
 	"tailscale.com/k8s-operator/reconciler/tailnet"
 	"tailscale.com/k8s-operator/tsclient"
@@ -95,8 +96,10 @@ func main() {
 		tsFirewallMode        = defaultEnv("PROXY_FIREWALL_MODE", "")
 		defaultProxyClass     = defaultEnv("PROXY_DEFAULT_CLASS", "")
 		isDefaultLoadBalancer = defaultBool("OPERATOR_DEFAULT_LOAD_BALANCER", false)
+		sharedACMEAccountKey  = defaultBool("OPERATOR_SHARED_ACME_ACCOUNT_KEY", false)
 		loginServer           = strings.TrimSuffix(defaultEnv("OPERATOR_LOGIN_SERVER", ""), "/")
 		ingressClassName      = defaultEnv("OPERATOR_INGRESS_CLASS_NAME", "tailscale")
+		operatorSAName        = defaultEnv("OPERATOR_SERVICE_ACCOUNT_NAME", "operator")
 	)
 
 	var opts []kzap.Opts
@@ -157,6 +160,7 @@ func main() {
 		tsServer:                      s,
 		tsClient:                      tsc,
 		tailscaleNamespace:            tsNamespace,
+		operatorSAName:                operatorSAName,
 		restConfig:                    restConfig,
 		proxyImage:                    image,
 		k8sProxyImage:                 k8sProxyImage,
@@ -167,6 +171,7 @@ func main() {
 		defaultProxyClass:             defaultProxyClass,
 		loginServer:                   loginServer,
 		ingressClassName:              ingressClassName,
+		sharedACMEAccountKey:          sharedACMEAccountKey,
 	})
 }
 
@@ -349,6 +354,7 @@ func runReconcilers(opts reconcilerOpts) {
 	tailnetOptions := tailnet.ReconcilerOptions{
 		Client:             mgr.GetClient(),
 		TailscaleNamespace: opts.tailscaleNamespace,
+		OperatorSAName:     opts.operatorSAName,
 		Clock:              tstime.DefaultClock{},
 		Logger:             opts.log,
 		Registry:           clients,
@@ -366,6 +372,19 @@ func runReconcilers(opts reconcilerOpts) {
 		startlog.Fatalf("could not register proxygrouppolicy reconciler: %v", err)
 	}
 
+	peerRelayOptions := peerrelay.ReconcilerOptions{
+		Client:             mgr.GetClient(),
+		TailscaleNamespace: opts.tailscaleNamespace,
+		ProxyImage:         opts.proxyImage,
+		DefaultTags:        strings.Split(opts.proxyTags, ","),
+		Clients:            clients,
+		Logger:             opts.log,
+	}
+
+	if err = peerrelay.NewReconciler(peerRelayOptions).Register(mgr); err != nil {
+		startlog.Fatalf("could not register peerrelay reconciler: %v", err)
+	}
+
 	svcFilter := handler.EnqueueRequestsFromMapFunc(serviceHandler)
 	svcChildFilter := handler.EnqueueRequestsFromMapFunc(managedResourceHandlerForType("svc"))
 	// If a ProxyClass changes, enqueue all Services labeled with that
@@ -692,12 +711,14 @@ func runReconcilers(opts reconcilerOpts) {
 		Watches(&rbacv1.Role{}, recorderFilter).
 		Watches(&rbacv1.RoleBinding{}, recorderFilter).
 		Complete(&RecorderReconciler{
-			recorder:    eventRecorder,
-			tsNamespace: opts.tailscaleNamespace,
-			Client:      mgr.GetClient(),
-			log:         opts.log.Named("recorder-reconciler"),
-			clock:       tstime.DefaultClock{},
-			clients:     clients,
+			recorder:          eventRecorder,
+			tsNamespace:       opts.tailscaleNamespace,
+			Client:            mgr.GetClient(),
+			log:               opts.log.Named("recorder-reconciler"),
+			clock:             tstime.DefaultClock{},
+			clients:           clients,
+			authKeyRateLimits: make(map[string]*rate.Limiter),
+			authKeyReissuing:  make(map[string]bool),
 		})
 	if err != nil {
 		startlog.Fatalf("could not create Recorder reconciler: %v", err)
@@ -733,6 +754,7 @@ func runReconcilers(opts reconcilerOpts) {
 	proxyClassFilterForProxyGroup := handler.EnqueueRequestsFromMapFunc(proxyClassHandlerForProxyGroup(mgr.GetClient(), startlog))
 	nodeFilterForProxyGroup := handler.EnqueueRequestsFromMapFunc(nodeHandlerForProxyGroup(mgr.GetClient(), opts.defaultProxyClass, startlog))
 	saFilterForProxyGroup := handler.EnqueueRequestsFromMapFunc(serviceAccountHandlerForProxyGroup(mgr.GetClient(), startlog))
+	acmeSecretFilterForProxyGroup := handler.EnqueueRequestsFromMapFunc(acmeAccountsSecretHandlerForProxyGroup(mgr.GetClient(), opts.tailscaleNamespace, opts.sharedACMEAccountKey, startlog))
 	err = builder.ControllerManagedBy(mgr).
 		For(&tsapi.ProxyGroup{}).
 		Named("proxygroup-reconciler").
@@ -741,6 +763,9 @@ func runReconcilers(opts reconcilerOpts) {
 		Watches(&corev1.ConfigMap{}, ownedByProxyGroupFilter).
 		Watches(&corev1.ServiceAccount{}, saFilterForProxyGroup).
 		Watches(&corev1.Secret{}, ownedByProxyGroupFilter).
+		// The shared ACME accounts Secret has no ProxyGroup owner ref, so
+		// watch it by name to react to its deletion/recreation.
+		Watches(&corev1.Secret{}, acmeSecretFilterForProxyGroup).
 		Watches(&rbacv1.Role{}, ownedByProxyGroupFilter).
 		Watches(&rbacv1.RoleBinding{}, ownedByProxyGroupFilter).
 		Watches(&tsapi.ProxyClass{}, proxyClassFilterForProxyGroup).
@@ -761,6 +786,8 @@ func runReconcilers(opts reconcilerOpts) {
 			loginServer:       opts.tsServer.ControlURL,
 			authKeyRateLimits: make(map[string]*rate.Limiter),
 			authKeyReissuing:  make(map[string]bool),
+
+			sharedACMEAccountKey: opts.sharedACMEAccountKey,
 		})
 	if err != nil {
 		startlog.Fatalf("could not create ProxyGroup reconciler: %v", err)
@@ -816,6 +843,17 @@ type reconcilerOpts struct {
 	// ingressClassName is the name of the ingress class used by reconcilers of Ingress resources. This defaults
 	// to "tailscale" but can be customised.
 	ingressClassName string
+	// sharedACMEAccountKey is the operator-wide default for the
+	// shared-ACME-account feature. When true, every ProxyGroup uses the
+	// shared per-tailnet account key unless the ProxyGroup explicitly
+	// opts out via tailscale.com/share-acme-account=false. When false,
+	// ProxyGroups opt in individually via
+	// tailscale.com/share-acme-account=true.
+	sharedACMEAccountKey bool
+	// operatorSAName is the name of the ServiceAccount that the operator pod runs as. It is used as the target
+	// ServiceAccount when minting tokens via the Kubernetes TokenRequest API for Tailnets that authenticate using
+	// workload identity federation.
+	operatorSAName string
 }
 
 // enqueueAllIngressEgressProxySvcsinNS returns a reconcile request for each
@@ -1207,6 +1245,30 @@ func serviceAccountHandlerForProxyGroup(cl client.Client, logger *zap.SugaredLog
 	}
 }
 
+// acmeAccountsSecretHandlerForProxyGroup enqueues ProxyGroups that use the
+// shared ACME account when the shared ACME accounts Secret changes. The
+// Secret carries no owner reference, so the owner-based Secret watch never
+// matches it.
+func acmeAccountsSecretHandlerForProxyGroup(cl client.Client, tsNamespace string, sharedACMEAccountDefault bool, logger *zap.SugaredLogger) handler.MapFunc {
+	return func(ctx context.Context, o client.Object) []reconcile.Request {
+		if o.GetName() != kubetypes.ACMEAccountsSecretName || o.GetNamespace() != tsNamespace {
+			return nil
+		}
+		pgList := new(tsapi.ProxyGroupList)
+		if err := cl.List(ctx, pgList); err != nil {
+			logger.Debugf("error listing ProxyGroups for shared ACME accounts Secret: %v", err)
+			return nil
+		}
+		reqs := make([]reconcile.Request, 0, len(pgList.Items))
+		for _, pg := range pgList.Items {
+			if sharedACMEAccountEnabled(&pg, sharedACMEAccountDefault) {
+				reqs = append(reqs, reconcile.Request{NamespacedName: client.ObjectKeyFromObject(&pg)})
+			}
+		}
+		return reqs
+	}
+}
+
 // serviceHandlerForIngress returns a handler for Service events for ingress
 // reconciler that ensures that if the Service associated with an event is of
 // interest to the reconciler, the associated Ingress(es) gets be reconciled.
@@ -1468,9 +1530,10 @@ func HAIngressesFromSecret(cl client.Client, logger *zap.SugaredLogger) handler.
 	return func(ctx context.Context, o client.Object) []reconcile.Request {
 		secret, ok := o.(*corev1.Secret)
 		if !ok {
-			logger.Infof("[unexpected] Secret handler triggered for an object that is not a Secret")
+			logger.Warn("Secret handler triggered for an object that is not a Secret")
 			return nil
 		}
+
 		if isTLSSecret(secret) {
 			return []reconcile.Request{
 				{
@@ -1507,15 +1570,16 @@ func HAIngressesFromSecret(cl client.Client, logger *zap.SugaredLogger) handler.
 	}
 }
 
-// HAServiceFromSecret returns a handler that returns reconcile requests for
+// HAServicesFromSecret returns a handler that returns reconcile requests for
 // all HA Services that should be reconciled in response to a Secret event.
 func HAServicesFromSecret(cl client.Client, logger *zap.SugaredLogger) handler.MapFunc {
 	return func(ctx context.Context, o client.Object) []reconcile.Request {
 		secret, ok := o.(*corev1.Secret)
 		if !ok {
-			logger.Infof("[unexpected] Secret handler triggered for an object that is not a Secret")
+			logger.Warn("Secret handler triggered for an object that is not a Secret")
 			return nil
 		}
+
 		if !isPGStateSecret(secret) {
 			return nil
 		}
@@ -1547,9 +1611,10 @@ func kubeAPIServerPGsFromSecret(cl client.Client, logger *zap.SugaredLogger) han
 	return func(ctx context.Context, o client.Object) []reconcile.Request {
 		secret, ok := o.(*corev1.Secret)
 		if !ok {
-			logger.Infof("[unexpected] Secret handler triggered for an object that is not a Secret")
+			logger.Warn("Secret handler triggered for an object that is not a Secret")
 			return nil
 		}
+
 		if secret.ObjectMeta.Labels[kubetypes.LabelManaged] != "true" ||
 			secret.ObjectMeta.Labels[LabelParentType] != "proxygroup" {
 			return nil
@@ -1585,9 +1650,10 @@ func egressSvcsFromEgressProxyGroup(cl client.Client, logger *zap.SugaredLogger)
 	return func(ctx context.Context, o client.Object) []reconcile.Request {
 		pg, ok := o.(*tsapi.ProxyGroup)
 		if !ok {
-			logger.Infof("[unexpected] ProxyGroup handler triggered for an object that is not a ProxyGroup")
+			logger.Warn("ProxyGroup handler triggered for an object that is not a ProxyGroup")
 			return nil
 		}
+
 		if pg.Spec.Type != tsapi.ProxyGroupTypeEgress {
 			return nil
 		}
@@ -1615,9 +1681,10 @@ func ingressesFromIngressProxyGroup(cl client.Client, logger *zap.SugaredLogger)
 	return func(ctx context.Context, o client.Object) []reconcile.Request {
 		pg, ok := o.(*tsapi.ProxyGroup)
 		if !ok {
-			logger.Infof("[unexpected] ProxyGroup handler triggered for an object that is not a ProxyGroup")
+			logger.Warn("ProxyGroup handler triggered for an object that is not a ProxyGroup")
 			return nil
 		}
+
 		if pg.Spec.Type != tsapi.ProxyGroupTypeIngress {
 			return nil
 		}
@@ -1645,9 +1712,10 @@ func epsFromExternalNameService(cl client.Client, logger *zap.SugaredLogger, ns
 	return func(ctx context.Context, o client.Object) []reconcile.Request {
 		svc, ok := o.(*corev1.Service)
 		if !ok {
-			logger.Infof("[unexpected] Service handler triggered for an object that is not a Service")
+			logger.Warn("Service handler triggered for an object that is not a Service")
 			return nil
 		}
+
 		if !isEgressSvcForProxyGroup(svc) {
 			return nil
 		}
@@ -1674,9 +1742,10 @@ func podsFromEgressEps(cl client.Client, logger *zap.SugaredLogger, ns string) h
 	return func(ctx context.Context, o client.Object) []reconcile.Request {
 		eps, ok := o.(*discoveryv1.EndpointSlice)
 		if !ok {
-			logger.Infof("[unexpected] EndpointSlice handler triggered for an object that is not a EndpointSlice")
+			logger.Warn("EndpointSlice handler triggered for an object that is not a EndpointSlice")
 			return nil
 		}
+
 		if eps.Labels[labelProxyGroup] == "" {
 			return nil
 		}
@@ -1713,18 +1782,21 @@ func proxyClassesWithServiceMonitor(cl client.Client, logger *zap.SugaredLogger)
 	return func(ctx context.Context, o client.Object) []reconcile.Request {
 		crd, ok := o.(*apiextensionsv1.CustomResourceDefinition)
 		if !ok {
-			logger.Debugf("[unexpected] ServiceMonitor CRD handler received an object that is not a CustomResourceDefinition")
+			logger.Warn("ServiceMonitor CRD handler received an object that is not a CustomResourceDefinition")
 			return nil
 		}
+
 		if crd.Name != serviceMonitorCRD {
-			logger.Debugf("[unexpected] ServiceMonitor CRD handler received an unexpected CRD %q", crd.Name)
+			logger.Warnf("ServiceMonitor CRD handler received an unexpected CRD %q", crd.Name)
 			return nil
 		}
+
 		pcl := &tsapi.ProxyClassList{}
 		if err := cl.List(ctx, pcl); err != nil {
-			logger.Debugf("[unexpected] error listing ProxyClasses: %v", err)
+			logger.Errorf("failed to list ProxyClass resources: %v", err)
 			return nil
 		}
+
 		reqs := make([]reconcile.Request, 0)
 		for _, pc := range pcl.Items {
 			if pc.Spec.Metrics != nil && pc.Spec.Metrics.ServiceMonitor != nil && pc.Spec.Metrics.ServiceMonitor.Enable {
@@ -1733,6 +1805,7 @@ func proxyClassesWithServiceMonitor(cl client.Client, logger *zap.SugaredLogger)
 				})
 			}
 		}
+
 		return reqs
 	}
 }
@@ -1742,9 +1815,10 @@ func crdTransformer(log *zap.SugaredLogger) toolscache.TransformFunc {
 	return func(o any) (any, error) {
 		crd, ok := o.(*apiextensionsv1.CustomResourceDefinition)
 		if !ok {
-			log.Infof("[unexpected] CRD transformer called for a non-CRD type")
+			log.Warn("CRD transformer called for a non-CRD type")
 			return crd, nil
 		}
+
 		crd.Spec = apiextensionsv1.CustomResourceDefinitionSpec{}
 		return crd, nil
 	}
diff --git a/cmd/k8s-operator/proxyclass.go b/cmd/k8s-operator/proxyclass.go
index c0ea46116..1484cf448 100644
--- a/cmd/k8s-operator/proxyclass.go
+++ b/cmd/k8s-operator/proxyclass.go
@@ -26,6 +26,7 @@ import (
 	"k8s.io/client-go/tools/record"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+
 	tsoperator "tailscale.com/k8s-operator"
 	tsapi "tailscale.com/k8s-operator/apis/v1alpha1"
 	"tailscale.com/tstime"
@@ -170,10 +171,11 @@ func (pcr *ProxyClassReconciler) validate(ctx context.Context, pc *tsapi.ProxyCl
 			}
 		}
 	}
+
 	if pc.Spec.Metrics != nil && pc.Spec.Metrics.ServiceMonitor != nil && pc.Spec.Metrics.ServiceMonitor.Enable {
 		found, err := hasServiceMonitorCRD(ctx, pcr.Client)
 		if err != nil {
-			pcr.logger.Infof("[unexpected]: error retrieving %q CRD: %v", serviceMonitorCRD, err)
+			pcr.logger.Errorf("error retrieving %q CRD: %v", serviceMonitorCRD, err)
 			// best effort validation - don't error out here
 		} else if !found {
 			msg := fmt.Sprintf("ProxyClass defines that a ServiceMonitor custom resource should be created, but %q CRD was not found", serviceMonitorCRD)
diff --git a/cmd/k8s-operator/proxygroup.go b/cmd/k8s-operator/proxygroup.go
index 4bd015701..b4955d7af 100644
--- a/cmd/k8s-operator/proxygroup.go
+++ b/cmd/k8s-operator/proxygroup.go
@@ -56,6 +56,7 @@ const (
 	reasonProxyGroupCreating           = "ProxyGroupCreating"
 	reasonProxyGroupInvalid            = "ProxyGroupInvalid"
 	reasonProxyGroupTailnetUnavailable = "ProxyGroupTailnetUnavailable"
+	reasonACMEAccountsPendingDeletion  = "ACMEAccountsPendingDeletion"
 
 	// Copied from k8s.io/apiserver/pkg/registry/generic/registry/store.go@cccad306d649184bf2a0e319ba830c53f65c445c
 	optimisticLockErrorMsg  = "the object has been modified; please apply your changes to the latest version and try again"
@@ -102,6 +103,14 @@ type ProxyGroupReconciler struct {
 	apiServerProxyGroups set.Slice[types.UID]     // for kube-apiserver proxygroups gauge
 	authKeyRateLimits    map[string]*rate.Limiter // per-ProxyGroup rate limiters for auth key re-issuance.
 	authKeyReissuing     map[string]bool
+
+	// sharedACMEAccountKey is the operator-wide default for the
+	// shared-ACME-account feature. When true, every ProxyGroup uses the
+	// shared per-tailnet account key unless the ProxyGroup explicitly
+	// opts out via tailscale.com/share-acme-account=false. When false,
+	// only ProxyGroups annotated with tailscale.com/share-acme-account=true
+	// use it.
+	sharedACMEAccountKey bool
 }
 
 func (r *ProxyGroupReconciler) logger(name string) *zap.SugaredLogger {
@@ -354,7 +363,7 @@ func (r *ProxyGroupReconciler) maybeProvision(ctx context.Context, tsClient tscl
 		}
 	}
 
-	role := pgRole(pg, r.tsNamespace)
+	role := pgRole(pg, r.tsNamespace, r.sharedACMEAccountEnabledFor(pg))
 	if _, err := createOrUpdate(ctx, r.Client, r.tsNamespace, role, func(r *rbacv1.Role) {
 		r.ObjectMeta.Labels = role.ObjectMeta.Labels
 		r.ObjectMeta.Annotations = role.ObjectMeta.Annotations
@@ -394,13 +403,36 @@ func (r *ProxyGroupReconciler) maybeProvision(ctx context.Context, tsClient tscl
 		}); err != nil {
 			return r.notReadyErrf(pg, logger, "error provisioning ingress ConfigMap %q: %w", cm.Name, err)
 		}
+
+		// Ensure the shared ACME accounts Secret exists (with finalizer)
+		// when this ProxyGroup opts into the feature. Proxy pods
+		// populate its fields on first cert issuance. See #18251.
+		if r.sharedACMEAccountEnabledFor(pg) {
+			acmeSecret := pgACMEAccountSecret(r.tsNamespace)
+			if _, err := createOrUpdate(ctx, r.Client, r.tsNamespace, acmeSecret, func(existing *corev1.Secret) {
+				if !existing.DeletionTimestamp.IsZero() {
+					// Deletion can't be undone; warn so the account keys
+					// get backed up before the finalizer is removed.
+					msg := fmt.Sprintf("shared ACME accounts Secret %q is marked for deletion but retained by the %q finalizer. Its data remains readable until the finalizer is removed - back it up first to preserve the ACME account keys.", existing.Name, kubetypes.ACMEAccountsFinalizer)
+					r.recorder.Event(existing, corev1.EventTypeWarning, reasonACMEAccountsPendingDeletion, msg)
+					logger.Warn(msg)
+					return
+				}
+				existing.Labels = acmeSecret.Labels
+				if !slices.Contains(existing.Finalizers, kubetypes.ACMEAccountsFinalizer) {
+					existing.Finalizers = append(existing.Finalizers, kubetypes.ACMEAccountsFinalizer)
+				}
+			}); err != nil {
+				return r.notReadyErrf(pg, logger, "error provisioning shared ACME accounts Secret %q: %w", acmeSecret.Name, err)
+			}
+		}
 	}
 
 	defaultImage := r.tsProxyImage
 	if pg.Spec.Type == tsapi.ProxyGroupTypeKubernetesAPIServer {
 		defaultImage = r.k8sProxyImage
 	}
-	ss, err := pgStatefulSet(pg, r.tsNamespace, defaultImage, r.tsFirewallMode, tailscaledPort, proxyClass)
+	ss, err := pgStatefulSet(pg, r.tsNamespace, defaultImage, r.tsFirewallMode, tailscaledPort, proxyClass, r.sharedACMEAccountEnabledFor(pg))
 	if err != nil {
 		return r.notReadyErrf(pg, logger, "error generating StatefulSet spec: %w", err)
 	}
@@ -1104,9 +1136,35 @@ func (r *ProxyGroupReconciler) findStaticEndpoints(ctx context.Context, existing
 		return nil, &FindStaticEndpointErr{msg: fmt.Sprintf("failed to find any `status.addresses` of type %q on nodes using configured Selectors on `spec.staticEndpoints.nodePort.selectors` for ProxyClass %q", corev1.NodeExternalIP, proxyClass.Name)}
 	}
 
+	// If we ended up selecting the same set of addresses already in use, keep
+	// the existing order. nodes.Items from r.List is not guaranteed to be in
+	// a stable order across calls, so without this the slice can permute on
+	// each reconcile, making the marshalled config Secret differ byte-for-byte
+	// even though nothing has effectively changed. That trips the DeepEqual
+	// check on the config Secret, which writes the Secret, which fires a
+	// watch event, which re-enqueues the ProxyGroup, and so on.
+	if len(currAddrs) > 0 && sameAddrPortSet(endpoints, currAddrs) {
+		return currAddrs, nil
+	}
+
 	return endpoints, nil
 }
 
+// sameAddrPortSet reports whether a and b contain the same AddrPorts,
+// ignoring order. Both slices are assumed to be free of duplicates, which
+// holds for callers in this package.
+func sameAddrPortSet(a, b []netip.AddrPort) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for _, x := range a {
+		if !slices.Contains(b, x) {
+			return false
+		}
+	}
+	return true
+}
+
 func getStaticEndpointAddress(a *corev1.NodeAddress, port uint16) *netip.AddrPort {
 	addr, err := netip.ParseAddr(a.Address)
 	if err != nil {
@@ -1160,6 +1218,9 @@ func (r *ProxyGroupReconciler) ensureStateRemovedForProxyGroup(pg *tsapi.ProxyGr
 	gaugeIngressProxyGroupResources.Set(int64(r.ingressProxyGroups.Len()))
 	gaugeAPIServerProxyGroupResources.Set(int64(r.apiServerProxyGroups.Len()))
 	delete(r.authKeyRateLimits, pg.Name)
+	for i := range pgReplicas(pg) {
+		delete(r.authKeyReissuing, pgStateSecretName(pg.Name, i))
+	}
 }
 
 func pgTailscaledConfig(pg *tsapi.ProxyGroup, loginServer string, pc *tsapi.ProxyClass, idx int32, authKey *string, staticEndpoints []netip.AddrPort, oldAdvertiseServices []string) (tailscaledConfigs, error) {
@@ -1318,6 +1379,25 @@ func notReady(reason, msg string) (map[string][]netip.AddrPort, *notReadyReason,
 	}, nil
 }
 
+// sharedACMEAccountEnabledFor reports whether the shared-ACME-account
+// feature should be applied to pg. The per-PG
+// tailscale.com/share-acme-account annotation wins when set; otherwise
+// the operator's OPERATOR_SHARED_ACME_ACCOUNT_KEY setting is the default
+// for every ProxyGroup.
+func (r *ProxyGroupReconciler) sharedACMEAccountEnabledFor(pg *tsapi.ProxyGroup) bool {
+	return sharedACMEAccountEnabled(pg, r.sharedACMEAccountKey)
+}
+
+// sharedACMEAccountEnabled reports whether pg should use the shared ACME
+// account, with the tailscale.com/share-acme-account annotation overriding
+// the operator-wide default.
+func sharedACMEAccountEnabled(pg *tsapi.ProxyGroup, operatorDefault bool) bool {
+	if v, ok := pg.Annotations[AnnotationShareACMEAccount]; ok {
+		return v == "true"
+	}
+	return operatorDefault
+}
+
 func (r *ProxyGroupReconciler) notReadyErrf(pg *tsapi.ProxyGroup, logger *zap.SugaredLogger, format string, a ...any) (map[string][]netip.AddrPort, *notReadyReason, error) {
 	err := fmt.Errorf(format, a...)
 	if strings.Contains(err.Error(), optimisticLockErrorMsg) {
diff --git a/cmd/k8s-operator/proxygroup_specs.go b/cmd/k8s-operator/proxygroup_specs.go
index 60b4bddd5..fc9b532b5 100644
--- a/cmd/k8s-operator/proxygroup_specs.go
+++ b/cmd/k8s-operator/proxygroup_specs.go
@@ -19,6 +19,7 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/intstr"
 	"sigs.k8s.io/yaml"
+
 	tsapi "tailscale.com/k8s-operator/apis/v1alpha1"
 	"tailscale.com/kube/egressservices"
 	"tailscale.com/kube/ingressservices"
@@ -63,8 +64,12 @@ func pgNodePortService(pg *tsapi.ProxyGroup, name string, namespace string) *cor
 }
 
 // Returns the base StatefulSet definition for a ProxyGroup. A ProxyClass may be
-// applied over the top after.
-func pgStatefulSet(pg *tsapi.ProxyGroup, namespace, image, tsFirewallMode string, port *uint16, proxyClass *tsapi.ProxyClass) (*appsv1.StatefulSet, error) {
+// applied over the top after. shareACMEAccount, when true, injects the env
+// vars that route the pod's ACME account key to the shared per-tailnet
+// Secret and drops TS_DEBUG_ACME_FORCE_RENEWAL so ARI-based renewals are
+// attempted; the caller is responsible for checking the operator setting
+// and the PG opt-in annotation.
+func pgStatefulSet(pg *tsapi.ProxyGroup, namespace, image, tsFirewallMode string, port *uint16, proxyClass *tsapi.ProxyClass, shareACMEAccount bool) (*appsv1.StatefulSet, error) {
 	if pg.Spec.Type == tsapi.ProxyGroupTypeKubernetesAPIServer {
 		return kubeAPIServerStatefulSet(pg, namespace, image, port)
 	}
@@ -74,10 +79,10 @@ func pgStatefulSet(pg *tsapi.ProxyGroup, namespace, image, tsFirewallMode string
 	}
 	// Validate some base assumptions.
 	if len(ss.Spec.Template.Spec.InitContainers) != 1 {
-		return nil, fmt.Errorf("[unexpected] base proxy config had %d init containers instead of 1", len(ss.Spec.Template.Spec.InitContainers))
+		return nil, fmt.Errorf("base proxy config had %d init containers instead of 1", len(ss.Spec.Template.Spec.InitContainers))
 	}
 	if len(ss.Spec.Template.Spec.Containers) != 1 {
-		return nil, fmt.Errorf("[unexpected] base proxy config had %d containers instead of 1", len(ss.Spec.Template.Spec.Containers))
+		return nil, fmt.Errorf("base proxy config had %d containers instead of 1", len(ss.Spec.Template.Spec.Containers))
 	}
 
 	// StatefulSet config.
@@ -186,14 +191,6 @@ func pgStatefulSet(pg *tsapi.ProxyGroup, namespace, image, tsFirewallMode string
 				Name:  "TS_EXPERIMENTAL_VERSIONED_CONFIG_DIR",
 				Value: "/etc/tsconfig/$(POD_NAME)",
 			},
-			{
-				// This ensures that cert renewals can succeed if ACME account
-				// keys have changed since issuance. We cannot guarantee or
-				// validate that the account key has not changed, see
-				// https://github.com/tailscale/tailscale/issues/18251
-				Name:  "TS_DEBUG_ACME_FORCE_RENEWAL",
-				Value: "true",
-			},
 		}
 
 		if port != nil {
@@ -251,6 +248,29 @@ func pgStatefulSet(pg *tsapi.ProxyGroup, namespace, image, tsFirewallMode string
 					Value: "true",
 				},
 			)
+			if shareACMEAccount {
+				envs = append(envs,
+					corev1.EnvVar{
+						Name:  "TS_ACME_ACCOUNT_SECRET_NAME",
+						Value: kubetypes.ACMEAccountsSecretName,
+					},
+					corev1.EnvVar{
+						Name:  "TS_ACME_ACCOUNT_FIELD",
+						Value: pgACMEAccountField(pg),
+					},
+				)
+			} else {
+				// Without a shared account key we cannot guarantee that
+				// the account key that issued the previous cert is the
+				// same one attempting renewal. Force plain new-order flow
+				// so renewals do not silently fail on rejected ARI
+				// "replaces" claims. See
+				// https://github.com/tailscale/tailscale/issues/18251.
+				envs = append(envs, corev1.EnvVar{
+					Name:  "TS_DEBUG_ACME_FORCE_RENEWAL",
+					Value: "true",
+				})
+			}
 		}
 		return append(c.Env, envs...)
 	}()
@@ -406,7 +426,7 @@ func pgServiceAccount(pg *tsapi.ProxyGroup, namespace string) *corev1.ServiceAcc
 	}
 }
 
-func pgRole(pg *tsapi.ProxyGroup, namespace string) *rbacv1.Role {
+func pgRole(pg *tsapi.ProxyGroup, namespace string, shareACMEAccount bool) *rbacv1.Role {
 	return &rbacv1.Role{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:            pg.Name,
@@ -438,6 +458,12 @@ func pgRole(pg *tsapi.ProxyGroup, namespace string) *rbacv1.Role {
 							pgPodName(pg.Name, i),          // State.
 						)
 					}
+					// Ingress ProxyGroup write replicas need access to the
+					// shared ACME account Secret so they can read the
+					// per-tailnet account key and write it on first use.
+					if pg.Spec.Type == tsapi.ProxyGroupTypeIngress && shareACMEAccount {
+						secrets = append(secrets, kubetypes.ACMEAccountsSecretName)
+					}
 					return secrets
 				}(),
 			},
@@ -476,6 +502,35 @@ func pgRoleBinding(pg *tsapi.ProxyGroup, namespace string) *rbacv1.RoleBinding {
 	}
 }
 
+// pgACMEAccountField returns the field name used inside the shared
+// tailscale-acme-accounts Secret for this ProxyGroup's tailnet. The blank
+// tailnet (operator-default credentials) is represented by a reserved
+// identifier so it gets a stable, unique field.
+func pgACMEAccountField(pg *tsapi.ProxyGroup) string {
+	tn := pg.Spec.Tailnet
+	if tn == "" {
+		tn = kubetypes.ACMEAccountDefaultKey
+	}
+	return tn + kubetypes.ACMEAccountKeySuffix
+}
+
+// pgACMEAccountSecret returns the shared per-tailnet ACME account key
+// Secret, keyed by tailnet inside its data. Not owned by any ProxyGroup
+// so it outlives ProxyGroup deletion.
+func pgACMEAccountSecret(namespace string) *corev1.Secret {
+	return &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      kubetypes.ACMEAccountsSecretName,
+			Namespace: namespace,
+			Labels: map[string]string{
+				kubetypes.LabelManaged: "true",
+			},
+			// Block accidental deletion.
+			Finalizers: []string{kubetypes.ACMEAccountsFinalizer},
+		},
+	}
+}
+
 // kube-apiserver proxies in auth mode use a static ServiceAccount. Everything
 // else uses a per-ProxyGroup ServiceAccount.
 func pgServiceAccountName(pg *tsapi.ProxyGroup) string {
diff --git a/cmd/k8s-operator/proxygroup_test.go b/cmd/k8s-operator/proxygroup_test.go
index 95eb7bd5f..ebd452559 100644
--- a/cmd/k8s-operator/proxygroup_test.go
+++ b/cmd/k8s-operator/proxygroup_test.go
@@ -811,6 +811,90 @@ func TestProxyGroupWithStaticEndpoints(t *testing.T) {
 	}
 }
 
+// TestFindStaticEndpointsStableOrder verifies that findStaticEndpoints returns
+// the existing endpoint order from the config Secret when the resulting set of
+// addresses is unchanged. nodes.Items from r.List is not order-stable across
+// calls, so without this guarantee the slice can permute on each reconcile,
+// triggering a spurious config Secret rewrite which fires a watch event that
+// re-enqueues the ProxyGroup, looping forever (issue #19700).
+func TestFindStaticEndpointsStableOrder(t *testing.T) {
+	const (
+		addrA = "10.0.0.1"
+		addrB = "10.0.0.2"
+		port  = uint16(30001)
+	)
+
+	pc := &tsapi.ProxyClass{
+		ObjectMeta: metav1.ObjectMeta{Name: "test-pc"},
+		Spec: tsapi.ProxyClassSpec{
+			StaticEndpoints: &tsapi.StaticEndpointsConfig{
+				NodePort: &tsapi.NodePortConfig{
+					Ports:    []tsapi.PortRange{{Port: port}},
+					Selector: map[string]string{"foo/bar": "baz"},
+				},
+			},
+		},
+	}
+
+	// Existing config Secret already pins the order [B, A]. The fake client
+	// lists nodes in name order ([node-a, node-b]) so without the stable-order
+	// guard findStaticEndpoints would return [A, B], differing from currAddrs
+	// and causing a spurious Secret rewrite.
+	currAddrs := []netip.AddrPort{
+		netip.MustParseAddrPort(addrB + ":30001"),
+		netip.MustParseAddrPort(addrA + ":30001"),
+	}
+	cfg := ipn.ConfigVAlpha{StaticEndpoints: currAddrs}
+	cfgJSON, err := json.Marshal(cfg)
+	if err != nil {
+		t.Fatalf("marshal config: %v", err)
+	}
+	existingSecret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{Name: "test-0-config", Namespace: tsNamespace},
+		Data:       map[string][]byte{tsoperator.TailscaledConfigFileName(106): cfgJSON},
+	}
+
+	nodes := []*corev1.Node{
+		{
+			ObjectMeta: metav1.ObjectMeta{Name: "node-a", Labels: map[string]string{"foo/bar": "baz"}},
+			Status: corev1.NodeStatus{Addresses: []corev1.NodeAddress{
+				{Type: corev1.NodeExternalIP, Address: addrA},
+			}},
+		},
+		{
+			ObjectMeta: metav1.ObjectMeta{Name: "node-b", Labels: map[string]string{"foo/bar": "baz"}},
+			Status: corev1.NodeStatus{Addresses: []corev1.NodeAddress{
+				{Type: corev1.NodeExternalIP, Address: addrB},
+			}},
+		},
+	}
+
+	fc := fake.NewClientBuilder().
+		WithScheme(tsapi.GlobalScheme).
+		WithObjects(pc, nodes[0], nodes[1], existingSecret).
+		Build()
+
+	zl, _ := zap.NewDevelopment()
+	r := &ProxyGroupReconciler{Client: fc}
+
+	got, err := r.findStaticEndpoints(t.Context(), existingSecret, pc, port, zl.Sugar())
+	if err != nil {
+		t.Fatalf("findStaticEndpoints: %v", err)
+	}
+	if !slices.Equal(got, currAddrs) {
+		t.Errorf("findStaticEndpoints returned %v, want %v (order must match currAddrs to avoid reconcile churn)", got, currAddrs)
+	}
+
+	// Repeat to confirm the result is stable across calls.
+	got2, err := r.findStaticEndpoints(t.Context(), existingSecret, pc, port, zl.Sugar())
+	if err != nil {
+		t.Fatalf("findStaticEndpoints (2nd call): %v", err)
+	}
+	if !slices.Equal(got, got2) {
+		t.Errorf("findStaticEndpoints not stable across calls: first=%v second=%v", got, got2)
+	}
+}
+
 func TestProxyGroup(t *testing.T) {
 	pc := &tsapi.ProxyClass{
 		ObjectMeta: metav1.ObjectMeta{
@@ -1052,14 +1136,15 @@ func TestProxyGroupTypes(t *testing.T) {
 
 	zl, _ := zap.NewDevelopment()
 	reconciler := &ProxyGroupReconciler{
-		tsNamespace:       tsNamespace,
-		tsProxyImage:      testProxyImage,
-		Client:            fc,
-		log:               zl.Sugar(),
-		clients:           tsclient.NewProvider(&fakeTSClient{}),
-		clock:             tstest.NewClock(tstest.ClockOpts{}),
-		authKeyRateLimits: make(map[string]*rate.Limiter),
-		authKeyReissuing:  make(map[string]bool),
+		tsNamespace:          tsNamespace,
+		tsProxyImage:         testProxyImage,
+		Client:               fc,
+		log:                  zl.Sugar(),
+		clients:              tsclient.NewProvider(&fakeTSClient{}),
+		clock:                tstest.NewClock(tstest.ClockOpts{}),
+		authKeyRateLimits:    make(map[string]*rate.Limiter),
+		authKeyReissuing:     make(map[string]bool),
+		sharedACMEAccountKey: true,
 	}
 
 	t.Run("egress_type", func(t *testing.T) {
@@ -1179,6 +1264,9 @@ func TestProxyGroupTypes(t *testing.T) {
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "test-ingress",
 				UID:  "test-ingress-uid",
+				Annotations: map[string]string{
+					AnnotationShareACMEAccount: "true",
+				},
 			},
 			Spec: tsapi.ProxyGroupSpec{
 				Type:     tsapi.ProxyGroupTypeIngress,
@@ -1199,6 +1287,44 @@ func TestProxyGroupTypes(t *testing.T) {
 		verifyEnvVar(t, sts, "TS_INTERNAL_APP", kubetypes.AppProxyGroupIngress)
 		verifyEnvVar(t, sts, "TS_SERVE_CONFIG", "/etc/proxies/serve-config.json")
 		verifyEnvVar(t, sts, "TS_EXPERIMENTAL_CERT_SHARE", "true")
+		verifyEnvVar(t, sts, "TS_ACME_ACCOUNT_SECRET_NAME", kubetypes.ACMEAccountsSecretName)
+		// pg.Spec.Tailnet is empty here so the default tailnet field is used.
+		verifyEnvVar(t, sts, "TS_ACME_ACCOUNT_FIELD", kubetypes.ACMEAccountDefaultKey+kubetypes.ACMEAccountKeySuffix)
+		// TS_DEBUG_ACME_FORCE_RENEWAL must NOT be set when the PG is
+		// opted in to the shared ACME account.
+		for _, e := range sts.Spec.Template.Spec.Containers[0].Env {
+			if e.Name == "TS_DEBUG_ACME_FORCE_RENEWAL" {
+				t.Errorf("TS_DEBUG_ACME_FORCE_RENEWAL must not be set on ingress ProxyGroup pods that share an ACME account")
+			}
+		}
+
+		// Verify the shared ACME accounts Secret exists and has the
+		// deletion finalizer (see tailscale/tailscale#18251).
+		acmeSecret := &corev1.Secret{}
+		if err := fc.Get(t.Context(), client.ObjectKey{Namespace: tsNamespace, Name: kubetypes.ACMEAccountsSecretName}, acmeSecret); err != nil {
+			t.Errorf("failed to get shared ACME accounts Secret: %v", err)
+		}
+		if !slices.Contains(acmeSecret.Finalizers, kubetypes.ACMEAccountsFinalizer) {
+			t.Errorf("shared ACME accounts Secret missing finalizer %q (got %v)", kubetypes.ACMEAccountsFinalizer, acmeSecret.Finalizers)
+		}
+
+		// Verify the per-ProxyGroup Role grants access to the shared
+		// ACME accounts Secret (write replicas need it to read/write the
+		// per-tailnet account key).
+		role := &rbacv1.Role{}
+		if err := fc.Get(t.Context(), client.ObjectKey{Namespace: tsNamespace, Name: pg.Name}, role); err != nil {
+			t.Fatalf("failed to get ProxyGroup Role: %v", err)
+		}
+		var sawACMEAccess bool
+		for _, rule := range role.Rules {
+			if slices.Contains(rule.Verbs, "patch") && slices.Contains(rule.ResourceNames, kubetypes.ACMEAccountsSecretName) {
+				sawACMEAccess = true
+				break
+			}
+		}
+		if !sawACMEAccess {
+			t.Errorf("ProxyGroup Role does not grant patch access to %q", kubetypes.ACMEAccountsSecretName)
+		}
 
 		// Verify ConfigMap volume mount
 		cmName := fmt.Sprintf("%s-ingress-config", pg.Name)
@@ -1228,6 +1354,60 @@ func TestProxyGroupTypes(t *testing.T) {
 		}
 	})
 
+	t.Run("ingress_type_shared_acme_opt_out", func(t *testing.T) {
+		// The reconciler has sharedACMEAccountKey=true, so ingress PGs
+		// default to shared. Explicit tailscale.com/share-acme-account=false
+		// must opt this PG out: no shared-Secret env vars, no Role
+		// access to the shared Secret, and TS_DEBUG_ACME_FORCE_RENEWAL
+		// must still be set so ARI "replaces" doesn't silently fail.
+		pg := &tsapi.ProxyGroup{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "test-ingress-optout",
+				UID:  "test-ingress-optout-uid",
+				Annotations: map[string]string{
+					AnnotationShareACMEAccount: "false",
+				},
+			},
+			Spec: tsapi.ProxyGroupSpec{
+				Type:     tsapi.ProxyGroupTypeIngress,
+				Replicas: new(int32(0)),
+			},
+		}
+		if err := fc.Create(t.Context(), pg); err != nil {
+			t.Fatal(err)
+		}
+		expectReconciled(t, reconciler, "", pg.Name)
+
+		sts := &appsv1.StatefulSet{}
+		if err := fc.Get(t.Context(), client.ObjectKey{Namespace: tsNamespace, Name: pg.Name}, sts); err != nil {
+			t.Fatalf("failed to get StatefulSet: %v", err)
+		}
+		for _, e := range sts.Spec.Template.Spec.Containers[0].Env {
+			switch e.Name {
+			case "TS_ACME_ACCOUNT_SECRET_NAME", "TS_ACME_ACCOUNT_FIELD":
+				t.Errorf("env %q unexpectedly present on opt-out PG", e.Name)
+			}
+		}
+		var sawForceRenewal bool
+		for _, e := range sts.Spec.Template.Spec.Containers[0].Env {
+			if e.Name == "TS_DEBUG_ACME_FORCE_RENEWAL" {
+				sawForceRenewal = true
+			}
+		}
+		if !sawForceRenewal {
+			t.Errorf("TS_DEBUG_ACME_FORCE_RENEWAL must be set on opt-out PG (avoids silent ARI \"replaces\" rejection)")
+		}
+		role := &rbacv1.Role{}
+		if err := fc.Get(t.Context(), client.ObjectKey{Namespace: tsNamespace, Name: pg.Name}, role); err != nil {
+			t.Fatalf("failed to get ProxyGroup Role: %v", err)
+		}
+		for _, rule := range role.Rules {
+			if slices.Contains(rule.ResourceNames, kubetypes.ACMEAccountsSecretName) {
+				t.Errorf("opt-out PG Role must not grant access to %q", kubetypes.ACMEAccountsSecretName)
+			}
+		}
+	})
+
 	t.Run("kubernetes_api_server_type", func(t *testing.T) {
 		pg := &tsapi.ProxyGroup{
 			ObjectMeta: metav1.ObjectMeta{
@@ -1247,7 +1427,7 @@ func TestProxyGroupTypes(t *testing.T) {
 		}
 
 		expectReconciled(t, reconciler, "", pg.Name)
-		verifyProxyGroupCounts(t, reconciler, 1, 2, 1)
+		verifyProxyGroupCounts(t, reconciler, 2, 2, 1)
 
 		sts := &appsv1.StatefulSet{}
 		if err := fc.Get(t.Context(), client.ObjectKey{Namespace: tsNamespace, Name: pg.Name}, sts); err != nil {
@@ -1952,10 +2132,11 @@ func verifyEnvVarNotPresent(t *testing.T, sts *appsv1.StatefulSet, name string)
 func expectProxyGroupResources(t *testing.T, fc client.WithWatch, pg *tsapi.ProxyGroup, shouldExist bool, proxyClass *tsapi.ProxyClass) {
 	t.Helper()
 
-	role := pgRole(pg, tsNamespace)
+	shareACMEAccount := pg.Annotations[AnnotationShareACMEAccount] == "true"
+	role := pgRole(pg, tsNamespace, shareACMEAccount)
 	roleBinding := pgRoleBinding(pg, tsNamespace)
 	serviceAccount := pgServiceAccount(pg, tsNamespace)
-	statefulSet, err := pgStatefulSet(pg, tsNamespace, testProxyImage, "auto", nil, proxyClass)
+	statefulSet, err := pgStatefulSet(pg, tsNamespace, testProxyImage, "auto", nil, proxyClass, shareACMEAccount)
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/cmd/k8s-operator/sts.go b/cmd/k8s-operator/sts.go
index 66c2e917f..f25f83185 100644
--- a/cmd/k8s-operator/sts.go
+++ b/cmd/k8s-operator/sts.go
@@ -68,6 +68,12 @@ const (
 
 	AnnotationProxyGroup = "tailscale.com/proxy-group"
 
+	// AnnotationShareACMEAccount opts a single ProxyGroup into ("true")
+	// or out of ("false") using the shared per-tailnet ACME account key.
+	// When absent, OPERATOR_SHARED_ACME_ACCOUNT_KEY on the operator is
+	// the default. See tailscale/tailscale#18251.
+	AnnotationShareACMEAccount = "tailscale.com/share-acme-account"
+
 	// Annotations settable by users on ingresses.
 	AnnotationFunnel       = "tailscale.com/funnel"
 	AnnotationHTTPRedirect = "tailscale.com/http-redirect"
@@ -783,7 +789,7 @@ func (r *tailscaleSTSReconciler) reconcileSTS(ctx context.Context, logger *zap.S
 		// No need to error out if now or in future we end up in a
 		// situation where app info cannot be determined for one of the
 		// many proxy configurations that the operator can produce.
-		logger.Error("[unexpected] unable to determine proxy type")
+		logger.Error("unable to determine proxy type")
 	} else {
 		container.Env = append(container.Env, corev1.EnvVar{
 			Name:  "TS_INTERNAL_APP",
@@ -993,7 +999,7 @@ func enableEndpoints(ss *appsv1.StatefulSet, metrics, debug bool) {
 		if isMainContainer(&c) {
 			if debug {
 				ss.Spec.Template.Spec.Containers[i].Env = append(ss.Spec.Template.Spec.Containers[i].Env,
-					// Serve tailscaled's debug metrics on on
+					// Serve tailscaled's debug metrics on
 					// <pod-ip>:9001/debug/metrics. If we didn't specify Pod IP
 					// here, the proxy would, in some cases, also listen to its
 					// Tailscale IP- we don't want folks to start relying on this
@@ -1321,7 +1327,7 @@ func proxyCapVer(sec *corev1.Secret, podUID string, log *zap.SugaredLogger) tail
 	}
 	capVer, err := strconv.Atoi(string(sec.Data[kubetypes.KeyCapVer]))
 	if err != nil {
-		log.Infof("[unexpected]: unexpected capability version in proxy's state Secret, expected an integer, got %q", string(sec.Data[kubetypes.KeyCapVer]))
+		log.Warnf("unexpected capability version in proxy's state Secret, expected an integer, got %q", string(sec.Data[kubetypes.KeyCapVer]))
 		return tailcfg.CapabilityVersion(-1)
 	}
 	if !strings.EqualFold(podUID, string(sec.Data[kubetypes.KeyPodUID])) {
diff --git a/cmd/k8s-operator/sts_test.go b/cmd/k8s-operator/sts_test.go
index f55f582a6..c5ea7862d 100644
--- a/cmd/k8s-operator/sts_test.go
+++ b/cmd/k8s-operator/sts_test.go
@@ -41,10 +41,7 @@ func Test_statefulSetNameBase(t *testing.T) {
 		if _, err := b.WriteString("a"); err != nil {
 			t.Fatalf("error writing to string builder: %v", err)
 		}
-		baseLength := b.Len()
-		if baseLength > 43 {
-			baseLength = 43 // currently 43 is the max base length
-		}
+		baseLength := min(b.Len(), 43)                                              // currently 43 is the max base length
 		wantsNameR := regexp.MustCompile(`^ts-a{` + fmt.Sprint(baseLength) + `}-$`) // to match a string like ts-aaaa-
 		gotName := statefulSetNameBase(b.String())
 		if !wantsNameR.MatchString(gotName) {
diff --git a/cmd/k8s-operator/svc-for-pg.go b/cmd/k8s-operator/svc-for-pg.go
index 29d1a1ebd..395e89eb9 100644
--- a/cmd/k8s-operator/svc-for-pg.go
+++ b/cmd/k8s-operator/svc-for-pg.go
@@ -99,7 +99,6 @@ func (r *HAServiceReconciler) Reconcile(ctx context.Context, req reconcile.Reque
 
 	pgName := svc.Annotations[AnnotationProxyGroup]
 	if pgName == "" {
-		logger.Infof("[unexpected] no ProxyGroup annotation, skipping Tailscale Service provisioning")
 		return res, nil
 	}
 
@@ -674,7 +673,7 @@ func (r *HAServiceReconciler) maybeUpdateAdvertiseServicesConfig(ctx context.Con
 			case shouldBeAdvertised:
 				replicaName, ok := strings.CutSuffix(secret.Name, "-config")
 				if !ok {
-					logger.Infof("[unexpected] unable to determine replica name from config Secret name %q, unable to determine if backend routing has been configured", secret.Name)
+					logger.Warnf("unable to determine replica name from config Secret name %q, unable to determine if backend routing has been configured", secret.Name)
 					return nil
 				}
 				ready, err := r.backendRoutesSetup(ctx, serviceName.String(), replicaName, cfg, logger)
@@ -825,14 +824,40 @@ func (r *HAServiceReconciler) validateService(ctx context.Context, svc *corev1.S
 	}
 	svcList := &corev1.ServiceList{}
 	if err := r.List(ctx, svcList); err != nil {
-		errs = append(errs, fmt.Errorf("[unexpected] error listing Services: %w", err))
+		errs = append(errs, fmt.Errorf("error listing Services: %w", err))
 		return errors.Join(errs...)
 	}
 	svcName := nameForService(svc)
 	for _, s := range svcList.Items {
-		if r.shouldExpose(&s) && nameForService(&s) == svcName && s.UID != svc.UID {
-			errs = append(errs, fmt.Errorf("found duplicate Service %q for hostname %q - multiple HA Services for the same hostname in the same cluster are not allowed", client.ObjectKeyFromObject(&s), svcName))
+		if s.UID == svc.UID {
+			continue
 		}
+		// Only check services managed by the ProxyGroup reconciler. Services
+		// exposed via the single-proxy path in svc.go have their own
+		// hostname tracking and live in a separate per-proxy tailnet
+		// namespace; flagging them as duplicates here breaks multi-tailnet
+		// setups where a single-proxy Service on the primary tailnet shares
+		// a hostname with a ProxyGroup ingress on a secondary tailnet.
+		if !r.isTailscaleService(&s) {
+			continue
+		}
+		if nameForService(&s) != svcName {
+			continue
+		}
+		// Two ProxyGroups joined to different tailnets each have their own
+		// DNS namespace, so a hostname collision across them is not a real
+		// conflict. Look up the other Service's ProxyGroup and skip the
+		// duplicate report when the tailnets differ; if the lookup fails
+		// fall through and flag the collision so a genuine duplicate isn't
+		// silently allowed.
+		otherPGName := s.Annotations[AnnotationProxyGroup]
+		if otherPGName != "" && otherPGName != pg.Name {
+			otherPG := &tsapi.ProxyGroup{}
+			if err := r.Get(ctx, client.ObjectKey{Name: otherPGName}, otherPG); err == nil && otherPG.Spec.Tailnet != pg.Spec.Tailnet {
+				continue
+			}
+		}
+		errs = append(errs, fmt.Errorf("found duplicate Service %q for hostname %q - multiple HA Services for the same hostname on the same tailnet are not allowed", client.ObjectKeyFromObject(&s), svcName))
 	}
 	return errors.Join(errs...)
 }
diff --git a/cmd/k8s-operator/svc-for-pg_test.go b/cmd/k8s-operator/svc-for-pg_test.go
index 455d3363c..9d2296112 100644
--- a/cmd/k8s-operator/svc-for-pg_test.go
+++ b/cmd/k8s-operator/svc-for-pg_test.go
@@ -258,7 +258,7 @@ func TestValidateService(t *testing.T) {
 					Status:             metav1.ConditionFalse,
 					Reason:             reasonIngressSvcInvalid,
 					LastTransitionTime: metav1.NewTime(cl.Now().Truncate(time.Second)),
-					Message:            `found duplicate Service "ns-2/my-app2" for hostname "my-app" - multiple HA Services for the same hostname in the same cluster are not allowed`,
+					Message:            `found duplicate Service "ns-2/my-app2" for hostname "my-app" - multiple HA Services for the same hostname on the same tailnet are not allowed`,
 				},
 			},
 		},
@@ -270,6 +270,142 @@ func TestValidateService(t *testing.T) {
 	expectEqual(t, lc, wantSvc)
 }
 
+// Regression test for #20069. The pre-fix duplicate-hostname check scanned
+// every Service with shouldExpose=true, which meant a Service exposed on
+// one tailnet via the single-proxy path (svc.go) would block a ProxyGroup
+// ingress Service for the same hostname on a different tailnet. The
+// ProxyGroup path's validateService must skip Services that aren't
+// themselves managed by a ProxyGroup.
+func TestValidateService_SingleProxyServiceDoesNotCollideWithProxyGroup(t *testing.T) {
+	pgr, _, lc, _, _ := setupServiceTest(t)
+	// Service exposed via the single-proxy path: tailscale.com/expose=true
+	// and no tailscale.com/proxy-group annotation. Its hostname matches
+	// the ProxyGroup-managed Service below, but it lives in a different
+	// reconciler entirely and must not be flagged as a duplicate.
+	singleProxySvc := &corev1.Service{
+		TypeMeta: metav1.TypeMeta{Kind: "Service", APIVersion: "v1"},
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "single-proxy",
+			Namespace: "ns-1",
+			UID:       types.UID("single-proxy-uid"),
+			Annotations: map[string]string{
+				"tailscale.com/expose":   "true",
+				"tailscale.com/hostname": "my-app",
+			},
+		},
+		Spec: corev1.ServiceSpec{
+			ClusterIP: "1.2.3.4",
+			Type:      corev1.ServiceTypeClusterIP,
+		},
+	}
+	// ProxyGroup-managed Service for the same hostname.
+	pgSvc := &corev1.Service{
+		TypeMeta: metav1.TypeMeta{Kind: "Service", APIVersion: "v1"},
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "pg-svc",
+			Namespace: "ns-2",
+			UID:       types.UID("pg-svc-uid"),
+			Annotations: map[string]string{
+				"tailscale.com/proxy-group": "test-pg",
+				"tailscale.com/hostname":    "my-app",
+			},
+		},
+		Spec: corev1.ServiceSpec{
+			ClusterIP:         "1.2.3.5",
+			Type:              corev1.ServiceTypeLoadBalancer,
+			LoadBalancerClass: new("tailscale"),
+		},
+	}
+
+	mustCreate(t, lc, singleProxySvc)
+	mustCreate(t, lc, pgSvc)
+	expectReconciled(t, pgr, pgSvc.Namespace, pgSvc.Name)
+
+	got := &corev1.Service{}
+	if err := lc.Get(context.Background(), client.ObjectKeyFromObject(pgSvc), got); err != nil {
+		t.Fatalf("get Service: %v", err)
+	}
+	for _, c := range got.Status.Conditions {
+		if c.Type == string(tsapi.IngressSvcValid) && c.Status == metav1.ConditionFalse {
+			t.Fatalf("ProxyGroup Service flagged invalid by a single-proxy Service on a different tailnet: %s", c.Message)
+		}
+	}
+}
+
+// Regression test for #20069. Two ProxyGroup-managed Services with the same
+// hostname but joined to different tailnets each have their own DNS
+// namespace and must not be flagged as duplicates. The Service being
+// reconciled here is on the default tailnet (so it uses the configured
+// fake tsclient); the conflicting Service already exists in-cluster on
+// a different tailnet and must be skipped by the duplicate check.
+func TestValidateService_DifferentTailnetDoesNotCollide(t *testing.T) {
+	pgr, _, lc, _, _ := setupServiceTest(t)
+	// Pre-create a ProxyGroup joined to a different tailnet.
+	secondaryPG := &tsapi.ProxyGroup{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:       "secondary-pg",
+			Generation: 1,
+		},
+		Spec: tsapi.ProxyGroupSpec{
+			Type:    tsapi.ProxyGroupTypeIngress,
+			Tailnet: "secondary",
+		},
+	}
+	if err := lc.Create(context.Background(), secondaryPG); err != nil {
+		t.Fatalf("create secondary ProxyGroup: %v", err)
+	}
+	// Pre-existing Service on the secondary tailnet with the conflicting hostname.
+	otherTailnetSvc := &corev1.Service{
+		TypeMeta: metav1.TypeMeta{Kind: "Service", APIVersion: "v1"},
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "other-tailnet-svc",
+			Namespace: "ns-2",
+			UID:       types.UID("other-tailnet-svc-uid"),
+			Annotations: map[string]string{
+				"tailscale.com/proxy-group": "secondary-pg",
+				"tailscale.com/hostname":    "my-app",
+			},
+		},
+		Spec: corev1.ServiceSpec{
+			ClusterIP:         "1.2.3.5",
+			Type:              corev1.ServiceTypeLoadBalancer,
+			LoadBalancerClass: new("tailscale"),
+		},
+	}
+	mustCreate(t, lc, otherTailnetSvc)
+
+	// Service being reconciled: same hostname, default tailnet ProxyGroup.
+	primarySvc := &corev1.Service{
+		TypeMeta: metav1.TypeMeta{Kind: "Service", APIVersion: "v1"},
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "primary-svc",
+			Namespace: "ns-1",
+			UID:       types.UID("primary-svc-uid"),
+			Annotations: map[string]string{
+				"tailscale.com/proxy-group": "test-pg",
+				"tailscale.com/hostname":    "my-app",
+			},
+		},
+		Spec: corev1.ServiceSpec{
+			ClusterIP:         "1.2.3.4",
+			Type:              corev1.ServiceTypeLoadBalancer,
+			LoadBalancerClass: new("tailscale"),
+		},
+	}
+	mustCreate(t, lc, primarySvc)
+	expectReconciled(t, pgr, primarySvc.Namespace, primarySvc.Name)
+
+	got := &corev1.Service{}
+	if err := lc.Get(context.Background(), client.ObjectKeyFromObject(primarySvc), got); err != nil {
+		t.Fatalf("get Service: %v", err)
+	}
+	for _, c := range got.Status.Conditions {
+		if c.Type == string(tsapi.IngressSvcValid) && c.Status == metav1.ConditionFalse {
+			t.Fatalf("ProxyGroup Service flagged invalid by a Service on a different tailnet with the same hostname: %s", c.Message)
+		}
+	}
+}
+
 func TestServicePGReconciler_MultiCluster(t *testing.T) {
 	var ft *fakeTSClient
 	for i := 0; i <= 10; i++ {
diff --git a/cmd/k8s-operator/svc.go b/cmd/k8s-operator/svc.go
index 6f12148c8..eb39d0029 100644
--- a/cmd/k8s-operator/svc.go
+++ b/cmd/k8s-operator/svc.go
@@ -468,29 +468,29 @@ func retrieveClusterDomain(namespace string, logger *zap.SugaredLogger) string {
 	if err != nil {
 		// Vast majority of clusters use the cluster.local domain, so it
 		// is probably better to fall back to that than error out.
-		logger.Infof("[unexpected] error parsing /etc/resolv.conf to determine cluster domain, defaulting to 'cluster.local'.")
+		logger.Warn("error parsing /etc/resolv.conf to determine cluster domain, defaulting to 'cluster.local'.")
 		return defaultClusterDomain
 	}
 	return clusterDomainFromResolverConf(conf, namespace, logger)
 }
 
 // clusterDomainFromResolverConf attempts to retrieve cluster domain from the provided resolver config.
-// It expects the first three search domains in the resolver config to be be ['<namespace>.svc.<cluster-domain>, svc.<cluster-domain>, <cluster-domain>, ...]
+// It expects the first three search domains in the resolver config to be ['<namespace>.svc.<cluster-domain>, svc.<cluster-domain>, <cluster-domain>, ...]
 // If the first three domains match the expected structure, it returns the third.
 // If the domains don't match the expected structure or an error is encountered, it defaults to 'cluster.local' domain.
 func clusterDomainFromResolverConf(conf *resolvconffile.Config, namespace string, logger *zap.SugaredLogger) string {
 	if len(conf.SearchDomains) < 3 {
-		logger.Infof("[unexpected] resolver config contains only %d search domains, at least three expected.\nDefaulting cluster domain to 'cluster.local'.")
+		logger.Warnf(" resolver config contains only %d search domains, at least three expected.\nDefaulting cluster domain to 'cluster.local'.", len(conf.SearchDomains))
 		return defaultClusterDomain
 	}
 	first := conf.SearchDomains[0]
 	if !strings.HasPrefix(string(first), namespace+".svc") {
-		logger.Infof("[unexpected] first search domain in resolver config is %s; expected %s.\nDefaulting cluster domain to 'cluster.local'.", first, namespace+".svc.<cluster-domain>")
+		logger.Warnf("first search domain in resolver config is %s; expected %s.\nDefaulting cluster domain to 'cluster.local'.", first, namespace+".svc.<cluster-domain>")
 		return defaultClusterDomain
 	}
 	second := conf.SearchDomains[1]
 	if !strings.HasPrefix(string(second), "svc") {
-		logger.Infof("[unexpected] second search domain in resolver config is %s; expected 'svc.<cluster-domain>'.\nDefaulting cluster domain to 'cluster.local'.", second)
+		logger.Warnf("second search domain in resolver config is %s; expected 'svc.<cluster-domain>'.\nDefaulting cluster domain to 'cluster.local'.", second)
 		return defaultClusterDomain
 	}
 	// Trim the trailing dot for backwards compatibility purposes as the
@@ -499,7 +499,7 @@ func clusterDomainFromResolverConf(conf *resolvconffile.Config, namespace string
 	probablyClusterDomain := strings.TrimPrefix(second.WithoutTrailingDot(), "svc.")
 	third := conf.SearchDomains[2]
 	if !strings.EqualFold(third.WithoutTrailingDot(), probablyClusterDomain) {
-		logger.Infof("[unexpected] expected resolver config to contain serch domains <namespace>.svc.<cluster-domain>, svc.<cluster-domain>, <cluster-domain>; got %s %s %s\n. Defaulting cluster domain to 'cluster.local'.", first, second, third)
+		logger.Warnf("expected resolver config to contain serch domains <namespace>.svc.<cluster-domain>, svc.<cluster-domain>, <cluster-domain>; got %s %s %s\n. Defaulting cluster domain to 'cluster.local'.", first, second, third)
 		return defaultClusterDomain
 	}
 	logger.Infof("Cluster domain %q extracted from resolver config", probablyClusterDomain)
diff --git a/cmd/k8s-operator/testutils_test.go b/cmd/k8s-operator/testutils_test.go
index 074d92094..6c0d77a8c 100644
--- a/cmd/k8s-operator/testutils_test.go
+++ b/cmd/k8s-operator/testutils_test.go
@@ -984,6 +984,11 @@ func removeTargetPortsFromSvc(svc *corev1.Service) {
 	svc.Spec.Ports = newPorts
 }
 
+func removeClusterIPsFromSvc(svc *corev1.Service) {
+	svc.Spec.ClusterIP = ""
+	svc.Spec.ClusterIPs = nil
+}
+
 func removeAuthKeyIfExistsModifier(t *testing.T) func(s *corev1.Secret) {
 	return func(secret *corev1.Secret) {
 		t.Helper()
diff --git a/cmd/k8s-operator/tsclient.go b/cmd/k8s-operator/tsclient.go
index 702f4cc53..0670d2bcf 100644
--- a/cmd/k8s-operator/tsclient.go
+++ b/cmd/k8s-operator/tsclient.go
@@ -6,16 +6,11 @@
 package main
 
 import (
-	"context"
 	"fmt"
 	"net/url"
 	"os"
-	"sync"
-	"time"
 
 	"go.uber.org/zap"
-	"golang.org/x/oauth2"
-	"golang.org/x/oauth2/clientcredentials"
 	"tailscale.com/client/tailscale/v2"
 
 	"tailscale.com/ipn"
@@ -58,67 +53,18 @@ func newTSClient(logger *zap.SugaredLogger, clientID, clientIDPath, clientSecret
 		}
 	} else {
 		// Use workload identity federation.
-		tokenSrc := &jwtTokenSource{
-			logger:  logger,
-			jwtPath: oidcJWTPath,
-			baseCfg: clientcredentials.Config{
-				ClientID: clientID,
-				TokenURL: fmt.Sprintf("%s%s", baseURL, "/api/v2/oauth/token-exchange"),
-			},
-		}
-
 		client.Auth = &tailscale.IdentityFederation{
 			ClientID: clientID,
 			IDTokenFunc: func() (string, error) {
-				token, err := tokenSrc.Token()
+				token, err := os.ReadFile(oidcJWTPath)
 				if err != nil {
 					return "", err
 				}
 
-				return token.AccessToken, nil
+				return string(token), nil
 			},
 		}
 	}
 
 	return client, nil
 }
-
-// jwtTokenSource implements the [oauth2.TokenSource] interface, but with the
-// ability to regenerate a fresh underlying token source each time a new value
-// of the JWT parameter is needed due to expiration.
-type jwtTokenSource struct {
-	logger  *zap.SugaredLogger
-	jwtPath string                   // Path to the file containing an automatically refreshed JWT.
-	baseCfg clientcredentials.Config // Holds config that doesn't change for the lifetime of the process.
-
-	mu         sync.Mutex         // Guards underlying.
-	underlying oauth2.TokenSource // The oauth2 client implementation. Does its own separate caching of the access token.
-}
-
-func (s *jwtTokenSource) Token() (*oauth2.Token, error) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	if s.underlying != nil {
-		t, err := s.underlying.Token()
-		if err == nil && t != nil && t.Valid() {
-			return t, nil
-		}
-	}
-
-	s.logger.Debugf("Refreshing JWT from %s", s.jwtPath)
-	tk, err := os.ReadFile(s.jwtPath)
-	if err != nil {
-		return nil, fmt.Errorf("error reading JWT from %q: %w", s.jwtPath, err)
-	}
-
-	// Shallow copy of the base config.
-	credentials := s.baseCfg
-	credentials.EndpointParams = map[string][]string{
-		"jwt": {string(tk)},
-	}
-
-	src := credentials.TokenSource(context.Background())
-	s.underlying = oauth2.ReuseTokenSourceWithExpiry(nil, src, time.Minute)
-	return s.underlying.Token()
-}
diff --git a/cmd/k8s-operator/tsrecorder.go b/cmd/k8s-operator/tsrecorder.go
index 881d82354..86669d212 100644
--- a/cmd/k8s-operator/tsrecorder.go
+++ b/cmd/k8s-operator/tsrecorder.go
@@ -14,9 +14,11 @@ import (
 	"strconv"
 	"strings"
 	"sync"
+	"time"
 
 	"go.uber.org/zap"
 	xslices "golang.org/x/exp/slices"
+	"golang.org/x/time/rate"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	rbacv1 "k8s.io/api/rbac/v1"
@@ -57,14 +59,15 @@ var gaugeRecorderResources = clientmetric.NewGauge(kubetypes.MetricRecorderCount
 // Recorder CRs.
 type RecorderReconciler struct {
 	client.Client
-	log         *zap.SugaredLogger
-	recorder    record.EventRecorder
-	clock       tstime.Clock
-	clients     ClientProvider
-	tsNamespace string
-
-	mu        sync.Mutex           // protects following
-	recorders set.Slice[types.UID] // for recorders gauge
+	log               *zap.SugaredLogger
+	recorder          record.EventRecorder
+	clock             tstime.Clock
+	clients           ClientProvider
+	tsNamespace       string
+	authKeyRateLimits map[string]*rate.Limiter // per-Recorder rate limiters for auth key re-issuance.
+	authKeyReissuing  map[string]bool
+	mu                sync.Mutex           // protects following
+	recorders         set.Slice[types.UID] // for recorders gauge
 }
 
 func (r *RecorderReconciler) logger(name string) *zap.SugaredLogger {
@@ -164,9 +167,23 @@ func (r *RecorderReconciler) Reconcile(ctx context.Context, req reconcile.Reques
 func (r *RecorderReconciler) maybeProvision(ctx context.Context, tsClient tsclient.Client, tsr *tsapi.Recorder) error {
 	logger := r.logger(tsr.Name)
 
+	var replicas int32 = 1
+	if tsr.Spec.Replicas != nil {
+		replicas = *tsr.Spec.Replicas
+	}
+
 	r.mu.Lock()
 	r.recorders.Add(tsr.UID)
 	gaugeRecorderResources.Set(int64(r.recorders.Len()))
+	if _, ok := r.authKeyRateLimits[tsr.Name]; !ok {
+		r.authKeyRateLimits[tsr.Name] = rate.NewLimiter(rate.Every(30*time.Second), int(replicas))
+	}
+	for replica := range replicas {
+		name := fmt.Sprintf("%s-%d", tsr.Name, replica)
+		if _, ok := r.authKeyReissuing[name]; !ok {
+			r.authKeyReissuing[name] = false
+		}
+	}
 	r.mu.Unlock()
 
 	if err := r.ensureAuthSecretsCreated(ctx, tsClient, tsr); err != nil {
@@ -174,11 +191,6 @@ func (r *RecorderReconciler) maybeProvision(ctx context.Context, tsClient tsclie
 	}
 
 	// State Secrets are pre-created so we can use the Recorder CR as its owner ref.
-	var replicas int32 = 1
-	if tsr.Spec.Replicas != nil {
-		replicas = *tsr.Spec.Replicas
-	}
-
 	for replica := range replicas {
 		sec := tsrStateSecret(tsr, r.tsNamespace, replica)
 		_, err := createOrUpdate(ctx, r.Client, r.tsNamespace, sec, func(s *corev1.Secret) {
@@ -423,6 +435,10 @@ func (r *RecorderReconciler) maybeCleanup(ctx context.Context, tsr *tsapi.Record
 	r.mu.Lock()
 	r.recorders.Remove(tsr.UID)
 	gaugeRecorderResources.Set(int64(r.recorders.Len()))
+	delete(r.authKeyRateLimits, tsr.Name)
+	for replica := range replicas {
+		delete(r.authKeyReissuing, fmt.Sprintf("%s-%d", tsr.Name, replica))
+	}
 	r.mu.Unlock()
 
 	return true, nil
@@ -447,28 +463,122 @@ func (r *RecorderReconciler) ensureAuthSecretsCreated(ctx context.Context, tsCli
 			Name:      fmt.Sprintf("%s-auth-%d", tsr.Name, replica),
 		}
 
-		err := r.Get(ctx, key, &corev1.Secret{})
+		existingSecret := &corev1.Secret{}
+		err := r.Get(ctx, key, existingSecret)
 		switch {
 		case err == nil:
-			logger.Debugf("auth Secret %q already exists", key.Name)
+			reissue, err := r.shouldReissueAuthKey(ctx, tsClient, tsr, replica, existingSecret)
+			if err != nil {
+				return fmt.Errorf("error checking auth key reissue for replica %d: %w", replica, err)
+			}
+			if !reissue {
+				logger.Debugf("auth Secret %q already exists, no reissue needed", key.Name)
+				continue
+			}
+			authKey, err := newAuthKey(ctx, tsClient, tags.Stringify())
+			if err != nil {
+				return err
+			}
+			existingSecret.Data["authkey"] = []byte(authKey)
+			if err = r.Update(ctx, existingSecret); err != nil {
+				return err
+			}
 			continue
-		case !apierrors.IsNotFound(err):
+		case apierrors.IsNotFound(err):
+			authKey, err := newAuthKey(ctx, tsClient, tags.Stringify())
+			if err != nil {
+				return err
+			}
+			if err := r.Create(ctx, tsrAuthSecret(tsr, r.tsNamespace, authKey, replica)); err != nil {
+				return err
+			}
+		default:
 			return fmt.Errorf("failed to get Secret %q: %w", key.Name, err)
 		}
-
-		authKey, err := newAuthKey(ctx, tsClient, tags.Stringify())
-		if err != nil {
-			return err
-		}
-
-		if err = r.Create(ctx, tsrAuthSecret(tsr, r.tsNamespace, authKey, replica)); err != nil {
-			return err
-		}
 	}
 
 	return nil
 }
 
+// shouldReissueAuthKey returns true if the proxy needs a new auth key. It
+// tracks in-flight reissues via authKeyReissuing to avoid duplicate API calls
+// across reconciles.
+func (r *RecorderReconciler) shouldReissueAuthKey(ctx context.Context, tsClient tsclient.Client, tsr *tsapi.Recorder, replica int32, authSecret *corev1.Secret) (shouldReissue bool, err error) {
+	stateSecret, err := r.getStateSecret(ctx, tsr.Name, replica)
+	if err != nil || stateSecret == nil {
+		return false, err
+	}
+
+	stateSecretName := fmt.Sprintf("%s-%d", tsr.Name, replica)
+
+	r.mu.Lock()
+	reissuing := r.authKeyReissuing[stateSecretName]
+	r.mu.Unlock()
+
+	if reissuing {
+		_, requestStillPresent := stateSecret.Data[kubetypes.KeyReissueAuthkey]
+		if !requestStillPresent {
+			r.mu.Lock()
+			r.authKeyReissuing[stateSecretName] = false
+			r.mu.Unlock()
+			r.log.Debugf("auth key reissue completed for %q", stateSecretName)
+			return false, nil
+		}
+		r.log.Debugf("auth key already in process of re-issuance for %q, waiting", stateSecretName)
+		return false, nil
+	}
+
+	defer func() {
+		r.mu.Lock()
+		r.authKeyReissuing[stateSecretName] = shouldReissue
+		r.mu.Unlock()
+	}()
+
+	brokenAuthkey, ok := stateSecret.Data[kubetypes.KeyReissueAuthkey]
+	if !ok {
+		return false, nil
+	}
+
+	cfgAuthKey := string(authSecret.Data["authkey"])
+	empty := cfgAuthKey == ""
+	broken := cfgAuthKey == string(brokenAuthkey)
+
+	if !empty && !broken {
+		return false, nil
+	}
+
+	lim := r.authKeyRateLimits[tsr.Name]
+	if !lim.Allow() {
+		r.log.Debugf("auth key re-issuance rate limit exceeded, limit: %.2f, burst: %d, tokens: %.2f",
+			lim.Limit(), lim.Burst(), lim.Tokens())
+		return false, fmt.Errorf("auth key re-issuance rate limit exceeded for Recorder %q, will retry with backoff", tsr.Name)
+	}
+
+	r.log.Infof("Recorder replica %s failing to auth; attempting cleanup and new key", stateSecretName)
+	if tsID := stateSecret.Data[kubetypes.KeyDeviceID]; len(tsID) > 0 {
+		id := tailcfg.StableNodeID(tsID)
+		if err := r.ensureDeviceDeleted(ctx, tsClient, id, r.log); err != nil {
+			return false, err
+		}
+	}
+
+	return true, nil
+}
+
+func (r *RecorderReconciler) ensureDeviceDeleted(ctx context.Context, tsClient tsclient.Client, id tailcfg.StableNodeID, logger *zap.SugaredLogger) error {
+	logger.Debugf("deleting device %s from control", string(id))
+	err := tsClient.Devices().Delete(ctx, string(id))
+	switch {
+	case tailscale.IsNotFound(err):
+		logger.Debugf("device %s not found, likely because it has already been deleted from control", string(id))
+	case err != nil:
+		return fmt.Errorf("error deleting device: %w", err)
+	default:
+		logger.Debugf("device %s deleted from control", string(id))
+	}
+	return nil
+}
+
 func (r *RecorderReconciler) validate(ctx context.Context, tsr *tsapi.Recorder) error {
 	if !tsr.Spec.EnableUI && tsr.Spec.Storage.S3 == nil {
 		return errors.New("must either enable UI or use S3 storage to ensure recordings are accessible")
diff --git a/cmd/k8s-operator/tsrecorder_test.go b/cmd/k8s-operator/tsrecorder_test.go
index 6bd47e07b..8f189728c 100644
--- a/cmd/k8s-operator/tsrecorder_test.go
+++ b/cmd/k8s-operator/tsrecorder_test.go
@@ -14,6 +14,7 @@ import (
 
 	"github.com/google/go-cmp/cmp"
 	"go.uber.org/zap"
+	"golang.org/x/time/rate"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	rbacv1 "k8s.io/api/rbac/v1"
@@ -55,12 +56,14 @@ func TestRecorder(t *testing.T) {
 	fr := record.NewFakeRecorder(2)
 	cl := tstest.NewClock(tstest.ClockOpts{})
 	reconciler := &RecorderReconciler{
-		tsNamespace: tsNamespace,
-		Client:      fc,
-		clients:     tsclient.NewProvider(tsClient),
-		recorder:    fr,
-		log:         zl.Sugar(),
-		clock:       cl,
+		tsNamespace:       tsNamespace,
+		Client:            fc,
+		clients:           tsclient.NewProvider(tsClient),
+		recorder:          fr,
+		log:               zl.Sugar(),
+		clock:             cl,
+		authKeyRateLimits: make(map[string]*rate.Limiter),
+		authKeyReissuing:  make(map[string]bool),
 	}
 
 	t.Run("invalid_spec_gives_an_error_condition", func(t *testing.T) {
diff --git a/cmd/k8s-proxy/k8s-proxy.go b/cmd/k8s-proxy/k8s-proxy.go
index 38a86a5e0..8d9b9faf0 100644
--- a/cmd/k8s-proxy/k8s-proxy.go
+++ b/cmd/k8s-proxy/k8s-proxy.go
@@ -31,6 +31,7 @@ import (
 	"k8s.io/utils/strings/slices"
 	"tailscale.com/client/local"
 	"tailscale.com/cmd/k8s-proxy/internal/config"
+	"tailscale.com/health"
 	"tailscale.com/hostinfo"
 	"tailscale.com/ipn"
 	"tailscale.com/ipn/store"
@@ -41,6 +42,7 @@ import (
 	"tailscale.com/kube/certs"
 	healthz "tailscale.com/kube/health"
 	"tailscale.com/kube/k8s-proxy/conf"
+	"tailscale.com/kube/kubeclient"
 	"tailscale.com/kube/kubetypes"
 	klc "tailscale.com/kube/localclient"
 	"tailscale.com/kube/metrics"
@@ -171,10 +173,31 @@ func run(logger *zap.SugaredLogger) error {
 
 	// If Pod UID unset, assume we're running outside of a cluster/not managed
 	// by the operator, so no need to set additional state keys.
+	var kc kubeclient.Client
+	var stateSecretName string
 	if podUID != "" {
 		if err := state.SetInitialKeys(st, podUID); err != nil {
 			return fmt.Errorf("error setting initial state: %w", err)
 		}
+
+		if cfg.Parsed.State != nil {
+			if name, ok := strings.CutPrefix(*cfg.Parsed.State, "kube:"); ok {
+				stateSecretName = name
+
+				kc, err = kubeclient.New(k8sProxyFieldManager)
+				if err != nil {
+					return err
+				}
+
+				var configAuthKey string
+				if cfg.Parsed.AuthKey != nil {
+					configAuthKey = *cfg.Parsed.AuthKey
+				}
+				if err := resetState(ctx, kc, stateSecretName, podUID, configAuthKey); err != nil {
+					return fmt.Errorf("error resetting state: %w", err)
+				}
+			}
+		}
 	}
 
 	var authKey string
@@ -197,23 +220,69 @@ func run(logger *zap.SugaredLogger) error {
 		ts.Hostname = *cfg.Parsed.Hostname
 	}
 
-	// Make sure we crash loop if Up doesn't complete in reasonable time.
-	upCtx, upCancel := context.WithTimeout(ctx, time.Minute)
-	defer upCancel()
-	if _, err := ts.Up(upCtx); err != nil {
-		return fmt.Errorf("error starting tailscale server: %w", err)
-	}
-	defer ts.Close()
 	lc, err := ts.LocalClient()
 	if err != nil {
 		return fmt.Errorf("error getting local client: %w", err)
 	}
 
-	// Setup for updating state keys.
+	// Make sure we crash loop if Up doesn't complete in reasonable time.
+	upCtx, upCancel := context.WithTimeout(ctx, 30*time.Second)
+	defer upCancel()
+
+	// ts.Up() deliberately ignores NeedsLogin because it fires transiently
+	// during normal auth-key login. We can watch for the login-state health
+	// warning here though, which only fires on terminal auth failure, and
+	// cancel early.
+	go func() {
+		w, err := lc.WatchIPNBus(upCtx, ipn.NotifyInitialHealthState)
+		if err != nil {
+			return
+		}
+		defer w.Close()
+		for {
+			n, err := w.Next()
+			if err != nil {
+				logger.Debugf("failed to process message from ipn bus: %s", err.Error())
+				return
+			}
+			if n.Health != nil {
+				if _, ok := n.Health.Warnings[health.LoginStateWarnable.Code]; ok {
+					upCancel()
+					return
+				}
+			}
+		}
+	}()
+
+	if _, err := ts.Up(upCtx); err != nil {
+		if kc != nil && stateSecretName != "" {
+			return handleAuthKeyReissue(ctx, lc, kc, stateSecretName, authKey, cfgChan, logger)
+		}
+		return err
+	}
+
+	defer ts.Close()
+
+	reissueCh := make(chan struct{}, 1)
 	if podUID != "" {
 		group.Go(func() error {
 			return state.KeepKeysUpdated(ctx, st, klc.New(lc))
 		})
+
+		if kc != nil && stateSecretName != "" {
+			needsReissue, err := checkInitialAuthState(ctx, lc)
+			if err != nil {
+				return fmt.Errorf("error checking initial auth state: %w", err)
+			}
+			if needsReissue {
+				logger.Info("Auth key missing or invalid after startup, requesting new key from operator")
+				return handleAuthKeyReissue(ctx, lc, kc, stateSecretName, authKey, cfgChan, logger)
+			}
+
+			group.Go(func() error {
+				return monitorAuthHealth(ctx, lc, reissueCh, logger)
+			})
+		}
 	}
 
 	if cfg.Parsed.HealthCheckEnabled.EqualBool(true) || cfg.Parsed.MetricsEnabled.EqualBool(true) {
@@ -232,8 +301,15 @@ func run(logger *zap.SugaredLogger) error {
 		}
 
 		if cfg.Parsed.HealthCheckEnabled.EqualBool(true) {
-			ipV4, _ := ts.TailscaleIPs()
-			hz := healthz.RegisterHealthHandlers(mux, ipV4.String(), logger.Infof)
+			ipV4, ipV6 := ts.TailscaleIPs()
+			var v4, v6 string
+			if ipV4.IsValid() {
+				v4 = ipV4.String()
+			}
+			if ipV6.IsValid() {
+				v6 = ipV6.String()
+			}
+			hz := healthz.RegisterHealthHandlers(mux, v4, v6, logger.Infof)
 			group.Go(func() error {
 				err := hz.MonitorHealth(ctx, lc)
 				if err == nil || errors.Is(err, context.Canceled) {
@@ -362,6 +438,8 @@ func run(logger *zap.SugaredLogger) error {
 			}
 
 			cfgLogger.Infof("Config reloaded")
+		case <-reissueCh:
+			return handleAuthKeyReissue(ctx, lc, kc, stateSecretName, authKey, cfgChan, logger)
 		}
 	}
 }
diff --git a/cmd/k8s-proxy/kube.go b/cmd/k8s-proxy/kube.go
new file mode 100644
index 000000000..1d9348f1a
--- /dev/null
+++ b/cmd/k8s-proxy/kube.go
@@ -0,0 +1,161 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !plan9
+
+package main
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"sync"
+	"time"
+
+	"go.uber.org/zap"
+	"tailscale.com/client/local"
+	"tailscale.com/health"
+	"tailscale.com/ipn"
+	"tailscale.com/kube/authkey"
+	"tailscale.com/kube/k8s-proxy/conf"
+	"tailscale.com/kube/kubeapi"
+	"tailscale.com/kube/kubeclient"
+	"tailscale.com/kube/kubetypes"
+	"tailscale.com/tailcfg"
+)
+
+const k8sProxyFieldManager = "tailscale-k8s-proxy"
+
+// resetState clears k8s-proxy state from previous runs and sets
+// initial values. This ensures the operator doesn't use stale state when a Pod
+// is first recreated.
+//
+// It also clears the reissue_authkey marker if the operator has actioned it
+// (i.e., the config now has a different auth key than what was marked for
+// reissue).
+func resetState(ctx context.Context, kc kubeclient.Client, stateSecretName string, podUID string, configAuthKey string) error {
+	existingSecret, err := kc.GetSecret(ctx, stateSecretName)
+	switch {
+	case kubeclient.IsNotFoundErr(err):
+		return nil
+	case err != nil:
+		return fmt.Errorf("failed to read state Secret %q to reset state: %w", stateSecretName, err)
+	}
+
+	s := &kubeapi.Secret{
+		Data: map[string][]byte{
+			kubetypes.KeyCapVer: fmt.Appendf(nil, "%d", tailcfg.CurrentCapabilityVersion),
+		},
+	}
+	if podUID != "" {
+		s.Data[kubetypes.KeyPodUID] = []byte(podUID)
+	}
+
+	// Only clear reissue_authkey if the operator has actioned it.
+	brokenAuthkey, ok := existingSecret.Data[kubetypes.KeyReissueAuthkey]
+	if ok && configAuthKey != "" && string(brokenAuthkey) != configAuthKey {
+		s.Data[kubetypes.KeyReissueAuthkey] = nil
+	}
+
+	return kc.StrategicMergePatchSecret(ctx, stateSecretName, s, k8sProxyFieldManager)
+}
+
+// needsAuthKeyReissue reports whether the given backend state and health
+// warnings indicate a terminal auth failure requiring a new key from the
+// operator.
+func needsAuthKeyReissue(backendState string, healthWarnings []string) bool {
+	if backendState == ipn.NeedsLogin.String() {
+		return true
+	}
+	loginWarnableCode := string(health.LoginStateWarnable.Code)
+	for _, h := range healthWarnings {
+		if strings.Contains(h, loginWarnableCode) {
+			return true
+		}
+	}
+	return false
+}
+
+// checkInitialAuthState checks if the tsnet server is in an auth failure state
+// immediately after coming up. Returns true if auth key reissue is needed.
+func checkInitialAuthState(ctx context.Context, lc *local.Client) (bool, error) {
+	status, err := lc.Status(ctx)
+	if err != nil {
+		return false, fmt.Errorf("error getting status: %w", err)
+	}
+	return needsAuthKeyReissue(status.BackendState, status.Health), nil
+}
+
+// monitorAuthHealth watches the IPN bus for auth failures and triggers reissue
+// when needed. Runs until context is cancelled or auth failure is detected.
+func monitorAuthHealth(ctx context.Context, lc *local.Client, reissueCh chan<- struct{}, logger *zap.SugaredLogger) error {
+	w, err := lc.WatchIPNBus(ctx, ipn.NotifyInitialHealthState)
+	if err != nil {
+		return fmt.Errorf("failed to watch IPN bus for auth health: %w", err)
+	}
+	defer w.Close()
+
+	for {
+		if ctx.Err() != nil {
+			return ctx.Err()
+		}
+		n, err := w.Next()
+		if err != nil {
+			return err
+		}
+		if n.Health != nil {
+			if _, ok := n.Health.Warnings[health.LoginStateWarnable.Code]; ok {
+				logger.Info("Auth key failed to authenticate (may be expired or single-use), requesting new key from operator")
+				select {
+				case reissueCh <- struct{}{}:
+				case <-ctx.Done():
+				}
+				return nil
+			}
+		}
+	}
+}
+
+// handleAuthKeyReissue orchestrates the auth key reissue flow:
+// 1. Disconnect from control
+// 2. Set reissue marker in state Secret
+// 3. Wait for operator to provide new key
+// 4. Exit cleanly (Kubernetes will restart the pod with the new key)
+func handleAuthKeyReissue(ctx context.Context, lc *local.Client, kc kubeclient.Client, stateSecretName string, currentAuthKey string, cfgChan <-chan *conf.Config, logger *zap.SugaredLogger) error {
+	if err := lc.DisconnectControl(ctx); err != nil {
+		return fmt.Errorf("error disconnecting from control: %w", err)
+	}
+	if err := authkey.SetReissueAuthKey(ctx, kc, stateSecretName, currentAuthKey, k8sProxyFieldManager); err != nil {
+		return fmt.Errorf("failed to set reissue_authkey in Kubernetes Secret: %w", err)
+	}
+
+	var mu sync.Mutex
+	var latestAuthKey string
+	notify := make(chan struct{}, 1)
+
+	// we use this go func to abstract away conf.Config from the shared function
+	go func() {
+		for cfg := range cfgChan {
+			if cfg.Parsed.AuthKey != nil {
+				mu.Lock()
+				latestAuthKey = *cfg.Parsed.AuthKey
+				mu.Unlock()
+				select {
+				case notify <- struct{}{}:
+				default:
+				}
+			}
+		}
+	}()
+
+	getAuthKey := func() string {
+		mu.Lock()
+		defer mu.Unlock()
+		return latestAuthKey
+	}
+	clearFn := func(ctx context.Context) error {
+		return authkey.ClearReissueAuthKey(ctx, kc, stateSecretName, k8sProxyFieldManager)
+	}
+
+	return authkey.WaitForAuthKeyReissue(ctx, currentAuthKey, 10*time.Minute, getAuthKey, clearFn, notify)
+}
diff --git a/cmd/k8s-proxy/kube_test.go b/cmd/k8s-proxy/kube_test.go
new file mode 100644
index 000000000..c7e0f33d0
--- /dev/null
+++ b/cmd/k8s-proxy/kube_test.go
@@ -0,0 +1,141 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !plan9
+
+package main
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"tailscale.com/health"
+	"tailscale.com/kube/kubeapi"
+	"tailscale.com/kube/kubeclient"
+	"tailscale.com/kube/kubetypes"
+	"tailscale.com/tailcfg"
+)
+
+func TestResetState(t *testing.T) {
+	tests := []struct {
+		name          string
+		existingData  map[string][]byte
+		podUID        string
+		configAuthKey string
+		wantPatched   map[string][]byte
+	}{
+		{
+			name: "sets_capver_and_pod_uid",
+			existingData: map[string][]byte{
+				kubetypes.KeyDeviceID:   []byte("device-123"),
+				kubetypes.KeyDeviceFQDN: []byte("node.tailnet"),
+				kubetypes.KeyDeviceIPs:  []byte(`["100.64.0.1"]`),
+			},
+			podUID:        "pod-123",
+			configAuthKey: "new-key",
+			wantPatched: map[string][]byte{
+				kubetypes.KeyPodUID: []byte("pod-123"),
+			},
+		},
+		{
+			name: "clears_reissue_marker_when_actioned",
+			existingData: map[string][]byte{
+				kubetypes.KeyReissueAuthkey: []byte("old-key"),
+			},
+			podUID:        "pod-123",
+			configAuthKey: "new-key",
+			wantPatched: map[string][]byte{
+				kubetypes.KeyPodUID:         []byte("pod-123"),
+				kubetypes.KeyReissueAuthkey: nil,
+			},
+		},
+		{
+			name: "keeps_reissue_marker_when_not_actioned",
+			existingData: map[string][]byte{
+				kubetypes.KeyReissueAuthkey: []byte("old-key"),
+			},
+			podUID:        "pod-123",
+			configAuthKey: "old-key",
+			wantPatched: map[string][]byte{
+				kubetypes.KeyPodUID: []byte("pod-123"),
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			tt.wantPatched[kubetypes.KeyCapVer] = fmt.Appendf(nil, "%d", tailcfg.CurrentCapabilityVersion)
+
+			var patched map[string][]byte
+			kc := &kubeclient.FakeClient{
+				GetSecretImpl: func(ctx context.Context, name string) (*kubeapi.Secret, error) {
+					return &kubeapi.Secret{Data: tt.existingData}, nil
+				},
+				StrategicMergePatchSecretImpl: func(ctx context.Context, name string, s *kubeapi.Secret, fm string) error {
+					patched = s.Data
+					return nil
+				},
+			}
+
+			err := resetState(context.Background(), kc, "test-secret", tt.podUID, tt.configAuthKey)
+			if err != nil {
+				t.Fatalf("resetState() error = %v", err)
+			}
+
+			if diff := cmp.Diff(tt.wantPatched, patched); diff != "" {
+				t.Errorf("resetState() mismatch (-want +got):\n%s", diff)
+			}
+		})
+	}
+}
+
+func TestNeedsAuthKeyReissue(t *testing.T) {
+	loginWarnableCode := string(health.LoginStateWarnable.Code)
+
+	tests := []struct {
+		name         string
+		backendState string
+		health       []string
+		want         bool
+	}{
+		{
+			name:         "running_healthy",
+			backendState: "Running",
+			want:         false,
+		},
+		{
+			name:         "needs_login",
+			backendState: "NeedsLogin",
+			want:         true,
+		},
+		{
+			name:         "running_with_login_warning",
+			backendState: "Running",
+			health:       []string{"warning: " + loginWarnableCode + ": you are logged out"},
+			want:         true,
+		},
+		{
+			name:         "running_with_unrelated_warning",
+			backendState: "Running",
+			health:       []string{"dns-not-working"},
+			want:         false,
+		},
+		{
+			name:         "running_no_warnings",
+			backendState: "Running",
+			health:       nil,
+			want:         false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := needsAuthKeyReissue(tt.backendState, tt.health)
+			if got != tt.want {
+				t.Errorf("needsAuthKeyReissue() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
diff --git a/cmd/nardump/nardump.go b/cmd/nardump/nardump.go
index c8db24cb6..38a2a6731 100644
--- a/cmd/nardump/nardump.go
+++ b/cmd/nardump/nardump.go
@@ -9,22 +9,13 @@
 // git-pull-oss.sh having Nix available.
 package main
 
-// For the format, see:
-// See https://gist.github.com/jbeda/5c79d2b1434f0018d693
-
 import (
-	"bufio"
-	"crypto/sha256"
-	"encoding/base64"
-	"encoding/binary"
 	"flag"
 	"fmt"
-	"io"
-	"io/fs"
 	"log"
 	"os"
-	"path"
-	"sort"
+
+	"tailscale.com/cmd/nardump/nardump"
 )
 
 var sri = flag.Bool("sri", false, "print SRI")
@@ -34,167 +25,16 @@ func main() {
 	if flag.NArg() != 1 {
 		log.Fatal("usage: nardump <dir>")
 	}
-	arg := flag.Arg(0)
-	if err := os.Chdir(arg); err != nil {
-		log.Fatal(err)
-	}
+	fsys := os.DirFS(flag.Arg(0))
 	if *sri {
-		hash := sha256.New()
-		if err := writeNAR(hash, os.DirFS(".")); err != nil {
+		s, err := nardump.SRI(fsys)
+		if err != nil {
 			log.Fatal(err)
 		}
-		fmt.Printf("sha256-%s\n", base64.StdEncoding.EncodeToString(hash.Sum(nil)))
+		fmt.Println(s)
 		return
 	}
-	bw := bufio.NewWriter(os.Stdout)
-	if err := writeNAR(bw, os.DirFS(".")); err != nil {
+	if err := nardump.WriteNAR(os.Stdout, fsys); err != nil {
 		log.Fatal(err)
 	}
-	bw.Flush()
-}
-
-// writeNARError is a sentinel panic type that's recovered by writeNAR
-// and converted into the wrapped error.
-type writeNARError struct{ err error }
-
-// narWriter writes NAR files.
-type narWriter struct {
-	w  io.Writer
-	fs fs.FS
-}
-
-// writeNAR writes a NAR file to w from the root of fs.
-func writeNAR(w io.Writer, fs fs.FS) (err error) {
-	defer func() {
-		if e := recover(); e != nil {
-			if we, ok := e.(writeNARError); ok {
-				err = we.err
-				return
-			}
-			panic(e)
-		}
-	}()
-	nw := &narWriter{w: w, fs: fs}
-	nw.str("nix-archive-1")
-	return nw.writeDir(".")
-}
-
-func (nw *narWriter) writeDir(dirPath string) error {
-	ents, err := fs.ReadDir(nw.fs, dirPath)
-	if err != nil {
-		return err
-	}
-	sort.Slice(ents, func(i, j int) bool {
-		return ents[i].Name() < ents[j].Name()
-	})
-	nw.str("(")
-	nw.str("type")
-	nw.str("directory")
-	for _, ent := range ents {
-		nw.str("entry")
-		nw.str("(")
-		nw.str("name")
-		nw.str(ent.Name())
-		nw.str("node")
-		mode := ent.Type()
-		sub := path.Join(dirPath, ent.Name())
-		var err error
-		switch {
-		case mode.IsDir():
-			err = nw.writeDir(sub)
-		case mode.IsRegular():
-			err = nw.writeRegular(sub)
-		case mode&os.ModeSymlink != 0:
-			err = nw.writeSymlink(sub)
-		default:
-			return fmt.Errorf("unsupported file type %v at %q", sub, mode)
-		}
-		if err != nil {
-			return err
-		}
-		nw.str(")")
-	}
-	nw.str(")")
-	return nil
-}
-
-func (nw *narWriter) writeRegular(path string) error {
-	nw.str("(")
-	nw.str("type")
-	nw.str("regular")
-	fi, err := fs.Stat(nw.fs, path)
-	if err != nil {
-		return err
-	}
-	if fi.Mode()&0111 != 0 {
-		nw.str("executable")
-		nw.str("")
-	}
-	contents, err := fs.ReadFile(nw.fs, path)
-	if err != nil {
-		return err
-	}
-	nw.str("contents")
-	if err := writeBytes(nw.w, contents); err != nil {
-		return err
-	}
-	nw.str(")")
-	return nil
-}
-
-func (nw *narWriter) writeSymlink(path string) error {
-	nw.str("(")
-	nw.str("type")
-	nw.str("symlink")
-	nw.str("target")
-	// broken symlinks are valid in a nar
-	// given we do os.chdir(dir) and os.dirfs(".") above
-	// readlink now resolves relative links even if they are broken
-	link, err := os.Readlink(path)
-	if err != nil {
-		return err
-	}
-	nw.str(link)
-	nw.str(")")
-	return nil
-}
-
-func (nw *narWriter) str(s string) {
-	if err := writeString(nw.w, s); err != nil {
-		panic(writeNARError{err})
-	}
-}
-
-func writeString(w io.Writer, s string) error {
-	var buf [8]byte
-	binary.LittleEndian.PutUint64(buf[:], uint64(len(s)))
-	if _, err := w.Write(buf[:]); err != nil {
-		return err
-	}
-	if _, err := io.WriteString(w, s); err != nil {
-		return err
-	}
-	return writePad(w, len(s))
-}
-
-func writeBytes(w io.Writer, b []byte) error {
-	var buf [8]byte
-	binary.LittleEndian.PutUint64(buf[:], uint64(len(b)))
-	if _, err := w.Write(buf[:]); err != nil {
-		return err
-	}
-	if _, err := w.Write(b); err != nil {
-		return err
-	}
-	return writePad(w, len(b))
-}
-
-func writePad(w io.Writer, n int) error {
-	pad := n % 8
-	if pad == 0 {
-		return nil
-	}
-	var zeroes [8]byte
-	_, err := w.Write(zeroes[:8-pad])
-	return err
 }
diff --git a/cmd/nardump/nardump/nardump.go b/cmd/nardump/nardump/nardump.go
new file mode 100644
index 000000000..ab9ff1f3c
--- /dev/null
+++ b/cmd/nardump/nardump/nardump.go
@@ -0,0 +1,193 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package nardump writes a NAR (Nix Archive) representation of an
+// fs.FS to an io.Writer, or summarizes it as a Subresource Integrity
+// hash, as used by Nix flake.nix vendor and toolchain hashes.
+//
+// For the format, see:
+// https://gist.github.com/jbeda/5c79d2b1434f0018d693
+package nardump
+
+import (
+	"bufio"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/binary"
+	"fmt"
+	"io"
+	"io/fs"
+	"path"
+	"sort"
+)
+
+// WriteNAR writes a NAR-encoded representation of fsys, rooted at
+// the FS root, to w.
+//
+// The encoder issues many small writes; if w is not already a
+// *bufio.Writer, WriteNAR wraps it in one and flushes on return so
+// the caller doesn't have to.
+//
+// fsys must implement fs.ReadLinkFS to encode any symlinks it
+// contains; os.DirFS satisfies this on Go 1.25+.
+func WriteNAR(w io.Writer, fsys fs.FS) (err error) {
+	defer func() {
+		if e := recover(); e != nil {
+			if we, ok := e.(writeNARError); ok {
+				err = we.err
+				return
+			}
+			panic(e)
+		}
+	}()
+	bw, ok := w.(*bufio.Writer)
+	if !ok {
+		bw = bufio.NewWriter(w)
+		defer func() {
+			if flushErr := bw.Flush(); err == nil {
+				err = flushErr
+			}
+		}()
+	}
+	nw := &narWriter{w: bw, fs: fsys}
+	nw.str("nix-archive-1")
+	return nw.writeDir(".")
+}
+
+// SRI returns the Subresource Integrity hash of the NAR encoding of
+// fsys, in the form "sha256-<base64>". This is the format Nix
+// expects for vendorHash and similar fields.
+func SRI(fsys fs.FS) (string, error) {
+	h := sha256.New()
+	if err := WriteNAR(h, fsys); err != nil {
+		return "", err
+	}
+	return "sha256-" + base64.StdEncoding.EncodeToString(h.Sum(nil)), nil
+}
+
+// writeNARError is a sentinel panic type that's recovered by
+// WriteNAR and converted into the wrapped error.
+type writeNARError struct{ err error }
+
+// narWriter writes NAR files.
+type narWriter struct {
+	w  io.Writer
+	fs fs.FS
+}
+
+func (nw *narWriter) writeDir(dirPath string) error {
+	ents, err := fs.ReadDir(nw.fs, dirPath)
+	if err != nil {
+		return err
+	}
+	sort.Slice(ents, func(i, j int) bool {
+		return ents[i].Name() < ents[j].Name()
+	})
+	nw.str("(")
+	nw.str("type")
+	nw.str("directory")
+	for _, ent := range ents {
+		nw.str("entry")
+		nw.str("(")
+		nw.str("name")
+		nw.str(ent.Name())
+		nw.str("node")
+		mode := ent.Type()
+		sub := path.Join(dirPath, ent.Name())
+		var err error
+		switch {
+		case mode.IsDir():
+			err = nw.writeDir(sub)
+		case mode.IsRegular():
+			err = nw.writeRegular(sub)
+		case mode&fs.ModeSymlink != 0:
+			err = nw.writeSymlink(sub)
+		default:
+			return fmt.Errorf("unsupported file type %v at %q", sub, mode)
+		}
+		if err != nil {
+			return err
+		}
+		nw.str(")")
+	}
+	nw.str(")")
+	return nil
+}
+
+func (nw *narWriter) writeRegular(p string) error {
+	nw.str("(")
+	nw.str("type")
+	nw.str("regular")
+	fi, err := fs.Stat(nw.fs, p)
+	if err != nil {
+		return err
+	}
+	if fi.Mode()&0111 != 0 {
+		nw.str("executable")
+		nw.str("")
+	}
+	contents, err := fs.ReadFile(nw.fs, p)
+	if err != nil {
+		return err
+	}
+	nw.str("contents")
+	if err := writeBytes(nw.w, contents); err != nil {
+		return err
+	}
+	nw.str(")")
+	return nil
+}
+
+func (nw *narWriter) writeSymlink(p string) error {
+	nw.str("(")
+	nw.str("type")
+	nw.str("symlink")
+	nw.str("target")
+	link, err := fs.ReadLink(nw.fs, p)
+	if err != nil {
+		return err
+	}
+	nw.str(link)
+	nw.str(")")
+	return nil
+}
+
+func (nw *narWriter) str(s string) {
+	if err := writeString(nw.w, s); err != nil {
+		panic(writeNARError{err})
+	}
+}
+
+func writeString(w io.Writer, s string) error {
+	var buf [8]byte
+	binary.LittleEndian.PutUint64(buf[:], uint64(len(s)))
+	if _, err := w.Write(buf[:]); err != nil {
+		return err
+	}
+	if _, err := io.WriteString(w, s); err != nil {
+		return err
+	}
+	return writePad(w, len(s))
+}
+
+func writeBytes(w io.Writer, b []byte) error {
+	var buf [8]byte
+	binary.LittleEndian.PutUint64(buf[:], uint64(len(b)))
+	if _, err := w.Write(buf[:]); err != nil {
+		return err
+	}
+	if _, err := w.Write(b); err != nil {
+		return err
+	}
+	return writePad(w, len(b))
+}
+
+func writePad(w io.Writer, n int) error {
+	pad := n % 8
+	if pad == 0 {
+		return nil
+	}
+	var zeroes [8]byte
+	_, err := w.Write(zeroes[:8-pad])
+	return err
+}
diff --git a/cmd/nardump/nardump/nardump_test.go b/cmd/nardump/nardump/nardump_test.go
new file mode 100644
index 000000000..16b690ee2
--- /dev/null
+++ b/cmd/nardump/nardump/nardump_test.go
@@ -0,0 +1,55 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package nardump
+
+import (
+	"crypto/sha256"
+	"fmt"
+	"os"
+	"path/filepath"
+	"runtime"
+	"testing"
+)
+
+// setupTmpdir sets up a known golden layout, covering all allowed file/folder types in a nar.
+func setupTmpdir(t *testing.T) string {
+	t.Helper()
+	tmpdir := t.TempDir()
+	must := func(err error) {
+		t.Helper()
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+	must(os.MkdirAll(filepath.Join(tmpdir, "sub/dir"), 0755))
+	must(os.Symlink("brokenfile", filepath.Join(tmpdir, "brokenlink")))
+	must(os.Symlink("sub/dir", filepath.Join(tmpdir, "dirl")))
+	must(os.Symlink("/abs/nonexistentdir", filepath.Join(tmpdir, "dirb")))
+	f, err := os.Create(filepath.Join(tmpdir, "sub/dir/file1"))
+	must(err)
+	f.Close()
+	f, err = os.Create(filepath.Join(tmpdir, "file2m"))
+	must(err)
+	must(f.Truncate(2 * 1024 * 1024))
+	f.Close()
+	must(os.Symlink("../file2m", filepath.Join(tmpdir, "sub/goodlink")))
+	return tmpdir
+}
+
+func TestWriteNAR(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		// Skip test on Windows as the Nix package manager is not supported on this platform
+		t.Skip("nix package manager is not available on Windows")
+	}
+	dir := setupTmpdir(t)
+	// obtained via `nix-store --dump /tmp/... | sha256sum` of the above test dir
+	const expected = "727613a36f41030e93a4abf2649c3ec64a2757ccff364e3f6f7d544eb976e442"
+	h := sha256.New()
+	if err := WriteNAR(h, os.DirFS(dir)); err != nil {
+		t.Fatal(err)
+	}
+	if got := fmt.Sprintf("%x", h.Sum(nil)); got != expected {
+		t.Fatalf("sha256sum of nar: got %s, want %s", got, expected)
+	}
+}
diff --git a/cmd/nardump/nardump_test.go b/cmd/nardump/nardump_test.go
deleted file mode 100644
index c1ca825e1..000000000
--- a/cmd/nardump/nardump_test.go
+++ /dev/null
@@ -1,52 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-package main
-
-import (
-	"crypto/sha256"
-	"fmt"
-	"os"
-	"runtime"
-	"testing"
-)
-
-// setupTmpdir sets up a known golden layout, covering all allowed file/folder types in a nar
-func setupTmpdir(t *testing.T) string {
-	tmpdir := t.TempDir()
-	pwd, _ := os.Getwd()
-	os.Chdir(tmpdir)
-	defer os.Chdir(pwd)
-	os.MkdirAll("sub/dir", 0755)
-	os.Symlink("brokenfile", "brokenlink")
-	os.Symlink("sub/dir", "dirl")
-	os.Symlink("/abs/nonexistentdir", "dirb")
-	os.Create("sub/dir/file1")
-	f, _ := os.Create("file2m")
-	_ = f.Truncate(2 * 1024 * 1024)
-	f.Close()
-	os.Symlink("../file2m", "sub/goodlink")
-	return tmpdir
-}
-
-func TestWriteNar(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		// Skip test on Windows as the Nix package manager is not supported on this platform
-		t.Skip("nix package manager is not available on Windows")
-	}
-	dir := setupTmpdir(t)
-	t.Run("nar", func(t *testing.T) {
-		// obtained via `nix-store --dump /tmp/... | sha256sum` of the above test dir
-		expected := "727613a36f41030e93a4abf2649c3ec64a2757ccff364e3f6f7d544eb976e442"
-		h := sha256.New()
-		os.Chdir(dir)
-		err := writeNAR(h, os.DirFS("."))
-		if err != nil {
-			t.Fatal(err)
-		}
-		hash := fmt.Sprintf("%x", h.Sum(nil))
-		if expected != hash {
-			t.Fatal("sha256sum of nar not matched", hash, expected)
-		}
-	})
-}
diff --git a/cmd/natc/natc.go b/cmd/natc/natc.go
index 877f16cc0..3ee09317e 100644
--- a/cmd/natc/natc.go
+++ b/cmd/natc/natc.go
@@ -20,6 +20,7 @@ import (
 	"net/netip"
 	"os"
 	"path/filepath"
+	"slices"
 	"strings"
 	"time"
 
@@ -537,12 +538,7 @@ func (c *connector) ignoreDestination(dstAddrs []netip.Addr) bool {
 	if c.ignoreDsts == nil {
 		return false
 	}
-	for _, a := range dstAddrs {
-		if c.ignoreDsts.Contains(a) {
-			return true
-		}
-	}
-	return false
+	return slices.ContainsFunc(dstAddrs, c.ignoreDsts.Contains)
 }
 
 func proxyTCPConn(c net.Conn, dest string, ctor *connector) {
diff --git a/cmd/netlogfmt/main.go b/cmd/netlogfmt/main.go
index 212b36fb6..af7baae46 100644
--- a/cmd/netlogfmt/main.go
+++ b/cmd/netlogfmt/main.go
@@ -45,6 +45,7 @@ import (
 	jsonv2 "github.com/go-json-experiment/json"
 	"github.com/go-json-experiment/json/jsontext"
 	"tailscale.com/tailcfg"
+	"tailscale.com/tstime"
 	"tailscale.com/types/bools"
 	"tailscale.com/types/logid"
 	"tailscale.com/types/netlogtype"
@@ -294,7 +295,7 @@ func printMessage(msg message) {
 		fmt.Printf("NodeID: %s\n", msg.NodeID)
 	}
 	formatTime := func(t time.Time) string {
-		return t.In(time.Local).Format("2006-01-02 15:04:05.000")
+		return t.Local().Format(tstime.DateSpTimeMilliZ)
 	}
 	switch {
 	case !msg.Logged.IsZero():
diff --git a/cmd/pgproxy/pgproxy.go b/cmd/pgproxy/pgproxy.go
index ded6fa695..a138eacdc 100644
--- a/cmd/pgproxy/pgproxy.go
+++ b/cmd/pgproxy/pgproxy.go
@@ -291,7 +291,7 @@ func (p *proxy) serve(sessionID int64, c net.Conn) error {
 			Certificates: p.downstreamCert,
 			MinVersion:   tls.VersionTLS12,
 		})
-		if err = uptc.HandshakeContext(ctx); err != nil {
+		if err = s.HandshakeContext(ctx); err != nil {
 			p.errors.Add("client-tls", 1)
 			return fmt.Errorf("client TLS handshake: %v", err)
 		}
diff --git a/cmd/sniproxy/sniproxy.go b/cmd/sniproxy/sniproxy.go
index bd95cc113..f7ebc6aba 100644
--- a/cmd/sniproxy/sniproxy.go
+++ b/cmd/sniproxy/sniproxy.go
@@ -138,9 +138,9 @@ func run(ctx context.Context, ts *tsnet.Server, wgPort int, hostname string, pro
 	}
 
 	// Finally, start mainloop to configure app connector based on information
-	// in the netmap.
-	// We set the NotifyInitialNetMap flag so we will always get woken with the
-	// current netmap, before only being woken on changes.
+	// in the self node's CapMap. We set NotifyInitialNetMap so the first
+	// Notify carries the current self node (now via Notify.SelfChange);
+	// subsequent self changes wake us up too.
 	bus, err := lc.WatchIPNBus(ctx, ipn.NotifyWatchEngineUpdates|ipn.NotifyInitialNetMap)
 	if err != nil {
 		log.Fatalf("watching IPN bus: %v", err)
@@ -155,28 +155,30 @@ func run(ctx context.Context, ts *tsnet.Server, wgPort int, hostname string, pro
 			log.Fatalf("reading IPN bus: %v", err)
 		}
 
-		// NetMap contains app-connector configuration
-		if nm := msg.NetMap; nm != nil && nm.SelfNode.Valid() {
-			var c appctype.AppConnectorConfig
-			nmConf, err := tailcfg.UnmarshalNodeCapViewJSON[appctype.AppConnectorConfig](nm.SelfNode.CapMap(), configCapKey)
-			if err != nil {
-				log.Printf("failed to read app connector configuration from coordination server: %v", err)
-			} else if len(nmConf) > 0 {
-				c = nmConf[0]
-			}
-
-			if c.AdvertiseRoutes {
-				if err := s.advertiseRoutesFromConfig(ctx, &c); err != nil {
-					log.Printf("failed to advertise routes: %v", err)
-				}
-			}
-
-			// Backwards compatibility: combine any configuration from control with flags specified
-			// on the command line. This is intentionally done after we advertise any routes
-			// because its never correct to advertise the nodes native IP addresses.
-			s.mergeConfigFromFlags(&c, ports, forwards)
-			s.srv.Configure(&c)
+		self := msg.SelfChange
+		if self == nil {
+			continue
 		}
+		var c appctype.AppConnectorConfig
+		// View() lets us reuse the existing CapView decoder.
+		nmConf, err := tailcfg.UnmarshalNodeCapViewJSON[appctype.AppConnectorConfig](self.View().CapMap(), configCapKey)
+		if err != nil {
+			log.Printf("failed to read app connector configuration from coordination server: %v", err)
+		} else if len(nmConf) > 0 {
+			c = nmConf[0]
+		}
+
+		if c.AdvertiseRoutes {
+			if err := s.advertiseRoutesFromConfig(ctx, &c); err != nil {
+				log.Printf("failed to advertise routes: %v", err)
+			}
+		}
+
+		// Backwards compatibility: combine any configuration from control with flags specified
+		// on the command line. This is intentionally done after we advertise any routes
+		// because its never correct to advertise the nodes native IP addresses.
+		s.mergeConfigFromFlags(&c, ports, forwards)
+		s.srv.Configure(&c)
 	}
 }
 
diff --git a/cmd/ssh-auth-none-demo/ssh-auth-none-demo.go b/cmd/ssh-auth-none-demo/ssh-auth-none-demo.go
index a2cd3acd2..4f4262d9f 100644
--- a/cmd/ssh-auth-none-demo/ssh-auth-none-demo.go
+++ b/cmd/ssh-auth-none-demo/ssh-auth-none-demo.go
@@ -86,19 +86,20 @@ func main() {
 					if cm.User() == "banners" {
 						totalBanners = 5
 					}
+
 					for banner := 2; banner <= totalBanners; banner++ {
 						time.Sleep(time.Second)
 						if banner == totalBanners {
-							spac.SendAuthBanner(fmt.Sprintf("# Banner%d: access granted at %v\r\n", banner, time.Since(start)))
+							spac.SendAuthBanner(fmt.Sprintf("# Final banner saying access granted (+%v)\r\n", time.Since(start).Round(time.Millisecond)))
 						} else {
-							spac.SendAuthBanner(fmt.Sprintf("# Banner%d at %v\r\n", banner, time.Since(start)))
+							spac.SendAuthBanner(fmt.Sprintf("# Another banner saying we're still waiting for auth server-side (+%v)\r\n", time.Since(start).Round(time.Millisecond)))
 						}
 					}
 					return nil, nil
 				},
 				BannerCallback: func(cm ssh.ConnMetadata) string {
 					log.Printf("Got connection from user %q, %q from %v", cm.User(), cm.ClientVersion(), cm.RemoteAddr())
-					return fmt.Sprintf("# Banner for user %q, %q\n", cm.User(), cm.ClientVersion())
+					return fmt.Sprintf("# Example URL in auth bannner for %q, %q: https://github.com/tailscale/tailscale\r\n", cm.User(), cm.ClientVersion())
 				},
 			}
 		},
@@ -136,6 +137,8 @@ func handleSessionPostSSHAuth(s gliderssh.Session) {
 		}
 	}()
 
+	fmt.Fprintf(s, "We're past auth phase now. Goodbye in ...\n")
+
 	for i := 10; i > 0; i-- {
 		fmt.Fprintf(s, "%v ...\n", i)
 		time.Sleep(time.Second)
diff --git a/cmd/stund/depaware.txt b/cmd/stund/depaware.txt
index 7804915dc..50538b6c3 100644
--- a/cmd/stund/depaware.txt
+++ b/cmd/stund/depaware.txt
@@ -9,6 +9,7 @@ tailscale.com/cmd/stund dependencies: (generated by github.com/tailscale/depawar
         github.com/go-json-experiment/json/internal/jsonopts         from github.com/go-json-experiment/json+
         github.com/go-json-experiment/json/internal/jsonwire         from github.com/go-json-experiment/json+
         github.com/go-json-experiment/json/jsontext                  from github.com/go-json-experiment/json+
+        github.com/go-json-experiment/json/v1                        from tailscale.com/types/logger
         github.com/munnerz/goautoneg                                 from github.com/prometheus/common/expfmt
      💣 github.com/prometheus/client_golang/prometheus               from tailscale.com/tsweb/promvarz
         github.com/prometheus/client_golang/prometheus/internal      from github.com/prometheus/client_golang/prometheus
@@ -61,6 +62,7 @@ tailscale.com/cmd/stund dependencies: (generated by github.com/tailscale/depawar
         tailscale.com/net/tsaddr                                     from tailscale.com/tsweb
         tailscale.com/syncs                                          from tailscale.com/metrics+
         tailscale.com/tailcfg                                        from tailscale.com/version+
+        tailscale.com/tstime                                         from tailscale.com/tsweb
         tailscale.com/tsweb                                          from tailscale.com/cmd/stund+
         tailscale.com/tsweb/promvarz                                 from tailscale.com/cmd/stund
         tailscale.com/tsweb/varz                                     from tailscale.com/tsweb+
@@ -140,22 +142,22 @@ tailscale.com/cmd/stund dependencies: (generated by github.com/tailscale/depawar
         crypto/internal/boring/bbig                                  from crypto/ecdsa+
         crypto/internal/boring/sig                                   from crypto/internal/boring
         crypto/internal/constanttime                                 from crypto/internal/fips140/edwards25519+
-        crypto/internal/fips140                                      from crypto/internal/fips140/aes+
+        crypto/internal/fips140                                      from crypto/fips140+
         crypto/internal/fips140/aes                                  from crypto/aes+
         crypto/internal/fips140/aes/gcm                              from crypto/cipher+
         crypto/internal/fips140/alias                                from crypto/cipher+
         crypto/internal/fips140/bigmod                               from crypto/internal/fips140/ecdsa+
-        crypto/internal/fips140/check                                from crypto/internal/fips140/aes+
-        crypto/internal/fips140/drbg                                 from crypto/internal/fips140/aes/gcm+
+        crypto/internal/fips140/check                                from crypto/fips140+
+        crypto/internal/fips140/drbg                                 from crypto/hpke+
         crypto/internal/fips140/ecdh                                 from crypto/ecdh
         crypto/internal/fips140/ecdsa                                from crypto/ecdsa
         crypto/internal/fips140/ed25519                              from crypto/ed25519
         crypto/internal/fips140/edwards25519                         from crypto/internal/fips140/ed25519
         crypto/internal/fips140/edwards25519/field                   from crypto/ecdh+
-        crypto/internal/fips140/hkdf                                 from crypto/internal/fips140/tls13+
+        crypto/internal/fips140/hkdf                                 from crypto/hkdf+
         crypto/internal/fips140/hmac                                 from crypto/hmac+
         crypto/internal/fips140/mlkem                                from crypto/mlkem
-        crypto/internal/fips140/nistec                               from crypto/elliptic+
+        crypto/internal/fips140/nistec                               from crypto/ecdsa+
         crypto/internal/fips140/nistec/fiat                          from crypto/internal/fips140/nistec
         crypto/internal/fips140/rsa                                  from crypto/rsa
         crypto/internal/fips140/sha256                               from crypto/internal/fips140/check+
@@ -220,13 +222,13 @@ tailscale.com/cmd/stund dependencies: (generated by github.com/tailscale/depawar
         internal/filepathlite                                        from os+
         internal/fmtsort                                             from fmt
         internal/goarch                                              from crypto/internal/fips140deps/cpu+
-        internal/godebug                                             from crypto/internal/fips140deps/godebug+
+        internal/godebug                                             from crypto/ed25519+
         internal/godebugs                                            from internal/godebug+
         internal/goexperiment                                        from net/http/pprof+
         internal/goos                                                from crypto/x509+
         internal/msan                                                from internal/runtime/maps+
         internal/nettrace                                            from net+
-        internal/oserror                                             from io/fs+
+        internal/oserror                                             from internal/syscall/windows+
         internal/poll                                                from net+
         internal/profile                                             from net/http/pprof
         internal/profilerecord                                       from runtime+
@@ -236,9 +238,9 @@ tailscale.com/cmd/stund dependencies: (generated by github.com/tailscale/depawar
         internal/runtime/atomic                                      from internal/runtime/exithook+
    L    internal/runtime/cgroup                                      from runtime
         internal/runtime/exithook                                    from runtime
-        internal/runtime/gc                                          from runtime+
+        internal/runtime/gc                                          from internal/runtime/gc/scan+
         internal/runtime/gc/scan                                     from runtime
-        internal/runtime/maps                                        from reflect+
+        internal/runtime/maps                                        from hash/maphash+
         internal/runtime/math                                        from internal/runtime/maps+
         internal/runtime/pprof/label                                 from runtime+
         internal/runtime/sys                                         from crypto/subtle+
@@ -252,7 +254,7 @@ tailscale.com/cmd/stund dependencies: (generated by github.com/tailscale/depawar
         internal/synctest                                            from sync
         internal/syscall/execenv                                     from os
   LD    internal/syscall/unix                                        from crypto/internal/sysrand+
-   W    internal/syscall/windows                                     from crypto/internal/sysrand+
+   W    internal/syscall/windows                                     from crypto/internal/fips140deps/time+
    W    internal/syscall/windows/registry                            from mime+
    W    internal/syscall/windows/sysdll                              from internal/syscall/windows+
         internal/testlog                                             from os
diff --git a/cmd/systray/systray.go b/cmd/systray/systray.go
index 9dc35f142..68a339782 100644
--- a/cmd/systray/systray.go
+++ b/cmd/systray/systray.go
@@ -15,9 +15,11 @@ import (
 )
 
 var socket = flag.String("socket", paths.DefaultTailscaledSocket(), "path to tailscaled socket")
+var theme = flag.String("theme", "dark", "color theme for Tailscale icon: dark, dark:nobg, light, light:nobg")
 
 func main() {
 	flag.Parse()
 	lc := &local.Client{Socket: *socket}
+	systray.SetTheme(*theme)
 	new(systray.Menu).Run(lc)
 }
diff --git a/cmd/tailscale/cli/appcroutes.go b/cmd/tailscale/cli/appcroutes.go
index 04cbcdd83..73b251df1 100644
--- a/cmd/tailscale/cli/appcroutes.go
+++ b/cmd/tailscale/cli/appcroutes.go
@@ -28,9 +28,9 @@ var appcRoutesCmd = &ffcli.Command{
 	ShortHelp:  "Print the current app connector routes",
 	FlagSet: (func() *flag.FlagSet {
 		fs := newFlagSet("appc-routes")
-		fs.BoolVar(&appcRoutesArgs.all, "all", false, "Print learned domains and routes and extra policy configured routes.")
-		fs.BoolVar(&appcRoutesArgs.domainMap, "map", false, "Print the map of learned domains: [routes].")
-		fs.BoolVar(&appcRoutesArgs.n, "n", false, "Print the total number of routes this node advertises.")
+		fs.BoolVar(&appcRoutesArgs.all, "all", false, "print learned domains and routes and extra policy configured routes.")
+		fs.BoolVar(&appcRoutesArgs.domainMap, "map", false, "print the map of learned domains: [routes].")
+		fs.BoolVar(&appcRoutesArgs.n, "n", false, "print the total number of routes this node advertises.")
 		return fs
 	})(),
 	LongHelp: strings.TrimSpace(`
@@ -40,7 +40,7 @@ By default this command prints the domains configured in the app connector confi
 learned for each domain.
 
 --all prints the routes learned from the domains configured in the app connector configuration; and any extra routes provided
-in the the policy app connector 'routes' field.
+in the policy app connector 'routes' field.
 
 --map prints the routes learned from the domains configured in the app connector configuration.
 
diff --git a/cmd/tailscale/cli/cert.go b/cmd/tailscale/cli/cert.go
index 6d78a8d8a..bab83901f 100644
--- a/cmd/tailscale/cli/cert.go
+++ b/cmd/tailscale/cli/cert.go
@@ -23,7 +23,10 @@ import (
 	"github.com/peterbourgon/ff/v3/ffcli"
 	"software.sslmate.com/src/go-pkcs12"
 	"tailscale.com/atomicfile"
+	"tailscale.com/feature/buildfeatures"
+	"tailscale.com/health"
 	"tailscale.com/ipn"
+	"tailscale.com/tsconst"
 	"tailscale.com/version"
 )
 
@@ -112,6 +115,11 @@ func runCert(ctx context.Context, args []string) error {
 		certArgs.certFile = fileBase + ".crt"
 		certArgs.keyFile = fileBase + ".key"
 	}
+	if buildfeatures.HasHealth {
+		watchCtx, cancel := context.WithCancel(ctx)
+		defer cancel()
+		go watchCertPendingHealth(watchCtx, domain)
+	}
 	certPEM, keyPEM, err := localClient.CertPairWithValidity(ctx, domain, certArgs.minValidity)
 	if err != nil {
 		return err
@@ -167,6 +175,44 @@ func runCert(ctx context.Context, args []string) error {
 	return nil
 }
 
+// watchCertPendingHealth subscribes to the IPN bus and prints the
+// [tsconst.HealthWarnableTLSCertPending] warning to stderr if it appears
+// for domain while a cert fetch is in flight. It returns once it has
+// printed the warning or ctx is done.
+//
+// Subscription is delayed 1 second so we don't print anything when the
+// daemon returns a cached cert quickly.
+func watchCertPendingHealth(ctx context.Context, domain string) {
+	select {
+	case <-time.After(1 * time.Second):
+	case <-ctx.Done():
+		return
+	}
+	watcher, err := localClient.WatchIPNBus(ctx, ipn.NotifyInitialHealthState|ipn.NotifyNoNetMap)
+	if err != nil {
+		return
+	}
+	defer watcher.Close()
+	for {
+		n, err := watcher.Next()
+		if err != nil {
+			return
+		}
+		if n.Health == nil {
+			continue
+		}
+		ws, ok := n.Health.Warnings[tsconst.HealthWarnableTLSCertPending]
+		if !ok {
+			continue
+		}
+		if !strings.Contains(ws.Args[health.ArgDomains], domain) {
+			continue
+		}
+		fmt.Fprintf(os.Stderr, "%s: %s\n", ws.Title, ws.Text)
+		return
+	}
+}
+
 func writeIfChanged(filename string, contents []byte, mode os.FileMode) (changed bool, err error) {
 	if filename == "-" {
 		Stdout.Write(contents)
diff --git a/cmd/tailscale/cli/cli.go b/cmd/tailscale/cli/cli.go
index 8a2c2b9ef..2f9243013 100644
--- a/cmd/tailscale/cli/cli.go
+++ b/cmd/tailscale/cli/cli.go
@@ -28,6 +28,7 @@ import (
 	"tailscale.com/feature"
 	"tailscale.com/paths"
 	"tailscale.com/util/slicesx"
+	"tailscale.com/util/testenv"
 	"tailscale.com/version/distro"
 )
 
@@ -92,8 +93,8 @@ var localClient = local.Client{
 	Socket: paths.DefaultTailscaledSocket(),
 }
 
-// Run runs the CLI. The args do not include the binary name.
-func Run(args []string) (err error) {
+// RunWithContext runs the CLI. The args do not include the binary name.
+func RunWithContext(ctx context.Context, args []string) (err error) {
 	if runtime.GOOS == "linux" && os.Getenv("GOKRAZY_FIRST_START") == "1" && distro.Get() == distro.Gokrazy && os.Getppid() == 1 && len(args) == 0 {
 		// We're running on gokrazy and the user did not specify 'up'.
 		// Don't run the tailscale CLI and spam logs with usage; just exit.
@@ -163,7 +164,7 @@ func Run(args []string) (err error) {
 		return
 	}
 
-	err = rootCmd.Run(context.Background())
+	err = rootCmd.Run(ctx)
 	if local.IsAccessDeniedError(err) && os.Getuid() != 0 && runtime.GOOS != "windows" {
 		return fmt.Errorf("%v\n\nUse 'sudo tailscale %s'.\nTo not require root, use 'sudo tailscale set --operator=$USER' once.", err, strings.Join(args, " "))
 	}
@@ -173,6 +174,11 @@ func Run(args []string) (err error) {
 	return err
 }
 
+// Run is equivalent to calling [RunWithContext] with the background context.
+func Run(args []string) (err error) {
+	return RunWithContext(context.Background(), args)
+}
+
 type onceFlagValue struct {
 	flag.Value
 	set bool
@@ -194,26 +200,49 @@ func (v *onceFlagValue) IsBoolFlag() bool {
 	return ok && bf.IsBoolFlag()
 }
 
-// noDupFlagify modifies c recursively to make all the
-// flag values be wrappers that permit setting the value
-// at most once.
-func noDupFlagify(c *ffcli.Command) {
-	if c.FlagSet != nil {
-		c.FlagSet.VisitAll(func(f *flag.Flag) {
-			f.Value = &onceFlagValue{Value: f.Value}
-		})
+// noDupFlagify modifies c recursively to make all the flag values be
+// wrappers that permit setting the value at most once. If tb is
+// non-nil, the original values are restored when the test completes.
+func noDupFlagify(c *ffcli.Command, tb testenv.TB) {
+	if tb == nil && testenv.InTest() {
+		return
 	}
-	for _, sub := range c.Subcommands {
-		noDupFlagify(sub)
+	type restore struct {
+		f *flag.Flag
+		v flag.Value
+	}
+	var restores []restore
+	var walk func(*ffcli.Command)
+	walk = func(c *ffcli.Command) {
+		if c.FlagSet != nil {
+			c.FlagSet.VisitAll(func(f *flag.Flag) {
+				if tb != nil {
+					restores = append(restores, restore{f, f.Value})
+				}
+				f.Value = &onceFlagValue{Value: f.Value}
+			})
+		}
+		for _, sub := range c.Subcommands {
+			walk(sub)
+		}
+	}
+	walk(c)
+	if tb != nil {
+		tb.Cleanup(func() {
+			for _, r := range restores {
+				r.f.Value = r.v
+			}
+		})
 	}
 }
 
 var (
 	fileCmd,
 	sysPolicyCmd,
+	maybeRoutecheckCmd,
 	maybeWebCmd,
 	maybeDriveCmd,
-	maybeNetlockCmd,
+	maybeTailnetLockCmd,
 	maybeFunnelCmd,
 	maybeServeCmd,
 	maybeCertCmd,
@@ -221,7 +250,7 @@ var (
 	_ func() *ffcli.Command
 )
 
-func newRootCmd() *ffcli.Command {
+func newRootCmd(tb ...testenv.TB) *ffcli.Command {
 	rootfs := newFlagSet("tailscale")
 	rootfs.Func("socket", "path to tailscaled socket", func(s string) error {
 		localClient.Socket = s
@@ -246,12 +275,14 @@ change in the future.
 			upCmd,
 			downCmd,
 			setCmd,
+			getCmd,
 			loginCmd,
 			logoutCmd,
 			switchCmd,
 			configureCmd(),
 			nilOrCall(sysPolicyCmd),
 			netcheckCmd,
+			nilOrCall(maybeRoutecheckCmd),
 			ipCmd,
 			dnsCmd,
 			statusCmd,
@@ -261,16 +292,18 @@ change in the future.
 			sshCmd,
 			nilOrCall(maybeFunnelCmd),
 			nilOrCall(maybeServeCmd),
+			serviceCmd,
 			versionCmd,
 			nilOrCall(maybeWebCmd),
 			nilOrCall(fileCmd),
 			bugReportCmd,
 			nilOrCall(maybeCertCmd),
-			nilOrCall(maybeNetlockCmd),
+			nilOrCall(maybeTailnetLockCmd),
 			licensesCmd,
 			exitNodeCmd(),
 			nilOrCall(maybeUpdateCmd),
 			whoisCmd,
+			whoamiCmd,
 			debugCmd(),
 			nilOrCall(maybeDriveCmd),
 			idTokenCmd,
@@ -303,7 +336,11 @@ change in the future.
 	})
 
 	ffcomplete.Inject(rootCmd, func(c *ffcli.Command) { c.LongHelp = hidden + c.LongHelp }, usageFunc)
-	noDupFlagify(rootCmd)
+	var t testenv.TB
+	if len(tb) > 0 {
+		t = tb[0]
+	}
+	noDupFlagify(rootCmd, t)
 	return rootCmd
 }
 
@@ -452,7 +489,7 @@ func usageFuncOpt(c *ffcli.Command, withDefaults bool) string {
 
 			showDefault := f.DefValue != "" && withDefaults
 			// Issue 6766: don't show the default Windows socket path. It's long
-			// and distracting. And people on on Windows aren't likely to ever
+			// and distracting. And people on Windows aren't likely to ever
 			// change it anyway.
 			if runtime.GOOS == "windows" && f.Name == "socket" && strings.HasPrefix(f.DefValue, `\\.\pipe\ProtectedPrefix\`) {
 				showDefault = false
diff --git a/cmd/tailscale/cli/cli_test.go b/cmd/tailscale/cli/cli_test.go
index f95d84695..6ad7e0888 100644
--- a/cmd/tailscale/cli/cli_test.go
+++ b/cmd/tailscale/cli/cli_test.go
@@ -30,6 +30,7 @@ import (
 	"tailscale.com/tka"
 	"tailscale.com/tstest"
 	"tailscale.com/tstest/deptest"
+	"tailscale.com/types/key"
 	"tailscale.com/types/logger"
 	"tailscale.com/types/opt"
 	"tailscale.com/types/persist"
@@ -769,7 +770,22 @@ func TestPrefsFromUpArgs(t *testing.T) {
 			args: upArgsT{
 				exitNodeIP: "foo",
 			},
-			wantErr: `invalid value "foo" for --exit-node; must be IP or hostname`,
+			st: &ipnstate.Status{
+				Peer: map[key.NodePublic]*ipnstate.PeerStatus{
+					key.NewNode().Public(): {
+						DNSName:      "example.com.",
+						TailscaleIPs: []netip.Addr{netip.MustParseAddr("1.0.0.2")},
+					},
+				},
+			},
+			wantErr: `invalid value "foo" for --exit-node; must be IP or peer hostname`,
+		},
+		{
+			name: "error_exit_node_not_started",
+			args: upArgsT{
+				exitNodeIP: "foo",
+			},
+			wantErr: `cannot resolve exit node by hostname while Tailscale is starting up; please use its Tailscale IP address instead`,
 		},
 		{
 			name: "error_exit_node_allow_lan_without_exit_node",
@@ -779,11 +795,43 @@ func TestPrefsFromUpArgs(t *testing.T) {
 			wantErr: `--exit-node-allow-lan-access can only be used with --exit-node`,
 		},
 		{
-			name: "error_tag_prefix",
+			name: "error_tag_bad_prefix",
 			args: upArgsT{
-				advertiseTags: "foo",
+				advertiseTags: "notatag:foo",
+			},
+			wantErr: `tag: "notatag:foo": tags must start with 'tag:'`,
+		},
+		{
+			name: "tag_auto_prefix",
+			args: upArgsFromOSArgs("linux", "--advertise-tags=foo,bar"),
+			want: &ipn.Prefs{
+				ControlURL:          ipn.DefaultControlURL,
+				WantRunning:         true,
+				CorpDNS:             true,
+				AdvertiseTags:       []string{"tag:foo", "tag:bar"},
+				NoSNAT:              false,
+				NoStatefulFiltering: "true",
+				NetfilterMode:       preftype.NetfilterOn,
+				AutoUpdate: ipn.AutoUpdatePrefs{
+					Check: true,
+				},
+			},
+		},
+		{
+			name: "tag_mixed_prefix",
+			args: upArgsFromOSArgs("linux", "--advertise-tags=tag:foo,bar"),
+			want: &ipn.Prefs{
+				ControlURL:          ipn.DefaultControlURL,
+				WantRunning:         true,
+				CorpDNS:             true,
+				AdvertiseTags:       []string{"tag:foo", "tag:bar"},
+				NoSNAT:              false,
+				NoStatefulFiltering: "true",
+				NetfilterMode:       preftype.NetfilterOn,
+				AutoUpdate: ipn.AutoUpdatePrefs{
+					Check: true,
+				},
 			},
-			wantErr: `tag: "foo": tags must start with 'tag:'`,
 		},
 		{
 			name: "error_long_hostname",
@@ -968,9 +1016,6 @@ func TestPrefFlagMapping(t *testing.T) {
 			continue
 		}
 		switch prefName {
-		case "AllowSingleHosts":
-			// Fake pref for downgrade compat. See #12058.
-			continue
 		case "WantRunning", "Persist", "LoggedOut":
 			// All explicitly handled (ignored) by checkForAccidentalSettingReverts.
 			continue
@@ -1566,7 +1611,7 @@ func TestParseNLArgs(t *testing.T) {
 
 	for _, tc := range tcs {
 		t.Run(tc.name, func(t *testing.T) {
-			keys, disablements, err := parseNLArgs(tc.input, tc.parseKeys, tc.parseDisablements)
+			keys, disablements, err := parseTLArgs(tc.input, tc.parseKeys, tc.parseDisablements)
 			if (tc.wantErr == nil && err != nil) ||
 				(tc.wantErr != nil && err == nil) ||
 				(tc.wantErr != nil && err != nil && tc.wantErr.Error() != err.Error()) {
@@ -1618,7 +1663,7 @@ func TestNoDups(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			cmd := newRootCmd()
+			cmd := newRootCmd(t)
 			makeQuietContinueOnError(cmd)
 			err := cmd.Parse(tt.args)
 			if got := fmt.Sprint(err); got != tt.want {
diff --git a/cmd/tailscale/cli/configure-flash-appliance.go b/cmd/tailscale/cli/configure-flash-appliance.go
new file mode 100644
index 000000000..c9f9af724
--- /dev/null
+++ b/cmd/tailscale/cli/configure-flash-appliance.go
@@ -0,0 +1,515 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !ts_omit_flashappliance
+
+package cli
+
+import (
+	"archive/zip"
+	"context"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"net/url"
+	"os"
+	"runtime"
+	"slices"
+	"sort"
+	"strings"
+
+	"github.com/bradfitz/monogok/disklayout"
+	"github.com/peterbourgon/ff/v3/ffcli"
+	"tailscale.com/clientupdate"
+	"tailscale.com/clientupdate/distsign"
+	"tailscale.com/gokrazy/mkfs"
+	"tailscale.com/util/progresstracking"
+	"tailscale.com/util/prompt"
+)
+
+var flashApplianceArgs struct {
+	variant              string
+	disk                 string
+	track                string
+	yes                  bool
+	gaf                  string
+	addSSHAuthorizedKeys string
+}
+
+func flashApplianceCmd() *ffcli.Command {
+	return &ffcli.Command{
+		Name:       "flash-appliance",
+		ShortUsage: "tailscale configure flash-appliance [flags]",
+		ShortHelp:  "Download a signed Tailscale appliance image and write it to a local disk [experimental]",
+		LongHelp: hidden + strings.TrimSpace(`
+This experimental command downloads a signed Tailscale appliance image (Gokrazy archive
+format, "GAF") from pkgs.tailscale.com, verifies its signature, and writes
+it to a local block device (SD card, USB drive, virtual disk).
+
+On macOS, the target disk is auto-discovered from 'diskutil list physical',
+excluding whichever disks back the running root. On Linux, you must pass
+--disk=/dev/sdX explicitly.
+
+This command requires mkfs.ext4 in $PATH to format the writable /perm
+partition. On macOS, 'brew install e2fsprogs' provides it.
+`),
+		FlagSet: (func() *flag.FlagSet {
+			fs := newFlagSet("flash-appliance")
+			fs.StringVar(&flashApplianceArgs.variant, "variant", "", `appliance variant: "pi-arm64", "vm-amd64", or "vm-arm64". Empty prompts interactively.`)
+			fs.StringVar(&flashApplianceArgs.disk, "disk", "", "target block device (e.g. /dev/sdb or /dev/disk4)")
+			fs.StringVar(&flashApplianceArgs.track, "track", "", `which track to download from; defaults to "`+clientupdate.CurrentTrack+`"`)
+			fs.BoolVar(&flashApplianceArgs.yes, "yes", false, "skip the destructive-write confirmation prompt")
+			fs.StringVar(&flashApplianceArgs.gaf, "gaf", "", "use a local GAF file instead of downloading (skips signature verification)")
+			fs.StringVar(&flashApplianceArgs.addSSHAuthorizedKeys, "add-ssh-authorized-keys", "", "path to an authorized_keys file to include on the appliance for breakglass SSH access")
+			return fs
+		})(),
+		Exec: runFlashAppliance,
+	}
+}
+
+func runFlashAppliance(ctx context.Context, args []string) error {
+	if len(args) > 0 {
+		return errors.New("unknown arguments")
+	}
+	if runtime.GOOS == "windows" {
+		return errors.New("flash-appliance is not supported on Windows yet; consider running under WSL")
+	}
+	if os.Geteuid() != 0 {
+		return errors.New("writing to a raw block device requires root; re-run with sudo")
+	}
+
+	disk, err := resolveTargetDisk(ctx, flashApplianceArgs.disk)
+	if err != nil {
+		return err
+	}
+
+	gafPath, gafLabel, variant, cleanup, err := obtainGAF(ctx, gafDownloadArgs{
+		localGAF: flashApplianceArgs.gaf,
+		track:    flashApplianceArgs.track,
+		variant:  flashApplianceArgs.variant,
+	})
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	zr, err := zip.OpenReader(gafPath)
+	if err != nil {
+		return fmt.Errorf("open GAF: %w", err)
+	}
+	defer zr.Close()
+
+	bootCode, err := readGAFMember(zr.File, "mbr.img", 1<<20)
+	if err != nil {
+		return err
+	}
+
+	if !flashApplianceArgs.yes {
+		msg := fmt.Sprintf("This will ERASE %s. Flash %s?", disk.Path, gafLabel)
+		if !prompt.YesNo(msg, false) {
+			return errors.New("aborted")
+		}
+	}
+
+	printf("Unmounting %s...\n", disk.Path)
+	if err := unmountDisk(ctx, disk.Path); err != nil {
+		return fmt.Errorf("unmount %s: %w", disk.Path, err)
+	}
+
+	if err := writeGAFToDisk(zr.File, disk.Path, bootCode, variant); err != nil {
+		return err
+	}
+
+	var permFiles []mkfs.PermFile
+	if flashApplianceArgs.addSSHAuthorizedKeys != "" {
+		keys, err := os.ReadFile(flashApplianceArgs.addSSHAuthorizedKeys)
+		if err != nil {
+			return fmt.Errorf("reading --add-ssh-authorized-keys: %w", err)
+		}
+		permFiles = append(permFiles, mkfs.PermFile{
+			Path:    "breakglass.authorized_keys",
+			Content: keys,
+		})
+		printf("Including SSH authorized_keys for breakglass access.\n")
+	}
+	if err := formatPermExt4(disk.Path, permFiles); err != nil {
+		return fmt.Errorf("formatting perm: %w", err)
+	}
+
+	ejected, err := ejectDisk(ctx, disk.Path)
+	if err != nil {
+		// Non-fatal: the user can eject manually.
+		fmt.Fprintf(Stderr, "ejecting %s: %v\n", disk.Path, err)
+	}
+
+	printf("Done. %s\n", flashSuccessHint(disk.Path, variant, ejected))
+	return nil
+}
+
+// formatPermExt4 creates an ext4 filesystem inside the gokrazy perm
+// partition of the disk at diskPath, delegating to gokrazy/mkfs.Perm.
+//
+// On macOS we open the buffered /dev/diskN path (not /dev/rdiskN)
+// because go-diskfs writes ext4 metadata in small unaligned chunks
+// that the raw character device rejects.
+func formatPermExt4(diskPath string, files []mkfs.PermFile) error {
+	f, err := os.OpenFile(diskPath, os.O_RDWR, 0)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	devsize, err := blockDeviceSize(f)
+	if err != nil {
+		return fmt.Errorf("sizing %s: %w", diskPath, err)
+	}
+	return mkfs.Perm(f, devsize, files...)
+}
+
+// flashSuccessHint returns a per-variant next-step hint shown after a
+// successful flash. variant is empty when the user passed --gaf
+// directly. ejected reports whether we already released the disk (true
+// on macOS after diskutil eject); when false, the message tells the
+// user to eject it themselves.
+func flashSuccessHint(diskPath, variant string, ejected bool) string {
+	verb := "Eject"
+	if ejected {
+		verb = "Pull"
+	}
+	switch variant {
+	case "pi-arm64":
+		return fmt.Sprintf("%s %s and boot your Raspberry Pi.", verb, diskPath)
+	case "vm-amd64":
+		return fmt.Sprintf("%s %s and boot an x86_64 VM from it.", verb, diskPath)
+	case "vm-arm64":
+		return fmt.Sprintf("%s %s and boot an arm64 VM from it.", verb, diskPath)
+	default:
+		return fmt.Sprintf("%s %s and boot the target device.", verb, diskPath)
+	}
+}
+
+// diskCandidate describes a flashable disk on the host.
+type diskCandidate struct {
+	Path        string // e.g. /dev/disk4 or /dev/sdb
+	SizeBytes   int64
+	Description string // human-readable model + size, e.g. "Generic MassStorage (62.5 GB)"
+}
+
+func (d diskCandidate) String() string {
+	if d.Description != "" {
+		return fmt.Sprintf("%s: %s", d.Path, d.Description)
+	}
+	return d.Path
+}
+
+// resolveTargetDisk returns the disk the user wants to flash. On macOS, an
+// empty userDisk triggers auto-discovery. On Linux, userDisk is required and
+// validated.
+func resolveTargetDisk(ctx context.Context, userDisk string) (diskCandidate, error) {
+	if userDisk != "" {
+		if err := validateDiskPath(userDisk); err != nil {
+			return diskCandidate{}, err
+		}
+		return diskCandidate{Path: userDisk}, nil
+	}
+
+	disks, err := discoverExternalDisks(ctx)
+	if err != nil {
+		return diskCandidate{}, err
+	}
+	switch len(disks) {
+	case 0:
+		return diskCandidate{}, errors.New("no candidate disks found; insert an SD card or USB drive, or pass --disk")
+	case 1:
+		printf("Found 1 candidate disk: %s\n", disks[0])
+		return disks[0], nil
+	default:
+		printf("Multiple candidate disks found:\n")
+		for i, d := range disks {
+			printf("  %d) %s\n", i+1, d)
+		}
+		return diskCandidate{}, errors.New("pass --disk=/dev/... to pick one")
+	}
+}
+
+// gafDownloadArgs are the inputs to [obtainGAF]. All fields are optional;
+// zero values mean "download the latest and prompt/pick sensible defaults".
+type gafDownloadArgs struct {
+	localGAF string // if set, skip the network and use this local GAF path
+	track    string // release track (empty → clientupdate.CurrentTrack)
+	variant  string // GAF variant key (e.g. "vm-amd64"); empty prompts interactively
+}
+
+// obtainGAF returns a path to a local GAF file the caller can read,
+// along with the appliance variant it corresponds to (empty for the
+// --gaf path). If args.localGAF is set, the local file is returned
+// directly. Otherwise the latest appliance GAF is fetched from
+// pkgs.tailscale.com (with signature verification) into a temp file.
+// cleanup removes any temp file it created.
+func obtainGAF(ctx context.Context, args gafDownloadArgs) (path, label, variant string, cleanup func(), err error) {
+	cleanup = func() {}
+	if args.localGAF != "" {
+		// With a local GAF there's no manifest to learn the variant
+		// from, so we trust whatever variant the caller passed (may be
+		// empty). rootArchForVariant defaults to arm64 when empty.
+		return args.localGAF, args.localGAF, args.variant, cleanup, nil
+	}
+
+	track := args.track
+	if track == "" {
+		track = clientupdate.CurrentTrack
+	}
+	latest, err := clientupdate.LatestPackages(track)
+	if err != nil {
+		return "", "", "", cleanup, fmt.Errorf("fetching package manifest: %w", err)
+	}
+	if len(latest.GAFs) == 0 {
+		return "", "", "", cleanup, fmt.Errorf("no appliance GAFs published on %q track", track)
+	}
+
+	variant, err = pickVariant(latest.GAFs, args.variant)
+	if err != nil {
+		return "", "", "", cleanup, err
+	}
+	gafName := latest.GAFs[variant]
+
+	gafURL, err := url.JoinPath("https://pkgs.tailscale.com", track, gafName)
+	if err != nil {
+		return "", "", "", cleanup, err
+	}
+
+	tmp, err := os.CreateTemp("", "tailscale-flash-*.gaf")
+	if err != nil {
+		return "", "", "", cleanup, err
+	}
+	tmpName := tmp.Name()
+	tmp.Close()
+	cleanup = func() { os.Remove(tmpName) }
+
+	printf("Downloading %s (version %s)\n", gafURL, latest.GAFsVersion)
+	logf := func(format string, args ...any) { fmt.Fprintf(Stderr, format+"\n", args...) }
+	if err := distsign.DownloadVerified(ctx, logf, gafURL, tmpName); err != nil {
+		cleanup()
+		return "", "", "", func() {}, fmt.Errorf("download GAF: %w", err)
+	}
+	return tmpName, fmt.Sprintf("%s (%s)", gafName, latest.GAFsVersion), variant, cleanup, nil
+}
+
+// pickVariant returns the variant key from gafs the user wants. If
+// chosen is non-empty, it's validated against the available keys.
+// Otherwise the caller is prompted to choose one on the next invocation.
+func pickVariant(gafs map[string]string, chosen string) (string, error) {
+	variants := make([]string, 0, len(gafs))
+	for k := range gafs {
+		variants = append(variants, k)
+	}
+	sort.Strings(variants)
+
+	if chosen != "" {
+		if !slices.Contains(variants, chosen) {
+			return "", fmt.Errorf("variant %q not published; available: %s", chosen, strings.Join(variants, ", "))
+		}
+		return chosen, nil
+	}
+
+	printf("Available appliance variants:\n")
+	for i, v := range variants {
+		printf("  %d) %s\n", i+1, v)
+	}
+	return "", fmt.Errorf("pass --variant=<one of %s>", strings.Join(variants, "|"))
+}
+
+// readGAFMember returns the contents of a named member of the GAF zip.
+// It returns an error if the member is missing or larger than maxBytes.
+func readGAFMember(files []*zip.File, name string, maxBytes int64) ([]byte, error) {
+	for _, f := range files {
+		if f.Name != name {
+			continue
+		}
+		if int64(f.UncompressedSize64) > maxBytes {
+			return nil, fmt.Errorf("%s is %d bytes; refusing to read more than %d", name, f.UncompressedSize64, maxBytes)
+		}
+		rc, err := f.Open()
+		if err != nil {
+			return nil, err
+		}
+		defer rc.Close()
+		return io.ReadAll(rc)
+	}
+	return nil, fmt.Errorf("GAF is missing %s", name)
+}
+
+// writeGAFToDisk writes a fresh gokrazy install to diskPath: the
+// protective MBR (with bootCode in the first 446 bytes), the primary
+// and secondary GPT, then boot.img at the boot partition's offset and
+// root.img at root A's offset. Root B and perm are left untouched — the
+// appliance populates root B on first boot, and the caller formats
+// perm with mkfs.ext4.
+func writeGAFToDisk(files []*zip.File, diskPath string, bootCode []byte, variant string) error {
+	f, err := openBlockDevice(diskPath)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	devsize, err := blockDeviceSize(f)
+	if err != nil {
+		return fmt.Errorf("sizing %s: %w", diskPath, err)
+	}
+	if devsize <= 0 {
+		return fmt.Errorf("could not determine size of %s", diskPath)
+	}
+
+	if err := writeApplianceImage(f, devsize, files, bootCode, variant); err != nil {
+		return err
+	}
+
+	if err := syncBlockDevice(f); err != nil {
+		return fmt.Errorf("fsync %s: %w", diskPath, err)
+	}
+	if err := rereadPartitionTable(f); err != nil {
+		return fmt.Errorf("reread partition table: %w", err)
+	}
+	return nil
+}
+
+// writeApplianceImage writes the gokrazy install (protective MBR + GPT,
+// boot.img, root.img) to f, whose usable size is devsize bytes. It does
+// not fsync or reread the partition table; those are the caller's
+// responsibility if targeting a block device.
+//
+// f is used for random-access seeks and writes and must already be sized
+// to devsize (a fresh block device, or a regular file that the caller
+// has truncated to devsize).
+func writeApplianceImage(f *os.File, devsize int64, files []*zip.File, bootCode []byte, variant string) error {
+	if len(bootCode) > 446 {
+		return fmt.Errorf("mbr.img is %d bytes; expected at most 446", len(bootCode))
+	}
+
+	if err := checkPartitionFits(files, "boot.img", int64(disklayout.BootPartitionSizeMB)<<20); err != nil {
+		return err
+	}
+	if err := checkPartitionFits(files, "root.img", int64(disklayout.RootPartitionSizeMB)<<20); err != nil {
+		return err
+	}
+
+	bootImg, err := readGAFMember(files, "boot.img", int64(disklayout.BootPartitionSizeMB)<<20)
+	if err != nil {
+		return err
+	}
+	partUUID, err := partUUIDFromBootImg(bootImg)
+	if err != nil {
+		return fmt.Errorf("locating gokrazy partuuid in boot.img: %w", err)
+	}
+
+	printf("Writing protective MBR + GPT (partuuid=%08x, arch=%s)\n", partUUID, rootArchForVariant(variant))
+	if err := disklayout.WriteGPT(f, uint64(devsize), disklayout.DefaultBootPartitionStartLBA, bootCode, partUUID, rootArchForVariant(variant)); err != nil {
+		return fmt.Errorf("writing GPT: %w", err)
+	}
+
+	writes := []struct {
+		member    string
+		offsetLBA uint32
+	}{
+		{"boot.img", disklayout.BootStartLBA(disklayout.DefaultBootPartitionStartLBA)},
+		{"root.img", disklayout.RootAStartLBA(disklayout.DefaultBootPartitionStartLBA)},
+	}
+	for _, w := range writes {
+		zf := findZipMember(files, w.member)
+		if zf == nil {
+			return fmt.Errorf("GAF is missing %s", w.member)
+		}
+		printf("Writing %s (%d bytes) at sector %d\n", w.member, zf.UncompressedSize64, w.offsetLBA)
+		if err := writeZipMemberAt(f, zf, int64(w.offsetLBA)*512); err != nil {
+			return fmt.Errorf("writing %s: %w", w.member, err)
+		}
+	}
+	return nil
+}
+
+// rootArchForVariant picks the GPT root partition type architecture
+// based on the GAF variant key (e.g. "pi-arm64" → arm64).
+func rootArchForVariant(variant string) disklayout.RootArch {
+	switch {
+	case strings.HasSuffix(variant, "-amd64"):
+		return disklayout.ArchAMD64
+	default:
+		// pi-arm64, vm-arm64, or empty (--gaf path): arm64 is the
+		// default for tailscale appliance images.
+		return disklayout.ArchARM64
+	}
+}
+
+// partUUIDFromBootImg returns the gokrazy per-disk partuuid embedded in
+// boot.img's cmdline.txt. We byte-search the FAT image for the
+// "PARTUUID=60c24cc1-..." pattern rather than parsing FAT, which is
+// good enough since the only thing on disk with that prefix is
+// cmdline.txt.
+func partUUIDFromBootImg(boot []byte) (uint32, error) {
+	return disklayout.ParseCmdlinePartUUID(string(boot))
+}
+
+// checkPartitionFits returns an error if the named GAF member is too
+// large to fit in a partition of maxBytes.
+func checkPartitionFits(files []*zip.File, name string, maxBytes int64) error {
+	zf := findZipMember(files, name)
+	if zf == nil {
+		return fmt.Errorf("GAF is missing %s", name)
+	}
+	if got := int64(zf.UncompressedSize64); got > maxBytes {
+		return fmt.Errorf("%s is %d bytes; gokrazy layout allows up to %d", name, got, maxBytes)
+	}
+	return nil
+}
+
+func findZipMember(files []*zip.File, name string) *zip.File {
+	for _, f := range files {
+		if f.Name == name {
+			return f
+		}
+	}
+	return nil
+}
+
+func writeZipMemberAt(f *os.File, zf *zip.File, offset int64) error {
+	rc, err := zf.Open()
+	if err != nil {
+		return err
+	}
+	defer rc.Close()
+	if _, err := f.Seek(offset, io.SeekStart); err != nil {
+		return err
+	}
+	total := int64(zf.UncompressedSize64)
+	cw := &progresstracking.CountingWriter{W: f}
+	stop := progresstracking.Ticker(cw.Count, total, func(d, t int64) {
+		pct := 0.0
+		if t > 0 {
+			pct = float64(d) * 100 / float64(t)
+		}
+		fmt.Fprintf(Stderr, "  %s: %s / %s (%.1f%%)\n", zf.Name, humanBytes(d), humanBytes(t), pct)
+	})
+	defer stop()
+	_, err = io.Copy(cw, rc)
+	return err
+}
+
+// humanBytes returns a friendly approximation of n bytes, e.g. "62.5 GB".
+func humanBytes(n int64) string {
+	const (
+		gb = 1 << 30
+		mb = 1 << 20
+		kb = 1 << 10
+	)
+	switch {
+	case n >= gb:
+		return fmt.Sprintf("%.1f GB", float64(n)/float64(gb))
+	case n >= mb:
+		return fmt.Sprintf("%.1f MB", float64(n)/float64(mb))
+	case n >= kb:
+		return fmt.Sprintf("%.1f KB", float64(n)/float64(kb))
+	default:
+		return fmt.Sprintf("%d B", n)
+	}
+}
diff --git a/cmd/tailscale/cli/configure-flash-appliance_darwin.go b/cmd/tailscale/cli/configure-flash-appliance_darwin.go
new file mode 100644
index 000000000..254fd6de6
--- /dev/null
+++ b/cmd/tailscale/cli/configure-flash-appliance_darwin.go
@@ -0,0 +1,430 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !ts_omit_flashappliance
+
+package cli
+
+import (
+	"context"
+	"encoding/xml"
+	"fmt"
+	"os"
+	"os/exec"
+	"regexp"
+	"strings"
+
+	"golang.org/x/sys/unix"
+)
+
+// maxAutoDetectDiskBytes is the upper size limit for a disk that
+// flash-appliance auto-discovers. Anything larger is reported to the
+// user but skipped from the candidate list, so it's harder to wipe an
+// unmounted internal SSD or a backup drive by accident; the user can
+// still target it with --disk explicitly.
+const maxAutoDetectDiskBytes = 256 << 30
+
+// discoverExternalDisks returns the physical disks suitable for flashing.
+// We pass just "physical" (not "external physical") to diskutil because
+// macOS reports built-in SD card readers as internal; instead we exclude
+// whichever whole disks back the running root.
+func discoverExternalDisks(ctx context.Context) ([]diskCandidate, error) {
+	out, err := exec.CommandContext(ctx, "diskutil", "list", "-plist", "physical").Output()
+	if err != nil {
+		return nil, fmt.Errorf("diskutil list: %w", err)
+	}
+	ids, err := parseDiskutilListPlist(out)
+	if err != nil {
+		return nil, fmt.Errorf("parse diskutil list output: %w", err)
+	}
+	boot, err := bootWholeDisks(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("locating boot disk: %w", err)
+	}
+	disks := make([]diskCandidate, 0, len(ids))
+	for _, id := range ids {
+		if boot[id] {
+			continue
+		}
+		d, err := diskutilInfo(ctx, id)
+		if err != nil {
+			return nil, err
+		}
+		if d.SizeBytes > maxAutoDetectDiskBytes {
+			printf("Skipping %s (%s) from auto-detection: looks suspiciously large.\n", d.Path, humanBytes(d.SizeBytes))
+			printf("  To flash it anyway, pass --disk=%s explicitly.\n", d.Path)
+			continue
+		}
+		disks = append(disks, d)
+	}
+	return disks, nil
+}
+
+var darwinWholeDiskRe = regexp.MustCompile(`^(disk\d+)`)
+
+// bootWholeDisks returns the set of whole-disk identifiers (e.g. "disk0")
+// that back the running root filesystem. It seeds the walk from `df -P /`
+// (which on Apple Silicon points to the sealed snapshot, e.g.
+// disk3s1s1) and follows ParentWholeDisk and APFSPhysicalStores so that
+// both the synthesized APFS container (disk3) and the physical disk
+// behind it (disk0) get excluded from flash candidates.
+func bootWholeDisks(ctx context.Context) (map[string]bool, error) {
+	rootDev, err := dfRootDevice(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("locating root device: %w", err)
+	}
+
+	boot := map[string]bool{}
+	seen := map[string]bool{}
+	queue := []string{rootDev}
+	for len(queue) > 0 {
+		id := queue[0]
+		queue = queue[1:]
+		if seen[id] {
+			continue
+		}
+		seen[id] = true
+
+		if m := darwinWholeDiskRe.FindString(id); m != "" {
+			boot[m] = true
+		}
+
+		out, err := exec.CommandContext(ctx, "diskutil", "info", "-plist", id).Output()
+		if err != nil {
+			// Skip identifiers diskutil can't resolve (e.g. a physical
+			// store on a disk that was unplugged); anything already
+			// collected stays excluded.
+			continue
+		}
+		info, err := parseDiskutilInfoPlist(out)
+		if err != nil {
+			continue
+		}
+		if d := info.ParentWholeDisk; d != "" {
+			queue = append(queue, d)
+		}
+		queue = append(queue, info.APFSPhysicalStores...)
+	}
+	return boot, nil
+}
+
+// dfRootDevice returns the device identifier (e.g. "disk3s1s1") that
+// backs the root mount, by parsing the second line of `df -P /`.
+func dfRootDevice(ctx context.Context) (string, error) {
+	out, err := exec.CommandContext(ctx, "df", "-P", "/").Output()
+	if err != nil {
+		return "", err
+	}
+	lines := strings.Split(strings.TrimSpace(string(out)), "\n")
+	if len(lines) < 2 {
+		return "", fmt.Errorf("unexpected df output: %q", out)
+	}
+	fields := strings.Fields(lines[1])
+	if len(fields) == 0 {
+		return "", fmt.Errorf("unexpected df line: %q", lines[1])
+	}
+	return strings.TrimPrefix(fields[0], "/dev/"), nil
+}
+
+func diskutilInfo(ctx context.Context, id string) (diskCandidate, error) {
+	out, err := exec.CommandContext(ctx, "diskutil", "info", "-plist", id).Output()
+	if err != nil {
+		return diskCandidate{}, fmt.Errorf("diskutil info %s: %w", id, err)
+	}
+	info, err := parseDiskutilInfoPlist(out)
+	if err != nil {
+		return diskCandidate{}, fmt.Errorf("parse diskutil info %s: %w", id, err)
+	}
+	desc := info.Model
+	if desc == "" {
+		desc = info.MediaName
+	}
+	if info.Size > 0 {
+		desc = strings.TrimSpace(fmt.Sprintf("%s (%s)", desc, humanBytes(info.Size)))
+	}
+	return diskCandidate{
+		Path:        "/dev/" + id,
+		SizeBytes:   info.Size,
+		Description: desc,
+	}, nil
+}
+
+// validateDiskPath checks that the user-provided disk path looks sane to
+// flash on macOS. We trust the user more than on Linux since they had to
+// type a /dev/disk path explicitly.
+func validateDiskPath(path string) error {
+	if !strings.HasPrefix(path, "/dev/disk") {
+		return fmt.Errorf("disk path %q does not look like a macOS whole-disk device (/dev/diskN)", path)
+	}
+	if strings.Contains(path, "s") && strings.IndexByte(path, 's') > len("/dev/disk") {
+		return fmt.Errorf("disk path %q looks like a partition (/dev/diskNsP); pass the whole disk", path)
+	}
+	return nil
+}
+
+// unmountDisk uses `diskutil unmountDisk` to release all partitions on the
+// target disk.
+func unmountDisk(ctx context.Context, path string) error {
+	cmd := exec.CommandContext(ctx, "diskutil", "unmountDisk", path)
+	cmd.Stdout = Stderr
+	cmd.Stderr = Stderr
+	return cmd.Run()
+}
+
+// ejectDisk runs `diskutil eject` so the user can pull the SD card or
+// USB drive without macOS complaining about an improper eject. Returns
+// true if the eject command ran successfully.
+func ejectDisk(ctx context.Context, path string) (bool, error) {
+	cmd := exec.CommandContext(ctx, "diskutil", "eject", path)
+	cmd.Stdout = Stderr
+	cmd.Stderr = Stderr
+	if err := cmd.Run(); err != nil {
+		return false, err
+	}
+	return true, nil
+}
+
+// openBlockDevice opens the whole-disk device for writing. On macOS we use
+// the raw "rdiskN" alias because the buffered "diskN" path is much slower
+// for large writes.
+func openBlockDevice(path string) (*os.File, error) {
+	raw := strings.Replace(path, "/dev/disk", "/dev/rdisk", 1)
+	return os.OpenFile(raw, os.O_WRONLY, 0)
+}
+
+// rereadPartitionTable is a no-op on macOS; diskutil and the kernel pick up
+// partition changes when the device is closed and re-opened.
+func rereadPartitionTable(_ *os.File) error { return nil }
+
+// macOS ioctls from <sys/disk.h>. lseek(SEEK_END) returns 0 on raw
+// (/dev/rdiskN) devices, so we have to compute the size from the block
+// size and block count.
+const (
+	dkiocGetBlockSize  = 0x40046418 // _IOR('d', 24, uint32_t)
+	dkiocGetBlockCount = 0x40086419 // _IOR('d', 25, uint64_t)
+)
+
+// syncBlockDevice asks the kernel to flush in-flight writes to disk. On
+// macOS, /dev/rdiskN is the unbuffered raw device, so its writes are
+// already synchronous and fsync returns ENOTTY ("inappropriate ioctl
+// for device"). We try F_FULLFSYNC for completeness and tolerate the
+// same ENOTTY there.
+func syncBlockDevice(f *os.File) error {
+	_, err := unix.FcntlInt(f.Fd(), unix.F_FULLFSYNC, 0)
+	if err == nil || err == unix.ENOTTY {
+		return nil
+	}
+	return err
+}
+
+// blockDeviceSize returns the size in bytes of the open block device f.
+// On little-endian darwin, IoctlGetInt's 8-byte int safely receives
+// both a 4-byte uint32 (block size) and an 8-byte uint64 (block count).
+func blockDeviceSize(f *os.File) (int64, error) {
+	blockSize, err := unix.IoctlGetInt(int(f.Fd()), dkiocGetBlockSize)
+	if err != nil {
+		return 0, fmt.Errorf("DKIOCGETBLOCKSIZE: %w", err)
+	}
+	blockCount, err := unix.IoctlGetInt(int(f.Fd()), dkiocGetBlockCount)
+	if err != nil {
+		return 0, fmt.Errorf("DKIOCGETBLOCKCOUNT: %w", err)
+	}
+	return int64(blockSize) * int64(blockCount), nil
+}
+
+// diskutilInfoFields are the fields we care about from `diskutil info -plist`.
+type diskutilInfoFields struct {
+	Model              string
+	MediaName          string
+	Size               int64
+	ParentWholeDisk    string   // e.g. "disk3" for "/" on APFS
+	APFSPhysicalStores []string // e.g. ["disk0s2"] for "/" on APFS
+}
+
+// parseDiskutilListPlist returns the WholeDisk device identifiers from the
+// output of `diskutil list -plist external physical`.
+func parseDiskutilListPlist(data []byte) ([]string, error) {
+	type listPlist struct {
+		Dict plistDict `xml:"dict"`
+	}
+	var p listPlist
+	if err := xml.Unmarshal(data, &p); err != nil {
+		return nil, err
+	}
+	arr, ok := p.Dict.Get("WholeDisks").(plistArray)
+	if !ok {
+		return nil, nil
+	}
+	var out []string
+	for _, v := range arr {
+		if s, ok := v.(string); ok {
+			out = append(out, s)
+		}
+	}
+	return out, nil
+}
+
+// parseDiskutilInfoPlist returns the fields we care about from `diskutil
+// info -plist <id>`.
+func parseDiskutilInfoPlist(data []byte) (diskutilInfoFields, error) {
+	type infoPlist struct {
+		Dict plistDict `xml:"dict"`
+	}
+	var p infoPlist
+	if err := xml.Unmarshal(data, &p); err != nil {
+		return diskutilInfoFields{}, err
+	}
+	var out diskutilInfoFields
+	if s, ok := p.Dict.Get("MediaName").(string); ok {
+		out.MediaName = s
+	}
+	if s, ok := p.Dict.Get("DeviceModel").(string); ok {
+		out.Model = s
+	} else if s, ok := p.Dict.Get("IORegistryEntryName").(string); ok {
+		out.Model = s
+	}
+	if i, ok := p.Dict.Get("Size").(int64); ok {
+		out.Size = i
+	} else if i, ok := p.Dict.Get("TotalSize").(int64); ok {
+		out.Size = i
+	}
+	if s, ok := p.Dict.Get("ParentWholeDisk").(string); ok {
+		out.ParentWholeDisk = s
+	}
+	if arr, ok := p.Dict.Get("APFSPhysicalStores").(plistArray); ok {
+		// The key inside each entry is APFSPhysicalStore (singular) on
+		// macOS 14+; older releases may use DeviceIdentifier. Accept
+		// either.
+		for _, v := range arr {
+			d, ok := v.(plistDict)
+			if !ok {
+				continue
+			}
+			if id, ok := d.Get("APFSPhysicalStore").(string); ok {
+				out.APFSPhysicalStores = append(out.APFSPhysicalStores, id)
+			} else if id, ok := d.Get("DeviceIdentifier").(string); ok {
+				out.APFSPhysicalStores = append(out.APFSPhysicalStores, id)
+			}
+		}
+	}
+	return out, nil
+}
+
+// plistDict and plistArray support unmarshaling a small subset of Apple
+// XML plists. They preserve key order and decode <string>, <integer>,
+// <true>, <false>, <array>, and nested <dict> elements.
+type plistDict []plistEntry
+
+type plistEntry struct {
+	Key   string
+	Value any
+}
+
+type plistArray []any
+
+// Get returns the value for a top-level key, or nil if absent.
+func (d plistDict) Get(key string) any {
+	for _, e := range d {
+		if e.Key == key {
+			return e.Value
+		}
+	}
+	return nil
+}
+
+// UnmarshalXML decodes the children of a <dict> element as alternating
+// <key>...</key> and value elements.
+func (d *plistDict) UnmarshalXML(dec *xml.Decoder, start xml.StartElement) error {
+	for {
+		tok, err := dec.Token()
+		if err != nil {
+			return err
+		}
+		switch t := tok.(type) {
+		case xml.EndElement:
+			if t.Name == start.Name {
+				return nil
+			}
+		case xml.StartElement:
+			if t.Name.Local != "key" {
+				return fmt.Errorf("dict child %q is not <key>", t.Name.Local)
+			}
+			var key string
+			if err := dec.DecodeElement(&key, &t); err != nil {
+				return err
+			}
+			vtok, err := nextStart(dec)
+			if err != nil {
+				return err
+			}
+			v, err := decodePlistValue(dec, vtok)
+			if err != nil {
+				return err
+			}
+			*d = append(*d, plistEntry{Key: key, Value: v})
+		}
+	}
+}
+
+func nextStart(dec *xml.Decoder) (xml.StartElement, error) {
+	for {
+		tok, err := dec.Token()
+		if err != nil {
+			return xml.StartElement{}, err
+		}
+		if s, ok := tok.(xml.StartElement); ok {
+			return s, nil
+		}
+	}
+}
+
+func decodePlistValue(dec *xml.Decoder, start xml.StartElement) (any, error) {
+	switch start.Name.Local {
+	case "string":
+		var s string
+		if err := dec.DecodeElement(&s, &start); err != nil {
+			return nil, err
+		}
+		return s, nil
+	case "integer":
+		var s string
+		if err := dec.DecodeElement(&s, &start); err != nil {
+			return nil, err
+		}
+		var i int64
+		fmt.Sscan(strings.TrimSpace(s), &i)
+		return i, nil
+	case "true":
+		return true, dec.Skip()
+	case "false":
+		return false, dec.Skip()
+	case "array":
+		var arr plistArray
+		for {
+			tok, err := dec.Token()
+			if err != nil {
+				return nil, err
+			}
+			switch t := tok.(type) {
+			case xml.EndElement:
+				if t.Name == start.Name {
+					return arr, nil
+				}
+			case xml.StartElement:
+				v, err := decodePlistValue(dec, t)
+				if err != nil {
+					return nil, err
+				}
+				arr = append(arr, v)
+			}
+		}
+	case "dict":
+		var d plistDict
+		if err := d.UnmarshalXML(dec, start); err != nil {
+			return nil, err
+		}
+		return d, nil
+	default:
+		return nil, dec.Skip()
+	}
+}
diff --git a/cmd/tailscale/cli/configure-flash-appliance_darwin_test.go b/cmd/tailscale/cli/configure-flash-appliance_darwin_test.go
new file mode 100644
index 000000000..c82754dff
--- /dev/null
+++ b/cmd/tailscale/cli/configure-flash-appliance_darwin_test.go
@@ -0,0 +1,98 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !ts_omit_flashappliance
+
+package cli
+
+import "testing"
+
+const diskutilListSample = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>AllDisks</key>
+	<array>
+		<string>disk4</string>
+		<string>disk4s1</string>
+	</array>
+	<key>WholeDisks</key>
+	<array>
+		<string>disk4</string>
+	</array>
+</dict>
+</plist>`
+
+const diskutilInfoSample = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>DeviceIdentifier</key>
+	<string>disk4</string>
+	<key>DeviceModel</key>
+	<string>Generic STORAGE DEVICE</string>
+	<key>MediaName</key>
+	<string>Generic STORAGE DEVICE Media</string>
+	<key>Size</key>
+	<integer>62512365568</integer>
+	<key>Removable</key>
+	<true/>
+</dict>
+</plist>`
+
+const diskutilInfoRootSample = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>DeviceIdentifier</key>
+	<string>disk3s1s1</string>
+	<key>ParentWholeDisk</key>
+	<string>disk3</string>
+	<key>APFSPhysicalStores</key>
+	<array>
+		<dict>
+			<key>APFSPhysicalStore</key>
+			<string>disk0s2</string>
+		</dict>
+	</array>
+</dict>
+</plist>`
+
+func TestParseDiskutilListPlist(t *testing.T) {
+	ids, err := parseDiskutilListPlist([]byte(diskutilListSample))
+	if err != nil {
+		t.Fatalf("parseDiskutilListPlist: %v", err)
+	}
+	if len(ids) != 1 || ids[0] != "disk4" {
+		t.Errorf("ids = %v; want [disk4]", ids)
+	}
+}
+
+func TestParseDiskutilInfoPlist(t *testing.T) {
+	info, err := parseDiskutilInfoPlist([]byte(diskutilInfoSample))
+	if err != nil {
+		t.Fatalf("parseDiskutilInfoPlist: %v", err)
+	}
+	if info.Model != "Generic STORAGE DEVICE" {
+		t.Errorf("Model = %q; want %q", info.Model, "Generic STORAGE DEVICE")
+	}
+	if info.MediaName != "Generic STORAGE DEVICE Media" {
+		t.Errorf("MediaName = %q", info.MediaName)
+	}
+	if info.Size != 62512365568 {
+		t.Errorf("Size = %d; want 62512365568", info.Size)
+	}
+}
+
+func TestParseDiskutilInfoPlistRoot(t *testing.T) {
+	info, err := parseDiskutilInfoPlist([]byte(diskutilInfoRootSample))
+	if err != nil {
+		t.Fatalf("parseDiskutilInfoPlist: %v", err)
+	}
+	if info.ParentWholeDisk != "disk3" {
+		t.Errorf("ParentWholeDisk = %q; want disk3", info.ParentWholeDisk)
+	}
+	if len(info.APFSPhysicalStores) != 1 || info.APFSPhysicalStores[0] != "disk0s2" {
+		t.Errorf("APFSPhysicalStores = %v; want [disk0s2]", info.APFSPhysicalStores)
+	}
+}
diff --git a/cmd/tailscale/cli/configure-flash-appliance_linux.go b/cmd/tailscale/cli/configure-flash-appliance_linux.go
new file mode 100644
index 000000000..987447ea6
--- /dev/null
+++ b/cmd/tailscale/cli/configure-flash-appliance_linux.go
@@ -0,0 +1,150 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !ts_omit_flashappliance
+
+package cli
+
+import (
+	"bufio"
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"strings"
+
+	"golang.org/x/sys/unix"
+)
+
+// discoverExternalDisks returns no disks on Linux: the user must pass
+// --disk=/dev/sdX. We don't try to enumerate removable disks here because
+// the right answer depends heavily on the host (servers don't have
+// removable media; Pi-on-Pi flashing has no notion of "external"; LVM
+// setups have arbitrary names).
+func discoverExternalDisks(_ context.Context) ([]diskCandidate, error) {
+	return nil, errors.New("on Linux, pass --disk=/dev/sdX (auto-discovery is macOS-only)")
+}
+
+// validateDiskPath rejects partition paths, the running root disk, and
+// disks with any partition currently mounted.
+func validateDiskPath(path string) error {
+	if !strings.HasPrefix(path, "/dev/") {
+		return fmt.Errorf("disk path %q must start with /dev/", path)
+	}
+	if isPartitionPath(path) {
+		return fmt.Errorf("disk path %q looks like a partition; pass the whole disk", path)
+	}
+	fi, err := os.Stat(path)
+	if err != nil {
+		return fmt.Errorf("stat %s: %w", path, err)
+	}
+	if fi.Mode()&os.ModeDevice == 0 {
+		return fmt.Errorf("%s is not a device file", path)
+	}
+	mounts, err := mountedSources()
+	if err != nil {
+		return err
+	}
+	for _, m := range mounts {
+		if m == path || strings.HasPrefix(m, path) {
+			return fmt.Errorf("%s (or one of its partitions) is currently mounted; unmount it first", path)
+		}
+	}
+	return nil
+}
+
+// isPartitionPath reports whether path looks like a partition (e.g.
+// /dev/sda1, /dev/nvme0n1p2, /dev/mmcblk0p1) rather than a whole disk.
+func isPartitionPath(path string) bool {
+	base := strings.TrimPrefix(path, "/dev/")
+	switch {
+	case strings.HasPrefix(base, "sd"), strings.HasPrefix(base, "hd"), strings.HasPrefix(base, "vd"):
+		// /dev/sdaN — partition.
+		if len(base) >= 4 && base[len(base)-1] >= '0' && base[len(base)-1] <= '9' {
+			return true
+		}
+	case strings.HasPrefix(base, "nvme"), strings.HasPrefix(base, "mmcblk"), strings.HasPrefix(base, "loop"):
+		// /dev/nvme0n1p1 — partition is "<diskname>p<digits>". The 'p'
+		// must follow a digit (to distinguish loop0 from loop0p1).
+		i := strings.LastIndexByte(base, 'p')
+		if i <= 0 || i >= len(base)-1 || base[i-1] < '0' || base[i-1] > '9' {
+			return false
+		}
+		for _, r := range base[i+1:] {
+			if r < '0' || r > '9' {
+				return false
+			}
+		}
+		return true
+	}
+	return false
+}
+
+// mountedSources returns the source device paths from /proc/mounts.
+func mountedSources() ([]string, error) {
+	f, err := os.Open("/proc/mounts")
+	if err != nil {
+		return nil, err
+	}
+	defer f.Close()
+	var out []string
+	sc := bufio.NewScanner(f)
+	for sc.Scan() {
+		fields := strings.Fields(sc.Text())
+		if len(fields) > 0 {
+			out = append(out, fields[0])
+		}
+	}
+	return out, sc.Err()
+}
+
+// unmountDisk unmounts every entry in /proc/mounts whose source starts with
+// path (covers /dev/sdb plus /dev/sdb1, /dev/sdb2, ...).
+func unmountDisk(ctx context.Context, path string) error {
+	mounts, err := mountedSources()
+	if err != nil {
+		return err
+	}
+	for _, m := range mounts {
+		if m == path || strings.HasPrefix(m, path) {
+			cmd := exec.CommandContext(ctx, "umount", m)
+			cmd.Stdout = Stderr
+			cmd.Stderr = Stderr
+			if err := cmd.Run(); err != nil {
+				return fmt.Errorf("umount %s: %w", m, err)
+			}
+		}
+	}
+	return nil
+}
+
+func openBlockDevice(path string) (*os.File, error) {
+	return os.OpenFile(path, os.O_WRONLY|unix.O_SYNC, 0)
+}
+
+// rereadPartitionTable asks the kernel to re-scan the partition table on
+// the open block device. Required on Linux before we can mkfs the perm
+// partition we just wrote.
+func rereadPartitionTable(f *os.File) error {
+	return unix.IoctlSetInt(int(f.Fd()), unix.BLKRRPART, 0)
+}
+
+// syncBlockDevice flushes pending writes to disk.
+func syncBlockDevice(f *os.File) error { return f.Sync() }
+
+// ejectDisk is a no-op on Linux; the user just pulls the disk after
+// the sync at the end of writeGAFToDisk. Returns false so the success
+// message instructs the user to eject themselves.
+func ejectDisk(_ context.Context, _ string) (bool, error) { return false, nil }
+
+// blockDeviceSize returns the size in bytes of the open block device f.
+// BLKGETSIZE64 returns a uint64; on 64-bit linux IoctlGetInt's int is wide
+// enough to receive it without needing an unsafe.Pointer.
+func blockDeviceSize(f *os.File) (int64, error) {
+	size, err := unix.IoctlGetInt(int(f.Fd()), unix.BLKGETSIZE64)
+	if err != nil {
+		return 0, fmt.Errorf("BLKGETSIZE64: %w", err)
+	}
+	return int64(size), nil
+}
diff --git a/cmd/tailscale/cli/configure-flash-appliance_linux_test.go b/cmd/tailscale/cli/configure-flash-appliance_linux_test.go
new file mode 100644
index 000000000..7da5c064b
--- /dev/null
+++ b/cmd/tailscale/cli/configure-flash-appliance_linux_test.go
@@ -0,0 +1,35 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !ts_omit_flashappliance
+
+package cli
+
+import "testing"
+
+func TestIsPartitionPath(t *testing.T) {
+	tests := []struct {
+		path string
+		want bool
+	}{
+		{"/dev/sda", false},
+		{"/dev/sda1", true},
+		{"/dev/sdb", false},
+		{"/dev/sdb4", true},
+		{"/dev/sdz9", true},
+		{"/dev/vdb", false},
+		{"/dev/vdb1", true},
+		{"/dev/nvme0n1", false},
+		{"/dev/nvme0n1p1", true},
+		{"/dev/nvme0n1p4", true},
+		{"/dev/mmcblk0", false},
+		{"/dev/mmcblk0p1", true},
+		{"/dev/loop0", false},
+		{"/dev/loop0p1", true},
+	}
+	for _, tt := range tests {
+		if got := isPartitionPath(tt.path); got != tt.want {
+			t.Errorf("isPartitionPath(%q) = %v; want %v", tt.path, got, tt.want)
+		}
+	}
+}
diff --git a/cmd/tailscale/cli/configure-flash-appliance_omit.go b/cmd/tailscale/cli/configure-flash-appliance_omit.go
new file mode 100644
index 000000000..903fe2ac4
--- /dev/null
+++ b/cmd/tailscale/cli/configure-flash-appliance_omit.go
@@ -0,0 +1,13 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build ts_omit_flashappliance
+
+package cli
+
+import "github.com/peterbourgon/ff/v3/ffcli"
+
+func flashApplianceCmd() *ffcli.Command {
+	// Omitted from the build when the ts_omit_flashappliance build tag is set.
+	return nil
+}
diff --git a/cmd/tailscale/cli/configure-flash-appliance_other.go b/cmd/tailscale/cli/configure-flash-appliance_other.go
new file mode 100644
index 000000000..2253f69e7
--- /dev/null
+++ b/cmd/tailscale/cli/configure-flash-appliance_other.go
@@ -0,0 +1,39 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !ts_omit_flashappliance && !linux && !darwin
+
+package cli
+
+import (
+	"context"
+	"errors"
+	"os"
+	"runtime"
+)
+
+var errFlashUnsupported = errors.New("flash-appliance is only supported on linux and darwin (got " + runtime.GOOS + ")")
+
+func discoverExternalDisks(_ context.Context) ([]diskCandidate, error) {
+	return nil, errFlashUnsupported
+}
+
+func validateDiskPath(_ string) error {
+	return errFlashUnsupported
+}
+
+func unmountDisk(_ context.Context, _ string) error {
+	return errFlashUnsupported
+}
+
+func openBlockDevice(_ string) (*os.File, error) {
+	return nil, errFlashUnsupported
+}
+
+func rereadPartitionTable(_ *os.File) error { return nil }
+
+func blockDeviceSize(_ *os.File) (int64, error) { return 0, errFlashUnsupported }
+
+func syncBlockDevice(_ *os.File) error { return errFlashUnsupported }
+
+func ejectDisk(_ context.Context, _ string) (bool, error) { return false, errFlashUnsupported }
diff --git a/cmd/tailscale/cli/configure-flash-appliance_test.go b/cmd/tailscale/cli/configure-flash-appliance_test.go
new file mode 100644
index 000000000..9a1fd9a7b
--- /dev/null
+++ b/cmd/tailscale/cli/configure-flash-appliance_test.go
@@ -0,0 +1,54 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !ts_omit_flashappliance
+
+package cli
+
+import (
+	"archive/zip"
+	"bytes"
+	"testing"
+)
+
+func TestCheckPartitionFits(t *testing.T) {
+	files := buildZip(t, map[string][]byte{
+		"boot.img": bytes.Repeat([]byte{0xAB}, 1<<20),
+		"root.img": bytes.Repeat([]byte{0xCD}, 4<<20),
+	})
+
+	if err := checkPartitionFits(files, "boot.img", 2<<20); err != nil {
+		t.Errorf("boot.img within limit: %v", err)
+	}
+	if err := checkPartitionFits(files, "root.img", 1<<20); err == nil {
+		t.Errorf("root.img over limit: expected error")
+	}
+	if err := checkPartitionFits(files, "missing.img", 1<<20); err == nil {
+		t.Errorf("missing file: expected error")
+	}
+}
+
+// buildZip returns the *zip.File entries for an in-memory zip containing
+// the given members.
+func buildZip(t *testing.T, members map[string][]byte) []*zip.File {
+	t.Helper()
+	var buf bytes.Buffer
+	zw := zip.NewWriter(&buf)
+	for name, data := range members {
+		w, err := zw.Create(name)
+		if err != nil {
+			t.Fatalf("zip.Create %s: %v", name, err)
+		}
+		if _, err := w.Write(data); err != nil {
+			t.Fatalf("zip.Write %s: %v", name, err)
+		}
+	}
+	if err := zw.Close(); err != nil {
+		t.Fatalf("zip.Close: %v", err)
+	}
+	zr, err := zip.NewReader(bytes.NewReader(buf.Bytes()), int64(buf.Len()))
+	if err != nil {
+		t.Fatalf("zip.NewReader: %v", err)
+	}
+	return zr.File
+}
diff --git a/cmd/tailscale/cli/configure-kube.go b/cmd/tailscale/cli/configure-kube.go
index 3dcec250f..e2ef6becf 100644
--- a/cmd/tailscale/cli/configure-kube.go
+++ b/cmd/tailscale/cli/configure-kube.go
@@ -20,10 +20,8 @@ import (
 	"github.com/peterbourgon/ff/v3/ffcli"
 	"k8s.io/client-go/util/homedir"
 	"sigs.k8s.io/yaml"
-	"tailscale.com/ipn"
 	"tailscale.com/ipn/ipnstate"
 	"tailscale.com/tailcfg"
-	"tailscale.com/types/netmap"
 	"tailscale.com/util/dnsname"
 	"tailscale.com/version"
 )
@@ -46,7 +44,7 @@ See: https://tailscale.com/s/k8s-auth-proxy
 `),
 		FlagSet: (func() *flag.FlagSet {
 			fs := newFlagSet("kubeconfig")
-			fs.BoolVar(&configureKubeconfigArgs.http, "http", false, "Use HTTP instead of HTTPS to connect to the auth proxy. Ignored if you include a scheme in the hostname argument.")
+			fs.BoolVar(&configureKubeconfigArgs.http, "http", false, "use HTTP instead of HTTPS to connect to the auth proxy. Ignored if you include a scheme in the hostname argument.")
 			return fs
 		})(),
 		Exec: runConfigureKubeconfig,
@@ -54,18 +52,15 @@ See: https://tailscale.com/s/k8s-auth-proxy
 }
 
 // kubeconfigPath returns the path to the kubeconfig file for the current user.
-func kubeconfigPath() (string, error) {
+func kubeconfigPath() string {
 	if kubeconfig := os.Getenv("KUBECONFIG"); kubeconfig != "" {
-		if version.IsSandboxedMacOS() {
-			return "", errors.New("cannot read $KUBECONFIG on GUI builds of the macOS client: this requires the open-source tailscaled distribution")
-		}
 		var out string
 		for _, out = range filepath.SplitList(kubeconfig) {
 			if info, err := os.Stat(out); !os.IsNotExist(err) && !info.IsDir() {
 				break
 			}
 		}
-		return out, nil
+		return out
 	}
 
 	var dir string
@@ -79,7 +74,64 @@ func kubeconfigPath() (string, error) {
 	} else {
 		dir = homedir.HomeDir()
 	}
-	return filepath.Join(dir, ".kube", "config"), nil
+	return filepath.Join(dir, ".kube", "config")
+}
+
+// checkKubeconfigWritable returns nil if the kubeconfig at path can be written,
+// or an error explaining why it can't. A not-yet-created file or .kube
+// directory is fine as long as the nearest existing ancestor is writable.
+//
+// On sandboxed macOS builds, kubeconfigPath resolves path to the user's real
+// ~/.kube/config, which we can only write via the home-relative-path
+// entitlement. If that write would fail (e.g. because $KUBECONFIG points
+// somewhere the sandbox can't reach), we want to surface a clear error pointing
+// at the open-source tailscaled distribution rather than silently writing a
+// config the user's kubectl will never read into the sandbox container.
+func checkKubeconfigWritable(path string) error {
+	for try := path; ; try = filepath.Dir(try) {
+		if _, err := os.Stat(try); err == nil {
+			if err := isWritable(try); err != nil {
+				return kubeconfigAccessErr(path, err)
+			}
+			return nil
+		} else if !os.IsNotExist(err) {
+			return kubeconfigAccessErr(path, err)
+		}
+		if parent := filepath.Dir(try); parent == try {
+			return nil // reached the filesystem root
+		}
+	}
+}
+
+// isWritable reports whether path can be opened or created for writing. For a
+// directory it probes by creating and removing a temporary file.
+func isWritable(path string) error {
+	fi, err := os.Stat(path)
+	if err != nil {
+		return err
+	}
+	if fi.IsDir() {
+		f, err := os.CreateTemp(path, ".tailscale-kubeconfig-*")
+		if err != nil {
+			return err
+		}
+		f.Close()
+		return os.Remove(f.Name())
+	}
+	f, err := os.OpenFile(path, os.O_WRONLY, 0)
+	if err != nil {
+		return err
+	}
+	return f.Close()
+}
+
+// kubeconfigAccessErr wraps err with context about path, adding macOS sandbox
+// guidance when the process is sandboxed.
+func kubeconfigAccessErr(path string, err error) error {
+	if version.IsSandboxedMacOS() {
+		return fmt.Errorf("cannot write kubeconfig at %q: %w; GUI builds of the macOS client run in a sandbox and can only access files under your home directory, use the open-source tailscaled distribution for other locations", path, err)
+	}
+	return fmt.Errorf("cannot write kubeconfig at %q: %w", path, err)
 }
 
 func runConfigureKubeconfig(ctx context.Context, args []string) error {
@@ -98,18 +150,18 @@ func runConfigureKubeconfig(ctx context.Context, args []string) error {
 	if st.BackendState != "Running" {
 		return errors.New("Tailscale is not running")
 	}
-	nm, err := getNetMap(ctx)
+	dnsCfg, err := getDNSConfig(ctx)
 	if err != nil {
 		return err
 	}
 
-	targetFQDN, err := nodeOrServiceDNSNameFromArg(st, nm, hostOrFQDNOrIP)
+	targetFQDN, err := nodeOrServiceDNSNameFromArg(st, dnsCfg, hostOrFQDNOrIP)
 	if err != nil {
 		return err
 	}
 	targetFQDN = strings.TrimSuffix(targetFQDN, ".")
-	var kubeconfig string
-	if kubeconfig, err = kubeconfigPath(); err != nil {
+	kubeconfig := kubeconfigPath()
+	if err := checkKubeconfigWritable(kubeconfig); err != nil {
 		return err
 	}
 	scheme := "https://"
@@ -217,13 +269,8 @@ func setKubeconfigForPeer(scheme, fqdn, filePath string) error {
 		if !os.IsNotExist(err) {
 			return err
 		}
-		if err := os.Mkdir(dir, 0755); err != nil {
-			if version.IsSandboxedMacOS() && errors.Is(err, os.ErrPermission) {
-				// macOS sandboxing prevents us from creating the .kube directory
-				// in the home directory.
-				return errors.New("unable to create .kube directory in home directory, please create it manually (e.g. mkdir ~/.kube")
-			}
-			return err
+		if err := os.MkdirAll(dir, 0755); err != nil {
+			return kubeconfigAccessErr(filePath, err)
 		}
 	}
 	b, err := os.ReadFile(filePath)
@@ -240,14 +287,14 @@ func setKubeconfigForPeer(scheme, fqdn, filePath string) error {
 // nodeOrServiceDNSNameFromArg returns the PeerStatus.DNSName value from a peer
 // in st that matches the input arg which can be a base name, full DNS name, or
 // an IP. If none is found, it looks for a Tailscale Service
-func nodeOrServiceDNSNameFromArg(st *ipnstate.Status, nm *netmap.NetworkMap, arg string) (string, error) {
+func nodeOrServiceDNSNameFromArg(st *ipnstate.Status, dns *tailcfg.DNSConfig, arg string) (string, error) {
 	// First check for a node DNS name.
 	if dnsName, ok := nodeDNSNameFromArg(st, arg); ok {
 		return dnsName, nil
 	}
 
 	// If not found, check for a Tailscale Service DNS name.
-	rec, ok := serviceDNSRecordFromNetMap(nm, arg)
+	rec, ok := serviceDNSRecordFromDNSConfig(dns, arg)
 	if !ok {
 		return "", fmt.Errorf("no peer found for %q", arg)
 	}
@@ -259,6 +306,11 @@ func nodeOrServiceDNSNameFromArg(st *ipnstate.Status, nm *netmap.NetworkMap, arg
 	}
 	ipPrefix := netip.PrefixFrom(ip, ip.BitLen())
 	for _, ps := range st.Peer {
+		if ps.AllowedIPs == nil {
+			// Peer with no addresses visible in the tailnet, e.g. a ProxyGroup
+			// whose backing nodes are offline or not yet approved (#20255).
+			continue
+		}
 		for _, allowedIP := range ps.AllowedIPs.All() {
 			if allowedIP == ipPrefix {
 				return rec.Name, nil
@@ -269,25 +321,13 @@ func nodeOrServiceDNSNameFromArg(st *ipnstate.Status, nm *netmap.NetworkMap, arg
 	return "", fmt.Errorf("%q is in MagicDNS, but is not currently reachable on any known peer", arg)
 }
 
-func getNetMap(ctx context.Context) (*netmap.NetworkMap, error) {
+func getDNSConfig(ctx context.Context) (*tailcfg.DNSConfig, error) {
 	ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
 	defer cancel()
-
-	watcher, err := localClient.WatchIPNBus(ctx, ipn.NotifyInitialNetMap)
-	if err != nil {
-		return nil, err
-	}
-	defer watcher.Close()
-
-	n, err := watcher.Next()
-	if err != nil {
-		return nil, err
-	}
-
-	return n.NetMap, nil
+	return localClient.DNSConfig(ctx)
 }
 
-func serviceDNSRecordFromNetMap(nm *netmap.NetworkMap, arg string) (rec tailcfg.DNSRecord, ok bool) {
+func serviceDNSRecordFromDNSConfig(dns *tailcfg.DNSConfig, arg string) (rec tailcfg.DNSRecord, ok bool) {
 	argIP, _ := netip.ParseAddr(arg)
 	argFQDN, err := dnsname.ToFQDN(arg)
 	argFQDNValid := err == nil
@@ -295,7 +335,7 @@ func serviceDNSRecordFromNetMap(nm *netmap.NetworkMap, arg string) (rec tailcfg.
 		return rec, false
 	}
 
-	for _, rec := range nm.DNS.ExtraRecords {
+	for _, rec := range dns.ExtraRecords {
 		if argIP.IsValid() {
 			recIP, _ := netip.ParseAddr(rec.Value)
 			if recIP == argIP {
diff --git a/cmd/tailscale/cli/configure-kube_test.go b/cmd/tailscale/cli/configure-kube_test.go
index 2c2a05ac0..45ab7f542 100644
--- a/cmd/tailscale/cli/configure-kube_test.go
+++ b/cmd/tailscale/cli/configure-kube_test.go
@@ -7,10 +7,18 @@ package cli
 import (
 	"bytes"
 	"fmt"
+	"net/netip"
+	"os"
+	"path/filepath"
+	"runtime"
 	"strings"
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
+	"tailscale.com/ipn/ipnstate"
+	"tailscale.com/tailcfg"
+	"tailscale.com/types/key"
+	"tailscale.com/types/views"
 )
 
 func TestKubeconfig(t *testing.T) {
@@ -247,6 +255,69 @@ users:
 	}
 }
 
+func TestCheckKubeconfigWritable(t *testing.T) {
+	t.Run("nonexistent-file-in-writable-dir", func(t *testing.T) {
+		dir := t.TempDir()
+		if err := checkKubeconfigWritable(filepath.Join(dir, "config")); err != nil {
+			t.Errorf("unexpected error: %v", err)
+		}
+	})
+
+	t.Run("nonexistent-file-and-dir-in-writable-parent", func(t *testing.T) {
+		dir := t.TempDir()
+		// The .kube directory does not exist yet, but its parent does and is
+		// writable, so this should be fine.
+		if err := checkKubeconfigWritable(filepath.Join(dir, ".kube", "config")); err != nil {
+			t.Errorf("unexpected error: %v", err)
+		}
+	})
+
+	t.Run("existing-writable-file", func(t *testing.T) {
+		dir := t.TempDir()
+		path := filepath.Join(dir, "config")
+		if err := os.WriteFile(path, []byte("apiVersion: v1\nkind: Config\n"), 0600); err != nil {
+			t.Fatal(err)
+		}
+		if err := checkKubeconfigWritable(path); err != nil {
+			t.Errorf("unexpected error: %v", err)
+		}
+	})
+
+	t.Run("unwritable-existing-file", func(t *testing.T) {
+		if runtime.GOOS == "windows" {
+			t.Skip("file mode permissions are not enforced the same way on Windows")
+		}
+		if os.Getuid() == 0 {
+			t.Skip("root bypasses file permission checks")
+		}
+		dir := t.TempDir()
+		path := filepath.Join(dir, "config")
+		if err := os.WriteFile(path, []byte("x"), 0400); err != nil {
+			t.Fatal(err)
+		}
+		if err := checkKubeconfigWritable(path); err == nil {
+			t.Error("expected error for read-only file, got nil")
+		}
+	})
+
+	t.Run("unwritable-dir", func(t *testing.T) {
+		if runtime.GOOS == "windows" {
+			t.Skip("directory mode permissions are not enforced the same way on Windows")
+		}
+		if os.Getuid() == 0 {
+			t.Skip("root bypasses directory permission checks")
+		}
+		dir := t.TempDir()
+		sub := filepath.Join(dir, "ro")
+		if err := os.Mkdir(sub, 0500); err != nil {
+			t.Fatal(err)
+		}
+		if err := checkKubeconfigWritable(filepath.Join(sub, "config")); err == nil {
+			t.Error("expected error for unwritable dir, got nil")
+		}
+	})
+}
+
 func TestGetInputs(t *testing.T) {
 	for _, arg := range []string{
 		"foo.tail-scale.ts.net",
@@ -273,3 +344,68 @@ func TestGetInputs(t *testing.T) {
 		}
 	}
 }
+
+func TestNodeOrServiceDNSNameFromArg(t *testing.T) {
+	svcIP := netip.MustParseAddr("100.100.100.100")
+	dnsCfg := &tailcfg.DNSConfig{
+		ExtraRecords: []tailcfg.DNSRecord{
+			{Name: "svc.example.ts.net", Value: svcIP.String()},
+		},
+	}
+
+	peerWithService := &ipnstate.PeerStatus{DNSName: "node-a.example.ts.net."}
+	allowed := views.SliceOf([]netip.Prefix{netip.PrefixFrom(svcIP, svcIP.BitLen())})
+	peerWithService.AllowedIPs = &allowed
+
+	// A peer with no AllowedIPs, as reported for a ProxyGroup whose backing
+	// nodes are offline or not yet approved (issue #20255).
+	peerNoAddrs := &ipnstate.PeerStatus{DNSName: "node-b.example.ts.net."}
+
+	tests := []struct {
+		name    string
+		peers   []*ipnstate.PeerStatus
+		arg     string
+		want    string
+		wantErr string
+	}{
+		{
+			name:    "service_with_no_reachable_peer",
+			peers:   []*ipnstate.PeerStatus{peerNoAddrs},
+			arg:     "svc",
+			wantErr: "not currently reachable",
+		},
+		{
+			name:  "service_advertised_by_peer",
+			peers: []*ipnstate.PeerStatus{peerNoAddrs, peerWithService},
+			arg:   "svc",
+			want:  "svc.example.ts.net",
+		},
+		{
+			name:  "node_dns_name",
+			peers: []*ipnstate.PeerStatus{peerNoAddrs},
+			arg:   "node-b",
+			want:  "node-b.example.ts.net.",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			st := &ipnstate.Status{Peer: map[key.NodePublic]*ipnstate.PeerStatus{}}
+			for _, ps := range tt.peers {
+				st.Peer[key.NewNode().Public()] = ps
+			}
+			got, err := nodeOrServiceDNSNameFromArg(st, dnsCfg, tt.arg)
+			if tt.wantErr != "" {
+				if err == nil || !strings.Contains(err.Error(), tt.wantErr) {
+					t.Fatalf("err = %v, want error containing %q", err, tt.wantErr)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatal(err)
+			}
+			if got != tt.want {
+				t.Errorf("got %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
diff --git a/cmd/tailscale/cli/configure-pve-appliance.go b/cmd/tailscale/cli/configure-pve-appliance.go
new file mode 100644
index 000000000..17656ebb1
--- /dev/null
+++ b/cmd/tailscale/cli/configure-pve-appliance.go
@@ -0,0 +1,413 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !ts_omit_flashappliance
+
+package cli
+
+import (
+	"archive/zip"
+	"context"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"os"
+	"os/exec"
+	"runtime"
+	"strconv"
+	"strings"
+
+	"github.com/peterbourgon/ff/v3/ffcli"
+	"tailscale.com/clientupdate"
+	"tailscale.com/gokrazy/mkfs"
+	"tailscale.com/util/prompt"
+)
+
+var pveApplianceArgs struct {
+	vmid                 int
+	name                 string
+	storage              string
+	diskSize             string
+	cores                int
+	memory               int
+	bridge               string
+	variant              string
+	track                string
+	gaf                  string
+	addSSHAuthorizedKeys string
+	start                bool
+	yes                  bool
+}
+
+func pveApplianceCmd() *ffcli.Command {
+	return &ffcli.Command{
+		Name:       "pve-appliance",
+		ShortUsage: "tailscale configure pve-appliance --storage=<name> [flags]",
+		ShortHelp:  "Create a Proxmox VE VM running the Tailscale appliance image [experimental]",
+		LongHelp: hidden + strings.TrimSpace(`
+This experimental command downloads a signed Tailscale appliance GAF from
+pkgs.tailscale.com, builds a raw disk image in /var/tmp, then invokes
+'qm create' / 'qm disk import' / 'qm set' on the local Proxmox VE host to
+create a new VM backed by that image. It must be run on the PVE host
+itself (where the 'qm' CLI is available).
+
+The imported disk is attached as scsi0 on a virtio-scsi-single controller
+with iothread, the network attaches to the given bridge (default vmbr0),
+and the guest agent is enabled — pair with the appliance's built-in
+qemu-guest-kragent so PVE can see the guest's IPs.
+
+The VM is created with a virtio-serial console (--serial0 socket). Once
+the VM is running, 'qm terminal <vmid>' on the PVE host — then press
+Enter — drops you into a busybox shell inside the appliance without
+needing an SSH key.
+
+Defaults are chosen so a bare invocation like:
+
+    tailscale configure pve-appliance --storage=local-lvm
+
+is enough to produce a bootable Tailscale appliance VM.
+`),
+		FlagSet: (func() *flag.FlagSet {
+			fs := newFlagSet("pve-appliance")
+			fs.IntVar(&pveApplianceArgs.vmid, "vmid", 0, "target VM ID; 0 asks Proxmox for the next available ID")
+			fs.StringVar(&pveApplianceArgs.name, "name", "", `VM name; defaults to "tsapp-<vmid>"`)
+			fs.StringVar(&pveApplianceArgs.storage, "storage", "", "PVE storage to import the disk into (e.g. local-lvm, ssd2); required")
+			fs.StringVar(&pveApplianceArgs.diskSize, "disk-size", "4G", "raw image size (accepts K/M/G suffixes, e.g. 4G, 8192M)")
+			fs.IntVar(&pveApplianceArgs.cores, "cores", 2, "vCPU cores")
+			fs.IntVar(&pveApplianceArgs.memory, "memory", 1024, "memory in MiB")
+			fs.StringVar(&pveApplianceArgs.bridge, "bridge", "vmbr0", "network bridge to attach virtio net0 to")
+			fs.StringVar(&pveApplianceArgs.variant, "variant", "vm-amd64", `appliance variant: "vm-amd64" or "vm-arm64"`)
+			fs.StringVar(&pveApplianceArgs.track, "track", "", `which track to download from; defaults to "`+clientupdate.CurrentTrack+`"`)
+			fs.StringVar(&pveApplianceArgs.gaf, "gaf", "", "use a local GAF file instead of downloading (skips signature verification)")
+			fs.StringVar(&pveApplianceArgs.addSSHAuthorizedKeys, "add-ssh-authorized-keys", "", "path to an authorized_keys file to include on the appliance for breakglass SSH access")
+			fs.BoolVar(&pveApplianceArgs.start, "start", true, "start the VM after import")
+			fs.BoolVar(&pveApplianceArgs.yes, "yes", false, "skip the confirmation prompt")
+			return fs
+		})(),
+		Exec: runPVEAppliance,
+	}
+}
+
+func runPVEAppliance(ctx context.Context, args []string) error {
+	if len(args) > 0 {
+		return errors.New("unknown arguments")
+	}
+	if runtime.GOOS != "linux" {
+		return errors.New("the pve-appliance subcommand is only available on Linux; for use on Proxmox PVE hosts")
+	}
+	if fi, err := os.Stat("/etc/pve"); err != nil || !fi.IsDir() {
+		return errors.New("/etc/pve is not a directory: run this on a Proxmox VE host")
+	}
+	if _, err := exec.LookPath("qm"); err != nil {
+		return errors.New("`qm` not found in $PATH: run this on the Proxmox VE host")
+	}
+	if pveApplianceArgs.storage == "" {
+		return errors.New("--storage is required (e.g. --storage=local-lvm)")
+	}
+
+	diskBytes, err := parseSizeBytes(pveApplianceArgs.diskSize)
+	if err != nil {
+		return fmt.Errorf("parsing --disk-size: %w", err)
+	}
+
+	vmid := pveApplianceArgs.vmid
+	if vmid == 0 {
+		vmid, err = pveNextID(ctx)
+		if err != nil {
+			return fmt.Errorf("fetching next VMID: %w", err)
+		}
+	}
+	name := pveApplianceArgs.name
+	if name == "" {
+		name = fmt.Sprintf("tsapp-%d", vmid)
+	}
+
+	gafPath, gafLabel, variant, cleanup, err := obtainGAF(ctx, gafDownloadArgs{
+		localGAF: pveApplianceArgs.gaf,
+		track:    pveApplianceArgs.track,
+		variant:  pveApplianceArgs.variant,
+	})
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	if !pveApplianceArgs.yes {
+		printf("About to create Proxmox VM %d (%q) on storage %q from %s\n",
+			vmid, name, pveApplianceArgs.storage, gafLabel)
+		printf("  cores=%d memory=%dMiB bridge=%s disk=%s start=%v\n",
+			pveApplianceArgs.cores, pveApplianceArgs.memory,
+			pveApplianceArgs.bridge, pveApplianceArgs.diskSize, pveApplianceArgs.start)
+		if !prompt.YesNo("Proceed?", false) {
+			return errors.New("aborted")
+		}
+	}
+
+	imgPath, err := buildPVERawImage(gafPath, diskBytes, variant)
+	if err != nil {
+		return err
+	}
+	defer os.Remove(imgPath)
+
+	if err := createPVEVM(ctx, vmid, name); err != nil {
+		return fmt.Errorf("qm create: %w", err)
+	}
+	diskRef, err := importPVEDisk(ctx, vmid, pveApplianceArgs.storage, imgPath)
+	if err != nil {
+		return fmt.Errorf("qm disk import: %w", err)
+	}
+	if err := attachPVEDisk(ctx, vmid, diskRef); err != nil {
+		return fmt.Errorf("qm set: %w", err)
+	}
+
+	if pveApplianceArgs.start {
+		if err := runQM(ctx, "start", strconv.Itoa(vmid)); err != nil {
+			return fmt.Errorf("qm start: %w", err)
+		}
+		printf("VM %d started.\n", vmid)
+	} else {
+		printf("VM %d created; not started (pass --start to auto-start).\n", vmid)
+	}
+	return nil
+}
+
+// buildPVERawImage creates a sparse raw disk image in /var/tmp and
+// writes the GAF's boot + root images to it plus a fresh /perm ext4
+// filesystem. The returned path is the caller's to remove.
+func buildPVERawImage(gafPath string, devsize int64, variant string) (string, error) {
+	zr, err := zip.OpenReader(gafPath)
+	if err != nil {
+		return "", fmt.Errorf("open GAF: %w", err)
+	}
+	defer zr.Close()
+
+	bootCode, err := readGAFMember(zr.File, "mbr.img", 1<<20)
+	if err != nil {
+		return "", err
+	}
+
+	tmp, err := os.CreateTemp("/var/tmp", "tsapp-pve-*.raw")
+	if err != nil {
+		return "", err
+	}
+	imgPath := tmp.Name()
+	if err := tmp.Truncate(devsize); err != nil {
+		tmp.Close()
+		os.Remove(imgPath)
+		return "", fmt.Errorf("truncate: %w", err)
+	}
+
+	if err := writeApplianceImage(tmp, devsize, zr.File, bootCode, variant); err != nil {
+		tmp.Close()
+		os.Remove(imgPath)
+		return "", err
+	}
+
+	var permFiles []mkfs.PermFile
+	if k := pveApplianceArgs.addSSHAuthorizedKeys; k != "" {
+		keys, err := os.ReadFile(k)
+		if err != nil {
+			tmp.Close()
+			os.Remove(imgPath)
+			return "", fmt.Errorf("reading --add-ssh-authorized-keys: %w", err)
+		}
+		permFiles = append(permFiles, mkfs.PermFile{
+			Path:    "breakglass.authorized_keys",
+			Content: keys,
+		})
+		printf("Including SSH authorized_keys for breakglass access.\n")
+	}
+	if err := mkfs.Perm(tmp, devsize, permFiles...); err != nil {
+		tmp.Close()
+		os.Remove(imgPath)
+		return "", fmt.Errorf("formatting perm: %w", err)
+	}
+
+	if err := tmp.Sync(); err != nil {
+		tmp.Close()
+		os.Remove(imgPath)
+		return "", err
+	}
+	if err := tmp.Close(); err != nil {
+		os.Remove(imgPath)
+		return "", err
+	}
+	return imgPath, nil
+}
+
+// pveNextID asks Proxmox for the next unused VMID via pvesh.
+func pveNextID(ctx context.Context) (int, error) {
+	out, err := exec.CommandContext(ctx, "pvesh", "get", "/cluster/nextid").Output()
+	if err != nil {
+		return 0, err
+	}
+	s := strings.TrimSpace(string(out))
+	n, err := strconv.Atoi(s)
+	if err != nil {
+		return 0, fmt.Errorf("parsing pvesh output %q: %w", s, err)
+	}
+	return n, nil
+}
+
+func createPVEVM(ctx context.Context, vmid int, name string) error {
+	return runQM(ctx, "create", strconv.Itoa(vmid),
+		"--name", name,
+		"--memory", strconv.Itoa(pveApplianceArgs.memory),
+		"--cores", strconv.Itoa(pveApplianceArgs.cores),
+		"--net0", "virtio,bridge="+pveApplianceArgs.bridge,
+		"--scsihw", "virtio-scsi-single",
+		"--serial0", "socket",
+		"--agent", "1",
+		"--ostype", "l26",
+		"--tablet", "0",
+		"--vga", "virtio",
+		"--description", vmNotes(vmid),
+	)
+}
+
+// vmNotes is the description shown in the PVE web UI's "Notes" panel
+// for VMs we create. It tells admins the two ways to get into the
+// appliance without needing an SSH key: the framebuffer console (press
+// Esc for a shell) and the serial console (qm terminal).
+func vmNotes(vmid int) string {
+	return fmt.Sprintf(`# Tailscale appliance [experimental]
+
+Admin access to this VM (no SSH key required):
+
+- **Framebuffer / NoVNC console**: press **Esc** on the enrollment screen
+  to drop into a busybox shell. Type `+"`exit`"+` to return to the
+  Tailscale status display.
+
+- **Serial console**: on this Proxmox host, run
+
+      qm terminal %d
+
+  then press **Enter** to get a busybox shell. Press **Ctrl+O** to
+  detach from `+"`qm terminal`"+` (leaves the guest shell alive).
+
+Inside either shell, run `+"`tailscale`"+` commands as usual
+(`+"`tailscale up`"+`, `+"`tailscale status`"+`, etc.).
+`, vmid)
+}
+
+// importPVEDisk imports src into storage on vmid and returns the
+// Proxmox volume reference of the newly-imported disk (e.g.
+// "local-lvm:vm-102-disk-0").
+//
+// The stdout of "qm disk import" isn't a stable API across Proxmox
+// versions — historically it has printed variants like
+// "vm-<vmid>-disk-<N>" and "importing disk … as <volid>", and the
+// allocated volume name isn't always vm-<vmid>-disk-0 (e.g. if a
+// stale volume with that name exists on the storage from a prior
+// VM). We instead diff the VM config before and after the import
+// and pick out the newly-added unusedN entry, which holds the real
+// volume ref.
+func importPVEDisk(ctx context.Context, vmid int, storage, src string) (volume string, err error) {
+	before, err := pveVMConfig(ctx, vmid)
+	if err != nil {
+		return "", fmt.Errorf("reading VM %d config: %w", vmid, err)
+	}
+	if err := runQM(ctx, "disk", "import", strconv.Itoa(vmid), src, storage, "--format", "raw"); err != nil {
+		return "", err
+	}
+	after, err := pveVMConfig(ctx, vmid)
+	if err != nil {
+		return "", fmt.Errorf("reading VM %d config after import: %w", vmid, err)
+	}
+	for k, v := range after {
+		if !strings.HasPrefix(k, "unused") {
+			continue
+		}
+		if before[k] == v {
+			continue
+		}
+		return v, nil
+	}
+	return "", fmt.Errorf("qm disk import didn't add an unusedN entry to VM %d config", vmid)
+}
+
+// pveVMConfig returns the current runtime config for vmid on the local
+// PVE node, as a flat key → string map. We ask pvesh for JSON since
+// "qm config" text output has evolved over releases.
+func pveVMConfig(ctx context.Context, vmid int) (map[string]string, error) {
+	node, err := os.Hostname()
+	if err != nil {
+		return nil, err
+	}
+	out, err := exec.CommandContext(ctx, "pvesh", "get",
+		fmt.Sprintf("/nodes/%s/qemu/%d/config", node, vmid),
+		"--output-format", "json").Output()
+	if err != nil {
+		return nil, err
+	}
+	var raw map[string]any
+	if err := json.Unmarshal(out, &raw); err != nil {
+		return nil, fmt.Errorf("parsing pvesh JSON: %w", err)
+	}
+	m := make(map[string]string, len(raw))
+	for k, v := range raw {
+		switch v := v.(type) {
+		case string:
+			m[k] = v
+		case float64:
+			m[k] = strconv.FormatFloat(v, 'f', -1, 64)
+		case bool:
+			m[k] = strconv.FormatBool(v)
+		}
+	}
+	return m, nil
+}
+
+func attachPVEDisk(ctx context.Context, vmid int, diskRef string) error {
+	return runQM(ctx, "set", strconv.Itoa(vmid),
+		"--scsi0", diskRef+",iothread=1",
+		"--boot", "order=scsi0",
+	)
+}
+
+// runQM invokes `qm` with args, streaming its output to Stderr so the
+// caller can see disk-import progress and any error messages.
+func runQM(ctx context.Context, args ...string) error {
+	printf("$ qm %s\n", strings.Join(args, " "))
+	cmd := exec.CommandContext(ctx, "qm", args...)
+	cmd.Stdout = Stderr
+	cmd.Stderr = Stderr
+	return cmd.Run()
+}
+
+// parseSizeBytes parses a size string like "4G", "8192M", "1024K", or
+// "12345" (bytes) into a byte count. Empty string returns an error.
+func parseSizeBytes(s string) (int64, error) {
+	s = strings.TrimSpace(s)
+	if s == "" {
+		return 0, errors.New("empty size")
+	}
+	mult := int64(1)
+	switch last := s[len(s)-1]; {
+	case last >= '0' && last <= '9':
+		// no suffix
+	default:
+		switch last {
+		case 'K', 'k':
+			mult = 1 << 10
+		case 'M', 'm':
+			mult = 1 << 20
+		case 'G', 'g':
+			mult = 1 << 30
+		case 'T', 't':
+			mult = 1 << 40
+		default:
+			return 0, fmt.Errorf("unknown size suffix %q", string(last))
+		}
+		s = s[:len(s)-1]
+	}
+	n, err := strconv.ParseInt(s, 10, 64)
+	if err != nil {
+		return 0, err
+	}
+	if n <= 0 {
+		return 0, fmt.Errorf("size %d must be positive", n)
+	}
+	return n * mult, nil
+}
diff --git a/cmd/tailscale/cli/configure-pve-appliance_omit.go b/cmd/tailscale/cli/configure-pve-appliance_omit.go
new file mode 100644
index 000000000..81af1f31d
--- /dev/null
+++ b/cmd/tailscale/cli/configure-pve-appliance_omit.go
@@ -0,0 +1,13 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build ts_omit_flashappliance
+
+package cli
+
+import "github.com/peterbourgon/ff/v3/ffcli"
+
+func pveApplianceCmd() *ffcli.Command {
+	// Omitted from the build when the ts_omit_flashappliance build tag is set.
+	return nil
+}
diff --git a/cmd/tailscale/cli/configure.go b/cmd/tailscale/cli/configure.go
index e7a6448e7..863f0fb6b 100644
--- a/cmd/tailscale/cli/configure.go
+++ b/cmd/tailscale/cli/configure.go
@@ -32,6 +32,8 @@ services on the host to use Tailscale in more ways.
 		Subcommands: nonNilCmds(
 			configureKubeconfigCmd(),
 			synologyConfigureCmd(),
+			flashApplianceCmd(),
+			pveApplianceCmd(),
 			ccall(maybeConfigSynologyCertCmd),
 			ccall(maybeSysExtCmd),
 			ccall(maybeVPNConfigCmd),
diff --git a/cmd/tailscale/cli/configure_linux.go b/cmd/tailscale/cli/configure_linux.go
index 9ba3b8e87..e21af3c90 100644
--- a/cmd/tailscale/cli/configure_linux.go
+++ b/cmd/tailscale/cli/configure_linux.go
@@ -18,7 +18,7 @@ func init() {
 	maybeSystrayCmd = systrayConfigCmd
 }
 
-var systrayArgs struct {
+var configSystrayArgs struct {
 	initSystem     string
 	installStartup bool
 }
@@ -32,16 +32,16 @@ func systrayConfigCmd() *ffcli.Command {
 		Exec:       configureSystray,
 		FlagSet: (func() *flag.FlagSet {
 			fs := newFlagSet("systray")
-			fs.StringVar(&systrayArgs.initSystem, "enable-startup", "",
-				"Install startup script for init system. Currently supported systems are [systemd, freedesktop].")
+			fs.StringVar(&configSystrayArgs.initSystem, "enable-startup", "",
+				"install startup script for init system. Currently supported systems are [systemd, freedesktop].")
 			return fs
 		})(),
 	}
 }
 
 func configureSystray(_ context.Context, _ []string) error {
-	if systrayArgs.initSystem != "" {
-		if err := systray.InstallStartupScript(systrayArgs.initSystem); err != nil {
+	if configSystrayArgs.initSystem != "" {
+		if err := systray.InstallStartupScript(configSystrayArgs.initSystem); err != nil {
 			fmt.Printf("%s\n\n", err.Error())
 			return flag.ErrHelp
 		}
diff --git a/cmd/tailscale/cli/debug.go b/cmd/tailscale/cli/debug.go
index 944f99f91..8e25c81f1 100644
--- a/cmd/tailscale/cli/debug.go
+++ b/cmd/tailscale/cli/debug.go
@@ -39,6 +39,7 @@ import (
 	"tailscale.com/net/ace"
 	"tailscale.com/net/dnscache"
 	"tailscale.com/net/netmon"
+	"tailscale.com/net/netutil"
 	"tailscale.com/net/tsaddr"
 	"tailscale.com/net/tsdial"
 	"tailscale.com/paths"
@@ -257,7 +258,7 @@ func debugCmd() *ffcli.Command {
 				ShortHelp:  "Print prefs",
 				FlagSet: (func() *flag.FlagSet {
 					fs := newFlagSet("prefs")
-					fs.BoolVar(&prefsArgs.pretty, "pretty", false, "If true, pretty-print output")
+					fs.BoolVar(&prefsArgs.pretty, "pretty", false, "if true, pretty-print output")
 					return fs
 				})(),
 			},
@@ -268,10 +269,19 @@ func debugCmd() *ffcli.Command {
 				ShortHelp:  "Subscribe to IPN message bus",
 				FlagSet: (func() *flag.FlagSet {
 					fs := newFlagSet("watch-ipn")
-					fs.BoolVar(&watchIPNArgs.netmap, "netmap", true, "include netmap in messages")
-					fs.BoolVar(&watchIPNArgs.initial, "initial", false, "include initial status")
-					fs.BoolVar(&watchIPNArgs.rateLimit, "rate-limit", true, "rate limit messages")
+					fs.BoolVar(&watchIPNArgs.initial, "initial", false, "include the initial backend State and Prefs in the first message")
 					fs.IntVar(&watchIPNArgs.count, "count", 0, "exit after printing this many statuses, or 0 to keep going forever")
+					fs.BoolVar(&watchIPNArgs.engineUpdates, "engine-updates", false, "set NotifyWatchEngineUpdates: send Engine updates")
+					fs.BoolVar(&watchIPNArgs.initialDriveShares, "initial-drive-shares", false, "set NotifyInitialDriveShares: send current Taildrive Shares in first message")
+					fs.BoolVar(&watchIPNArgs.initialOutgoingFiles, "initial-outgoing-files", false, "set NotifyInitialOutgoingFiles: send current Taildrop OutgoingFiles in first message")
+					fs.BoolVar(&watchIPNArgs.initialHealthState, "initial-health", false, "set NotifyInitialHealthState: send current health.State in first message")
+					fs.BoolVar(&watchIPNArgs.healthActions, "health-actions", false, "set NotifyHealthActions: include PrimaryActions in health.State")
+					fs.BoolVar(&watchIPNArgs.initialSuggestedExitNode, "initial-suggested-exit-node", false, "set NotifyInitialSuggestedExitNode: send current SuggestedExitNode in first message")
+					fs.BoolVar(&watchIPNArgs.initialClientVersion, "initial-client-version", false, "set NotifyInitialClientVersion: send current ClientVersion in first message")
+					fs.BoolVar(&watchIPNArgs.peerChanges, "peer-changes", true, "set NotifyPeerChanges: send PeersChanged and PeersRemoved updates")
+					fs.BoolVar(&watchIPNArgs.initialStatus, "initial-status", false, "set NotifyInitialStatus: send current ipnstate.Status in first message")
+					fs.BoolVar(&watchIPNArgs.peerPatches, "peer-patches", true, "set NotifyPeerPatches: send narrow per-field peer patches")
+					fs.BoolVar(&watchIPNArgs.peerWireGuardState, "peer-wireguard-state", false, "set NotifyPeerWireGuardState: send WireGuard session state notifications")
 					return fs
 				})(),
 			},
@@ -632,19 +642,59 @@ func runPrefs(ctx context.Context, args []string) error {
 }
 
 var watchIPNArgs struct {
-	netmap    bool
-	initial   bool
-	rateLimit bool
-	count     int
+	initial bool
+	count   int
+
+	engineUpdates            bool
+	initialDriveShares       bool
+	initialOutgoingFiles     bool
+	initialHealthState       bool
+	healthActions            bool
+	initialSuggestedExitNode bool
+	initialClientVersion     bool
+	peerChanges              bool
+	initialStatus            bool
+	peerPatches              bool
+	peerWireGuardState       bool
 }
 
 func runWatchIPN(ctx context.Context, args []string) error {
-	var mask ipn.NotifyWatchOpt
+	mask := ipn.NotifyNoNetMap
 	if watchIPNArgs.initial {
-		mask = ipn.NotifyInitialState | ipn.NotifyInitialPrefs | ipn.NotifyInitialNetMap
+		mask |= ipn.NotifyInitialState | ipn.NotifyInitialPrefs
 	}
-	if watchIPNArgs.rateLimit {
-		mask |= ipn.NotifyRateLimit
+	if watchIPNArgs.engineUpdates {
+		mask |= ipn.NotifyWatchEngineUpdates
+	}
+	if watchIPNArgs.initialDriveShares {
+		mask |= ipn.NotifyInitialDriveShares
+	}
+	if watchIPNArgs.initialOutgoingFiles {
+		mask |= ipn.NotifyInitialOutgoingFiles
+	}
+	if watchIPNArgs.initialHealthState {
+		mask |= ipn.NotifyInitialHealthState
+	}
+	if watchIPNArgs.healthActions {
+		mask |= ipn.NotifyHealthActions
+	}
+	if watchIPNArgs.initialSuggestedExitNode {
+		mask |= ipn.NotifyInitialSuggestedExitNode
+	}
+	if watchIPNArgs.initialClientVersion {
+		mask |= ipn.NotifyInitialClientVersion
+	}
+	if watchIPNArgs.peerChanges {
+		mask |= ipn.NotifyPeerChanges
+	}
+	if watchIPNArgs.initialStatus {
+		mask |= ipn.NotifyInitialStatus
+	}
+	if watchIPNArgs.peerPatches {
+		mask |= ipn.NotifyPeerPatches
+	}
+	if watchIPNArgs.peerWireGuardState {
+		mask |= ipn.NotifyPeerWireGuardState
 	}
 	watcher, err := localClient.WatchIPNBus(ctx, mask)
 	if err != nil {
@@ -657,9 +707,6 @@ func runWatchIPN(ctx context.Context, args []string) error {
 		if err != nil {
 			return err
 		}
-		if !watchIPNArgs.netmap {
-			n.NetMap = nil
-		}
 		j, _ := json.MarshalIndent(n, "", "\t")
 		fmt.Printf("%s\n", j)
 	}
@@ -670,18 +717,11 @@ func runNetmap(ctx context.Context, args []string) error {
 	ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
 	defer cancel()
 
-	var mask ipn.NotifyWatchOpt = ipn.NotifyInitialNetMap
-	watcher, err := localClient.WatchIPNBus(ctx, mask)
+	raw, err := localClient.DebugResultJSON(ctx, "current-netmap")
 	if err != nil {
 		return err
 	}
-	defer watcher.Close()
-
-	n, err := watcher.Next()
-	if err != nil {
-		return err
-	}
-	j, _ := json.MarshalIndent(n.NetMap, "", "\t")
+	j, _ := json.MarshalIndent(raw, "", "\t")
 	fmt.Printf("%s\n", j)
 	return nil
 }
@@ -798,10 +838,13 @@ func runDaemonLogs(ctx context.Context, args []string) error {
 	}
 	d := json.NewDecoder(logs)
 	for {
+		type logtail struct {
+			Time string `json:"client_time"`
+		}
 		var line struct {
-			Text    string `json:"text"`
-			Verbose int    `json:"v"`
-			Time    string `json:"client_time"`
+			Text    string  `json:"text"`
+			Verbose int     `json:"v"`
+			Logtail logtail `json:"logtail"`
 		}
 		err := d.Decode(&line)
 		if err != nil {
@@ -811,8 +854,8 @@ func runDaemonLogs(ctx context.Context, args []string) error {
 		if line.Text == "" || line.Verbose > daemonLogsArgs.verbose {
 			continue
 		}
-		if daemonLogsArgs.time {
-			fmt.Printf("%s %s\n", line.Time, line.Text)
+		if daemonLogsArgs.time && line.Logtail.Time != "" {
+			fmt.Printf("%s %s\n", line.Logtail.Time, line.Text)
 		} else {
 			fmt.Println(line.Text)
 		}
@@ -998,7 +1041,7 @@ func runTS2021(ctx context.Context, args []string) error {
 
 	keysURL := "https://" + ts2021Args.host + "/key?v=" + strconv.Itoa(ts2021Args.version)
 
-	keyTransport := http.DefaultTransport.(*http.Transport).Clone()
+	keyTransport := netutil.NewDefaultTransport()
 	if ts2021Args.aceHost != "" {
 		log.Printf("using ACE server %q", ts2021Args.aceHost)
 		keyTransport.Proxy = nil
diff --git a/cmd/tailscale/cli/dns-query.go b/cmd/tailscale/cli/dns-query.go
index 2993441b3..6336b159c 100644
--- a/cmd/tailscale/cli/dns-query.go
+++ b/cmd/tailscale/cli/dns-query.go
@@ -15,7 +15,8 @@ import (
 
 	"github.com/peterbourgon/ff/v3/ffcli"
 	"golang.org/x/net/dns/dnsmessage"
-	"tailscale.com/cmd/tailscale/cli/jsonoutput"
+
+	"tailscale.com/cmd/tailscale/tsdnsjsonv0"
 )
 
 var dnsQueryArgs struct {
@@ -73,7 +74,7 @@ func runDNSQuery(ctx context.Context, args []string) error {
 		return fmt.Errorf("failed to query DNS: %w", err)
 	}
 
-	data := &jsonoutput.DNSQueryResult{
+	data := &tsdnsjsonv0.QueryResponse{
 		Name:      name,
 		QueryType: queryType,
 	}
@@ -96,9 +97,9 @@ func runDNSQuery(ctx context.Context, args []string) error {
 		if err != nil {
 			return fmt.Errorf("failed to parse DNS answers: %w", err)
 		}
-		data.Answers = make([]jsonoutput.DNSAnswer, 0, len(answers))
+		data.Answers = make([]tsdnsjsonv0.Answer, 0, len(answers))
 		for _, a := range answers {
-			data.Answers = append(data.Answers, jsonoutput.DNSAnswer{
+			data.Answers = append(data.Answers, tsdnsjsonv0.Answer{
 				Name:  a.Header.Name.String(),
 				TTL:   a.Header.TTL,
 				Class: a.Header.Class.String(),
@@ -120,7 +121,7 @@ func runDNSQuery(ctx context.Context, args []string) error {
 	return nil
 }
 
-func formatDNSQueryText(data *jsonoutput.DNSQueryResult) string {
+func formatDNSQueryText(data *tsdnsjsonv0.QueryResponse) string {
 	var sb strings.Builder
 
 	fmt.Fprintf(&sb, "DNS query for %q (%s) using internal resolver:\n", data.Name, data.QueryType)
@@ -158,8 +159,8 @@ func formatDNSQueryText(data *jsonoutput.DNSQueryResult) string {
 	return sb.String()
 }
 
-// formatResolverString formats a jsonoutput.DNSResolverInfo for human-readable text output.
-func formatResolverString(r jsonoutput.DNSResolverInfo) string {
+// formatResolverString formats a [tsdnsjsonv0.ResolverInfo] for human-readable text output.
+func formatResolverString(r tsdnsjsonv0.ResolverInfo) string {
 	if len(r.BootstrapResolution) > 0 {
 		return fmt.Sprintf("%s (bootstrap: %v)", r.Addr, r.BootstrapResolution)
 	}
diff --git a/cmd/tailscale/cli/dns-status.go b/cmd/tailscale/cli/dns-status.go
index 66a5e21d8..2b2e64871 100644
--- a/cmd/tailscale/cli/dns-status.go
+++ b/cmd/tailscale/cli/dns-status.go
@@ -13,10 +13,9 @@ import (
 	"strings"
 
 	"github.com/peterbourgon/ff/v3/ffcli"
-	"tailscale.com/cmd/tailscale/cli/jsonoutput"
-	"tailscale.com/ipn"
+
+	"tailscale.com/cmd/tailscale/tsdnsjsonv0"
 	"tailscale.com/types/dnstype"
-	"tailscale.com/types/netmap"
 )
 
 var dnsStatusCmd = &ffcli.Command{
@@ -86,9 +85,9 @@ var dnsStatusArgs struct {
 	json bool
 }
 
-// makeDNSResolverInfo converts a dnstype.Resolver to a jsonoutput.DNSResolverInfo.
-func makeDNSResolverInfo(r *dnstype.Resolver) jsonoutput.DNSResolverInfo {
-	info := jsonoutput.DNSResolverInfo{Addr: r.Addr}
+// makeDNSResolverInfo converts a [dnstype.Resolver] to a [tsdnsjsonv0.ResolverInfo].
+func makeDNSResolverInfo(r *dnstype.Resolver) tsdnsjsonv0.ResolverInfo {
+	info := tsdnsjsonv0.ResolverInfo{Addr: r.Addr}
 	if r.BootstrapResolution != nil {
 		info.BootstrapResolution = make([]string, 0, len(r.BootstrapResolution))
 		for _, a := range r.BootstrapResolution {
@@ -109,28 +108,27 @@ func runDNSStatus(ctx context.Context, args []string) error {
 		return err
 	}
 
-	data := &jsonoutput.DNSStatusResult{
+	data := &tsdnsjsonv0.StatusResponse{
 		TailscaleDNS: prefs.CorpDNS,
 	}
 
 	if s.CurrentTailnet != nil {
-		data.CurrentTailnet = &jsonoutput.DNSTailnetInfo{
+		data.CurrentTailnet = &tsdnsjsonv0.TailnetInfo{
 			MagicDNSEnabled: s.CurrentTailnet.MagicDNSEnabled,
 			MagicDNSSuffix:  s.CurrentTailnet.MagicDNSSuffix,
 			SelfDNSName:     s.Self.DNSName,
 		}
 
-		netMap, err := fetchNetMap()
+		dnsConfig, err := localClient.DNSConfig(ctx)
 		if err != nil {
-			return fmt.Errorf("failed to fetch network map: %w", err)
+			return fmt.Errorf("failed to fetch DNS config: %w", err)
 		}
-		dnsConfig := netMap.DNS
 
 		for _, r := range dnsConfig.Resolvers {
 			data.Resolvers = append(data.Resolvers, makeDNSResolverInfo(r))
 		}
 
-		data.SplitDNSRoutes = make(map[string][]jsonoutput.DNSResolverInfo)
+		data.SplitDNSRoutes = make(map[string][]tsdnsjsonv0.ResolverInfo)
 		for k, v := range dnsConfig.Routes {
 			for _, r := range v {
 				data.SplitDNSRoutes[k] = append(data.SplitDNSRoutes[k], makeDNSResolverInfo(r))
@@ -152,7 +150,7 @@ func runDNSStatus(ctx context.Context, args []string) error {
 		data.CertDomains = dnsConfig.CertDomains
 
 		for _, er := range dnsConfig.ExtraRecords {
-			data.ExtraRecords = append(data.ExtraRecords, jsonoutput.DNSExtraRecord{
+			data.ExtraRecords = append(data.ExtraRecords, tsdnsjsonv0.ExtraRecord{
 				Name:  er.Name,
 				Type:  er.Type,
 				Value: er.Value,
@@ -169,7 +167,7 @@ func runDNSStatus(ctx context.Context, args []string) error {
 				data.SystemDNSError = err.Error()
 			}
 		} else if osCfg != nil {
-			data.SystemDNS = &jsonoutput.DNSSystemConfig{
+			data.SystemDNS = &tsdnsjsonv0.SystemConfig{
 				Nameservers:   osCfg.Nameservers,
 				SearchDomains: osCfg.SearchDomains,
 				MatchDomains:  osCfg.MatchDomains,
@@ -189,7 +187,7 @@ func runDNSStatus(ctx context.Context, args []string) error {
 	return nil
 }
 
-func formatDNSStatusText(data *jsonoutput.DNSStatusResult, all bool) string {
+func formatDNSStatusText(data *tsdnsjsonv0.StatusResponse, all bool) string {
 	var sb strings.Builder
 
 	fmt.Fprintf(&sb, "\n")
@@ -357,19 +355,3 @@ func formatDNSStatusText(data *jsonoutput.DNSStatusResult, all bool) string {
 	fmt.Fprintf(&sb, "[this is a preliminary version of this command; the output format may change in the future]\n")
 	return sb.String()
 }
-
-func fetchNetMap() (netMap *netmap.NetworkMap, err error) {
-	w, err := localClient.WatchIPNBus(context.Background(), ipn.NotifyInitialNetMap)
-	if err != nil {
-		return nil, err
-	}
-	defer w.Close()
-	notify, err := w.Next()
-	if err != nil {
-		return nil, err
-	}
-	if notify.NetMap == nil {
-		return nil, fmt.Errorf("no network map yet available, please try again later")
-	}
-	return notify.NetMap, nil
-}
diff --git a/cmd/tailscale/cli/exitnode.go b/cmd/tailscale/cli/exitnode.go
index 7ba4859d7..8b8333121 100644
--- a/cmd/tailscale/cli/exitnode.go
+++ b/cmd/tailscale/cli/exitnode.go
@@ -16,6 +16,7 @@ import (
 	"github.com/kballard/go-shellquote"
 	"github.com/peterbourgon/ff/v3/ffcli"
 	"tailscale.com/envknob"
+	"tailscale.com/feature/buildfeatures"
 	"tailscale.com/ipn/ipnstate"
 	"tailscale.com/tailcfg"
 	"tailscale.com/util/slicesx"
@@ -43,6 +44,13 @@ func exitNodeCmd() *ffcli.Command {
 				ShortUsage: "tailscale exit-node suggest",
 				ShortHelp:  "Suggest the best available exit node",
 				Exec:       runExitNodeSuggest,
+				FlagSet: (func() *flag.FlagSet {
+					fs := newFlagSet("suggest")
+					if buildfeatures.HasRouteCheck {
+						fs.BoolVar(&exitNodeArgs.probe, "force-probe", false, hidden+"perform a routecheck probe before suggesting")
+					}
+					return fs
+				})(),
 			}},
 			(func() []*ffcli.Command {
 				if !envknob.UseWIPCode() {
@@ -68,6 +76,7 @@ func exitNodeCmd() *ffcli.Command {
 
 var exitNodeArgs struct {
 	filter string
+	probe  bool
 }
 
 func exitNodeSetUse(wantOn bool) func(ctx context.Context, args []string) error {
@@ -148,7 +157,11 @@ func runExitNodeList(ctx context.Context, args []string) error {
 // runExitNodeSuggest returns a suggested exit node ID to connect to and shows the chosen exit node tailcfg.StableNodeID.
 // If there are no derp based exit nodes to choose from or there is a failure in finding a suggestion, the command will return an error indicating so.
 func runExitNodeSuggest(ctx context.Context, args []string) error {
-	res, err := localClient.SuggestExitNode(ctx)
+	suggestExitNode := localClient.SuggestExitNode
+	if exitNodeArgs.probe {
+		suggestExitNode = localClient.SuggestExitNodeWithProbe
+	}
+	res, err := suggestExitNode(ctx)
 	if err != nil {
 		return fmt.Errorf("suggest exit node: %w", err)
 	}
diff --git a/cmd/tailscale/cli/file.go b/cmd/tailscale/cli/file.go
index e7406bee3..a78caf369 100644
--- a/cmd/tailscale/cli/file.go
+++ b/cmd/tailscale/cli/file.go
@@ -32,6 +32,7 @@ import (
 	"tailscale.com/client/tailscale/apitype"
 	"tailscale.com/cmd/tailscale/cli/ffcomplete"
 	"tailscale.com/envknob"
+	"tailscale.com/ipn"
 	"tailscale.com/ipn/ipnstate"
 	"tailscale.com/net/tsaddr"
 	"tailscale.com/tailcfg"
@@ -78,14 +79,16 @@ var fileCpCmd = &ffcli.Command{
 		fs.StringVar(&cpArgs.name, "name", "", "alternate filename to use, especially useful when <file> is \"-\" (stdin)")
 		fs.BoolVar(&cpArgs.verbose, "verbose", false, "verbose output")
 		fs.BoolVar(&cpArgs.targets, "targets", false, "list possible file cp targets")
+		fs.DurationVar(&cpArgs.updateInterval, "update-interval", 250*time.Millisecond, "how often to repaint the progress line; zero or negative disables progress display entirely")
 		return fs
 	})(),
 }
 
 var cpArgs struct {
-	name    string
-	verbose bool
-	targets bool
+	name           string
+	verbose        bool
+	targets        bool
+	updateInterval time.Duration
 }
 
 func runCp(ctx context.Context, args []string) error {
@@ -119,9 +122,6 @@ func runCp(ctx context.Context, args []string) error {
 	if err != nil {
 		return fmt.Errorf("can't send to %s: %v", target, err)
 	}
-	if isOffline {
-		fmt.Fprintf(Stderr, "# warning: %s is offline\n", target)
-	}
 
 	if len(files) > 1 {
 		if cpArgs.name != "" {
@@ -132,7 +132,51 @@ func runCp(ctx context.Context, args []string) error {
 		}
 	}
 
-	for _, fileArg := range files {
+	// outFiles tracks per-name push state, populated by a goroutine subscribed
+	// to the IPN bus. tailscaled's OutgoingFile.Sent is the bytes-pulled-toward-
+	// peerAPI signal; it stays at 0 until the peerAPI request body is actually
+	// being read, which is what we want both for the progress display and for
+	// disarming the offline warning. The CLI's local-side bytes counter would
+	// say "100% sent" the moment net/http buffers a small body into the local
+	// unix-socket conn to tailscaled, well before the peer has heard a thing.
+	type pushState struct {
+		sent      atomic.Int64
+		warnTimer *time.Timer // disarmed on first byte sent to peerAPI; nil after
+	}
+	var (
+		outMu    sync.Mutex
+		outFiles = map[string]*pushState{} // keyed by file name
+	)
+
+	busCtx, cancelBus := context.WithCancel(ctx)
+	defer cancelBus()
+	go watchOutgoingFiles(busCtx, stableID, func(name string, sent int64) {
+		outMu.Lock()
+		ps := outFiles[name]
+		outMu.Unlock()
+		if ps == nil {
+			return
+		}
+		// Only ever advance ps.sent forward. Bus updates can arrive late
+		// (after the success path below has already written contentLength
+		// to ps.sent for an instant final-100% paint), so we'd otherwise
+		// regress the count and the progress printer would compute a
+		// negative delta on its next tick.
+		for {
+			old := ps.sent.Load()
+			if sent <= old {
+				return
+			}
+			if ps.sent.CompareAndSwap(old, sent) {
+				if old == 0 && ps.warnTimer != nil {
+					ps.warnTimer.Stop()
+				}
+				return
+			}
+		}
+	})
+
+	for i, fileArg := range files {
 		var fileContents *countingReader
 		var name = cpArgs.name
 		var contentLength int64 = -1
@@ -175,16 +219,57 @@ func runCp(ctx context.Context, args []string) error {
 			log.Printf("sending %q to %v/%v/%v ...", name, target, ip, stableID)
 		}
 
+		// Register this file with the watcher and, for the first file only,
+		// arm a timer that warns the user if no bytes have flowed to peerAPI
+		// after a few seconds. The watcher disarms it on first byte; PushFile
+		// returning also disarms it (cleanup, below). We don't gate on the
+		// netmap's Online bit (which can lag reality), but we do use it to
+		// pick between two warning messages.
+		ps := &pushState{}
+		if i == 0 {
+			ps.warnTimer = time.AfterFunc(3*time.Second, func() {
+				// vtRestartLine clears whatever (possibly progress) was on
+				// the current line, then we print the warning + \n so the
+				// next progress redraw lands on a fresh line below.
+				const vtRestartLine = "\r\x1b[K"
+				if isOffline {
+					fmt.Fprintf(Stderr, "%s# warning: %s is reportedly offline; trying anyway\n", vtRestartLine, target)
+				} else {
+					fmt.Fprintf(Stderr, "%s# warning: %s is not replying; trying anyway\n", vtRestartLine, target)
+				}
+			})
+		}
+		outMu.Lock()
+		outFiles[name] = ps
+		outMu.Unlock()
+
 		var group sync.WaitGroup
 		ctxProgress, cancelProgress := context.WithCancel(ctx)
 		defer cancelProgress()
-		if isatty.IsTerminal(os.Stderr.Fd()) {
-			group.Go(func() { progressPrinter(ctxProgress, name, fileContents.n.Load, contentLength) })
+		if cpArgs.updateInterval > 0 && isatty.IsTerminal(os.Stderr.Fd()) {
+			group.Go(func() {
+				progressPrinter(ctxProgress, name, ps.sent.Load, contentLength, cpArgs.updateInterval)
+			})
 		}
 
 		err := localClient.PushFile(ctx, stableID, contentLength, name, fileContents)
+		if err == nil {
+			// PushFile can finish faster than the IPN bus delivers a final
+			// OutgoingFile update, leaving the progress display stuck at 0%.
+			// Synthesize a "fully done" count before stopping the printer so
+			// its final paint shows 100%. For stdin (contentLength == -1) we
+			// don't know the size, so fall back to the local read count.
+			if contentLength >= 0 {
+				ps.sent.Store(contentLength)
+			} else {
+				ps.sent.Store(fileContents.n.Load())
+			}
+		}
 		cancelProgress()
 		group.Wait() // wait for progress printer to stop before reporting the error
+		if ps.warnTimer != nil {
+			ps.warnTimer.Stop()
+		}
 		if err != nil {
 			return err
 		}
@@ -195,15 +280,71 @@ func runCp(ctx context.Context, args []string) error {
 	return nil
 }
 
-func progressPrinter(ctx context.Context, name string, contentCount func() int64, contentLength int64) {
+// watchOutgoingFiles subscribes to the IPN bus and invokes onUpdate once
+// per OutgoingFile event for files going to peer. It runs until ctx is
+// done (which runCp does on return) and is best-effort: if the bus
+// subscription fails for any reason, onUpdate simply isn't called and the
+// caller's progress display stays at 0 — exactly the right degradation,
+// since the warning timer will then fire on its normal 3-second deadline.
+func watchOutgoingFiles(ctx context.Context, peer tailcfg.StableNodeID, onUpdate func(name string, sent int64)) {
+	// NotifyPeerChanges opts in to per-peer add/remove notifications so the
+	// bus stays responsive without us also subscribing to the full NetMap,
+	// which we don't read here.
+	w, err := localClient.WatchIPNBus(ctx, ipn.NotifyInitialOutgoingFiles|ipn.NotifyPeerChanges)
+	if err != nil {
+		return
+	}
+	defer w.Close()
+	for {
+		n, err := w.Next()
+		if err != nil {
+			return
+		}
+		for _, of := range n.OutgoingFiles {
+			if of.PeerID != peer {
+				continue
+			}
+			// tailscaled keeps Finished entries in its OutgoingFiles map
+			// across PushFile calls (see feature/taildrop/ext.go), so a
+			// re-send of the same filename will see both the old completed
+			// (Sent == DeclaredSize) entry and the new in-progress one.
+			// Without this filter the watcher's monotonic CAS would latch
+			// onto the old entry's max value and the new transfer would
+			// appear stuck at 100% from the first bus tick.
+			if of.Finished {
+				continue
+			}
+			onUpdate(of.Name, of.Sent)
+		}
+	}
+}
+
+// progressPrinter repaints a single-line transfer progress display every
+// interval. interval must be > 0; runCp's caller gates on the
+// --update-interval flag and skips invoking us when it's <= 0.
+//
+// It returns when ctx is done OR when it detects the transfer is stuck —
+// "stuck" being: contentCount has equalled contentLength with a near-zero
+// rate for >2 seconds. The stuck case prints a final newline so subsequent
+// output (e.g. an error from PushFile) lands on a fresh line below the
+// frozen progress line, instead of being painted over by it.
+func progressPrinter(ctx context.Context, name string, contentCount func() int64, contentLength int64, interval time.Duration) {
 	var rateValueFast, rateValueSlow tsrate.Value
-	rateValueFast.HalfLife = 1 * time.Second  // fast response for rate measurement
-	rateValueSlow.HalfLife = 10 * time.Second // slow response for ETA measurement
+	// tailscaled emits OutgoingFile.Sent updates at ~1 Hz, so most printer
+	// ticks see no delta. With too short a half-life the displayed rate
+	// roughly halves between updates and doubles back when one arrives,
+	// looking jumpy. 5s keeps the swing under ~15% while still settling
+	// within a few seconds of a real change.
+	rateValueFast.HalfLife = 5 * time.Second  // smoothed rate for display
+	rateValueSlow.HalfLife = 10 * time.Second // even slower, for ETA measurement
 	var prevContentCount int64
 	print := func() {
 		currContentCount := contentCount()
-		rateValueFast.Add(float64(currContentCount - prevContentCount))
-		rateValueSlow.Add(float64(currContentCount - prevContentCount))
+		// Clamp so a regression (which shouldn't happen, but tsrate.Value.Add
+		// panics on a negative count) can't take down the CLI.
+		delta := max(currContentCount-prevContentCount, 0)
+		rateValueFast.Add(float64(delta))
+		rateValueSlow.Add(float64(delta))
 		prevContentCount = currContentCount
 
 		const vtRestartLine = "\r\x1b[K"
@@ -215,16 +356,23 @@ func progressPrinter(ctx context.Context, name string, contentCount func() int64
 		if contentLength >= 0 {
 			currContentCount = min(currContentCount, contentLength) // cap at 100%
 			ratioRemain := float64(currContentCount) / float64(contentLength)
-			bytesRemain := float64(contentLength - currContentCount)
-			secsRemain := bytesRemain / rateValueSlow.Rate()
-			secs := int(min(max(0, secsRemain), 99*60*60+59+60+59))
+			etaStr := "ETA -"
+			if rate := rateValueSlow.Rate(); rate > 0 {
+				bytesRemain := float64(contentLength - currContentCount)
+				secsRemain := bytesRemain / rate
+				secs := int(min(max(0, secsRemain), 99*60*60+59+60+59))
+				etaStr = fmt.Sprintf("ETA %02d:%02d:%02d", secs/60/60, (secs/60)%60, secs%60)
+			}
 			fmt.Fprintf(os.Stderr, "    %s    %s",
 				leftPad(fmt.Sprintf("%0.2f%%", 100.0*ratioRemain), len("100.00%")),
-				fmt.Sprintf("ETA %02d:%02d:%02d", secs/60/60, (secs/60)%60, secs%60))
+				etaStr)
 		}
 	}
 
-	tc := time.NewTicker(250 * time.Millisecond)
+	const stuckAfter = 2 * time.Second
+	var fullStartedAt time.Time // when we first observed currCount==contentLength with ~zero rate
+
+	tc := time.NewTicker(interval)
 	defer tc.Stop()
 	print()
 	for {
@@ -235,6 +383,24 @@ func progressPrinter(ctx context.Context, name string, contentCount func() int64
 			return
 		case <-tc.C:
 			print()
+			if contentLength < 0 {
+				continue
+			}
+			currCount := contentCount()
+			rate := rateValueFast.Rate()
+			if currCount >= contentLength && rate < 1 {
+				if fullStartedAt.IsZero() {
+					fullStartedAt = time.Now()
+				} else if time.Since(fullStartedAt) >= stuckAfter {
+					// Transfer is stuck at 100% with no movement. Stop
+					// repainting so we don't keep clobbering anything the
+					// rest of runCp prints (warnings, errors).
+					fmt.Fprintln(os.Stderr)
+					return
+				}
+			} else {
+				fullStartedAt = time.Time{}
+			}
 		}
 	}
 }
@@ -328,7 +494,10 @@ peerLoop:
 		return "", isOffline, errors.New("cannot send files: missing required Taildrop capability")
 
 	case ipnstate.TaildropTargetOffline:
-		return "", isOffline, errors.New("cannot send files: peer is offline")
+		// Don't gate on the server-reported Online bit (which lags reality
+		// and isn't always accurate). runCp probes reachability itself with
+		// TSMP pings.
+		return foundPeer.ID, isOffline, nil
 
 	case ipnstate.TaildropTargetNoPeerInfo:
 		return "", isOffline, errors.New("cannot send files: invalid or unrecognized peer")
@@ -379,10 +548,7 @@ type slowReader struct {
 
 func (r *slowReader) Read(p []byte) (n int, err error) {
 	const burst = 4 << 10
-	plen := len(p)
-	if plen > burst {
-		plen = burst
-	}
+	plen := min(len(p), burst)
 	if r.rl == nil {
 		r.rl = rate.NewLimiter(rate.Limit(1<<10), burst)
 	}
@@ -451,10 +617,10 @@ var fileGetCmd = &ffcli.Command{
 	Exec:       runFileGet,
 	FlagSet: (func() *flag.FlagSet {
 		fs := newFlagSet("get")
-		fs.BoolVar(&getArgs.wait, "wait", false, "wait for a file to arrive if inbox is empty")
-		fs.BoolVar(&getArgs.loop, "loop", false, "run get in a loop, receiving files as they come in")
-		fs.BoolVar(&getArgs.verbose, "verbose", false, "verbose output")
-		fs.Var(&getArgs.conflict, "conflict", "`behavior`"+` when a conflicting (same-named) file already exists in the target directory.
+		fs.BoolVar(&fileGetArgs.wait, "wait", false, "wait for a file to arrive if inbox is empty")
+		fs.BoolVar(&fileGetArgs.loop, "loop", false, "run get in a loop, receiving files as they come in")
+		fs.BoolVar(&fileGetArgs.verbose, "verbose", false, "verbose output")
+		fs.Var(&fileGetArgs.conflict, "conflict", "`behavior`"+` when a conflicting (same-named) file already exists in the target directory.
 	skip:       skip conflicting files: leave them in the taildrop inbox and print an error. get any non-conflicting files
 	overwrite:  overwrite existing file
 	rename:     write to a new number-suffixed filename`)
@@ -463,7 +629,7 @@ var fileGetCmd = &ffcli.Command{
 	})(),
 }
 
-var getArgs = struct {
+var fileGetArgs = struct {
 	wait     bool
 	loop     bool
 	verbose  bool
@@ -525,7 +691,7 @@ func receiveFile(ctx context.Context, wf apitype.WaitingFile, dir string) (targe
 		return "", 0, fmt.Errorf("opening inbox file %q: %w", wf.Name, err)
 	}
 	defer rc.Close()
-	f, err := openFileOrSubstitute(dir, wf.Name, getArgs.conflict)
+	f, err := openFileOrSubstitute(dir, wf.Name, fileGetArgs.conflict)
 	if err != nil {
 		return "", 0, err
 	}
@@ -551,10 +717,10 @@ func runFileGetOneBatch(ctx context.Context, dir string) []error {
 			errs = append(errs, fmt.Errorf("getting WaitingFiles: %w", err))
 			break
 		}
-		if len(wfs) != 0 || !(getArgs.wait || getArgs.loop) {
+		if len(wfs) != 0 || !(fileGetArgs.wait || fileGetArgs.loop) {
 			break
 		}
-		if getArgs.verbose {
+		if fileGetArgs.verbose {
 			printf("waiting for file...")
 		}
 		if err := waitForFile(ctx); err != nil {
@@ -575,7 +741,7 @@ func runFileGetOneBatch(ctx context.Context, dir string) []error {
 			errs = append(errs, err)
 			continue
 		}
-		if getArgs.verbose {
+		if fileGetArgs.verbose {
 			printf("wrote %v as %v (%d bytes)\n", wf.Name, writtenFile, size)
 		}
 		if err = localClient.DeleteWaitingFile(ctx, wf.Name); err != nil {
@@ -587,7 +753,7 @@ func runFileGetOneBatch(ctx context.Context, dir string) []error {
 	if deleted == 0 && len(wfs) > 0 {
 		// persistently stuck files are basically an error
 		errs = append(errs, fmt.Errorf("moved %d/%d files", deleted, len(wfs)))
-	} else if getArgs.verbose {
+	} else if fileGetArgs.verbose {
 		printf("moved %d/%d files\n", deleted, len(wfs))
 	}
 	return errs
@@ -607,7 +773,7 @@ func runFileGet(ctx context.Context, args []string) error {
 	if fi, err := os.Stat(dir); err != nil || !fi.IsDir() {
 		return fmt.Errorf("%q is not a directory", dir)
 	}
-	if getArgs.loop {
+	if fileGetArgs.loop {
 		for {
 			errs := runFileGetOneBatch(ctx, dir)
 			for _, err := range errs {
@@ -639,7 +805,7 @@ func runFileGet(ctx context.Context, args []string) error {
 }
 
 func wipeInbox(ctx context.Context) error {
-	if getArgs.wait {
+	if fileGetArgs.wait {
 		return errors.New("can't use --wait with /dev/null target")
 	}
 	wfs, err := localClient.WaitingFiles(ctx)
@@ -648,7 +814,7 @@ func wipeInbox(ctx context.Context) error {
 	}
 	deleted := 0
 	for _, wf := range wfs {
-		if getArgs.verbose {
+		if fileGetArgs.verbose {
 			log.Printf("deleting %v ...", wf.Name)
 		}
 		if err := localClient.DeleteWaitingFile(ctx, wf.Name); err != nil {
@@ -656,7 +822,7 @@ func wipeInbox(ctx context.Context) error {
 		}
 		deleted++
 	}
-	if getArgs.verbose {
+	if fileGetArgs.verbose {
 		log.Printf("deleted %d files", deleted)
 	}
 	return nil
diff --git a/cmd/tailscale/cli/get.go b/cmd/tailscale/cli/get.go
new file mode 100644
index 000000000..b896dcb52
--- /dev/null
+++ b/cmd/tailscale/cli/get.go
@@ -0,0 +1,240 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package cli
+
+import (
+	"context"
+	"encoding/json"
+	"flag"
+	"fmt"
+	"strings"
+	"text/tabwriter"
+
+	"github.com/peterbourgon/ff/v3/ffcli"
+	"tailscale.com/ipn"
+	"tailscale.com/ipn/ipnstate"
+	"tailscale.com/net/tsaddr"
+	"tailscale.com/types/views"
+)
+
+var getCmd = &ffcli.Command{
+	Name:       "get",
+	ShortUsage: "tailscale get [flags] [setting-name | all]",
+	ShortHelp:  "Show current preference values",
+	LongHelp: `"tailscale get" shows the current value of one or all preferences.
+
+With no argument or "all", all preferences are shown.
+With a specific setting name, only that value is shown.
+
+The setting names are the same flag names accepted by "tailscale set".`,
+	FlagSet: getFlags,
+	Exec:    runGet,
+}
+
+type getArgsT struct {
+	json     bool
+	setFlags bool
+}
+
+var getArgs getArgsT
+
+var getFlags = newGetFlagSet(&getArgs)
+
+func newGetFlagSet(args *getArgsT) *flag.FlagSet {
+	fs := newFlagSet("get")
+	fs.BoolVar(&args.json, "json", false, "output as JSON")
+	fs.BoolVar(&args.setFlags, "set-flags", false, "output as \"tailscale set\" flag arguments")
+	return fs
+}
+
+// getSetting is a single preference name-value pair.
+type getSetting struct {
+	name  string
+	value any
+}
+
+func runGet(ctx context.Context, args []string) error {
+	prefs, err := localClient.GetPrefs(ctx)
+	if err != nil {
+		return err
+	}
+	st, err := localClient.Status(ctx)
+	if err != nil {
+		return err
+	}
+
+	settings, wantAll, err := selectSettings(prefs, st, effectiveGOOS(), args)
+	if err != nil {
+		return err
+	}
+
+	switch {
+	case getArgs.json:
+		return getOutputJSON(settings)
+	case getArgs.setFlags:
+		return getOutputSetFlags(settings)
+	case !wantAll:
+		// Single value: just print the raw value.
+		outln(fmt.Sprint(settings[0].value))
+		return nil
+	default:
+		return getOutputTable(settings)
+	}
+}
+
+// selectSettings validates args and returns the settings to display.
+// wantAll reports whether the caller asked for all settings (no arg or "all").
+func selectSettings(prefs *ipn.Prefs, st *ipnstate.Status, goos string, args []string) (settings []getSetting, wantAll bool, err error) {
+	if len(args) > 1 {
+		return nil, false, fmt.Errorf("too many arguments: %q", args)
+	}
+	wantAll = len(args) == 0 || args[0] == "all"
+	if wantAll {
+		return getSettingsFromPrefs(prefs, st, goos, false), true, nil
+	}
+	wantName := args[0]
+	// When querying a specific name, include hidden flags.
+	for _, s := range getSettingsFromPrefs(prefs, st, goos, true) {
+		if s.name == wantName {
+			return []getSetting{s}, false, nil
+		}
+	}
+	return nil, false, fmt.Errorf("unknown setting %q; see \"tailscale set --help\" for valid settings", wantName)
+}
+
+// getSettingsFromPrefs returns get-able settings derived from prefs,
+// using the same flag names as "tailscale set".
+// If includeHidden is false, flags with hidden usage strings are omitted.
+func getSettingsFromPrefs(prefs *ipn.Prefs, st *ipnstate.Status, goos string, includeHidden bool) []getSetting {
+	// Use the set command's flag set to get the canonical ordered list
+	// of flag names and to determine OS applicability.
+	var dummy setArgsT
+	fs := newSetFlagSet(goos, &dummy)
+
+	var settings []getSetting
+	fs.VisitAll(func(f *flag.Flag) {
+		if preflessFlag(f.Name) {
+			return
+		}
+		if !includeHidden && strings.HasPrefix(f.Usage, hidden) {
+			return
+		}
+		v := prefValue(f.Name, prefs, st)
+		settings = append(settings, getSetting{name: f.Name, value: v})
+	})
+	return settings
+}
+
+// prefValue returns the current value of the preference corresponding to
+// the given "tailscale set" flag name.
+func prefValue(flagName string, prefs *ipn.Prefs, st *ipnstate.Status) any {
+	switch flagName {
+	case "accept-routes":
+		return prefs.RouteAll
+	case "accept-dns":
+		return prefs.CorpDNS
+	case "exit-node":
+		if prefs.AutoExitNode.IsSet() {
+			return ipn.AutoExitNodePrefix + string(prefs.AutoExitNode)
+		}
+		ip := exitNodeIP(prefs, st)
+		if ip.IsValid() {
+			return ip.String()
+		}
+		return ""
+	case "exit-node-allow-lan-access":
+		return prefs.ExitNodeAllowLANAccess
+	case "shields-up":
+		return prefs.ShieldsUp
+	case "ssh":
+		return prefs.RunSSH
+	case "hostname":
+		return prefs.Hostname
+	case "advertise-routes":
+		var sb strings.Builder
+		for i, r := range tsaddr.WithoutExitRoutes(views.SliceOf(prefs.AdvertiseRoutes)).All() {
+			if i > 0 {
+				sb.WriteByte(',')
+			}
+			sb.WriteString(r.String())
+		}
+		return sb.String()
+	case "advertise-exit-node":
+		return tsaddr.ContainsExitRoutes(views.SliceOf(prefs.AdvertiseRoutes))
+	case "advertise-connector":
+		return prefs.AppConnector.Advertise
+	case "nickname":
+		return prefs.ProfileName
+	case "update-check":
+		return prefs.AutoUpdate.Check
+	case "auto-update":
+		return prefs.AutoUpdate.Apply.EqualBool(true)
+	case "report-posture":
+		return prefs.PostureChecking
+	case "webclient":
+		return prefs.RunWebClient
+	case "operator":
+		return prefs.OperatorUser
+	case "snat-subnet-routes":
+		return !prefs.NoSNAT
+	case "stateful-filtering":
+		val, ok := prefs.NoStatefulFiltering.Get()
+		if ok && val {
+			return false
+		}
+		return true
+	case "netfilter-mode":
+		return prefs.NetfilterMode.String()
+	case "unattended":
+		return prefs.ForceDaemon
+	case "sync":
+		return prefs.Sync.EqualBool(true)
+	case "remote-config":
+		return prefs.RemoteConfig
+	case "relay-server-port":
+		if prefs.RelayServerPort != nil {
+			return fmt.Sprint(*prefs.RelayServerPort)
+		}
+		return ""
+	case "relay-server-static-endpoints":
+		parts := make([]string, len(prefs.RelayServerStaticEndpoints))
+		for i, ep := range prefs.RelayServerStaticEndpoints {
+			parts[i] = ep.String()
+		}
+		return strings.Join(parts, ",")
+	default:
+		return nil
+	}
+}
+
+func getOutputTable(settings []getSetting) error {
+	w := tabwriter.NewWriter(Stdout, 0, 0, 2, ' ', 0)
+	fmt.Fprintf(w, "NAME\tVALUE\n")
+	for _, s := range settings {
+		fmt.Fprintf(w, "%s\t%v\n", s.name, s.value)
+	}
+	return w.Flush()
+}
+
+func getOutputJSON(settings []getSetting) error {
+	m := make(map[string]any, len(settings))
+	for _, s := range settings {
+		m[s.name] = s.value
+	}
+	j, err := json.MarshalIndent(m, "", "  ")
+	if err != nil {
+		return err
+	}
+	outln(string(j))
+	return nil
+}
+
+func getOutputSetFlags(settings []getSetting) error {
+	var parts []string
+	for _, s := range settings {
+		parts = append(parts, fmtFlagValueArg(s.name, s.value))
+	}
+	outln(strings.Join(parts, " "))
+	return nil
+}
diff --git a/cmd/tailscale/cli/get_test.go b/cmd/tailscale/cli/get_test.go
new file mode 100644
index 000000000..7b9f13ea3
--- /dev/null
+++ b/cmd/tailscale/cli/get_test.go
@@ -0,0 +1,596 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package cli
+
+import (
+	"bytes"
+	"encoding/json"
+	"flag"
+	"io"
+	"net/netip"
+	"reflect"
+	"strings"
+	"testing"
+
+	"tailscale.com/ipn"
+	"tailscale.com/ipn/ipnstate"
+	"tailscale.com/safesocket"
+	"tailscale.com/tailcfg"
+	"tailscale.com/tstest"
+	"tailscale.com/types/key"
+	"tailscale.com/types/opt"
+	"tailscale.com/types/preftype"
+)
+
+func TestPrefValue(t *testing.T) {
+	port := uint16(41641)
+	peerKey := key.NewNode().Public()
+	exitPeerID := tailcfg.StableNodeID("exit-peer")
+	exitPeerIP := netip.MustParseAddr("100.64.0.5")
+
+	stWithExitPeer := &ipnstate.Status{
+		Peer: map[key.NodePublic]*ipnstate.PeerStatus{
+			peerKey: {
+				ID:           exitPeerID,
+				TailscaleIPs: []netip.Addr{exitPeerIP},
+			},
+		},
+	}
+
+	tests := []struct {
+		name  string
+		flag  string
+		prefs *ipn.Prefs
+		st    *ipnstate.Status
+		want  any
+	}{
+		// Simple boolean prefs.
+		{
+			name:  "accept-routes-true",
+			flag:  "accept-routes",
+			prefs: &ipn.Prefs{RouteAll: true},
+			want:  true,
+		},
+		{
+			name:  "accept-routes-false",
+			flag:  "accept-routes",
+			prefs: &ipn.Prefs{},
+			want:  false,
+		},
+		{
+			name:  "accept-dns",
+			flag:  "accept-dns",
+			prefs: &ipn.Prefs{CorpDNS: true},
+			want:  true,
+		},
+		{
+			name:  "exit-node-allow-lan-access",
+			flag:  "exit-node-allow-lan-access",
+			prefs: &ipn.Prefs{ExitNodeAllowLANAccess: true},
+			want:  true,
+		},
+		{
+			name:  "shields-up",
+			flag:  "shields-up",
+			prefs: &ipn.Prefs{ShieldsUp: true},
+			want:  true,
+		},
+		{
+			name:  "ssh",
+			flag:  "ssh",
+			prefs: &ipn.Prefs{RunSSH: true},
+			want:  true,
+		},
+		{
+			name:  "advertise-connector",
+			flag:  "advertise-connector",
+			prefs: &ipn.Prefs{AppConnector: ipn.AppConnectorPrefs{Advertise: true}},
+			want:  true,
+		},
+		{
+			name:  "update-check",
+			flag:  "update-check",
+			prefs: &ipn.Prefs{AutoUpdate: ipn.AutoUpdatePrefs{Check: true}},
+			want:  true,
+		},
+		{
+			name:  "report-posture",
+			flag:  "report-posture",
+			prefs: &ipn.Prefs{PostureChecking: true},
+			want:  true,
+		},
+		{
+			name:  "webclient",
+			flag:  "webclient",
+			prefs: &ipn.Prefs{RunWebClient: true},
+			want:  true,
+		},
+		{
+			name:  "unattended",
+			flag:  "unattended",
+			prefs: &ipn.Prefs{ForceDaemon: true},
+			want:  true,
+		},
+
+		// Simple string prefs.
+		{
+			name:  "hostname",
+			flag:  "hostname",
+			prefs: &ipn.Prefs{Hostname: "myhost"},
+			want:  "myhost",
+		},
+		{
+			name:  "nickname",
+			flag:  "nickname",
+			prefs: &ipn.Prefs{ProfileName: "work"},
+			want:  "work",
+		},
+		{
+			name:  "operator",
+			flag:  "operator",
+			prefs: &ipn.Prefs{OperatorUser: "alice"},
+			want:  "alice",
+		},
+
+		// exit-node has three branches.
+		{
+			name:  "exit-node/auto",
+			flag:  "exit-node",
+			prefs: &ipn.Prefs{AutoExitNode: ipn.AnyExitNode},
+			want:  "auto:any",
+		},
+		{
+			name:  "exit-node/by-ip",
+			flag:  "exit-node",
+			prefs: &ipn.Prefs{ExitNodeIP: netip.MustParseAddr("100.64.0.1")},
+			want:  "100.64.0.1",
+		},
+		{
+			name:  "exit-node/by-id-resolves-via-status",
+			flag:  "exit-node",
+			prefs: &ipn.Prefs{ExitNodeID: exitPeerID},
+			st:    stWithExitPeer,
+			want:  exitPeerIP.String(),
+		},
+		{
+			name:  "exit-node/empty",
+			flag:  "exit-node",
+			prefs: &ipn.Prefs{},
+			want:  "",
+		},
+
+		// advertise-routes filters out exit routes, comma-joins.
+		{
+			name: "advertise-routes/multiple",
+			flag: "advertise-routes",
+			prefs: &ipn.Prefs{AdvertiseRoutes: []netip.Prefix{
+				netip.MustParsePrefix("10.0.0.0/24"),
+				netip.MustParsePrefix("192.168.0.0/16"),
+			}},
+			want: "10.0.0.0/24,192.168.0.0/16",
+		},
+		{
+			name: "advertise-routes/excludes-exit-routes",
+			flag: "advertise-routes",
+			prefs: &ipn.Prefs{AdvertiseRoutes: []netip.Prefix{
+				netip.MustParsePrefix("10.0.0.0/24"),
+				netip.MustParsePrefix("0.0.0.0/0"),
+				netip.MustParsePrefix("::/0"),
+			}},
+			want: "10.0.0.0/24",
+		},
+		{
+			name:  "advertise-routes/empty",
+			flag:  "advertise-routes",
+			prefs: &ipn.Prefs{},
+			want:  "",
+		},
+
+		// advertise-exit-node derives from AdvertiseRoutes.
+		{
+			name: "advertise-exit-node/true",
+			flag: "advertise-exit-node",
+			prefs: &ipn.Prefs{AdvertiseRoutes: []netip.Prefix{
+				netip.MustParsePrefix("0.0.0.0/0"),
+				netip.MustParsePrefix("::/0"),
+			}},
+			want: true,
+		},
+		{
+			name:  "advertise-exit-node/false-empty",
+			flag:  "advertise-exit-node",
+			prefs: &ipn.Prefs{},
+			want:  false,
+		},
+		{
+			name: "advertise-exit-node/false-only-subnet",
+			flag: "advertise-exit-node",
+			prefs: &ipn.Prefs{AdvertiseRoutes: []netip.Prefix{
+				netip.MustParsePrefix("10.0.0.0/24"),
+			}},
+			want: false,
+		},
+
+		// auto-update and sync use opt.Bool.EqualBool(true).
+		{
+			name:  "auto-update/unset-is-false",
+			flag:  "auto-update",
+			prefs: &ipn.Prefs{},
+			want:  false,
+		},
+		{
+			name:  "auto-update/explicit-true",
+			flag:  "auto-update",
+			prefs: &ipn.Prefs{AutoUpdate: ipn.AutoUpdatePrefs{Apply: opt.NewBool(true)}},
+			want:  true,
+		},
+		{
+			name:  "auto-update/explicit-false",
+			flag:  "auto-update",
+			prefs: &ipn.Prefs{AutoUpdate: ipn.AutoUpdatePrefs{Apply: opt.NewBool(false)}},
+			want:  false,
+		},
+		{
+			name:  "sync/unset-is-false",
+			flag:  "sync",
+			prefs: &ipn.Prefs{},
+			want:  false,
+		},
+		{
+			name:  "sync/explicit-true",
+			flag:  "sync",
+			prefs: &ipn.Prefs{Sync: opt.NewBool(true)},
+			want:  true,
+		},
+
+		// snat-subnet-routes is inverted.
+		{
+			name:  "snat-subnet-routes/default-true",
+			flag:  "snat-subnet-routes",
+			prefs: &ipn.Prefs{},
+			want:  true,
+		},
+		{
+			name:  "snat-subnet-routes/false-when-no-snat",
+			flag:  "snat-subnet-routes",
+			prefs: &ipn.Prefs{NoSNAT: true},
+			want:  false,
+		},
+
+		// stateful-filtering: the inversion of NoStatefulFiltering, defaulting on.
+		{
+			name:  "stateful-filtering/unset-is-true",
+			flag:  "stateful-filtering",
+			prefs: &ipn.Prefs{},
+			want:  true,
+		},
+		{
+			name:  "stateful-filtering/explicit-disabled-no-stateful",
+			flag:  "stateful-filtering",
+			prefs: &ipn.Prefs{NoStatefulFiltering: opt.NewBool(true)},
+			want:  false,
+		},
+		{
+			name:  "stateful-filtering/explicit-enabled-no-stateful",
+			flag:  "stateful-filtering",
+			prefs: &ipn.Prefs{NoStatefulFiltering: opt.NewBool(false)},
+			want:  true,
+		},
+
+		// netfilter-mode renders via String().
+		{
+			name:  "netfilter-mode/off",
+			flag:  "netfilter-mode",
+			prefs: &ipn.Prefs{NetfilterMode: preftype.NetfilterOff},
+			want:  "off",
+		},
+		{
+			name:  "netfilter-mode/on",
+			flag:  "netfilter-mode",
+			prefs: &ipn.Prefs{NetfilterMode: preftype.NetfilterOn},
+			want:  "on",
+		},
+
+		// relay-server-port: nil pointer vs explicit.
+		{
+			name:  "relay-server-port/unset",
+			flag:  "relay-server-port",
+			prefs: &ipn.Prefs{},
+			want:  "",
+		},
+		{
+			name:  "relay-server-port/set",
+			flag:  "relay-server-port",
+			prefs: &ipn.Prefs{RelayServerPort: &port},
+			want:  "41641",
+		},
+
+		// relay-server-static-endpoints: empty vs joined.
+		{
+			name:  "relay-server-static-endpoints/empty",
+			flag:  "relay-server-static-endpoints",
+			prefs: &ipn.Prefs{},
+			want:  "",
+		},
+		{
+			name: "relay-server-static-endpoints/multiple",
+			flag: "relay-server-static-endpoints",
+			prefs: &ipn.Prefs{RelayServerStaticEndpoints: []netip.AddrPort{
+				netip.MustParseAddrPort("192.0.2.1:40000"),
+				netip.MustParseAddrPort("[2001:db8::1]:40000"),
+			}},
+			want: "192.0.2.1:40000,[2001:db8::1]:40000",
+		},
+
+		// Unknown flag returns nil. This guards against the default branch
+		// silently producing nil for a flag that should have been wired up.
+		{
+			name:  "unknown-flag",
+			flag:  "no-such-flag",
+			prefs: &ipn.Prefs{},
+			want:  nil,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			st := tt.st
+			if st == nil {
+				st = &ipnstate.Status{}
+			}
+			got := prefValue(tt.flag, tt.prefs, st)
+			if !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("prefValue(%q) = %v (%T), want %v (%T)",
+					tt.flag, got, got, tt.want, tt.want)
+			}
+		})
+	}
+}
+
+// TestPrefValueCoversAllSetFlags is the load-bearing guard: every flag
+// that "tailscale set" exposes must have a corresponding prefValue case,
+// or "tailscale get" silently returns nil for it. It iterates the set
+// command's flag set across the platforms whose flag sets differ, so
+// OS-conditional flags (snat-subnet-routes, netfilter-mode, unattended,
+// operator, ...) are all covered.
+func TestPrefValueCoversAllSetFlags(t *testing.T) {
+	for _, goos := range []string{"linux", "darwin", "windows"} {
+		t.Run(goos, func(t *testing.T) {
+			var dummy setArgsT
+			fs := newSetFlagSet(goos, &dummy)
+			fs.VisitAll(func(f *flag.Flag) {
+				if preflessFlag(f.Name) {
+					return
+				}
+				if got := prefValue(f.Name, &ipn.Prefs{}, &ipnstate.Status{}); got == nil {
+					t.Errorf("prefValue(%q) returned nil; add a case for it in prefValue", f.Name)
+				}
+			})
+		})
+	}
+}
+
+func TestGetSettingsFromPrefsHiddenFlag(t *testing.T) {
+	prefs := &ipn.Prefs{}
+	st := &ipnstate.Status{}
+
+	visible := getSettingsFromPrefs(prefs, st, "linux", false)
+	if containsSetting(visible, "sync") {
+		t.Error("expected hidden flag --sync to be excluded when includeHidden=false")
+	}
+	if !containsSetting(visible, "accept-dns") {
+		t.Error("expected visible flag --accept-dns to be included")
+	}
+
+	withHidden := getSettingsFromPrefs(prefs, st, "linux", true)
+	if !containsSetting(withHidden, "sync") {
+		t.Error("expected hidden flag --sync to be included when includeHidden=true")
+	}
+
+	// Ordering must match the set flag set's VisitAll order.
+	var wantOrder []string
+	var dummy setArgsT
+	newSetFlagSet("linux", &dummy).VisitAll(func(f *flag.Flag) {
+		if preflessFlag(f.Name) {
+			return
+		}
+		wantOrder = append(wantOrder, f.Name)
+	})
+	var gotOrder []string
+	for _, s := range withHidden {
+		gotOrder = append(gotOrder, s.name)
+	}
+	if !reflect.DeepEqual(gotOrder, wantOrder) {
+		t.Errorf("setting order = %v, want %v", gotOrder, wantOrder)
+	}
+}
+
+func TestSelectSettings(t *testing.T) {
+	prefs := &ipn.Prefs{Hostname: "h", CorpDNS: true}
+	st := &ipnstate.Status{}
+	const goos = "linux"
+
+	t.Run("empty-args-returns-all-visible", func(t *testing.T) {
+		got, wantAll, err := selectSettings(prefs, st, goos, nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if !wantAll {
+			t.Error("wantAll = false; want true")
+		}
+		if containsSetting(got, "sync") {
+			t.Error("hidden flag --sync leaked into all-settings result")
+		}
+		if !containsSetting(got, "hostname") {
+			t.Error("missing --hostname in all-settings result")
+		}
+	})
+
+	t.Run("all-arg-same-as-empty", func(t *testing.T) {
+		empty, _, err := selectSettings(prefs, st, goos, nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		allArg, wantAll, err := selectSettings(prefs, st, goos, []string{"all"})
+		if err != nil {
+			t.Fatal(err)
+		}
+		if !wantAll {
+			t.Error("wantAll = false; want true for explicit \"all\"")
+		}
+		if !reflect.DeepEqual(empty, allArg) {
+			t.Errorf("\"all\" produced %v, empty produced %v", allArg, empty)
+		}
+	})
+
+	t.Run("specific-visible-flag", func(t *testing.T) {
+		got, wantAll, err := selectSettings(prefs, st, goos, []string{"hostname"})
+		if err != nil {
+			t.Fatal(err)
+		}
+		if wantAll {
+			t.Error("wantAll = true; want false for specific name")
+		}
+		if len(got) != 1 || got[0].name != "hostname" || got[0].value != "h" {
+			t.Errorf("got %+v, want [{hostname h}]", got)
+		}
+	})
+
+	t.Run("specific-hidden-flag", func(t *testing.T) {
+		// Hidden flags must be reachable by exact name.
+		got, _, err := selectSettings(prefs, st, goos, []string{"sync"})
+		if err != nil {
+			t.Fatal(err)
+		}
+		if len(got) != 1 || got[0].name != "sync" {
+			t.Errorf("got %+v, want [{sync ...}]", got)
+		}
+	})
+
+	t.Run("unknown-flag-errors", func(t *testing.T) {
+		_, _, err := selectSettings(prefs, st, goos, []string{"no-such-flag"})
+		if err == nil {
+			t.Fatal("expected error")
+		}
+		if !strings.Contains(err.Error(), "unknown setting") || !strings.Contains(err.Error(), "no-such-flag") {
+			t.Errorf("error %q missing expected substrings", err)
+		}
+	})
+
+	t.Run("too-many-args-errors", func(t *testing.T) {
+		_, _, err := selectSettings(prefs, st, goos, []string{"hostname", "ssh"})
+		if err == nil {
+			t.Fatal("expected error")
+		}
+		if !strings.Contains(err.Error(), "too many arguments") {
+			t.Errorf("error %q missing \"too many arguments\"", err)
+		}
+	})
+
+	t.Run("os-conditional-flag-on-wrong-goos", func(t *testing.T) {
+		// "netfilter-mode" is registered only on linux. Asking for it
+		// on darwin should produce an "unknown setting" error.
+		_, _, err := selectSettings(prefs, st, "darwin", []string{"netfilter-mode"})
+		if err == nil || !strings.Contains(err.Error(), "unknown setting") {
+			t.Errorf("got err=%v, want \"unknown setting\"", err)
+		}
+		// And operator is peer-creds-only.
+		if safesocket.GOOSUsesPeerCreds("windows") {
+			t.Skip("operator is exposed on windows")
+		}
+		_, _, err = selectSettings(prefs, st, "windows", []string{"operator"})
+		if err == nil || !strings.Contains(err.Error(), "unknown setting") {
+			t.Errorf("got err=%v, want \"unknown setting\"", err)
+		}
+	})
+}
+
+func TestGetOutputJSON(t *testing.T) {
+	var buf bytes.Buffer
+	tstest.Replace[io.Writer](t, &Stdout, &buf)
+
+	settings := []getSetting{
+		{name: "accept-dns", value: true},
+		{name: "hostname", value: "myhost"},
+		{name: "advertise-routes", value: "10.0.0.0/24"},
+		{name: "shields-up", value: false},
+	}
+	if err := getOutputJSON(settings); err != nil {
+		t.Fatal(err)
+	}
+
+	var got map[string]any
+	if err := json.Unmarshal(buf.Bytes(), &got); err != nil {
+		t.Fatalf("output is not valid JSON: %v\noutput: %s", err, buf.String())
+	}
+	want := map[string]any{
+		"accept-dns":       true,
+		"hostname":         "myhost",
+		"advertise-routes": "10.0.0.0/24",
+		"shields-up":       false,
+	}
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("got %v, want %v", got, want)
+	}
+}
+
+func TestGetOutputTable(t *testing.T) {
+	var buf bytes.Buffer
+	tstest.Replace[io.Writer](t, &Stdout, &buf)
+
+	settings := []getSetting{
+		{name: "accept-dns", value: true},
+		{name: "hostname", value: "myhost"},
+	}
+	if err := getOutputTable(settings); err != nil {
+		t.Fatal(err)
+	}
+
+	out := buf.String()
+	lines := strings.Split(strings.TrimRight(out, "\n"), "\n")
+	if len(lines) != 3 {
+		t.Fatalf("got %d lines, want 3:\n%s", len(lines), out)
+	}
+	if !strings.HasPrefix(lines[0], "NAME") || !strings.Contains(lines[0], "VALUE") {
+		t.Errorf("header line = %q, want NAME ... VALUE", lines[0])
+	}
+	if !strings.HasPrefix(lines[1], "accept-dns") || !strings.HasSuffix(lines[1], "true") {
+		t.Errorf("row 1 = %q", lines[1])
+	}
+	if !strings.HasPrefix(lines[2], "hostname") || !strings.HasSuffix(lines[2], "myhost") {
+		t.Errorf("row 2 = %q", lines[2])
+	}
+}
+
+func TestGetOutputSetFlags(t *testing.T) {
+	var buf bytes.Buffer
+	tstest.Replace[io.Writer](t, &Stdout, &buf)
+
+	settings := []getSetting{
+		{name: "ssh", value: true},
+		{name: "shields-up", value: false},
+		{name: "hostname", value: "myhost"},
+		{name: "advertise-routes", value: ""},
+	}
+	if err := getOutputSetFlags(settings); err != nil {
+		t.Fatal(err)
+	}
+
+	got := strings.TrimSpace(buf.String())
+	// true → bare flag; false → --flag=false; empty string → --flag=; other → --flag=value
+	want := "--ssh --shields-up=false --hostname=myhost --advertise-routes="
+	if got != want {
+		t.Errorf("got %q, want %q", got, want)
+	}
+}
+
+// containsSetting reports whether settings contains a setting with the given name.
+func containsSetting(settings []getSetting, name string) bool {
+	for _, s := range settings {
+		if s.name == name {
+			return true
+		}
+	}
+	return false
+}
diff --git a/cmd/tailscale/cli/ip.go b/cmd/tailscale/cli/ip.go
index b76ef0a70..6ff1cf867 100644
--- a/cmd/tailscale/cli/ip.go
+++ b/cmd/tailscale/cli/ip.go
@@ -13,13 +13,14 @@ import (
 
 	"github.com/peterbourgon/ff/v3/ffcli"
 	"tailscale.com/ipn/ipnstate"
+	"tailscale.com/tailcfg"
 )
 
 var ipCmd = &ffcli.Command{
 	Name:       "ip",
-	ShortUsage: "tailscale ip [-1] [-4] [-6] [peer hostname or ip address]",
+	ShortUsage: "tailscale ip [-1] [-4] [-6] [peer or service hostname or ip address]",
 	ShortHelp:  "Show Tailscale IP addresses",
-	LongHelp:   "Show Tailscale IP addresses for peer. Peer defaults to the current machine.",
+	LongHelp:   "Show Tailscale IP addresses for peer or service. Peer defaults to the current machine.",
 	Exec:       runIP,
 	FlagSet: (func() *flag.FlagSet {
 		fs := newFlagSet("ip")
@@ -79,10 +80,20 @@ func runIP(ctx context.Context, args []string) error {
 			return err
 		}
 		peer, ok := peerMatchingIP(st, ip)
-		if !ok {
-			return fmt.Errorf("no peer found with IP %v", ip)
+		if ok {
+			ips = peer.TailscaleIPs
+		} else {
+			// No peer matched; check if the IP belongs to a service.
+			serviceIPs, err := serviceAddrsMatchingIP(ctx, ip)
+			if err != nil {
+				return err
+			}
+			if serviceIPs != nil {
+				ips = serviceIPs
+			} else {
+				return fmt.Errorf("no peer or service found with IP %v", ip)
+			}
 		}
-		ips = peer.TailscaleIPs
 	}
 	if len(ips) == 0 {
 		return fmt.Errorf("no current Tailscale IPs; state: %v", st.BackendState)
@@ -109,6 +120,31 @@ func runIP(ctx context.Context, args []string) error {
 	return nil
 }
 
+// serviceAddrsMatchingIP checks whether ipStr matches a service's VIP address
+// and returns the service's addresses if so.
+func serviceAddrsMatchingIP(ctx context.Context, ipStr string) ([]netip.Addr, error) {
+	ip, err := netip.ParseAddr(ipStr)
+	if err != nil {
+		return nil, nil
+	}
+	services, err := localClient.GetServices(ctx)
+	if err != nil {
+		return nil, err
+	}
+	return allIPsForServiceWithIP(services, ip), nil
+}
+
+// allIPsForServiceWithIP returns the Addrs of the service whose VIP addresses
+// contain ip, or nil if no service matches.
+func allIPsForServiceWithIP(services map[tailcfg.ServiceName]tailcfg.ServiceDetails, ip netip.Addr) []netip.Addr {
+	for _, svc := range services {
+		if slices.Contains(svc.Addrs, ip) {
+			return svc.Addrs
+		}
+	}
+	return nil
+}
+
 func peerMatchingIP(st *ipnstate.Status, ipStr string) (ps *ipnstate.PeerStatus, ok bool) {
 	ip, err := netip.ParseAddr(ipStr)
 	if err != nil {
diff --git a/cmd/tailscale/cli/ip_test.go b/cmd/tailscale/cli/ip_test.go
new file mode 100644
index 000000000..9e5d31166
--- /dev/null
+++ b/cmd/tailscale/cli/ip_test.go
@@ -0,0 +1,199 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package cli
+
+import (
+	"net/netip"
+	"testing"
+
+	"tailscale.com/ipn/ipnstate"
+	"tailscale.com/tailcfg"
+	"tailscale.com/types/key"
+)
+
+func TestPeerMatchingIP(t *testing.T) {
+	st := &ipnstate.Status{
+		Self: &ipnstate.PeerStatus{
+			TailscaleIPs: []netip.Addr{netip.MustParseAddr("100.64.0.1"), netip.MustParseAddr("fd7a:115c:a1e0::1")},
+		},
+		Peer: map[key.NodePublic]*ipnstate.PeerStatus{
+			key.NewNode().Public(): {
+				TailscaleIPs: []netip.Addr{netip.MustParseAddr("100.64.0.2"), netip.MustParseAddr("fd7a:115c:a1e0::2")},
+			},
+			key.NewNode().Public(): {
+				TailscaleIPs: []netip.Addr{netip.MustParseAddr("100.64.0.3")},
+			},
+		},
+	}
+
+	tests := []struct {
+		name    string
+		ipStr   string
+		wantOK  bool
+		wantIPs []netip.Addr
+	}{
+		{
+			name:    "match_self_v4",
+			ipStr:   "100.64.0.1",
+			wantOK:  true,
+			wantIPs: []netip.Addr{netip.MustParseAddr("100.64.0.1"), netip.MustParseAddr("fd7a:115c:a1e0::1")},
+		},
+		{
+			name:    "match_self_v6",
+			ipStr:   "fd7a:115c:a1e0::1",
+			wantOK:  true,
+			wantIPs: []netip.Addr{netip.MustParseAddr("100.64.0.1"), netip.MustParseAddr("fd7a:115c:a1e0::1")},
+		},
+		{
+			name:    "match_peer_v4",
+			ipStr:   "100.64.0.2",
+			wantOK:  true,
+			wantIPs: []netip.Addr{netip.MustParseAddr("100.64.0.2"), netip.MustParseAddr("fd7a:115c:a1e0::2")},
+		},
+		{
+			name:    "match_peer_single_ip",
+			ipStr:   "100.64.0.3",
+			wantOK:  true,
+			wantIPs: []netip.Addr{netip.MustParseAddr("100.64.0.3")},
+		},
+		{
+			name:   "no_match",
+			ipStr:  "100.64.0.99",
+			wantOK: false,
+		},
+		{
+			name:   "invalid_ip",
+			ipStr:  "not-an-ip",
+			wantOK: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ps, ok := peerMatchingIP(st, tt.ipStr)
+			if ok != tt.wantOK {
+				t.Fatalf("peerMatchingIP(%q) ok = %v, want %v", tt.ipStr, ok, tt.wantOK)
+			}
+			if ok {
+				if len(ps.TailscaleIPs) != len(tt.wantIPs) {
+					t.Fatalf("got %d IPs, want %d", len(ps.TailscaleIPs), len(tt.wantIPs))
+				}
+				for i, ip := range ps.TailscaleIPs {
+					if ip != tt.wantIPs[i] {
+						t.Errorf("IP[%d] = %v, want %v", i, ip, tt.wantIPs[i])
+					}
+				}
+			}
+		})
+	}
+}
+
+func TestAllIPsForServiceWithIP(t *testing.T) {
+	services := map[tailcfg.ServiceName]tailcfg.ServiceDetails{
+		"svc:web": {
+			Name: "svc:web",
+			Addrs: []netip.Addr{
+				netip.MustParseAddr("100.100.0.1"),
+				netip.MustParseAddr("fd7a:115c:a1e0:ab12::1"),
+			},
+		},
+		"svc:api": {
+			Name:  "svc:api",
+			Addrs: []netip.Addr{netip.MustParseAddr("100.100.0.2")},
+		},
+	}
+	// Services should have at most 2 addrs (one v4, one v6), but
+	// we handle more gracefully if the server ever returns them.
+	multiAddr := map[tailcfg.ServiceName]tailcfg.ServiceDetails{
+		"svc:multi": {
+			Name: "svc:multi",
+			Addrs: []netip.Addr{
+				netip.MustParseAddr("100.100.0.3"),
+				netip.MustParseAddr("100.100.0.4"),
+				netip.MustParseAddr("fd7a:115c:a1e0:ab12::3"),
+				netip.MustParseAddr("fd7a:115c:a1e0:ab12::4"),
+			},
+		},
+	}
+
+	tests := []struct {
+		name     string
+		services map[tailcfg.ServiceName]tailcfg.ServiceDetails
+		ip       netip.Addr
+		wantIPs  []netip.Addr
+	}{
+		{
+			name:     "match_service_v4",
+			services: services,
+			ip:       netip.MustParseAddr("100.100.0.1"),
+			wantIPs: []netip.Addr{
+				netip.MustParseAddr("100.100.0.1"),
+				netip.MustParseAddr("fd7a:115c:a1e0:ab12::1"),
+			},
+		},
+		{
+			name:     "match_service_v6",
+			services: services,
+			ip:       netip.MustParseAddr("fd7a:115c:a1e0:ab12::1"),
+			wantIPs: []netip.Addr{
+				netip.MustParseAddr("100.100.0.1"),
+				netip.MustParseAddr("fd7a:115c:a1e0:ab12::1"),
+			},
+		},
+		{
+			name:     "match_single_addr_service",
+			services: services,
+			ip:       netip.MustParseAddr("100.100.0.2"),
+			wantIPs:  []netip.Addr{netip.MustParseAddr("100.100.0.2")},
+		},
+		{
+			name:     "match_service_multiple_addrs_v4",
+			services: multiAddr,
+			ip:       netip.MustParseAddr("100.100.0.3"),
+			wantIPs: []netip.Addr{
+				netip.MustParseAddr("100.100.0.3"),
+				netip.MustParseAddr("100.100.0.4"),
+				netip.MustParseAddr("fd7a:115c:a1e0:ab12::3"),
+				netip.MustParseAddr("fd7a:115c:a1e0:ab12::4"),
+			},
+		},
+		{
+			name:     "match_service_multiple_addrs_v6",
+			services: multiAddr,
+			ip:       netip.MustParseAddr("fd7a:115c:a1e0:ab12::3"),
+			wantIPs: []netip.Addr{
+				netip.MustParseAddr("100.100.0.3"),
+				netip.MustParseAddr("100.100.0.4"),
+				netip.MustParseAddr("fd7a:115c:a1e0:ab12::3"),
+				netip.MustParseAddr("fd7a:115c:a1e0:ab12::4"),
+			},
+		},
+		{
+			name:     "no_match",
+			services: services,
+			ip:       netip.MustParseAddr("100.100.0.99"),
+			wantIPs:  nil,
+		},
+		{
+			name:     "empty_services",
+			services: nil,
+			ip:       netip.MustParseAddr("100.100.0.1"),
+			wantIPs:  nil,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := allIPsForServiceWithIP(tt.services, tt.ip)
+			if len(got) != len(tt.wantIPs) {
+				t.Fatalf("allIPsForServiceWithIP(%v) returned %d IPs, want %d", tt.ip, len(got), len(tt.wantIPs))
+			}
+			for i, ip := range got {
+				if ip != tt.wantIPs[i] {
+					t.Errorf("IP[%d] = %v, want %v", i, ip, tt.wantIPs[i])
+				}
+			}
+		})
+	}
+}
diff --git a/cmd/tailscale/cli/jsonoutput/jsonoutput.go b/cmd/tailscale/cli/jsonoutput/jsonoutput.go
deleted file mode 100644
index 69e7374d9..000000000
--- a/cmd/tailscale/cli/jsonoutput/jsonoutput.go
+++ /dev/null
@@ -1,84 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-// Package jsonoutput provides stable and versioned JSON serialisation for CLI output.
-// This allows us to provide stable output to scripts/clients, but also make
-// breaking changes to the output when it's useful.
-//
-// Historically we only used `--json` as a boolean flag, so changing the output
-// could break scripts that rely on the existing format.
-//
-// This package allows callers to pass a version number to `--json` and get
-// a consistent output. We'll bump the version when we make a breaking change
-// that's likely to break scripts that rely on the existing output, e.g. if
-// we remove a field or change the type/format.
-//
-// Passing just the boolean flag `--json` will always return v1, to preserve
-// compatibility with scripts written before we versioned our output.
-package jsonoutput
-
-import (
-	"errors"
-	"fmt"
-	"strconv"
-)
-
-// JSONSchemaVersion implements flag.Value, and tracks whether the CLI has
-// been called with `--json`, and if so, with what value.
-type JSONSchemaVersion struct {
-	// IsSet tracks if the flag was provided at all.
-	IsSet bool
-
-	// Value tracks the desired schema version, which defaults to 1 if
-	// the user passes `--json` without an argument.
-	Value int
-}
-
-// String returns the default value which is printed in the CLI help text.
-func (v *JSONSchemaVersion) String() string {
-	if v.IsSet {
-		return strconv.Itoa(v.Value)
-	} else {
-		return "(not set)"
-	}
-}
-
-// Set is called when the user passes the flag as a command-line argument.
-func (v *JSONSchemaVersion) Set(s string) error {
-	if v.IsSet {
-		return errors.New("received multiple instances of --json; only pass it once")
-	}
-
-	v.IsSet = true
-
-	// If the user doesn't supply a schema version, default to 1.
-	// This ensures that any existing scripts will continue to get their
-	// current output.
-	if s == "true" {
-		v.Value = 1
-		return nil
-	}
-
-	version, err := strconv.Atoi(s)
-	if err != nil {
-		return fmt.Errorf("invalid integer value passed to --json: %q", s)
-	}
-	v.Value = version
-	return nil
-}
-
-// IsBoolFlag tells the flag package that JSONSchemaVersion can be set
-// without an argument.
-func (v *JSONSchemaVersion) IsBoolFlag() bool {
-	return true
-}
-
-// ResponseEnvelope is a set of fields common to all versioned JSON output.
-type ResponseEnvelope struct {
-	// SchemaVersion is the version of the JSON output, e.g. "1", "2", "3"
-	SchemaVersion string
-
-	// ResponseWarning tells a user if a newer version of the JSON output
-	// is available.
-	ResponseWarning string `json:"_WARNING,omitzero"`
-}
diff --git a/cmd/tailscale/cli/maybe_captiveportal.go b/cmd/tailscale/cli/maybe_captiveportal.go
new file mode 100644
index 000000000..1994b5628
--- /dev/null
+++ b/cmd/tailscale/cli/maybe_captiveportal.go
@@ -0,0 +1,10 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !ts_omit_captiveportal
+
+package cli
+
+// Import the netcheck captive portal hook package so that the netcheck
+// command also probes for captive portals during its report.
+import _ "tailscale.com/feature/captiveportal/netcheckhook"
diff --git a/cmd/tailscale/cli/netcheck.go b/cmd/tailscale/cli/netcheck.go
index 5e45445c7..52d66d516 100644
--- a/cmd/tailscale/cli/netcheck.go
+++ b/cmd/tailscale/cli/netcheck.go
@@ -26,6 +26,7 @@ import (
 	"tailscale.com/net/portmapper/portmappertype"
 	"tailscale.com/net/tlsdial"
 	"tailscale.com/tailcfg"
+	"tailscale.com/tstime"
 	"tailscale.com/types/logger"
 	"tailscale.com/util/eventbus"
 	"tailscale.com/util/set"
@@ -143,7 +144,7 @@ func runNetcheck(ctx context.Context, args []string) error {
 		if err != nil {
 			return fmt.Errorf("netcheck: %w", err)
 		}
-		if err := printReport(dm, report); err != nil {
+		if err := printNetCheckReport(dm, report); err != nil {
 			return err
 		}
 		if netcheckArgs.every == 0 {
@@ -153,7 +154,7 @@ func runNetcheck(ctx context.Context, args []string) error {
 	}
 }
 
-func printReport(dm *tailcfg.DERPMap, report *netcheck.Report) error {
+func printNetCheckReport(dm *tailcfg.DERPMap, report *netcheck.Report) error {
 	var j []byte
 	var err error
 	switch netcheckArgs.format {
@@ -175,7 +176,7 @@ func printReport(dm *tailcfg.DERPMap, report *netcheck.Report) error {
 	}
 
 	printf("\nReport:\n")
-	printf("\t* Time: %v\n", report.Now.Format(time.RFC3339Nano))
+	printf("\t* Time: %v\n", report.Now.Local().Format(tstime.DateSpTimeNanoZ))
 	printf("\t* UDP: %v\n", report.UDP)
 	if report.GlobalV4.IsValid() {
 		printf("\t* IPv4: yes, %s\n", report.GlobalV4)
diff --git a/cmd/tailscale/cli/routecheck.go b/cmd/tailscale/cli/routecheck.go
new file mode 100644
index 000000000..c5162f98f
--- /dev/null
+++ b/cmd/tailscale/cli/routecheck.go
@@ -0,0 +1,122 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !ts_omit_routecheck
+
+package cli
+
+import (
+	"cmp"
+	"context"
+	"flag"
+	"fmt"
+	"slices"
+	"strings"
+	"text/tabwriter"
+
+	jsonv2 "github.com/go-json-experiment/json"
+	"github.com/go-json-experiment/json/jsontext"
+	"github.com/peterbourgon/ff/v3/ffcli"
+
+	"tailscale.com/cmd/tailscale/jsonoutput"
+	"tailscale.com/cmd/tailscale/tsroutecheckjsonv0"
+	"tailscale.com/net/routecheck"
+	"tailscale.com/tstime"
+)
+
+func init() {
+	maybeRoutecheckCmd = routecheckCmd
+}
+
+var routecheckCmd = func() *ffcli.Command {
+	return &ffcli.Command{
+		Name:       "routecheck",
+		ShortUsage: "tailscale routecheck",
+		ShortHelp:  "Print a reachability report for routes with multiple paths",
+		LongHelp:   hidden + `"tailscale routecheck" is an experimental feature; it is not a stable interface`,
+		Exec:       runRoutecheck,
+		FlagSet:    routecheckFlagSet,
+	}
+}
+
+var routecheckFlagSet = func() *flag.FlagSet {
+	fs := newFlagSet("routecheck")
+	fs.BoolVar(&routecheckArgs.probe, "probe", false, "probe now to generate a new reachability report")
+	fs.Var(&routecheckArgs.format, "format", `output format: empty (for human-readable), "json" or "json-line"`)
+	fs.Var(routecheckArgs.format.JSONBool(), "json", "output in JSON format")
+	return fs
+}()
+
+var routecheckArgs struct {
+	probe  bool
+	format jsonoutput.Format
+}
+
+func runRoutecheck(ctx context.Context, args []string) error {
+	routeCheck := localClient.RouteCheck
+	if routecheckArgs.probe {
+		routeCheck = localClient.RouteCheckProbe
+	}
+	rp, err := routeCheck(ctx)
+	if err != nil {
+		return fmt.Errorf("routecheck: %w", err)
+	}
+	if err := printRouteCheckReport(rp); err != nil {
+		return err
+	}
+	return nil
+}
+
+func printRouteCheckReport(rp *routecheck.Report) error {
+	var enc *jsontext.Encoder
+	switch routecheckArgs.format.String() {
+	case "":
+	case "json":
+		enc = jsontext.NewEncoder(Stdout, jsontext.WithIndent("\t"))
+	case "json-line":
+		enc = jsontext.NewEncoder(Stdout, jsontext.Multiline(false))
+	default:
+		return fmt.Errorf("unknown output format %q", routecheckArgs.format)
+	}
+
+	if rp == nil {
+		return fmt.Errorf("routecheck: report unavailable")
+	}
+	routes := rp.RoutablePrefixes()
+
+	// Don’t render prefixes that only have one router:
+	for pfx, nodes := range routes {
+		if len(nodes) <= 1 {
+			delete(routes, pfx)
+		}
+	}
+
+	if enc != nil {
+		out := tsroutecheckjsonv0.ReportResponse{
+			Done:   rp.Done,
+			Routes: routes,
+		}
+		if err := jsonv2.MarshalEncode(enc, out); err != nil {
+			return err
+		}
+		if _, err := Stdout.Write([]byte("\n")); err != nil {
+			return err
+		}
+		return nil
+	}
+
+	w := tabwriter.NewWriter(Stdout, 10, 5, 5, ' ', 0)
+	defer w.Flush()
+	fmt.Fprintf(w, "\nReachable routers at %s:\n", rp.Done.Local().Format(tstime.DateSpTimeZ))
+	fmt.Fprintf(w, "\n %s\t%s\t%s", "PREFIX", "IP", "HOSTNAME")
+	for prefix, nodes := range routes.Sorted() {
+		slices.SortFunc(nodes, func(a, b routecheck.Node) int {
+			return cmp.Compare(a.Name, b.Name) // order by hostname
+		})
+		for _, n := range nodes {
+			fmt.Fprintf(w, "\n %s\t%s\t%s", prefix, n.Addr, strings.TrimSuffix(n.Name, "."))
+		}
+	}
+	fmt.Fprintln(w)
+	return nil
+}
diff --git a/cmd/tailscale/cli/serve_legacy.go b/cmd/tailscale/cli/serve_legacy.go
index 837d88513..b8d9e2766 100644
--- a/cmd/tailscale/cli/serve_legacy.go
+++ b/cmd/tailscale/cli/serve_legacy.go
@@ -628,7 +628,7 @@ func (e *serveEnv) runServeStatus(ctx context.Context, args []string) error {
 		return nil
 	}
 	printFunnelStatus(ctx)
-	if sc == nil || (len(sc.TCP) == 0 && len(sc.Web) == 0 && len(sc.AllowFunnel) == 0) {
+	if isServeConfigEmpty(sc) {
 		printf("No serve config\n")
 		return nil
 	}
@@ -636,18 +636,8 @@ func (e *serveEnv) runServeStatus(ctx context.Context, args []string) error {
 	if err != nil {
 		return err
 	}
-	if sc.IsTCPForwardingAny() {
-		if err := printTCPStatusTree(ctx, sc, st); err != nil {
-			return err
-		}
-		printf("\n")
-	}
-	for hp := range sc.Web {
-		err := e.printWebStatusTree(sc, hp)
-		if err != nil {
-			return err
-		}
-		printf("\n")
+	if err := printServeStatusTrees(sc, st); err != nil {
+		return err
 	}
 	printFunnelWarning(sc)
 	return nil
@@ -660,82 +650,97 @@ func printTCPStatusTree(ctx context.Context, sc *ipn.ServeConfig, st *ipnstate.S
 			continue
 		}
 		hp := ipn.HostPort(net.JoinHostPort(dnsName, strconv.Itoa(int(p))))
-		tlsStatus := "TLS over TCP"
-		if h.TerminateTLS != "" {
-			tlsStatus = "TLS terminated"
-		}
 		fStatus := "tailnet only"
 		if sc.AllowFunnel[hp] {
 			fStatus = "Funnel on"
 		}
-		printf("|-- tcp://%s (%s, %s)\n", hp, tlsStatus, fStatus)
+		if h.TerminateTLS != "" {
+			printf("|-- tcp://%s (TLS-terminated TCP, %s)\n", hp, fStatus)
+		} else {
+			printf("|-- tcp://%s (%s)\n", hp, fStatus)
+		}
 		for _, a := range st.TailscaleIPs {
 			ipp := net.JoinHostPort(a.String(), strconv.Itoa(int(p)))
 			printf("|-- tcp://%s\n", ipp)
 		}
-		printf("|--> tcp://%s\n", h.TCPForward)
+		if strings.HasPrefix(h.TCPForward, "unix:") {
+			printf("|--> %s\n", h.TCPForward)
+		} else {
+			printf("|--> tcp://%s\n", h.TCPForward)
+		}
 	}
 	return nil
 }
 
-func (e *serveEnv) printWebStatusTree(sc *ipn.ServeConfig, hp ipn.HostPort) error {
-	// No-op if no serve config
-	if sc == nil {
+// printWebStatusTree renders one Web entry (the URL line plus its handler
+// tree) for either a node-level serve or a service-level serve. When
+// svcName is the empty string, the entry is treated as node-level. Service
+// entries include the service name in the URL annotation.
+//
+// funnel and https are computed by the caller from the parent ServeConfig
+// so this function does not need a reference to it.
+func printWebStatusTree(wsc *ipn.WebServerConfig, hp ipn.HostPort, funnel, https bool, svcName tailcfg.ServiceName) error {
+	if wsc == nil {
 		return nil
 	}
-	fStatus := "tailnet only"
-	if sc.AllowFunnel[hp] {
-		fStatus = "Funnel on"
-	}
 	host, portStr, _ := net.SplitHostPort(string(hp))
-
-	port, err := parseServePort(portStr)
-	if err != nil {
-		return fmt.Errorf("invalid port %q: %w", portStr, err)
-	}
-
 	scheme := "https"
-	if sc.IsServingHTTP(port, noService) {
+	if !https {
 		scheme = "http"
 	}
-
 	portPart := ":" + portStr
 	if scheme == "http" && portStr == "80" ||
 		scheme == "https" && portStr == "443" {
 		portPart = ""
 	}
-	if scheme == "http" {
-		hostname, _, _ := strings.Cut(host, ".")
-		printf("%s://%s%s (%s)\n", scheme, hostname, portPart, fStatus)
+
+	fStatus := "tailnet only"
+	if funnel {
+		fStatus = "Funnel on"
 	}
-	printf("%s://%s%s (%s)\n", scheme, host, portPart, fStatus)
-	srvTypeAndDesc := func(h *ipn.HTTPHandler) (string, string) {
-		switch {
-		case h.Path != "":
-			return "path", h.Path
-		case h.Proxy != "":
-			return "proxy", h.Proxy
-		case h.Text != "":
-			return "text", "\"" + elipticallyTruncate(h.Text, 20) + "\""
+	if svcName != "" {
+		printf("%s://%s%s (%s) (%s)\n", scheme, host, portPart, fStatus, svcName)
+	} else {
+		if scheme == "http" {
+			hostname, _, _ := strings.Cut(host, ".")
+			printf("%s://%s%s (%s)\n", scheme, hostname, portPart, fStatus)
 		}
-		return "", ""
+		printf("%s://%s%s (%s)\n", scheme, host, portPart, fStatus)
 	}
 
-	mounts := slicesx.MapKeys(sc.Web[hp].Handlers)
+	mounts := slicesx.MapKeys(wsc.Handlers)
+	if len(mounts) == 0 {
+		return nil
+	}
 	sort.Slice(mounts, func(i, j int) bool {
 		return len(mounts[i]) < len(mounts[j])
 	})
 	maxLen := len(mounts[len(mounts)-1])
 
 	for _, m := range mounts {
-		h := sc.Web[hp].Handlers[m]
-		t, d := srvTypeAndDesc(h)
+		h := wsc.Handlers[m]
+		t, d := serveHandlerDesc(h)
 		printf("%s %s%s %-5s %s\n", "|--", m, strings.Repeat(" ", maxLen-len(m)), t, d)
 	}
 
 	return nil
 }
 
+// serveHandlerDesc returns the type label and description for an
+// HTTPHandler, matching the format used by the Web tree printer for
+// node-level and service-level serves.
+func serveHandlerDesc(h *ipn.HTTPHandler) (string, string) {
+	switch {
+	case h.Path != "":
+		return "path", h.Path
+	case h.Proxy != "":
+		return "proxy", h.Proxy
+	case h.Text != "":
+		return "text", "\"" + elipticallyTruncate(h.Text, 20) + "\""
+	}
+	return "", ""
+}
+
 func elipticallyTruncate(s string, max int) string {
 	if len(s) <= max {
 		return s
@@ -848,10 +853,10 @@ func (e *serveEnv) enableFeatureInteractive(ctx context.Context, feature string,
 			e.lc.IncrementCounter(ctx, fmt.Sprintf("%s_enablement_lost_connection", feature), 1)
 			return err
 		}
-		if nm := n.NetMap; nm != nil && nm.SelfNode.Valid() {
+		if self := n.SelfChange; self != nil {
 			gotAll := true
 			for _, c := range caps {
-				if !nm.SelfNode.HasCap(c) {
+				if _, has := self.CapMap[c]; !has {
 					// The feature is not yet enabled.
 					// Continue blocking until it is.
 					gotAll = false
diff --git a/cmd/tailscale/cli/serve_status.go b/cmd/tailscale/cli/serve_status.go
new file mode 100644
index 000000000..6ba85ca59
--- /dev/null
+++ b/cmd/tailscale/cli/serve_status.go
@@ -0,0 +1,120 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !ts_omit_serve
+
+package cli
+
+import (
+	"context"
+	"maps"
+	"net"
+	"slices"
+	"strconv"
+
+	"tailscale.com/ipn"
+	"tailscale.com/ipn/ipnstate"
+	"tailscale.com/tailcfg"
+)
+
+// isServeConfigEmpty reports whether sc has no user-visible configuration
+// to render in the non-JSON status output.
+func isServeConfigEmpty(sc *ipn.ServeConfig) bool {
+	return sc == nil || (len(sc.TCP) == 0 && len(sc.Web) == 0 && len(sc.Services) == 0 && len(sc.AllowFunnel) == 0)
+}
+
+// printServeStatusTrees prints the tree-style human-readable status of sc,
+// including any node-level TCP and Web serve entries and any configured
+// services, to [Stdout]. It does not print the funnel-status header, the
+// no-config message, or the trailing funnel warning — callers are expected
+// to handle those.
+//
+// Ordering is deterministic: node TCP forwards (existing behavior), then
+// node Web entries by HostPort, then services by name.
+func printServeStatusTrees(sc *ipn.ServeConfig, st *ipnstate.Status) error {
+	if sc == nil {
+		return nil
+	}
+	if sc.IsTCPForwardingAny() {
+		if err := printTCPStatusTree(context.Background(), sc, st); err != nil {
+			return err
+		}
+		printf("\n")
+	}
+	for _, hp := range slices.Sorted(maps.Keys(sc.Web)) {
+		_, portStr, _ := net.SplitHostPort(string(hp))
+		port, err := parseServePort(portStr)
+		if err != nil {
+			return err
+		}
+		funnel := sc.AllowFunnel[hp]
+		https := !sc.IsServingHTTP(port, noService)
+		if err := printWebStatusTree(sc.Web[hp], hp, funnel, https, noService); err != nil {
+			return err
+		}
+		printf("\n")
+	}
+	for _, name := range slices.Sorted(maps.Keys(sc.Services)) {
+		if err := printServiceStatusTree(sc, st, name); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// printServiceStatusTree prints the tree-style status for a single
+// configured service. Each rendered URL/forward line is prefixed with the
+// service name in the URL annotation (e.g.
+// "https://db.example.ts.net (tailnet only) (svc:db)") so service entries
+// are visually distinct from node-level serves.
+func printServiceStatusTree(sc *ipn.ServeConfig, st *ipnstate.Status, name tailcfg.ServiceName) error {
+	svc, ok := sc.Services[name]
+	if !ok || svc == nil {
+		return nil
+	}
+
+	if svc.Tun {
+		printf("tun (L3 forwarding) (%s)\n\n", name)
+		return nil
+	}
+
+	suffix := ""
+	if st != nil && st.CurrentTailnet != nil {
+		suffix = st.CurrentTailnet.MagicDNSSuffix
+	}
+	host := name.WithoutPrefix()
+	if suffix != "" {
+		host = host + "." + suffix
+	}
+
+	// TCP forwards configured directly on the service.
+	for _, p := range slices.Sorted(maps.Keys(svc.TCP)) {
+		h := svc.TCP[p]
+		if h == nil || h.TCPForward == "" {
+			continue
+		}
+		hp := ipn.HostPort(net.JoinHostPort(host, strconv.Itoa(int(p))))
+		if h.TerminateTLS != "" {
+			printf("tcp://%s (TLS-terminated TCP, tailnet only) (%s)\n", hp, name)
+		} else {
+			printf("tcp://%s (tailnet only) (%s)\n", hp, name)
+		}
+		printf("|--> tcp://%s\n\n", h.TCPForward)
+	}
+
+	// Web entries (HTTP/HTTPS). Services have no Funnel concept.
+	for _, hp := range slices.Sorted(maps.Keys(svc.Web)) {
+		_, portStr, _ := net.SplitHostPort(string(hp))
+		port, err := parseServePort(portStr)
+		if err != nil {
+			return err
+		}
+		https := !sc.IsServingHTTP(port, name)
+		if err := printWebStatusTree(svc.Web[hp], hp, false, https, name); err != nil {
+			return err
+		}
+		printf("\n")
+	}
+
+	return nil
+}
diff --git a/cmd/tailscale/cli/serve_status_test.go b/cmd/tailscale/cli/serve_status_test.go
new file mode 100644
index 000000000..821a1d667
--- /dev/null
+++ b/cmd/tailscale/cli/serve_status_test.go
@@ -0,0 +1,308 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !ts_omit_serve
+
+package cli
+
+import (
+	"bytes"
+	"encoding/json"
+	"io"
+	"net"
+	"strings"
+	"testing"
+
+	"tailscale.com/ipn"
+	"tailscale.com/ipn/ipnstate"
+	"tailscale.com/tailcfg"
+	"tailscale.com/tstest"
+)
+
+// statusTestStatus is a minimal ipnstate.Status used by serve-status tests.
+var statusTestStatus = &ipnstate.Status{
+	BackendState: ipn.Running.String(),
+	Self: &ipnstate.PeerStatus{
+		DNSName: "foo.test.ts.net.",
+	},
+	CurrentTailnet: &ipnstate.TailnetStatus{MagicDNSSuffix: "test.ts.net"},
+}
+
+func TestPrintServeStatusTrees(t *testing.T) {
+	tests := []struct {
+		name string
+		sc   *ipn.ServeConfig
+		want string
+	}{
+		{
+			name: "node_web_tailnet_only",
+			sc: &ipn.ServeConfig{
+				TCP: map[uint16]*ipn.TCPPortHandler{443: {HTTPS: true}},
+				Web: map[ipn.HostPort]*ipn.WebServerConfig{
+					"foo.test.ts.net:443": {Handlers: map[string]*ipn.HTTPHandler{
+						"/": {Proxy: "http://127.0.0.1:3000"},
+					}},
+				},
+			},
+			want: strings.Join([]string{
+				"https://foo.test.ts.net (tailnet only)",
+				"|-- / proxy http://127.0.0.1:3000",
+				"",
+				"",
+			}, "\n"),
+		},
+		{
+			name: "node_tcp_funnel_on",
+			sc: &ipn.ServeConfig{
+				TCP: map[uint16]*ipn.TCPPortHandler{2222: {TCPForward: "127.0.0.1:22"}},
+				AllowFunnel: map[ipn.HostPort]bool{
+					"foo.test.ts.net:2222": true,
+				},
+			},
+			want: strings.Join([]string{
+				"|-- tcp://foo.test.ts.net:2222 (Funnel on)",
+				"|--> tcp://127.0.0.1:22",
+				"",
+				"",
+			}, "\n"),
+		},
+		{
+			name: "node_tls_terminated_tcp_tailnet",
+			sc: &ipn.ServeConfig{
+				TCP: map[uint16]*ipn.TCPPortHandler{
+					443: {TCPForward: "127.0.0.1:8080", TerminateTLS: "foo.test.ts.net"},
+				},
+			},
+			want: strings.Join([]string{
+				"|-- tcp://foo.test.ts.net:443 (TLS-terminated TCP, tailnet only)",
+				"|--> tcp://127.0.0.1:8080",
+				"",
+				"",
+			}, "\n"),
+		},
+		{
+			name: "service_web_only",
+			sc: &ipn.ServeConfig{
+				Services: map[tailcfg.ServiceName]*ipn.ServiceConfig{
+					"svc:db": {
+						TCP: map[uint16]*ipn.TCPPortHandler{443: {HTTPS: true}},
+						Web: map[ipn.HostPort]*ipn.WebServerConfig{
+							"db.test.ts.net:443": {Handlers: map[string]*ipn.HTTPHandler{
+								"/": {Proxy: "http://127.0.0.1:5432"},
+							}},
+						},
+					},
+				},
+			},
+			want: strings.Join([]string{
+				"https://db.test.ts.net (tailnet only) (svc:db)",
+				"|-- / proxy http://127.0.0.1:5432",
+				"",
+				"",
+			}, "\n"),
+		},
+		{
+			name: "service_tcp_forward",
+			sc: &ipn.ServeConfig{
+				Services: map[tailcfg.ServiceName]*ipn.ServiceConfig{
+					"svc:ssh": {
+						TCP: map[uint16]*ipn.TCPPortHandler{2222: {TCPForward: "127.0.0.1:22"}},
+					},
+				},
+			},
+			want: strings.Join([]string{
+				"tcp://ssh.test.ts.net:2222 (tailnet only) (svc:ssh)",
+				"|--> tcp://127.0.0.1:22",
+				"",
+				"",
+			}, "\n"),
+		},
+		{
+			name: "service_tls_terminated_tcp",
+			sc: &ipn.ServeConfig{
+				Services: map[tailcfg.ServiceName]*ipn.ServiceConfig{
+					"svc:foo": {
+						TCP: map[uint16]*ipn.TCPPortHandler{
+							443: {TCPForward: "127.0.0.1:8080", TerminateTLS: "foo.test.ts.net"},
+						},
+					},
+				},
+			},
+			want: strings.Join([]string{
+				"tcp://foo.test.ts.net:443 (TLS-terminated TCP, tailnet only) (svc:foo)",
+				"|--> tcp://127.0.0.1:8080",
+				"",
+				"",
+			}, "\n"),
+		},
+		{
+			name: "service_tun",
+			sc: &ipn.ServeConfig{
+				Services: map[tailcfg.ServiceName]*ipn.ServiceConfig{
+					"svc:vpn": {Tun: true},
+				},
+			},
+			want: strings.Join([]string{
+				"tun (L3 forwarding) (svc:vpn)",
+				"",
+				"",
+			}, "\n"),
+		},
+		{
+			name: "node_and_services_mixed",
+			sc: &ipn.ServeConfig{
+				TCP: map[uint16]*ipn.TCPPortHandler{443: {HTTPS: true}},
+				Web: map[ipn.HostPort]*ipn.WebServerConfig{
+					"foo.test.ts.net:443": {Handlers: map[string]*ipn.HTTPHandler{
+						"/": {Proxy: "http://127.0.0.1:3000"},
+					}},
+				},
+				AllowFunnel: map[ipn.HostPort]bool{
+					"foo.test.ts.net:443": true,
+				},
+				Services: map[tailcfg.ServiceName]*ipn.ServiceConfig{
+					"svc:db": {
+						TCP: map[uint16]*ipn.TCPPortHandler{5432: {TCPForward: "127.0.0.1:5432"}},
+					},
+				},
+			},
+			want: strings.Join([]string{
+				"https://foo.test.ts.net (Funnel on)",
+				"|-- / proxy http://127.0.0.1:3000",
+				"",
+				"tcp://db.test.ts.net:5432 (tailnet only) (svc:db)",
+				"|--> tcp://127.0.0.1:5432",
+				"",
+				"",
+			}, "\n"),
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var stdout, stderr bytes.Buffer
+			tstest.Replace(t, &Stdout, io.Writer(&stdout))
+			tstest.Replace(t, &Stderr, io.Writer(&stderr))
+
+			if err := printServeStatusTrees(tt.sc, statusTestStatus); err != nil {
+				t.Fatalf("printServeStatusTrees: %v", err)
+			}
+			if got := stdout.String(); got != tt.want {
+				t.Errorf("\nGot:\n%q\nExpected:\n%q", got, tt.want)
+			}
+			if got := stderr.String(); got != "" {
+				t.Errorf("unexpected Stderr output: %q", got)
+			}
+		})
+	}
+}
+
+// TestPrintServeStatusTreesParity asserts that the host-identifying keys
+// visible in the JSON serialization of a ServeConfig also appear in the
+// human-readable output, so the two views stay in lockstep. This is the
+// parity contract from issue #34163.
+//
+// It checks:
+//   - every Services key (service name)
+//   - every node-level Web HostPort host
+//   - every service-level Web HostPort host
+//   - every node-level TCP forward as a host:port string
+//   - every tun-mode service rendering the "tun" marker after its name
+func TestPrintServeStatusTreesParity(t *testing.T) {
+	sc := &ipn.ServeConfig{
+		TCP: map[uint16]*ipn.TCPPortHandler{
+			443:  {HTTPS: true},
+			2222: {TCPForward: "127.0.0.1:22"},
+		},
+		Web: map[ipn.HostPort]*ipn.WebServerConfig{
+			"foo.test.ts.net:443": {Handlers: map[string]*ipn.HTTPHandler{
+				"/": {Proxy: "http://127.0.0.1:3000"},
+			}},
+		},
+		AllowFunnel: map[ipn.HostPort]bool{
+			"foo.test.ts.net:2222": true,
+		},
+		Services: map[tailcfg.ServiceName]*ipn.ServiceConfig{
+			"svc:db": {
+				TCP: map[uint16]*ipn.TCPPortHandler{5432: {TCPForward: "127.0.0.1:5432"}},
+			},
+			"svc:web": {
+				TCP: map[uint16]*ipn.TCPPortHandler{443: {HTTPS: true}},
+				Web: map[ipn.HostPort]*ipn.WebServerConfig{
+					"web.test.ts.net:443": {Handlers: map[string]*ipn.HTTPHandler{
+						"/api": {Proxy: "http://127.0.0.1:9000"},
+					}},
+				},
+			},
+			"svc:vpn": {Tun: true},
+		},
+	}
+
+	// Marshal to JSON and reparse as a generic map so the parity check walks
+	// the same wire shape clients see, not the typed Go values.
+	jsonBytes, err := json.Marshal(sc)
+	if err != nil {
+		t.Fatalf("json.Marshal: %v", err)
+	}
+	var raw map[string]any
+	if err := json.Unmarshal(jsonBytes, &raw); err != nil {
+		t.Fatalf("json.Unmarshal: %v", err)
+	}
+
+	var stdout, stderr bytes.Buffer
+	tstest.Replace(t, &Stdout, io.Writer(&stdout))
+	tstest.Replace(t, &Stderr, io.Writer(&stderr))
+
+	if err := printServeStatusTrees(sc, statusTestStatus); err != nil {
+		t.Fatalf("printServeStatusTrees: %v", err)
+	}
+	if got := stderr.String(); got != "" {
+		t.Errorf("unexpected Stderr output: %q", got)
+	}
+	human := stdout.String()
+
+	services, _ := raw["Services"].(map[string]any)
+	for name, sval := range services {
+		if !strings.Contains(human, name) {
+			t.Errorf("human output missing service name %q\n--- human ---\n%s", name, human)
+		}
+		svc, _ := sval.(map[string]any)
+		if tun, _ := svc["Tun"].(bool); tun {
+			tunLine := "tun (L3 forwarding) (" + name + ")"
+			if !strings.Contains(human, tunLine) {
+				t.Errorf("human output missing tun marker for %q\n--- human ---\n%s", tunLine, human)
+			}
+		}
+		web, _ := svc["Web"].(map[string]any)
+		for hp := range web {
+			host := strings.SplitN(hp, ":", 2)[0]
+			if !strings.Contains(human, host) {
+				t.Errorf("human output missing service %s Web host %q\n--- human ---\n%s", name, host, human)
+			}
+		}
+	}
+
+	if web, ok := raw["Web"].(map[string]any); ok {
+		for hp := range web {
+			host := strings.SplitN(hp, ":", 2)[0]
+			if !strings.Contains(human, host) {
+				t.Errorf("human output missing node Web host %q\n--- human ---\n%s", host, human)
+			}
+		}
+	}
+
+	nodeHost := strings.TrimSuffix(statusTestStatus.Self.DNSName, ".")
+	if tcp, ok := raw["TCP"].(map[string]any); ok {
+		for portStr, hVal := range tcp {
+			h, _ := hVal.(map[string]any)
+			fwd, _ := h["TCPForward"].(string)
+			if fwd == "" {
+				continue
+			}
+			hostport := net.JoinHostPort(nodeHost, portStr)
+			if !strings.Contains(human, hostport) {
+				t.Errorf("human output missing node TCP forward %q\n--- human ---\n%s", hostport, human)
+			}
+		}
+	}
+}
diff --git a/cmd/tailscale/cli/serve_v2.go b/cmd/tailscale/cli/serve_v2.go
index 13f5c09b8..6a41f7156 100644
--- a/cmd/tailscale/cli/serve_v2.go
+++ b/cmd/tailscale/cli/serve_v2.go
@@ -702,19 +702,26 @@ func (e *serveEnv) runServeGetConfig(ctx context.Context, args []string) (err er
 				} else {
 					proto = conffile.ProtoTCP
 				}
-				destHost, destPortStr, err := net.SplitHostPort(config.TCPForward)
-				if err != nil {
-					return nil, fmt.Errorf("parse TCPForward=%q: %w", config.TCPForward, err)
+				if strings.HasPrefix(config.TCPForward, "unix:") {
+					mak.Set(&sdf.Endpoints, &ppr, &conffile.Target{
+						Protocol:    proto,
+						Destination: config.TCPForward,
+					})
+				} else {
+					destHost, destPortStr, err := net.SplitHostPort(config.TCPForward)
+					if err != nil {
+						return nil, fmt.Errorf("parse TCPForward=%q: %w", config.TCPForward, err)
+					}
+					destPort, err := strconv.ParseUint(destPortStr, 10, 16)
+					if err != nil {
+						return nil, fmt.Errorf("parse port %q: %w", destPortStr, err)
+					}
+					mak.Set(&sdf.Endpoints, &ppr, &conffile.Target{
+						Protocol:         proto,
+						Destination:      destHost,
+						DestinationPorts: tailcfg.PortRange{First: uint16(destPort), Last: uint16(destPort)},
+					})
 				}
-				destPort, err := strconv.ParseUint(destPortStr, 10, 16)
-				if err != nil {
-					return nil, fmt.Errorf("parse port %q: %w", destPortStr, err)
-				}
-				mak.Set(&sdf.Endpoints, &ppr, &conffile.Target{
-					Protocol:         proto,
-					Destination:      destHost,
-					DestinationPorts: tailcfg.PortRange{First: uint16(destPort), Last: uint16(destPort)},
-				})
 			} else if config.HTTP || config.HTTPS {
 				webKey := ipn.HostPort(net.JoinHostPort(sniName, strconv.FormatUint(uint64(port), 10)))
 				handlers, ok := serviceConfig.Web[webKey]
@@ -732,25 +739,38 @@ func (e *serveEnv) runServeGetConfig(ctx context.Context, args []string) (err er
 						DestinationPorts: tailcfg.PortRange{},
 					})
 				} else if defaultHandler.Proxy != "" {
-					proto, rest, ok := strings.Cut(defaultHandler.Proxy, "://")
-					if !ok {
-						return nil, fmt.Errorf("service %q: invalid proxy handler %q", svcName, defaultHandler.Proxy)
-					}
-					host, portStr, err := net.SplitHostPort(rest)
-					if err != nil {
-						return nil, fmt.Errorf("service %q: invalid proxy handler %q: %w", svcName, defaultHandler.Proxy, err)
-					}
+					if strings.HasPrefix(defaultHandler.Proxy, "unix:") {
+						// HTTP over unix socket: h.Proxy is "unix:/path" without "://".
+						// The inbound protocol is HTTP(S); infer from useTLS.
+						httpProto := conffile.ProtoHTTP
+						if config.HTTPS {
+							httpProto = conffile.ProtoHTTPS
+						}
+						mak.Set(&sdf.Endpoints, &ppr, &conffile.Target{
+							Protocol:    httpProto,
+							Destination: defaultHandler.Proxy,
+						})
+					} else {
+						proto, rest, ok := strings.Cut(defaultHandler.Proxy, "://")
+						if !ok {
+							return nil, fmt.Errorf("service %q: invalid proxy handler %q", svcName, defaultHandler.Proxy)
+						}
+						host, portStr, err := net.SplitHostPort(rest)
+						if err != nil {
+							return nil, fmt.Errorf("service %q: invalid proxy handler %q: %w", svcName, defaultHandler.Proxy, err)
+						}
 
-					port, err := strconv.ParseUint(portStr, 10, 16)
-					if err != nil {
-						return nil, fmt.Errorf("service %q: parse port %q: %w", svcName, portStr, err)
-					}
+						port, err := strconv.ParseUint(portStr, 10, 16)
+						if err != nil {
+							return nil, fmt.Errorf("service %q: parse port %q: %w", svcName, portStr, err)
+						}
 
-					mak.Set(&sdf.Endpoints, &ppr, &conffile.Target{
-						Protocol:         conffile.ServiceProtocol(proto),
-						Destination:      host,
-						DestinationPorts: tailcfg.PortRange{First: uint16(port), Last: uint16(port)},
-					})
+						mak.Set(&sdf.Endpoints, &ppr, &conffile.Target{
+							Protocol:         conffile.ServiceProtocol(proto),
+							Destination:      host,
+							DestinationPorts: tailcfg.PortRange{First: uint16(port), Last: uint16(port)},
+						})
+					}
 				}
 			}
 		}
@@ -800,24 +820,57 @@ func (e *serveEnv) runServeGetConfig(ctx context.Context, args []string) (err er
 	return err
 }
 
+// serveConfigDocsURL documents the Services configuration file format that set-config prefers
+const serveConfigDocsURL = "https://tailscale.com/kb/1589/tailscale-services-configuration-file"
+
+const serveLegacyFormatWarning = "Warning: %q is in the legacy raw serve config format " +
+	"(as emitted by `tailscale serve status --json`), which is deprecated for set-config. " +
+	"Applying its services only. To migrate, run `tailscale serve get-config` to save your " +
+	"configuration in the supported format; see %s\n"
+
+const serveLegacyDroppedWarning = "Warning: ignoring node-level fields not supported by set-config: %s\n"
+
+// legacyNodeLevelFields returns the names of the populated top-level fields in
+// sc, other than Services, that set-config does not apply (it is services-only).
+func legacyNodeLevelFields(sc *ipn.ServeConfig) []string {
+	rest := sc.Clone()
+	rest.Services = nil
+	b, err := json.Marshal(rest)
+	if err != nil {
+		return nil
+	}
+	var m map[string]json.RawMessage
+	if err := json.Unmarshal(b, &m); err != nil {
+		return nil
+	}
+	fields := make([]string, 0, len(m))
+	for k := range m {
+		fields = append(fields, k)
+	}
+	sort.Strings(fields)
+	return fields
+}
+
 func (e *serveEnv) runServeSetConfig(ctx context.Context, args []string) (err error) {
 	if len(args) != 1 {
 		return errors.New("must specify filename")
 	}
+	filename := args[0]
 	forSingleService := e.service.Validate() == nil
-
-	var scf *conffile.ServicesConfigFile
 	if e.allServices && forSingleService {
 		return errors.New("cannot specify both --all and --service")
-	} else if e.allServices {
-		scf, err = conffile.LoadServicesConfig(args[0], "")
-	} else if forSingleService {
-		scf, err = conffile.LoadServicesConfig(args[0], e.service.String())
-	} else {
+	}
+	if !e.allServices && !forSingleService {
 		return errors.New("must specify either --service=svc:<service-name> or --all")
 	}
+
+	forService := ""
+	if forSingleService {
+		forService = e.service.String()
+	}
+	scf, err := conffile.LoadServicesConfig(filename, forService)
 	if err != nil {
-		return fmt.Errorf("could not read config from file %q: %w", args[0], err)
+		return fmt.Errorf("could not read config from file %q: %w", filename, err)
 	}
 
 	st, err := e.getLocalClientStatusWithoutPeers(ctx)
@@ -842,6 +895,29 @@ func (e *serveEnv) runServeSetConfig(ctx context.Context, args []string) (err er
 	}
 	advertisedServices := set.Set[string]{}
 
+	if scf.Version == conffile.LegacyVersion {
+		// Legacy raw ipn.ServeConfig (e.g. "tailscale serve status --json"
+		// output). Deprecated for set-config; apply only its services-oriented
+		// content, with a migration warning to stderr (never stdout, which
+		// callers may pipe).
+		legacy := scf.Legacy
+		fmt.Fprintf(e.stderr(), serveLegacyFormatWarning, filename, serveConfigDocsURL)
+		if dropped := legacyNodeLevelFields(legacy); len(dropped) > 0 {
+			fmt.Fprintf(e.stderr(), serveLegacyDroppedWarning, strings.Join(dropped, ", "))
+		}
+		for name, svcCfg := range legacy.Services {
+			if forSingleService && name != e.service {
+				continue
+			}
+			mak.Set(&sc.Services, name, svcCfg.Clone())
+			advertisedServices.Add(name.String())
+		}
+		if forSingleService && sc.Services[e.service] == nil {
+			return fmt.Errorf("service %q not found in %q", e.service, filename)
+		}
+	}
+
+	// scf.Services is nil for the legacy format, making this loop a no-op then.
 	for name, details := range scf.Services {
 		for ppr, ep := range details.Endpoints {
 			if ep.Protocol == conffile.ProtoTUN {
@@ -861,6 +937,10 @@ func (e *serveEnv) runServeSetConfig(ctx context.Context, args []string) (err er
 				var target string
 				if ep.Protocol == conffile.ProtoFile {
 					target = ep.Destination
+				} else if strings.HasPrefix(ep.Destination, "unix:") {
+					// Unix socket target: pass "unix:/path" through to setServe.
+					// Supported for HTTP(S), TCP, and TLS-terminated-TCP inbound.
+					target = ep.Destination
 				} else {
 					// map source port range 1-1 to destination port range
 					destPort := ep.DestinationPorts.First + (port - ppr.Ports.First)
@@ -1045,21 +1125,28 @@ func (e *serveEnv) messageForPort(sc *ipn.ServeConfig, st *ipnstate.Status, dnsN
 			output.WriteString(fmt.Sprintf("%s %-5s %s\n\n", "|--", t, d))
 		}
 	} else if tcpHandler != nil {
-
-		tlsStatus := "TLS over TCP"
+		var annotations []string
 		if tcpHandler.TerminateTLS != "" {
-			tlsStatus = "TLS terminated"
+			annotations = append(annotations, "TLS terminated")
 		}
 		if ver := tcpHandler.ProxyProtocol; ver != 0 {
-			tlsStatus = fmt.Sprintf("%s, PROXY protocol v%d", tlsStatus, ver)
+			annotations = append(annotations, fmt.Sprintf("PROXY protocol v%d", ver))
 		}
 
-		output.WriteString(fmt.Sprintf("|-- tcp://%s:%d (%s)\n", host, srvPort, tlsStatus))
+		output.WriteString(fmt.Sprintf("|-- tcp://%s:%d", host, srvPort))
+		if len(annotations) != 0 {
+			output.WriteString(fmt.Sprintf(" (%s)", strings.Join(annotations, ", ")))
+		}
+		output.WriteString("\n")
 		for _, a := range ips {
 			ipp := net.JoinHostPort(a.String(), strconv.Itoa(int(srvPort)))
 			output.WriteString(fmt.Sprintf("|-- tcp://%s\n", ipp))
 		}
-		output.WriteString(fmt.Sprintf("|--> tcp://%s\n\n", tcpHandler.TCPForward))
+		if strings.HasPrefix(tcpHandler.TCPForward, "unix:") {
+			output.WriteString(fmt.Sprintf("|--> %s\n\n", tcpHandler.TCPForward))
+		} else {
+			output.WriteString(fmt.Sprintf("|--> tcp://%s\n\n", tcpHandler.TCPForward))
+		}
 	}
 
 	if !forService && !e.bg.Value {
@@ -1122,8 +1209,8 @@ func (e *serveEnv) shouldWarnRemoteDestCompatibility(ctx context.Context, target
 		return nil
 	}
 
-	if filepath.IsAbs(target) || strings.HasPrefix(target, "text:") {
-		// local path or text target, nothing to check
+	if filepath.IsAbs(target) || strings.HasPrefix(target, "text:") || strings.HasPrefix(target, "unix:") {
+		// local path, text target, or unix socket, nothing to check
 		return nil
 	}
 
@@ -1216,14 +1303,28 @@ func (e *serveEnv) applyTCPServe(sc *ipn.ServeConfig, dnsName string, srcType se
 
 	svcName := tailcfg.AsServiceName(dnsName)
 
-	targetURL, err := ipn.ExpandProxyTargetValue(target, []string{"tcp"}, "tcp")
+	targetURL, err := ipn.ExpandProxyTargetValue(target, []string{"tcp", "unix"}, "tcp")
 	if err != nil {
 		return fmt.Errorf("unable to expand target: %v", err)
 	}
 
-	dstURL, err := url.Parse(targetURL)
-	if err != nil {
-		return fmt.Errorf("invalid TCP target %q: %v", target, err)
+	// For unix: targets, store the full "unix:/path" string as the forward address.
+	// For tcp: targets, extract the host:port from the parsed URL.
+	var fwdAddr string
+	if strings.HasPrefix(targetURL, "unix:") {
+		if proxyProtocol != 0 {
+			return fmt.Errorf("PROXY protocol is not supported with unix socket targets")
+		}
+		fwdAddr = targetURL
+	} else {
+		dstURL, err := url.Parse(targetURL)
+		if err != nil {
+			return fmt.Errorf("invalid TCP target %q: %v", target, err)
+		}
+		if dstURL.Port() == "" {
+			return fmt.Errorf("TCP target %q must include a port", target)
+		}
+		fwdAddr = dstURL.Host
 	}
 
 	if sc.IsServingWeb(srcPort, svcName) {
@@ -1232,17 +1333,17 @@ func (e *serveEnv) applyTCPServe(sc *ipn.ServeConfig, dnsName string, srcType se
 
 	// TODO: needs to account for multiple configs from foreground mode
 	if svcName := tailcfg.AsServiceName(dnsName); svcName != "" {
-		sc.SetTCPForwardingForService(srcPort, dstURL.Host, terminateTLS, svcName, proxyProtocol, mds)
+		sc.SetTCPForwardingForService(srcPort, fwdAddr, terminateTLS, svcName, proxyProtocol, mds)
 		return nil
 	}
 
 	// TODO: needs to account for multiple configs from foreground mode
 	if svcName != "" {
-		sc.SetTCPForwardingForService(srcPort, dstURL.Host, terminateTLS, svcName, proxyProtocol, mds)
+		sc.SetTCPForwardingForService(srcPort, fwdAddr, terminateTLS, svcName, proxyProtocol, mds)
 		return nil
 	}
 
-	sc.SetTCPForwarding(srcPort, dstURL.Host, terminateTLS, proxyProtocol, dnsName)
+	sc.SetTCPForwarding(srcPort, fwdAddr, terminateTLS, proxyProtocol, dnsName)
 	return nil
 }
 
diff --git a/cmd/tailscale/cli/serve_v2_test.go b/cmd/tailscale/cli/serve_v2_test.go
index 1d2a8ef86..b86c40139 100644
--- a/cmd/tailscale/cli/serve_v2_test.go
+++ b/cmd/tailscale/cli/serve_v2_test.go
@@ -13,6 +13,7 @@ import (
 	"path/filepath"
 	"reflect"
 	"regexp"
+	"runtime"
 	"slices"
 	"strconv"
 	"strings"
@@ -40,6 +41,7 @@ func TestServeDevConfigMutations(t *testing.T) {
 		name         string
 		steps        []step
 		initialState fakeLocalServeClient // use the zero value for empty config
+		skipOn       []string             // platforms on which to skip; GOOS values
 	}
 
 	// creaet a temporary directory for path-based destinations
@@ -483,6 +485,63 @@ func TestServeDevConfigMutations(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "tcp_unix_socket",
+			steps: []step{{
+				command: cmd("serve --tcp=3128 --bg unix:/var/run/app.sock"),
+				want: &ipn.ServeConfig{
+					TCP: map[uint16]*ipn.TCPPortHandler{
+						3128: {
+							TCPForward: "unix:/var/run/app.sock",
+						},
+					},
+				},
+			}},
+			skipOn: []string{"windows"},
+		},
+		{
+			name: "tls_terminated_tcp_unix_socket",
+			steps: []step{{
+				command: cmd("serve --tls-terminated-tcp=443 --bg unix:/var/run/app.sock"),
+				want: &ipn.ServeConfig{
+					TCP: map[uint16]*ipn.TCPPortHandler{
+						443: {
+							TCPForward:   "unix:/var/run/app.sock",
+							TerminateTLS: "foo.test.ts.net",
+						},
+					},
+				},
+			}},
+			skipOn: []string{"windows"},
+		},
+		{
+			name: "tcp_unix_socket_off",
+			steps: []step{
+				{
+					command: cmd("serve --tcp=3128 --bg unix:/var/run/app.sock"),
+					want: &ipn.ServeConfig{
+						TCP: map[uint16]*ipn.TCPPortHandler{
+							3128: {
+								TCPForward: "unix:/var/run/app.sock",
+							},
+						},
+					},
+				},
+				{
+					command: cmd("serve --tcp=3128 off"),
+					want:    &ipn.ServeConfig{},
+				},
+			},
+			skipOn: []string{"windows"},
+		},
+		{
+			name: "tcp_unix_socket_proxy_protocol_rejected",
+			steps: []step{{
+				command: cmd("serve --tcp=3128 --proxy-protocol=1 --bg unix:/var/run/app.sock"),
+				wantErr: anyErr(),
+			}},
+			skipOn: []string{"windows"},
+		},
 		{
 			name: "tcp_off",
 			steps: []step{
@@ -993,6 +1052,9 @@ func TestServeDevConfigMutations(t *testing.T) {
 
 	for _, group := range groups {
 		t.Run(group.name, func(t *testing.T) {
+			if slices.Contains(group.skipOn, runtime.GOOS) {
+				t.Skip("skipping on", runtime.GOOS)
+			}
 			lc := group.initialState
 			for i, st := range group.steps {
 				var stderr bytes.Buffer
@@ -1603,7 +1665,7 @@ func TestMessageForPort(t *testing.T) {
 			expected: strings.Join([]string{
 				msgServeAvailable,
 				"",
-				"|-- tcp://foo.test.ts.net:2200 (TLS over TCP)",
+				"|-- tcp://foo.test.ts.net:2200",
 				"|-- tcp://100.101.101.101:2200",
 				"|-- tcp://[fd7a:115c:a1e0:ab12:4843:cd96:6565:6565]:2200",
 				"|--> tcp://localhost:3000",
@@ -2361,3 +2423,278 @@ func ptrToReadOnlySlice[T any](s []T) *views.Slice[T] {
 	vs := views.SliceOf(s)
 	return &vs
 }
+
+func writeTmpServeConfig(t *testing.T, body string) string {
+	t.Helper()
+	p := filepath.Join(t.TempDir(), "serve.json")
+	if err := os.WriteFile(p, []byte(body), 0600); err != nil {
+		t.Fatal(err)
+	}
+	return p
+}
+
+// TestRunServeSetConfig covers set-config accepting both the declarative
+// Services configuration file (with a "version" field) and the legacy raw
+// ipn.ServeConfig format (no "version"), the latter applying services only and
+// warning on stderr.
+func TestRunServeSetConfig(t *testing.T) {
+	const fooSvc = tailcfg.ServiceName("svc:foo")
+
+	t.Run("legacy_all_services_only", func(t *testing.T) {
+		lc := &fakeLocalServeClient{config: &ipn.ServeConfig{}}
+		var stdout, stderr bytes.Buffer
+		e := &serveEnv{lc: lc, allServices: true, testStdout: &stdout, testStderr: &stderr}
+		path := writeTmpServeConfig(t, `{"Services":{"svc:foo":{"TCP":{"443":{"HTTPS":true}}}}}`)
+
+		if err := e.runServeSetConfig(context.Background(), []string{path}); err != nil {
+			t.Fatal(err)
+		}
+		if lc.setCount != 1 {
+			t.Fatalf("setCount = %d, want 1", lc.setCount)
+		}
+		svc := lc.config.Services[fooSvc]
+		if svc == nil || svc.TCP[443] == nil || !svc.TCP[443].HTTPS {
+			t.Errorf("svc:foo TCP/443 HTTPS not applied; got %+v", lc.config.Services)
+		}
+		if !slices.Contains(lc.prefs.AdvertiseServices, fooSvc.String()) {
+			t.Errorf("svc:foo not advertised; AdvertiseServices=%v", lc.prefs.AdvertiseServices)
+		}
+		if !strings.Contains(stderr.String(), "legacy raw serve config format") ||
+			!strings.Contains(stderr.String(), serveConfigDocsURL) {
+			t.Errorf("missing legacy migration warning; stderr:\n%s", stderr.String())
+		}
+		if strings.Contains(stderr.String(), "ignoring node-level fields") {
+			t.Errorf("unexpected dropped-fields warning; stderr:\n%s", stderr.String())
+		}
+		if stdout.Len() != 0 {
+			t.Errorf("stdout must stay clean, got:\n%s", stdout.String())
+		}
+	})
+
+	t.Run("legacy_drops_node_level_fields", func(t *testing.T) {
+		lc := &fakeLocalServeClient{config: &ipn.ServeConfig{}}
+		var stdout, stderr bytes.Buffer
+		e := &serveEnv{lc: lc, allServices: true, testStdout: &stdout, testStderr: &stderr}
+		path := writeTmpServeConfig(t, `{
+			"TCP":{"443":{"HTTPS":true}},
+			"Web":{"foo.test.ts.net:443":{"Handlers":{"/":{"Proxy":"http://127.0.0.1:3000"}}}},
+			"AllowFunnel":{"foo.test.ts.net:443":true},
+			"Services":{"svc:foo":{"Tun":true}}
+		}`)
+
+		if err := e.runServeSetConfig(context.Background(), []string{path}); err != nil {
+			t.Fatal(err)
+		}
+		if svc := lc.config.Services[fooSvc]; svc == nil || !svc.Tun {
+			t.Errorf("svc:foo Tun not applied; got %+v", lc.config.Services)
+		}
+		// Fields are derived from the JSON dynamically and sorted.
+		if !strings.Contains(stderr.String(), "ignoring node-level fields not supported by set-config: AllowFunnel, TCP, Web") {
+			t.Errorf("missing/incorrect dropped-fields warning; stderr:\n%s", stderr.String())
+		}
+		// Node-level content must not have leaked into the applied config.
+		if len(lc.config.TCP) != 0 || len(lc.config.Web) != 0 {
+			t.Errorf("node-level TCP/Web should not be applied; got TCP=%v Web=%v", lc.config.TCP, lc.config.Web)
+		}
+		if stdout.Len() != 0 {
+			t.Errorf("stdout must stay clean, got:\n%s", stdout.String())
+		}
+	})
+
+	t.Run("versionless_new_format_errors", func(t *testing.T) {
+		// A Services config file (lowercase "services"/"endpoints") that omits
+		// the required "version" field must error, not be misread as a legacy
+		// raw ServeConfig and silently wipe the existing config.
+		existing := &ipn.ServeConfig{Services: map[tailcfg.ServiceName]*ipn.ServiceConfig{
+			fooSvc: {Tun: true},
+		}}
+		lc := &fakeLocalServeClient{config: existing}
+		e := &serveEnv{lc: lc, allServices: true, testStdout: &bytes.Buffer{}, testStderr: &bytes.Buffer{}}
+		path := writeTmpServeConfig(t, `{"services":{"svc:foo":{"endpoints":{"tcp:443":"https://localhost:8000"}}}}`)
+
+		err := e.runServeSetConfig(context.Background(), []string{path})
+		if err == nil || !strings.Contains(err.Error(), "version") {
+			t.Fatalf("err = %v, want an error mentioning the missing version field", err)
+		}
+		if lc.setCount != 0 {
+			t.Errorf("setCount = %d, want 0 (existing config must not be wiped)", lc.setCount)
+		}
+		if lc.config.Services[fooSvc] == nil {
+			t.Errorf("existing svc:foo was wiped; got %+v", lc.config.Services)
+		}
+	})
+
+	t.Run("version_0_0_0_rejected", func(t *testing.T) {
+		// A file can never forge the internal LegacyVersion ("0.0.0") sentinel
+		// that LoadServicesConfig uses to wrap a legacy raw config: it is
+		// rejected as an unsupported version, and must not wipe existing config.
+		existing := &ipn.ServeConfig{Services: map[tailcfg.ServiceName]*ipn.ServiceConfig{
+			fooSvc: {Tun: true},
+		}}
+		lc := &fakeLocalServeClient{config: existing}
+		e := &serveEnv{lc: lc, allServices: true, testStdout: &bytes.Buffer{}, testStderr: &bytes.Buffer{}}
+		path := writeTmpServeConfig(t, `{"version":"0.0.0","services":{}}`)
+
+		err := e.runServeSetConfig(context.Background(), []string{path})
+		if err == nil || !strings.Contains(err.Error(), `unsupported config file version "0.0.0"`) {
+			t.Fatalf("err = %v, want an 'unsupported config file version \"0.0.0\"' error", err)
+		}
+		if lc.setCount != 0 {
+			t.Errorf("setCount = %d, want 0 (existing config must not be wiped)", lc.setCount)
+		}
+		if lc.config.Services[fooSvc] == nil {
+			t.Errorf("existing svc:foo was wiped; got %+v", lc.config.Services)
+		}
+	})
+
+	t.Run("legacy_service_selects_one", func(t *testing.T) {
+		lc := &fakeLocalServeClient{config: &ipn.ServeConfig{}}
+		var stdout, stderr bytes.Buffer
+		e := &serveEnv{lc: lc, service: fooSvc, testStdout: &stdout, testStderr: &stderr}
+		path := writeTmpServeConfig(t, `{"Services":{"svc:foo":{"Tun":true},"svc:bar":{"Tun":true}}}`)
+
+		if err := e.runServeSetConfig(context.Background(), []string{path}); err != nil {
+			t.Fatal(err)
+		}
+		if lc.config.Services[fooSvc] == nil {
+			t.Errorf("svc:foo not applied; got %+v", lc.config.Services)
+		}
+		if lc.config.Services[tailcfg.ServiceName("svc:bar")] != nil {
+			t.Errorf("svc:bar should not be applied with --service=svc:foo; got %+v", lc.config.Services)
+		}
+	})
+
+	t.Run("legacy_service_missing_errors", func(t *testing.T) {
+		lc := &fakeLocalServeClient{config: &ipn.ServeConfig{}}
+		e := &serveEnv{lc: lc, service: tailcfg.ServiceName("svc:missing"), testStdout: &bytes.Buffer{}, testStderr: &bytes.Buffer{}}
+		path := writeTmpServeConfig(t, `{"Services":{"svc:foo":{"Tun":true}}}`)
+
+		err := e.runServeSetConfig(context.Background(), []string{path})
+		if err == nil || !strings.Contains(err.Error(), "not found") {
+			t.Fatalf("err = %v, want a 'not found' error", err)
+		}
+		if lc.setCount != 0 {
+			t.Errorf("setCount = %d, want 0", lc.setCount)
+		}
+	})
+
+	t.Run("both_flags_error", func(t *testing.T) {
+		lc := &fakeLocalServeClient{config: &ipn.ServeConfig{}}
+		e := &serveEnv{lc: lc, allServices: true, service: fooSvc, testStdout: &bytes.Buffer{}, testStderr: &bytes.Buffer{}}
+		err := e.runServeSetConfig(context.Background(), []string{"unused.json"})
+		if err == nil || !strings.Contains(err.Error(), "cannot specify both") {
+			t.Fatalf("err = %v, want 'cannot specify both'", err)
+		}
+	})
+
+	t.Run("neither_flag_error", func(t *testing.T) {
+		lc := &fakeLocalServeClient{config: &ipn.ServeConfig{}}
+		e := &serveEnv{lc: lc, testStdout: &bytes.Buffer{}, testStderr: &bytes.Buffer{}}
+		err := e.runServeSetConfig(context.Background(), []string{"unused.json"})
+		if err == nil || !strings.Contains(err.Error(), "must specify either") {
+			t.Fatalf("err = %v, want 'must specify either'", err)
+		}
+	})
+
+	t.Run("new_format_all_no_warning", func(t *testing.T) {
+		lc := &fakeLocalServeClient{config: &ipn.ServeConfig{}}
+		var stdout, stderr bytes.Buffer
+		e := &serveEnv{lc: lc, allServices: true, testStdout: &stdout, testStderr: &stderr}
+		path := writeTmpServeConfig(t, `{"version":"0.0.1","services":{"svc:foo":{"endpoints":{"tcp:443":"https://localhost:8000"}}}}`)
+
+		if err := e.runServeSetConfig(context.Background(), []string{path}); err != nil {
+			t.Fatal(err)
+		}
+		if lc.setCount != 1 {
+			t.Fatalf("setCount = %d, want 1", lc.setCount)
+		}
+		if lc.config.Services[fooSvc] == nil {
+			t.Errorf("svc:foo not applied; got %+v", lc.config.Services)
+		}
+		if stderr.Len() != 0 {
+			t.Errorf("new format must not warn; stderr:\n%s", stderr.String())
+		}
+		if stdout.Len() != 0 {
+			t.Errorf("stdout must stay clean, got:\n%s", stdout.String())
+		}
+	})
+
+	t.Run("new_format_single_service_no_warning", func(t *testing.T) {
+		lc := &fakeLocalServeClient{config: &ipn.ServeConfig{}}
+		var stdout, stderr bytes.Buffer
+		e := &serveEnv{lc: lc, service: fooSvc, testStdout: &stdout, testStderr: &stderr}
+		path := writeTmpServeConfig(t, `{"version":"0.0.1","endpoints":{"tcp:443":"https://localhost:8000"}}`)
+
+		if err := e.runServeSetConfig(context.Background(), []string{path}); err != nil {
+			t.Fatal(err)
+		}
+		if lc.config.Services[fooSvc] == nil {
+			t.Errorf("svc:foo not applied; got %+v", lc.config.Services)
+		}
+		if stderr.Len() != 0 {
+			t.Errorf("new format must not warn; stderr:\n%s", stderr.String())
+		}
+	})
+
+	t.Run("http_over_unix_roundtrip", func(t *testing.T) {
+		if runtime.GOOS == "windows" {
+			t.Skip("skipping on windows")
+		}
+
+		// set-config: apply HTTP-over-unix declarative config; then get-config
+		// should reproduce a target of "http://unix:/var/run/app.sock" without
+		// mangling it through host:port parsing.
+		lc := &fakeLocalServeClient{config: &ipn.ServeConfig{}}
+		var stdout, stderr bytes.Buffer
+		e := &serveEnv{lc: lc, service: fooSvc, testStdout: &stdout, testStderr: &stderr}
+		path := writeTmpServeConfig(t, `{"version":"0.0.1","endpoints":{"tcp:443":"http://unix:/var/run/app.sock"}}`)
+
+		if err := e.runServeSetConfig(context.Background(), []string{path}); err != nil {
+			t.Fatalf("set-config: %v", err)
+		}
+		svc := lc.config.Services[fooSvc]
+		if svc == nil {
+			t.Fatalf("svc:foo not applied; got %+v", lc.config.Services)
+		}
+		if got := svc.Web["foo.test.ts.net:443"].Handlers["/"].Proxy; got != "unix:/var/run/app.sock" {
+			t.Errorf("Handler Proxy = %q, want %q", got, "unix:/var/run/app.sock")
+		}
+		if stderr.Len() != 0 {
+			t.Errorf("stderr must be empty; got:\n%s", stderr.String())
+		}
+
+		// Round-trip through get-config.
+		var gotStdout, gotStderr bytes.Buffer
+		g := &serveEnv{lc: lc, service: fooSvc, testStdout: &gotStdout, testStderr: &gotStderr}
+		if err := g.runServeGetConfig(context.Background(), nil); err != nil {
+			t.Fatalf("get-config: %v", err)
+		}
+		if !strings.Contains(gotStdout.String(), `"tcp:443": "http://unix:/var/run/app.sock"`) {
+			t.Errorf("get-config output missing http-over-unix target:\n%s", gotStdout.String())
+		}
+	})
+
+	t.Run("https_over_unix_roundtrip", func(t *testing.T) {
+		if runtime.GOOS == "windows" {
+			t.Skip("skipping on windows")
+		}
+
+		lc := &fakeLocalServeClient{config: &ipn.ServeConfig{}}
+		var stdout, stderr bytes.Buffer
+		e := &serveEnv{lc: lc, service: fooSvc, testStdout: &stdout, testStderr: &stderr}
+		path := writeTmpServeConfig(t, `{"version":"0.0.1","endpoints":{"tcp:443":"https://unix:/var/run/app.sock"}}`)
+
+		if err := e.runServeSetConfig(context.Background(), []string{path}); err != nil {
+			t.Fatalf("set-config: %v", err)
+		}
+
+		var gotStdout, gotStderr bytes.Buffer
+		g := &serveEnv{lc: lc, service: fooSvc, testStdout: &gotStdout, testStderr: &gotStderr}
+		if err := g.runServeGetConfig(context.Background(), nil); err != nil {
+			t.Fatalf("get-config: %v", err)
+		}
+		if !strings.Contains(gotStdout.String(), `"tcp:443": "https://unix:/var/run/app.sock"`) {
+			t.Errorf("get-config output missing https-over-unix target:\n%s", gotStdout.String())
+		}
+	})
+}
diff --git a/cmd/tailscale/cli/service.go b/cmd/tailscale/cli/service.go
new file mode 100644
index 000000000..35df8b6a0
--- /dev/null
+++ b/cmd/tailscale/cli/service.go
@@ -0,0 +1,266 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package cli
+
+import (
+	"cmp"
+	"context"
+	"encoding/json"
+	"flag"
+	"fmt"
+	"slices"
+	"strings"
+	"text/tabwriter"
+
+	"github.com/peterbourgon/ff/v3/ffcli"
+	"tailscale.com/ipn/ipnstate"
+	"tailscale.com/tailcfg"
+	"tailscale.com/types/ipproto"
+)
+
+// serviceLister is the subset of [local.Client] that the service commands
+// need. It is injected via the command's context (see [withServiceLister] /
+// [serviceListerFromContext]) so tests can supply a mock. Outside of tests
+// it is suplied by the package-level localClient var.
+//
+// NOTE(adrianosela): Could be replaced by a more generic way to mock
+// local.Client e.g. https://github.com/tailscale/tailscale/issues/20164.
+type serviceLister interface {
+	GetServices(ctx context.Context) (map[tailcfg.ServiceName]tailcfg.ServiceDetails, error)
+	Status(ctx context.Context) (*ipnstate.Status, error)
+}
+
+type serviceListerCtxKey struct{}
+
+// withServiceLister returns a copy of ctx carrying sl, retrievable with
+// [serviceListerFromContext].
+func withServiceLister(ctx context.Context, sl serviceLister) context.Context {
+	return context.WithValue(ctx, serviceListerCtxKey{}, sl)
+}
+
+// serviceListerFromContext returns the [serviceLister] stored in ctx by
+// [withServiceLister], or the package-level localClient if none was injected.
+func serviceListerFromContext(ctx context.Context) serviceLister {
+	if sl, ok := ctx.Value(serviceListerCtxKey{}).(serviceLister); ok {
+		return sl
+	}
+	return &localClient
+}
+
+const serviceListUsage = "tailscale service list"
+
+var serviceCmd = &ffcli.Command{
+	Name:       "service",
+	ShortHelp:  "Interact with Tailscale Services",
+	ShortUsage: "tailscale service",
+	LongHelp: strings.TrimSpace(`
+The 'tailscale service' command groups subcommands for Tailscale Services.
+
+A Tailscale Service is a virtual service with its own IP addresses. Which
+Services this node can reach is determined by the tailnet's ACLs. Use the 'list'
+subcommand to see the Services currently available to this node.
+`),
+	UsageFunc: usageFuncNoDefaultValues,
+	Exec:      func(context.Context, []string) error { return flag.ErrHelp },
+	Subcommands: []*ffcli.Command{
+		{
+			Name:       "list",
+			ShortUsage: serviceListUsage,
+			ShortHelp:  "List the Tailscale Services your node can access",
+			Exec:       runServiceList,
+			FlagSet: func() *flag.FlagSet {
+				fs := newFlagSet("list")
+				fs.BoolVar(&serviceListArgs.json, "json", false, "output in JSON format")
+				return fs
+			}(),
+		},
+	},
+}
+
+var serviceListArgs struct {
+	json bool
+}
+
+// serviceListEntry decorates a [tailcfg.ServiceDetails] with the Service's
+// MagicDNS hostname, both for the table's HOSTNAME column and so it is included
+// in the JSON output.
+type serviceListEntry struct {
+	tailcfg.ServiceDetails
+	Hostname string
+}
+
+// runServiceList is the entry point for the "tailscale service list" command.
+func runServiceList(ctx context.Context, args []string) error {
+	if len(args) != 0 {
+		return fmt.Errorf("usage: %s", serviceListUsage)
+	}
+
+	lc := serviceListerFromContext(ctx)
+
+	services, err := lc.GetServices(ctx)
+	if err != nil {
+		return err
+	}
+
+	// We need the tailnet's MagicDNS suffix to build each Service's hostname.
+	st, err := lc.Status(ctx)
+	if err != nil {
+		return fixTailscaledConnectError(err)
+	}
+	var magicDNSSuffix string
+	if st.CurrentTailnet != nil {
+		magicDNSSuffix = st.CurrentTailnet.MagicDNSSuffix
+	}
+
+	// Sort the services by name for stable output.
+	names := make([]tailcfg.ServiceName, 0, len(services))
+	for name := range services {
+		names = append(names, name)
+	}
+	slices.Sort(names)
+
+	entries := make([]serviceListEntry, 0, len(names))
+	for _, name := range names {
+		svc := services[name]
+		entries = append(entries, serviceListEntry{
+			ServiceDetails: svc,
+			Hostname:       serviceHostname(name, magicDNSSuffix),
+		})
+	}
+
+	if serviceListArgs.json {
+		enc := json.NewEncoder(Stdout)
+		enc.SetIndent("", "  ")
+		return enc.Encode(entries)
+	}
+
+	if len(entries) == 0 {
+		fmt.Fprintln(Stdout, "No Tailscale Services are available to this node.")
+		return nil
+	}
+
+	w := tabwriter.NewWriter(Stdout, 10, 5, 5, ' ', 0)
+	defer w.Flush()
+	fmt.Fprintf(w, "\n %s\t%s\t%s\t%s\t%s\t", "IP", "HOSTNAME", "DISPLAY NAME", "ENDPOINTS", "TYPE")
+	for _, e := range entries {
+		// Show a single IP, always the first in Addrs. If a tailnet has IPv4
+		// disabled, the netmap only includes the v6 address, so the 0th index
+		// is the v6 address and that's what we show.
+		var ip string
+		if len(e.Addrs) > 0 {
+			ip = e.Addrs[0].String()
+		}
+		fmt.Fprintf(w, "\n %s\t%s\t%s\t%s\t%s\t",
+			cmp.Or(ip, "-"),
+			cmp.Or(e.Hostname, "-"),
+			cmp.Or(e.DisplayName, "-"),
+			joinStringers(e.Ports, "-"),
+			serviceActionTypes(e.ServiceDetails),
+		)
+	}
+	fmt.Fprintln(w)
+	return nil
+}
+
+// wellKnownPortActions maps well-known TCP ports to the service action type
+// they conventionally correspond to. It is used to infer actions for Services
+// that don't carry explicit ones.
+//
+// TODO(adrianosela): move this to tailcfg as
+// InferredServiceActionForPort(p uint16) ServiceActionType.
+var wellKnownPortActions = map[uint16]tailcfg.ServiceActionType{
+	22:    tailcfg.ServiceActionTypeSSH,
+	80:    tailcfg.ServiceActionTypeHTTP,
+	443:   tailcfg.ServiceActionTypeHTTP,
+	1433:  tailcfg.ServiceActionTypeMSSQL,
+	3306:  tailcfg.ServiceActionTypeMySQL,
+	3389:  tailcfg.ServiceActionTypeRDP,
+	5432:  tailcfg.ServiceActionTypePostgreSQL,
+	5900:  tailcfg.ServiceActionTypeVNC,
+	6443:  tailcfg.ServiceActionTypeKubernetes,
+	9200:  tailcfg.ServiceActionTypeElasticSearch,
+	26257: tailcfg.ServiceActionTypeCockroachDB,
+	27017: tailcfg.ServiceActionTypeMongoDB,
+}
+
+// maxNamedTypes is the most action types serviceActionTypes names before
+// summarizing the remainder as "N other(s)".
+const maxNamedTypes = 2
+
+// serviceActionTypes renders a Service's action identifiers (types) for the
+// TYPE column. Types are deduplicated; it names at most [maxNamedTypes] of them
+// and summarizes any remainder, e.g. "-" for none, "http" for one, "http, ssh"
+// for two, and "http, ssh, 2 others" for more.
+//
+// Explicit actions are shown by type. When a Service carries no explicit
+// actions, types are inferred from well-known TCP ports (see
+// [wellKnownPortActions]).
+func serviceActionTypes(svc tailcfg.ServiceDetails) string {
+	var raw []tailcfg.ServiceActionType
+	if len(svc.Actions) > 0 {
+		for _, a := range svc.Actions {
+			raw = append(raw, a.Type)
+		}
+	} else {
+		for _, ppr := range svc.Ports {
+			// Only single TCP ports map to a well-known action.
+			if ppr.Proto != 0 && ppr.Proto != int(ipproto.TCP) {
+				continue
+			}
+			if ppr.Ports.First != ppr.Ports.Last {
+				continue
+			}
+			if t, ok := wellKnownPortActions[ppr.Ports.First]; ok {
+				raw = append(raw, t)
+			}
+		}
+	}
+
+	// Deduplicate, preserving first-seen order.
+	var types []string
+	seen := make(map[tailcfg.ServiceActionType]bool)
+	for _, t := range raw {
+		if seen[t] {
+			continue
+		}
+		seen[t] = true
+		types = append(types, string(t))
+	}
+
+	if len(types) == 0 {
+		return "-"
+	}
+	if len(types) <= maxNamedTypes {
+		return strings.Join(types, ", ")
+	}
+	extra := len(types) - maxNamedTypes
+	noun := "others"
+	if extra == 1 {
+		noun = "other"
+	}
+	return fmt.Sprintf("%s, %d %s", strings.Join(types[:maxNamedTypes], ", "), extra, noun)
+}
+
+// serviceHostname returns the MagicDNS hostname for a Service, of the form
+// "<name>.<magicDNSSuffix>". It returns "" if the name or suffix is missing.
+func serviceHostname(name tailcfg.ServiceName, magicDNSSuffix string) string {
+	bare := name.WithoutPrefix()
+	if bare == "" || magicDNSSuffix == "" {
+		return ""
+	}
+	return bare + "." + strings.Trim(magicDNSSuffix, ".")
+}
+
+// joinStringers renders a slice of fmt.Stringer-like values as a
+// comma-separated string, returning empty if the slice is empty.
+func joinStringers[T fmt.Stringer](vals []T, empty string) string {
+	if len(vals) == 0 {
+		return empty
+	}
+	strs := make([]string, len(vals))
+	for i, v := range vals {
+		strs[i] = v.String()
+	}
+	return strings.Join(strs, ", ")
+}
diff --git a/cmd/tailscale/cli/service_test.go b/cmd/tailscale/cli/service_test.go
new file mode 100644
index 000000000..f289ce97c
--- /dev/null
+++ b/cmd/tailscale/cli/service_test.go
@@ -0,0 +1,357 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package cli
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"net/netip"
+	"strings"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"tailscale.com/ipn/ipnstate"
+	"tailscale.com/tailcfg"
+	"tailscale.com/tstest"
+)
+
+// fakeServiceLister is a test-only [serviceLister] injected via
+// [withServiceLister] in place of the real localClient.
+type fakeServiceLister struct {
+	services    map[tailcfg.ServiceName]tailcfg.ServiceDetails
+	servicesErr error
+	status      *ipnstate.Status
+	statusErr   error
+}
+
+func (f fakeServiceLister) GetServices(context.Context) (map[tailcfg.ServiceName]tailcfg.ServiceDetails, error) {
+	return f.services, f.servicesErr
+}
+
+func (f fakeServiceLister) Status(context.Context) (*ipnstate.Status, error) {
+	return f.status, f.statusErr
+}
+
+// mustParsePorts parses ProtoPortRanges or fails the test.
+func mustParsePorts(t *testing.T, ports ...string) []tailcfg.ProtoPortRange {
+	t.Helper()
+	ppr, err := tailcfg.ParseProtoPortRanges(ports)
+	if err != nil {
+		t.Fatalf("ParseProtoPortRanges(%q): %v", ports, err)
+	}
+	return ppr
+}
+
+// statusWithSuffix returns a Status carrying the given MagicDNS suffix.
+func statusWithSuffix(suffix string) *ipnstate.Status {
+	return &ipnstate.Status{
+		CurrentTailnet: &ipnstate.TailnetStatus{MagicDNSSuffix: suffix},
+	}
+}
+
+// runList runs the list command with the given lister, capturing stdout.
+func runList(t *testing.T, lc serviceLister, jsonOut bool) string {
+	t.Helper()
+	var buf strings.Builder
+	tstest.Replace[io.Writer](t, &Stdout, &buf)
+	tstest.Replace(t, &serviceListArgs.json, jsonOut)
+
+	ctx := withServiceLister(context.Background(), lc)
+	if err := runServiceList(ctx, nil); err != nil {
+		t.Fatalf("runServiceList: %v", err)
+	}
+	return buf.String()
+}
+
+func TestServiceListTable(t *testing.T) {
+	lc := fakeServiceLister{
+		status: statusWithSuffix("ts-tailnet.ts.net."),
+		services: map[tailcfg.ServiceName]tailcfg.ServiceDetails{
+			// Intentionally out of order to exercise sorting.
+			"svc:web": {
+				Name:        "svc:web",
+				DisplayName: "Web",
+				Addrs:       []netip.Addr{netip.MustParseAddr("100.80.0.2"), netip.MustParseAddr("fd7a::2")},
+				Ports:       mustParsePorts(t, "tcp:443"),
+				// Two actions render comma-separated.
+				Actions: []tailcfg.ServiceAction{
+					{Type: tailcfg.ServiceActionTypeHTTP, Port: 443},
+					{Type: tailcfg.ServiceActionTypeSSH, Port: 22},
+				},
+			},
+			"svc:db": {
+				Name:  "svc:db",
+				Addrs: []netip.Addr{netip.MustParseAddr("100.80.0.1")},
+				Ports: mustParsePorts(t, "tcp:5432"),
+				// No explicit actions, but tcp:5432 infers "postgresql".
+			},
+		},
+	}
+
+	out := runList(t, lc, false)
+
+	for _, h := range []string{"IP", "HOSTNAME", "DISPLAY NAME", "ENDPOINTS", "TYPE"} {
+		if !strings.Contains(out, h) {
+			t.Errorf("output missing header %q\n%s", h, out)
+		}
+	}
+
+	// Services are sorted by name, so svc:db's row precedes svc:web's.
+	if i, j := strings.Index(out, "db.ts-tailnet.ts.net"), strings.Index(out, "web.ts-tailnet.ts.net"); i < 0 || j < 0 || i > j {
+		t.Errorf("services not sorted by name (db=%d, web=%d)\n%s", i, j, out)
+	}
+
+	// IP is the first address only; the v6 address is not shown.
+	if !strings.Contains(out, "100.80.0.2") {
+		t.Errorf("output missing svc:web first IP\n%s", out)
+	}
+	if strings.Contains(out, "fd7a::2") {
+		t.Errorf("output should show only the first IP, not the v6 address\n%s", out)
+	}
+
+	// Endpoints come from Ports.
+	if !strings.Contains(out, "tcp:443") || !strings.Contains(out, "tcp:5432") {
+		t.Errorf("output missing endpoints\n%s", out)
+	}
+
+	// svc:web has two explicit actions, rendered comma-separated.
+	if !strings.Contains(out, "http, ssh") {
+		t.Errorf("output missing svc:web actions %q\n%s", "http, ssh", out)
+	}
+
+	// svc:db has no explicit actions but a well-known port (5432), so its
+	// type is inferred.
+	if !strings.Contains(out, "postgresql") {
+		t.Errorf("output missing svc:db inferred type %q\n%s", "postgresql", out)
+	}
+}
+
+func TestServiceActionTypes(t *testing.T) {
+	tests := []struct {
+		name string
+		svc  tailcfg.ServiceDetails
+		want string
+	}{
+		{
+			"explicit one",
+			tailcfg.ServiceDetails{Actions: []tailcfg.ServiceAction{{Type: tailcfg.ServiceActionTypeSSH}}},
+			"ssh",
+		},
+		{
+			"explicit two",
+			tailcfg.ServiceDetails{Actions: []tailcfg.ServiceAction{
+				{Type: tailcfg.ServiceActionTypeHTTP},
+				{Type: tailcfg.ServiceActionTypeSSH},
+			}},
+			"http, ssh",
+		},
+		{
+			// More than maxNamedTypes: name two, summarize the rest.
+			"explicit three summarizes one other",
+			tailcfg.ServiceDetails{Actions: []tailcfg.ServiceAction{
+				{Type: tailcfg.ServiceActionTypeHTTP},
+				{Type: tailcfg.ServiceActionTypeSSH},
+				{Type: tailcfg.ServiceActionTypeMySQL},
+			}},
+			"http, ssh, 1 other",
+		},
+		{
+			"explicit four summarizes multiple others",
+			tailcfg.ServiceDetails{Actions: []tailcfg.ServiceAction{
+				{Type: tailcfg.ServiceActionTypeHTTP},
+				{Type: tailcfg.ServiceActionTypeSSH},
+				{Type: tailcfg.ServiceActionTypeMySQL},
+				{Type: tailcfg.ServiceActionTypeRDP},
+			}},
+			"http, ssh, 2 others",
+		},
+		{
+			// Duplicate types collapse before counting.
+			"explicit dedupes by type",
+			tailcfg.ServiceDetails{Actions: []tailcfg.ServiceAction{
+				{Type: tailcfg.ServiceActionTypeHTTP, Port: 80},
+				{Type: tailcfg.ServiceActionTypeHTTP, Port: 443},
+				{Type: tailcfg.ServiceActionTypeSSH, Port: 22},
+			}},
+			"http, ssh",
+		},
+		{
+			// Explicit actions win; ports are not consulted for inference.
+			"explicit beats inference",
+			tailcfg.ServiceDetails{
+				Actions: []tailcfg.ServiceAction{{Type: tailcfg.ServiceActionTypeTCP}},
+				Ports:   mustParsePorts(t, "tcp:22"),
+			},
+			"tcp",
+		},
+		{
+			"inferred from well-known port",
+			tailcfg.ServiceDetails{Ports: mustParsePorts(t, "tcp:22")},
+			"ssh",
+		},
+		{
+			"inferred from multiple well-known ports",
+			tailcfg.ServiceDetails{Ports: mustParsePorts(t, "tcp:80", "tcp:5432")},
+			"http, postgresql",
+		},
+		{
+			// 443 and 80 both map to http; it is only listed once.
+			"inferred dedupes by action type",
+			tailcfg.ServiceDetails{Ports: mustParsePorts(t, "tcp:80", "tcp:443")},
+			"http",
+		},
+		{
+			"no actions and unknown port",
+			tailcfg.ServiceDetails{Ports: mustParsePorts(t, "tcp:12345")},
+			"-",
+		},
+		{
+			// A port range is not a single well-known port, so nothing is inferred.
+			"port range is not inferred",
+			tailcfg.ServiceDetails{Ports: mustParsePorts(t, "tcp:20-30")},
+			"-",
+		},
+		{"nothing at all", tailcfg.ServiceDetails{}, "-"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := serviceActionTypes(tt.svc); got != tt.want {
+				t.Errorf("serviceActionTypes() = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
+
+// TestServiceListIPv6Only verifies that when a Service only has a v6 address
+// (e.g. a tailnet with IPv4 disabled), the v6 address is shown as the IP.
+func TestServiceListIPv6Only(t *testing.T) {
+	lc := fakeServiceLister{
+		status: statusWithSuffix("ts-tailnet.ts.net"),
+		services: map[tailcfg.ServiceName]tailcfg.ServiceDetails{
+			"svc:v6": {
+				Name:  "svc:v6",
+				Addrs: []netip.Addr{netip.MustParseAddr("fd7a::9")},
+				Ports: mustParsePorts(t, "tcp:80"),
+			},
+		},
+	}
+
+	out := runList(t, lc, false)
+	if !strings.Contains(out, "fd7a::9") {
+		t.Errorf("expected v6 address as IP\n%s", out)
+	}
+}
+
+func TestServiceListJSON(t *testing.T) {
+	lc := fakeServiceLister{
+		status: statusWithSuffix("ts-tailnet.ts.net"),
+		services: map[tailcfg.ServiceName]tailcfg.ServiceDetails{
+			// Intentionally out of order to exercise sorting, and svc:web has
+			// both v4 and v6 addresses to confirm the JSON carries the full
+			// address list (unlike the table, which shows only the first).
+			"svc:web": {
+				Name:        "svc:web",
+				DisplayName: "Web",
+				Addrs:       []netip.Addr{netip.MustParseAddr("100.80.0.2"), netip.MustParseAddr("fd7a::2")},
+				Ports:       mustParsePorts(t, "tcp:443", "tcp:8443"),
+			},
+			"svc:db": {
+				Name:  "svc:db",
+				Addrs: []netip.Addr{netip.MustParseAddr("100.80.0.1")},
+				Ports: mustParsePorts(t, "tcp:5432"),
+			},
+		},
+	}
+
+	out := runList(t, lc, true)
+
+	var got []serviceListEntry
+	if err := json.Unmarshal([]byte(out), &got); err != nil {
+		t.Fatalf("unmarshal JSON output: %v\n%s", err, out)
+	}
+
+	// Entries are sorted by name and each embedded ServiceDetails (including
+	// the full Addrs and Ports) round-trips, decorated with the hostname.
+	want := []serviceListEntry{
+		{
+			ServiceDetails: tailcfg.ServiceDetails{
+				Name:  "svc:db",
+				Addrs: []netip.Addr{netip.MustParseAddr("100.80.0.1")},
+				Ports: mustParsePorts(t, "tcp:5432"),
+			},
+			Hostname: "db.ts-tailnet.ts.net",
+		},
+		{
+			ServiceDetails: tailcfg.ServiceDetails{
+				Name:        "svc:web",
+				DisplayName: "Web",
+				Addrs:       []netip.Addr{netip.MustParseAddr("100.80.0.2"), netip.MustParseAddr("fd7a::2")},
+				Ports:       mustParsePorts(t, "tcp:443", "tcp:8443"),
+			},
+			Hostname: "web.ts-tailnet.ts.net",
+		},
+	}
+	// netip.Addr has unexported fields but is comparable, so compare it by ==.
+	if diff := cmp.Diff(want, got, cmpopts.EquateComparable(netip.Addr{})); diff != "" {
+		t.Errorf("JSON output mismatch (-want +got):\n%s\nraw:\n%s", diff, out)
+	}
+}
+
+func TestServiceListEmpty(t *testing.T) {
+	lc := fakeServiceLister{
+		status:   statusWithSuffix("ts-tailnet.ts.net"),
+		services: map[tailcfg.ServiceName]tailcfg.ServiceDetails{},
+	}
+	out := runList(t, lc, false)
+	if !strings.Contains(out, "No Tailscale Services are available") {
+		t.Errorf("expected empty message, got\n%s", out)
+	}
+}
+
+func TestServiceListGetServicesError(t *testing.T) {
+	wantErr := errors.New("boom")
+	lc := fakeServiceLister{servicesErr: wantErr}
+
+	ctx := withServiceLister(context.Background(), lc)
+	err := runServiceList(ctx, nil)
+	if !errors.Is(err, wantErr) {
+		t.Errorf("err = %v, want %v", err, wantErr)
+	}
+}
+
+func TestServiceListRejectsArgs(t *testing.T) {
+	ctx := withServiceLister(context.Background(), fakeServiceLister{})
+	if err := runServiceList(ctx, []string{"unexpected"}); err == nil {
+		t.Error("expected error for extra args, got nil")
+	}
+}
+
+func TestServiceHostname(t *testing.T) {
+	tests := []struct {
+		name   tailcfg.ServiceName
+		suffix string
+		want   string
+	}{
+		{"svc:web", "ts-tailnet.ts.net", "web.ts-tailnet.ts.net"},
+		{"svc:web", "ts-tailnet.ts.net.", "web.ts-tailnet.ts.net"}, // trailing dot trimmed
+		{"svc:web", "", ""},                        // no suffix
+		{"not-a-service", "ts-tailnet.ts.net", ""}, // invalid name (no svc: prefix)
+	}
+	for _, tt := range tests {
+		if got := serviceHostname(tt.name, tt.suffix); got != tt.want {
+			t.Errorf("serviceHostname(%q, %q) = %q, want %q", tt.name, tt.suffix, got, tt.want)
+		}
+	}
+}
+
+// TestServiceListerFromContextDefault verifies that without injection the
+// real localClient is returned.
+func TestServiceListerFromContextDefault(t *testing.T) {
+	if got := serviceListerFromContext(context.Background()); got != &localClient {
+		t.Errorf("serviceListerFromContext default = %v, want &localClient", got)
+	}
+}
diff --git a/cmd/tailscale/cli/set.go b/cmd/tailscale/cli/set.go
index 6fd4b09ad..95ee35bb1 100644
--- a/cmd/tailscale/cli/set.go
+++ b/cmd/tailscale/cli/set.go
@@ -62,6 +62,7 @@ type setArgsT struct {
 	updateCheck                bool
 	updateApply                bool
 	reportPosture              bool
+	remoteConfig               bool
 	snat                       bool
 	statefulFiltering          bool
 	sync                       bool
@@ -77,7 +78,7 @@ func newSetFlagSet(goos string, setArgs *setArgsT) *flag.FlagSet {
 	setf.BoolVar(&setArgs.acceptRoutes, "accept-routes", acceptRouteDefault(goos), "accept routes advertised by other Tailscale nodes")
 	setf.BoolVar(&setArgs.acceptDNS, "accept-dns", true, "accept DNS configuration from the admin panel")
 	setf.StringVar(&setArgs.exitNodeIP, "exit-node", "", "Tailscale exit node (IP, base name, or auto:any) for internet traffic, or empty string to not use an exit node")
-	setf.BoolVar(&setArgs.exitNodeAllowLANAccess, "exit-node-allow-lan-access", false, "Allow direct access to the local network when routing traffic via an exit node")
+	setf.BoolVar(&setArgs.exitNodeAllowLANAccess, "exit-node-allow-lan-access", false, "allow direct access to the local network when routing traffic via an exit node")
 	setf.BoolVar(&setArgs.shieldsUp, "shields-up", false, "don't allow incoming connections")
 	setf.BoolVar(&setArgs.runSSH, "ssh", false, "run an SSH server, permitting access per tailnet admin's declared policy")
 	setf.StringVar(&setArgs.hostname, "hostname", "", "hostname to use instead of the one provided by the OS")
@@ -88,6 +89,7 @@ func newSetFlagSet(goos string, setArgs *setArgsT) *flag.FlagSet {
 	setf.BoolVar(&setArgs.updateApply, "auto-update", false, "automatically update to the latest available version")
 	setf.BoolVar(&setArgs.reportPosture, "report-posture", false, "allow management plane to gather device posture information")
 	setf.BoolVar(&setArgs.runWebClient, "webclient", false, "expose the web interface for managing this node over Tailscale at port 5252")
+	setf.BoolVar(&setArgs.remoteConfig, "remote-config", false, hidden+"delegate FULL remote control of this node's prefs and LocalAPI to the tailnet admin, bypassing Tailscale's per-feature double opt-in; only use when the tailnet admin owns or is fully trusted with this machine")
 	setf.BoolVar(&setArgs.sync, "sync", false, hidden+"actively sync configuration from the control plane (set to false only for network failure testing)")
 	setf.StringVar(&setArgs.relayServerPort, "relay-server-port", "", "UDP port number (0 will pick a random unused port) for the relay server to bind to, on all interfaces, or empty string to disable relay server functionality")
 	setf.StringVar(&setArgs.relayServerStaticEndpoints, "relay-server-static-endpoints", "", "static IP:port endpoints to advertise as candidates for relay connections (comma-separated, e.g. \"[2001:db8::1]:40000,192.0.2.1:40000\") or empty string to not advertise any static endpoints")
@@ -163,6 +165,7 @@ func runSet(ctx context.Context, args []string) (retErr error) {
 				Advertise: setArgs.advertiseConnector,
 			},
 			PostureChecking:     setArgs.reportPosture,
+			RemoteConfig:        setArgs.remoteConfig,
 			NoStatefulFiltering: opt.NewBool(!setArgs.statefulFiltering),
 		},
 	}
diff --git a/cmd/tailscale/cli/ssh.go b/cmd/tailscale/cli/ssh.go
index 9efab8cf7..eb1ce37f8 100644
--- a/cmd/tailscale/cli/ssh.go
+++ b/cmd/tailscale/cli/ssh.go
@@ -11,7 +11,6 @@ import (
 	"log"
 	"net/netip"
 	"os"
-	"os/user"
 	"path/filepath"
 	"runtime"
 	"slices"
@@ -59,11 +58,7 @@ func runSSH(ctx context.Context, args []string) error {
 	username, host, ok := strings.Cut(arg, "@")
 	if !ok {
 		host = arg
-		lu, err := user.Current()
-		if err != nil {
-			return nil
-		}
-		username = lu.Username
+		username = ""
 	}
 
 	st, err := localClient.Status(ctx)
@@ -146,7 +141,11 @@ func runSSH(ctx context.Context, args []string) error {
 	// to use a different one, we'll later be making stock ssh
 	// work well by default too. (doing things like automatically
 	// setting known_hosts, etc)
-	argv = append(argv, username+"@"+hostForSSH)
+	if username == "" {
+		argv = append(argv, hostForSSH)
+	} else {
+		argv = append(argv, username+"@"+hostForSSH)
+	}
 
 	argv = append(argv, argRest...)
 
diff --git a/cmd/tailscale/cli/status.go b/cmd/tailscale/cli/status.go
index 9ce4debda..a058a2d3c 100644
--- a/cmd/tailscale/cli/status.go
+++ b/cmd/tailscale/cli/status.go
@@ -54,7 +54,7 @@ https://github.com/tailscale/tailscale/blob/main/ipn/ipnstate/ipnstate.go
 		fs.BoolVar(&statusArgs.self, "self", true, "show status of local machine")
 		fs.BoolVar(&statusArgs.peers, "peers", true, "show status of peers")
 		fs.StringVar(&statusArgs.listen, "listen", "127.0.0.1:8384", "listen address for web mode; use port 0 for automatic")
-		fs.BoolVar(&statusArgs.browser, "browser", true, "Open a browser in web mode")
+		fs.BoolVar(&statusArgs.browser, "browser", true, "open a browser in web mode")
 		fs.BoolVar(&statusArgs.header, "header", false, "show column headers in table format")
 		return fs
 	})(),
diff --git a/cmd/tailscale/cli/systray.go b/cmd/tailscale/cli/systray.go
index ca0840fe9..07de5c786 100644
--- a/cmd/tailscale/cli/systray.go
+++ b/cmd/tailscale/cli/systray.go
@@ -7,6 +7,7 @@ package cli
 
 import (
 	"context"
+	"flag"
 
 	"github.com/peterbourgon/ff/v3/ffcli"
 	"tailscale.com/client/systray"
@@ -17,10 +18,20 @@ var systrayCmd = &ffcli.Command{
 	ShortUsage: "tailscale systray",
 	ShortHelp:  "Run a systray application to manage Tailscale",
 	LongHelp:   "Run a systray application to manage Tailscale.",
-	Exec:       runSystray,
+	FlagSet: (func() *flag.FlagSet {
+		fs := newFlagSet("systray")
+		fs.StringVar(&systrayArgs.theme, "theme", "dark", "color theme for Tailscale icon: dark, dark:nobg, light, light:nobg")
+		return fs
+	})(),
+	Exec: runSystray,
+}
+
+var systrayArgs struct {
+	theme string
 }
 
 func runSystray(ctx context.Context, _ []string) error {
+	systray.SetTheme(systrayArgs.theme)
 	new(systray.Menu).Run(&localClient)
 	return nil
 }
diff --git a/cmd/tailscale/cli/network-lock.go b/cmd/tailscale/cli/tailnet-lock.go
similarity index 83%
rename from cmd/tailscale/cli/network-lock.go
rename to cmd/tailscale/cli/tailnet-lock.go
index 4febd56a9..2a9331954 100644
--- a/cmd/tailscale/cli/network-lock.go
+++ b/cmd/tailscale/cli/tailnet-lock.go
@@ -22,7 +22,8 @@ import (
 
 	"github.com/mattn/go-isatty"
 	"github.com/peterbourgon/ff/v3/ffcli"
-	"tailscale.com/cmd/tailscale/cli/jsonoutput"
+
+	"tailscale.com/cmd/tailscale/jsonoutput"
 	"tailscale.com/ipn/ipnstate"
 	"tailscale.com/tka"
 	"tailscale.com/tsconst"
@@ -32,30 +33,30 @@ import (
 )
 
 func init() {
-	maybeNetlockCmd = func() *ffcli.Command { return netlockCmd }
+	maybeTailnetLockCmd = func() *ffcli.Command { return tailnetLockCmd }
 }
 
-var netlockCmd = &ffcli.Command{
+var tailnetLockCmd = &ffcli.Command{
 	Name:       "lock",
 	ShortUsage: "tailscale lock <subcommand> [arguments...]",
 	ShortHelp:  "Manage tailnet lock",
 	LongHelp:   "Manage tailnet lock",
 	Subcommands: []*ffcli.Command{
-		nlInitCmd,
-		nlStatusCmd,
-		nlAddCmd,
-		nlRemoveCmd,
-		nlSignCmd,
-		nlDisableCmd,
-		nlDisablementKDFCmd,
-		nlLogCmd,
-		nlLocalDisableCmd,
-		nlRevokeKeysCmd,
+		tlInitCmd,
+		tlStatusCmd,
+		tlAddCmd,
+		tlRemoveCmd,
+		tlSignCmd,
+		tlDisableCmd,
+		tlDisablementKDFCmd,
+		tlLogCmd,
+		tlLocalDisableCmd,
+		tlRevokeKeysCmd,
 	},
-	Exec: runNetworkLockNoSubcommand,
+	Exec: runTailnetLockNoSubcommand,
 }
 
-func runNetworkLockNoSubcommand(ctx context.Context, args []string) error {
+func runTailnetLockNoSubcommand(ctx context.Context, args []string) error {
 	// Detect & handle the deprecated command 'lock tskey-wrap'.
 	if len(args) >= 2 && args[0] == "tskey-wrap" {
 		return runTskeyWrapCmd(ctx, args[1:])
@@ -64,7 +65,7 @@ func runNetworkLockNoSubcommand(ctx context.Context, args []string) error {
 		return fmt.Errorf("tailscale lock: unknown subcommand: %s", args[0])
 	}
 
-	return runNetworkLockStatus(ctx, args)
+	return runTailnetLockStatus(ctx, args)
 }
 
 var nlInitArgs struct {
@@ -73,7 +74,7 @@ var nlInitArgs struct {
 	confirm               bool
 }
 
-var nlInitCmd = &ffcli.Command{
+var tlInitCmd = &ffcli.Command{
 	Name:       "init",
 	ShortUsage: "tailscale lock init [--gen-disablement-for-support] --gen-disablements N <trusted-key>...",
 	ShortHelp:  "Initialize tailnet lock",
@@ -98,7 +99,7 @@ will be generated and transmitted to Tailscale, which support can use to disable
 tailnet lock. We recommend setting this flag.
 
 `),
-	Exec: runNetworkLockInit,
+	Exec: runTailnetLockInit,
 	FlagSet: (func() *flag.FlagSet {
 		fs := newFlagSet("lock init")
 		fs.IntVar(&nlInitArgs.numDisablements, "gen-disablements", 1, "number of disablement secrets to generate")
@@ -108,8 +109,8 @@ tailnet lock. We recommend setting this flag.
 	})(),
 }
 
-func runNetworkLockInit(ctx context.Context, args []string) error {
-	st, err := localClient.NetworkLockStatus(ctx)
+func runTailnetLockInit(ctx context.Context, args []string) error {
+	st, err := localClient.TailnetLockStatus(ctx)
 	if err != nil {
 		return fixTailscaledConnectError(err)
 	}
@@ -118,7 +119,7 @@ func runNetworkLockInit(ctx context.Context, args []string) error {
 	}
 
 	// Parse initially-trusted keys & disablement values.
-	keys, disablementValues, err := parseNLArgs(args, true, true)
+	keys, disablementValues, err := parseTLArgs(args, true, true)
 	if err != nil {
 		return err
 	}
@@ -183,9 +184,9 @@ func runNetworkLockInit(ctx context.Context, args []string) error {
 		fmt.Fprintln(&successMsg, "A disablement secret for Tailscale support has been generated and transmitted to Tailscale.")
 	}
 
-	// The state returned by NetworkLockInit likely doesn't contain the initialized state,
+	// The state returned by TailnetLockInit likely doesn't contain the initialized state,
 	// because that has to tick through from netmaps.
-	if _, err := localClient.NetworkLockInit(ctx, keys, disablementValues, supportDisablement); err != nil {
+	if _, err := localClient.TailnetLockInit(ctx, keys, disablementValues, supportDisablement); err != nil {
 		return err
 	}
 
@@ -195,14 +196,14 @@ func runNetworkLockInit(ctx context.Context, args []string) error {
 }
 
 var nlStatusArgs struct {
-	json jsonoutput.JSONSchemaVersion
+	json jsonoutput.SchemaVersion
 }
 
-var nlStatusCmd = &ffcli.Command{
+var tlStatusCmd = &ffcli.Command{
 	Name:       "status",
 	ShortUsage: "tailscale lock status",
 	ShortHelp:  "Output the state of tailnet lock",
-	Exec:       runNetworkLockStatus,
+	Exec:       runTailnetLockStatus,
 	FlagSet: (func() *flag.FlagSet {
 		fs := newFlagSet("lock status")
 		fs.Var(&nlStatusArgs.json, "json", "output in JSON format")
@@ -210,21 +211,21 @@ var nlStatusCmd = &ffcli.Command{
 	})(),
 }
 
-func runNetworkLockStatus(ctx context.Context, args []string) error {
+func runTailnetLockStatus(ctx context.Context, args []string) error {
 	if len(args) > 0 {
 		return fmt.Errorf("tailscale lock status: unexpected argument")
 	}
 
-	st, err := localClient.NetworkLockStatus(ctx)
+	st, err := localClient.TailnetLockStatus(ctx)
 	if err != nil {
 		return fixTailscaledConnectError(err)
 	}
 
 	if nlStatusArgs.json.IsSet {
-		if nlStatusArgs.json.Value == 1 {
-			return jsonoutput.PrintNetworkLockStatusJSONV1(os.Stdout, st)
+		if nlStatusArgs.json.Version == 1 {
+			return jsonoutput.PrintTailnetLockStatusJSONV1(os.Stdout, st)
 		} else {
-			return fmt.Errorf("unrecognised version: %d", nlStatusArgs.json.Value)
+			return fmt.Errorf("unrecognised version: %d", nlStatusArgs.json.Version)
 		}
 	}
 
@@ -301,22 +302,22 @@ func runNetworkLockStatus(ctx context.Context, args []string) error {
 	return nil
 }
 
-var nlAddCmd = &ffcli.Command{
+var tlAddCmd = &ffcli.Command{
 	Name:       "add",
 	ShortUsage: "tailscale lock add <public-key>...",
 	ShortHelp:  "Add one or more trusted signing keys to tailnet lock",
-	Exec:       runNetworkLockAdd,
+	Exec:       runTailnetLockAdd,
 }
 
 var nlRemoveArgs struct {
 	resign bool
 }
 
-var nlRemoveCmd = &ffcli.Command{
+var tlRemoveCmd = &ffcli.Command{
 	Name:       "remove",
 	ShortUsage: "tailscale lock remove [--re-sign=false] <public-key>...",
 	ShortHelp:  "Remove one or more trusted signing keys from tailnet lock",
-	Exec:       runNetworkLockRemove,
+	Exec:       runTailnetLockRemove,
 	FlagSet: (func() *flag.FlagSet {
 		fs := newFlagSet("lock remove")
 		fs.BoolVar(&nlRemoveArgs.resign, "re-sign", true, "resign signatures which would be invalidated by removal of trusted signing keys")
@@ -324,15 +325,15 @@ var nlRemoveCmd = &ffcli.Command{
 	})(),
 }
 
-func runNetworkLockRemove(ctx context.Context, args []string) error {
-	removeKeys, _, err := parseNLArgs(args, true, false)
+func runTailnetLockRemove(ctx context.Context, args []string) error {
+	removeKeys, _, err := parseTLArgs(args, true, false)
 	if err != nil {
 		return err
 	}
 	if len(removeKeys) == 0 {
 		return fmt.Errorf("missing argument, expected one or more tailnet lock keys")
 	}
-	st, err := localClient.NetworkLockStatus(ctx)
+	st, err := localClient.TailnetLockStatus(ctx)
 	if err != nil {
 		return fixTailscaledConnectError(err)
 	}
@@ -359,7 +360,7 @@ func runNetworkLockRemove(ctx context.Context, args []string) error {
 		// Resign affected signatures for each of the keys we are removing.
 		for _, k := range removeKeys {
 			kID, _ := k.ID() // err already checked above
-			sigs, err := localClient.NetworkLockAffectedSigs(ctx, kID)
+			sigs, err := localClient.TailnetLockAffectedSigs(ctx, kID)
 			if err != nil {
 				return fmt.Errorf("affected sigs for key %X: %w", kID, err)
 			}
@@ -374,10 +375,10 @@ func runNetworkLockRemove(ctx context.Context, args []string) error {
 					return fmt.Errorf("failed decoding pubkey for signature: %w", err)
 				}
 
-				// Safety: NetworkLockAffectedSigs() verifies all signatures before
+				// Safety: TailnetLockAffectedSigs() verifies all signatures before
 				// successfully returning.
 				rotationKey, _ := sig.UnverifiedWrappingPublic()
-				if err := localClient.NetworkLockSign(ctx, nodeKey, []byte(rotationKey)); err != nil {
+				if err := localClient.TailnetLockSign(ctx, nodeKey, []byte(rotationKey)); err != nil {
 					return fmt.Errorf("failed to sign %v: %w", nodeKey, err)
 				}
 			}
@@ -386,7 +387,7 @@ func runNetworkLockRemove(ctx context.Context, args []string) error {
 		if isatty.IsTerminal(os.Stdout.Fd()) {
 			fmt.Printf(`Warning
 Removal of a signing key(s) without resigning nodes (--re-sign=false)
-will cause any nodes signed by the the given key(s) to be locked out
+will cause any nodes signed by the given key(s) to be locked out
 of the Tailscale network. Proceed with caution.
 `)
 			if !prompt.YesNo("Are you sure you want to remove the signing key(s)?", true) {
@@ -396,10 +397,10 @@ of the Tailscale network. Proceed with caution.
 		}
 	}
 
-	return localClient.NetworkLockModify(ctx, nil, removeKeys)
+	return localClient.TailnetLockModify(ctx, nil, removeKeys)
 }
 
-// parseNLArgs parses a slice of strings into slices of tka.Key & disablement
+// parseTLArgs parses a slice of strings into slices of tka.Key & disablement
 // values/secrets.
 // The keys encoded in args should be specified using their key.NLPublic.MarshalText
 // representation with an optional '?<votes>' suffix.
@@ -408,7 +409,7 @@ of the Tailscale network. Proceed with caution.
 //
 // If any element could not be parsed,
 // a nil slice is returned along with an appropriate error.
-func parseNLArgs(args []string, parseKeys, parseDisablements bool) (keys []tka.Key, disablements [][]byte, err error) {
+func parseTLArgs(args []string, parseKeys, parseDisablements bool) (keys []tka.Key, disablements [][]byte, err error) {
 	for i, a := range args {
 		if parseDisablements && (strings.HasPrefix(a, "disablement:") || strings.HasPrefix(a, "disablement-secret:")) {
 			b, err := hex.DecodeString(a[strings.Index(a, ":")+1:])
@@ -446,8 +447,8 @@ func parseNLArgs(args []string, parseKeys, parseDisablements bool) (keys []tka.K
 	return keys, disablements, nil
 }
 
-func runNetworkLockAdd(ctx context.Context, addArgs []string) error {
-	addKeys, _, err := parseNLArgs(addArgs, true, false)
+func runTailnetLockAdd(ctx context.Context, addArgs []string) error {
+	addKeys, _, err := parseTLArgs(addArgs, true, false)
 	if err != nil {
 		return err
 	}
@@ -455,7 +456,7 @@ func runNetworkLockAdd(ctx context.Context, addArgs []string) error {
 		return fmt.Errorf("missing argument, expected one or more tailnet lock keys")
 	}
 
-	st, err := localClient.NetworkLockStatus(ctx)
+	st, err := localClient.TailnetLockStatus(ctx)
 	if err != nil {
 		return fixTailscaledConnectError(err)
 	}
@@ -463,13 +464,13 @@ func runNetworkLockAdd(ctx context.Context, addArgs []string) error {
 		return errors.New("tailnet lock is not enabled")
 	}
 
-	if err := localClient.NetworkLockModify(ctx, addKeys, nil); err != nil {
+	if err := localClient.TailnetLockModify(ctx, addKeys, nil); err != nil {
 		return err
 	}
 	return nil
 }
 
-var nlSignCmd = &ffcli.Command{
+var tlSignCmd = &ffcli.Command{
 	Name:       "sign",
 	ShortUsage: "tailscale lock sign <node-key> [<rotation-key>]\ntailscale lock sign <auth-key>",
 	ShortHelp:  "Sign a node or pre-approved auth key",
@@ -481,10 +482,10 @@ var nlSignCmd = &ffcli.Command{
 
 If any of the key arguments begin with "file:", the key is retrieved from
 the file at the path specified in the argument suffix.`,
-	Exec: runNetworkLockSign,
+	Exec: runTailnetLockSign,
 }
 
-func runNetworkLockSign(ctx context.Context, args []string) error {
+func runTailnetLockSign(ctx context.Context, args []string) error {
 	// If any of the arguments start with "file:", replace that argument
 	// with the contents of the file. We do this early, before the check
 	// to see if the first argument is an auth key.
@@ -519,7 +520,7 @@ func runNetworkLockSign(ctx context.Context, args []string) error {
 		}
 	}
 
-	err := localClient.NetworkLockSign(ctx, nodeKey, []byte(rotationKey.Verifier()))
+	err := localClient.TailnetLockSign(ctx, nodeKey, []byte(rotationKey.Verifier()))
 	// Provide a better help message for when someone clicks through the signing flow
 	// on the wrong device.
 	if err != nil && strings.Contains(err.Error(), tsconst.TailnetLockNotTrustedMsg) {
@@ -531,7 +532,7 @@ func runNetworkLockSign(ctx context.Context, args []string) error {
 	return err
 }
 
-var nlDisableCmd = &ffcli.Command{
+var tlDisableCmd = &ffcli.Command{
 	Name:       "disable",
 	ShortUsage: "tailscale lock disable <disablement-secret>",
 	ShortHelp:  "Consume a disablement secret to shut down tailnet lock for the tailnet",
@@ -546,21 +547,21 @@ Once this secret is used, it has been distributed
 to all nodes in the tailnet and should be considered public.
 
 `),
-	Exec: runNetworkLockDisable,
+	Exec: runTailnetLockDisable,
 }
 
-func runNetworkLockDisable(ctx context.Context, args []string) error {
-	_, secrets, err := parseNLArgs(args, false, true)
+func runTailnetLockDisable(ctx context.Context, args []string) error {
+	_, secrets, err := parseTLArgs(args, false, true)
 	if err != nil {
 		return err
 	}
 	if len(secrets) != 1 {
 		return errors.New("usage: tailscale lock disable <disablement-secret>")
 	}
-	return localClient.NetworkLockDisable(ctx, secrets[0])
+	return localClient.TailnetLockDisable(ctx, secrets[0])
 }
 
-var nlLocalDisableCmd = &ffcli.Command{
+var tlLocalDisableCmd = &ffcli.Command{
 	Name:       "local-disable",
 	ShortUsage: "tailscale lock local-disable",
 	ShortHelp:  "Disable tailnet lock for this node only",
@@ -575,22 +576,22 @@ that the current node will accept traffic from other nodes in the tailnet
 that are locked out.
 
 `),
-	Exec: runNetworkLockLocalDisable,
+	Exec: runTailnetLockLocalDisable,
 }
 
-func runNetworkLockLocalDisable(ctx context.Context, args []string) error {
-	return localClient.NetworkLockForceLocalDisable(ctx)
+func runTailnetLockLocalDisable(ctx context.Context, args []string) error {
+	return localClient.TailnetLockForceLocalDisable(ctx)
 }
 
-var nlDisablementKDFCmd = &ffcli.Command{
+var tlDisablementKDFCmd = &ffcli.Command{
 	Name:       "disablement-kdf",
 	ShortUsage: "tailscale lock disablement-kdf <hex-encoded-disablement-secret>",
 	ShortHelp:  "Compute a disablement value from a disablement secret (advanced users only)",
 	LongHelp:   "Compute a disablement value from a disablement secret (advanced users only)",
-	Exec:       runNetworkLockDisablementKDF,
+	Exec:       runTailnetLockDisablementKDF,
 }
 
-func runNetworkLockDisablementKDF(ctx context.Context, args []string) error {
+func runTailnetLockDisablementKDF(ctx context.Context, args []string) error {
 	if len(args) != 1 {
 		return errors.New("usage: tailscale lock disablement-kdf <hex-encoded-disablement-secret>")
 	}
@@ -604,15 +605,15 @@ func runNetworkLockDisablementKDF(ctx context.Context, args []string) error {
 
 var nlLogArgs struct {
 	limit int
-	json  jsonoutput.JSONSchemaVersion
+	json  jsonoutput.SchemaVersion
 }
 
-var nlLogCmd = &ffcli.Command{
+var tlLogCmd = &ffcli.Command{
 	Name:       "log",
 	ShortUsage: "tailscale lock log [--limit N]",
 	ShortHelp:  "List changes applied to tailnet lock",
 	LongHelp:   "List changes applied to tailnet lock",
-	Exec:       runNetworkLockLog,
+	Exec:       runTailnetLockLog,
 	FlagSet: (func() *flag.FlagSet {
 		fs := newFlagSet("lock log")
 		fs.IntVar(&nlLogArgs.limit, "limit", 50, "max number of updates to list")
@@ -621,7 +622,7 @@ var nlLogCmd = &ffcli.Command{
 	})(),
 }
 
-func nlDescribeUpdate(update ipnstate.NetworkLockUpdate, color bool) (string, error) {
+func nlDescribeUpdate(update ipnstate.TailnetLockUpdate, color bool) (string, error) {
 	terminalYellow := ""
 	terminalClear := ""
 	if color {
@@ -693,8 +694,8 @@ func nlDescribeUpdate(update ipnstate.NetworkLockUpdate, color bool) (string, er
 	return stanza.String(), nil
 }
 
-func runNetworkLockLog(ctx context.Context, args []string) error {
-	st, err := localClient.NetworkLockStatus(ctx)
+func runTailnetLockLog(ctx context.Context, args []string) error {
+	st, err := localClient.TailnetLockStatus(ctx)
 	if err != nil {
 		return fixTailscaledConnectError(err)
 	}
@@ -702,22 +703,22 @@ func runNetworkLockLog(ctx context.Context, args []string) error {
 		return errors.New("Tailnet Lock is not enabled")
 	}
 
-	updates, err := localClient.NetworkLockLog(ctx, nlLogArgs.limit)
+	updates, err := localClient.TailnetLockLog(ctx, nlLogArgs.limit)
 	if err != nil {
 		return fixTailscaledConnectError(err)
 	}
 
 	out, useColor := colorableOutput()
 
-	return printNetworkLockLog(updates, out, nlLogArgs.json, useColor)
+	return printTailnetLockLog(updates, out, nlLogArgs.json, useColor)
 }
 
-func printNetworkLockLog(updates []ipnstate.NetworkLockUpdate, out io.Writer, jsonSchema jsonoutput.JSONSchemaVersion, useColor bool) error {
+func printTailnetLockLog(updates []ipnstate.NetworkLockUpdate, out io.Writer, jsonSchema jsonoutput.SchemaVersion, useColor bool) error {
 	if jsonSchema.IsSet {
-		if jsonSchema.Value == 1 {
-			return jsonoutput.PrintNetworkLockLogJSONV1(out, updates)
+		if jsonSchema.Version == 1 {
+			return jsonoutput.PrintTailnetLockLogJSONV1(out, updates)
 		} else {
-			return fmt.Errorf("unrecognised version: %d", jsonSchema.Value)
+			return fmt.Errorf("unrecognised version: %d", jsonSchema.Version)
 		}
 	}
 
@@ -772,11 +773,11 @@ func wrapAuthKey(ctx context.Context, keyStr string, status *ipnstate.Status) er
 		Meta:   m,
 	}
 
-	wrapped, err := localClient.NetworkLockWrapPreauthKey(ctx, keyStr, priv)
+	wrapped, err := localClient.TailnetLockWrapPreauthKey(ctx, keyStr, priv)
 	if err != nil {
 		return fmt.Errorf("wrapping failed: %w", err)
 	}
-	if err := localClient.NetworkLockModify(ctx, []tka.Key{k}, nil); err != nil {
+	if err := localClient.TailnetLockModify(ctx, []tka.Key{k}, nil); err != nil {
 		return fmt.Errorf("add key failed: %w", err)
 	}
 
@@ -784,13 +785,13 @@ func wrapAuthKey(ctx context.Context, keyStr string, status *ipnstate.Status) er
 	return nil
 }
 
-var nlRevokeKeysArgs struct {
+var tlRevokeKeysArgs struct {
 	cosign   bool
 	finish   bool
 	forkFrom string
 }
 
-var nlRevokeKeysCmd = &ffcli.Command{
+var tlRevokeKeysCmd = &ffcli.Command{
 	Name:       "revoke-keys",
 	ShortUsage: "tailscale lock revoke-keys <tailnet-lock-key>...\n  revoke-keys [--cosign] [--finish] <recovery-blob>",
 	ShortHelp:  "Revoke compromised tailnet-lock keys",
@@ -806,20 +807,20 @@ Revocation is a multi-step process that requires several signing nodes to ` + "`
    most recent command output on the next signing node in sequence.
 3. Once the number of ` + "`--cosign`" + `s is greater than the number of keys being revoked,
    run the command one final time with ` + "`--finish`" + ` instead of ` + "`--cosign`" + `.`,
-	Exec: runNetworkLockRevokeKeys,
+	Exec: runTailnetLockRevokeKeys,
 	FlagSet: (func() *flag.FlagSet {
 		fs := newFlagSet("lock revoke-keys")
-		fs.BoolVar(&nlRevokeKeysArgs.cosign, "cosign", false, "continue generating the recovery using the tailnet lock key on this device and the provided recovery blob")
-		fs.BoolVar(&nlRevokeKeysArgs.finish, "finish", false, "finish the recovery process by transmitting the revocation")
-		fs.StringVar(&nlRevokeKeysArgs.forkFrom, "fork-from", "", "parent AUM hash to rewrite from (advanced users only)")
+		fs.BoolVar(&tlRevokeKeysArgs.cosign, "cosign", false, "continue generating the recovery using the tailnet lock key on this device and the provided recovery blob")
+		fs.BoolVar(&tlRevokeKeysArgs.finish, "finish", false, "finish the recovery process by transmitting the revocation")
+		fs.StringVar(&tlRevokeKeysArgs.forkFrom, "fork-from", "", "parent AUM hash to rewrite from (advanced users only)")
 		return fs
 	})(),
 }
 
-func runNetworkLockRevokeKeys(ctx context.Context, args []string) error {
+func runTailnetLockRevokeKeys(ctx context.Context, args []string) error {
 	// First step in the process
-	if !nlRevokeKeysArgs.cosign && !nlRevokeKeysArgs.finish {
-		revokeKeys, _, err := parseNLArgs(args, true, false)
+	if !tlRevokeKeysArgs.cosign && !tlRevokeKeysArgs.finish {
+		revokeKeys, _, err := parseTLArgs(args, true, false)
 		if err != nil {
 			return err
 		}
@@ -837,22 +838,22 @@ func runNetworkLockRevokeKeys(ctx context.Context, args []string) error {
 		}
 
 		var forkFrom tka.AUMHash
-		if nlRevokeKeysArgs.forkFrom != "" {
-			if len(nlRevokeKeysArgs.forkFrom) == (len(forkFrom) * 2) {
+		if tlRevokeKeysArgs.forkFrom != "" {
+			if len(tlRevokeKeysArgs.forkFrom) == (len(forkFrom) * 2) {
 				// Hex-encoded: like the output of the lock log command.
-				b, err := hex.DecodeString(nlRevokeKeysArgs.forkFrom)
+				b, err := hex.DecodeString(tlRevokeKeysArgs.forkFrom)
 				if err != nil {
 					return fmt.Errorf("invalid fork-from hash: %v", err)
 				}
 				copy(forkFrom[:], b)
 			} else {
-				if err := forkFrom.UnmarshalText([]byte(nlRevokeKeysArgs.forkFrom)); err != nil {
+				if err := forkFrom.UnmarshalText([]byte(tlRevokeKeysArgs.forkFrom)); err != nil {
 					return fmt.Errorf("invalid fork-from hash: %v", err)
 				}
 			}
 		}
 
-		aumBytes, err := localClient.NetworkLockGenRecoveryAUM(ctx, keyIDs, forkFrom)
+		aumBytes, err := localClient.TailnetLockGenRecoveryAUM(ctx, keyIDs, forkFrom)
 		if err != nil {
 			return fmt.Errorf("generation of recovery AUM failed: %w", err)
 		}
@@ -873,8 +874,8 @@ func runNetworkLockRevokeKeys(ctx context.Context, args []string) error {
 		return fmt.Errorf("decoding recovery AUM: %v", err)
 	}
 
-	if nlRevokeKeysArgs.cosign {
-		aumBytes, err := localClient.NetworkLockCosignRecoveryAUM(ctx, recoveryAUM)
+	if tlRevokeKeysArgs.cosign {
+		aumBytes, err := localClient.TailnetLockCosignRecoveryAUM(ctx, recoveryAUM)
 		if err != nil {
 			return fmt.Errorf("co-signing recovery AUM failed: %w", err)
 		}
@@ -889,8 +890,8 @@ Alternatively if you are done with co-signing, complete recovery by running the
 `, os.Args[0], aumBytes, os.Args[0], aumBytes)
 	}
 
-	if nlRevokeKeysArgs.finish {
-		if err := localClient.NetworkLockSubmitRecoveryAUM(ctx, recoveryAUM); err != nil {
+	if tlRevokeKeysArgs.finish {
+		if err := localClient.TailnetLockSubmitRecoveryAUM(ctx, recoveryAUM); err != nil {
 			return fmt.Errorf("submitting recovery AUM failed: %w", err)
 		}
 		fmt.Println("Recovery completed.")
diff --git a/cmd/tailscale/cli/network-lock_test.go b/cmd/tailscale/cli/tailnet-lock_test.go
similarity index 92%
rename from cmd/tailscale/cli/network-lock_test.go
rename to cmd/tailscale/cli/tailnet-lock_test.go
index 8e49265bf..76fba6517 100644
--- a/cmd/tailscale/cli/network-lock_test.go
+++ b/cmd/tailscale/cli/tailnet-lock_test.go
@@ -10,7 +10,8 @@ import (
 
 	"github.com/google/go-cmp/cmp"
 	"go4.org/mem"
-	"tailscale.com/cmd/tailscale/cli/jsonoutput"
+
+	"tailscale.com/cmd/tailscale/jsonoutput"
 	"tailscale.com/ipn/ipnstate"
 	"tailscale.com/tailcfg"
 	"tailscale.com/tka"
@@ -18,7 +19,7 @@ import (
 	"tailscale.com/types/tkatype"
 )
 
-func TestNetworkLockLogOutput(t *testing.T) {
+func TestTailnetLockLogOutput(t *testing.T) {
 	votes := uint(1)
 	aum1 := tka.AUM{
 		MessageKind: tka.AUMAddKey,
@@ -63,7 +64,7 @@ func TestNetworkLockLogOutput(t *testing.T) {
 		Votes: &votes,
 	}
 
-	updates := []ipnstate.NetworkLockUpdate{
+	updates := []ipnstate.TailnetLockUpdate{
 		{
 			Hash:   aum3.Hash(),
 			Change: aum3.MessageKind.String(),
@@ -85,10 +86,10 @@ func TestNetworkLockLogOutput(t *testing.T) {
 		t.Parallel()
 
 		var outBuf bytes.Buffer
-		json := jsonoutput.JSONSchemaVersion{}
+		json := jsonoutput.SchemaVersion{}
 		useColor := false
 
-		printNetworkLockLog(updates, &outBuf, json, useColor)
+		printTailnetLockLog(updates, &outBuf, json, useColor)
 
 		t.Logf("%s", outBuf.String())
 
@@ -189,13 +190,13 @@ KeyID: tlpub:0202
 		t.Parallel()
 
 		var outBuf bytes.Buffer
-		json := jsonoutput.JSONSchemaVersion{
-			IsSet: true,
-			Value: 1,
+		json := jsonoutput.SchemaVersion{
+			IsSet:   true,
+			Version: 1,
 		}
 		useColor := false
 
-		printNetworkLockLog(updates, &outBuf, json, useColor)
+		printTailnetLockLog(updates, &outBuf, json, useColor)
 
 		want := jsonV1
 
@@ -205,7 +206,7 @@ KeyID: tlpub:0202
 	})
 }
 
-func TestNetworkLockStatusOutput(t *testing.T) {
+func TestTailnetLockStatusOutput(t *testing.T) {
 	aum := tka.AUM{
 		MessageKind: tka.AUMNoOp,
 	}
@@ -226,12 +227,12 @@ func TestNetworkLockStatusOutput(t *testing.T) {
 	t.Run("json-1", func(t *testing.T) {
 		for _, tt := range []struct {
 			Name   string
-			Status ipnstate.NetworkLockStatus
+			Status ipnstate.TailnetLockStatus
 			Want   string
 		}{
 			{
 				Name:   "tailnet-lock-disabled",
-				Status: ipnstate.NetworkLockStatus{Enabled: false},
+				Status: ipnstate.TailnetLockStatus{Enabled: false},
 				Want: `{
   "SchemaVersion": "1",
   "Enabled": false
@@ -240,7 +241,7 @@ func TestNetworkLockStatusOutput(t *testing.T) {
 			},
 			{
 				Name: "tailnet-lock-disabled-with-keys",
-				Status: ipnstate.NetworkLockStatus{
+				Status: ipnstate.TailnetLockStatus{
 					Enabled:   false,
 					NodeKey:   &nodeKey1,
 					PublicKey: trustedNlPub,
@@ -255,7 +256,7 @@ func TestNetworkLockStatusOutput(t *testing.T) {
 			},
 			{
 				Name: "tailnet-lock-enabled",
-				Status: ipnstate.NetworkLockStatus{
+				Status: ipnstate.TailnetLockStatus{
 					Enabled:          true,
 					Head:             &head,
 					PublicKey:        nlPub,
@@ -355,9 +356,9 @@ func TestNetworkLockStatusOutput(t *testing.T) {
 				t.Parallel()
 
 				var outBuf bytes.Buffer
-				err := jsonoutput.PrintNetworkLockStatusJSONV1(&outBuf, &tt.Status)
+				err := jsonoutput.PrintTailnetLockStatusJSONV1(&outBuf, &tt.Status)
 				if err != nil {
-					t.Fatalf("PrintNetworkLockStatusJSONV1: %v", err)
+					t.Fatalf("PrintTailnetLockStatusJSONV1: %v", err)
 				}
 
 				if diff := cmp.Diff(outBuf.String(), tt.Want); diff != "" {
diff --git a/cmd/tailscale/cli/up.go b/cmd/tailscale/cli/up.go
index 586df07bb..982a69ca9 100644
--- a/cmd/tailscale/cli/up.go
+++ b/cmd/tailscale/cli/up.go
@@ -110,15 +110,15 @@ func newUpFlagSet(goos string, upArgs *upArgsT, cmd string) *flag.FlagSet {
 	upf.BoolVar(&upArgs.acceptDNS, "accept-dns", true, "accept DNS configuration from the admin panel")
 	upf.Var(notFalseVar{}, "host-routes", hidden+"install host routes to other Tailscale nodes (must be true as of Tailscale 1.67+)")
 	upf.StringVar(&upArgs.exitNodeIP, "exit-node", "", "Tailscale exit node (IP, base name, or auto:any) for internet traffic, or empty string to not use an exit node")
-	upf.BoolVar(&upArgs.exitNodeAllowLANAccess, "exit-node-allow-lan-access", false, "Allow direct access to the local network when routing traffic via an exit node")
+	upf.BoolVar(&upArgs.exitNodeAllowLANAccess, "exit-node-allow-lan-access", false, "allow direct access to the local network when routing traffic via an exit node")
 	upf.BoolVar(&upArgs.shieldsUp, "shields-up", false, "don't allow incoming connections")
 	upf.BoolVar(&upArgs.runSSH, "ssh", false, "run an SSH server, permitting access per tailnet admin's declared policy")
-	upf.StringVar(&upArgs.advertiseTags, "advertise-tags", "", "comma-separated ACL tags to request; each must start with \"tag:\" (e.g. \"tag:eng,tag:montreal,tag:ssh\")")
+	upf.StringVar(&upArgs.advertiseTags, "advertise-tags", "", "comma-separated ACL tags to request (e.g. \"tag:eng,tag:montreal,tag:ssh\"); the \"tag:\" prefix is optional and added automatically when omitted (e.g. \"eng,montreal,ssh\")")
 	upf.StringVar(&upArgs.hostname, "hostname", "", "hostname to use instead of the one provided by the OS")
 	upf.StringVar(&upArgs.advertiseRoutes, "advertise-routes", "", "routes to advertise to other nodes (comma-separated, e.g. \"10.0.0.0/8,192.168.0.0/24\") or empty string to not advertise routes")
 	upf.BoolVar(&upArgs.advertiseConnector, "advertise-connector", false, "advertise this node as an app connector")
 	upf.BoolVar(&upArgs.advertiseDefaultRoute, "advertise-exit-node", false, "offer to be an exit node for internet traffic for the tailnet")
-	upf.BoolVar(&upArgs.postureChecking, "report-posture", false, hidden+"allow management plane to gather device posture information")
+	upf.BoolVar(&upArgs.postureChecking, "report-posture", false, "allow management plane to gather device posture information")
 
 	if safesocket.GOOSUsesPeerCreds(goos) {
 		upf.StringVar(&upArgs.opUser, "operator", "", "Unix username to allow to operate on tailscaled without sudo")
@@ -309,9 +309,15 @@ func prefsFromUpArgs(upArgs upArgsT, warnf logger.Logf, st *ipnstate.Status, goo
 	var tags []string
 	if upArgs.advertiseTags != "" {
 		tags = strings.Split(upArgs.advertiseTags, ",")
-		for _, tag := range tags {
-			err := tailcfg.CheckTag(tag)
-			if err != nil {
+		for i, tag := range tags {
+			// Allow users to omit the "tag:" prefix; if the tag has no
+			// colon at all, add it for them. Tags with a colon must be
+			// fully qualified ("tag:foo") and are validated as-is.
+			if !strings.Contains(tag, ":") {
+				tag = "tag:" + tag
+				tags[i] = tag
+			}
+			if err := tailcfg.CheckTag(tag); err != nil {
 				return nil, fmt.Errorf("tag: %q: %s", tag, err)
 			}
 		}
@@ -647,7 +653,10 @@ func runUp(ctx context.Context, cmd string, args []string, upArgs upArgsT) (retE
 				}
 			}
 
-			authKey, err = f(ctx, clientSecret, prefs.AdvertiseTags)
+			authKey, err = f(ctx, tailscale.ResolveAuthKeyArgs{
+				AuthKey: clientSecret,
+				Tags:    prefs.AdvertiseTags,
+			})
 			if err != nil {
 				return err
 			}
@@ -660,7 +669,13 @@ func runUp(ctx context.Context, cmd string, args []string, upArgs upArgsT) (retE
 				return err
 			}
 
-			authKey, err = f(ctx, prefs.ControlURL, upArgs.clientID, idToken, upArgs.audience, prefs.AdvertiseTags)
+			authKey, err = f(ctx, tailscale.ResolveAuthKeyWIFArgs{
+				BaseURL:  prefs.ControlURL,
+				ClientID: upArgs.clientID,
+				IDToken:  idToken,
+				Audience: upArgs.audience,
+				Tags:     prefs.AdvertiseTags,
+			})
 			if err != nil {
 				return err
 			}
@@ -726,7 +741,7 @@ func runUp(ctx context.Context, cmd string, args []string, upArgs upArgsT) (retE
 			if s := n.State; s != nil {
 				ipnIsRunning = *s == ipn.Running
 			}
-			if n.NetMap != nil && n.NetMap.NodeKey != origNodeKey {
+			if n.SelfChange != nil && n.SelfChange.Key != origNodeKey {
 				waitingForKeyChange = false
 			}
 			if ipnIsRunning && !waitingForKeyChange {
@@ -911,6 +926,7 @@ func init() {
 	addPrefFlagMapping("auto-update", "AutoUpdate.Apply")
 	addPrefFlagMapping("advertise-connector", "AppConnector")
 	addPrefFlagMapping("report-posture", "PostureChecking")
+	addPrefFlagMapping("remote-config", "RemoteConfig")
 	addPrefFlagMapping("relay-server-port", "RelayServerPort")
 	addPrefFlagMapping("sync", "Sync")
 	addPrefFlagMapping("relay-server-static-endpoints", "RelayServerStaticEndpoints")
diff --git a/cmd/tailscale/cli/update.go b/cmd/tailscale/cli/update.go
index 47177347d..39cdfe6c3 100644
--- a/cmd/tailscale/cli/update.go
+++ b/cmd/tailscale/cli/update.go
@@ -10,6 +10,7 @@ import (
 	"errors"
 	"flag"
 	"fmt"
+	"io"
 	"runtime"
 
 	"github.com/peterbourgon/ff/v3/ffcli"
@@ -67,8 +68,19 @@ var updateArgs struct {
 	version string // explicit version; empty means auto
 }
 
+const gokrazyUpdateFromURLMagicArg = "--gokrazy-update-from-url"
+
 func runUpdate(ctx context.Context, args []string) error {
 	if len(args) > 0 {
+		if runtime.GOOS == "linux" && distro.Get() == distro.Gokrazy {
+			gokArgs, err := gokrazyUpdateArgsFromMagicArg(args)
+			if err != nil {
+				return err
+			}
+			if gokArgs != nil {
+				return clientupdate.GokrazyUpdateFromURL.Get()(ctx, *gokArgs)
+			}
+		}
 		return flag.ErrHelp
 	}
 	if updateArgs.version != "" && updateArgs.track != "" {
@@ -102,3 +114,36 @@ func confirmUpdate(ver string) bool {
 	msg := fmt.Sprintf("This will update Tailscale from %v to %v. Continue?", version.Short(), ver)
 	return prompt.YesNo(msg, true)
 }
+
+// gokrazyUpdateArgsFromMagicArg parses the Gokrazy update-from-URL command-line
+// flow. It returns nil if args do not select that flow. A non-nil result means
+// the caller may safely invoke clientupdate.GokrazyUpdateFromURL.
+func gokrazyUpdateArgsFromMagicArg(args []string) (*clientupdate.GokrazyUpdateArgs, error) {
+	var updateURL string
+	var unsigned bool
+
+	fs := flag.NewFlagSet("gokrazy-update", flag.ContinueOnError)
+	fs.SetOutput(io.Discard)
+	// This flag path is exercised end-to-end by TestGokrazyUpdatesItselfToSameImage.
+	fs.StringVar(&updateURL, gokrazyUpdateFromURLMagicArg[2:], "", "URL of the Gokrazy archive format file to install")
+	fs.BoolVar(&unsigned, "unsigned", false, "skip GAF signature verification; for tests only")
+	if err := fs.Parse(args); err != nil {
+		return nil, err
+	}
+	if fs.NArg() != 0 {
+		return nil, nil
+	}
+	if updateURL == "" {
+		return nil, nil
+	}
+	if !clientupdate.GokrazyUpdateFromURL.IsSet() {
+		return nil, errors.New("gokrazy update support is not linked into this binary")
+	}
+	return &clientupdate.GokrazyUpdateArgs{
+		URL:           updateURL,
+		AllowUnsigned: unsigned,
+		Logf: func(format string, args ...any) {
+			printf(format+"\n", args...)
+		},
+	}, nil
+}
diff --git a/cmd/tailscale/cli/whoami.go b/cmd/tailscale/cli/whoami.go
new file mode 100644
index 000000000..5c7966216
--- /dev/null
+++ b/cmd/tailscale/cli/whoami.go
@@ -0,0 +1,52 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package cli
+
+import (
+	"context"
+	"errors"
+	"flag"
+	"fmt"
+	"strings"
+
+	"github.com/peterbourgon/ff/v3/ffcli"
+)
+
+var whoamiCmd = &ffcli.Command{
+	Name:       "whoami",
+	ShortUsage: "tailscale whoami [--json]",
+	ShortHelp:  "Show the machine and user identity of the current machine",
+	LongHelp: strings.TrimSpace(`
+	'tailscale whoami' shows the machine and user identity of the current machine.
+	It is equivalent to running 'tailscale whois' against one of the current machine's own Tailscale IP addresses.
+	`),
+	Exec: runWhoami,
+	FlagSet: func() *flag.FlagSet {
+		fs := newFlagSet("whoami")
+		fs.BoolVar(&whoamiArgs.json, "json", false, "output in JSON format")
+		return fs
+	}(),
+}
+
+var whoamiArgs struct {
+	json bool // output in JSON format
+}
+
+func runWhoami(ctx context.Context, args []string) error {
+	if len(args) > 0 {
+		return errors.New("too many arguments, expected none")
+	}
+	st, err := localClient.StatusWithoutPeers(ctx)
+	if err != nil {
+		return err
+	}
+	if len(st.TailscaleIPs) == 0 {
+		return fmt.Errorf("no current Tailscale IP address; state: %v", st.BackendState)
+	}
+	who, err := localClient.WhoIsProto(ctx, "", st.TailscaleIPs[0].String())
+	if err != nil {
+		return err
+	}
+	return printWhoIs(who, st.CurrentTailnet, whoamiArgs.json)
+}
diff --git a/cmd/tailscale/cli/whois.go b/cmd/tailscale/cli/whois.go
index 7cc8f2889..c6cae118c 100644
--- a/cmd/tailscale/cli/whois.go
+++ b/cmd/tailscale/cli/whois.go
@@ -4,6 +4,7 @@
 package cli
 
 import (
+	"cmp"
 	"context"
 	"encoding/json"
 	"errors"
@@ -13,6 +14,9 @@ import (
 	"text/tabwriter"
 
 	"github.com/peterbourgon/ff/v3/ffcli"
+	"tailscale.com/client/tailscale/apitype"
+	"tailscale.com/ipn/ipnstate"
+	"tailscale.com/tailcfg"
 )
 
 var whoisCmd = &ffcli.Command{
@@ -46,10 +50,27 @@ func runWhoIs(ctx context.Context, args []string) error {
 	if err != nil {
 		return err
 	}
-	if whoIsArgs.json {
+	return printWhoIs(who, nil, whoIsArgs.json)
+}
+
+// whoisAndTailnet combines a WhoIsResponse and TailnetStatus for display.
+type whoisAndTailnet struct {
+	*apitype.WhoIsResponse
+	CurrentTailnet *ipnstate.TailnetStatus `json:",omitzero"`
+}
+
+// printWhoIs prints the WhoIsResponse to Stdout, either as JSON (if asJSON is
+// true) or in a human-readable form.
+// If tailnet is non-nil, tailnet information is included in the output.
+func printWhoIs(who *apitype.WhoIsResponse, tailnet *ipnstate.TailnetStatus, asJSON bool) error {
+	wat := whoisAndTailnet{
+		WhoIsResponse:  who,
+		CurrentTailnet: tailnet,
+	}
+	if asJSON {
 		ec := json.NewEncoder(Stdout)
 		ec.SetIndent("", "  ")
-		ec.Encode(who)
+		ec.Encode(wat)
 		return nil
 	}
 
@@ -68,6 +89,20 @@ func runWhoIs(ctx context.Context, args []string) error {
 		fmt.Fprintf(w, "  Name:\t%s\n", who.UserProfile.LoginName)
 		fmt.Fprintf(w, "  ID:\t%d\n", who.UserProfile.ID)
 	}
+	if tailnet != nil {
+		// use the tailnet display name, if present
+		var displayName string
+		if who.Node.HasCap(tailcfg.NodeAttrTailnetDisplayName) {
+			v, err := tailcfg.UnmarshalNodeCapJSON[string](who.Node.CapMap, tailcfg.NodeAttrTailnetDisplayName)
+			if err == nil && len(v) > 0 {
+				displayName = v[0]
+			}
+		}
+		fmt.Fprintln(w, "Tailnet:")
+		// TODO(will@): plumb through StableTailnetID so we can show that here as well
+		fmt.Fprintf(w, "  Name:\t%s\n", cmp.Or(displayName, tailnet.Name))
+		fmt.Fprintf(w, "  MagicDNS Suffix:\t%s\n", tailnet.MagicDNSSuffix)
+	}
 	w.Flush()
 	w = nil // avoid accidental use
 
diff --git a/cmd/tailscale/depaware.txt b/cmd/tailscale/depaware.txt
index 01d3f418f..c240581e7 100644
--- a/cmd/tailscale/depaware.txt
+++ b/cmd/tailscale/depaware.txt
@@ -24,10 +24,12 @@ tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/dep
         github.com/aws/aws-sdk-go-v2/aws/signer/v4                   from github.com/aws/aws-sdk-go-v2/internal/auth/smithy+
         github.com/aws/aws-sdk-go-v2/aws/transport/http              from github.com/aws/aws-sdk-go-v2/config+
         github.com/aws/aws-sdk-go-v2/config                          from tailscale.com/wif+
+        github.com/aws/aws-sdk-go-v2/config/internal/ini             from github.com/aws/aws-sdk-go-v2/config
         github.com/aws/aws-sdk-go-v2/credentials                     from github.com/aws/aws-sdk-go-v2/config
         github.com/aws/aws-sdk-go-v2/credentials/ec2rolecreds        from github.com/aws/aws-sdk-go-v2/config
         github.com/aws/aws-sdk-go-v2/credentials/endpointcreds       from github.com/aws/aws-sdk-go-v2/config
         github.com/aws/aws-sdk-go-v2/credentials/endpointcreds/internal/client from github.com/aws/aws-sdk-go-v2/credentials/endpointcreds
+        github.com/aws/aws-sdk-go-v2/credentials/logincreds          from github.com/aws/aws-sdk-go-v2/config
         github.com/aws/aws-sdk-go-v2/credentials/processcreds        from github.com/aws/aws-sdk-go-v2/config
         github.com/aws/aws-sdk-go-v2/credentials/ssocreds            from github.com/aws/aws-sdk-go-v2/config
         github.com/aws/aws-sdk-go-v2/credentials/stscreds            from github.com/aws/aws-sdk-go-v2/config
@@ -40,17 +42,21 @@ tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/dep
         github.com/aws/aws-sdk-go-v2/internal/endpoints              from github.com/aws/aws-sdk-go-v2/service/sso+
         github.com/aws/aws-sdk-go-v2/internal/endpoints/awsrulesfn   from github.com/aws/aws-sdk-go-v2/service/sso+
         github.com/aws/aws-sdk-go-v2/internal/endpoints/v2           from github.com/aws/aws-sdk-go-v2/service/sso/internal/endpoints+
-        github.com/aws/aws-sdk-go-v2/internal/ini                    from github.com/aws/aws-sdk-go-v2/config
-        github.com/aws/aws-sdk-go-v2/internal/middleware             from github.com/aws/aws-sdk-go-v2/service/sso+
         github.com/aws/aws-sdk-go-v2/internal/rand                   from github.com/aws/aws-sdk-go-v2/aws+
         github.com/aws/aws-sdk-go-v2/internal/sdk                    from github.com/aws/aws-sdk-go-v2/aws+
         github.com/aws/aws-sdk-go-v2/internal/sdkio                  from github.com/aws/aws-sdk-go-v2/credentials/processcreds
         github.com/aws/aws-sdk-go-v2/internal/shareddefaults         from github.com/aws/aws-sdk-go-v2/config+
-        github.com/aws/aws-sdk-go-v2/internal/strings                from github.com/aws/aws-sdk-go-v2/aws/signer/internal/v4
+        github.com/aws/aws-sdk-go-v2/internal/strings                from github.com/aws/aws-sdk-go-v2/aws/signer/internal/v4+
         github.com/aws/aws-sdk-go-v2/internal/sync/singleflight      from github.com/aws/aws-sdk-go-v2/aws
         github.com/aws/aws-sdk-go-v2/internal/timeconv               from github.com/aws/aws-sdk-go-v2/aws/retry
+        github.com/aws/aws-sdk-go-v2/internal/v4a                    from github.com/aws/aws-sdk-go-v2/service/sts
+        github.com/aws/aws-sdk-go-v2/internal/v4a/internal/crypto    from github.com/aws/aws-sdk-go-v2/internal/v4a
+        github.com/aws/aws-sdk-go-v2/internal/v4a/internal/v4        from github.com/aws/aws-sdk-go-v2/internal/v4a
         github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding from github.com/aws/aws-sdk-go-v2/service/sts
         github.com/aws/aws-sdk-go-v2/service/internal/presigned-url  from github.com/aws/aws-sdk-go-v2/service/sts
+        github.com/aws/aws-sdk-go-v2/service/signin                  from github.com/aws/aws-sdk-go-v2/config+
+        github.com/aws/aws-sdk-go-v2/service/signin/internal/endpoints from github.com/aws/aws-sdk-go-v2/service/signin
+        github.com/aws/aws-sdk-go-v2/service/signin/types            from github.com/aws/aws-sdk-go-v2/credentials/logincreds+
    L    github.com/aws/aws-sdk-go-v2/service/ssm                     from tailscale.com/feature/awsparamstore
    L    github.com/aws/aws-sdk-go-v2/service/ssm/internal/endpoints  from github.com/aws/aws-sdk-go-v2/service/ssm
    L    github.com/aws/aws-sdk-go-v2/service/ssm/types               from github.com/aws/aws-sdk-go-v2/service/ssm
@@ -63,7 +69,7 @@ tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/dep
         github.com/aws/aws-sdk-go-v2/service/sts                     from github.com/aws/aws-sdk-go-v2/config+
         github.com/aws/aws-sdk-go-v2/service/sts/internal/endpoints  from github.com/aws/aws-sdk-go-v2/service/sts
         github.com/aws/aws-sdk-go-v2/service/sts/types               from github.com/aws/aws-sdk-go-v2/credentials/stscreds+
-        github.com/aws/smithy-go                                     from github.com/aws/aws-sdk-go-v2/aws/protocol/restjson+
+     💣 github.com/aws/smithy-go                                     from github.com/aws/aws-sdk-go-v2/aws/protocol/restjson+
         github.com/aws/smithy-go/auth                                from github.com/aws/aws-sdk-go-v2/internal/auth+
         github.com/aws/smithy-go/auth/bearer                         from github.com/aws/aws-sdk-go-v2/aws+
         github.com/aws/smithy-go/context                             from github.com/aws/smithy-go/auth/bearer
@@ -73,7 +79,8 @@ tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/dep
         github.com/aws/smithy-go/encoding/json                       from github.com/aws/aws-sdk-go-v2/service/ssooidc+
         github.com/aws/smithy-go/encoding/xml                        from github.com/aws/aws-sdk-go-v2/service/sts
         github.com/aws/smithy-go/endpoints                           from github.com/aws/aws-sdk-go-v2/service/sso+
-        github.com/aws/smithy-go/endpoints/private/rulesfn           from github.com/aws/aws-sdk-go-v2/service/sts
+        github.com/aws/smithy-go/endpoints/private/rulesfn           from github.com/aws/aws-sdk-go-v2/service/sts+
+        github.com/aws/smithy-go/eventstream                         from github.com/aws/aws-sdk-go-v2/internal/auth/smithy+
         github.com/aws/smithy-go/internal/sync/singleflight          from github.com/aws/smithy-go/auth/bearer
         github.com/aws/smithy-go/io                                  from github.com/aws/aws-sdk-go-v2/feature/ec2/imds+
         github.com/aws/smithy-go/logging                             from github.com/aws/aws-sdk-go-v2/aws+
@@ -82,17 +89,26 @@ tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/dep
         github.com/aws/smithy-go/private/requestcompression          from github.com/aws/aws-sdk-go-v2/config
         github.com/aws/smithy-go/ptr                                 from github.com/aws/aws-sdk-go-v2/aws+
         github.com/aws/smithy-go/rand                                from github.com/aws/aws-sdk-go-v2/aws/middleware+
-        github.com/aws/smithy-go/time                                from github.com/aws/aws-sdk-go-v2/service/sso+
+        github.com/aws/smithy-go/sync                                from github.com/aws/smithy-go/transport/http
+        github.com/aws/smithy-go/time                                from github.com/aws/aws-sdk-go-v2/service/ssm+
         github.com/aws/smithy-go/tracing                             from github.com/aws/aws-sdk-go-v2/aws/middleware+
+        github.com/aws/smithy-go/traits                              from github.com/aws/smithy-go/eventstream
         github.com/aws/smithy-go/transport/http                      from github.com/aws/aws-sdk-go-v2/aws+
         github.com/aws/smithy-go/transport/http/internal/io          from github.com/aws/smithy-go/transport/http
    L    github.com/aws/smithy-go/waiter                              from github.com/aws/aws-sdk-go-v2/service/ssm
+        github.com/bradfitz/monogok/disklayout                       from tailscale.com/cmd/tailscale/cli+
         github.com/coder/websocket                                   from tailscale.com/util/eventbus
         github.com/coder/websocket/internal/errd                     from github.com/coder/websocket
         github.com/coder/websocket/internal/util                     from github.com/coder/websocket
-        github.com/coder/websocket/internal/xsync                    from github.com/coder/websocket
    W 💣 github.com/dblohm7/wingoes                                   from github.com/dblohm7/wingoes/pe+
    W 💣 github.com/dblohm7/wingoes/pe                                from tailscale.com/util/winutil/authenticode
+        github.com/diskfs/go-diskfs/backend                          from github.com/diskfs/go-diskfs/filesystem/ext4+
+        github.com/diskfs/go-diskfs/filesystem                       from github.com/diskfs/go-diskfs/filesystem/ext4
+        github.com/diskfs/go-diskfs/filesystem/ext4                  from tailscale.com/gokrazy/mkfs
+        github.com/diskfs/go-diskfs/filesystem/ext4/crc              from github.com/diskfs/go-diskfs/filesystem/ext4
+        github.com/diskfs/go-diskfs/filesystem/ext4/md4              from github.com/diskfs/go-diskfs/filesystem/ext4
+        github.com/diskfs/go-diskfs/util/bitmap                      from github.com/diskfs/go-diskfs/filesystem/ext4
+        github.com/diskfs/go-diskfs/util/slices                      from github.com/diskfs/go-diskfs/filesystem/ext4
    L    github.com/fogleman/gg                                       from tailscale.com/client/systray
         github.com/fxamacker/cbor/v2                                 from tailscale.com/tka
         github.com/gaissmai/bart                                     from tailscale.com/net/tsdial
@@ -109,13 +125,14 @@ tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/dep
         github.com/go-json-experiment/json/internal/jsonopts         from github.com/go-json-experiment/json+
         github.com/go-json-experiment/json/internal/jsonwire         from github.com/go-json-experiment/json+
         github.com/go-json-experiment/json/jsontext                  from github.com/go-json-experiment/json+
+        github.com/go-json-experiment/json/v1                        from tailscale.com/net/routecheck+
    L 💣 github.com/godbus/dbus/v5                                    from fyne.io/systray+
    L    github.com/godbus/dbus/v5/introspect                         from fyne.io/systray+
    L    github.com/godbus/dbus/v5/prop                               from fyne.io/systray
    L    github.com/golang/freetype/raster                            from github.com/fogleman/gg+
    L    github.com/golang/freetype/truetype                          from github.com/fogleman/gg
         github.com/golang/groupcache/lru                             from tailscale.com/net/dnscache
-  DW    github.com/google/uuid                                       from tailscale.com/clientupdate+
+        github.com/google/uuid                                       from tailscale.com/clientupdate+
         github.com/hdevalence/ed25519consensus                       from tailscale.com/clientupdate/distsign+
         github.com/huin/goupnp                                       from github.com/huin/goupnp/dcps/internetgateway2+
         github.com/huin/goupnp/dcps/internetgateway2                 from tailscale.com/net/portmapper
@@ -144,7 +161,7 @@ tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/dep
    W 💣 github.com/tailscale/go-winio/internal/socket                from github.com/tailscale/go-winio
    W    github.com/tailscale/go-winio/internal/stringbuffer          from github.com/tailscale/go-winio/internal/fs
    W    github.com/tailscale/go-winio/pkg/guid                       from github.com/tailscale/go-winio+
-        github.com/tailscale/hujson                                  from tailscale.com/ipn/conffile
+        github.com/tailscale/hujson                                  from tailscale.com/ipn/conffile+
         github.com/tailscale/web-client-prebuilt                     from tailscale.com/client/web
         github.com/toqueteos/webbrowser                              from tailscale.com/cmd/tailscale/cli+
         github.com/x448/float16                                      from github.com/fxamacker/cbor/v2
@@ -165,11 +182,13 @@ tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/dep
         tailscale.com/client/tailscale/apitype                       from tailscale.com/client/tailscale+
         tailscale.com/client/web                                     from tailscale.com/cmd/tailscale/cli
         tailscale.com/clientupdate                                   from tailscale.com/cmd/tailscale/cli
-  LW    tailscale.com/clientupdate/distsign                          from tailscale.com/clientupdate
+        tailscale.com/clientupdate/distsign                          from tailscale.com/clientupdate+
         tailscale.com/cmd/tailscale/cli                              from tailscale.com/cmd/tailscale
         tailscale.com/cmd/tailscale/cli/ffcomplete                   from tailscale.com/cmd/tailscale/cli
         tailscale.com/cmd/tailscale/cli/ffcomplete/internal          from tailscale.com/cmd/tailscale/cli/ffcomplete
-        tailscale.com/cmd/tailscale/cli/jsonoutput                   from tailscale.com/cmd/tailscale/cli
+        tailscale.com/cmd/tailscale/jsonoutput                       from tailscale.com/cmd/tailscale/cli
+        tailscale.com/cmd/tailscale/tsdnsjsonv0                      from tailscale.com/cmd/tailscale/cli
+        tailscale.com/cmd/tailscale/tsroutecheckjsonv0               from tailscale.com/cmd/tailscale/cli
         tailscale.com/control/controlbase                            from tailscale.com/control/controlhttp+
         tailscale.com/control/controlhttp                            from tailscale.com/control/ts2021
         tailscale.com/control/controlhttp/controlhttpcommon          from tailscale.com/control/controlhttp
@@ -183,6 +202,7 @@ tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/dep
         tailscale.com/feature                                        from tailscale.com/tsweb+
    L    tailscale.com/feature/awsparamstore                          from tailscale.com/feature/condregister/awsparamstore
         tailscale.com/feature/buildfeatures                          from tailscale.com/cmd/tailscale/cli+
+        tailscale.com/feature/captiveportal/netcheckhook             from tailscale.com/cmd/tailscale/cli
         tailscale.com/feature/capture/dissector                      from tailscale.com/cmd/tailscale/cli
         tailscale.com/feature/condregister/awsparamstore             from tailscale.com/cmd/tailscale/cli
         tailscale.com/feature/condregister/identityfederation        from tailscale.com/cmd/tailscale/cli
@@ -192,8 +212,10 @@ tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/dep
         tailscale.com/feature/identityfederation                     from tailscale.com/feature/condregister/identityfederation
         tailscale.com/feature/oauthkey                               from tailscale.com/feature/condregister/oauthkey
         tailscale.com/feature/portmapper                             from tailscale.com/feature/condregister/portmapper
+        tailscale.com/feature/serviceclientprefs/serviceclient       from tailscale.com/client/local
         tailscale.com/feature/syspolicy                              from tailscale.com/cmd/tailscale/cli
         tailscale.com/feature/useproxy                               from tailscale.com/feature/condregister/useproxy
+        tailscale.com/gokrazy/mkfs                                   from tailscale.com/cmd/tailscale/cli
         tailscale.com/health                                         from tailscale.com/net/tlsdial+
         tailscale.com/health/healthmsg                               from tailscale.com/cmd/tailscale/cli
         tailscale.com/hostinfo                                       from tailscale.com/client/web+
@@ -206,11 +228,11 @@ tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/dep
         tailscale.com/metrics                                        from tailscale.com/tsweb+
         tailscale.com/net/ace                                        from tailscale.com/cmd/tailscale/cli
         tailscale.com/net/bakedroots                                 from tailscale.com/net/tlsdial
-        tailscale.com/net/captivedetection                           from tailscale.com/net/netcheck
+        tailscale.com/net/captivedetection                           from tailscale.com/feature/captiveportal/netcheckhook
         tailscale.com/net/dnscache                                   from tailscale.com/control/controlhttp+
         tailscale.com/net/dnsfallback                                from tailscale.com/control/controlhttp+
         tailscale.com/net/netaddr                                    from tailscale.com/ipn+
-        tailscale.com/net/netcheck                                   from tailscale.com/cmd/tailscale/cli
+        tailscale.com/net/netcheck                                   from tailscale.com/cmd/tailscale/cli+
         tailscale.com/net/neterror                                   from tailscale.com/net/netcheck+
         tailscale.com/net/netknob                                    from tailscale.com/net/netns+
      💣 tailscale.com/net/netmon                                     from tailscale.com/cmd/tailscale/cli+
@@ -220,10 +242,13 @@ tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/dep
         tailscale.com/net/ping                                       from tailscale.com/net/netcheck
         tailscale.com/net/portmapper                                 from tailscale.com/feature/portmapper
         tailscale.com/net/portmapper/portmappertype                  from tailscale.com/net/netcheck+
+        tailscale.com/net/routecheck                                 from tailscale.com/client/local+
+        tailscale.com/net/routecheck/peernode                        from tailscale.com/net/routecheck
         tailscale.com/net/sockstats                                  from tailscale.com/control/controlhttp+
         tailscale.com/net/stun                                       from tailscale.com/net/netcheck
         tailscale.com/net/tlsdial                                    from tailscale.com/cmd/tailscale/cli+
         tailscale.com/net/tlsdial/blockblame                         from tailscale.com/net/tlsdial
+        tailscale.com/net/traffic                                    from tailscale.com/net/routecheck
         tailscale.com/net/tsaddr                                     from tailscale.com/client/web+
         tailscale.com/net/tsdial                                     from tailscale.com/cmd/tailscale/cli+
      💣 tailscale.com/net/tshttpproxy                                from tailscale.com/feature/useproxy
@@ -239,7 +264,7 @@ tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/dep
         tailscale.com/tstime                                         from tailscale.com/control/controlhttp+
         tailscale.com/tstime/mono                                    from tailscale.com/tstime/rate
         tailscale.com/tstime/rate                                    from tailscale.com/cmd/tailscale/cli
-        tailscale.com/tsweb                                          from tailscale.com/util/eventbus
+        tailscale.com/tsweb                                          from tailscale.com/util/eventbus+
         tailscale.com/tsweb/varz                                     from tailscale.com/util/usermetric+
         tailscale.com/types/appctype                                 from tailscale.com/client/local+
         tailscale.com/types/dnstype                                  from tailscale.com/tailcfg+
@@ -275,6 +300,7 @@ tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/dep
         tailscale.com/util/mak                                       from tailscale.com/cmd/tailscale/cli+
         tailscale.com/util/must                                      from tailscale.com/clientupdate/distsign+
         tailscale.com/util/nocasemaps                                from tailscale.com/types/ipproto
+        tailscale.com/util/progresstracking                          from tailscale.com/clientupdate/distsign+
         tailscale.com/util/prompt                                    from tailscale.com/cmd/tailscale/cli
      💣 tailscale.com/util/qrcodes                                   from tailscale.com/cmd/tailscale/cli
         tailscale.com/util/quarantine                                from tailscale.com/cmd/tailscale/cli
@@ -331,7 +357,7 @@ tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/dep
         golang.org/x/net/icmp                                        from tailscale.com/net/ping
         golang.org/x/net/idna                                        from golang.org/x/net/http/httpproxy+
         golang.org/x/net/internal/iana                               from golang.org/x/net/icmp+
-        golang.org/x/net/internal/socket                             from golang.org/x/net/icmp+
+        golang.org/x/net/internal/socket                             from golang.org/x/net/ipv4+
         golang.org/x/net/internal/socks                              from golang.org/x/net/proxy
         golang.org/x/net/ipv4                                        from golang.org/x/net/icmp+
         golang.org/x/net/ipv6                                        from golang.org/x/net/icmp+
@@ -369,6 +395,7 @@ tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/dep
         vendor/golang.org/x/text/unicode/bidi                        from vendor/golang.org/x/net/idna+
         vendor/golang.org/x/text/unicode/norm                        from vendor/golang.org/x/net/idna
         archive/tar                                                  from tailscale.com/clientupdate
+        archive/zip                                                  from tailscale.com/clientupdate+
         bufio                                                        from compress/flate+
         bytes                                                        from archive/tar+
         cmp                                                          from slices+
@@ -394,23 +421,24 @@ tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/dep
         crypto/internal/boring/bbig                                  from crypto/ecdsa+
         crypto/internal/boring/sig                                   from crypto/internal/boring
         crypto/internal/constanttime                                 from crypto/internal/fips140/edwards25519+
-        crypto/internal/fips140                                      from crypto/internal/fips140/aes+
+        crypto/internal/fips140                                      from crypto/fips140+
         crypto/internal/fips140/aes                                  from crypto/aes+
         crypto/internal/fips140/aes/gcm                              from crypto/cipher+
         crypto/internal/fips140/alias                                from crypto/cipher+
         crypto/internal/fips140/bigmod                               from crypto/internal/fips140/ecdsa+
-        crypto/internal/fips140/check                                from crypto/internal/fips140/aes+
-        crypto/internal/fips140/drbg                                 from crypto/internal/fips140/aes/gcm+
+        crypto/internal/fips140/check                                from crypto/fips140+
+        crypto/internal/fips140/drbg                                 from crypto/hpke+
         crypto/internal/fips140/ecdh                                 from crypto/ecdh
         crypto/internal/fips140/ecdsa                                from crypto/ecdsa
         crypto/internal/fips140/ed25519                              from crypto/ed25519
         crypto/internal/fips140/edwards25519                         from crypto/internal/fips140/ed25519
         crypto/internal/fips140/edwards25519/field                   from crypto/ecdh+
-        crypto/internal/fips140/hkdf                                 from crypto/internal/fips140/tls13+
+        crypto/internal/fips140/hkdf                                 from crypto/hkdf+
         crypto/internal/fips140/hmac                                 from crypto/hmac+
         crypto/internal/fips140/mlkem                                from crypto/mlkem
-        crypto/internal/fips140/nistec                               from crypto/elliptic+
+        crypto/internal/fips140/nistec                               from crypto/ecdsa+
         crypto/internal/fips140/nistec/fiat                          from crypto/internal/fips140/nistec
+        crypto/internal/fips140/pbkdf2                               from crypto/pbkdf2
         crypto/internal/fips140/rsa                                  from crypto/rsa
         crypto/internal/fips140/sha256                               from crypto/internal/fips140/check+
         crypto/internal/fips140/sha3                                 from crypto/internal/fips140/hmac+
@@ -431,6 +459,7 @@ tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/dep
         crypto/internal/sysrand                                      from crypto/internal/fips140/drbg
         crypto/md5                                                   from crypto/tls+
         crypto/mlkem                                                 from crypto/hpke+
+        crypto/pbkdf2                                                from golang.org/x/crypto/pbkdf2
         crypto/rand                                                  from crypto/ed25519+
         crypto/rc4                                                   from crypto/tls
         crypto/rsa                                                   from crypto/tls+
@@ -444,7 +473,7 @@ tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/dep
         crypto/x509                                                  from crypto/tls+
    D    crypto/x509/internal/macos                                   from crypto/x509
         crypto/x509/pkix                                             from crypto/x509+
-  DW    database/sql/driver                                          from github.com/google/uuid
+        database/sql/driver                                          from github.com/google/uuid
    W    debug/dwarf                                                  from debug/pe
    W    debug/pe                                                     from github.com/dblohm7/wingoes/pe
         embed                                                        from github.com/peterbourgon/ff/v3+
@@ -464,6 +493,7 @@ tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/dep
         hash                                                         from compress/zlib+
         hash/adler32                                                 from compress/zlib
         hash/crc32                                                   from compress/gzip+
+        hash/fnv                                                     from tailscale.com/net/traffic+
         hash/maphash                                                 from go4.org/mem
         html                                                         from html/template+
         html/template                                                from tailscale.com/util/eventbus
@@ -490,7 +520,7 @@ tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/dep
         internal/goos                                                from crypto/x509+
         internal/msan                                                from internal/runtime/maps+
         internal/nettrace                                            from net+
-        internal/oserror                                             from io/fs+
+        internal/oserror                                             from internal/syscall/windows+
         internal/poll                                                from net+
         internal/profile                                             from net/http/pprof
         internal/profilerecord                                       from runtime+
@@ -500,9 +530,9 @@ tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/dep
         internal/runtime/atomic                                      from internal/runtime/exithook+
    L    internal/runtime/cgroup                                      from runtime
         internal/runtime/exithook                                    from runtime
-        internal/runtime/gc                                          from runtime+
+        internal/runtime/gc                                          from internal/runtime/gc/scan+
         internal/runtime/gc/scan                                     from runtime
-        internal/runtime/maps                                        from reflect+
+        internal/runtime/maps                                        from hash/maphash+
         internal/runtime/math                                        from internal/runtime/maps+
         internal/runtime/pprof/label                                 from runtime+
         internal/runtime/sys                                         from crypto/subtle+
@@ -516,7 +546,7 @@ tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/dep
         internal/synctest                                            from sync
         internal/syscall/execenv                                     from os+
   LD    internal/syscall/unix                                        from crypto/internal/sysrand+
-   W    internal/syscall/windows                                     from crypto/internal/sysrand+
+   W    internal/syscall/windows                                     from crypto/internal/fips140deps/time+
    W    internal/syscall/windows/registry                            from mime+
    W    internal/syscall/windows/sysdll                              from internal/syscall/windows+
         internal/testlog                                             from os
diff --git a/cmd/tailscale/jsonoutput/example_format_test.go b/cmd/tailscale/jsonoutput/example_format_test.go
new file mode 100644
index 000000000..e9f60336c
--- /dev/null
+++ b/cmd/tailscale/jsonoutput/example_format_test.go
@@ -0,0 +1,41 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package jsonoutput_test
+
+import (
+	"flag"
+	"fmt"
+
+	"tailscale.com/cmd/tailscale/jsonoutput"
+)
+
+func ExampleFormat_JSONBool() {
+	var args struct {
+		format jsonoutput.Format
+	}
+
+	fs := flag.NewFlagSet("ExampleFormat", flag.ExitOnError)
+	fs.Var(&args.format, "format", `output format; empty (for human-readable), "json" or "json-line"`)
+	fs.Var(args.format.JSONBool(), "json", "output in JSON format")
+
+	fs.Parse([]string{"-json"})
+	fmt.Printf(`{format: %q, set: %t, version: %d}`, args.format, args.format.IsSet, args.format.Version)
+	// Output:
+	// {format: "json", set: true, version: 1}
+}
+
+func ExampleFormat_JSONSchemaVersion() {
+	var args struct {
+		format jsonoutput.Format
+	}
+
+	fs := flag.NewFlagSet("ExampleFormat", flag.ExitOnError)
+	fs.Var(&args.format, "format", `output format; empty (for human-readable), "json" or "json-line"`)
+	fs.Var(args.format.JSONSchemaVersion(), "json", "output in JSON format")
+
+	fs.Parse([]string{"-json=2", "-format=json-line"})
+	fmt.Printf(`{format: %q, set: %t, version: %d}`, args.format, args.format.IsSet, args.format.Version)
+	// Output:
+	// {format: "json-line", set: true, version: 2}
+}
diff --git a/cmd/tailscale/jsonoutput/example_responseenvelope_test.go b/cmd/tailscale/jsonoutput/example_responseenvelope_test.go
new file mode 100644
index 000000000..38f27af7d
--- /dev/null
+++ b/cmd/tailscale/jsonoutput/example_responseenvelope_test.go
@@ -0,0 +1,33 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package jsonoutput_test
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"tailscale.com/cmd/tailscale/jsonoutput"
+)
+
+type Hello struct {
+	jsonoutput.ResponseEnvelope
+	Greeting string
+}
+
+func ExampleResponseEnvelope() {
+	hi := Hello{
+		ResponseEnvelope: jsonoutput.ResponseEnvelope{SchemaVersion: "1"},
+		Greeting:         "Hello, world",
+	}
+	out, err := json.MarshalIndent(hi, "", "    ")
+	if err != nil {
+		panic(err)
+	}
+	fmt.Printf("%s\n", out)
+	// Output:
+	// {
+	//     "SchemaVersion": "1",
+	//     "Greeting": "Hello, world"
+	// }
+}
diff --git a/cmd/tailscale/jsonoutput/example_schemaversion_test.go b/cmd/tailscale/jsonoutput/example_schemaversion_test.go
new file mode 100644
index 000000000..a198d2528
--- /dev/null
+++ b/cmd/tailscale/jsonoutput/example_schemaversion_test.go
@@ -0,0 +1,25 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package jsonoutput_test
+
+import (
+	"flag"
+	"fmt"
+
+	"tailscale.com/cmd/tailscale/jsonoutput"
+)
+
+var args struct {
+	json jsonoutput.SchemaVersion
+}
+
+func ExampleSchemaVersion() {
+	fs := flag.NewFlagSet("ExampleSchemaVersion", flag.ExitOnError)
+	fs.Var(&args.json, "json", "output in JSON format")
+
+	fs.Parse([]string{"-json=2"})
+	fmt.Printf(`{set: %t, version: %d}`, args.json.IsSet, args.json.Version)
+	// Output:
+	// {set: true, version: 2}
+}
diff --git a/cmd/tailscale/jsonoutput/format.go b/cmd/tailscale/jsonoutput/format.go
new file mode 100644
index 000000000..422f76860
--- /dev/null
+++ b/cmd/tailscale/jsonoutput/format.go
@@ -0,0 +1,130 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package jsonoutput
+
+import (
+	"errors"
+	"flag"
+	"strconv"
+)
+
+var _ flag.Value = new(Format)
+
+// Format implements the [flag.Value] interface,
+// supporting a combination of both -format and -json flags.
+//
+// For some commands, like tailscale netcheck or tailscale routecheck,
+// the user can specify the output format using the -format flag:
+//
+//	tailscale routecheck -format=json-line.
+//
+// Setting this flag to "json" or "json-line" implies that the -json flag is set.
+type Format struct {
+	s string
+	SchemaVersion
+}
+
+// String returns the default value which is printed in the CLI help text.
+func (f Format) String() string {
+	return string(f.s)
+}
+
+// Set is called when the user passes the flag as a command-line argument.
+func (f *Format) Set(s string) error {
+	f.s = s
+	isJSON := f.isJSON()
+	f.IsSet = isJSON
+	if !isJSON {
+		f.Version = 0
+	}
+	return nil
+}
+
+// IsBoolFlag reports that this [flag.Value] can be set without an argument.
+// This is the magic interface that makes -name equivalent to -name=true
+// rather than using the next command-line argument.
+func (f *Format) IsBoolFlag() bool {
+	return false // requires argument, overrides [SchemaVersion.IsBoolFlag]
+}
+
+// isJSON reports whether f represents a format based on JSON.
+func (f *Format) isJSON() bool {
+	return f.s == "json" || f.s == "json-line"
+}
+
+// setJSON either sets or clears the format value if it doesn’t match x.
+func (f *Format) setJSON(x bool) {
+	switch x {
+	case f.isJSON():
+		return // no change
+	case true:
+		f.s = "json"
+	case false:
+		f.s = "" // clear
+		f.Version = 0
+	}
+}
+
+// JSONBool returns a [flag.Value] for a boolean -json flag
+// which is aware of the underlying format.
+func (f *Format) JSONBool() flag.Value {
+	return &formatBool{f}
+}
+
+type formatBool struct {
+	*Format
+}
+
+// String returns the default value which is printed in the CLI help text.
+func (f formatBool) String() string {
+	return strconv.FormatBool(f.isJSON())
+}
+
+// Set is called when the user passes the flag as a command-line argument.
+func (f *formatBool) Set(s string) error {
+	if _, err := strconv.ParseBool(s); err != nil {
+		return errors.New("parse error")
+	}
+	f.SchemaVersion.Set(s)
+	f.setJSON(f.IsSet)
+	return nil
+}
+
+// IsBoolFlag reports that this [flag.Value] can be set without an argument.
+// This is the magic interface that makes -name equivalent to -name=true
+// rather than using the next command-line argument.
+func (f *formatBool) IsBoolFlag() bool {
+	return true
+}
+
+// JSONSchemaVersion returns a [flag.Value] for a [SchemaVersion] -json flag
+// which is aware of the underlying format.
+func (f *Format) JSONSchemaVersion() flag.Value {
+	return &formatSchemaVersion{f}
+}
+
+type formatSchemaVersion struct {
+	*Format
+}
+
+// String returns the default value which is printed in the CLI help text.
+func (f formatSchemaVersion) String() string {
+	return f.SchemaVersion.String()
+}
+
+// Set is called when the user passes the flag as a command-line argument.
+func (f *formatSchemaVersion) Set(s string) error {
+	if err := f.SchemaVersion.Set(s); err != nil {
+		return err
+	}
+	f.setJSON(f.IsSet)
+	return nil
+}
+
+// IsBoolFlag reports that this [flag.Value] can be set without an argument.
+// This is the magic interface that makes -name equivalent to -name=true
+// rather than using the next command-line argument.
+func (f *formatSchemaVersion) IsBoolFlag() bool {
+	return f.SchemaVersion.IsBoolFlag()
+}
diff --git a/cmd/tailscale/jsonoutput/format_test.go b/cmd/tailscale/jsonoutput/format_test.go
new file mode 100644
index 000000000..c072a8746
--- /dev/null
+++ b/cmd/tailscale/jsonoutput/format_test.go
@@ -0,0 +1,404 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package jsonoutput_test
+
+import (
+	"errors"
+	"flag"
+	"io"
+	"strings"
+	"testing"
+
+	"tailscale.com/cmd/tailscale/jsonoutput"
+)
+
+func TestFormat(t *testing.T) {
+	for _, tc := range []struct {
+		name        string
+		flags       []string
+		wantString  string
+		wantIsSet   bool
+		wantVersion int
+		wantErr     string
+	}{
+		{
+			name:        "no-flags",
+			flags:       []string{},
+			wantString:  "",
+			wantIsSet:   false,
+			wantVersion: 0,
+		},
+		{
+			name:        "format-json",
+			flags:       []string{"-format=json"},
+			wantString:  "json",
+			wantIsSet:   true,
+			wantVersion: 0,
+		},
+		{
+			name:        "format-json-line",
+			flags:       []string{"-format=json-line"},
+			wantString:  "json-line",
+			wantIsSet:   true,
+			wantVersion: 0,
+		},
+		{
+			name:        "format-not-json",
+			flags:       []string{"-format=xml"},
+			wantString:  "xml",
+			wantIsSet:   false,
+			wantVersion: 0,
+		},
+		{
+			name:        "bool-bare",
+			flags:       []string{"-bool"},
+			wantString:  "json",
+			wantIsSet:   true,
+			wantVersion: 1,
+		},
+		{
+			name:        "bool-true",
+			flags:       []string{"-bool=true"},
+			wantString:  "json",
+			wantIsSet:   true,
+			wantVersion: 1,
+		},
+		{
+			name:        "bool-false",
+			flags:       []string{"-bool=false"},
+			wantString:  "",
+			wantIsSet:   false,
+			wantVersion: 0,
+		},
+		{
+			name:    "bool-invalid",
+			flags:   []string{"-bool=2"},
+			wantErr: "parse error",
+		},
+		{
+			name:        "version-bare",
+			flags:       []string{"-version"},
+			wantString:  "json",
+			wantIsSet:   true,
+			wantVersion: 1,
+		},
+		{
+			name:        "version-true",
+			flags:       []string{"-version=true"},
+			wantString:  "json",
+			wantIsSet:   true,
+			wantVersion: 1,
+		},
+		{
+			name:        "version-false",
+			flags:       []string{"-version=false"},
+			wantString:  "",
+			wantIsSet:   false,
+			wantVersion: 0,
+		},
+		{
+			name:        "version-number",
+			flags:       []string{"-version=2"},
+			wantString:  "json",
+			wantIsSet:   true,
+			wantVersion: 2,
+		},
+		{
+			name:        "version-zero",
+			flags:       []string{"-version=0"},
+			wantString:  "json",
+			wantIsSet:   true,
+			wantVersion: 0,
+		},
+		{
+			name:    "version-invalid",
+			flags:   []string{"-version=1.0"},
+			wantErr: "parse error",
+		},
+		{
+			name:        "format-xml-then-bool-true",
+			flags:       []string{"-format=xml", "-bool"},
+			wantString:  "json",
+			wantIsSet:   true,
+			wantVersion: 1,
+		},
+		{
+			name:        "format-json-then-bool-true",
+			flags:       []string{"-format=json", "-bool"},
+			wantString:  "json",
+			wantIsSet:   true,
+			wantVersion: 1,
+		},
+		{
+			name:        "format-json-line-then-bool-true",
+			flags:       []string{"-format=json-line", "-bool"},
+			wantString:  "json-line",
+			wantIsSet:   true,
+			wantVersion: 1,
+		},
+		{
+			name:        "format-xml-then-bool-false",
+			flags:       []string{"-format=xml", "-bool=false"},
+			wantString:  "xml",
+			wantIsSet:   false,
+			wantVersion: 0,
+		},
+		{
+			name:        "format-json-then-bool-false",
+			flags:       []string{"-format=json", "-bool=false"},
+			wantString:  "",
+			wantIsSet:   false,
+			wantVersion: 0,
+		},
+		{
+			name:        "format-json-line-then-bool-false",
+			flags:       []string{"-format=json-line", "-bool=false"},
+			wantString:  "",
+			wantIsSet:   false,
+			wantVersion: 0,
+		},
+		{
+			name:        "bool-true-then-format-xml",
+			flags:       []string{"-bool", "-format=xml"},
+			wantString:  "xml",
+			wantIsSet:   false,
+			wantVersion: 0,
+		},
+		{
+			name:        "bool-true-then-format-json",
+			flags:       []string{"-bool", "--format=json"},
+			wantString:  "json",
+			wantIsSet:   true,
+			wantVersion: 1,
+		},
+		{
+			name:        "bool-true-then-format-json-line",
+			flags:       []string{"-bool", "--format=json-line"},
+			wantString:  "json-line",
+			wantIsSet:   true,
+			wantVersion: 1,
+		},
+		{
+			name:        "bool-false-then-format-xml",
+			flags:       []string{"-bool=false", "--format=xml"},
+			wantString:  "xml",
+			wantIsSet:   false,
+			wantVersion: 0,
+		},
+		{
+			name:        "bool-false-then-format-json",
+			flags:       []string{"-bool=false", "--format=json"},
+			wantString:  "json",
+			wantIsSet:   true,
+			wantVersion: 0,
+		},
+		{
+			name:        "bool-false-then-format-json-line",
+			flags:       []string{"-bool=false", "--format=json-line"},
+			wantString:  "json-line",
+			wantIsSet:   true,
+			wantVersion: 0,
+		},
+		{
+			name:        "format-xml-then-version-true",
+			flags:       []string{"-format=xml", "-version"},
+			wantString:  "json",
+			wantIsSet:   true,
+			wantVersion: 1,
+		},
+		{
+			name:        "format-json-then-version-true",
+			flags:       []string{"-format=json", "-version"},
+			wantString:  "json",
+			wantIsSet:   true,
+			wantVersion: 1,
+		},
+		{
+			name:        "format-json-line-then-version-true",
+			flags:       []string{"-format=json-line", "-version"},
+			wantString:  "json-line",
+			wantIsSet:   true,
+			wantVersion: 1,
+		},
+		{
+			name:        "format-xml-then-version-number",
+			flags:       []string{"-format=xml", "-version=2"},
+			wantString:  "json",
+			wantIsSet:   true,
+			wantVersion: 2,
+		},
+		{
+			name:        "format-json-then-version-number",
+			flags:       []string{"-format=json", "-version=2"},
+			wantString:  "json",
+			wantIsSet:   true,
+			wantVersion: 2,
+		},
+		{
+			name:        "format-json-line-then-version-number",
+			flags:       []string{"-format=json-line", "-version=2"},
+			wantString:  "json-line",
+			wantIsSet:   true,
+			wantVersion: 2,
+		},
+		{
+			name:        "format-xml-then-version-zero",
+			flags:       []string{"-format=xml", "-version=0"},
+			wantString:  "json",
+			wantIsSet:   true,
+			wantVersion: 0,
+		},
+		{
+			name:        "format-json-then-version-zero",
+			flags:       []string{"-format=json", "-version=0"},
+			wantString:  "json",
+			wantIsSet:   true,
+			wantVersion: 0,
+		},
+		{
+			name:        "format-json-line-then-version-zero",
+			flags:       []string{"-format=json-line", "-version=0"},
+			wantString:  "json-line",
+			wantIsSet:   true,
+			wantVersion: 0,
+		},
+		{
+			name:        "format-xml-then-version-false",
+			flags:       []string{"-format=xml", "-version=false"},
+			wantString:  "xml",
+			wantIsSet:   false,
+			wantVersion: 0,
+		},
+		{
+			name:        "format-json-then-version-false",
+			flags:       []string{"-format=json", "-version=false"},
+			wantString:  "",
+			wantIsSet:   false,
+			wantVersion: 0,
+		},
+		{
+			name:        "format-json-line-then-version-false",
+			flags:       []string{"-format=json-line", "-version=false"},
+			wantString:  "",
+			wantIsSet:   false,
+			wantVersion: 0,
+		},
+		{
+			name:        "version-true-then-format-xml",
+			flags:       []string{"-version", "-format=xml"},
+			wantString:  "xml",
+			wantIsSet:   false,
+			wantVersion: 0,
+		},
+		{
+			name:        "version-true-then-format-json",
+			flags:       []string{"-version", "--format=json"},
+			wantString:  "json",
+			wantIsSet:   true,
+			wantVersion: 1,
+		},
+		{
+			name:        "version-true-then-format-json-line",
+			flags:       []string{"-version", "--format=json-line"},
+			wantString:  "json-line",
+			wantIsSet:   true,
+			wantVersion: 1,
+		},
+		{
+			name:        "version-false-then-format-xml",
+			flags:       []string{"-version=false", "--format=xml"},
+			wantString:  "xml",
+			wantIsSet:   false,
+			wantVersion: 0,
+		},
+		{
+			name:        "version-false-then-format-json",
+			flags:       []string{"-version=false", "--format=json"},
+			wantString:  "json",
+			wantIsSet:   true,
+			wantVersion: 0,
+		},
+		{
+			name:        "version-false-then-format-json-line",
+			flags:       []string{"-version=false", "--format=json-line"},
+			wantString:  "json-line",
+			wantIsSet:   true,
+			wantVersion: 0,
+		},
+		{
+			name:        "version-number-then-format-xml",
+			flags:       []string{"-version=2", "--format=xml"},
+			wantString:  "xml",
+			wantIsSet:   false,
+			wantVersion: 0,
+		},
+		{
+			name:        "version-number-then-format-json",
+			flags:       []string{"-version=2", "--format=json"},
+			wantString:  "json",
+			wantIsSet:   true,
+			wantVersion: 2,
+		},
+		{
+			name:        "version-number-then-format-json-line",
+			flags:       []string{"-version=2", "--format=json-line"},
+			wantString:  "json-line",
+			wantIsSet:   true,
+			wantVersion: 2,
+		},
+		{
+			name:        "version-zero-then-format-xml",
+			flags:       []string{"-version=0", "--format=xml"},
+			wantString:  "xml",
+			wantIsSet:   false,
+			wantVersion: 0,
+		},
+		{
+			name:        "version-zero-then-format-json",
+			flags:       []string{"-version=0", "--format=json"},
+			wantString:  "json",
+			wantIsSet:   true,
+			wantVersion: 0,
+		},
+		{
+			name:        "version-zero-then-format-json-line",
+			flags:       []string{"-version=0", "--format=json-line"},
+			wantString:  "json-line",
+			wantIsSet:   true,
+			wantVersion: 0,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var f jsonoutput.Format
+			fs := flag.NewFlagSet("", flag.ContinueOnError)
+			fs.Var(&f, "format", "")
+			fs.Var(f.JSONBool(), "bool", "")
+			fs.Var(f.JSONSchemaVersion(), "version", "")
+			fs.SetOutput(io.Discard) // silence
+
+			t.Logf("flags: %q", tc.flags)
+			if err := fs.Parse(tc.flags); err != nil {
+				// Unwrap the header added by FlagSet.failf:
+				// `invalid boolean value "invalid" for -json: `
+				bits := strings.SplitN(err.Error(), ": ", 2)
+				err := errors.New(bits[len(bits)-1])
+				if tc.wantErr == "" && err != nil {
+					t.Fatalf("err %s, want <nil>", err)
+				} else if tc.wantErr != "" && (err == nil || err.Error() != tc.wantErr) {
+					t.Fatalf("err %v, want %s", err, tc.wantErr)
+				}
+			}
+
+			if got := f.String(); got != tc.wantString {
+				t.Errorf("Format.String %q, want %q", got, tc.wantString)
+			}
+			if got := f.IsSet; got != tc.wantIsSet {
+				t.Errorf("Format.IsSet %t, want %t", got, tc.wantIsSet)
+			}
+			if got := f.Version; got != tc.wantVersion {
+				t.Errorf("Format.Version %d, want %d", got, tc.wantVersion)
+			}
+		})
+	}
+}
diff --git a/cmd/tailscale/jsonoutput/jsonoutput.go b/cmd/tailscale/jsonoutput/jsonoutput.go
new file mode 100644
index 000000000..1b062b816
--- /dev/null
+++ b/cmd/tailscale/jsonoutput/jsonoutput.go
@@ -0,0 +1,110 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package jsonoutput provides stable and versioned JSON serialisation for CLI output.
+// This allows us to provide stable output to scripts/clients, but also make
+// breaking changes to the output when it's useful.
+//
+// Historically we only used a boolean -json flag, so changing the output
+// could break scripts that rely on the existing format.
+//
+// This package provides a [SchemaVersion] flag type that allows callers
+// to pass either a boolean or a version number and get a consistent output.
+// We'll bump the version when we make a breaking change
+// that's likely to break scripts that rely on the existing output,
+// e.g. if we remove a field or change the type/format.
+// Passing just the boolean flag will always return 1, to preserve
+// compatibility with scripts written before we versioned our output.
+//
+// This package provides a [Format] flag type that allows callers to specify
+// which output format the command should print.
+// This flag provides [Format.JSONBool] and [Format.JSONSchemaVersion] methods
+// to support combining both -format=json and -format=json-line options
+// with either boolean or versioned -json flags.
+//
+// This package also provides [ResponseEnvelope] which is used to provide the
+// set of fields common to all versioned JSON output.
+package jsonoutput
+
+import (
+	"errors"
+	"flag"
+	"io"
+	"strconv"
+	"strings"
+)
+
+var _ flag.Value = &SchemaVersion{}
+
+// SchemaVersion implements the [flag.Value] interface,
+// tracking whether the flag has been set or cleared, and its value when set.
+type SchemaVersion struct {
+	// IsSet tracks if the flag was set or cleared.
+	// This flag is true when set by -name or -name=true or -name=INT,
+	// otherwise it is false when cleared by -name=false.
+	IsSet bool
+
+	// Version tracks the desired schema version, as set by the -name=INT flag.
+	// The version defaults to 1 when implicitly set by -name or -name=true.
+	Version int
+}
+
+// String returns the default value which is printed in the CLI help text.
+func (v SchemaVersion) String() string {
+	if v.IsSet {
+		return strconv.Itoa(v.Version)
+	}
+	return strconv.FormatBool(false)
+}
+
+// Set is called when the user passes the flag as a command-line argument.
+func (v *SchemaVersion) Set(s string) error {
+	// Delegate to a FlagSet to parse this as both a BoolVar and an IntVar.
+	// This is less efficient than copying the implementation from the standard library
+	// but this design makes it likelier that Set will inherit any upstream fixes.
+	fs := flag.NewFlagSet("", flag.ContinueOnError)
+	fs.BoolVar(&v.IsSet, "bool", false, "")
+	fs.IntVar(&v.Version, "int", 0, "")
+	fs.SetOutput(io.Discard) // silence
+
+	// First, try to parse as an IntVar to handle -flag=INT.
+	// This order is important because -bool=0 will parse as false.
+	if err := fs.Parse([]string{"-int=" + s}); err == nil {
+		v.IsSet = true
+		return nil
+	}
+	// If that fails, parse as a BoolVar to handle -flag and -flag=false.
+	// This is checked last for compatibility with the boolean -json flag.
+	if err := fs.Parse([]string{"-bool=" + s}); err != nil {
+		// Unwrap the header added by FlagSet.failf:
+		// `invalid boolean value "invalid" for -bool: `
+		bits := strings.SplitN(err.Error(), ": ", 2)
+		return errors.New(bits[len(bits)-1])
+	}
+	// If the user doesn't supply a schema version, default to 1.
+	// This ensures that any existing scripts will continue to get their
+	// current output.
+	if v.IsSet {
+		v.Version = 1
+	} else {
+		v.Version = 0 // if unset, zero out the Version
+	}
+	return nil
+}
+
+// IsBoolFlag reports that this [flag.Value] can be set without an argument.
+// This is the magic interface that makes -name equivalent to -name=true
+// rather than using the next command-line argument.
+func (v *SchemaVersion) IsBoolFlag() bool {
+	return true
+}
+
+// ResponseEnvelope is a set of fields common to all versioned JSON output.
+type ResponseEnvelope struct {
+	// SchemaVersion is the version of the JSON output, e.g. "1", "2", "3"
+	SchemaVersion string
+
+	// ResponseWarning tells a user if a newer version of the JSON output
+	// is available.
+	ResponseWarning string `json:"_WARNING,omitzero"`
+}
diff --git a/cmd/tailscale/jsonoutput/jsonoutput_test.go b/cmd/tailscale/jsonoutput/jsonoutput_test.go
new file mode 100644
index 000000000..b66f5a12e
--- /dev/null
+++ b/cmd/tailscale/jsonoutput/jsonoutput_test.go
@@ -0,0 +1,164 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package jsonoutput_test
+
+import (
+	"flag"
+	"math"
+	"testing"
+
+	gcmp "github.com/google/go-cmp/cmp"
+	"github.com/kballard/go-shellquote"
+
+	"tailscale.com/cmd/tailscale/jsonoutput"
+)
+
+func TestSchemaVersion(t *testing.T) {
+	for _, tc := range []struct {
+		name    string
+		args    string
+		want    jsonoutput.SchemaVersion
+		wantErr string
+		wantStr string
+	}{
+		{
+			name:    "none",
+			want:    jsonoutput.SchemaVersion{IsSet: false, Version: 0},
+			wantStr: "false",
+		},
+		{
+			name:    "default",
+			args:    "-got",
+			want:    jsonoutput.SchemaVersion{IsSet: true, Version: 1},
+			wantStr: "1",
+		},
+		{
+			name:    "true",
+			args:    "-got=true",
+			want:    jsonoutput.SchemaVersion{IsSet: true, Version: 1},
+			wantStr: "1",
+		},
+		{
+			name:    "false",
+			args:    "-got=false",
+			want:    jsonoutput.SchemaVersion{IsSet: false, Version: 0},
+			wantStr: "false",
+		},
+		{
+			// Test that -got=0 isn’t interpreted as -bool=0, i.e. false.
+			name:    "zero_not_false",
+			args:    "-got=0",
+			want:    jsonoutput.SchemaVersion{IsSet: true, Version: 0},
+			wantStr: "0",
+		},
+		{
+			name:    "one",
+			args:    "-got=1",
+			want:    jsonoutput.SchemaVersion{IsSet: true, Version: 1},
+			wantStr: "1",
+		},
+		{
+			name:    "two",
+			args:    "-got=2",
+			want:    jsonoutput.SchemaVersion{IsSet: true, Version: 2},
+			wantStr: "2",
+		},
+		{
+			name:    "max",
+			args:    "-got=2147483647",
+			want:    jsonoutput.SchemaVersion{IsSet: true, Version: math.MaxInt32},
+			wantStr: "2147483647",
+		},
+		{
+			name:    "min",
+			args:    "-got=-2147483648",
+			want:    jsonoutput.SchemaVersion{IsSet: true, Version: math.MinInt32},
+			wantStr: "-2147483648",
+		},
+		{
+			name:    "invalid",
+			args:    "-got=invalid",
+			wantErr: `invalid boolean value "invalid" for -got: parse error`,
+		},
+		{
+			name:    "float",
+			args:    "-got=1.3",
+			wantErr: `invalid boolean value "1.3" for -got: parse error`,
+		},
+		{
+			name:    "space",
+			args:    "-got=' '",
+			wantErr: `invalid boolean value " " for -got: parse error`,
+		},
+		{
+			name:    "trailing_space",
+			args:    "-got='1 '",
+			wantErr: `invalid boolean value "1 " for -got: parse error`,
+		},
+	} {
+		args, err := shellquote.Split(tc.args)
+		if err != nil {
+			t.Fatalf("broken args %q: %v", tc.args, err)
+		}
+
+		// Test both Set and String methods.
+		t.Run(tc.name, func(t *testing.T) {
+			var got jsonoutput.SchemaVersion
+			fs := flag.NewFlagSet("name", flag.ContinueOnError)
+			fs.Var(&got, "got", "usage")
+
+			err = fs.Parse(args)
+			if err != nil && tc.wantErr == "" {
+				t.Errorf("parse error: %v", err)
+			} else if err != nil && err.Error() != tc.wantErr {
+				t.Errorf("parse error mismatch: %q, want %q", err, tc.wantErr)
+			} else if err == nil && tc.wantErr != "" {
+				t.Errorf("parse error: %v, want %q", err, tc.wantErr)
+			}
+
+			if len(fs.Args()) != 0 {
+				t.Errorf("unexpected positional arguments: %q", fs.Args())
+			}
+
+			if diff := gcmp.Diff(tc.want, got); diff != "" {
+				t.Errorf("parse mismatch: -want +got\n%s", diff)
+			}
+
+			if s := got.String(); s != tc.wantStr && tc.wantStr != "" {
+				t.Errorf("string %q, want %q", s, tc.wantStr)
+			}
+		})
+
+		if tc.args == "" {
+			continue // nothing to clobber
+		}
+		if tc.wantErr != "" {
+			continue // clobbering will just trigger another error
+		}
+
+		// The last -got flag will clobber all previous -got flags.
+		t.Run(tc.name+"/clobber", func(t *testing.T) {
+			var got jsonoutput.SchemaVersion
+			fs := flag.NewFlagSet("name", flag.ContinueOnError)
+			fs.Var(&got, "got", "usage")
+
+			sentinel := []string{"-got=-1"}
+			if err := fs.Parse(append(sentinel, args...)); err != nil {
+				t.Errorf("parse error: %v", err)
+			}
+
+			if got.Version == -1 {
+				t.Errorf("sentinel detected: flag didn’t clobber")
+			}
+
+			if len(fs.Args()) != 0 {
+				t.Errorf("unexpected positional arguments: %q", fs.Args())
+			}
+
+			if diff := gcmp.Diff(tc.want, got); diff != "" {
+				t.Errorf("parse mismatch: -want +got\n%s", diff)
+			}
+		})
+	}
+}
diff --git a/cmd/tailscale/cli/jsonoutput/network-lock-log.go b/cmd/tailscale/jsonoutput/tailnet-lock-log.go
similarity index 94%
rename from cmd/tailscale/cli/jsonoutput/network-lock-log.go
rename to cmd/tailscale/jsonoutput/tailnet-lock-log.go
index c7c16e223..97af3bed7 100644
--- a/cmd/tailscale/cli/jsonoutput/network-lock-log.go
+++ b/cmd/tailscale/jsonoutput/tailnet-lock-log.go
@@ -16,7 +16,7 @@ import (
 	"tailscale.com/tka"
 )
 
-// PrintNetworkLockLogJSONV1 prints the stored TKA state as a JSON object to the CLI,
+// PrintTailnetLockLogJSONV1 prints the stored TKA state as a JSON object to the CLI,
 // in a stable "v1" format.
 //
 // This format includes:
@@ -24,7 +24,7 @@ import (
 //   - the AUM hash as a base32-encoded string
 //   - the raw AUM as base64-encoded bytes
 //   - the expanded AUM, which prints named fields for consumption by other tools
-func PrintNetworkLockLogJSONV1(out io.Writer, updates []ipnstate.NetworkLockUpdate) error {
+func PrintTailnetLockLogJSONV1(out io.Writer, updates []ipnstate.TailnetLockUpdate) error {
 	messages := make([]logMessageV1, len(updates))
 
 	for i, update := range updates {
@@ -57,9 +57,9 @@ func PrintNetworkLockLogJSONV1(out io.Writer, updates []ipnstate.NetworkLockUpda
 	return enc.Encode(result)
 }
 
-// toLogMessageV1 converts a [tka.AUM] and [ipnstate.NetworkLockUpdate] to the
+// toLogMessageV1 converts a [tka.AUM] and [ipnstate.TailnetLockUpdate] to the
 // JSON output returned by the CLI.
-func toLogMessageV1(aum tka.AUM, update ipnstate.NetworkLockUpdate) logMessageV1 {
+func toLogMessageV1(aum tka.AUM, update ipnstate.TailnetLockUpdate) logMessageV1 {
 	expandedAUM := expandedAUMV1{}
 	expandedAUM.MessageKind = aum.MessageKind.String()
 	if len(aum.PrevAUMHash) > 0 {
@@ -159,7 +159,7 @@ type expandedAUMV1 struct {
 }
 
 // tkaKeyV1 is the expanded version of a [tka.Key], which describes
-// the public components of a key known to network-lock.
+// the public components of a key known to tailnet-lock.
 type tkaKeyV1 struct {
 	Kind string `json:"Kind,omitzero"`
 
diff --git a/cmd/tailscale/cli/jsonoutput/network-lock-status.go b/cmd/tailscale/jsonoutput/tailnet-lock-status.go
similarity index 94%
rename from cmd/tailscale/cli/jsonoutput/network-lock-status.go
rename to cmd/tailscale/jsonoutput/tailnet-lock-status.go
index a1d95b871..b5121c5ef 100644
--- a/cmd/tailscale/cli/jsonoutput/network-lock-status.go
+++ b/cmd/tailscale/jsonoutput/tailnet-lock-status.go
@@ -15,9 +15,9 @@ import (
 	"tailscale.com/tka"
 )
 
-// PrintNetworkLockStatusJSONV1 prints the current Tailnet Lock status
+// PrintTailnetLockStatusJSONV1 prints the current Tailnet Lock status
 // as a JSON object to the CLI, in a stable "v1" format.
-func PrintNetworkLockStatusJSONV1(out io.Writer, status *ipnstate.NetworkLockStatus) error {
+func PrintTailnetLockStatusJSONV1(out io.Writer, status *ipnstate.TailnetLockStatus) error {
 	responseEnvelope := ResponseEnvelope{
 		SchemaVersion: "1",
 	}
@@ -46,7 +46,7 @@ func PrintNetworkLockStatusJSONV1(out io.Writer, status *ipnstate.NetworkLockSta
 	return enc.Encode(result)
 }
 
-func toTailnetLockDisabledStatusV1(status *ipnstate.NetworkLockStatus) tailnetLockDisabledStatusV1 {
+func toTailnetLockDisabledStatusV1(status *ipnstate.TailnetLockStatus) tailnetLockDisabledStatusV1 {
 	out := tailnetLockDisabledStatusV1{
 		tailnetLockStatusV1Base: tailnetLockStatusV1Base{
 			Enabled: status.Enabled,
@@ -61,7 +61,7 @@ func toTailnetLockDisabledStatusV1(status *ipnstate.NetworkLockStatus) tailnetLo
 	return out
 }
 
-func toTailnetLockEnabledStatusV1(status *ipnstate.NetworkLockStatus) tailnetLockEnabledStatusV1 {
+func toTailnetLockEnabledStatusV1(status *ipnstate.TailnetLockStatus) tailnetLockEnabledStatusV1 {
 	out := tailnetLockEnabledStatusV1{
 		tailnetLockStatusV1Base: tailnetLockStatusV1Base{
 			Enabled: status.Enabled,
@@ -116,7 +116,7 @@ type tailnetLockStatusV1Base struct {
 	// Enabled is true if Tailnet Lock is enabled.
 	Enabled bool
 
-	// PublicKey describes the node's network-lock public key.
+	// PublicKey describes the node's tailnet-lock public key.
 	PublicKey string `json:"PublicKey,omitzero"`
 
 	// NodeKey describes the node's current node-key. This field is not
@@ -144,11 +144,11 @@ type tailnetLockEnabledStatusV1 struct {
 	NodeKeySignature *tkaNodeKeySignatureV1
 
 	// TrustedKeys describes the keys currently trusted to make changes
-	// to network-lock.
+	// to tailnet-lock.
 	TrustedKeys []tkaKeyV1
 
 	// VisiblePeers describes peers which are visible in the netmap that
-	// have valid Tailnet Lock signatures signatures.
+	// have valid Tailnet Lock signatures.
 	VisiblePeers []tkaTrustedPeerV1
 
 	// FilteredPeers describes peers which were removed from the netmap
diff --git a/cmd/tailscale/tsdnsjsonv0/doc.go b/cmd/tailscale/tsdnsjsonv0/doc.go
new file mode 100644
index 000000000..6017e157c
--- /dev/null
+++ b/cmd/tailscale/tsdnsjsonv0/doc.go
@@ -0,0 +1,14 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package tsdnsjsonv0 provides types for unmarshalling the JSON output of the
+// "tailscale dns --json" command:
+//
+//   - [QueryResponse] will unmarshal the output of "tailscale dns query --json=1"
+//   - [StatusResponse] will unmarshal the output of "tailscale dns status --json=1".
+//
+// # WARNING: unstable
+//
+// Format is "v0" and is subject to change.
+// There is no guarantee of backwards or forwards compatibility.
+package tsdnsjsonv0
diff --git a/cmd/tailscale/tsdnsjsonv0/example_dnsqueryresult_test.go b/cmd/tailscale/tsdnsjsonv0/example_dnsqueryresult_test.go
new file mode 100644
index 000000000..718bd18c5
--- /dev/null
+++ b/cmd/tailscale/tsdnsjsonv0/example_dnsqueryresult_test.go
@@ -0,0 +1,31 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package tsdnsjsonv0_test
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+
+	"tailscale.com/cmd/tailscale/tsdnsjsonv0"
+)
+
+func ExampleQueryResponse() {
+	cmd := exec.Command("tailscale", "dns", "query", "--json", "hello.ts.net")
+	out, err := cmd.Output()
+	if err != nil {
+		if err, ok := errors.AsType[*exec.ExitError](err); ok {
+			fmt.Fprintf(os.Stderr, "%s", err.Stderr)
+		}
+		panic(err)
+	}
+
+	var resp tsdnsjsonv0.QueryResponse
+	if err := json.Unmarshal(out, &resp); err != nil {
+		panic(err)
+	}
+	fmt.Printf("{type: %s, name: %q}\n", resp.QueryType, resp.Name)
+}
diff --git a/cmd/tailscale/tsdnsjsonv0/example_dnsstatusresult_test.go b/cmd/tailscale/tsdnsjsonv0/example_dnsstatusresult_test.go
new file mode 100644
index 000000000..aabe92574
--- /dev/null
+++ b/cmd/tailscale/tsdnsjsonv0/example_dnsstatusresult_test.go
@@ -0,0 +1,31 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package tsdnsjsonv0_test
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+
+	"tailscale.com/cmd/tailscale/tsdnsjsonv0"
+)
+
+func ExampleStatusResponse() {
+	cmd := exec.Command("tailscale", "dns", "status", "--json")
+	out, err := cmd.Output()
+	if err != nil {
+		if err, ok := errors.AsType[*exec.ExitError](err); ok {
+			fmt.Fprintf(os.Stderr, "%s", err.Stderr)
+		}
+		panic(err)
+	}
+
+	var resp tsdnsjsonv0.StatusResponse
+	if err := json.Unmarshal(out, &resp); err != nil {
+		panic(err)
+	}
+	fmt.Printf("{accept-dns: %t, resolvers: %q}\n", resp.TailscaleDNS, resp.Resolvers)
+}
diff --git a/cmd/tailscale/tsdnsjsonv0/query.go b/cmd/tailscale/tsdnsjsonv0/query.go
new file mode 100644
index 000000000..311ff1d5c
--- /dev/null
+++ b/cmd/tailscale/tsdnsjsonv0/query.go
@@ -0,0 +1,25 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package tsdnsjsonv0
+
+// Answer is a single DNS resource record from a query response.
+type Answer struct {
+	Name  string
+	TTL   uint32
+	Class string // e.g. "ClassINET"
+	Type  string // e.g. "TypeA", "TypeAAAA"
+	Body  string // human-readable record data
+}
+
+// QueryResponse is the result of a DNS query via the Tailscale
+// internal forwarder (100.100.100.100). It is the output of:
+//
+//	$ tailscale dns query --json NAME
+type QueryResponse struct {
+	Name         string
+	QueryType    string         // e.g. "A", "AAAA"
+	Resolvers    []ResolverInfo `json:",omitzero"`
+	ResponseCode string         // e.g. "RCodeSuccess", "RCodeNameError"
+	Answers      []Answer       `json:",omitzero"`
+}
diff --git a/cmd/tailscale/cli/jsonoutput/dns.go b/cmd/tailscale/tsdnsjsonv0/status.go
similarity index 59%
rename from cmd/tailscale/cli/jsonoutput/dns.go
rename to cmd/tailscale/tsdnsjsonv0/status.go
index d9d3cc0bb..1397a36ea 100644
--- a/cmd/tailscale/cli/jsonoutput/dns.go
+++ b/cmd/tailscale/tsdnsjsonv0/status.go
@@ -1,10 +1,17 @@
 // Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
-package jsonoutput
+package tsdnsjsonv0
 
-// DNSResolverInfo is the JSON form of [dnstype.Resolver].
-type DNSResolverInfo struct {
+// ExtraRecord is the JSON form of [tailscale.com/tailcfg.DNSRecord].
+type ExtraRecord struct {
+	Name  string
+	Type  string `json:",omitempty"` // empty means A or AAAA, depending on Value
+	Value string // typically an IP address
+}
+
+// ResolverInfo is the JSON form of [tailscale.com/types/dnstype.Resolver].
+type ResolverInfo struct {
 	// Addr is a plain IP, IP:port, DoH URL, or HTTP-over-WireGuard URL.
 	Addr string
 
@@ -13,16 +20,9 @@ type DNSResolverInfo struct {
 	BootstrapResolution []string `json:",omitempty"`
 }
 
-// DNSExtraRecord is the JSON form of [tailcfg.DNSRecord].
-type DNSExtraRecord struct {
-	Name  string
-	Type  string `json:",omitempty"` // empty means A or AAAA, depending on Value
-	Value string // typically an IP address
-}
-
-// DNSSystemConfig is the OS DNS configuration as observed by Tailscale,
-// mirroring [net/dns.OSConfig].
-type DNSSystemConfig struct {
+// SystemConfig is the OS DNS configuration as observed by Tailscale,
+// mirroring [tailscale.com/net/dns.OSConfig].
+type SystemConfig struct {
 	Nameservers   []string `json:",omitzero"`
 	SearchDomains []string `json:",omitzero"`
 
@@ -32,9 +32,10 @@ type DNSSystemConfig struct {
 	MatchDomains []string `json:",omitzero"`
 }
 
-// DNSTailnetInfo describes MagicDNS configuration for the tailnet,
-// combining [ipnstate.TailnetStatus] and [ipnstate.PeerStatus].
-type DNSTailnetInfo struct {
+// TailnetInfo describes MagicDNS configuration for the tailnet,
+// combining [tailscale.com/ipn/ipnstate.TailnetStatus]
+// and [tailscale.com/ipn/ipnstate.PeerStatus].
+type TailnetInfo struct {
 	// MagicDNSEnabled is whether MagicDNS is enabled for the
 	// tailnet. The device may still not use it if
 	// --accept-dns=false.
@@ -49,28 +50,30 @@ type DNSTailnetInfo struct {
 	SelfDNSName string `json:",omitempty"`
 }
 
-// DNSStatusResult is the full DNS status collected from the local
-// Tailscale daemon.
-type DNSStatusResult struct {
+// StatusResponse is the full DNS status collected from the local
+// Tailscale daemon. It is the output of:
+//
+//	$ tailscale dns status --json
+type StatusResponse struct {
 	// TailscaleDNS is whether the Tailscale DNS configuration is
 	// installed on this device (the --accept-dns setting).
 	TailscaleDNS bool
 
 	// CurrentTailnet describes MagicDNS configuration for the tailnet.
-	CurrentTailnet *DNSTailnetInfo `json:",omitzero"` // nil if not connected
+	CurrentTailnet *TailnetInfo `json:",omitzero"` // nil if not connected
 
 	// Resolvers are the DNS resolvers, in preference order. If
 	// empty, the system defaults are used.
-	Resolvers []DNSResolverInfo `json:",omitzero"`
+	Resolvers []ResolverInfo `json:",omitzero"`
 
 	// SplitDNSRoutes maps domain suffixes to dedicated resolvers.
 	// An empty resolver slice means the suffix is handled by
 	// Tailscale's built-in resolver (100.100.100.100).
-	SplitDNSRoutes map[string][]DNSResolverInfo `json:",omitzero"`
+	SplitDNSRoutes map[string][]ResolverInfo `json:",omitzero"`
 
 	// FallbackResolvers are like Resolvers but only used when
 	// split DNS needs explicit default resolvers.
-	FallbackResolvers []DNSResolverInfo `json:",omitzero"`
+	FallbackResolvers []ResolverInfo `json:",omitzero"`
 
 	SearchDomains []string `json:",omitzero"`
 
@@ -84,7 +87,7 @@ type DNSStatusResult struct {
 	CertDomains []string `json:",omitzero"`
 
 	// ExtraRecords contains extra DNS records in the MagicDNS config.
-	ExtraRecords []DNSExtraRecord `json:",omitzero"`
+	ExtraRecords []ExtraRecord `json:",omitzero"`
 
 	// ExitNodeFilteredSet are DNS suffixes this node won't resolve
 	// when acting as an exit node DNS proxy. Period-prefixed
@@ -92,25 +95,6 @@ type DNSStatusResult struct {
 	// lowercase, no trailing dots.
 	ExitNodeFilteredSet []string `json:",omitzero"`
 
-	SystemDNS      *DNSSystemConfig `json:",omitzero"` // nil if unavailable
-	SystemDNSError string           `json:",omitempty"`
-}
-
-// DNSAnswer is a single DNS resource record from a query response.
-type DNSAnswer struct {
-	Name  string
-	TTL   uint32
-	Class string // e.g. "ClassINET"
-	Type  string // e.g. "TypeA", "TypeAAAA"
-	Body  string // human-readable record data
-}
-
-// DNSQueryResult is the result of a DNS query via the Tailscale
-// internal forwarder (100.100.100.100).
-type DNSQueryResult struct {
-	Name         string
-	QueryType    string            // e.g. "A", "AAAA"
-	Resolvers    []DNSResolverInfo `json:",omitzero"`
-	ResponseCode string            // e.g. "RCodeSuccess", "RCodeNameError"
-	Answers      []DNSAnswer       `json:",omitzero"`
+	SystemDNS      *SystemConfig `json:",omitzero"` // nil if unavailable
+	SystemDNSError string        `json:",omitempty"`
 }
diff --git a/cmd/tailscale/tsroutecheckjsonv0/tsroutecheck.go b/cmd/tailscale/tsroutecheckjsonv0/tsroutecheck.go
new file mode 100644
index 000000000..f9dd89348
--- /dev/null
+++ b/cmd/tailscale/tsroutecheckjsonv0/tsroutecheck.go
@@ -0,0 +1,28 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !ts_omit_routecheck
+
+// Package tsroutecheckjsonv0 provides types for unmarshalling the JSON output of the
+// "tailscale routecheck --json" command:
+//
+//   - [ReportResponse] will unmarshal the output of "tailscale routecheck --json"
+//
+// # WARNING: unstable
+//
+// Format is "v0" and is subject to change.
+// There is no guarantee of backwards or forwards compatibility.
+package tsroutecheckjsonv0
+
+import (
+	"time"
+
+	"tailscale.com/net/routecheck"
+)
+
+// ReportResponse is the JSON form of [routecheck.Report].
+// Experimental: This output is not yet stable: tailscale/tailscale#17366.
+type ReportResponse struct {
+	Done   time.Time                   `json:"done"`
+	Routes routecheck.RoutablePrefixes `json:"routes"`
+}
diff --git a/cmd/tailscaled/depaware-min.txt b/cmd/tailscaled/depaware-min.txt
index 94ebf144b..e57c3bbb6 100644
--- a/cmd/tailscaled/depaware-min.txt
+++ b/cmd/tailscaled/depaware-min.txt
@@ -15,6 +15,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         github.com/go-json-experiment/json/internal/jsonopts         from github.com/go-json-experiment/json+
         github.com/go-json-experiment/json/internal/jsonwire         from github.com/go-json-experiment/json+
         github.com/go-json-experiment/json/jsontext                  from github.com/go-json-experiment/json+
+        github.com/go-json-experiment/json/v1                        from tailscale.com/types/logger
         github.com/golang/groupcache/lru                             from tailscale.com/net/dnscache
      💣 github.com/jsimonetti/rtnetlink                              from tailscale.com/net/netmon
         github.com/jsimonetti/rtnetlink/internal/unix                from github.com/jsimonetti/rtnetlink
@@ -62,6 +63,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com/feature/buildfeatures                          from tailscale.com/cmd/tailscaled+
         tailscale.com/feature/condlite/expvar                        from tailscale.com/wgengine/magicsock
         tailscale.com/feature/condregister                           from tailscale.com/cmd/tailscaled
+        tailscale.com/feature/condregister/netlog                    from tailscale.com/feature/condregister
         tailscale.com/feature/condregister/portmapper                from tailscale.com/feature/condregister
         tailscale.com/feature/condregister/useproxy                  from tailscale.com/feature/condregister
         tailscale.com/health                                         from tailscale.com/control/controlclient+
@@ -95,7 +97,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com/net/flowtrack                                  from tailscale.com/wgengine/filter
         tailscale.com/net/ipset                                      from tailscale.com/ipn/ipnlocal+
         tailscale.com/net/netaddr                                    from tailscale.com/ipn+
-        tailscale.com/net/netcheck                                   from tailscale.com/ipn/ipnlocal+
+        tailscale.com/net/netcheck                                   from tailscale.com/wgengine/magicsock
         tailscale.com/net/neterror                                   from tailscale.com/net/batching+
         tailscale.com/net/netkernelconf                              from tailscale.com/ipn/ipnlocal
         tailscale.com/net/netknob                                    from tailscale.com/logpolicy+
@@ -107,11 +109,14 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com/net/packet/checksum                            from tailscale.com/net/tstun
         tailscale.com/net/ping                                       from tailscale.com/net/netcheck+
         tailscale.com/net/portmapper/portmappertype                  from tailscale.com/net/netcheck+
+        tailscale.com/net/routecheck/peernode                        from tailscale.com/ipn/ipnlocal
+        tailscale.com/net/routemanager                               from tailscale.com/ipn/ipnlocal+
         tailscale.com/net/sockopts                                   from tailscale.com/wgengine/magicsock
         tailscale.com/net/sockstats                                  from tailscale.com/control/controlclient+
         tailscale.com/net/stun                                       from tailscale.com/net/netcheck+
         tailscale.com/net/tlsdial                                    from tailscale.com/control/controlclient+
         tailscale.com/net/tlsdial/blockblame                         from tailscale.com/net/tlsdial
+        tailscale.com/net/traffic                                    from tailscale.com/ipn/ipnlocal
         tailscale.com/net/tsaddr                                     from tailscale.com/ipn+
         tailscale.com/net/tsdial                                     from tailscale.com/cmd/tailscaled+
         tailscale.com/net/tstun                                      from tailscale.com/cmd/tailscaled+
@@ -139,7 +144,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com/types/lazy                                     from tailscale.com/hostinfo+
         tailscale.com/types/logger                                   from tailscale.com/appc+
         tailscale.com/types/logid                                    from tailscale.com/cmd/tailscaled+
-        tailscale.com/types/mapx                                     from tailscale.com/ipn/ipnext
+        tailscale.com/types/mapx                                     from tailscale.com/ipn/ipnext+
         tailscale.com/types/netlogfunc                               from tailscale.com/net/tstun+
         tailscale.com/types/netmap                                   from tailscale.com/control/controlclient+
         tailscale.com/types/nettype                                  from tailscale.com/net/batching+
@@ -158,6 +163,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com/util/cloudenv                                  from tailscale.com/hostinfo+
         tailscale.com/util/cloudinfo                                 from tailscale.com/wgengine/magicsock
         tailscale.com/util/ctxkey                                    from tailscale.com/client/tailscale/apitype+
+        tailscale.com/util/def                                       from tailscale.com/ipn/localapi
         tailscale.com/util/dnsname                                   from tailscale.com/appc+
         tailscale.com/util/eventbus                                  from tailscale.com/control/controlclient+
         tailscale.com/util/execqueue                                 from tailscale.com/appc+
@@ -192,11 +198,9 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com/wgengine/filter                                from tailscale.com/control/controlclient+
         tailscale.com/wgengine/filter/filtertype                     from tailscale.com/types/netmap+
      💣 tailscale.com/wgengine/magicsock                             from tailscale.com/ipn/ipnlocal+
-        tailscale.com/wgengine/netlog                                from tailscale.com/wgengine
         tailscale.com/wgengine/netstack/gro                          from tailscale.com/net/tstun+
         tailscale.com/wgengine/router                                from tailscale.com/cmd/tailscaled+
         tailscale.com/wgengine/wgcfg                                 from tailscale.com/ipn/ipnlocal+
-        tailscale.com/wgengine/wgcfg/nmcfg                           from tailscale.com/ipn/ipnlocal
      💣 tailscale.com/wgengine/wgint                                 from tailscale.com/wgengine+
         tailscale.com/wgengine/wglog                                 from tailscale.com/wgengine
         golang.org/x/crypto/blake2b                                  from golang.org/x/crypto/nacl/box
@@ -219,7 +223,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         golang.org/x/net/icmp                                        from tailscale.com/net/ping
         golang.org/x/net/idna                                        from golang.org/x/net/http/httpguts
         golang.org/x/net/internal/iana                               from golang.org/x/net/icmp+
-        golang.org/x/net/internal/socket                             from golang.org/x/net/icmp+
+        golang.org/x/net/internal/socket                             from golang.org/x/net/ipv4+
         golang.org/x/net/ipv4                                        from github.com/tailscale/wireguard-go/conn+
         golang.org/x/net/ipv6                                        from github.com/tailscale/wireguard-go/conn+
         golang.org/x/sync/errgroup                                   from github.com/mdlayher/socket
@@ -334,6 +338,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         fmt                                                          from compress/flate+
         hash                                                         from crypto+
         hash/crc32                                                   from compress/gzip+
+        hash/fnv                                                     from tailscale.com/net/traffic
         hash/maphash                                                 from go4.org/mem
         html                                                         from tailscale.com/ipn/ipnlocal+
         internal/abi                                                 from hash/maphash+
diff --git a/cmd/tailscaled/depaware-minbox.txt b/cmd/tailscaled/depaware-minbox.txt
index e518613f8..cf34705e6 100644
--- a/cmd/tailscaled/depaware-minbox.txt
+++ b/cmd/tailscaled/depaware-minbox.txt
@@ -15,6 +15,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         github.com/go-json-experiment/json/internal/jsonopts         from github.com/go-json-experiment/json+
         github.com/go-json-experiment/json/internal/jsonwire         from github.com/go-json-experiment/json+
         github.com/go-json-experiment/json/jsontext                  from github.com/go-json-experiment/json+
+        github.com/go-json-experiment/json/v1                        from tailscale.com/types/logger
         github.com/golang/groupcache/lru                             from tailscale.com/net/dnscache
      💣 github.com/jsimonetti/rtnetlink                              from tailscale.com/net/netmon
         github.com/jsimonetti/rtnetlink/internal/unix                from github.com/jsimonetti/rtnetlink
@@ -54,7 +55,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com/cmd/tailscale/cli                              from tailscale.com/cmd/tailscaled
         tailscale.com/cmd/tailscale/cli/ffcomplete                   from tailscale.com/cmd/tailscale/cli
         tailscale.com/cmd/tailscale/cli/ffcomplete/internal          from tailscale.com/cmd/tailscale/cli/ffcomplete
-        tailscale.com/cmd/tailscale/cli/jsonoutput                   from tailscale.com/cmd/tailscale/cli
+        tailscale.com/cmd/tailscale/tsdnsjsonv0                      from tailscale.com/cmd/tailscale/cli
         tailscale.com/cmd/tailscaled/childproc                       from tailscale.com/cmd/tailscaled
         tailscale.com/control/controlbase                            from tailscale.com/control/controlhttp+
         tailscale.com/control/controlclient                          from tailscale.com/cmd/tailscaled+
@@ -75,6 +76,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com/feature/condregister                           from tailscale.com/cmd/tailscaled
         tailscale.com/feature/condregister/awsparamstore             from tailscale.com/cmd/tailscale/cli
         tailscale.com/feature/condregister/identityfederation        from tailscale.com/cmd/tailscale/cli
+        tailscale.com/feature/condregister/netlog                    from tailscale.com/feature/condregister
         tailscale.com/feature/condregister/oauthkey                  from tailscale.com/cmd/tailscale/cli
         tailscale.com/feature/condregister/portmapper                from tailscale.com/feature/condregister+
         tailscale.com/feature/condregister/useproxy                  from tailscale.com/cmd/tailscale/cli+
@@ -112,7 +114,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com/net/flowtrack                                  from tailscale.com/wgengine/filter
         tailscale.com/net/ipset                                      from tailscale.com/ipn/ipnlocal+
         tailscale.com/net/netaddr                                    from tailscale.com/ipn+
-        tailscale.com/net/netcheck                                   from tailscale.com/ipn/ipnlocal+
+        tailscale.com/net/netcheck                                   from tailscale.com/cmd/tailscale/cli+
         tailscale.com/net/neterror                                   from tailscale.com/net/batching+
         tailscale.com/net/netkernelconf                              from tailscale.com/ipn/ipnlocal
         tailscale.com/net/netknob                                    from tailscale.com/logpolicy+
@@ -124,11 +126,14 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com/net/packet/checksum                            from tailscale.com/net/tstun
         tailscale.com/net/ping                                       from tailscale.com/net/netcheck+
         tailscale.com/net/portmapper/portmappertype                  from tailscale.com/net/netcheck+
+        tailscale.com/net/routecheck/peernode                        from tailscale.com/ipn/ipnlocal
+        tailscale.com/net/routemanager                               from tailscale.com/ipn/ipnlocal+
         tailscale.com/net/sockopts                                   from tailscale.com/wgengine/magicsock
         tailscale.com/net/sockstats                                  from tailscale.com/control/controlclient+
         tailscale.com/net/stun                                       from tailscale.com/net/netcheck+
         tailscale.com/net/tlsdial                                    from tailscale.com/control/controlclient+
         tailscale.com/net/tlsdial/blockblame                         from tailscale.com/net/tlsdial
+        tailscale.com/net/traffic                                    from tailscale.com/ipn/ipnlocal
         tailscale.com/net/tsaddr                                     from tailscale.com/ipn+
         tailscale.com/net/tsdial                                     from tailscale.com/cmd/tailscaled+
         tailscale.com/net/tstun                                      from tailscale.com/cmd/tailscaled+
@@ -158,7 +163,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com/types/lazy                                     from tailscale.com/hostinfo+
         tailscale.com/types/logger                                   from tailscale.com/appc+
         tailscale.com/types/logid                                    from tailscale.com/cmd/tailscaled+
-        tailscale.com/types/mapx                                     from tailscale.com/ipn/ipnext
+        tailscale.com/types/mapx                                     from tailscale.com/ipn/ipnext+
         tailscale.com/types/netlogfunc                               from tailscale.com/net/tstun+
         tailscale.com/types/netmap                                   from tailscale.com/control/controlclient+
         tailscale.com/types/nettype                                  from tailscale.com/net/batching+
@@ -177,6 +182,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com/util/cloudenv                                  from tailscale.com/hostinfo+
         tailscale.com/util/cloudinfo                                 from tailscale.com/wgengine/magicsock
         tailscale.com/util/ctxkey                                    from tailscale.com/client/tailscale/apitype+
+        tailscale.com/util/def                                       from tailscale.com/ipn/localapi
         tailscale.com/util/dnsname                                   from tailscale.com/appc+
         tailscale.com/util/eventbus                                  from tailscale.com/client/local+
         tailscale.com/util/execqueue                                 from tailscale.com/appc+
@@ -213,11 +219,9 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com/wgengine/filter                                from tailscale.com/control/controlclient+
         tailscale.com/wgengine/filter/filtertype                     from tailscale.com/types/netmap+
      💣 tailscale.com/wgengine/magicsock                             from tailscale.com/ipn/ipnlocal+
-        tailscale.com/wgengine/netlog                                from tailscale.com/wgengine
         tailscale.com/wgengine/netstack/gro                          from tailscale.com/net/tstun+
         tailscale.com/wgengine/router                                from tailscale.com/cmd/tailscaled+
         tailscale.com/wgengine/wgcfg                                 from tailscale.com/ipn/ipnlocal+
-        tailscale.com/wgengine/wgcfg/nmcfg                           from tailscale.com/ipn/ipnlocal
      💣 tailscale.com/wgengine/wgint                                 from tailscale.com/wgengine+
         tailscale.com/wgengine/wglog                                 from tailscale.com/wgengine
         golang.org/x/crypto/blake2b                                  from golang.org/x/crypto/nacl/box
@@ -240,7 +244,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         golang.org/x/net/icmp                                        from tailscale.com/net/ping
         golang.org/x/net/idna                                        from golang.org/x/net/http/httpguts+
         golang.org/x/net/internal/iana                               from golang.org/x/net/icmp+
-        golang.org/x/net/internal/socket                             from golang.org/x/net/icmp+
+        golang.org/x/net/internal/socket                             from golang.org/x/net/ipv4+
         golang.org/x/net/ipv4                                        from github.com/tailscale/wireguard-go/conn+
         golang.org/x/net/ipv6                                        from github.com/tailscale/wireguard-go/conn+
         golang.org/x/sync/errgroup                                   from github.com/mdlayher/socket
@@ -355,6 +359,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         fmt                                                          from compress/flate+
         hash                                                         from crypto+
         hash/crc32                                                   from compress/gzip+
+        hash/fnv                                                     from tailscale.com/net/traffic
         hash/maphash                                                 from go4.org/mem
         html                                                         from tailscale.com/ipn/ipnlocal+
         internal/abi                                                 from hash/maphash+
diff --git a/cmd/tailscaled/depaware.txt b/cmd/tailscaled/depaware.txt
index 678d72560..27fe06551 100644
--- a/cmd/tailscaled/depaware.txt
+++ b/cmd/tailscaled/depaware.txt
@@ -20,10 +20,12 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
    L    github.com/aws/aws-sdk-go-v2/aws/signer/v4                   from github.com/aws/aws-sdk-go-v2/service/internal/presigned-url+
    L    github.com/aws/aws-sdk-go-v2/aws/transport/http              from github.com/aws/aws-sdk-go-v2/config+
    L    github.com/aws/aws-sdk-go-v2/config                          from tailscale.com/ipn/store/awsstore
+   L    github.com/aws/aws-sdk-go-v2/config/internal/ini             from github.com/aws/aws-sdk-go-v2/config
    L    github.com/aws/aws-sdk-go-v2/credentials                     from github.com/aws/aws-sdk-go-v2/config
    L    github.com/aws/aws-sdk-go-v2/credentials/ec2rolecreds        from github.com/aws/aws-sdk-go-v2/config
    L    github.com/aws/aws-sdk-go-v2/credentials/endpointcreds       from github.com/aws/aws-sdk-go-v2/config
    L    github.com/aws/aws-sdk-go-v2/credentials/endpointcreds/internal/client from github.com/aws/aws-sdk-go-v2/credentials/endpointcreds
+   L    github.com/aws/aws-sdk-go-v2/credentials/logincreds          from github.com/aws/aws-sdk-go-v2/config
    L    github.com/aws/aws-sdk-go-v2/credentials/processcreds        from github.com/aws/aws-sdk-go-v2/config
    L    github.com/aws/aws-sdk-go-v2/credentials/ssocreds            from github.com/aws/aws-sdk-go-v2/config
    L    github.com/aws/aws-sdk-go-v2/credentials/stscreds            from github.com/aws/aws-sdk-go-v2/config
@@ -36,17 +38,21 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
    L    github.com/aws/aws-sdk-go-v2/internal/endpoints              from github.com/aws/aws-sdk-go-v2/service/ssm+
    L    github.com/aws/aws-sdk-go-v2/internal/endpoints/awsrulesfn   from github.com/aws/aws-sdk-go-v2/service/ssm+
    L    github.com/aws/aws-sdk-go-v2/internal/endpoints/v2           from github.com/aws/aws-sdk-go-v2/service/ssm/internal/endpoints+
-   L    github.com/aws/aws-sdk-go-v2/internal/ini                    from github.com/aws/aws-sdk-go-v2/config
-   L    github.com/aws/aws-sdk-go-v2/internal/middleware             from github.com/aws/aws-sdk-go-v2/service/sso+
    L    github.com/aws/aws-sdk-go-v2/internal/rand                   from github.com/aws/aws-sdk-go-v2/aws+
    L    github.com/aws/aws-sdk-go-v2/internal/sdk                    from github.com/aws/aws-sdk-go-v2/aws+
    L    github.com/aws/aws-sdk-go-v2/internal/sdkio                  from github.com/aws/aws-sdk-go-v2/credentials/processcreds
    L    github.com/aws/aws-sdk-go-v2/internal/shareddefaults         from github.com/aws/aws-sdk-go-v2/config+
-   L    github.com/aws/aws-sdk-go-v2/internal/strings                from github.com/aws/aws-sdk-go-v2/aws/signer/internal/v4
+   L    github.com/aws/aws-sdk-go-v2/internal/strings                from github.com/aws/aws-sdk-go-v2/aws/signer/internal/v4+
    L    github.com/aws/aws-sdk-go-v2/internal/sync/singleflight      from github.com/aws/aws-sdk-go-v2/aws
    L    github.com/aws/aws-sdk-go-v2/internal/timeconv               from github.com/aws/aws-sdk-go-v2/aws/retry
+   L    github.com/aws/aws-sdk-go-v2/internal/v4a                    from github.com/aws/aws-sdk-go-v2/service/sts
+   L    github.com/aws/aws-sdk-go-v2/internal/v4a/internal/crypto    from github.com/aws/aws-sdk-go-v2/internal/v4a
+   L    github.com/aws/aws-sdk-go-v2/internal/v4a/internal/v4        from github.com/aws/aws-sdk-go-v2/internal/v4a
    L    github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding from github.com/aws/aws-sdk-go-v2/service/sts
    L    github.com/aws/aws-sdk-go-v2/service/internal/presigned-url  from github.com/aws/aws-sdk-go-v2/service/sts
+   L    github.com/aws/aws-sdk-go-v2/service/signin                  from github.com/aws/aws-sdk-go-v2/config+
+   L    github.com/aws/aws-sdk-go-v2/service/signin/internal/endpoints from github.com/aws/aws-sdk-go-v2/service/signin
+   L    github.com/aws/aws-sdk-go-v2/service/signin/types            from github.com/aws/aws-sdk-go-v2/credentials/logincreds+
    L    github.com/aws/aws-sdk-go-v2/service/ssm                     from tailscale.com/ipn/store/awsstore
    L    github.com/aws/aws-sdk-go-v2/service/ssm/internal/endpoints  from github.com/aws/aws-sdk-go-v2/service/ssm
    L    github.com/aws/aws-sdk-go-v2/service/ssm/types               from github.com/aws/aws-sdk-go-v2/service/ssm+
@@ -59,7 +65,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
    L    github.com/aws/aws-sdk-go-v2/service/sts                     from github.com/aws/aws-sdk-go-v2/config+
    L    github.com/aws/aws-sdk-go-v2/service/sts/internal/endpoints  from github.com/aws/aws-sdk-go-v2/service/sts
    L    github.com/aws/aws-sdk-go-v2/service/sts/types               from github.com/aws/aws-sdk-go-v2/credentials/stscreds+
-   L    github.com/aws/smithy-go                                     from github.com/aws/aws-sdk-go-v2/aws/protocol/restjson+
+   L 💣 github.com/aws/smithy-go                                     from github.com/aws/aws-sdk-go-v2/aws/protocol/restjson+
    L    github.com/aws/smithy-go/auth                                from github.com/aws/aws-sdk-go-v2/internal/auth+
    L    github.com/aws/smithy-go/auth/bearer                         from github.com/aws/aws-sdk-go-v2/aws+
    L    github.com/aws/smithy-go/context                             from github.com/aws/smithy-go/auth/bearer
@@ -69,7 +75,8 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
    L    github.com/aws/smithy-go/encoding/json                       from github.com/aws/aws-sdk-go-v2/service/ssm+
    L    github.com/aws/smithy-go/encoding/xml                        from github.com/aws/aws-sdk-go-v2/service/sts
    L    github.com/aws/smithy-go/endpoints                           from github.com/aws/aws-sdk-go-v2/service/ssm+
-   L    github.com/aws/smithy-go/endpoints/private/rulesfn           from github.com/aws/aws-sdk-go-v2/service/sts
+   L    github.com/aws/smithy-go/endpoints/private/rulesfn           from github.com/aws/aws-sdk-go-v2/service/sts+
+   L    github.com/aws/smithy-go/eventstream                         from github.com/aws/aws-sdk-go-v2/internal/auth/smithy+
    L    github.com/aws/smithy-go/internal/sync/singleflight          from github.com/aws/smithy-go/auth/bearer
    L    github.com/aws/smithy-go/io                                  from github.com/aws/aws-sdk-go-v2/feature/ec2/imds+
    L    github.com/aws/smithy-go/logging                             from github.com/aws/aws-sdk-go-v2/aws+
@@ -78,15 +85,16 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
    L    github.com/aws/smithy-go/private/requestcompression          from github.com/aws/aws-sdk-go-v2/config
    L    github.com/aws/smithy-go/ptr                                 from github.com/aws/aws-sdk-go-v2/aws+
    L    github.com/aws/smithy-go/rand                                from github.com/aws/aws-sdk-go-v2/aws/middleware+
+   L    github.com/aws/smithy-go/sync                                from github.com/aws/smithy-go/transport/http
    L    github.com/aws/smithy-go/time                                from github.com/aws/aws-sdk-go-v2/service/ssm+
    L    github.com/aws/smithy-go/tracing                             from github.com/aws/aws-sdk-go-v2/aws/middleware+
+   L    github.com/aws/smithy-go/traits                              from github.com/aws/smithy-go/eventstream
    L    github.com/aws/smithy-go/transport/http                      from github.com/aws/aws-sdk-go-v2/aws/middleware+
    L    github.com/aws/smithy-go/transport/http/internal/io          from github.com/aws/smithy-go/transport/http
    L    github.com/aws/smithy-go/waiter                              from github.com/aws/aws-sdk-go-v2/service/ssm
         github.com/coder/websocket                                   from tailscale.com/util/eventbus
         github.com/coder/websocket/internal/errd                     from github.com/coder/websocket
         github.com/coder/websocket/internal/util                     from github.com/coder/websocket
-        github.com/coder/websocket/internal/xsync                    from github.com/coder/websocket
    L    github.com/coreos/go-iptables/iptables                       from tailscale.com/util/linuxfw
         github.com/creachadair/msync/trigger                         from tailscale.com/logtail
   LD 💣 github.com/creack/pty                                        from tailscale.com/ssh/tailssh
@@ -112,6 +120,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         github.com/go-json-experiment/json/internal/jsonopts         from github.com/go-json-experiment/json/jsontext+
         github.com/go-json-experiment/json/internal/jsonwire         from github.com/go-json-experiment/json/jsontext+
         github.com/go-json-experiment/json/jsontext                  from tailscale.com/logtail+
+        github.com/go-json-experiment/json/v1                        from tailscale.com/feature/routecheck+
    W 💣 github.com/go-ole/go-ole                                     from github.com/go-ole/go-ole/oleutil+
    W 💣 github.com/go-ole/go-ole/oleutil                             from tailscale.com/wgengine/winnet
    L 💣 github.com/godbus/dbus/v5                                    from tailscale.com/net/dns+
@@ -130,7 +139,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
    L    github.com/google/nftables/expr                              from github.com/google/nftables+
    L    github.com/google/nftables/internal/parseexprfunc            from github.com/google/nftables+
    L    github.com/google/nftables/xt                                from github.com/google/nftables/expr+
-  DW    github.com/google/uuid                                       from tailscale.com/clientupdate+
+   W    github.com/google/uuid                                       from tailscale.com/clientupdate
         github.com/hdevalence/ed25519consensus                       from tailscale.com/clientupdate/distsign+
         github.com/huin/goupnp                                       from github.com/huin/goupnp/dcps/internetgateway2+
         github.com/huin/goupnp/dcps/internetgateway2                 from tailscale.com/net/portmapper
@@ -173,16 +182,15 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         github.com/pires/go-proxyproto                               from tailscale.com/ipn/ipnlocal
   LD    github.com/pkg/sftp                                          from tailscale.com/ssh/tailssh
   LD    github.com/pkg/sftp/internal/encoding/ssh/filexfer           from github.com/pkg/sftp
-   D    github.com/prometheus-community/pro-bing                     from tailscale.com/wgengine/netstack
    L 💣 github.com/safchain/ethtool                                  from tailscale.com/net/netkernelconf+
-   W 💣 github.com/tailscale/certstore                               from tailscale.com/control/controlclient
+  DW 💣 github.com/tailscale/certstore                               from tailscale.com/control/controlclient
   LD    github.com/tailscale/gliderssh                               from tailscale.com/ssh/tailssh
    W 💣 github.com/tailscale/go-winio                                from tailscale.com/safesocket
    W 💣 github.com/tailscale/go-winio/internal/fs                    from github.com/tailscale/go-winio
    W 💣 github.com/tailscale/go-winio/internal/socket                from github.com/tailscale/go-winio
    W    github.com/tailscale/go-winio/internal/stringbuffer          from github.com/tailscale/go-winio/internal/fs
    W    github.com/tailscale/go-winio/pkg/guid                       from github.com/tailscale/go-winio+
-        github.com/tailscale/hujson                                  from tailscale.com/ipn/conffile
+        github.com/tailscale/hujson                                  from tailscale.com/ipn/conffile+
    L 💣 github.com/tailscale/netlink                                 from tailscale.com/net/routetable+
    L 💣 github.com/tailscale/netlink/nl                              from github.com/tailscale/netlink
   LD    github.com/tailscale/peercred                                from tailscale.com/ipn/ipnauth
@@ -253,12 +261,13 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com                                                from tailscale.com/version
         tailscale.com/appc                                           from tailscale.com/ipn/ipnlocal+
      💣 tailscale.com/atomicfile                                     from tailscale.com/ipn+
-  LD    tailscale.com/chirp                                          from tailscale.com/cmd/tailscaled
+  LD    tailscale.com/chirp                                          from tailscale.com/feature/bird
         tailscale.com/client/local                                   from tailscale.com/client/web+
         tailscale.com/client/tailscale/apitype                       from tailscale.com/client/local+
         tailscale.com/client/web                                     from tailscale.com/ipn/ipnlocal
         tailscale.com/clientupdate                                   from tailscale.com/feature/clientupdate
   LW    tailscale.com/clientupdate/distsign                          from tailscale.com/clientupdate
+        tailscale.com/cmd/tailscale/jsonoutput                       from tailscale.com/feature/tailnetlock
         tailscale.com/cmd/tailscaled/childproc                       from tailscale.com/cmd/tailscaled+
         tailscale.com/cmd/tailscaled/tailscaledhooks                 from tailscale.com/cmd/tailscaled+
         tailscale.com/control/controlbase                            from tailscale.com/control/controlhttp+
@@ -284,13 +293,18 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com/envknob/featureknob                            from tailscale.com/client/web+
         tailscale.com/feature                                        from tailscale.com/feature/wakeonlan+
         tailscale.com/feature/ace                                    from tailscale.com/feature/condregister
+        tailscale.com/feature/acme                                   from tailscale.com/feature/condregister
         tailscale.com/feature/appconnectors                          from tailscale.com/feature/condregister
+  LD    tailscale.com/feature/bird                                   from tailscale.com/feature/condregister
         tailscale.com/feature/buildfeatures                          from tailscale.com/wgengine/magicsock+
         tailscale.com/feature/c2n                                    from tailscale.com/feature/condregister
+        tailscale.com/feature/captiveportal                          from tailscale.com/feature/condregister
+        tailscale.com/feature/captiveportal/netcheckhook             from tailscale.com/feature/captiveportal
         tailscale.com/feature/capture                                from tailscale.com/feature/condregister
         tailscale.com/feature/clientupdate                           from tailscale.com/feature/condregister
         tailscale.com/feature/condlite/expvar                        from tailscale.com/wgengine/magicsock
         tailscale.com/feature/condregister                           from tailscale.com/cmd/tailscaled
+        tailscale.com/feature/condregister/netlog                    from tailscale.com/feature/condregister
         tailscale.com/feature/condregister/portmapper                from tailscale.com/feature/condregister
         tailscale.com/feature/condregister/useproxy                  from tailscale.com/feature/condregister
         tailscale.com/feature/conn25                                 from tailscale.com/feature/condregister
@@ -299,14 +313,22 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com/feature/drive                                  from tailscale.com/feature/condregister
    L    tailscale.com/feature/linkspeed                              from tailscale.com/feature/condregister
    L    tailscale.com/feature/linuxdnsfight                          from tailscale.com/feature/condregister
+        tailscale.com/feature/netlog                                 from tailscale.com/feature/condregister/netlog
         tailscale.com/feature/portlist                               from tailscale.com/feature/condregister
         tailscale.com/feature/portmapper                             from tailscale.com/feature/condregister/portmapper
         tailscale.com/feature/posture                                from tailscale.com/feature/condregister
         tailscale.com/feature/relayserver                            from tailscale.com/feature/condregister
+        tailscale.com/feature/remoteconfig                           from tailscale.com/feature/condregister
+        tailscale.com/feature/routecheck                             from tailscale.com/feature/condregister
+        tailscale.com/feature/runtimemetrics                         from tailscale.com/feature/condregister
    L    tailscale.com/feature/sdnotify                               from tailscale.com/feature/condregister
+        tailscale.com/feature/serviceclientprefs                     from tailscale.com/feature/condregister
+        tailscale.com/feature/serviceclientprefs/serviceclient       from tailscale.com/client/local+
   LD    tailscale.com/feature/ssh                                    from tailscale.com/cmd/tailscaled
-        tailscale.com/feature/syspolicy                              from tailscale.com/feature/condregister+
+   L    tailscale.com/feature/syslog                                 from tailscale.com/feature/condregister
+        tailscale.com/feature/syspolicy                              from tailscale.com/feature/condregister
         tailscale.com/feature/taildrop                               from tailscale.com/feature/condregister
+        tailscale.com/feature/tailnetlock                            from tailscale.com/feature/condregister
    L    tailscale.com/feature/tap                                    from tailscale.com/feature/condregister
         tailscale.com/feature/tpm                                    from tailscale.com/feature/condregister
    L 💣 tailscale.com/feature/tundevstats                            from tailscale.com/feature/condregister
@@ -344,7 +366,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com/net/ace                                        from tailscale.com/feature/ace
         tailscale.com/net/bakedroots                                 from tailscale.com/net/tlsdial+
      💣 tailscale.com/net/batching                                   from tailscale.com/wgengine/magicsock+
-        tailscale.com/net/captivedetection                           from tailscale.com/ipn/ipnlocal+
+        tailscale.com/net/captivedetection                           from tailscale.com/feature/captiveportal+
         tailscale.com/net/dns                                        from tailscale.com/cmd/tailscaled+
         tailscale.com/net/dns/publicdns                              from tailscale.com/net/dns+
         tailscale.com/net/dns/resolvconffile                         from tailscale.com/net/dns+
@@ -369,6 +391,9 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com/net/portmapper                                 from tailscale.com/feature/portmapper+
         tailscale.com/net/portmapper/portmappertype                  from tailscale.com/feature/portmapper+
         tailscale.com/net/proxymux                                   from tailscale.com/cmd/tailscaled
+        tailscale.com/net/routecheck                                 from tailscale.com/feature/routecheck+
+        tailscale.com/net/routecheck/peernode                        from tailscale.com/ipn/ipnlocal+
+        tailscale.com/net/routemanager                               from tailscale.com/ipn/ipnlocal+
         tailscale.com/net/routetable                                 from tailscale.com/doctor/routetable
      💣 tailscale.com/net/sockopts                                   from tailscale.com/wgengine/magicsock+
         tailscale.com/net/socks5                                     from tailscale.com/cmd/tailscaled
@@ -376,6 +401,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com/net/stun                                       from tailscale.com/ipn/localapi+
         tailscale.com/net/tlsdial                                    from tailscale.com/control/controlclient+
         tailscale.com/net/tlsdial/blockblame                         from tailscale.com/net/tlsdial
+        tailscale.com/net/traffic                                    from tailscale.com/ipn/ipnlocal+
         tailscale.com/net/tsaddr                                     from tailscale.com/client/web+
         tailscale.com/net/tsdial                                     from tailscale.com/cmd/tailscaled+
      💣 tailscale.com/net/tshttpproxy                                from tailscale.com/feature/useproxy
@@ -393,7 +419,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
   LD 💣 tailscale.com/ssh/tailssh                                    from tailscale.com/feature/ssh
         tailscale.com/syncs                                          from tailscale.com/cmd/tailscaled+
         tailscale.com/tailcfg                                        from tailscale.com/client/local+
-        tailscale.com/tempfork/acme                                  from tailscale.com/ipn/ipnlocal
+        tailscale.com/tempfork/acme                                  from tailscale.com/feature/acme
         tailscale.com/tempfork/heap                                  from tailscale.com/wgengine/magicsock
         tailscale.com/tempfork/httprec                               from tailscale.com/feature/c2n
         tailscale.com/tka                                            from tailscale.com/client/local+
@@ -402,7 +428,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com/tstime                                         from tailscale.com/control/controlclient+
         tailscale.com/tstime/mono                                    from tailscale.com/net/tstun+
         tailscale.com/tstime/rate                                    from tailscale.com/wgengine/filter
-        tailscale.com/tsweb                                          from tailscale.com/util/eventbus
+        tailscale.com/tsweb                                          from tailscale.com/util/eventbus+
         tailscale.com/tsweb/varz                                     from tailscale.com/cmd/tailscaled+
         tailscale.com/types/appctype                                 from tailscale.com/ipn/ipnlocal+
         tailscale.com/types/bools                                    from tailscale.com/wgengine/netlog
@@ -415,7 +441,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com/types/lazy                                     from tailscale.com/ipn/ipnlocal+
         tailscale.com/types/logger                                   from tailscale.com/appc+
         tailscale.com/types/logid                                    from tailscale.com/cmd/tailscaled+
-        tailscale.com/types/mapx                                     from tailscale.com/ipn/ipnext
+        tailscale.com/types/mapx                                     from tailscale.com/ipn/ipnext+
         tailscale.com/types/netlogfunc                               from tailscale.com/net/tstun+
         tailscale.com/types/netlogtype                               from tailscale.com/wgengine/netlog
         tailscale.com/types/netmap                                   from tailscale.com/control/controlclient+
@@ -437,6 +463,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com/util/cmpver                                    from tailscale.com/net/dns+
         tailscale.com/util/ctxkey                                    from tailscale.com/ipn/ipnlocal+
      💣 tailscale.com/util/deephash                                  from tailscale.com/util/syspolicy/setting
+        tailscale.com/util/def                                       from tailscale.com/feature/debugportmapper+
    L 💣 tailscale.com/util/dirwalk                                   from tailscale.com/metrics+
         tailscale.com/util/dnsname                                   from tailscale.com/appc+
         tailscale.com/util/eventbus                                  from tailscale.com/tsd+
@@ -456,7 +483,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
    W 💣 tailscale.com/util/osdiag/internal/wsc                       from tailscale.com/util/osdiag
         tailscale.com/util/osshare                                   from tailscale.com/cmd/tailscaled+
         tailscale.com/util/osuser                                    from tailscale.com/ipn/ipnlocal+
-        tailscale.com/util/progresstracking                          from tailscale.com/feature/taildrop
+        tailscale.com/util/progresstracking                          from tailscale.com/feature/taildrop+
         tailscale.com/util/race                                      from tailscale.com/net/dns/resolver
         tailscale.com/util/racebuild                                 from tailscale.com/logpolicy
         tailscale.com/util/rands                                     from tailscale.com/ipn/ipnlocal+
@@ -464,7 +491,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com/util/set                                       from tailscale.com/control/controlclient+
         tailscale.com/util/singleflight                              from tailscale.com/control/controlclient+
         tailscale.com/util/slicesx                                   from tailscale.com/appc+
-        tailscale.com/util/syspolicy                                 from tailscale.com/feature/syspolicy
+        tailscale.com/util/syspolicy                                 from tailscale.com/feature/syspolicy+
         tailscale.com/util/syspolicy/internal                        from tailscale.com/util/syspolicy/setting+
         tailscale.com/util/syspolicy/internal/loggerx                from tailscale.com/util/syspolicy/internal/metrics+
         tailscale.com/util/syspolicy/internal/metrics                from tailscale.com/util/syspolicy/source
@@ -491,13 +518,12 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com/wgengine/filter                                from tailscale.com/control/controlclient+
         tailscale.com/wgengine/filter/filtertype                     from tailscale.com/types/netmap+
      💣 tailscale.com/wgengine/magicsock                             from tailscale.com/ipn/ipnlocal+
-        tailscale.com/wgengine/netlog                                from tailscale.com/wgengine
+        tailscale.com/wgengine/netlog                                from tailscale.com/feature/netlog
         tailscale.com/wgengine/netstack                              from tailscale.com/cmd/tailscaled
         tailscale.com/wgengine/netstack/gro                          from tailscale.com/net/tstun+
         tailscale.com/wgengine/router                                from tailscale.com/cmd/tailscaled+
         tailscale.com/wgengine/router/osrouter                       from tailscale.com/feature/condregister
         tailscale.com/wgengine/wgcfg                                 from tailscale.com/ipn/ipnlocal+
-        tailscale.com/wgengine/wgcfg/nmcfg                           from tailscale.com/ipn/ipnlocal
      💣 tailscale.com/wgengine/wgint                                 from tailscale.com/wgengine+
         tailscale.com/wgengine/wglog                                 from tailscale.com/wgengine
    W 💣 tailscale.com/wgengine/winnet                                from tailscale.com/wgengine/router/osrouter
@@ -507,7 +533,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
   LD    golang.org/x/crypto/blowfish                                 from golang.org/x/crypto/ssh/internal/bcrypt_pbkdf
         golang.org/x/crypto/chacha20                                 from golang.org/x/crypto/chacha20poly1305+
         golang.org/x/crypto/chacha20poly1305                         from github.com/tailscale/wireguard-go/device+
-        golang.org/x/crypto/cryptobyte                               from tailscale.com/feature/tpm
+        golang.org/x/crypto/cryptobyte                               from tailscale.com/feature/tpm+
         golang.org/x/crypto/cryptobyte/asn1                          from golang.org/x/crypto/cryptobyte+
         golang.org/x/crypto/curve25519                               from golang.org/x/crypto/ssh+
         golang.org/x/crypto/hkdf                                     from tailscale.com/control/controlbase
@@ -525,13 +551,13 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         golang.org/x/net/dns/dnsmessage                              from tailscale.com/appc+
         golang.org/x/net/http/httpguts                               from tailscale.com/ipn/ipnlocal
         golang.org/x/net/http/httpproxy                              from tailscale.com/net/tshttpproxy
-        golang.org/x/net/icmp                                        from tailscale.com/net/ping+
+        golang.org/x/net/icmp                                        from tailscale.com/net/ping
         golang.org/x/net/idna                                        from golang.org/x/net/http/httpguts+
         golang.org/x/net/internal/iana                               from golang.org/x/net/icmp+
-        golang.org/x/net/internal/socket                             from golang.org/x/net/icmp+
+        golang.org/x/net/internal/socket                             from golang.org/x/net/ipv4+
         golang.org/x/net/internal/socks                              from golang.org/x/net/proxy
-        golang.org/x/net/ipv4                                        from github.com/prometheus-community/pro-bing+
-        golang.org/x/net/ipv6                                        from github.com/prometheus-community/pro-bing+
+        golang.org/x/net/ipv4                                        from github.com/tailscale/wireguard-go/conn+
+        golang.org/x/net/ipv6                                        from github.com/tailscale/wireguard-go/conn+
         golang.org/x/net/proxy                                       from tailscale.com/net/netns
    D    golang.org/x/net/route                                       from tailscale.com/net/netmon+
         golang.org/x/sync/errgroup                                   from github.com/mdlayher/socket+
@@ -547,7 +573,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         golang.org/x/text/secure/bidirule                            from golang.org/x/net/idna
         golang.org/x/text/transform                                  from golang.org/x/text/secure/bidirule+
         golang.org/x/text/unicode/bidi                               from golang.org/x/net/idna+
-        golang.org/x/text/unicode/norm                               from golang.org/x/net/idna
+        golang.org/x/text/unicode/norm                               from golang.org/x/net/idna+
         golang.org/x/time/rate                                       from gvisor.dev/gvisor/pkg/log+
         vendor/golang.org/x/crypto/chacha20                          from vendor/golang.org/x/crypto/chacha20poly1305
         vendor/golang.org/x/crypto/chacha20poly1305                  from crypto/hpke+
@@ -566,6 +592,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         vendor/golang.org/x/text/unicode/bidi                        from vendor/golang.org/x/net/idna+
         vendor/golang.org/x/text/unicode/norm                        from vendor/golang.org/x/net/idna
         archive/tar                                                  from tailscale.com/clientupdate
+   L    archive/zip                                                  from tailscale.com/clientupdate
         bufio                                                        from compress/flate+
         bytes                                                        from archive/tar+
         cmp                                                          from slices+
@@ -642,7 +669,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         crypto/x509                                                  from crypto/tls+
    D    crypto/x509/internal/macos                                   from crypto/x509
         crypto/x509/pkix                                             from crypto/x509+
-  DW    database/sql/driver                                          from github.com/google/uuid
+   W    database/sql/driver                                          from github.com/google/uuid
    W    debug/dwarf                                                  from debug/pe
    W    debug/pe                                                     from github.com/dblohm7/wingoes/pe
         embed                                                        from github.com/tailscale/web-client-prebuilt+
@@ -662,6 +689,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         hash                                                         from compress/zlib+
         hash/adler32                                                 from compress/zlib+
         hash/crc32                                                   from compress/gzip+
+        hash/fnv                                                     from tailscale.com/net/traffic
         hash/maphash                                                 from go4.org/mem
         html                                                         from html/template+
         html/template                                                from tailscale.com/util/eventbus
@@ -716,11 +744,11 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         internal/unsafeheader                                        from internal/reflectlite+
         io                                                           from archive/tar+
         io/fs                                                        from archive/tar+
-        io/ioutil                                                    from github.com/aws/aws-sdk-go-v2/aws/protocol/query+
+        io/ioutil                                                    from github.com/aws/aws-sdk-go-v2/service/sso+
         iter                                                         from maps+
         log                                                          from expvar+
         log/internal                                                 from log
-  LD    log/syslog                                                   from tailscale.com/ssh/tailssh
+  LD    log/syslog                                                   from tailscale.com/ssh/tailssh+
         maps                                                         from tailscale.com/clientupdate+
         math                                                         from archive/tar+
         math/big                                                     from crypto/dsa+
@@ -732,7 +760,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         mime/quotedprintable                                         from mime/multipart
         net                                                          from crypto/tls+
         net/http                                                     from expvar+
-        net/http/httptrace                                           from github.com/prometheus-community/pro-bing+
+        net/http/httptrace                                           from github.com/aws/smithy-go/transport/http+
         net/http/httputil                                            from github.com/aws/smithy-go/transport/http+
         net/http/internal                                            from net/http+
         net/http/internal/ascii                                      from net/http+
@@ -752,6 +780,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         regexp/syntax                                                from regexp
         runtime                                                      from archive/tar+
         runtime/debug                                                from github.com/aws/aws-sdk-go-v2/internal/sync/singleflight+
+        runtime/metrics                                              from tailscale.com/feature/runtimemetrics
         runtime/pprof                                                from net/http/pprof+
         runtime/trace                                                from net/http/pprof
         slices                                                       from tailscale.com/appc+
diff --git a/cmd/tailscaled/deps_test.go b/cmd/tailscaled/deps_test.go
index be4f65a7d..a611644d1 100644
--- a/cmd/tailscaled/deps_test.go
+++ b/cmd/tailscaled/deps_test.go
@@ -13,6 +13,18 @@ import (
 	"tailscale.com/tstest/deptest"
 )
 
+func TestOmitServiceClientPrefs(t *testing.T) {
+	const msg = "unexpected with ts_omit_serviceclientprefs"
+	deptest.DepChecker{
+		GOOS:   "linux",
+		GOARCH: "amd64",
+		Tags:   "ts_omit_serviceclientprefs,ts_include_cli",
+		BadDeps: map[string]string{
+			"tailscale.com/feature/serviceclientprefs": msg,
+		},
+	}.Check(t)
+}
+
 func TestOmitSSH(t *testing.T) {
 	const msg = "unexpected with ts_omit_ssh"
 	deptest.DepChecker{
@@ -33,6 +45,21 @@ func TestOmitSSH(t *testing.T) {
 	}.Check(t)
 }
 
+func TestOmitSyslog(t *testing.T) {
+	const msg = "unexpected syslog usage with ts_omit_syslog"
+	deptest.DepChecker{
+		GOOS:   "linux",
+		GOARCH: "amd64",
+		// Tailscale SSH's incubator also uses log/syslog, so omit
+		// SSH too to lock down the standard library package.
+		Tags: "ts_omit_syslog,ts_omit_ssh,ts_include_cli",
+		BadDeps: map[string]string{
+			"log/syslog":                   msg,
+			"tailscale.com/feature/syslog": msg,
+		},
+	}.Check(t)
+}
+
 func TestOmitSyspolicy(t *testing.T) {
 	const msg = "unexpected syspolicy usage with ts_omit_syspolicy"
 	deptest.DepChecker{
@@ -137,6 +164,20 @@ func TestOmitCaptivePortal(t *testing.T) {
 	}.Check(t)
 }
 
+func TestOmitBird(t *testing.T) {
+	deptest.DepChecker{
+		GOOS:   "linux",
+		GOARCH: "amd64",
+		Tags:   "ts_omit_bird,ts_include_cli",
+		OnDep: func(dep string) {
+			switch dep {
+			case "tailscale.com/chirp", "tailscale.com/feature/bird":
+				t.Errorf("unexpected dep with ts_omit_bird: %q", dep)
+			}
+		},
+	}.Check(t)
+}
+
 func TestOmitAuth(t *testing.T) {
 	deptest.DepChecker{
 		GOOS:   "linux",
@@ -202,6 +243,19 @@ func TestOmitPortlist(t *testing.T) {
 	}.Check(t)
 }
 
+func TestOmitRouteCheck(t *testing.T) {
+	deptest.DepChecker{
+		GOOS:   "linux",
+		GOARCH: "amd64",
+		Tags:   "ts_omit_routecheck,ts_include_cli",
+		OnDep: func(dep string) {
+			if strings.Contains(dep, "routecheck") && !strings.HasSuffix(dep, "/peernode") {
+				t.Errorf("unexpected dep: %q", dep)
+			}
+		},
+	}.Check(t)
+}
+
 func TestOmitGRO(t *testing.T) {
 	deptest.DepChecker{
 		GOOS:   "linux",
diff --git a/cmd/tailscaled/install_darwin.go b/cmd/tailscaled/install_darwin.go
index 15d9e5462..4de1f3122 100644
--- a/cmd/tailscaled/install_darwin.go
+++ b/cmd/tailscaled/install_darwin.go
@@ -123,7 +123,7 @@ func installSystemDaemonDarwin(args []string) (err error) {
 		return err
 	}
 
-	// Do not overwrite targetBin with the binary file if it it's already
+	// Do not overwrite targetBin with the binary file if it's already
 	// pointing to it. This is primarily to handle Homebrew that writes
 	// /usr/local/bin/tailscaled is a symlink to the actual binary.
 	if !same {
diff --git a/cmd/tailscaled/netstack.go b/cmd/tailscaled/netstack.go
index d896f384f..4e180d36b 100644
--- a/cmd/tailscaled/netstack.go
+++ b/cmd/tailscaled/netstack.go
@@ -44,11 +44,6 @@ func newNetstack(logf logger.Logf, sys *tsd.System, onlyNetstack bool) (tsd.Nets
 	dialer := sys.Dialer.Get() // must be set by caller already
 
 	if onlyNetstack {
-		e := sys.Engine.Get()
-		dialer.UseNetstackForIP = func(ip netip.Addr) bool {
-			_, ok := e.PeerForIP(ip)
-			return ok
-		}
 		dialer.NetstackDialTCP = func(ctx context.Context, dst netip.AddrPort) (net.Conn, error) {
 			// Note: don't just return ns.DialContextTCP or we'll return
 			// *gonet.TCPConn(nil) instead of a nil interface which trips up
diff --git a/cmd/tailscaled/syspolicy.go b/cmd/tailscaled/syspolicy.go
new file mode 100644
index 000000000..47e6294fd
--- /dev/null
+++ b/cmd/tailscaled/syspolicy.go
@@ -0,0 +1,54 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !ts_omit_syspolicy
+
+package main
+
+import (
+	"flag"
+	"log"
+	"os"
+	"path/filepath"
+	"runtime"
+
+	"tailscale.com/util/syspolicy"
+)
+
+// syspolicyFile is the path to a JSON syspolicy file, set via the
+// --syspolicy-file flag. An empty value disables file-based syspolicy.
+var syspolicyFile string
+
+// defaultSyspolicyFile returns the platform-specific default path for the
+// --syspolicy-file flag. On Windows it sits next to the rest of Tailscale's
+// machine state under %ProgramData%\Tailscale. On every other platform
+// (Linux, the BSDs, illumos/Solaris, and tailscaled-without-the-GUI on
+// macOS) it uses /etc/tailscale, which is where admin-provided
+// configuration is conventionally placed.
+//
+// On Windows, when the file exists, its values take precedence over the
+// HKLM registry-based platform store on a per-key basis (with the registry
+// providing fallback values for keys the file does not set), because rsop
+// merges later-registered same-scope sources over earlier ones.
+func defaultSyspolicyFile() string {
+	if runtime.GOOS == "windows" {
+		if pd := os.Getenv("ProgramData"); pd != "" {
+			return filepath.Join(pd, "Tailscale", "syspolicy.json")
+		}
+		return ""
+	}
+	return "/etc/tailscale/syspolicy.json"
+}
+
+func init() {
+	flag.StringVar(&syspolicyFile, "syspolicy-file", defaultSyspolicyFile(),
+		"path to a JSON syspolicy file applied as a device-scope policy source; empty disables")
+	loadSyspolicy.Set(func() {
+		if syspolicyFile == "" {
+			return
+		}
+		if err := syspolicy.LoadJSONPolicyFile("JSONFile", syspolicyFile); err != nil {
+			log.Printf("%v", err)
+		}
+	})
+}
diff --git a/cmd/tailscaled/tailscaled.go b/cmd/tailscaled/tailscaled.go
index fe18731ae..d7c19f51b 100644
--- a/cmd/tailscaled/tailscaled.go
+++ b/cmd/tailscaled/tailscaled.go
@@ -18,6 +18,7 @@ import (
 	"log"
 	"net"
 	"net/http"
+	"net/netip"
 	"os"
 	"os/signal"
 	"path/filepath"
@@ -87,6 +88,16 @@ func defaultTunName() string {
 			// See https://github.com/tailscale/tailscale-synology/issues/35
 			return "tailscale0,userspace-networking"
 		}
+		if buildfeatures.HasNetstack && distro.Get() == distro.Crostini {
+			// cros-garcon NULL-derefs on cold-boot netlink interface
+			// enumeration when tailscale0 is present, preventing the
+			// Crostini container and ChromeOS Terminal from starting
+			// cleanly. Default to userspace-networking until the
+			// upstream ChromiumOS bug is fixed.
+			// See https://github.com/tailscale/tailscale/issues/12090
+			// See https://issuetracker.google.com/issues/517069318
+			return "userspace-networking"
+		}
 	}
 	return "tailscale0"
 }
@@ -131,9 +142,8 @@ var args struct {
 }
 
 var (
-	installSystemDaemon   func([]string) error                      // non-nil on some platforms
-	uninstallSystemDaemon func([]string) error                      // non-nil on some platforms
-	createBIRDClient      func(string) (wgengine.BIRDClient, error) // non-nil on some platforms
+	installSystemDaemon   func([]string) error // non-nil on some platforms
+	uninstallSystemDaemon func([]string) error // non-nil on some platforms
 )
 
 // Note - we use function pointers for subcommands so that subcommands like
@@ -173,6 +183,12 @@ var (
 	hookOutboundProxyListen        feature.Hook[func() proxyStartFunc]
 )
 
+// loadSyspolicy, if set, loads a JSON-file-backed syspolicy source after
+// command-line flags are parsed, using the path from --syspolicy-file. It
+// is set when built without ts_omit_syspolicy (see syspolicy.go), and
+// unset otherwise.
+var loadSyspolicy feature.Hook[func()]
+
 // proxyStartFunc is the type of the function returned by
 // outboundProxyListen, to start the servers on the Listeners
 // started by hookOutboundProxyListen.
@@ -207,7 +223,7 @@ func main() {
 	}
 	flag.BoolVar(&printVersion, "version", false, "print version information and exit")
 	flag.BoolVar(&args.disableLogs, "no-logs-no-support", false, "disable log uploads; this also disables any technical support")
-	flag.StringVar(&args.confFile, "config", "", "path to config file, or 'vm:user-data' to use the VM's user-data (EC2)")
+	flag.StringVar(&args.confFile, "config", "", "path to config file, or 'vm:user-data' to use the VM's user-data (EC2); prefix with 'optional:' to boot unconfigured when the source is absent instead of failing")
 	if buildfeatures.HasTPM {
 		flag.Var(&args.hardwareAttestation, "hardware-attestation", `use hardware-backed keys to bind node identity to this device when supported
 by the OS and hardware. Uses TPM 2.0 on Linux and Windows; SecureEnclave on
@@ -217,6 +233,9 @@ store state on filesystem.`)
 	if f, ok := hookRegisterOutboundProxyFlags.GetOk(); ok {
 		f()
 	}
+	if f, ok := feature.HookRegisterLogSinkFlags.GetOk(); ok {
+		f()
+	}
 
 	if runtime.GOOS == "plan9" && os.Getenv("_NETSHELL_CHILD_") != "" {
 		os.Args = []string{"tailscaled", "be-child", "plan9-netshell"}
@@ -245,6 +264,10 @@ store state on filesystem.`)
 		}
 	}
 
+	if f, ok := feature.HookLogSink.GetOk(); ok {
+		f() // redirects the default logger (e.g. to syslog) if requested by flags
+	}
+
 	if fd, ok := envknob.LookupInt("TS_PARENT_DEATH_FD"); ok && fd > 2 {
 		go dieOnPipeReadErrorOfFD(fd)
 	}
@@ -264,7 +287,7 @@ store state on filesystem.`)
 		log.Fatalf("--socket is required")
 	}
 
-	if buildfeatures.HasBird && args.birdSocketPath != "" && createBIRDClient == nil {
+	if buildfeatures.HasBird && args.birdSocketPath != "" && !wgengine.HookNewBird.IsSet() {
 		log.SetFlags(0)
 		log.Fatalf("--bird-socket is not supported on %s", runtime.GOOS)
 	}
@@ -285,6 +308,12 @@ store state on filesystem.`)
 		}
 	}
 
+	// If syspolicy is built in, load the JSON syspolicy file (if any) now
+	// so its settings are visible before anything queries them.
+	if f, ok := loadSyspolicy.GetOk(); ok {
+		f()
+	}
+
 	if buildfeatures.HasTPM {
 		handleTPMFlags()
 	}
@@ -409,11 +438,24 @@ func run() (err error) {
 	// Parse config, if specified, to fail early if it's invalid.
 	var conf *conffile.Config
 	if args.confFile != "" {
-		conf, err = conffile.Load(args.confFile)
-		if err != nil {
+		// An "optional:" prefix (e.g. "optional:vm:user-data") means it's fine
+		// for the config source to be absent: boot unconfigured and let the node
+		// be enrolled interactively instead of failing to start. A config that's
+		// present but invalid still fails, even when optional.
+		path := args.confFile
+		optional := false
+		if p, ok := strings.CutPrefix(path, "optional:"); ok {
+			optional, path = true, p
+		}
+		conf, err = conffile.Load(path)
+		switch {
+		case err == nil:
+			sys.InitialConfig = conf
+		case optional && errors.Is(err, conffile.ErrNoConfig):
+			logf("config: none present at %q; continuing unconfigured", path)
+		default:
 			return fmt.Errorf("error reading config file: %w", err)
 		}
-		sys.InitialConfig = conf
 	}
 
 	var netMon *netmon.Monitor
@@ -428,6 +470,10 @@ func run() (err error) {
 
 	var publicLogID logid.PublicID
 	if buildfeatures.HasLogTail {
+		logpolicy.GetLogTarget.Set(func() string {
+			target, _ := sys.PolicyClientOrDefault().GetString(pkey.LogTarget, "")
+			return target
+		})
 
 		pol := logpolicy.Options{
 			Collection: logtail.CollectionNode,
@@ -460,9 +506,6 @@ func run() (err error) {
 		return nil
 	}
 
-	if envknob.Bool("TS_DEBUG_MEMORY") {
-		logf = logger.RusagePrefixLog(logf)
-	}
 	logf = logger.RateLimitedFn(logf, 5*time.Second, 5, 100)
 
 	if envknob.Bool("TS_PLEASE_PANIC") {
@@ -671,6 +714,12 @@ func getLocalBackend(ctx context.Context, logf logger.Logf, logID logid.PublicID
 	if err != nil {
 		return nil, fmt.Errorf("ipnlocal.NewLocalBackend: %w", err)
 	}
+	if onlyNetstack {
+		dialer.UseNetstackForIP = func(ip netip.Addr) bool {
+			_, ok := lb.PeerForIP(ip)
+			return ok
+		}
+	}
 	lb.SetVarRoot(opts.VarRoot)
 	if logPol != nil {
 		lb.SetLogFlusher(logPol.Logtail.StartFlush)
@@ -761,12 +810,8 @@ func tryEngine(logf logger.Logf, sys *tsd.System, name string) (onlyNetstack boo
 	netstackSubnetRouter := onlyNetstack // but mutated later on some platforms
 	netns.SetEnabled(!onlyNetstack)
 
-	if args.birdSocketPath != "" && createBIRDClient != nil {
-		log.Printf("Connecting to BIRD at %s ...", args.birdSocketPath)
-		conf.BIRDClient, err = createBIRDClient(args.birdSocketPath)
-		if err != nil {
-			return false, fmt.Errorf("createBIRDClient: %w", err)
-		}
+	if buildfeatures.HasBird && args.birdSocketPath != "" {
+		conf.BIRDSocket = args.birdSocketPath
 	}
 	if onlyNetstack {
 		if runtime.GOOS == "linux" && distro.Get() == distro.Synology {
@@ -828,7 +873,6 @@ func tryEngine(logf logger.Logf, sys *tsd.System, name string) (onlyNetstack boo
 	if err != nil {
 		return onlyNetstack, err
 	}
-	e = wgengine.NewWatchdog(e)
 	sys.Set(e)
 	sys.NetstackRouter.Set(netstackSubnetRouter)
 
@@ -917,7 +961,9 @@ func handleTPMFlags() {
 	case !args.hardwareAttestation.set:
 		policyHWAttestation, _ := policyclient.Get().GetBoolean(pkey.HardwareAttestation, false)
 		if err := canUseHardwareAttestation(); err != nil {
-			log.Printf("[unexpected] policy requires hardware attestation, but device does not support it: %v", err)
+			if policyHWAttestation {
+				log.Printf("[unexpected] policy requires hardware attestation, but device does not support it: %v", err)
+			}
 			args.hardwareAttestation.v = false
 		} else {
 			args.hardwareAttestation.v = policyHWAttestation
diff --git a/cmd/tailscaled/tailscaled_bird.go b/cmd/tailscaled/tailscaled_bird.go
deleted file mode 100644
index c1c32d2bb..000000000
--- a/cmd/tailscaled/tailscaled_bird.go
+++ /dev/null
@@ -1,17 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-//go:build go1.19 && (linux || darwin || freebsd || openbsd) && !ts_omit_bird
-
-package main
-
-import (
-	"tailscale.com/chirp"
-	"tailscale.com/wgengine"
-)
-
-func init() {
-	createBIRDClient = func(ctlSocket string) (wgengine.BIRDClient, error) {
-		return chirp.New(ctlSocket)
-	}
-}
diff --git a/cmd/testwrapper/flakytest/flakytest.go b/cmd/testwrapper/flakytest/flakytest.go
index 5e1591e81..ff9b8e5bb 100644
--- a/cmd/testwrapper/flakytest/flakytest.go
+++ b/cmd/testwrapper/flakytest/flakytest.go
@@ -1,9 +1,14 @@
 // Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
-// Package flakytest contains test helpers for marking a test as flaky. For
-// tests run using cmd/testwrapper, a failed flaky test will cause tests to be
-// re-run a few time until they succeed or exceed our iteration limit.
+// Package flakytest contains test helpers for marking a test as flaky.
+//
+// Marking a test with [Mark] is not required for cmd/testwrapper to retry
+// failed tests; the wrapper retries any failure within a per-test time
+// budget and reports a test as flaky if it ever passes on retry. Mark is
+// useful for tracking a known-flaky test against a GitHub issue and for the
+// TS_SKIP_FLAKY_TESTS skip behavior used to keep CI green when a flake is
+// being investigated.
 package flakytest
 
 import (
diff --git a/cmd/testwrapper/testdata/A_baseline/raw.txt b/cmd/testwrapper/testdata/A_baseline/raw.txt
new file mode 100644
index 000000000..36bfad518
--- /dev/null
+++ b/cmd/testwrapper/testdata/A_baseline/raw.txt
@@ -0,0 +1,6 @@
+=== RUN   TestOne
+    a_test.go:6: hello from one
+--- PASS: TestOne (0.00s)
+=== RUN   TestTwo
+--- PASS: TestTwo (0.00s)
+PASS
diff --git a/cmd/testwrapper/testdata/A_baseline/src.go b/cmd/testwrapper/testdata/A_baseline/src.go
new file mode 100644
index 000000000..5f90db1dd
--- /dev/null
+++ b/cmd/testwrapper/testdata/A_baseline/src.go
@@ -0,0 +1,13 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package baseline
+
+import "testing"
+
+func TestOne(t *testing.T) {
+	t.Log("hello from one")
+}
+
+func TestTwo(t *testing.T) {
+}
diff --git a/cmd/testwrapper/testdata/B_inbody/raw.txt b/cmd/testwrapper/testdata/B_inbody/raw.txt
new file mode 100644
index 000000000..108a0ec59
--- /dev/null
+++ b/cmd/testwrapper/testdata/B_inbody/raw.txt
@@ -0,0 +1,30 @@
+=== RUN   TestRace
+==================
+WARNING: DATA RACE
+Read at 0x0000007f12a8 by goroutine 8:
+  racesurvey/B_inbody.TestRace.func1()
+      /tmp/racesurvey/B_inbody/b_test.go:13 +0x74
+
+Previous write at 0x0000007f12a8 by goroutine 9:
+  racesurvey/B_inbody.TestRace.func2()
+      /tmp/racesurvey/B_inbody/b_test.go:14 +0x8c
+
+Goroutine 8 (running) created at:
+  racesurvey/B_inbody.TestRace()
+      /tmp/racesurvey/B_inbody/b_test.go:13 +0xbe
+  testing.tRunner()
+      /home/ubuntu/sdk/go1.26.3/src/testing/testing.go:2036 +0x21c
+  testing.(*T).Run.gowrap1()
+      /home/ubuntu/sdk/go1.26.3/src/testing/testing.go:2101 +0x38
+
+Goroutine 9 (finished) created at:
+  racesurvey/B_inbody.TestRace()
+      /tmp/racesurvey/B_inbody/b_test.go:14 +0x124
+  testing.tRunner()
+      /home/ubuntu/sdk/go1.26.3/src/testing/testing.go:2036 +0x21c
+  testing.(*T).Run.gowrap1()
+      /home/ubuntu/sdk/go1.26.3/src/testing/testing.go:2101 +0x38
+==================
+    testing.go:1712: race detected during execution of test
+--- FAIL: TestRace (0.00s)
+FAIL
diff --git a/cmd/testwrapper/testdata/B_inbody/src.go b/cmd/testwrapper/testdata/B_inbody/src.go
new file mode 100644
index 000000000..f0abebb99
--- /dev/null
+++ b/cmd/testwrapper/testdata/B_inbody/src.go
@@ -0,0 +1,19 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package inbody
+
+import (
+	"sync"
+	"testing"
+)
+
+var counter int
+
+func TestRace(t *testing.T) {
+	var wg sync.WaitGroup
+	wg.Add(2)
+	go func() { defer wg.Done(); counter++ }()
+	go func() { defer wg.Done(); counter++ }()
+	wg.Wait()
+}
diff --git a/cmd/testwrapper/testdata/C_spawnwait/caught.raw.txt b/cmd/testwrapper/testdata/C_spawnwait/caught.raw.txt
new file mode 100644
index 000000000..c2dcf3655
--- /dev/null
+++ b/cmd/testwrapper/testdata/C_spawnwait/caught.raw.txt
@@ -0,0 +1,32 @@
+=== RUN   TestSpawn
+==================
+WARNING: DATA RACE
+Read at 0x0000007f12a8 by goroutine 9:
+  racesurvey/C_spawnwait.TestSpawn.func2()
+      /tmp/racesurvey/C_spawnwait/c_test.go:14 +0x70
+
+Previous write at 0x0000007f12a8 by goroutine 8:
+  racesurvey/C_spawnwait.TestSpawn.func1()
+      /tmp/racesurvey/C_spawnwait/c_test.go:13 +0x88
+
+Goroutine 9 (running) created at:
+  racesurvey/C_spawnwait.TestSpawn()
+      /tmp/racesurvey/C_spawnwait/c_test.go:14 +0x44
+  testing.tRunner()
+      /home/ubuntu/sdk/go1.26.3/src/testing/testing.go:2036 +0x21c
+  testing.(*T).Run.gowrap1()
+      /home/ubuntu/sdk/go1.26.3/src/testing/testing.go:2101 +0x38
+
+Goroutine 8 (finished) created at:
+  racesurvey/C_spawnwait.TestSpawn()
+      /tmp/racesurvey/C_spawnwait/c_test.go:13 +0x34
+  testing.tRunner()
+      /home/ubuntu/sdk/go1.26.3/src/testing/testing.go:2036 +0x21c
+  testing.(*T).Run.gowrap1()
+      /home/ubuntu/sdk/go1.26.3/src/testing/testing.go:2101 +0x38
+==================
+    testing.go:1712: race detected during execution of test
+--- FAIL: TestSpawn (0.00s)
+=== RUN   TestWait
+--- PASS: TestWait (0.00s)
+FAIL
diff --git a/cmd/testwrapper/testdata/C_spawnwait/pass.raw.txt b/cmd/testwrapper/testdata/C_spawnwait/pass.raw.txt
new file mode 100644
index 000000000..c7ba6ebf3
--- /dev/null
+++ b/cmd/testwrapper/testdata/C_spawnwait/pass.raw.txt
@@ -0,0 +1,31 @@
+=== RUN   TestSpawn
+--- PASS: TestSpawn (0.00s)
+=== RUN   TestWait
+==================
+WARNING: DATA RACE
+Read at 0x0000007f12a8 by goroutine 8:
+  racesurvey/C_spawnwait.TestSpawn.func1()
+      /tmp/racesurvey/C_spawnwait/c_test.go:13 +0x70
+
+Previous write at 0x0000007f12a8 by goroutine 9:
+  racesurvey/C_spawnwait.TestSpawn.func2()
+      /tmp/racesurvey/C_spawnwait/c_test.go:14 +0x88
+
+Goroutine 8 (running) created at:
+  racesurvey/C_spawnwait.TestSpawn()
+      /tmp/racesurvey/C_spawnwait/c_test.go:13 +0x34
+  testing.tRunner()
+      /home/ubuntu/sdk/go1.26.3/src/testing/testing.go:2036 +0x21c
+  testing.(*T).Run.gowrap1()
+      /home/ubuntu/sdk/go1.26.3/src/testing/testing.go:2101 +0x38
+
+Goroutine 9 (finished) created at:
+  racesurvey/C_spawnwait.TestSpawn()
+      /tmp/racesurvey/C_spawnwait/c_test.go:14 +0x44
+  testing.tRunner()
+      /home/ubuntu/sdk/go1.26.3/src/testing/testing.go:2036 +0x21c
+  testing.(*T).Run.gowrap1()
+      /home/ubuntu/sdk/go1.26.3/src/testing/testing.go:2101 +0x38
+==================
+--- PASS: TestWait (0.00s)
+FAIL
diff --git a/cmd/testwrapper/testdata/C_spawnwait/src.go b/cmd/testwrapper/testdata/C_spawnwait/src.go
new file mode 100644
index 000000000..42e13fef1
--- /dev/null
+++ b/cmd/testwrapper/testdata/C_spawnwait/src.go
@@ -0,0 +1,22 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package spawnwait
+
+import (
+	"sync"
+	"testing"
+)
+
+var counter int
+var wg sync.WaitGroup
+
+func TestSpawn(t *testing.T) {
+	wg.Add(2)
+	go func() { defer wg.Done(); counter++ }()
+	go func() { defer wg.Done(); counter++ }()
+}
+
+func TestWait(t *testing.T) {
+	wg.Wait()
+}
diff --git a/cmd/testwrapper/testdata/D_delayed/raw.txt b/cmd/testwrapper/testdata/D_delayed/raw.txt
new file mode 100644
index 000000000..d7d22f21e
--- /dev/null
+++ b/cmd/testwrapper/testdata/D_delayed/raw.txt
@@ -0,0 +1,32 @@
+=== RUN   TestA
+--- PASS: TestA (0.00s)
+=== RUN   TestSleep
+==================
+WARNING: DATA RACE
+Read at 0x0000007f12a8 by goroutine 9:
+  racesurvey/D_postterminal.TestA.func2()
+      /tmp/racesurvey/D_postterminal/d_test.go:16 +0x8a
+
+Previous write at 0x0000007f12a8 by goroutine 8:
+  racesurvey/D_postterminal.TestA.func1()
+      /tmp/racesurvey/D_postterminal/d_test.go:15 +0xa4
+
+Goroutine 9 (running) created at:
+  racesurvey/D_postterminal.TestA()
+      /tmp/racesurvey/D_postterminal/d_test.go:16 +0x44
+  testing.tRunner()
+      /home/ubuntu/sdk/go1.26.3/src/testing/testing.go:2036 +0x21c
+  testing.(*T).Run.gowrap1()
+      /home/ubuntu/sdk/go1.26.3/src/testing/testing.go:2101 +0x38
+
+Goroutine 8 (finished) created at:
+  racesurvey/D_postterminal.TestA()
+      /tmp/racesurvey/D_postterminal/d_test.go:15 +0x34
+  testing.tRunner()
+      /home/ubuntu/sdk/go1.26.3/src/testing/testing.go:2036 +0x21c
+  testing.(*T).Run.gowrap1()
+      /home/ubuntu/sdk/go1.26.3/src/testing/testing.go:2101 +0x38
+==================
+    testing.go:1712: race detected during execution of test
+--- FAIL: TestSleep (0.05s)
+FAIL
diff --git a/cmd/testwrapper/testdata/D_delayed/src.go b/cmd/testwrapper/testdata/D_delayed/src.go
new file mode 100644
index 000000000..f0fed3cfc
--- /dev/null
+++ b/cmd/testwrapper/testdata/D_delayed/src.go
@@ -0,0 +1,28 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package delayed
+
+import (
+	"sync"
+	"testing"
+	"time"
+)
+
+var counter int
+var wg sync.WaitGroup
+var trigger = make(chan struct{})
+
+func TestA(t *testing.T) {
+	wg.Add(2)
+	go func() { defer wg.Done(); <-trigger; counter++ }()
+	go func() { defer wg.Done(); <-trigger; counter++ }()
+}
+
+func TestSleep(t *testing.T) {
+	close(trigger)
+	// Sleep long enough that the goroutines race during this sleep,
+	// but TestSleep itself doesn't write to counter.
+	time.Sleep(50 * time.Millisecond)
+	wg.Wait()
+}
diff --git a/cmd/testwrapper/testdata/E_testmain/raw.txt b/cmd/testwrapper/testdata/E_testmain/raw.txt
new file mode 100644
index 000000000..df96dbe1f
--- /dev/null
+++ b/cmd/testwrapper/testdata/E_testmain/raw.txt
@@ -0,0 +1,26 @@
+=== RUN   TestPass
+--- PASS: TestPass (0.00s)
+PASS
+==================
+WARNING: DATA RACE
+Read at 0x0000007f52a8 by goroutine 9:
+  racesurvey/E_testmain.TestMain.func2()
+      /tmp/racesurvey/E_testmain/e_test.go:18 +0x74
+
+Previous write at 0x0000007f52a8 by goroutine 8:
+  racesurvey/E_testmain.TestMain.func1()
+      /tmp/racesurvey/E_testmain/e_test.go:17 +0x8c
+
+Goroutine 9 (running) created at:
+  racesurvey/E_testmain.TestMain()
+      /tmp/racesurvey/E_testmain/e_test.go:18 +0x139
+  main.main()
+      _testmain.go:48 +0x171
+
+Goroutine 8 (finished) created at:
+  racesurvey/E_testmain.TestMain()
+      /tmp/racesurvey/E_testmain/e_test.go:17 +0xcc
+  main.main()
+      _testmain.go:48 +0x171
+==================
+Found 1 data race(s)
diff --git a/cmd/testwrapper/testdata/E_testmain/src.go b/cmd/testwrapper/testdata/E_testmain/src.go
new file mode 100644
index 000000000..ec15be22b
--- /dev/null
+++ b/cmd/testwrapper/testdata/E_testmain/src.go
@@ -0,0 +1,24 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package testmain
+
+import (
+	"sync"
+	"testing"
+)
+
+var counter int
+
+func TestPass(t *testing.T) {
+}
+
+func TestMain(m *testing.M) {
+	code := m.Run()
+	var wg sync.WaitGroup
+	wg.Add(2)
+	go func() { defer wg.Done(); counter++ }()
+	go func() { defer wg.Done(); counter++ }()
+	wg.Wait()
+	_ = code
+}
diff --git a/cmd/testwrapper/testdata/F_parallel/split.raw.txt b/cmd/testwrapper/testdata/F_parallel/split.raw.txt
new file mode 100644
index 000000000..6c8e1137d
--- /dev/null
+++ b/cmd/testwrapper/testdata/F_parallel/split.raw.txt
@@ -0,0 +1,57 @@
+=== RUN   TestParA
+=== PAUSE TestParA
+=== RUN   TestParB
+=== PAUSE TestParB
+=== CONT  TestParA
+=== CONT  TestParB
+--- PASS: TestParA (0.00s)
+==================
+WARNING: DATA RACE
+Read at 0x0000007f02b0 by goroutine 8:
+  racesurvey/F_parallel.TestParB()
+      /tmp/racesurvey/F_parallel/f_test.go:17 +0x3b
+  testing.tRunner()
+      /home/ubuntu/sdk/go1.26.3/src/testing/testing.go:2036 +0x21c
+  testing.(*T).Run.gowrap1()
+      /home/ubuntu/sdk/go1.26.3/src/testing/testing.go:2101 +0x38
+
+Previous write at 0x0000007f02b0 by goroutine 7:
+  racesurvey/F_parallel.TestParA()
+      /tmp/racesurvey/F_parallel/f_test.go:10 +0x53
+  testing.tRunner()
+      /home/ubuntu/sdk/go1.26.3/src/testing/testing.go:2036 +0x21c
+  testing.(*T).Run.gowrap1()
+      /home/ubuntu/sdk/go1.26.3/src/testing/testing.go:2101 +0x38
+
+Goroutine 8 (running) created at:
+  testing.(*T).Run()
+      /home/ubuntu/sdk/go1.26.3/src/testing/testing.go:2101 +0xb12
+  testing.runTests.func1()
+      /home/ubuntu/sdk/go1.26.3/src/testing/testing.go:2585 +0x84
+  testing.tRunner()
+      /home/ubuntu/sdk/go1.26.3/src/testing/testing.go:2036 +0x21c
+  testing.runTests()
+      /home/ubuntu/sdk/go1.26.3/src/testing/testing.go:2583 +0x9e9
+  testing.(*M).Run()
+      /home/ubuntu/sdk/go1.26.3/src/testing/testing.go:2443 +0xf4b
+  main.main()
+      _testmain.go:48 +0x164
+
+Goroutine 7 (running) created at:
+  testing.(*T).Run()
+      /home/ubuntu/sdk/go1.26.3/src/testing/testing.go:2101 +0xb12
+  testing.runTests.func1()
+      /home/ubuntu/sdk/go1.26.3/src/testing/testing.go:2585 +0x84
+  testing.tRunner()
+      /home/ubuntu/sdk/go1.26.3/src/testing/testing.go:2036 +0x21c
+  testing.runTests()
+      /home/ubuntu/sdk/go1.26.3/src/testing/testing.go:2583 +0x9e9
+  testing.(*M).Run()
+      /home/ubuntu/sdk/go1.26.3/src/testing/testing.go:2443 +0xf4b
+  main.main()
+      _testmain.go:48 +0x164
+==================
+=== NAME  TestParB
+    testing.go:1712: race detected during execution of test
+--- FAIL: TestParB (0.00s)
+FAIL
diff --git a/cmd/testwrapper/testdata/F_parallel/src.go b/cmd/testwrapper/testdata/F_parallel/src.go
new file mode 100644
index 000000000..18cd968ff
--- /dev/null
+++ b/cmd/testwrapper/testdata/F_parallel/src.go
@@ -0,0 +1,22 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package parallel
+
+import "testing"
+
+var counter int
+
+func TestParA(t *testing.T) {
+	t.Parallel()
+	for i := 0; i < 100; i++ {
+		counter++
+	}
+}
+
+func TestParB(t *testing.T) {
+	t.Parallel()
+	for i := 0; i < 100; i++ {
+		counter++
+	}
+}
diff --git a/cmd/testwrapper/testdata/README.md b/cmd/testwrapper/testdata/README.md
new file mode 100644
index 000000000..d15dc64c3
--- /dev/null
+++ b/cmd/testwrapper/testdata/README.md
@@ -0,0 +1,133 @@
+# Race-output test corpus
+
+This directory is a corpus of captured Go test binary outputs that
+exercise the various ways the `-race` detector's `WARNING: DATA RACE`
+text can land relative to `=== RUN` / `--- PASS:` / `--- FAIL:` /
+`=== NAME` lines, and how `cmd/internal/test2json` attributes that
+output to tests.
+
+Each scenario subdirectory contains:
+
+- `src.go` — the Go source code that was compiled and run to produce
+  the captured output. Reproduce via
+  `go test -race -c -o /tmp/scenario.test ./<dir>/`.
+- `raw.txt` (or scenario-specific name) — the raw stdout+stderr of
+  the resulting test binary when run as `./scenario.test -test.v`.
+  This is the byte stream that `go test -json` feeds to
+  `go tool test2json` in production.
+
+`go test -json` adds two things on top of what `test2json` sees,
+which are NOT in these captures: a `FAIL\t<pkg>\t<time>` output line
+and a corresponding `fail` action event when the binary exits with a
+non-zero status (e.g. the race detector's exit code 66). Consumers
+that simulate the `go test -json` view from these files need to
+append those.
+
+To turn a `raw.txt` into the JSON `testwrapper` would consume:
+
+```
+go tool test2json -p <pkgname> < raw.txt
+```
+
+## Scenarios
+
+### A_baseline — no race
+
+Two trivial passing tests, no `-race` involvement at all. Useful as a
+sanity-check for parsers; demonstrates the standard mapping from
+`=== RUN`/`--- PASS:`/bare `PASS` lines to JSON events.
+
+### B_inbody — race during a test's own body
+
+A single test spawns racing goroutines and `wg.Wait()`s for them.
+The race fires while the test is still running, so
+`testing.checkRaces` sees `race.Errors()` increment between the
+test's start and end and the test is marked `--- FAIL:` with a
+`testing.go:1712: race detected during execution of test` line.
+
+This is the well-behaved case: the race output and the failure marker
+are both attributed to a single, clearly-failed test.
+
+### C_spawnwait — race in goroutines that outlive a test
+
+`TestSpawn` spawns racing goroutines and returns immediately;
+`TestWait` blocks until they finish. Where the race report lands is
+timing-dependent. Two captured variants:
+
+- `pass.raw.txt` — both `TestSpawn` and `TestWait` end up marked
+  `--- PASS:`, with the entire `WARNING: DATA RACE` report
+  attributed to `TestWait` (the test whose `=== RUN` line was the
+  most recent thing emitted when TSan printed). Neither test's
+  `checkRaces` saw `race.Errors()` increment within its window. The
+  binary still exits non-zero, producing only a bare trailing
+  `FAIL`. **This is the case where testwrapper currently drops the
+  race report on the floor.**
+
+- `caught.raw.txt` — `TestSpawn`'s `checkRaces` happened to fire
+  after the goroutines raced, so it emits the standard
+  `testing.go:1712:` + `--- FAIL: TestSpawn` markers. Race report is
+  attributed to `TestSpawn`, and the failure is attributed to
+  `TestSpawn` too. Well-behaved.
+
+### D_delayed — race delayed into the next test's body
+
+Like `C_spawnwait` but the spawned goroutines block on a channel that
+the second test closes, then sleeps. This forces the race counter
+delta to land between the second test's `resetRaces` and
+`checkRaces`, so the framework reliably attributes a failure to the
+sleeping test. Compare with `B_inbody`: same end shape, but the
+failure is attributed to a test that doesn't *contain* the racing
+code.
+
+### E_testmain — race in `TestMain` after `m.Run()`
+
+The race-producing goroutines are spawned by `TestMain` after
+`m.Run()` returns. By that point the framework has already printed
+its top-level `PASS` summary, so `test2json`'s `c.testName` is reset
+to `""` and the entire race report shows up at **package level** —
+all of its `output` events have an empty `Test` field. The bare
+`PASS` line earlier in the output also causes `test2json` to set
+`c.result = "pass"`, which means `go tool test2json` in isolation
+ends up emitting `{"Action":"pass","Package":"..."}` for the
+package; only `go test`'s own exit-code post-processing turns it
+into the visible package-level failure.
+
+### F_parallel — racing parallel tests
+
+Two `t.Parallel()` tests both increment the same global. The
+captured `split.raw.txt` shows the report **split across two tests**
+via a `=== NAME  TestParB` redirect line emitted by the framework:
+
+```
+--- PASS: TestParA (0.00s)
+==================
+WARNING: DATA RACE
+   ... full race report ...
+==================
+=== NAME  TestParB
+    testing.go:1712: race detected during execution of test
+--- FAIL: TestParB (0.00s)
+```
+
+`test2json` attributes the `WARNING: DATA RACE` block plus the full
+stack trace to `TestParA` (which passes), then sees the
+`=== NAME  TestParB` directive and switches attribution, so the
+trailing `race detected` line and `--- FAIL` end up under
+`TestParB` (which fails). A consumer that only flushes failed tests'
+logs sees the `race detected` line but loses the stack trace.
+
+## How these were captured
+
+```
+# For each scenario directory <name>/ (e.g. C_spawnwait):
+go test -race -c -o /tmp/<name>.test ./testdata/<name>/
+/tmp/<name>.test -test.v >./testdata/<name>/raw.txt 2>&1
+```
+
+For scenarios where the race detector's attribution is
+timing-dependent (C, F), the binary was run repeatedly and the
+interesting variants saved with distinct names.
+
+The captured outputs contain absolute file paths from the machine
+they were recorded on (e.g. `/tmp/racesurvey/...`). Tests that
+match against these files should not depend on those paths.
diff --git a/cmd/testwrapper/testwrapper.go b/cmd/testwrapper/testwrapper.go
index 204409a63..d1977691b 100644
--- a/cmd/testwrapper/testwrapper.go
+++ b/cmd/testwrapper/testwrapper.go
@@ -1,10 +1,17 @@
 // Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
-// testwrapper is a wrapper for retrying flaky tests. It is an alternative to
-// `go test` and re-runs failed marked flaky tests (using the flakytest pkg). It
-// takes different arguments than go test and requires the first positional
-// argument to be the pattern to test.
+// testwrapper is a wrapper for go test that automatically retries failing
+// tests to detect flakiness.
+//
+// Any failed test is treated as potentially flaky and re-run within a per-test
+// time budget (see the perAttempt* and perTestBudget constants). A test that
+// fails and then later passes is reported as flaky. A test that never passes
+// within the budget is a real failure and causes a non-zero exit.
+//
+// The flakytest package's Mark API is no longer required for retries — it is
+// kept for explicit issue tracking and for the TS_SKIP_FLAKY_TESTS skip
+// behavior.
 package main
 
 import (
@@ -15,38 +22,133 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"hash/fnv"
 	"io"
 	"log"
 	"os"
 	"os/exec"
+	"path/filepath"
+	"regexp"
 	"slices"
 	"sort"
+	"strconv"
 	"strings"
 	"time"
 
 	"tailscale.com/cmd/testwrapper/flakytest"
-	"tailscale.com/util/slicesx"
 )
 
+// Per-test retry policy. See package doc comment.
 const (
-	maxAttempts = 3
+	// perAttemptCap is the upper bound on the per-retry-attempt -timeout we set
+	// when running a single failed test.
+	perAttemptCap = 5 * time.Minute
+	// perAttemptFloor is the lower bound on the per-retry-attempt -timeout, to
+	// give the test binary time to start.
+	perAttemptFloor = 30 * time.Second
+	// maxRetries caps the number of retry attempts for a single test. It
+	// guards against re-running a very fast test thousands of times within
+	// perTestBudget.
+	maxRetries = 10
+
+	// raceDetectorMarkerLine is the first line of every Go race
+	// detector report, emitted at column 0. We look for it as a
+	// whole line (not as a substring) so that we don't false-fire
+	// on tests that legitimately print the same text indented in
+	// their own logs — for example, this package's own race tests,
+	// which exec a child testwrapper and dump its captured output.
+	raceDetectorMarkerLine = "WARNING: DATA RACE\n"
+)
+
+// Tunables for the per-test retry budget. These default to production values
+// but can be overridden via env vars, primarily for tests of testwrapper
+// itself.
+var (
+	// perTestBudget is the total wall-clock time we are willing to spend
+	// retrying a single test before giving up. Override via
+	// TS_TESTWRAPPER_BUDGET (a time.Duration string).
+	perTestBudget = envDuration("TS_TESTWRAPPER_BUDGET", 10*time.Minute)
+	// minRetries is the minimum number of retry attempts we make for a failed
+	// test, regardless of perTestBudget. Override via TS_TESTWRAPPER_MIN_RETRIES.
+	minRetries = envInt("TS_TESTWRAPPER_MIN_RETRIES", 2)
+	// maxRetryTime is the maximum wall-clock time we are willing to spend on the
+	// whole retry phase. It ensures a run with many flakes or real failures
+	// doesn't block for an unreasonable amount of time. Override via
+	// TS_TESTWRAPPER_MAX_RETRY_TIME (a time.Duration string).
+	maxRetryTime = envDuration("TS_TESTWRAPPER_MAX_RETRY_TIME", 10*time.Minute)
+)
+
+func envDuration(key string, def time.Duration) time.Duration {
+	s := os.Getenv(key)
+	if s == "" {
+		return def
+	}
+	d, err := time.ParseDuration(s)
+	if err != nil {
+		log.Panicf("invalid %s=%q: %v", key, s, err)
+	}
+	return d
+}
+
+func envInt(key string, def int) int {
+	s := os.Getenv(key)
+	if s == "" {
+		return def
+	}
+	n, err := strconv.Atoi(s)
+	if err != nil {
+		log.Panicf("invalid %s=%q: %v", key, s, err)
+	}
+	return n
+}
+
+// flakeUnknownIssueSlug is the trailing path of the fake GitHub issue URL we
+// record for tests that turned out flaky but were not explicitly marked with
+// flakytest.Mark. flakeapp records this as a flake occurrence with no real
+// issue.
+const flakeUnknownIssueSlug = "/issues/UNKNOWN"
+
+// testOutcome is the outcome of a single test (or package) run. Its string
+// values match the Action field in `go test -json` output.
+type testOutcome string
+
+const (
+	outcomeUnknown testOutcome = ""
+	outcomePass    testOutcome = "pass"
+	outcomeFail    testOutcome = "fail"
+	outcomeSkip    testOutcome = "skip"
 )
 
 type testAttempt struct {
-	pkg           string // "tailscale.com/types/key"
-	testName      string // "TestFoo"
-	outcome       string // "pass", "fail", "skip"
-	cached        bool   // whether package-level (non-testName specific) was pass due to being cached
+	pkg           string      // "tailscale.com/types/key"
+	testName      string      // "TestFoo"
+	outcome       testOutcome // outcomePass, outcomeFail, outcomeSkip, or outcomeUnknown
+	cached        bool        // whether package-level (non-testName specific) was pass due to being cached
 	logs          bytes.Buffer
 	start, end    time.Time
 	isMarkedFlaky bool   // set if the test is marked as flaky
 	issueURL      string // set if the test is marked as flaky
+	// raceDetected is true on a per-test event if that test's output
+	// contained a race report, and true on a pkgFinished event if any
+	// test in the package -- or the package's own output -- did.
+	raceDetected bool
 
 	pkgFinished bool
 }
 
+// failedTest tracks per-test state across the retry phase.
+type failedTest struct {
+	pkg, testName     string
+	firstFailDuration time.Duration
+	issueURL          string // non-empty iff the test called flakytest.Mark
+
+	attempts          int           // number of retry attempts run so far
+	totalRetryElapsed time.Duration // total time spent across retry attempts
+	everPassed        bool          // a retry attempt passed
+}
+
 // packageTests describes what to run.
-// It's also JSON-marshalled to output for analysys tools to parse
+// It's also JSON-marshalled to output for analysis tools to parse,
 // so the fields are all exported.
 // TODO(bradfitz): move this type to its own types package?
 type packageTests struct {
@@ -71,6 +173,94 @@ type goTestOutput struct {
 
 var debug = os.Getenv("TS_TESTWRAPPER_DEBUG") != ""
 
+// testsForShard returns the test names in pkg that belong to the given shard
+// spec (e.g. "2/3"). It uses "go list -json" to find test source files (no
+// compilation) and scans them for top-level test function names, assigning
+// each to a shard by hashing. Returns nil if the spec is invalid or if
+// listing fails (the main run will surface the error).
+func testsForShard(ctx context.Context, pkg, shardSpec string) ([]string, error) {
+	a, b, ok := strings.Cut(shardSpec, "/")
+	if !ok {
+		return nil, nil
+	}
+	wantShard, err := strconv.Atoi(a)
+	if err != nil || wantShard < 1 {
+		return nil, nil
+	}
+	shards, err := strconv.Atoi(b)
+	if err != nil || shards < 1 {
+		return nil, nil
+	}
+
+	out, err := exec.CommandContext(ctx, "go", "list", "-json", pkg).Output()
+	if err != nil {
+		// Errors will be surfaced by the main test run.
+		return nil, nil
+	}
+
+	type pkgJSON struct {
+		Dir          string
+		TestGoFiles  []string
+		XTestGoFiles []string
+	}
+
+	seen := map[string]bool{}
+	var result []string
+
+	dec := json.NewDecoder(bytes.NewReader(out))
+	for dec.More() {
+		var p pkgJSON
+		if err := dec.Decode(&p); err != nil {
+			break
+		}
+		for _, f := range append(p.TestGoFiles, p.XTestGoFiles...) {
+			names, err := testFuncNames(filepath.Join(p.Dir, f))
+			if err != nil {
+				continue
+			}
+			for _, name := range names {
+				if seen[name] {
+					continue
+				}
+				seen[name] = true
+				h := fnv.New32a()
+				io.WriteString(h, name)
+				if int(h.Sum32()%uint32(shards)) == wantShard-1 {
+					result = append(result, name)
+				}
+			}
+		}
+	}
+	return result, nil
+}
+
+// testFuncNames scans a Go source file and returns the names of all top-level
+// test functions (Test*, Benchmark*, Example*, Fuzz*).
+func testFuncNames(path string) ([]string, error) {
+	f, err := os.Open(path)
+	if err != nil {
+		return nil, err
+	}
+	defer f.Close()
+	var names []string
+	sc := bufio.NewScanner(f)
+	for sc.Scan() {
+		rest, ok := strings.CutPrefix(sc.Text(), "func ")
+		if !ok {
+			continue
+		}
+		for _, prefix := range []string{"Test", "Benchmark", "Example", "Fuzz"} {
+			if strings.HasPrefix(rest, prefix) {
+				if i := strings.IndexByte(rest, '('); i > 0 {
+					names = append(names, rest[:i])
+				}
+				break
+			}
+		}
+	}
+	return names, sc.Err()
+}
+
 // runTests runs the tests in pt and sends the results on ch. It sends a
 // testAttempt for each test and a final testAttempt per pkg with pkgFinished
 // set to true. Package build errors will not emit a testAttempt (as no valid
@@ -82,8 +272,24 @@ func runTests(ctx context.Context, attempt int, pt *packageTests, goTestArgs, te
 	args = append(args, goTestArgs...)
 	args = append(args, pt.Pattern)
 	if len(pt.Tests) > 0 {
+		// Specific tests requested (e.g. flaky test retry).
 		runArg := strings.Join(pt.Tests, "|")
 		args = append(args, "--run", runArg)
+	} else if shardSpec := os.Getenv("TS_TEST_SHARD"); shardSpec != "" {
+		// Automatic test-name sharding: list tests and filter by hash.
+		shardTests, err := testsForShard(ctx, pt.Pattern, shardSpec)
+		if err != nil {
+			return err
+		}
+		if len(shardTests) == 0 {
+			ch <- &testAttempt{pkg: pt.Pattern, outcome: outcomeSkip, pkgFinished: true}
+			return nil
+		}
+		quoted := make([]string, len(shardTests))
+		for i, name := range shardTests {
+			quoted[i] = regexp.QuoteMeta(name)
+		}
+		args = append(args, "--run", "^("+strings.Join(quoted, "|")+")$")
 	}
 	args = append(args, testArgs...)
 	args = append(args, "-json")
@@ -91,9 +297,6 @@ func runTests(ctx context.Context, attempt int, pt *packageTests, goTestArgs, te
 		fmt.Println("running", strings.Join(args, " "))
 	}
 	cmd := exec.CommandContext(ctx, "go", args...)
-	if len(pt.Tests) > 0 {
-		cmd.Env = append(os.Environ(), "TS_TEST_SHARD=") // clear test shard; run all tests we say to run
-	}
 	r, err := cmd.StdoutPipe()
 	if err != nil {
 		log.Printf("error creating stdout pipe: %v", err)
@@ -101,7 +304,9 @@ func runTests(ctx context.Context, attempt int, pt *packageTests, goTestArgs, te
 	defer r.Close()
 	cmd.Stderr = os.Stderr
 
-	cmd.Env = os.Environ()
+	cmd.Env = slices.DeleteFunc(os.Environ(), func(s string) bool {
+		return strings.HasPrefix(s, "TS_TEST_SHARD=")
+	})
 	cmd.Env = append(cmd.Env, fmt.Sprintf("%s=%d", flakytest.FlakeAttemptEnv, attempt))
 
 	if err := cmd.Start(); err != nil {
@@ -143,24 +348,56 @@ func runTests(ctx context.Context, attempt int, pt *packageTests, goTestArgs, te
 				pkgTests[""].logs.WriteString(goOutput.Output)
 			case "build-fail", "fail", "pass", "skip":
 				for _, test := range pkgTests {
-					if test.testName != "" && test.outcome == "" {
-						test.outcome = "fail"
+					if test.testName != "" && test.outcome == outcomeUnknown {
+						test.outcome = outcomeFail
 						ch <- test
 					}
 				}
-				outcome := goOutput.Action
-				if outcome == "build-fail" {
-					outcome = "fail"
+				outcome := testOutcome(goOutput.Action)
+				if goOutput.Action == "build-fail" {
+					outcome = outcomeFail
 				}
 				pkgTests[""].logs.WriteString(goOutput.Output)
+				// If a data race was detected anywhere in this
+				// package's output -- whether at the package level or
+				// attributed to a specific test -- consolidate all
+				// per-test logs into the package-level logs so the
+				// full race report is visible regardless of which
+				// test test2json happened to attribute it to. The
+				// pkgFinished testAttempt also carries raceDetected
+				// so the main loop can suppress flaky-test retries.
+				raceDetected := pkgTests[""].raceDetected
+				if !raceDetected {
+					for _, t := range pkgTests {
+						if t.raceDetected {
+							raceDetected = true
+							break
+						}
+					}
+				}
+				if raceDetected {
+					var ts []*testAttempt
+					for _, t := range pkgTests {
+						if t.testName != "" && t.logs.Len() > 0 {
+							ts = append(ts, t)
+						}
+					}
+					slices.SortFunc(ts, func(a, b *testAttempt) int {
+						return a.start.Compare(b.start)
+					})
+					for _, t := range ts {
+						pkgTests[""].logs.Write(t.logs.Bytes())
+					}
+				}
 				ch <- &testAttempt{
-					pkg:         goOutput.Package,
-					outcome:     outcome,
-					start:       pkgTests[""].start,
-					end:         goOutput.Time,
-					logs:        pkgTests[""].logs,
-					pkgFinished: true,
-					cached:      pkgCached[goOutput.Package],
+					pkg:          goOutput.Package,
+					outcome:      outcome,
+					start:        pkgTests[""].start,
+					end:          goOutput.Time,
+					logs:         pkgTests[""].logs,
+					pkgFinished:  true,
+					cached:       pkgCached[goOutput.Package],
+					raceDetected: raceDetected,
 				}
 			case "output":
 				// Capture all output from the package except for the final
@@ -168,6 +405,9 @@ func runTests(ctx context.Context, attempt int, pt *packageTests, goTestArgs, te
 				// printPkgOutcome will output a similar line
 				if !strings.HasPrefix(goOutput.Output, fmt.Sprintf("FAIL\t%s\t", goOutput.Package)) {
 					pkgTests[""].logs.WriteString(goOutput.Output)
+					if goOutput.Output == raceDetectorMarkerLine {
+						pkgTests[""].raceDetected = true
+					}
 				}
 			}
 
@@ -178,6 +418,9 @@ func runTests(ctx context.Context, attempt int, pt *packageTests, goTestArgs, te
 			testName = test
 			if goOutput.Action == "output" {
 				resultMap[pkg][testName].logs.WriteString(goOutput.Output)
+				if goOutput.Output == raceDetectorMarkerLine {
+					resultMap[pkg][testName].raceDetected = true
+				}
 			}
 			continue
 		}
@@ -192,7 +435,7 @@ func runTests(ctx context.Context, attempt int, pt *packageTests, goTestArgs, te
 			}
 		case "skip", "pass", "fail":
 			pkgTests[testName].end = goOutput.Time
-			pkgTests[testName].outcome = goOutput.Action
+			pkgTests[testName].outcome = testOutcome(goOutput.Action)
 			ch <- pkgTests[testName]
 		case "output":
 			if suffix, ok := strings.CutPrefix(strings.TrimSpace(goOutput.Output), flakytest.FlakyTestLogMessage); ok {
@@ -200,6 +443,9 @@ func runTests(ctx context.Context, attempt int, pt *packageTests, goTestArgs, te
 				pkgTests[testName].issueURL = strings.TrimPrefix(suffix, ": ")
 			} else {
 				pkgTests[testName].logs.WriteString(goOutput.Output)
+				if goOutput.Output == raceDetectorMarkerLine {
+					pkgTests[testName].raceDetected = true
+				}
 			}
 		}
 	}
@@ -212,6 +458,283 @@ func runTests(ctx context.Context, attempt int, pt *packageTests, goTestArgs, te
 	return nil
 }
 
+// runOneTest runs a single test in a single package via `go test -run` with a
+// per-attempt -timeout. It returns the test's outcome (outcomePass /
+// outcomeFail / outcomeSkip), the wall-clock time spent on this attempt
+// (used for the per-test retry budget), and any captured test logs.
+//
+// On panic, timeout, or any other failure mode where the test does not emit a
+// pass/fail/skip JSON event, outcome is reported as outcomeFail.
+func runOneTest(ctx context.Context, pkg, testName string, perAttemptTimeout time.Duration, attemptNum int, goTestArgs, testArgs []string) (outcome testOutcome, wallDur time.Duration, logs bytes.Buffer, err error) {
+	goTestArgs, perAttemptTimeout = extractTimeout(goTestArgs, perAttemptTimeout)
+	testArgs, perAttemptTimeout = extractTimeout(testArgs, perAttemptTimeout)
+	args := []string{"test", "-json"}
+	args = append(args, goTestArgs...)
+	args = append(args, "-timeout", perAttemptTimeout.String())
+	args = append(args, pkg)
+	args = append(args, "--run", "^("+regexp.QuoteMeta(testName)+")$")
+	args = append(args, testArgs...)
+
+	if debug {
+		fmt.Println("running", strings.Join(args, " "))
+	}
+	cmd := exec.CommandContext(ctx, "go", args...)
+	// Strip TS_TEST_SHARD so the child doesn't try to shard inside a
+	// single-test retry — we are telling it exactly what to run.
+	cmd.Env = slices.DeleteFunc(os.Environ(), func(s string) bool {
+		return strings.HasPrefix(s, "TS_TEST_SHARD=")
+	})
+	cmd.Env = append(cmd.Env, fmt.Sprintf("%s=%d", flakytest.FlakeAttemptEnv, attemptNum))
+	r, perr := cmd.StdoutPipe()
+	if perr != nil {
+		return "", 0, logs, fmt.Errorf("stdout pipe: %w", perr)
+	}
+	defer r.Close()
+	cmd.Stderr = os.Stderr
+
+	wallStart := time.Now()
+	if err := cmd.Start(); err != nil {
+		return "", 0, logs, fmt.Errorf("starting go test: %w", err)
+	}
+
+	s := bufio.NewScanner(r)
+	for s.Scan() {
+		var ev goTestOutput
+		if err := json.Unmarshal(s.Bytes(), &ev); err != nil {
+			continue
+		}
+		if ev.Test == "" {
+			continue // package-level events ignored for single-test runs
+		}
+		// Collapse subtests to parent.
+		parent, _, _ := strings.Cut(ev.Test, "/")
+		if parent != testName {
+			continue
+		}
+		switch ev.Action {
+		case "pass", "fail", "skip":
+			if ev.Test == testName {
+				outcome = testOutcome(ev.Action)
+			}
+		case "output":
+			logs.WriteString(ev.Output)
+		}
+	}
+	waitErr := cmd.Wait()
+	wallDur = time.Since(wallStart)
+	if scanErr := s.Err(); scanErr != nil && err == nil {
+		err = fmt.Errorf("reading go test stdout: %w", scanErr)
+	}
+	if outcome == outcomeUnknown {
+		// Test never emitted a pass/fail/skip — likely a panic, timeout, or
+		// build error. Treat as fail.
+		outcome = outcomeFail
+	}
+	if waitErr != nil && err == nil && outcome == outcomePass {
+		// A non-zero exit when outcome==outcomePass is unexpected; surface it.
+		err = waitErr
+	}
+	return outcome, wallDur, logs, err
+}
+
+// extractTimeout returns args with any -timeout / -test.timeout flags
+// stripped, and the smaller of cap and the user-supplied timeout (if any).
+// This lets retries use the testwrapper-computed per-attempt timeout, but
+// never exceed an explicit -timeout the user passed on the command line.
+func extractTimeout(args []string, cap time.Duration) (stripped []string, t time.Duration) {
+	t = cap
+	stripped = make([]string, 0, len(args))
+	for i := 0; i < len(args); i++ {
+		a := args[i]
+		bare := strings.TrimLeft(a, "-")
+		name, val, hasEq := strings.Cut(bare, "=")
+		if name == "timeout" || name == "test.timeout" {
+			var raw string
+			if hasEq {
+				raw = val
+			} else if i+1 < len(args) {
+				raw = args[i+1]
+				i++
+			}
+			if d, err := time.ParseDuration(raw); err == nil && d < t {
+				t = d
+			}
+			continue
+		}
+		stripped = append(stripped, a)
+	}
+	return stripped, t
+}
+
+// computePerAttemptTimeout returns the -timeout we use for each retry attempt
+// of a test that first failed in firstFail.
+//
+// It is the smaller of perAttemptCap (5 min) and 1.5*firstFail, but never
+// smaller than perAttemptFloor (30 s).
+func computePerAttemptTimeout(firstFail time.Duration) time.Duration {
+	t := time.Duration(float64(firstFail) * 1.5)
+	return max(perAttemptFloor, min(perAttemptCap, t))
+}
+
+// retryFailedTest runs the per-test retry loop for ft. It updates ft in place.
+func retryFailedTest(ctx context.Context, ft *failedTest, goTestArgs, testArgs []string, deadline time.Time) {
+	perAttempt := computePerAttemptTimeout(ft.firstFailDuration)
+	for {
+		if ft.everPassed {
+			return
+		}
+		if ft.attempts >= maxRetries {
+			return
+		}
+		if ft.attempts >= minRetries && ft.totalRetryElapsed >= perTestBudget {
+			return
+		}
+		if remaining := time.Until(deadline); remaining < perAttempt {
+			// perAttempt represents a reasonable guess of how long the test might take
+			// to run, so don't even attempt to retry a test that is likely to take us
+			// past our overall deadline.
+			log.Printf("testwrapper: not retrying %s.%s because its timeout (%.1fs) would exceed the remaining max retry time (%.1fs)",
+				ft.pkg, ft.testName, perAttempt.Seconds(), remaining.Seconds())
+			return
+		}
+
+		// FlakeAttemptEnv is 1-indexed counting the first pass as attempt 1.
+		// Retry attempt N is FlakeAttemptEnv = 1 + N.
+		attemptNum := 1 + ft.attempts + 1
+		outcome, dur, logs, err := runOneTest(ctx, ft.pkg, ft.testName, perAttempt, attemptNum, goTestArgs, testArgs)
+		ft.attempts++
+		ft.totalRetryElapsed += dur
+
+		fmt.Printf("    [retry %d] %s.%s: %s (%.3fs)\n",
+			ft.attempts, ft.pkg, ft.testName, strings.ToUpper(string(outcome)), dur.Seconds())
+		if err != nil {
+			log.Printf("testwrapper: error running %s.%s: %v", ft.pkg, ft.testName, err)
+		}
+		if testingVerbose || outcome == outcomeFail {
+			io.Copy(os.Stdout, &logs)
+		}
+		if outcome == outcomePass {
+			ft.everPassed = true
+		}
+	}
+}
+
+// detectRepo returns the GitHub "owner/repo" we're running in, used in the
+// fake issue URL recorded for unmarked flaky tests.
+//
+// It checks GITHUB_REPOSITORY (set by GitHub Actions), then `git config --get
+// remote.origin.url`, then falls back to "tailscale/tailscale".
+func detectRepo() string {
+	if r := os.Getenv("GITHUB_REPOSITORY"); r != "" {
+		return r
+	}
+	out, err := exec.Command("git", "config", "--get", "remote.origin.url").Output()
+	if err == nil {
+		if r := parseGitRemote(strings.TrimSpace(string(out))); r != "" {
+			return r
+		}
+	}
+	return "tailscale/tailscale"
+}
+
+// parseGitRemote pulls "owner/repo" out of common git remote URL forms:
+//   - git@github.com:owner/repo.git
+//   - https://github.com/owner/repo.git
+//   - https://github.com/owner/repo
+func parseGitRemote(url string) string {
+	url = strings.TrimSuffix(url, ".git")
+	// SSH form
+	if rest, ok := strings.CutPrefix(url, "git@github.com:"); ok {
+		return rest
+	}
+	// HTTPS form
+	for _, p := range []string{"https://github.com/", "http://github.com/"} {
+		if rest, ok := strings.CutPrefix(url, p); ok {
+			return rest
+		}
+	}
+	return ""
+}
+
+// fakeIssueURL returns the fake GitHub issue URL we record for unmarked tests
+// that turn out to be flaky.
+func fakeIssueURL(repo string) string {
+	return "https://github.com/" + repo + flakeUnknownIssueSlug
+}
+
+// writeFlakeSummary appends a markdown summary of flaky tests to path,
+// creating it if needed. In practice path is the GitHub Actions runner's
+// $GITHUB_STEP_SUMMARY, which testwrapper auto-detects. It logs and
+// continues on errors, as a CI write failure should not poison the test
+// run's exit status.
+func writeFlakeSummary(path string, flaky []*failedTest, repo string) {
+	f, err := os.OpenFile(path, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0o644)
+	if err != nil {
+		log.Printf("testwrapper: opening summary file %s: %v", path, err)
+		return
+	}
+	defer f.Close()
+	if len(flaky) == 0 {
+		fmt.Fprintln(f, "_No flaky tests detected._")
+		return
+	}
+	fmt.Fprintln(f, "### Flaky tests detected")
+	fmt.Fprintln(f)
+	fmt.Fprintln(f, "Tests that failed at least once and then passed on retry. Rows tagged 🆕 were not annotated with flakytest.Mark; testwrapper auto-detected the flake.")
+	fmt.Fprintln(f)
+	fmt.Fprintln(f, "| Package | Test | Retries | Retry time | Issue |")
+	fmt.Fprintln(f, "|---------|------|--------:|-----------:|-------|")
+	for _, ft := range flaky {
+		url := ft.issueURL
+		if url == "" {
+			url = fakeIssueURL(repo)
+		}
+		var tag string
+		if ft.issueURL == "" {
+			tag = " 🆕"
+		}
+		fmt.Fprintf(f, "| `%s` | `%s`%s | %d | %.1fs | [link](%s) |\n",
+			ft.pkg, ft.testName, tag, ft.attempts, ft.totalRetryElapsed.Seconds(), url)
+	}
+}
+
+// buildPackageTests groups failedTests by package into the wire format
+// flakeapp expects.
+//
+// If fakeRepo is non-empty, tests with no real issue URL (i.e. not marked via
+// flakytest.Mark) get a fake URL of the form
+// https://github.com/{fakeRepo}/issues/UNKNOWN. If fakeRepo is empty, those
+// tests are simply omitted from the IssueURLs map.
+func buildPackageTests(fts []*failedTest, fakeRepo string) []packageTests {
+	byPkg := map[string][]*failedTest{}
+	for _, ft := range fts {
+		byPkg[ft.pkg] = append(byPkg[ft.pkg], ft)
+	}
+	pkgs := make([]string, 0, len(byPkg))
+	for p := range byPkg {
+		pkgs = append(pkgs, p)
+	}
+	sort.Strings(pkgs)
+	out := make([]packageTests, 0, len(pkgs))
+	for _, p := range pkgs {
+		group := byPkg[p]
+		slices.SortFunc(group, func(a, b *failedTest) int { return strings.Compare(a.testName, b.testName) })
+		pt := packageTests{Pattern: p, IssueURLs: map[string]string{}}
+		for _, ft := range group {
+			pt.Tests = append(pt.Tests, ft.testName)
+			url := ft.issueURL
+			if url == "" && fakeRepo != "" {
+				url = fakeIssueURL(fakeRepo)
+			}
+			if url != "" {
+				pt.IssueURLs[ft.testName] = url
+			}
+		}
+		out = append(out, pt)
+	}
+	return out
+}
+
 func main() {
 	goTestArgs, packages, testArgs, err := splitArgs(os.Args[1:])
 	if err != nil {
@@ -234,156 +757,136 @@ func main() {
 	}
 
 	ctx := context.Background()
-	type nextRun struct {
-		tests   []*packageTests
-		attempt int // starting at 1
-	}
-	firstRun := &nextRun{
-		attempt: 1,
-	}
-	for _, pkg := range packages {
-		firstRun.tests = append(firstRun.tests, &packageTests{Pattern: pkg})
-	}
-	toRun := []*nextRun{firstRun}
-	printPkgOutcome := func(pkg, outcome string, cached bool, attempt int, testDur time.Duration) {
+	repo := detectRepo()
+
+	printPkgOutcome := func(pkg string, outcome testOutcome, cached bool, testDur time.Duration) {
 		if pkg == "" {
 			return // We reach this path on a build error.
 		}
-		if outcome == "skip" {
+		if outcome == outcomeSkip {
 			fmt.Printf("?\t%s [skipped/no tests] \n", pkg)
 			return
 		}
-		if outcome == "pass" {
-			outcome = "ok"
+		label := string(outcome)
+		if outcome == outcomePass {
+			label = "ok"
 		}
-		if outcome == "fail" {
-			outcome = "FAIL"
-		}
-		if attempt > 1 {
-			fmt.Printf("%s\t%s\t%.3fs\t[attempt=%d]\n", outcome, pkg, testDur.Seconds(), attempt)
-			return
+		if outcome == outcomeFail {
+			label = "FAIL"
 		}
 		var lastCol string
 		if cached {
 			lastCol = "(cached)"
 		} else {
-			lastCol = fmt.Sprintf("%.3f", testDur.Seconds())
+			lastCol = fmt.Sprintf("%.3fs", testDur.Seconds())
 		}
-		fmt.Printf("%s\t%s\t%v\n", outcome, pkg, lastCol)
+		fmt.Printf("%s\t%s\t%v\n", label, pkg, lastCol)
 	}
 
-	for len(toRun) > 0 {
-		var thisRun *nextRun
-		thisRun, toRun = toRun[0], toRun[1:]
+	// First pass: run every package once, collect failed tests for retry.
+	var failed []*failedTest
+	var pkgFatal bool // a package produced a non-test fatal (build error, etc.)
+	for _, pkgPattern := range packages {
+		pt := &packageTests{Pattern: pkgPattern}
+		ch := make(chan *testAttempt)
+		runErrCh := make(chan error, 1)
+		go func() {
+			defer close(runErrCh)
+			runErrCh <- runTests(ctx, 1, pt, goTestArgs, testArgs, ch)
+		}()
 
-		if thisRun.attempt > maxAttempts {
-			fmt.Println("max attempts reached")
-			os.Exit(1)
-		}
-		if thisRun.attempt > 1 {
-			j, _ := json.Marshal(thisRun.tests)
-			fmt.Printf("\n\nAttempt #%d: Retrying flaky tests:\n\nflakytest failures JSON: %s\n\n", thisRun.attempt, j)
-		}
-
-		fatalFailures := make(map[string]struct{}) // pkg.Test key
-		toRetry := make(map[string][]*testAttempt) // pkg -> tests to retry
-		for _, pt := range thisRun.tests {
-			ch := make(chan *testAttempt)
-			runErr := make(chan error, 1)
-			go func() {
-				defer close(runErr)
-				runErr <- runTests(ctx, thisRun.attempt, pt, goTestArgs, testArgs, ch)
-			}()
-
-			var failed bool
-			for tr := range ch {
-				// Go assigns the package name "command-line-arguments" when you
-				// `go test FILE` rather than `go test PKG`. It's more
-				// convenient for us to to specify files in tests, so fix tr.pkg
-				// so that subsequent testwrapper attempts run correctly.
-				if tr.pkg == "command-line-arguments" {
-					tr.pkg = packages[0]
+		// Collect failed tests in this package on the side; we use the count
+		// when a package reports a fail to decide if the failure is explained
+		// by retryable test failures or is a separate package-level fatal.
+		var pkgFailedTests []*failedTest
+		for tr := range ch {
+			// Go assigns the package name "command-line-arguments" when you
+			// `go test FILE` rather than `go test PKG`. It's more
+			// convenient for us to specify files in tests, so fix tr.pkg
+			// so that subsequent testwrapper attempts run correctly.
+			if tr.pkg == "command-line-arguments" {
+				tr.pkg = packages[0]
+			}
+			if tr.pkgFinished {
+				if tr.raceDetected {
+					// A data race is never something we want to paper
+					// over by retrying flaky tests in the package: the
+					// race indicates a real bug that may not even be
+					// in the failing test, and a retry could hide it.
+					// Drop any retry plans for this pkg and fail fast.
+					pkgFailedTests = nil
+					pkgFatal = true
 				}
-				if tr.pkgFinished {
-					if tr.outcome == "fail" && len(toRetry[tr.pkg]) == 0 {
-						// If a package fails and we don't have any tests to
-						// retry, then we should fail. This typically happens
-						// when a package times out.
-						failed = true
-					}
-					if testingVerbose || tr.outcome == "fail" {
-						// Output package-level output which is where e.g.
-						// panics outside tests will be printed
-						io.Copy(os.Stdout, &tr.logs)
-					}
-					printPkgOutcome(tr.pkg, tr.outcome, tr.cached, thisRun.attempt, tr.end.Sub(tr.start))
-					continue
-				}
-				if testingVerbose || tr.outcome == "fail" {
+				if testingVerbose || tr.outcome == outcomeFail {
 					io.Copy(os.Stdout, &tr.logs)
 				}
-				if tr.outcome != "fail" {
-					continue
-				}
-				if tr.isMarkedFlaky {
-					toRetry[tr.pkg] = append(toRetry[tr.pkg], tr)
-				} else {
-					fatalFailures[tr.pkg+"."+tr.testName] = struct{}{}
-					failed = true
+				if tr.outcome == outcomeFail && len(pkgFailedTests) == 0 {
+					// Package failed but no test failed (e.g. the package
+					// timed out, or a build error). Not retryable per-test.
+					pkgFatal = true
 				}
+				printPkgOutcome(tr.pkg, tr.outcome, tr.cached, tr.end.Sub(tr.start))
+				continue
 			}
-			if failed {
-				fmt.Println("\n\nNot retrying flaky tests because non-flaky tests failed.")
-
-				// Print the list of non-flakytest failures.
-				// We will later analyze the retried GitHub Action runs to see
-				// if non-flakytest failures succeeded upon retry. This will
-				// highlight tests which are flaky but not yet flagged as such.
-				if len(fatalFailures) > 0 {
-					tests := slicesx.MapKeys(fatalFailures)
-					sort.Strings(tests)
-					j, _ := json.Marshal(tests)
-					fmt.Printf("non-flakytest failures: %s\n", j)
-				}
-				fmt.Println()
-				os.Exit(1)
+			if testingVerbose || tr.outcome == outcomeFail {
+				io.Copy(os.Stdout, &tr.logs)
 			}
-
-			// If there's nothing to retry and no non-retryable tests have
-			// failed then we've probably hit a build error.
-			if err := <-runErr; len(toRetry) == 0 && err != nil {
-				if exit, ok := errors.AsType[*exec.ExitError](err); ok {
-					if code := exit.ExitCode(); code > -1 {
-						os.Exit(exit.ExitCode())
-					}
-				}
-				log.Printf("testwrapper: %s", err)
-				os.Exit(1)
+			if tr.outcome != outcomeFail {
+				continue
 			}
-		}
-		if len(toRetry) == 0 {
-			continue
-		}
-		pkgs := slicesx.MapKeys(toRetry)
-		sort.Strings(pkgs)
-		nextRun := &nextRun{
-			attempt: thisRun.attempt + 1,
-		}
-		for _, pkg := range pkgs {
-			tests := toRetry[pkg]
-			slices.SortFunc(tests, func(a, b *testAttempt) int { return strings.Compare(a.testName, b.testName) })
-			issueURLs := map[string]string{} // test name => URL
-			var testNames []string
-			for _, ta := range tests {
-				issueURLs[ta.testName] = ta.issueURL
-				testNames = append(testNames, ta.testName)
-			}
-			nextRun.tests = append(nextRun.tests, &packageTests{
-				Pattern:   pkg,
-				Tests:     testNames,
-				IssueURLs: issueURLs,
+			pkgFailedTests = append(pkgFailedTests, &failedTest{
+				pkg:               tr.pkg,
+				testName:          tr.testName,
+				firstFailDuration: tr.end.Sub(tr.start),
+				issueURL:          tr.issueURL, // real if Mark()'d, else "".
 			})
 		}
-		toRun = append(toRun, nextRun)
+		failed = append(failed, pkgFailedTests...)
+		if err := <-runErrCh; err != nil {
+			if exit, ok := errors.AsType[*exec.ExitError](err); ok {
+				if code := exit.ExitCode(); code > -1 && len(pkgFailedTests) == 0 {
+					// Pure exec failure with no test-level failures to retry:
+					// honor the original exit code.
+					os.Exit(code)
+				}
+			} else {
+				log.Printf("testwrapper: %s", err)
+				pkgFatal = true
+			}
+		}
+	}
+
+	// Second pass: retry each failed test serially with its per-test budget.
+	if len(failed) > 0 {
+		deadline := time.Now().Add(maxRetryTime)
+		fmt.Printf("\n\nRetrying %d failed test(s) to detect flakiness...\n\n", len(failed))
+		for _, ft := range failed {
+			retryFailedTest(ctx, ft, goTestArgs, testArgs, deadline)
+		}
+	}
+
+	// Summarize and exit.
+	var flaky, permanent []*failedTest
+	for _, ft := range failed {
+		if ft.everPassed {
+			flaky = append(flaky, ft)
+		} else {
+			permanent = append(permanent, ft)
+		}
+	}
+	if len(flaky) > 0 {
+		j, _ := json.Marshal(buildPackageTests(flaky, repo))
+		fmt.Printf("\nflakytest failures JSON: %s\n", j)
+	}
+	if path := os.Getenv("GITHUB_STEP_SUMMARY"); path != "" {
+		writeFlakeSummary(path, flaky, repo)
+	}
+	if len(permanent) > 0 {
+		j, _ := json.Marshal(buildPackageTests(permanent, ""))
+		fmt.Printf("\npermanent test failures JSON: %s\n", j)
+	}
+
+	if pkgFatal || len(permanent) > 0 {
+		os.Exit(1)
 	}
 }
diff --git a/cmd/testwrapper/testwrapper_test.go b/cmd/testwrapper/testwrapper_test.go
index 46400fd1c..7dbc4e57b 100644
--- a/cmd/testwrapper/testwrapper_test.go
+++ b/cmd/testwrapper/testwrapper_test.go
@@ -10,7 +10,6 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
-	"regexp"
 	"runtime"
 	"strings"
 	"sync"
@@ -30,7 +29,15 @@ func cmdTestwrapper(t *testing.T, args ...string) *exec.Cmd {
 	if buildErr != nil {
 		t.Fatalf("building testwrapper: %s", buildErr)
 	}
-	return exec.Command(buildPath, args...)
+	cmd := exec.Command(buildPath, args...)
+	// Tests of testwrapper run with a small per-test budget so they don't
+	// take 10 minutes when checking permanent-failure behavior.
+	cmd.Env = append(os.Environ(),
+		"TS_TESTWRAPPER_BUDGET=2s",
+		"TS_TESTWRAPPER_MIN_RETRIES=2",
+		"GITHUB_REPOSITORY=tailscale/tailscale",
+	)
+	return cmd
 }
 
 func buildTestWrapper() (string, error) {
@@ -45,6 +52,9 @@ func buildTestWrapper() (string, error) {
 	return filepath.Join(dir, "testwrapper"), nil
 }
 
+// TestRetry covers a Mark()'d test that fails on the first attempt and passes
+// on retry: the wrapper must exit 0, emit a flakytest failures JSON line with
+// the real issue URL, and have run TestFlakeRun twice.
 func TestRetry(t *testing.T) {
 	t.Parallel()
 
@@ -60,7 +70,7 @@ import (
 func TestOK(t *testing.T) {}
 
 func TestFlakeRun(t *testing.T) {
-	flakytest.Mark(t, "https://github.com/tailscale/tailscale/issues/0") // random issue
+	flakytest.Mark(t, "https://github.com/tailscale/tailscale/issues/1234")
 	e := os.Getenv(flakytest.FlakeAttemptEnv)
 	if e == "" {
 		t.Skip("not running in testwrapper")
@@ -79,19 +89,20 @@ func TestFlakeRun(t *testing.T) {
 		t.Fatalf("go run . %s: %s with output:\n%s", testfile, err, out)
 	}
 
-	// Replace the unpredictable timestamp with "0.00s".
-	out = regexp.MustCompile(`\t\d+\.\d\d\ds\t`).ReplaceAll(out, []byte("\t0.00s\t"))
-
-	want := []byte("ok\t" + testfile + "\t0.00s\t[attempt=2]")
-	if !bytes.Contains(out, want) {
-		t.Fatalf("wanted output containing %q but got:\n%s", want, out)
+	if !bytes.Contains(out, []byte("flakytest failures JSON:")) {
+		t.Errorf("missing flakytest failures JSON line in output:\n%s", out)
+	}
+	if !bytes.Contains(out, []byte("https://github.com/tailscale/tailscale/issues/1234")) {
+		t.Errorf("missing real issue URL in output:\n%s", out)
+	}
+	if bytes.Contains(out, []byte("permanent test failures JSON:")) {
+		t.Errorf("unexpected permanent failures line in output:\n%s", out)
 	}
-
 	if okRuns := bytes.Count(out, []byte("=== RUN   TestOK")); okRuns != 1 {
-		t.Fatalf("expected TestOK to be run once but was run %d times in output:\n%s", okRuns, out)
+		t.Errorf("expected TestOK to be run once but was run %d times in output:\n%s", okRuns, out)
 	}
 	if flakeRuns := bytes.Count(out, []byte("=== RUN   TestFlakeRun")); flakeRuns != 2 {
-		t.Fatalf("expected TestFlakeRun to be run twice but was run %d times in output:\n%s", flakeRuns, out)
+		t.Errorf("expected TestFlakeRun to be run twice but was run %d times in output:\n%s", flakeRuns, out)
 	}
 
 	if testing.Verbose() {
@@ -99,45 +110,209 @@ func TestFlakeRun(t *testing.T) {
 	}
 }
 
-func TestNoRetry(t *testing.T) {
+// TestAutoRetry covers a non-Mark()'d test that fails on the first attempt and
+// passes on retry: the wrapper must exit 0, emit a flakytest failures JSON
+// line with a fake /issues/UNKNOWN URL, and have run the test twice.
+func TestAutoRetry(t *testing.T) {
 	t.Parallel()
 
-	testfile := filepath.Join(t.TempDir(), "noretry_test.go")
-	code := []byte(`package noretry_test
+	testfile := filepath.Join(t.TempDir(), "autoretry_test.go")
+	// Note: no flakytest.Mark call. The wrapper should retry anyway.
+	code := []byte(`package autoretry_test
 
 import (
+	"os"
 	"testing"
-	"tailscale.com/cmd/testwrapper/flakytest"
 )
 
-func TestFlakeRun(t *testing.T) {
-	flakytest.Mark(t, "https://github.com/tailscale/tailscale/issues/0") // random issue
-	t.Error("shouldn't be retried")
-}
-
-func TestAlwaysError(t *testing.T) {
-	t.Error("error")
+func TestAutoFlake(t *testing.T) {
+	e := os.Getenv("TS_TESTWRAPPER_ATTEMPT")
+	if e == "" {
+		t.Skip("not running in testwrapper")
+	}
+	if e == "1" {
+		t.Fatal("First run in testwrapper, failing so that test is retried. This is expected.")
+	}
 }
 `)
 	if err := os.WriteFile(testfile, code, 0o644); err != nil {
 		t.Fatalf("writing package: %s", err)
 	}
 
-	out, err := cmdTestwrapper(t, "-v", testfile).Output()
+	out, err := cmdTestwrapper(t, "-v", testfile).CombinedOutput()
+	if err != nil {
+		t.Fatalf("testwrapper %s: %s with output:\n%s", testfile, err, out)
+	}
+
+	if !bytes.Contains(out, []byte("flakytest failures JSON:")) {
+		t.Errorf("missing flakytest failures JSON line in output:\n%s", out)
+	}
+	if !bytes.Contains(out, []byte("/issues/UNKNOWN")) {
+		t.Errorf("missing fake /issues/UNKNOWN URL in output:\n%s", out)
+	}
+	if !bytes.Contains(out, []byte("https://github.com/tailscale/tailscale/issues/UNKNOWN")) {
+		t.Errorf("missing fake URL with detected repo in output:\n%s", out)
+	}
+	if bytes.Contains(out, []byte("permanent test failures JSON:")) {
+		t.Errorf("unexpected permanent failures line in output:\n%s", out)
+	}
+	if runs := bytes.Count(out, []byte("=== RUN   TestAutoFlake")); runs != 2 {
+		t.Errorf("expected TestAutoFlake to run twice but ran %d times in output:\n%s", runs, out)
+	}
+
+	if testing.Verbose() {
+		t.Logf("success - output:\n%s", out)
+	}
+}
+
+// TestPermanentFailure covers a test that always fails: the wrapper must exit
+// non-zero, emit a permanent test failures JSON line, and NOT emit a flakytest
+// failures JSON line. The test should be retried at least minRetries times.
+func TestPermanentFailure(t *testing.T) {
+	t.Parallel()
+
+	testfile := filepath.Join(t.TempDir(), "permfail_test.go")
+	code := []byte(`package permfail_test
+
+import "testing"
+
+func TestAlwaysFail(t *testing.T) {
+	t.Fatal("always fails")
+}
+`)
+	if err := os.WriteFile(testfile, code, 0o644); err != nil {
+		t.Fatalf("writing package: %s", err)
+	}
+
+	out, err := cmdTestwrapper(t, "-v", testfile).CombinedOutput()
 	if err == nil {
-		t.Fatalf("go run . %s: expected error but it succeeded with output:\n%s", testfile, out)
+		t.Fatalf("testwrapper %s: expected error but it succeeded with output:\n%s", testfile, out)
 	}
 	if code, ok := errExitCode(err); ok && code != 1 {
-		t.Fatalf("expected exit code 1 but got %d", code)
+		t.Errorf("expected exit code 1 but got %d; output:\n%s", code, out)
 	}
 
-	want := []byte("Not retrying flaky tests because non-flaky tests failed.")
-	if !bytes.Contains(out, want) {
-		t.Fatalf("wanted output containing %q but got:\n%s", want, out)
+	if bytes.Contains(out, []byte("flakytest failures JSON:")) {
+		t.Errorf("unexpected flakytest failures JSON line in output (test never passed):\n%s", out)
+	}
+	if !bytes.Contains(out, []byte("permanent test failures JSON:")) {
+		t.Errorf("missing permanent test failures JSON line in output:\n%s", out)
+	}
+	// First pass + at least minRetries retries = 3 runs.
+	if runs := bytes.Count(out, []byte("=== RUN   TestAlwaysFail")); runs < 3 {
+		t.Errorf("expected TestAlwaysFail to run >= 3 times (1 first + 2 retries) but ran %d times in output:\n%s", runs, out)
 	}
 
-	if flakeRuns := bytes.Count(out, []byte("=== RUN   TestFlakeRun")); flakeRuns != 1 {
-		t.Fatalf("expected TestFlakeRun to be run once but was run %d times in output:\n%s", flakeRuns, out)
+	if testing.Verbose() {
+		t.Logf("success - output:\n%s", out)
+	}
+}
+
+// TestRaceSuppressesFlakyRetry verifies that detecting a data race
+// in a package's output stops testwrapper from retrying any flaky
+// test in that package. Races are too serious to paper over: the
+// flaky test might not even be the one whose code is racy, and a
+// retry without the racy goroutine could silently hide the bug.
+func TestRaceSuppressesFlakyRetry(t *testing.T) {
+	if runtime.GOOS != "linux" || runtime.GOARCH != "amd64" {
+		t.Skip("test requires the race detector, which needs linux/amd64")
+	}
+	t.Parallel()
+
+	testfile := filepath.Join(t.TempDir(), "raceretry_test.go")
+	code := []byte(`package raceretry_test
+
+import (
+	"sync"
+	"testing"
+	"tailscale.com/cmd/testwrapper/flakytest"
+)
+
+var counter int
+
+func TestRace(t *testing.T) {
+	var wg sync.WaitGroup
+	wg.Add(2)
+	go func() { defer wg.Done(); counter++ }()
+	go func() { defer wg.Done(); counter++ }()
+	wg.Wait()
+}
+
+func TestFlaky(t *testing.T) {
+	flakytest.Mark(t, "https://github.com/tailscale/tailscale/issues/0")
+	t.Fatal("flaky test failing; would normally be retried")
+}
+`)
+	if err := os.WriteFile(testfile, code, 0o644); err != nil {
+		t.Fatalf("writing package: %s", err)
+	}
+
+	out, err := cmdTestwrapper(t, testfile, "-race").CombinedOutput()
+	if code, ok := errExitCode(err); !ok || code != 1 {
+		t.Fatalf("testwrapper %s -race: expected exit code 1, got %v; output was:\n%s", testfile, err, out)
+	}
+	if want := "WARNING: DATA RACE"; !bytes.Contains(out, []byte(want)) {
+		t.Fatalf("expected race report in output, got:\n%s", out)
+	}
+	if bytes.Contains(out, []byte("Retrying")) {
+		t.Fatalf("expected no retry phase in output, but found one:\n%s", out)
+	}
+	if got := bytes.Count(out, []byte("[retry ")); got != 0 {
+		t.Fatalf("expected no retry attempts to be made, but %d were:\n%s", got, out)
+	}
+	if got := bytes.Count(out, []byte("=== RUN   TestFlaky")); got != 1 {
+		t.Fatalf("expected TestFlaky to be run exactly once, ran %d times:\n%s", got, out)
+	}
+
+	if testing.Verbose() {
+		t.Logf("success - output:\n%s", out)
+	}
+}
+
+// TestRaceAttributedToPassingTest covers the case where go test
+// attributes a data race report to a test that itself reports PASS
+// (e.g. when the racing goroutines outlive the test that spawned
+// them and TSan prints during a different test's window). Without
+// the race-detection fix, the WARNING: DATA RACE block would be
+// stuck in a passing test's log buffer and dropped on the floor.
+// See https://github.com/tailscale/tailscale/issues/19603.
+func TestRaceAttributedToPassingTest(t *testing.T) {
+	if runtime.GOOS != "linux" || runtime.GOARCH != "amd64" {
+		t.Skip("test requires the race detector, which needs linux/amd64")
+	}
+	t.Parallel()
+
+	testfile := filepath.Join(t.TempDir(), "race_test.go")
+	code := []byte(`package race_test
+
+import (
+	"sync"
+	"testing"
+)
+
+var counter int
+var wg sync.WaitGroup
+
+func TestSpawn(t *testing.T) {
+	wg.Add(2)
+	go func() { defer wg.Done(); counter++ }()
+	go func() { defer wg.Done(); counter++ }()
+}
+
+func TestWait(t *testing.T) {
+	wg.Wait()
+}
+`)
+	if err := os.WriteFile(testfile, code, 0o644); err != nil {
+		t.Fatalf("writing package: %s", err)
+	}
+
+	out, err := cmdTestwrapper(t, testfile, "-race").CombinedOutput()
+	if code, ok := errExitCode(err); !ok || code != 1 {
+		t.Fatalf("testwrapper %s -race: expected exit code 1, got %v; output was:\n%s", testfile, err, out)
+	}
+	if want := "WARNING: DATA RACE"; !bytes.Contains(out, []byte(want)) {
+		t.Fatalf("expected race report in output, got:\n%s", out)
 	}
 
 	if testing.Verbose() {
@@ -204,10 +379,10 @@ func TestTimeout(t *testing.T) {
 
 	out, err := cmdTestwrapper(t, testfile, "-timeout=20ms").CombinedOutput()
 	if code, ok := errExitCode(err); !ok || code != 1 {
-		t.Fatalf("testwrapper %s: expected error with exit code 0 but got: %v; output was:\n%s", testfile, err, out)
+		t.Fatalf("testwrapper %s: expected error with exit code 1 but got: %v; output was:\n%s", testfile, err, out)
 	}
 	if want := "panic: test timed out after 20ms"; !bytes.Contains(out, []byte(want)) {
-		t.Fatalf("testwrapper %s: expected build error containing %q but got:\n%s", testfile, buildErr, out)
+		t.Fatalf("testwrapper %s: expected timeout panic containing %q but got:\n%s", testfile, want, out)
 	}
 
 	if testing.Verbose() {
@@ -275,6 +450,55 @@ func TestCached(t *testing.T) {}
 	}
 }
 
+// TestMaxRetryTime verifies the suite-wide retry deadline
+// (TS_TESTWRAPPER_MAX_RETRY_TIME) is a hard backstop: when the remaining time
+// is smaller than a single attempt's timeout, testwrapper skips the retry
+// entirely — even below minRetries — and reports the test as a permanent
+// failure. Because computePerAttemptTimeout floors each attempt at 30s, any
+// deadline under 30s deterministically cuts off the first retry with no timing
+// race.
+func TestMaxRetryTime(t *testing.T) {
+	t.Parallel()
+
+	testfile := filepath.Join(t.TempDir(), "maxretrytime_test.go")
+	code := []byte(`package maxretrytime_test
+
+import "testing"
+
+func TestAlwaysFail(t *testing.T) {
+	t.Fatal("always fails")
+}
+`)
+	if err := os.WriteFile(testfile, code, 0o644); err != nil {
+		t.Fatalf("writing package: %s", err)
+	}
+
+	cmd := cmdTestwrapper(t, "-v", testfile)
+	cmd.Env = append(cmd.Env, "TS_TESTWRAPPER_MAX_RETRY_TIME=1ms")
+	out, err := cmd.CombinedOutput()
+	if code, ok := errExitCode(err); !ok || code != 1 {
+		t.Fatalf("testwrapper %s: expected exit code 1, got %v; output:\n%s", testfile, err, out)
+	}
+	if !bytes.Contains(out, []byte("permanent test failures JSON:")) {
+		t.Errorf("missing permanent test failures JSON line in output:\n%s", out)
+	}
+	if !bytes.Contains(out, []byte("would exceed the remaining max retry time")) {
+		t.Errorf("missing retry-deadline skip message in output:\n%s", out)
+	}
+	// The deadline overrides minRetries, so no retry attempt should run: the
+	// test executes exactly once (the first pass).
+	if got := bytes.Count(out, []byte("[retry ")); got != 0 {
+		t.Errorf("expected no retry attempts, but %d were made; output:\n%s", got, out)
+	}
+	if runs := bytes.Count(out, []byte("=== RUN   TestAlwaysFail")); runs != 1 {
+		t.Errorf("expected TestAlwaysFail to run exactly once, ran %d times; output:\n%s", runs, out)
+	}
+
+	if testing.Verbose() {
+		t.Logf("success - output:\n%s", out)
+	}
+}
+
 func errExitCode(err error) (int, bool) {
 	if exit, ok := errors.AsType[*exec.ExitError](err); ok {
 		return exit.ExitCode(), true
diff --git a/cmd/tl-longchain/tl-longchain.go b/cmd/tl-longchain/tl-longchain.go
index 33d0df301..78822b779 100644
--- a/cmd/tl-longchain/tl-longchain.go
+++ b/cmd/tl-longchain/tl-longchain.go
@@ -45,7 +45,7 @@ func main() {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
-	st, err := lc.NetworkLockStatus(ctx)
+	st, err := lc.TailnetLockStatus(ctx)
 	if err != nil {
 		log.Fatalf("could not get Tailnet Lock status: %v", err)
 	}
diff --git a/cmd/tsconnect/build-pkg.go b/cmd/tsconnect/build-pkg.go
index 53aacc02e..4beb449d9 100644
--- a/cmd/tsconnect/build-pkg.go
+++ b/cmd/tsconnect/build-pkg.go
@@ -13,7 +13,7 @@ import (
 	"path"
 
 	"github.com/tailscale/hujson"
-	"tailscale.com/util/precompress"
+	"tailscale.com/cmd/tsconnect/wasmbuild"
 	"tailscale.com/version"
 )
 
@@ -39,8 +39,8 @@ func runBuildPkg() {
 
 	runEsbuild(*buildOptions)
 
-	if err := precompressWasm(); err != nil {
-		log.Fatalf("Could not pre-recompress wasm: %v", err)
+	if err := writeBuildInfo(); err != nil {
+		log.Fatalf("Could not write %s: %v", wasmbuild.BuildInfoFile, err)
 	}
 
 	log.Printf("Generating types...\n")
@@ -59,13 +59,6 @@ func runBuildPkg() {
 	log.Printf("Built package version %s", version.Long())
 }
 
-func precompressWasm() error {
-	log.Printf("Pre-compressing main.wasm...\n")
-	return precompress.Precompress(path.Join(*pkgDir, "main.wasm"), precompress.Options{
-		FastCompression: *fastCompression,
-	})
-}
-
 func updateVersion() error {
 	packageJSONBytes, err := os.ReadFile("package.json.tmpl")
 	if err != nil {
@@ -90,6 +83,21 @@ func updateVersion() error {
 	return os.WriteFile(path.Join(*pkgDir, "package.json"), packageJSONBytes, 0644)
 }
 
+// writeBuildInfo writes pkg/build-info.json so tests can detect a stale
+// pkg/main.wasm. lastRawWasmSHA256 is set by buildWasm (in common.go)
+// just before wasm-opt overwrites the file.
+func writeBuildInfo() error {
+	if lastRawWasmSHA256 == "" {
+		return fmt.Errorf("lastRawWasmSHA256 unset; buildWasm did not run in non-dev mode")
+	}
+	bi := wasmbuild.BuildInfo{RawWasmSHA256: lastRawWasmSHA256}
+	data, err := json.MarshalIndent(bi, "", "  ")
+	if err != nil {
+		return err
+	}
+	return os.WriteFile(path.Join(*pkgDir, wasmbuild.BuildInfoFile), append(data, '\n'), 0644)
+}
+
 func copyReadme() error {
 	readmeBytes, err := os.ReadFile("README.pkg.md")
 	if err != nil {
diff --git a/cmd/tsconnect/common.go b/cmd/tsconnect/common.go
index bc9e1ed4f..a6192f641 100644
--- a/cmd/tsconnect/common.go
+++ b/cmd/tsconnect/common.go
@@ -6,7 +6,10 @@
 package main
 
 import (
+	"crypto/sha256"
+	"encoding/hex"
 	"fmt"
+	"io"
 	"log"
 	"net"
 	"os"
@@ -19,8 +22,14 @@ import (
 	"time"
 
 	esbuild "github.com/evanw/esbuild/pkg/api"
+	"tailscale.com/cmd/tsconnect/wasmbuild"
 )
 
+// lastRawWasmSHA256 is set by buildWasm in non-dev mode after the
+// `go build` step but before wasm-opt runs. build-pkg reads it to
+// emit pkg/build-info.json (see [wasmbuild.BuildInfo]).
+var lastRawWasmSHA256 string
+
 const (
 	devMode  = true
 	prodMode = false
@@ -228,14 +237,14 @@ func buildWasm(dev bool) ([]byte, error) {
 	// to fail for unclosed files.
 	defer outputFile.Close()
 
-	args := []string{"build", "-tags", "tailscale_go,osusergo,netgo,nethttpomithttp2,omitidna,omitpemdecrypt"}
+	args := []string{"build", "-tags", wasmbuild.Tags()}
 	if !dev {
 		if *devControl != "" {
 			return nil, fmt.Errorf("Development control URL can only be used in dev mode.")
 		}
 		// Omit long paths and debug symbols in release builds, to reduce the
 		// generated WASM binary size.
-		args = append(args, "-trimpath", "-ldflags", "-s -w")
+		args = append(args, "-trimpath", "-ldflags", wasmbuild.ProdLDFlags)
 	} else if *devControl != "" {
 		args = append(args, "-ldflags", fmt.Sprintf("-X 'main.ControlURL=%v'", *devControl))
 	}
@@ -253,8 +262,16 @@ func buildWasm(dev bool) ([]byte, error) {
 	log.Printf("Built wasm in %v\n", time.Since(start).Round(time.Millisecond))
 
 	if !dev {
-		err := runWasmOpt(outputPath)
+		// Capture the raw (pre-wasm-opt) sha256 so build-pkg can write it to
+		// pkg/build-info.json. Tests reproduce this sha256 to detect a stale
+		// pkg/main.wasm without having to re-run wasm-opt.
+		sum, err := sha256File(outputPath)
 		if err != nil {
+			return nil, fmt.Errorf("hashing raw wasm: %w", err)
+		}
+		lastRawWasmSHA256 = sum
+
+		if err := runWasmOpt(outputPath); err != nil {
 			return nil, fmt.Errorf("Cannot run wasm-opt: %w", err)
 		}
 	}
@@ -262,6 +279,19 @@ func buildWasm(dev bool) ([]byte, error) {
 	return os.ReadFile(outputPath)
 }
 
+func sha256File(path string) (string, error) {
+	f, err := os.Open(path)
+	if err != nil {
+		return "", err
+	}
+	defer f.Close()
+	h := sha256.New()
+	if _, err := io.Copy(h, f); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(h.Sum(nil)), nil
+}
+
 func runWasmOpt(path string) error {
 	start := time.Now()
 	stat, err := os.Stat(path)
diff --git a/cmd/tsconnect/tsconfig.json b/cmd/tsconnect/tsconfig.json
index 52c25c727..c1404a107 100644
--- a/cmd/tsconnect/tsconfig.json
+++ b/cmd/tsconnect/tsconfig.json
@@ -8,7 +8,8 @@
     "forceConsistentCasingInFileNames": true,
     "sourceMap": true,
     "jsx": "react-jsx",
-    "jsxImportSource": "preact"
+    "jsxImportSource": "preact",
+    "types": ["golang-wasm-exec", "qrcode"]
   },
   "include": ["src/**/*"],
   "exclude": ["node_modules"]
diff --git a/cmd/tsconnect/wasm/drive.go b/cmd/tsconnect/wasm/drive.go
new file mode 100644
index 000000000..58a659e5c
--- /dev/null
+++ b/cmd/tsconnect/wasm/drive.go
@@ -0,0 +1,300 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !ts_omit_drive
+
+package main
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"sync"
+	"syscall/js"
+
+	"tailscale.com/drive"
+	"tailscale.com/tailcfg"
+	"tailscale.com/tsd"
+)
+
+// Compile-time check that jsFileSystemForRemote implements drive.FileSystemForRemote.
+var _ drive.FileSystemForRemote = (*jsFileSystemForRemote)(nil)
+
+// jsFileSystemForRemote implements drive.FileSystemForRemote by bridging
+// incoming WebDAV requests to a JS handler function. Auth and permission
+// parsing are handled upstream by handleServeDrive before this is called.
+type jsFileSystemForRemote struct {
+	mu sync.RWMutex
+	fn js.Value
+}
+
+func (fs *jsFileSystemForRemote) setHandler(fn js.Value) {
+	fs.mu.Lock()
+	fs.fn = fn
+	fs.mu.Unlock()
+}
+
+// SetFileServerAddr is a no-op: the JS handler owns its own storage.
+func (fs *jsFileSystemForRemote) SetFileServerAddr(_ string) {}
+
+// SetShares is a no-op: the JS handler controls which shares it exposes.
+func (fs *jsFileSystemForRemote) SetShares(_ []*drive.Share) {}
+
+// Close is a no-op.
+func (fs *jsFileSystemForRemote) Close() error { return nil }
+
+// ServeHTTPWithPerms handles a WebDAV request by bridging it to the JS handler.
+// It streams the request body to JS via readBodyChunk() and streams the
+// response body back via write()/end() callbacks, so no full-body buffering
+// occurs regardless of file size.
+//
+// The call blocks until JS calls end() (or a write error occurs).
+func (fs *jsFileSystemForRemote) ServeHTTPWithPerms(
+	perms drive.Permissions, w http.ResponseWriter, r *http.Request,
+) {
+	fs.mu.RLock()
+	fn := fs.fn
+	fs.mu.RUnlock()
+
+	if fn.IsUndefined() || fn.IsNull() {
+		http.NotFound(w, r)
+		return
+	}
+
+	// readBodyChunk is exposed to JS as req.readBodyChunk().
+	// Each call returns a Promise<Uint8Array|null>: null signals EOF.
+	readBodyChunk := js.FuncOf(func(_ js.Value, _ []js.Value) any {
+		return makePromise(func() (any, error) {
+			buf := make([]byte, 65536)
+			n, err := r.Body.Read(buf)
+			if n > 0 {
+				arr := js.Global().Get("Uint8Array").New(n)
+				js.CopyBytesToJS(arr, buf[:n])
+				return arr, nil
+			}
+			if errors.Is(err, io.EOF) {
+				return js.Null(), nil
+			}
+			return nil, err
+		})
+	})
+
+	// doneCh receives nil when JS calls end(), or a write error if Write fails.
+	doneCh := make(chan error, 1)
+
+	// writeHead sets response headers and status code. Must be called before write().
+	writeHead := js.FuncOf(func(_ js.Value, args []js.Value) any {
+		if len(args) < 1 {
+			return nil
+		}
+		status := args[0].Int()
+		if len(args) > 1 && !args[1].IsUndefined() && !args[1].IsNull() {
+			for k, vs := range jsHeadersToGo(args[1]) {
+				for _, v := range vs {
+					w.Header().Add(k, v)
+				}
+			}
+		}
+		w.WriteHeader(status)
+		return nil
+	})
+
+	// write streams a single response body chunk to the client.
+	write := js.FuncOf(func(_ js.Value, args []js.Value) any {
+		if len(args) < 1 {
+			return nil
+		}
+		data := args[0]
+		buf := make([]byte, data.Get("length").Int())
+		js.CopyBytesToGo(buf, data)
+		if _, werr := w.Write(buf); werr != nil {
+			select {
+			case doneCh <- werr:
+			default:
+			}
+			return nil
+		}
+		if f, ok := w.(http.Flusher); ok {
+			f.Flush()
+		}
+		return nil
+	})
+
+	// end signals that the response is complete.
+	end := js.FuncOf(func(_ js.Value, _ []js.Value) any {
+		select {
+		case doneCh <- nil:
+		default:
+		}
+		return nil
+	})
+
+	defer func() {
+		readBodyChunk.Release()
+		writeHead.Release()
+		write.Release()
+		end.Release()
+	}()
+
+	jsReq := map[string]any{
+		"method":        r.Method,
+		"path":          r.URL.Path,
+		"rawQuery":      r.URL.RawQuery,
+		"headers":       goHeadersToJS(r.Header),
+		"readBodyChunk": readBodyChunk,
+	}
+	jsRes := map[string]any{
+		"writeHead": writeHead,
+		"write":     write,
+		"end":       end,
+	}
+
+	fn.Invoke(jsReq, jsRes, drivePermsToJS(perms))
+
+	// Block this goroutine until JS calls end() or a write error occurs.
+	// The Go WASM scheduler yields back to JS while we wait.
+	<-doneCh
+}
+
+// drivePermsToJS converts drive.Permissions to a plain JS-friendly object.
+// Each share name maps to a numeric permission: 0=none, 1=read-only, 2=read-write.
+// The wildcard share name "*" is included if present.
+func drivePermsToJS(p drive.Permissions) map[string]any {
+	result := make(map[string]any, len(p))
+	for name, perm := range p {
+		result[name] = int(perm)
+	}
+	return result
+}
+
+// goHeadersToJS converts an http.Header to a map[string]any suitable for JS.
+// Single-value headers become a string; multi-value headers become a []any.
+func goHeadersToJS(h http.Header) map[string]any {
+	result := make(map[string]any, len(h))
+	for k, vs := range h {
+		if len(vs) == 1 {
+			result[k] = vs[0]
+		} else {
+			arr := make([]any, len(vs))
+			for i, v := range vs {
+				arr[i] = v
+			}
+			result[k] = arr
+		}
+	}
+	return result
+}
+
+// jsHeadersToGo parses a JS headers object into an http.Header map.
+// Values may be a string or an array of strings.
+func jsHeadersToGo(jsHeaders js.Value) http.Header {
+	h := make(http.Header)
+	keys := js.Global().Get("Object").Call("keys", jsHeaders)
+	for i := 0; i < keys.Length(); i++ {
+		key := keys.Index(i).String()
+		val := jsHeaders.Get(key)
+		switch val.Type() {
+		case js.TypeString:
+			h.Set(key, val.String())
+		case js.TypeObject:
+			if val.InstanceOf(js.Global().Get("Array")) {
+				for j := 0; j < val.Length(); j++ {
+					h.Add(key, val.Index(j).String())
+				}
+			}
+		}
+	}
+	return h
+}
+
+// initDriveForRemote creates the JS-backed FileSystemForRemote and registers
+// it with sys. Must be called before NewLocalBackend (SubSystem is set-once).
+func initDriveForRemote(sys *tsd.System) *jsFileSystemForRemote {
+	driveFS := &jsFileSystemForRemote{}
+	sys.Set(driveFS)
+	return driveFS
+}
+
+// wireDriveJS adds drive-related methods to the IPN JS methods map.
+// driveFS must be the value returned by initDriveForRemote.
+func wireDriveJS(i *jsIPN, driveFS *jsFileSystemForRemote, m map[string]any) {
+	m["setDriveHandler"] = js.FuncOf(func(_ js.Value, args []js.Value) any {
+		if len(args) < 1 {
+			return nil
+		}
+		driveFS.setHandler(args[0])
+		return nil
+	})
+
+	m["listDrivePeers"] = js.FuncOf(func(_ js.Value, _ []js.Value) any {
+		return i.listDrivePeers()
+	})
+}
+
+type jsDrivePeer struct {
+	Name         string `json:"name"`
+	PeerAPIURL   string `json:"peerAPIURL"`
+	StableNodeID string `json:"stableNodeID"`
+	Online       *bool  `json:"online,omitempty"`
+}
+
+// listDrivePeers returns a JSON array of peers that carry
+// PeerCapabilityTaildriveSharer. Returns an empty array if the local node
+// does not have drive:access in its ACL (DriveAccessEnabled). This mirrors
+// the filtering in LocalBackend.driveRemotesFromPeers.
+func (i *jsIPN) listDrivePeers() js.Value {
+	return makePromise(func() (any, error) {
+		if !i.lb.DriveAccessEnabled() {
+			return "[]", nil
+		}
+
+		nm := i.lb.NetMap()
+		if nm == nil {
+			return nil, errors.New("listDrivePeers: no network map available")
+		}
+
+		var selfHave4, selfHave6 bool
+		for _, a := range nm.GetAddresses().All() {
+			if !a.IsSingleIP() {
+				continue
+			}
+			if a.Addr().Is4() {
+				selfHave4 = true
+			} else if a.Addr().Is6() {
+				selfHave6 = true
+			}
+		}
+
+		peers := make([]jsDrivePeer, 0)
+		for _, p := range nm.Peers {
+			// Check PeerCapabilityTaildriveSharer via the live PeerCaps map
+			// (derived from ACL rules), mirroring driveRemotesFromPeers.
+			hasCap := false
+			for _, a := range p.Addresses().All() {
+				if a.IsSingleIP() && i.lb.PeerCaps(a.Addr()).HasCapability(tailcfg.PeerCapabilityTaildriveSharer) {
+					hasCap = true
+					break
+				}
+			}
+			if !hasCap {
+				continue
+			}
+			peerURL := buildPeerAPIURL(p, selfHave4, selfHave6)
+			online := p.Online().Clone()
+			peers = append(peers, jsDrivePeer{
+				Name:         p.DisplayName(false),
+				PeerAPIURL:   peerURL,
+				StableNodeID: string(p.StableID()),
+				Online:       online,
+			})
+		}
+
+		b, err := json.Marshal(peers)
+		if err != nil {
+			return nil, fmt.Errorf("listDrivePeers: marshal: %w", err)
+		}
+		return string(b), nil
+	})
+}
diff --git a/cmd/tsconnect/wasm/drive_stub.go b/cmd/tsconnect/wasm/drive_stub.go
new file mode 100644
index 000000000..a9f3101d7
--- /dev/null
+++ b/cmd/tsconnect/wasm/drive_stub.go
@@ -0,0 +1,27 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build ts_omit_drive
+
+package main
+
+import (
+	"syscall/js"
+
+	"tailscale.com/tsd"
+)
+
+type jsFileSystemForRemote struct{}
+
+// initDriveForRemote is a no-op when the drive feature is omitted.
+func initDriveForRemote(_ *tsd.System) *jsFileSystemForRemote { return nil }
+
+// wireDriveJS is a no-op when the drive feature is omitted.
+func wireDriveJS(_ *jsIPN, _ *jsFileSystemForRemote, _ map[string]any) {}
+
+// listDrivePeers returns an empty list when the drive feature is omitted.
+func (i *jsIPN) listDrivePeers() js.Value {
+	return makePromise(func() (any, error) {
+		return "[]", nil
+	})
+}
diff --git a/cmd/tsconnect/wasm/peer.go b/cmd/tsconnect/wasm/peer.go
new file mode 100644
index 000000000..341404bfe
--- /dev/null
+++ b/cmd/tsconnect/wasm/peer.go
@@ -0,0 +1,41 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package main
+
+import (
+	"fmt"
+	"net/netip"
+
+	"tailscale.com/tailcfg"
+)
+
+// buildPeerAPIURL returns the HTTP base URL for a peer's peerAPI server,
+// selecting IPv4 when available and falling back to IPv6. Returns an empty
+// string if the peer advertises no reachable peerAPI port.
+func buildPeerAPIURL(p tailcfg.NodeView, selfHave4, selfHave6 bool) string {
+	var pp4, pp6 uint16
+	for _, s := range p.Hostinfo().Services().All() {
+		switch s.Proto {
+		case tailcfg.PeerAPI4:
+			pp4 = s.Port
+		case tailcfg.PeerAPI6:
+			pp6 = s.Port
+		}
+	}
+	if selfHave4 && pp4 != 0 {
+		for _, a := range p.Addresses().All() {
+			if a.IsSingleIP() && a.Addr().Is4() {
+				return fmt.Sprintf("http://%v", netip.AddrPortFrom(a.Addr(), pp4))
+			}
+		}
+	}
+	if selfHave6 && pp6 != 0 {
+		for _, a := range p.Addresses().All() {
+			if a.IsSingleIP() && a.Addr().Is6() {
+				return fmt.Sprintf("http://%v", netip.AddrPortFrom(a.Addr(), pp6))
+			}
+		}
+	}
+	return ""
+}
diff --git a/cmd/tsconnect/wasm/taildrop.go b/cmd/tsconnect/wasm/taildrop.go
new file mode 100644
index 000000000..acdf1b097
--- /dev/null
+++ b/cmd/tsconnect/wasm/taildrop.go
@@ -0,0 +1,512 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// This file bridges the Taildrop FileOps interface to JS callbacks,
+// using the same channel+FuncOf pattern as the Go stdlib's WASM HTTP
+// transport (src/net/http/roundtrip_js.go): Go passes a js.FuncOf to JS,
+// then blocks on a channel until JS calls it back — which may be async.
+
+package main
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"io/fs"
+	"net/http"
+	"net/url"
+	"os"
+	"syscall/js"
+	"time"
+
+	"tailscale.com/client/tailscale/apitype"
+	"tailscale.com/feature/taildrop"
+	"tailscale.com/ipn"
+	"tailscale.com/ipn/ipnlocal"
+	"tailscale.com/tailcfg"
+	"tailscale.com/util/progresstracking"
+	"tailscale.com/util/rands"
+)
+
+// Compile-time check that jsFileOps implements taildrop.FileOps.
+var _ taildrop.FileOps = (*jsFileOps)(nil)
+
+// taildropExt returns the taildrop extension, or an error if unavailable.
+func (i *jsIPN) taildropExt() (*taildrop.Extension, error) {
+	ext, ok := ipnlocal.GetExt[*taildrop.Extension](i.lb)
+	if !ok {
+		return nil, errors.New("taildrop extension not available")
+	}
+	return ext, nil
+}
+
+// listFileTargets returns the peers that can receive Taildrop files as a JSON
+// array of {stableNodeID, name, addresses, os} objects.
+func (i *jsIPN) listFileTargets() js.Value {
+	return makePromise(func() (any, error) {
+		ext, err := i.taildropExt()
+		if err != nil {
+			return nil, err
+		}
+		fts, err := ext.FileTargets()
+		if err != nil {
+			return nil, err
+		}
+		type jsTarget struct {
+			StableNodeID string   `json:"stableNodeID"`
+			Name         string   `json:"name"`
+			Addresses    []string `json:"addresses"`
+			OS           string   `json:"os"`
+		}
+		out := make([]jsTarget, 0, len(fts))
+		for _, ft := range fts {
+			addrs := make([]string, 0, len(ft.Node.Addresses))
+			for _, a := range ft.Node.Addresses {
+				addrs = append(addrs, a.Addr().String())
+			}
+			out = append(out, jsTarget{
+				StableNodeID: string(ft.Node.StableID),
+				Name:         ft.Node.Name,
+				Addresses:    addrs,
+				OS:           ft.Node.Hostinfo.OS(),
+			})
+		}
+		b, err := json.Marshal(out)
+		if err != nil {
+			return nil, err
+		}
+		return string(b), nil
+	})
+}
+
+// sendFile sends stream as filename to the peer identified by stableNodeID,
+// reporting progress via notifyOutgoingFiles callbacks roughly once per second.
+// declaredSize is the total byte count (-1 if unknown); it is used for progress
+// reporting and sets Content-Length on the PUT request (chunked TE when -1).
+func (i *jsIPN) sendFile(stableNodeID, filename string, stream js.Value, declaredSize int) js.Value {
+	return makePromise(func() (any, error) {
+		ext, err := i.taildropExt()
+		if err != nil {
+			return nil, err
+		}
+		fts, err := ext.FileTargets()
+		if err != nil {
+			return nil, err
+		}
+		var ft *apitype.FileTarget
+		for _, x := range fts {
+			if x.Node.StableID == tailcfg.StableNodeID(stableNodeID) {
+				ft = x
+				break
+			}
+		}
+		if ft == nil {
+			return nil, fmt.Errorf("node %q not found or not a file target", stableNodeID)
+		}
+		dstURL, err := url.Parse(ft.PeerAPIURL)
+		if err != nil {
+			return nil, fmt.Errorf("bogus peer URL: %w", err)
+		}
+
+		reader := stream.Call("getReader")
+		body := &jsStreamReader{reader: reader}
+
+		outgoing := ipn.OutgoingFile{
+			ID:           rands.HexString(30),
+			PeerID:       tailcfg.StableNodeID(stableNodeID),
+			Name:         filename,
+			DeclaredSize: int64(declaredSize),
+			Started:      time.Now(),
+		}
+		reportProgress := func() {
+			ext.UpdateOutgoingFiles(map[string]ipn.OutgoingFile{outgoing.ID: outgoing})
+		}
+
+		// Report final state (success or failure) when the function returns.
+		var sendErr error
+		defer func() {
+			outgoing.Finished = true
+			outgoing.Succeeded = sendErr == nil
+			reportProgress()
+		}()
+
+		progressBody := progresstracking.NewReader(body, time.Second, func(n int, _ error) {
+			outgoing.Sent = int64(n)
+			reportProgress()
+		})
+
+		req, err := http.NewRequest("PUT", dstURL.String()+"/v0/put/"+url.PathEscape(filename), progressBody)
+		if err != nil {
+			sendErr = err
+			return nil, err
+		}
+		req.ContentLength = int64(declaredSize)
+		client := &http.Client{Transport: i.lb.Dialer().PeerAPITransport()}
+		resp, err := client.Do(req)
+		if err != nil {
+			sendErr = err
+			return nil, err
+		}
+		defer resp.Body.Close()
+		if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusCreated {
+			respBody, _ := io.ReadAll(resp.Body)
+			b := make([]byte, len(respBody))
+			copy(b, respBody)
+			// trim trailing whitespace
+			for len(b) > 0 && (b[len(b)-1] == '\n' || b[len(b)-1] == '\r' || b[len(b)-1] == ' ') {
+				b = b[:len(b)-1]
+			}
+			sendErr = fmt.Errorf("send file: %s: %s", resp.Status, b)
+			return nil, sendErr
+		}
+		return nil, nil
+	})
+}
+
+// waitingFiles returns received files waiting for pickup as a JSON array of
+// {name, size} objects. Always returns an array (never null).
+func (i *jsIPN) waitingFiles() js.Value {
+	return makePromise(func() (any, error) {
+		ext, err := i.taildropExt()
+		if err != nil {
+			return nil, err
+		}
+		wfs, err := ext.WaitingFiles()
+		if err != nil {
+			return nil, err
+		}
+		type jsWaitingFile struct {
+			Name string `json:"name"`
+			Size int64  `json:"size"`
+		}
+		out := make([]jsWaitingFile, len(wfs))
+		for i, wf := range wfs {
+			out[i] = jsWaitingFile{Name: wf.Name, Size: wf.Size}
+		}
+		b, err := json.Marshal(out)
+		if err != nil {
+			return nil, err
+		}
+		return string(b), nil
+	})
+}
+
+// openWaitingFile returns the contents of a received file as a ReadableStream.
+// The stream emits Uint8Array chunks and closes when the file is fully read.
+func (i *jsIPN) openWaitingFile(name string) js.Value {
+	return makePromise(func() (any, error) {
+		ext, err := i.taildropExt()
+		if err != nil {
+			return nil, err
+		}
+		rc, _, err := ext.OpenFile(name)
+		if err != nil {
+			return nil, err
+		}
+		return jsReadableStream(rc), nil
+	})
+}
+
+// deleteWaitingFile deletes a received file by name.
+func (i *jsIPN) deleteWaitingFile(name string) js.Value {
+	return makePromise(func() (any, error) {
+		ext, err := i.taildropExt()
+		if err != nil {
+			return nil, err
+		}
+		return nil, ext.DeleteFile(name)
+	})
+}
+
+// wireTaildropFileOps installs a JS-backed FileOps on the taildrop extension
+// if jsObj is a non-null JS object. It must be called after NewLocalBackend
+// and before lb.Start (i.e. before run() is called by the user), so that the
+// FileOps is in place when the extension's onChangeProfile hook fires on init.
+//
+// SetStagedFileOps is used instead of SetFileOps so that files are staged for
+// explicit retrieval via WaitingFiles/OpenFile rather than delivered directly
+// (DirectFileMode=false). The JS caller fetches them via waitingFiles() et al.
+func wireTaildropFileOps(lb *ipnlocal.LocalBackend, jsObj js.Value) {
+	if jsObj.IsUndefined() || jsObj.IsNull() {
+		return
+	}
+	ext, ok := ipnlocal.GetExt[*taildrop.Extension](lb)
+	if !ok {
+		return
+	}
+	ext.SetStagedFileOps(&jsFileOps{v: jsObj})
+}
+
+// jsStreamReader implements io.ReadCloser by pulling chunks from a JS
+// ReadableStreamDefaultReader. Each Read call awaits one reader.read() Promise,
+// using the channel+FuncOf pattern so Go blocks until JS delivers the chunk.
+type jsStreamReader struct {
+	reader js.Value
+	buf    []byte
+	done   bool
+}
+
+func (r *jsStreamReader) Read(p []byte) (int, error) {
+	if r.done {
+		return 0, io.EOF
+	}
+	if len(r.buf) > 0 {
+		n := copy(p, r.buf)
+		r.buf = r.buf[n:]
+		return n, nil
+	}
+	type chunkResult struct {
+		data []byte
+		done bool
+	}
+	ch := make(chan chunkResult, 1)
+	thenFn := js.FuncOf(func(this js.Value, args []js.Value) any {
+		result := args[0]
+		if result.Get("done").Bool() {
+			ch <- chunkResult{done: true}
+		} else {
+			value := result.Get("value")
+			b := make([]byte, value.Get("byteLength").Int())
+			js.CopyBytesToGo(b, value)
+			ch <- chunkResult{data: b}
+		}
+		return nil
+	})
+	defer thenFn.Release()
+	r.reader.Call("read").Call("then", thenFn)
+	result := <-ch
+	if result.done {
+		r.done = true
+		return 0, io.EOF
+	}
+	n := copy(p, result.data)
+	r.buf = result.data[n:]
+	return n, nil
+}
+
+func (r *jsStreamReader) Close() error {
+	r.reader.Call("cancel")
+	return nil
+}
+
+// jsReadableStream wraps rc in a pull-based JS ReadableStream. Each pull call
+// reads up to 64 KiB from rc and enqueues a Uint8Array chunk; the stream
+// closes on EOF or signals an error on any other read failure.
+func jsReadableStream(rc io.ReadCloser) js.Value {
+	var pullFn, cancelFn js.Func
+
+	cancelFn = js.FuncOf(func(this js.Value, args []js.Value) any {
+		rc.Close()
+		pullFn.Release()
+		cancelFn.Release()
+		return nil
+	})
+
+	pullFn = js.FuncOf(func(this js.Value, args []js.Value) any {
+		controller := args[0]
+		var execFn js.Func
+		execFn = js.FuncOf(func(this js.Value, rr []js.Value) any {
+			resolve := rr[0]
+			go func() {
+				defer execFn.Release()
+				buf := make([]byte, 65536)
+				n, err := rc.Read(buf)
+				if n > 0 {
+					chunk := js.Global().Get("Uint8Array").New(n)
+					js.CopyBytesToJS(chunk, buf[:n])
+					controller.Call("enqueue", chunk)
+				}
+				if err == io.EOF {
+					rc.Close()
+					pullFn.Release()
+					cancelFn.Release()
+					controller.Call("close")
+				} else if err != nil {
+					rc.Close()
+					pullFn.Release()
+					cancelFn.Release()
+					controller.Call("error", err.Error())
+				}
+				resolve.Invoke()
+			}()
+			return nil
+		})
+		return js.Global().Get("Promise").New(execFn)
+	})
+
+	return js.Global().Get("ReadableStream").New(map[string]any{
+		"pull":   pullFn,
+		"cancel": cancelFn,
+	})
+}
+
+// jsFileOps implements [taildrop.FileOps] by delegating to JS callbacks.
+// JS methods use one of two callback conventions:
+//
+// Void ops (openWriter, write, closeWriter, remove): cb(err?: string)
+//
+//	on success: cb()  or  cb("")
+//	on error:   cb("error message")
+//	not found:  cb("ENOENT")
+//
+// Result ops (rename, listFiles, stat, openReader): cb(result: T | null, err?: string)
+//
+//	on success: cb(result)
+//	on error:   cb(null, "error message")
+//	not found:  cb(null, "ENOENT")
+type jsFileOps struct {
+	v js.Value
+}
+
+// jsCallResult invokes method on j.v, appending a Go-owned js.FuncOf as the
+// final argument. It blocks until JS calls back with (result, errStr?), then
+// returns (result, error). An absent or empty errStr means success.
+//
+// JS convention for result ops: cb(result: T | null, err?: string)
+func (j jsFileOps) jsCallResult(method string, args ...any) (js.Value, error) {
+	type result struct {
+		val js.Value
+		err error
+	}
+	ch := make(chan result, 1)
+	cb := js.FuncOf(func(this js.Value, cbArgs []js.Value) any {
+		var r result
+		if len(cbArgs) > 0 {
+			if t := cbArgs[0].Type(); t != js.TypeNull && t != js.TypeUndefined {
+				r.val = cbArgs[0]
+			}
+		}
+		if len(cbArgs) > 1 && cbArgs[1].Type() == js.TypeString {
+			if s := cbArgs[1].String(); s != "" {
+				r.err = errors.New(s)
+			}
+		}
+		ch <- r
+		return nil
+	})
+	defer cb.Release()
+	j.v.Call(method, append(args, cb)...)
+	r := <-ch
+	return r.val, r.err
+}
+
+// jsCallVoid invokes method on j.v for operations that return no result,
+// appending a Go-owned js.FuncOf as the final argument. It blocks until JS
+// calls back with an optional error string, then returns the error or nil.
+//
+// JS convention for void ops: cb(err?: string)
+func (j jsFileOps) jsCallVoid(method string, args ...any) error {
+	ch := make(chan error, 1)
+	cb := js.FuncOf(func(this js.Value, cbArgs []js.Value) any {
+		var err error
+		if len(cbArgs) > 0 && cbArgs[0].Type() == js.TypeString {
+			if s := cbArgs[0].String(); s != "" {
+				err = errors.New(s)
+			}
+		}
+		ch <- err
+		return nil
+	})
+	defer cb.Release()
+	j.v.Call(method, append(args, cb)...)
+	return <-ch
+}
+
+// isJSNotExist reports whether err is the sentinel "ENOENT" from JS.
+func isJSNotExist(err error) bool {
+	return err != nil && err.Error() == "ENOENT"
+}
+
+func (j jsFileOps) OpenWriter(name string, offset int64, _ os.FileMode) (io.WriteCloser, string, error) {
+	if err := j.jsCallVoid("openWriter", name, offset); err != nil {
+		return nil, "", err
+	}
+	return &jsWriteCloser{ops: j, name: name}, name, nil
+}
+
+type jsWriteCloser struct {
+	ops  jsFileOps
+	name string
+}
+
+func (w *jsWriteCloser) Write(p []byte) (int, error) {
+	buf := js.Global().Get("Uint8Array").New(len(p))
+	js.CopyBytesToJS(buf, p)
+	if err := w.ops.jsCallVoid("write", w.name, buf); err != nil {
+		return 0, err
+	}
+	return len(p), nil
+}
+
+func (w *jsWriteCloser) Close() error {
+	return w.ops.jsCallVoid("closeWriter", w.name)
+}
+
+func (j jsFileOps) Remove(name string) error {
+	err := j.jsCallVoid("remove", name)
+	if isJSNotExist(err) {
+		return &fs.PathError{Op: "remove", Path: name, Err: fs.ErrNotExist}
+	}
+	return err
+}
+
+func (j jsFileOps) Rename(oldPath, newName string) (string, error) {
+	val, err := j.jsCallResult("rename", oldPath, newName)
+	if err != nil {
+		return "", err
+	}
+	return val.String(), nil
+}
+
+func (j jsFileOps) ListFiles() ([]string, error) {
+	val, err := j.jsCallResult("listFiles")
+	if err != nil {
+		return nil, err
+	}
+	n := val.Length()
+	names := make([]string, n)
+	for i := 0; i < n; i++ {
+		names[i] = val.Index(i).String()
+	}
+	return names, nil
+}
+
+func (j jsFileOps) Stat(name string) (fs.FileInfo, error) {
+	val, err := j.jsCallResult("stat", name)
+	if isJSNotExist(err) {
+		return nil, &fs.PathError{Op: "stat", Path: name, Err: fs.ErrNotExist}
+	}
+	if err != nil {
+		return nil, err
+	}
+	// Use Float to correctly handle files larger than 2 GiB (int is 32-bit on wasm).
+	return &jsFileInfo{name: name, size: int64(val.Float())}, nil
+}
+
+func (j jsFileOps) OpenReader(name string) (io.ReadCloser, error) {
+	val, err := j.jsCallResult("openReader", name)
+	if isJSNotExist(err) {
+		return nil, &fs.PathError{Op: "open", Path: name, Err: fs.ErrNotExist}
+	}
+	if err != nil {
+		return nil, err
+	}
+	// val is a ReadableStream; wrap its reader for streaming delivery to Go.
+	reader := val.Call("getReader")
+	return &jsStreamReader{reader: reader}, nil
+}
+
+// jsFileInfo is a minimal [fs.FileInfo] backed by a name and a size.
+// Only Size() is used by the taildrop manager; the other fields are stubs.
+type jsFileInfo struct {
+	name string
+	size int64
+}
+
+func (i *jsFileInfo) Name() string       { return i.name }
+func (i *jsFileInfo) Size() int64        { return i.size }
+func (i *jsFileInfo) Mode() fs.FileMode  { return 0o444 }
+func (i *jsFileInfo) ModTime() time.Time { return time.Time{} }
+func (i *jsFileInfo) IsDir() bool        { return false }
+func (i *jsFileInfo) Sys() any           { return nil }
diff --git a/cmd/tsconnect/wasm/wasm_js.go b/cmd/tsconnect/wasm/wasm_js.go
index 71e8476a0..613652d39 100644
--- a/cmd/tsconnect/wasm/wasm_js.go
+++ b/cmd/tsconnect/wasm/wasm_js.go
@@ -12,32 +12,51 @@ package main
 import (
 	"bytes"
 	"context"
+	"crypto/tls"
+	"crypto/x509"
 	"encoding/hex"
 	"encoding/json"
+	"errors"
 	"fmt"
+	"io"
 	"log"
 	"math/rand/v2"
 	"net"
 	"net/http"
+	"net/http/httptest"
 	"net/netip"
+	"strconv"
 	"strings"
+	"sync"
 	"syscall/js"
 	"time"
 
 	"golang.org/x/crypto/ssh"
+	"golang.org/x/net/dns/dnsmessage"
+	"gvisor.dev/gvisor/pkg/tcpip"
+	"gvisor.dev/gvisor/pkg/tcpip/adapters/gonet"
+	"gvisor.dev/gvisor/pkg/tcpip/network/ipv4"
+	"gvisor.dev/gvisor/pkg/tcpip/network/ipv6"
+	"gvisor.dev/gvisor/pkg/tcpip/transport/icmp"
+	"gvisor.dev/gvisor/pkg/waiter"
 	"tailscale.com/control/controlclient"
+	_ "tailscale.com/feature/condregister"
 	"tailscale.com/ipn"
 	"tailscale.com/ipn/ipnauth"
 	"tailscale.com/ipn/ipnlocal"
 	"tailscale.com/ipn/ipnserver"
+	"tailscale.com/ipn/localapi"
 	"tailscale.com/ipn/store/mem"
 	"tailscale.com/logpolicy"
 	"tailscale.com/logtail"
+	"tailscale.com/net/bakedroots"
 	"tailscale.com/net/netns"
+	"tailscale.com/net/tsaddr"
 	"tailscale.com/net/tsdial"
 	"tailscale.com/safesocket"
 	"tailscale.com/tailcfg"
 	"tailscale.com/tsd"
+	"tailscale.com/types/logid"
 	"tailscale.com/types/views"
 	"tailscale.com/wgengine"
 	"tailscale.com/wgengine/netstack"
@@ -48,19 +67,20 @@ import (
 var ControlURL = ipn.DefaultControlURL
 
 func main() {
+	shutdownCh := make(chan struct{})
 	js.Global().Set("newIPN", js.FuncOf(func(this js.Value, args []js.Value) any {
 		if len(args) != 1 {
 			log.Fatal("Usage: newIPN(config)")
 			return nil
 		}
-		return newIPN(args[0])
+		return newIPN(args[0], shutdownCh)
 	}))
-	// Keep Go runtime alive, otherwise it will be shut down before newIPN gets
-	// called.
-	<-make(chan bool)
+	// Block until shutdown() is called on the IPN, then let main return so the
+	// Go runtime (and all its goroutines) can be collected by the JS engine.
+	<-shutdownCh
 }
 
-func newIPN(jsConfig js.Value) map[string]any {
+func newIPN(jsConfig js.Value, shutdownCh chan struct{}) map[string]any {
 	netns.SetEnabled(false)
 
 	var store ipn.StateStore
@@ -131,15 +151,33 @@ func newIPN(jsConfig js.Value) map[string]any {
 		return true
 	}
 	dialer.NetstackDialTCP = func(ctx context.Context, dst netip.AddrPort) (net.Conn, error) {
-		return ns.DialContextTCP(ctx, dst)
+		// Note: don't just return ns.DialContextTCP or we'll return
+		// *gonet.TCPConn(nil) instead of a nil interface which trips up
+		// callers.
+		tcpConn, err := ns.DialContextTCP(ctx, dst)
+		if err != nil {
+			return nil, err
+		}
+		return tcpConn, nil
 	}
 	dialer.NetstackDialUDP = func(ctx context.Context, dst netip.AddrPort) (net.Conn, error) {
-		return ns.DialContextUDP(ctx, dst)
+		// Note: don't just return ns.DialContextUDP or we'll return
+		// *gonet.UDPConn(nil) instead of a nil interface which trips up
+		// callers.
+		udpConn, err := ns.DialContextUDP(ctx, dst)
+		if err != nil {
+			return nil, err
+		}
+		return udpConn, nil
 	}
 	sys.NetstackRouter.Set(true)
 	sys.Tun.Get().Start()
 
 	logid := lpc.PublicID
+
+	// initDriveForRemote must be called before NewLocalBackend (SubSystem is set-once).
+	driveFS := initDriveForRemote(sys)
+
 	srv := ipnserver.New(logf, logid, sys.Bus.Get(), sys.NetMon.Get())
 	lb, err := ipnlocal.NewLocalBackend(logf, logid, sys, controlclient.LoginEphemeral)
 	if err != nil {
@@ -148,18 +186,24 @@ func newIPN(jsConfig js.Value) map[string]any {
 	if err := ns.Start(lb); err != nil {
 		log.Fatalf("failed to start netstack: %v", err)
 	}
+	wireTaildropFileOps(lb, jsConfig.Get("fileOps"))
 	srv.SetLocalBackend(lb)
 
 	jsIPN := &jsIPN{
-		dialer:     dialer,
-		srv:        srv,
-		lb:         lb,
-		controlURL: controlURL,
-		authKey:    authKey,
-		hostname:   hostname,
+		dialer:      dialer,
+		srv:         srv,
+		lb:          lb,
+		ns:          ns,
+		controlURL:  controlURL,
+		authKey:     authKey,
+		hostname:    hostname,
+		logID:       logid,
+		funnelPorts: make(map[uint16]*funnelListenerEntry),
+		shutdownCh:  shutdownCh,
 	}
+	lb.SetTCPHandlerForFunnelFlow(jsIPN.handleFunnelTCP)
 
-	return map[string]any{
+	m := map[string]any{
 		"run": js.FuncOf(func(this js.Value, args []js.Value) any {
 			if len(args) != 1 {
 				log.Fatal(`Usage: run({
@@ -208,16 +252,186 @@ func newIPN(jsConfig js.Value) map[string]any {
 			url := args[0].String()
 			return jsIPN.fetch(url)
 		}),
+		"dial": js.FuncOf(func(this js.Value, args []js.Value) any {
+			if len(args) != 2 {
+				log.Printf("Usage: dial(network, addr)")
+				return nil
+			}
+			return jsIPN.dial(args[0].String(), args[1].String())
+		}),
+		"listen": js.FuncOf(func(this js.Value, args []js.Value) any {
+			if len(args) != 2 {
+				log.Printf("Usage: listen(network, addr)")
+				return nil
+			}
+			return jsIPN.listen(args[0].String(), args[1].String())
+		}),
+		"listenICMP": js.FuncOf(func(this js.Value, args []js.Value) any {
+			if len(args) != 1 {
+				log.Printf("Usage: listenICMP(network)")
+				return nil
+			}
+			return jsIPN.listenICMP(args[0].String())
+		}),
+		"dialTLS": js.FuncOf(func(this js.Value, args []js.Value) any {
+			if len(args) < 1 || len(args) > 2 {
+				log.Printf("Usage: dialTLS(addr, opts?)")
+				return nil
+			}
+			var opts js.Value
+			if len(args) == 2 {
+				opts = args[1]
+			}
+			return jsIPN.dialTLS(args[0].String(), opts)
+		}),
+		"setExitNode": js.FuncOf(func(this js.Value, args []js.Value) any {
+			if len(args) != 1 {
+				log.Printf("Usage: setExitNode(stableNodeID)")
+				return nil
+			}
+			return jsIPN.setExitNode(args[0].String())
+		}),
+		"setExitNodeEnabled": js.FuncOf(func(this js.Value, args []js.Value) any {
+			if len(args) != 1 {
+				log.Printf("Usage: setExitNodeEnabled(enabled)")
+				return nil
+			}
+			return jsIPN.setExitNodeEnabled(args[0].Bool())
+		}),
+		"listFileTargets": js.FuncOf(func(this js.Value, args []js.Value) any {
+			return jsIPN.listFileTargets()
+		}),
+		"sendFile": js.FuncOf(func(this js.Value, args []js.Value) any {
+			if len(args) != 4 {
+				log.Printf("Usage: sendFile(stableNodeID, filename, stream, declaredSize)")
+				return nil
+			}
+			return jsIPN.sendFile(args[0].String(), args[1].String(), args[2], args[3].Int())
+		}),
+		"waitingFiles": js.FuncOf(func(this js.Value, args []js.Value) any {
+			return jsIPN.waitingFiles()
+		}),
+		"openWaitingFile": js.FuncOf(func(this js.Value, args []js.Value) any {
+			if len(args) != 1 {
+				log.Printf("Usage: openWaitingFile(name)")
+				return nil
+			}
+			return jsIPN.openWaitingFile(args[0].String())
+		}),
+		"deleteWaitingFile": js.FuncOf(func(this js.Value, args []js.Value) any {
+			if len(args) != 1 {
+				log.Printf("Usage: deleteWaitingFile(name)")
+				return nil
+			}
+			return jsIPN.deleteWaitingFile(args[0].String())
+		}),
+		"getCert": js.FuncOf(func(this js.Value, args []js.Value) any {
+			return jsIPN.getCert()
+		}),
+		"listenTLS": js.FuncOf(func(this js.Value, args []js.Value) any {
+			if len(args) != 3 {
+				log.Printf("Usage: listenTLS(addr, certPEM, keyPEM)")
+				return nil
+			}
+			return jsIPN.listenTLS(args[0].String(), args[1].String(), args[2].String())
+		}),
+		"setFunnel": js.FuncOf(func(this js.Value, args []js.Value) any {
+			if len(args) != 3 {
+				log.Printf("Usage: setFunnel(hostname, port, enabled)")
+				return nil
+			}
+			return jsIPN.setFunnel(args[0].String(), uint16(args[1].Int()), args[2].Bool())
+		}),
+		"whoIs": js.FuncOf(func(this js.Value, args []js.Value) any {
+			if len(args) < 1 {
+				log.Printf("Usage: whoIs(addrPort[, proto])")
+				return nil
+			}
+			proto := ""
+			if len(args) >= 2 {
+				proto = args[1].String()
+			}
+			return jsIPN.whoIs(args[0].String(), proto)
+		}),
+		"queryDNS": js.FuncOf(func(this js.Value, args []js.Value) any {
+			if len(args) < 1 {
+				log.Printf("Usage: queryDNS(name[, type])")
+				return nil
+			}
+			qtype := 1 // TypeA
+			if len(args) >= 2 {
+				qtype = args[1].Int()
+			}
+			return jsIPN.queryDNS(args[0].String(), qtype)
+		}),
+		"ping": js.FuncOf(func(this js.Value, args []js.Value) any {
+			if len(args) < 1 {
+				log.Printf("Usage: ping(ip[, type[, size]])")
+				return nil
+			}
+			pingType := "TSMP"
+			if len(args) >= 2 {
+				pingType = args[1].String()
+			}
+			size := 0
+			if len(args) >= 3 {
+				size = args[2].Int()
+			}
+			return jsIPN.ping(args[0].String(), pingType, size)
+		}),
+		"suggestExitNode": js.FuncOf(func(this js.Value, args []js.Value) any {
+			return jsIPN.suggestExitNode()
+		}),
+		"shutdown": js.FuncOf(func(this js.Value, args []js.Value) any {
+			return jsIPN.shutdown()
+		}),
+		"setServices": js.FuncOf(func(this js.Value, args []js.Value) any {
+			if len(args) != 1 {
+				log.Printf("Usage: setServices(services)")
+				return nil
+			}
+			return jsIPN.setServices(args[0])
+		}),
+		"localAPI": js.FuncOf(func(this js.Value, args []js.Value) any {
+			if len(args) < 2 {
+				log.Printf("Usage: localAPI(method, path[, body])")
+				return nil
+			}
+			body := ""
+			if len(args) >= 3 {
+				body = args[2].String()
+			}
+			return jsIPN.localAPI(args[0].String(), args[1].String(), body)
+		}),
 	}
+	wireDriveJS(jsIPN, driveFS, m)
+	return m
 }
 
 type jsIPN struct {
 	dialer     *tsdial.Dialer
 	srv        *ipnserver.Server
 	lb         *ipnlocal.LocalBackend
+	ns         *netstack.Impl
 	controlURL string
 	authKey    string
 	hostname   string
+	logID      logid.PublicID
+
+	funnelMu    sync.Mutex
+	funnelPorts map[uint16]*funnelListenerEntry
+
+	// ln is the safesocket listener created by run(); stored here so shutdown
+	// can close it and unblock srv.Run.
+	ln           net.Listener
+	shutdownCh   chan struct{} // closed by shutdown() to unblock main()
+	shutdownOnce sync.Once
+}
+
+// funnelListenerEntry is the per-port state for routing Funnel connections to a listenTLS listener.
+type funnelListenerEntry struct {
+	ch     chan net.Conn
+	tlsCfg *tls.Config
 }
 
 var jsIPNState = map[ipn.State]string{
@@ -258,49 +472,133 @@ func (i *jsIPN) run(jsCallbacks js.Value) {
 		if n.State != nil {
 			notifyState(*n.State)
 		}
-		if nm := n.NetMap; nm != nil {
-			jsNetMap := jsNetMap{
-				Self: jsNetMapSelfNode{
-					jsNetMapNode: jsNetMapNode{
-						Name:       nm.SelfName(),
-						Addresses:  mapSliceView(nm.GetAddresses(), func(a netip.Prefix) string { return a.Addr().String() }),
-						NodeKey:    nm.NodeKey.String(),
-						MachineKey: nm.MachineKey.String(),
-					},
-					MachineStatus: jsMachineStatus[nm.GetMachineStatus()],
-				},
-				Peers: mapSlice(nm.Peers, func(p tailcfg.NodeView) jsNetMapPeerNode {
-					name := p.Name()
-					if name == "" {
-						// In practice this should only happen for Hello.
-						name = p.Hostinfo().Hostname()
+		if n.SelfChange != nil {
+			// Self changed: rebuild the JS-side NetMap snapshot. Peers
+			// don't ride on the bus anymore, so fetch them on demand
+			// from LocalBackend.
+			nm := i.lb.NetMapWithPeers()
+			if nm != nil {
+				// Determine which address families we have, for peer peerAPI URL selection.
+				var selfHave4, selfHave6 bool
+				for _, a := range nm.GetAddresses().All() {
+					if !a.IsSingleIP() {
+						continue
 					}
-					addrs := make([]string, p.Addresses().Len())
-					for i, ap := range p.Addresses().All() {
-						addrs[i] = ap.Addr().String()
+					if a.Addr().Is4() {
+						selfHave4 = true
+					} else if a.Addr().Is6() {
+						selfHave6 = true
 					}
-					return jsNetMapPeerNode{
+				}
+
+				// Self peerAPI URL: own port as reported by LocalBackend.
+				selfPeerAPIURL := ""
+				for _, a := range nm.GetAddresses().All() {
+					if !a.IsSingleIP() {
+						continue
+					}
+					if port, ok := i.lb.GetPeerAPIPort(a.Addr()); ok && port != 0 {
+						selfPeerAPIURL = fmt.Sprintf("http://%v", netip.AddrPortFrom(a.Addr(), port))
+						break
+					}
+				}
+
+				jsNetMap := jsNetMap{
+					Self: jsNetMapSelfNode{
 						jsNetMapNode: jsNetMapNode{
-							Name:       name,
-							Addresses:  addrs,
-							MachineKey: p.Machine().String(),
-							NodeKey:    p.Key().String(),
+							Name:       nm.SelfName(),
+							Addresses:  mapSliceView(nm.GetAddresses(), func(a netip.Prefix) string { return a.Addr().String() }),
+							NodeKey:    nm.NodeKey.String(),
+							MachineKey: nm.MachineKey.String(),
+							PeerAPIURL: selfPeerAPIURL,
+							Services:   userServicesFromView(nm.SelfNode.Hostinfo().Services()),
 						},
-						Online:              p.Online().Clone(),
-						TailscaleSSHEnabled: p.Hostinfo().TailscaleSSHEnabled(),
-					}
-				}),
-				LockedOut: nm.TKAEnabled && nm.SelfNode.KeySignature().Len() == 0,
-			}
-			if jsonNetMap, err := json.Marshal(jsNetMap); err == nil {
-				jsCallbacks.Call("notifyNetMap", string(jsonNetMap))
-			} else {
-				log.Printf("Could not generate JSON netmap: %v", err)
+						MachineStatus: jsMachineStatus[nm.GetMachineStatus()],
+					},
+					Peers: mapSlice(nm.Peers, func(p tailcfg.NodeView) jsNetMapPeerNode {
+						name := p.Name()
+						if name == "" {
+							// In practice this should only happen for Hello.
+							name = p.Hostinfo().Hostname()
+						}
+						addrs := make([]string, p.Addresses().Len())
+						for idx, ap := range p.Addresses().All() {
+							addrs[idx] = ap.Addr().String()
+						}
+
+						// Peer peerAPI URL from the peer's advertised Services.
+						peerURL := buildPeerAPIURL(p, selfHave4, selfHave6)
+
+						return jsNetMapPeerNode{
+							jsNetMapNode: jsNetMapNode{
+								Name:       name,
+								Addresses:  addrs,
+								MachineKey: p.Machine().String(),
+								NodeKey:    p.Key().String(),
+								PeerAPIURL: peerURL,
+								Services:   userServicesFromView(p.Hostinfo().Services()),
+							},
+							Online:              p.Online().Clone(),
+							TailscaleSSHEnabled: p.Hostinfo().TailscaleSSHEnabled(),
+							ExitNodeOption:      tsaddr.ContainsExitRoutes(p.AllowedIPs()),
+							StableNodeID:        string(p.StableID()),
+						}
+					}),
+					LockedOut: nm.TKAEnabled && nm.SelfNode.KeySignature().Len() == 0,
+				}
+				if jsonNetMap, err := json.Marshal(jsNetMap); err == nil {
+					jsCallbacks.Call("notifyNetMap", string(jsonNetMap))
+				} else {
+					log.Printf("Could not generate JSON netmap: %v", err)
+				}
 			}
 		}
+		if n.Prefs != nil && n.Prefs.Valid() {
+			jsCallbacks.Call("notifyExitNode", string(n.Prefs.ExitNodeID()))
+		}
 		if n.BrowseToURL != nil {
 			jsCallbacks.Call("notifyBrowseToURL", *n.BrowseToURL)
 		}
+		if n.FilesWaiting != nil {
+			jsCallbacks.Call("notifyFilesWaiting")
+		}
+		if n.IncomingFiles != nil {
+			files := make([]jsIncomingFile, len(n.IncomingFiles))
+			for i, f := range n.IncomingFiles {
+				files[i] = jsIncomingFile{
+					Name:         f.Name,
+					Started:      f.Started.UnixMilli(),
+					DeclaredSize: f.DeclaredSize,
+					Received:     f.Received,
+					Done:         f.Done,
+				}
+			}
+			if b, err := json.Marshal(files); err == nil {
+				jsCallbacks.Call("notifyIncomingFiles", string(b))
+			} else {
+				log.Printf("could not marshal IncomingFiles: %v", err)
+			}
+		}
+		if n.OutgoingFiles != nil {
+			files := make([]jsOutgoingFile, len(n.OutgoingFiles))
+			for i, f := range n.OutgoingFiles {
+				files[i] = jsOutgoingFile{
+					ID:           f.ID,
+					PeerID:       string(f.PeerID),
+					Name:         f.Name,
+					Started:      f.Started.UnixMilli(),
+					DeclaredSize: f.DeclaredSize,
+					Sent:         f.Sent,
+					Finished:     f.Finished,
+					Succeeded:    f.Succeeded,
+				}
+			}
+			if b, err := json.Marshal(files); err == nil {
+				jsCallbacks.Call("notifyOutgoingFiles", string(b))
+			} else {
+				log.Printf("could not marshal OutgoingFiles: %v", err)
+			}
+		}
 	})
 
 	go func() {
@@ -318,14 +616,17 @@ func (i *jsIPN) run(jsCallbacks js.Value) {
 		}
 	}()
 
-	go func() {
-		ln, err := safesocket.Listen("")
-		if err != nil {
-			log.Fatalf("safesocket.Listen: %v", err)
-		}
+	ln, err := safesocket.Listen("")
+	if err != nil {
+		log.Fatalf("safesocket.Listen: %v", err)
+	}
+	i.ln = ln
 
-		err = i.srv.Run(context.Background(), ln)
-		log.Fatalf("ipnserver.Run exited: %v", err)
+	go func() {
+		err := i.srv.Run(context.Background(), ln)
+		if err != nil && !errors.Is(err, net.ErrClosed) {
+			log.Fatalf("ipnserver.Run exited: %v", err)
+		}
 	}()
 }
 
@@ -344,6 +645,21 @@ func (i *jsIPN) logout() {
 	}()
 }
 
+func (i *jsIPN) shutdown() js.Value {
+	return makePromise(func() (any, error) {
+		i.shutdownOnce.Do(func() {
+			if i.lb != nil {
+				i.lb.Shutdown()
+			}
+			if i.ln != nil {
+				i.ln.Close()
+			}
+			close(i.shutdownCh)
+		})
+		return nil, nil
+	})
+}
+
 func (i *jsIPN) ssh(host, username string, termConfig js.Value) map[string]any {
 	jsSSHSession := &jsSSHSession{
 		jsIPN:      i,
@@ -531,6 +847,823 @@ func (i *jsIPN) fetch(url string) js.Value {
 	})
 }
 
+func (i *jsIPN) setExitNode(stableNodeID string) js.Value {
+	return makePromise(func() (any, error) {
+		mp := &ipn.MaskedPrefs{
+			ExitNodeIDSet: true,
+			Prefs:         ipn.Prefs{ExitNodeID: tailcfg.StableNodeID(stableNodeID)},
+		}
+		_, err := i.lb.EditPrefs(mp)
+		return nil, err
+	})
+}
+
+func (i *jsIPN) setExitNodeEnabled(enabled bool) js.Value {
+	return makePromise(func() (any, error) {
+		_, err := i.lb.SetUseExitNodeEnabled(ipnauth.Self, enabled)
+		return nil, err
+	})
+}
+
+func (i *jsIPN) dial(network, addr string) js.Value {
+	return makePromise(func() (any, error) {
+		ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+		defer cancel()
+		conn, err := i.dialer.UserDial(ctx, network, addr)
+		if err != nil {
+			return nil, err
+		}
+		return wrapConn(conn), nil
+	})
+}
+
+func (i *jsIPN) listen(network, addr string) js.Value {
+	return makePromise(func() (any, error) {
+		switch network {
+		case "tcp", "tcp4", "tcp6":
+			// netstack.ListenTCP only accepts tcp4/tcp6; bare "tcp"
+			// defaults to IPv4 to match net.Listen's typical behavior
+			// when given an unspecified address.
+			n := network
+			if n == "tcp" {
+				n = "tcp4"
+			}
+			// netstack.ListenTCP requires a full host:port; normalise the
+			// standard net.Listen form ":port" that omits the host.
+			if strings.HasPrefix(addr, ":") {
+				addr = "0.0.0.0" + addr
+			}
+			ln, err := i.ns.ListenTCP(n, addr)
+			if err != nil {
+				return nil, err
+			}
+			return wrapTCPListener(ln), nil
+		case "udp", "udp4", "udp6":
+			pc, err := i.ns.ListenPacket(network, addr)
+			if err != nil {
+				return nil, err
+			}
+			return wrapPacketConn(pc), nil
+		default:
+			return nil, fmt.Errorf("unsupported network %q", network)
+		}
+	})
+}
+
+// tlsClientConfigFromJS builds a client tls.Config from optional JS options
+// (serverName, insecureSkipVerify, caCerts). defaultServerName may be empty
+// (STARTTLS upgrade case), in which case serverName must be provided unless
+// insecureSkipVerify is set.
+//
+// On wasm there's no system root pool, so default to the baked-in
+// LetsEncrypt roots (which is what `tailscale cert` uses for tailnet
+// HTTPS endpoints). Callers can override with caCerts (PEM) or bypass
+// entirely with insecureSkipVerify.
+func tlsClientConfigFromJS(defaultServerName string, opts js.Value) (*tls.Config, error) {
+	cfg := &tls.Config{
+		ServerName: defaultServerName,
+		RootCAs:    bakedroots.Get(),
+	}
+	if !opts.IsUndefined() && !opts.IsNull() {
+		if sn := opts.Get("serverName"); sn.Type() == js.TypeString {
+			cfg.ServerName = sn.String()
+		}
+		if iv := opts.Get("insecureSkipVerify"); iv.Type() == js.TypeBoolean {
+			cfg.InsecureSkipVerify = iv.Bool()
+		}
+		if ca := opts.Get("caCerts"); ca.Type() == js.TypeString {
+			pool := x509.NewCertPool()
+			if !pool.AppendCertsFromPEM([]byte(ca.String())) {
+				return nil, fmt.Errorf("caCerts: no valid PEM certificates found")
+			}
+			cfg.RootCAs = pool
+		}
+	}
+	if cfg.ServerName == "" && !cfg.InsecureSkipVerify {
+		return nil, fmt.Errorf("serverName is required unless insecureSkipVerify is set")
+	}
+	return cfg, nil
+}
+
+func (i *jsIPN) dialTLS(addr string, opts js.Value) js.Value {
+	return makePromise(func() (any, error) {
+		ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+		defer cancel()
+
+		host, _, err := net.SplitHostPort(addr)
+		if err != nil {
+			return nil, fmt.Errorf("invalid address %q: %w", addr, err)
+		}
+
+		cfg, err := tlsClientConfigFromJS(host, opts)
+		if err != nil {
+			return nil, err
+		}
+
+		rawConn, err := i.dialer.UserDial(ctx, "tcp", addr)
+		if err != nil {
+			return nil, err
+		}
+		tlsConn := tls.Client(rawConn, cfg)
+		if err := tlsConn.HandshakeContext(ctx); err != nil {
+			rawConn.Close()
+			return nil, err
+		}
+		return wrapConn(tlsConn), nil
+	})
+}
+
+func (i *jsIPN) listenICMP(network string) js.Value {
+	return makePromise(func() (any, error) {
+		var transportProto tcpip.TransportProtocolNumber
+		var networkProto tcpip.NetworkProtocolNumber
+
+		switch network {
+		case "icmp4", "icmp":
+			transportProto = icmp.ProtocolNumber4
+			networkProto = ipv4.ProtocolNumber
+		case "icmp6":
+			transportProto = icmp.ProtocolNumber6
+			networkProto = ipv6.ProtocolNumber
+		default:
+			return nil, fmt.Errorf("unsupported network %q (use \"icmp4\" or \"icmp6\")", network)
+		}
+
+		st := i.ns.Stack()
+		var wq waiter.Queue
+		ep, nserr := st.NewEndpoint(transportProto, networkProto, &wq)
+		if nserr != nil {
+			return nil, fmt.Errorf("creating ICMP endpoint: %v", nserr)
+		}
+
+		pc := gonet.NewUDPConn(&wq, ep)
+		return wrapPacketConn(pc), nil
+	})
+}
+
+func (i *jsIPN) getCert() js.Value {
+	return makePromise(func() (any, error) {
+		nm := i.lb.NetMap()
+		if nm == nil {
+			return nil, errors.New("getCert: no network map available")
+		}
+		certDomains := nm.DNS.CertDomains
+		if len(certDomains) == 0 {
+			return nil, errors.New("getCert: this tailnet does not support TLS certificates")
+		}
+		pair, err := i.lb.GetCertPEM(context.Background(), certDomains[0])
+		if err != nil {
+			return nil, err
+		}
+		return map[string]any{
+			"certPEM": string(pair.CertPEM),
+			"keyPEM":  string(pair.KeyPEM),
+		}, nil
+	})
+}
+
+func (i *jsIPN) listenTLS(addr, certPEM, keyPEM string) js.Value {
+	return makePromise(func() (any, error) {
+		cert, err := tls.X509KeyPair([]byte(certPEM), []byte(keyPEM))
+		if err != nil {
+			return nil, fmt.Errorf("listenTLS: parsing cert/key: %w", err)
+		}
+		tlsCfg := &tls.Config{Certificates: []tls.Certificate{cert}}
+
+		tcpLn, err := i.ns.ListenTCP("tcp4", addr)
+		if err != nil {
+			return nil, err
+		}
+
+		// Determine the actual port (handles ":0" ephemeral assignment).
+		// Use SplitHostPort rather than netip.ParseAddrPort because gVisor
+		// may return ":443" (empty host) which ParseAddrPort rejects.
+		_, portStr, err := net.SplitHostPort(tcpLn.Addr().String())
+		if err != nil {
+			tcpLn.Close()
+			return nil, fmt.Errorf("listenTLS: getting port from listener addr: %w", err)
+		}
+		portNum, err := strconv.ParseUint(portStr, 10, 16)
+		if err != nil {
+			tcpLn.Close()
+			return nil, fmt.Errorf("listenTLS: parsing port %q: %w", portStr, err)
+		}
+		port := uint16(portNum)
+
+		// Register a Funnel entry so handleFunnelTCP can route to this listener.
+		entry := &funnelListenerEntry{
+			ch:     make(chan net.Conn, 8),
+			tlsCfg: tlsCfg,
+		}
+		i.funnelMu.Lock()
+		i.funnelPorts[port] = entry
+		i.funnelMu.Unlock()
+
+		ln := newCombinedTLSListener(tcpLn, tlsCfg, entry.ch, port, i)
+		return wrapTCPListener(ln), nil
+	})
+}
+
+// handleFunnelTCP is registered with LocalBackend.SetTCPHandlerForFunnelFlow.
+// It routes incoming Funnel connections to the matching listenTLS listener.
+func (i *jsIPN) handleFunnelTCP(src netip.AddrPort, dstPort uint16) func(net.Conn) {
+	i.funnelMu.Lock()
+	entry := i.funnelPorts[dstPort]
+	i.funnelMu.Unlock()
+	if entry == nil {
+		return nil
+	}
+	return func(conn net.Conn) {
+		tlsConn := tls.Server(conn, entry.tlsCfg)
+		select {
+		case entry.ch <- tlsConn:
+		default:
+			// Channel full; drop the connection rather than block.
+			conn.Close()
+		}
+	}
+}
+
+// combinedTLSListener merges TLS connections from the local netstack (direct
+// tailnet access) and from Funnel ingress into a single net.Listener.
+type combinedTLSListener struct {
+	tcpLn      net.Listener
+	tlsCfg     *tls.Config
+	funnelCh   <-chan net.Conn
+	port       uint16
+	ipn        *jsIPN
+	netstackCh chan net.Conn
+	errCh      chan error
+	done       chan struct{}
+	closeOnce  sync.Once
+}
+
+func newCombinedTLSListener(tcpLn net.Listener, tlsCfg *tls.Config, funnelCh <-chan net.Conn, port uint16, ipn *jsIPN) *combinedTLSListener {
+	l := &combinedTLSListener{
+		tcpLn:      tcpLn,
+		tlsCfg:     tlsCfg,
+		funnelCh:   funnelCh,
+		port:       port,
+		ipn:        ipn,
+		netstackCh: make(chan net.Conn, 8),
+		errCh:      make(chan error, 1),
+		done:       make(chan struct{}),
+	}
+	go l.drainNetstack()
+	return l
+}
+
+func (l *combinedTLSListener) drainNetstack() {
+	for {
+		conn, err := l.tcpLn.Accept()
+		if err != nil {
+			select {
+			case l.errCh <- err:
+			default:
+			}
+			return
+		}
+		tlsConn := tls.Server(conn, l.tlsCfg)
+		select {
+		case l.netstackCh <- tlsConn:
+		case <-l.done:
+			conn.Close()
+			return
+		}
+	}
+}
+
+func (l *combinedTLSListener) Accept() (net.Conn, error) {
+	select {
+	case conn := <-l.funnelCh:
+		return conn, nil
+	case conn := <-l.netstackCh:
+		return conn, nil
+	case err := <-l.errCh:
+		return nil, err
+	case <-l.done:
+		return nil, net.ErrClosed
+	}
+}
+
+func (l *combinedTLSListener) Close() error {
+	l.closeOnce.Do(func() {
+		close(l.done)
+		l.tcpLn.Close()
+		l.ipn.funnelMu.Lock()
+		delete(l.ipn.funnelPorts, l.port)
+		l.ipn.funnelMu.Unlock()
+	})
+	return nil
+}
+
+func (l *combinedTLSListener) Addr() net.Addr {
+	return l.tcpLn.Addr()
+}
+
+func (i *jsIPN) setFunnel(hostname string, port uint16, enabled bool) js.Value {
+	return makePromise(func() (any, error) {
+		hp := ipn.HostPort(fmt.Sprintf("%s:%d", hostname, port))
+		var cfg *ipn.ServeConfig
+		if enabled {
+			cfg = &ipn.ServeConfig{
+				AllowFunnel: map[ipn.HostPort]bool{hp: true},
+			}
+		} else {
+			cfg = &ipn.ServeConfig{}
+		}
+		return nil, i.lb.SetServeConfig(cfg, "")
+	})
+}
+
+func (i *jsIPN) whoIs(addr string, proto string) js.Value {
+	return makePromise(func() (any, error) {
+		// Accept both "ip:port" and bare "ip" (port 0 still resolves by IP).
+		var ipp netip.AddrPort
+		if ap, err := netip.ParseAddrPort(addr); err == nil {
+			ipp = ap
+		} else if ip, err := netip.ParseAddr(addr); err == nil {
+			ipp = netip.AddrPortFrom(ip, 0)
+		} else {
+			return nil, fmt.Errorf("whoIs: invalid address %q (want ip:port or ip)", addr)
+		}
+		n, u, ok := i.lb.WhoIs(proto, ipp)
+		if !ok {
+			return nil, nil
+		}
+		addrs := make([]any, n.Addresses().Len())
+		for idx, ap := range n.Addresses().All() {
+			addrs[idx] = ap.Addr().String()
+		}
+		return map[string]any{
+			"node": map[string]any{
+				"id":        string(n.StableID()),
+				"name":      n.Name(),
+				"addresses": addrs,
+			},
+			"user": map[string]any{
+				"id":            int64(u.ID),
+				"loginName":     u.LoginName,
+				"displayName":   u.DisplayName,
+				"profilePicURL": u.ProfilePicURL,
+			},
+		}, nil
+	})
+}
+
+func (i *jsIPN) queryDNS(name string, queryType int) js.Value {
+	return makePromise(func() (any, error) {
+		res, resolvers, err := i.lb.QueryDNS(name, dnsmessage.Type(queryType))
+
+		// Detect SERVFAIL with no upstream resolvers (common when an exit node is
+		// active but the DNS manager forwarder has no configured upstreams). Fall
+		// back to querying 8.8.8.8 via the dialer (which routes through the exit
+		// node), then as a last resort use the browser's default name resolver.
+		needsFallback := err != nil
+		if !needsFallback && len(resolvers) == 0 && len(res) > 0 {
+			var hdrParser dnsmessage.Parser
+			if hdr, hdrErr := hdrParser.Start(res); hdrErr == nil && hdr.RCode == dnsmessage.RCodeServerFailure {
+				needsFallback = true
+			}
+		}
+		if needsFallback {
+			qt := dnsmessage.Type(queryType)
+			if qt != dnsmessage.TypeA && qt != dnsmessage.TypeAAAA {
+				if err != nil {
+					return nil, fmt.Errorf("queryDNS: %w (no upstream resolver; only A/AAAA queries support fallback)", err)
+				}
+				return nil, fmt.Errorf("queryDNS: no upstream resolver available; only A/AAAA queries support fallback lookup")
+			}
+			ctx := context.Background()
+			d := i.dialer
+			r := &net.Resolver{
+				PreferGo: true,
+				Dial: func(rctx context.Context, network, address string) (net.Conn, error) {
+					return d.UserDial(rctx, "tcp", "8.8.8.8:53")
+				},
+			}
+			ips, rerr := r.LookupIPAddr(ctx, name)
+			if rerr != nil {
+				// Last resort: browser-native resolution (no exit-node routing).
+				ips, rerr = (&net.Resolver{PreferGo: false}).LookupIPAddr(ctx, name)
+				if rerr != nil {
+					return nil, fmt.Errorf("queryDNS: fallback resolution failed: %w", rerr)
+				}
+			}
+			var answers []any
+			for _, ia := range ips {
+				ip, ok := netip.AddrFromSlice(ia.IP)
+				if !ok {
+					continue
+				}
+				ip = ip.Unmap()
+				if qt == dnsmessage.TypeA && ip.Is4() {
+					answers = append(answers, ip.String())
+				} else if qt == dnsmessage.TypeAAAA && ip.Is6() {
+					answers = append(answers, ip.String())
+				}
+			}
+			return map[string]any{
+				"answers":   answers,
+				"resolvers": []any{},
+			}, nil
+		}
+
+		var p dnsmessage.Parser
+		if _, err := p.Start(res); err != nil {
+			return nil, fmt.Errorf("queryDNS: parsing response: %w", err)
+		}
+		if err := p.SkipAllQuestions(); err != nil {
+			return nil, fmt.Errorf("queryDNS: skipping questions: %w", err)
+		}
+		var answers []any
+		for {
+			h, err := p.AnswerHeader()
+			if err == dnsmessage.ErrSectionDone {
+				break
+			}
+			if err != nil {
+				return nil, fmt.Errorf("queryDNS: reading answer: %w", err)
+			}
+			switch h.Type {
+			case dnsmessage.TypeA:
+				r, err := p.AResource()
+				if err != nil {
+					return nil, fmt.Errorf("queryDNS: reading A record: %w", err)
+				}
+				answers = append(answers, netip.AddrFrom4(r.A).String())
+			case dnsmessage.TypeAAAA:
+				r, err := p.AAAAResource()
+				if err != nil {
+					return nil, fmt.Errorf("queryDNS: reading AAAA record: %w", err)
+				}
+				answers = append(answers, netip.AddrFrom16(r.AAAA).String())
+			case dnsmessage.TypeCNAME:
+				r, err := p.CNAMEResource()
+				if err != nil {
+					return nil, fmt.Errorf("queryDNS: reading CNAME record: %w", err)
+				}
+				answers = append(answers, r.CNAME.String())
+			case dnsmessage.TypeTXT:
+				r, err := p.TXTResource()
+				if err != nil {
+					return nil, fmt.Errorf("queryDNS: reading TXT record: %w", err)
+				}
+				for _, s := range r.TXT {
+					answers = append(answers, s)
+				}
+			default:
+				if err := p.SkipAnswer(); err != nil {
+					return nil, fmt.Errorf("queryDNS: skipping unknown answer: %w", err)
+				}
+			}
+		}
+		resolverAddrs := make([]any, len(resolvers))
+		for idx, r := range resolvers {
+			resolverAddrs[idx] = r.Addr
+		}
+		return map[string]any{
+			"answers":   answers,
+			"resolvers": resolverAddrs,
+		}, nil
+	})
+}
+
+func (i *jsIPN) ping(ip string, pingType string, size int) js.Value {
+	return makePromise(func() (any, error) {
+		addr, err := netip.ParseAddr(ip)
+		if err != nil {
+			return nil, fmt.Errorf("ping: invalid IP %q: %w", ip, err)
+		}
+		switch tailcfg.PingType(pingType) {
+		case tailcfg.PingDisco, tailcfg.PingTSMP, tailcfg.PingICMP, tailcfg.PingPeerAPI:
+			// valid
+		default:
+			return nil, fmt.Errorf("ping: unknown type %q, must be one of: disco, TSMP, ICMP, peerapi", pingType)
+		}
+		ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+		defer cancel()
+		pr, err := i.lb.Ping(ctx, addr, tailcfg.PingType(pingType), size)
+		if err != nil {
+			return nil, err
+		}
+		result := map[string]any{
+			"ip":             pr.IP,
+			"nodeIP":         pr.NodeIP,
+			"nodeName":       pr.NodeName,
+			"latencySeconds": pr.LatencySeconds,
+			"endpoint":       pr.Endpoint,
+			"derpRegionID":   pr.DERPRegionID,
+			"derpRegionCode": pr.DERPRegionCode,
+			"peerAPIURL":     pr.PeerAPIURL,
+			"isLocalIP":      pr.IsLocalIP,
+		}
+		if pr.Err != "" {
+			result["err"] = pr.Err
+		}
+		return result, nil
+	})
+}
+
+func (i *jsIPN) suggestExitNode() js.Value {
+	return makePromise(func() (any, error) {
+		resp, err := i.lb.SuggestExitNode()
+		if err != nil {
+			return nil, err
+		}
+		result := map[string]any{
+			"id":   string(resp.ID),
+			"name": resp.Name,
+		}
+		if l := resp.Location; l.Valid() {
+			result["location"] = map[string]any{
+				"country":     l.Country(),
+				"countryCode": l.CountryCode(),
+				"city":        l.City(),
+				"cityCode":    l.CityCode(),
+				"latitude":    l.Latitude(),
+				"longitude":   l.Longitude(),
+			}
+		}
+		return result, nil
+	})
+}
+
+func (i *jsIPN) setServices(jsServices js.Value) js.Value {
+	return makePromise(func() (any, error) {
+		n := jsServices.Length()
+		svcs := make([]tailcfg.Service, 0, n)
+		for idx := range n {
+			s := jsServices.Index(idx)
+			proto := tailcfg.ServiceProto(s.Get("proto").String())
+			port := uint16(s.Get("port").Int())
+			var desc string
+			if d := s.Get("description"); d.Type() == js.TypeString {
+				desc = d.String()
+			}
+			svcs = append(svcs, tailcfg.Service{Proto: proto, Port: port, Description: desc})
+		}
+		i.lb.SetExplicitServices(svcs)
+		return nil, nil
+	})
+}
+
+// userServicesFromView converts a hostinfo services slice to jsService entries,
+// filtering out internal peerapi protocol entries (already reflected in peerAPIURL).
+func userServicesFromView(svcs views.Slice[tailcfg.Service]) []jsService {
+	out := make([]jsService, 0, svcs.Len())
+	for _, s := range svcs.All() {
+		switch s.Proto {
+		case tailcfg.PeerAPI4, tailcfg.PeerAPI6, tailcfg.PeerAPIDNS:
+			continue
+		}
+		out = append(out, jsService{Proto: string(s.Proto), Port: s.Port, Description: s.Description})
+	}
+	return out
+}
+
+func (i *jsIPN) localAPI(method, path, body string) js.Value {
+	return makePromise(func() (any, error) {
+		h := localapi.NewHandler(localapi.HandlerConfig{
+			Actor: &ipnauth.TestActor{
+				Name:       "wasm",
+				LocalAdmin: true,
+			},
+			Backend:  i.lb,
+			Logf:     log.Printf,
+			LogID:    i.logID,
+			EventBus: i.lb.Sys().Bus.Get(),
+		})
+		h.PermitRead = true
+		h.PermitWrite = true
+		h.PermitCert = true
+
+		var bodyReader io.Reader
+		if body != "" {
+			bodyReader = strings.NewReader(body)
+		}
+		req, err := http.NewRequest(method, "http://local-tailscaled.sock"+path, bodyReader)
+		if err != nil {
+			return nil, fmt.Errorf("localAPI: %w", err)
+		}
+		// Empty Host passes the validHost check in the LocalAPI handler.
+		req.Host = ""
+		if body != "" {
+			req.Header.Set("Content-Type", "application/json")
+		}
+		w := httptest.NewRecorder()
+		h.ServeHTTP(w, req)
+		resp := w.Result()
+		respBody, err := io.ReadAll(resp.Body)
+		if err != nil {
+			return nil, fmt.Errorf("localAPI: reading response: %w", err)
+		}
+		return map[string]any{
+			"status": resp.StatusCode,
+			"body":   string(respBody),
+		}, nil
+	})
+}
+
+// wrapConn exposes a net.Conn to JavaScript with binary (Uint8Array) I/O.
+func wrapConn(conn net.Conn) map[string]any {
+	return map[string]any{
+		"read": js.FuncOf(func(this js.Value, args []js.Value) any {
+			return makePromise(func() (any, error) {
+				buf := make([]byte, 65536)
+				n, err := conn.Read(buf)
+				if err != nil {
+					return nil, err
+				}
+				arr := js.Global().Get("Uint8Array").New(n)
+				js.CopyBytesToJS(arr, buf[:n])
+				return arr, nil
+			})
+		}),
+		"write": js.FuncOf(func(this js.Value, args []js.Value) any {
+			return makePromise(func() (any, error) {
+				data := args[0]
+				buf := make([]byte, data.Get("length").Int())
+				js.CopyBytesToGo(buf, data)
+				n, err := conn.Write(buf)
+				if err != nil {
+					return nil, err
+				}
+				return n, nil
+			})
+		}),
+		"close": js.FuncOf(func(this js.Value, args []js.Value) any {
+			return conn.Close() != nil
+		}),
+		"localAddr": js.FuncOf(func(this js.Value, args []js.Value) any {
+			return conn.LocalAddr().String()
+		}),
+		"remoteAddr": js.FuncOf(func(this js.Value, args []js.Value) any {
+			return conn.RemoteAddr().String()
+		}),
+		// upgradeTLS wraps the conn in TLS in place (STARTTLS-style) and
+		// returns a new wrapped conn sharing the same underlying net.Conn;
+		// the old handle must not be used afterward. On any failure —
+		// configuration or handshake — the underlying conn is closed, so
+		// callers can treat every rejection as fatal to the connection.
+		// With isServer, certPem and keyPem are required; otherwise client
+		// options as in dialTLS apply.
+		"upgradeTLS": js.FuncOf(func(this js.Value, args []js.Value) any {
+			opts := js.Undefined()
+			if len(args) > 0 {
+				opts = args[0]
+			}
+			return makePromise(func() (any, error) {
+				var tlsConn *tls.Conn
+				hasOpts := !opts.IsUndefined() && !opts.IsNull()
+				if hasOpts && opts.Get("isServer").Type() == js.TypeBoolean && opts.Get("isServer").Bool() {
+					certPem := opts.Get("certPem")
+					keyPem := opts.Get("keyPem")
+					if certPem.Type() != js.TypeString || keyPem.Type() != js.TypeString {
+						conn.Close()
+						return nil, fmt.Errorf("upgradeTLS: certPem and keyPem are required when isServer is set")
+					}
+					cert, err := tls.X509KeyPair([]byte(certPem.String()), []byte(keyPem.String()))
+					if err != nil {
+						conn.Close()
+						return nil, fmt.Errorf("upgradeTLS: parsing cert/key: %w", err)
+					}
+					tlsConn = tls.Server(conn, &tls.Config{Certificates: []tls.Certificate{cert}})
+				} else {
+					cfg, err := tlsClientConfigFromJS("", opts)
+					if err != nil {
+						conn.Close()
+						return nil, err
+					}
+					tlsConn = tls.Client(conn, cfg)
+				}
+				ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+				defer cancel()
+				if err := tlsConn.HandshakeContext(ctx); err != nil {
+					conn.Close()
+					return nil, err
+				}
+				return wrapConn(tlsConn), nil
+			})
+		}),
+	}
+}
+
+// wrapTCPListener exposes a net.Listener to JavaScript as an object with
+// accept/close/addr methods plus a Symbol.asyncIterator implementation, so
+// callers can write `for await (const conn of listener)`.
+func wrapTCPListener(ln net.Listener) js.Value {
+	obj := js.Global().Get("Object").New()
+	obj.Set("accept", js.FuncOf(func(this js.Value, args []js.Value) any {
+		return makePromise(func() (any, error) {
+			conn, err := ln.Accept()
+			if err != nil {
+				return nil, err
+			}
+			return wrapConn(conn), nil
+		})
+	}))
+	obj.Set("close", js.FuncOf(func(this js.Value, args []js.Value) any {
+		return ln.Close() != nil
+	}))
+	obj.Set("addr", js.FuncOf(func(this js.Value, args []js.Value) any {
+		return ln.Addr().String()
+	}))
+
+	asyncIterSym := js.Global().Get("Symbol").Get("asyncIterator")
+	iterFactory := js.FuncOf(func(this js.Value, args []js.Value) any {
+		iter := js.Global().Get("Object").New()
+		iter.Set("next", js.FuncOf(func(this js.Value, args []js.Value) any {
+			return makePromise(func() (any, error) {
+				conn, err := ln.Accept()
+				if err != nil {
+					if errors.Is(err, net.ErrClosed) {
+						return map[string]any{
+							"value": js.Undefined(),
+							"done":  true,
+						}, nil
+					}
+					return nil, err
+				}
+				return map[string]any{
+					"value": wrapConn(conn),
+					"done":  false,
+				}, nil
+			})
+		}))
+		return iter
+	})
+	js.Global().Get("Reflect").Call("set", obj, asyncIterSym, iterFactory)
+	return obj
+}
+
+// wrapPacketConn exposes a net.PacketConn to JavaScript with binary (Uint8Array) I/O.
+func wrapPacketConn(pc net.PacketConn) map[string]any {
+	return map[string]any{
+		"readFrom": js.FuncOf(func(this js.Value, args []js.Value) any {
+			return makePromise(func() (any, error) {
+				buf := make([]byte, 65536)
+				n, addr, err := pc.ReadFrom(buf)
+				if err != nil {
+					return nil, err
+				}
+				arr := js.Global().Get("Uint8Array").New(n)
+				js.CopyBytesToJS(arr, buf[:n])
+				return map[string]any{
+					"data": arr,
+					"addr": addr.String(),
+				}, nil
+			})
+		}),
+		"writeTo": js.FuncOf(func(this js.Value, args []js.Value) any {
+			return makePromise(func() (any, error) {
+				data := args[0]
+				addrStr := args[1].String()
+				buf := make([]byte, data.Get("length").Int())
+				js.CopyBytesToGo(buf, data)
+				addr, err := resolveUDPAddr(addrStr)
+				if err != nil {
+					return nil, err
+				}
+				n, err := pc.WriteTo(buf, addr)
+				if err != nil {
+					return nil, err
+				}
+				return n, nil
+			})
+		}),
+		"close": js.FuncOf(func(this js.Value, args []js.Value) any {
+			return pc.Close() != nil
+		}),
+		"localAddr": js.FuncOf(func(this js.Value, args []js.Value) any {
+			return pc.LocalAddr().String()
+		}),
+	}
+}
+
+// resolveUDPAddr parses an address string that is either "host:port" or just
+// an IP (for ICMP, where port defaults to 0).
+func resolveUDPAddr(s string) (*net.UDPAddr, error) {
+	host, portStr, err := net.SplitHostPort(s)
+	if err != nil {
+		// Bare IP address without port (used for ICMP).
+		ip := net.ParseIP(s)
+		if ip == nil {
+			return nil, fmt.Errorf("invalid address: %s", s)
+		}
+		return &net.UDPAddr{IP: ip}, nil
+	}
+	ip := net.ParseIP(host)
+	if ip == nil {
+		return nil, fmt.Errorf("invalid IP: %s", host)
+	}
+	port, err := strconv.Atoi(portStr)
+	if err != nil {
+		return nil, fmt.Errorf("invalid port: %s", portStr)
+	}
+	return &net.UDPAddr{IP: ip, Port: port}, nil
+}
+
 type termWriter struct {
 	f js.Value
 }
@@ -541,17 +1674,48 @@ func (w termWriter) Write(p []byte) (n int, err error) {
 	return len(p), nil
 }
 
+// jsIncomingFile is the JSON representation of an in-progress inbound file
+// transfer sent to the notifyIncomingFiles callback.
+type jsIncomingFile struct {
+	Name         string `json:"name"`
+	Started      int64  `json:"started"`      // Unix milliseconds; use new Date(started) in JS
+	DeclaredSize int64  `json:"declaredSize"` // -1 if unknown
+	Received     int64  `json:"received"`     // bytes received so far
+	Done         bool   `json:"done"`         // true once the file has been fully received
+}
+
+// jsOutgoingFile is the JSON representation of an outgoing file transfer
+// sent to the notifyOutgoingFiles callback.
+type jsOutgoingFile struct {
+	ID           string `json:"id"`
+	PeerID       string `json:"peerID"`
+	Name         string `json:"name"`
+	Started      int64  `json:"started"`      // Unix milliseconds
+	DeclaredSize int64  `json:"declaredSize"` // -1 if unknown
+	Sent         int64  `json:"sent"`         // bytes sent so far
+	Finished     bool   `json:"finished"`
+	Succeeded    bool   `json:"succeeded"` // only meaningful when finished
+}
+
 type jsNetMap struct {
 	Self      jsNetMapSelfNode   `json:"self"`
 	Peers     []jsNetMapPeerNode `json:"peers"`
 	LockedOut bool               `json:"lockedOut"`
 }
 
+type jsService struct {
+	Proto       string `json:"proto"`
+	Port        uint16 `json:"port"`
+	Description string `json:"description,omitempty"`
+}
+
 type jsNetMapNode struct {
-	Name       string   `json:"name"`
-	Addresses  []string `json:"addresses"`
-	MachineKey string   `json:"machineKey"`
-	NodeKey    string   `json:"nodeKey"`
+	Name       string      `json:"name"`
+	Addresses  []string    `json:"addresses"`
+	MachineKey string      `json:"machineKey"`
+	NodeKey    string      `json:"nodeKey"`
+	PeerAPIURL string      `json:"peerAPIURL,omitempty"`
+	Services   []jsService `json:"services"`
 }
 
 type jsNetMapSelfNode struct {
@@ -561,8 +1725,10 @@ type jsNetMapSelfNode struct {
 
 type jsNetMapPeerNode struct {
 	jsNetMapNode
-	Online              *bool `json:"online,omitempty"`
-	TailscaleSSHEnabled bool  `json:"tailscaleSSHEnabled"`
+	Online              *bool  `json:"online,omitempty"`
+	TailscaleSSHEnabled bool   `json:"tailscaleSSHEnabled"`
+	ExitNodeOption      bool   `json:"exitNodeOption"`
+	StableNodeID        string `json:"stableNodeID"`
 }
 
 type jsStateStore struct {
diff --git a/cmd/tsconnect/wasmbuild/wasmbuild.go b/cmd/tsconnect/wasmbuild/wasmbuild.go
new file mode 100644
index 000000000..ceefd86fe
--- /dev/null
+++ b/cmd/tsconnect/wasmbuild/wasmbuild.go
@@ -0,0 +1,137 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package wasmbuild contains the shared build flags and manifest layout
+// used to produce the @tailscale/connect NPM package's main.wasm. It is
+// imported both by cmd/tsconnect (which does the build) and by tests
+// that verify the produced pkg/main.wasm matches what the current
+// source tree would build (see tstest/integration/jswasmtest).
+package wasmbuild
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"slices"
+	"strings"
+
+	"tailscale.com/feature/featuretags"
+)
+
+// baseTags are the non-featuretag build tags always set for the wasm
+// build. Featuretag omits (ts_omit_*) are computed dynamically by
+// [Tags] from [Keep] using the [featuretags] registry.
+//
+// Note: nethttpomithttp2 is intentionally NOT included: control/ts2021
+// (since commit 1d93bdce2, Oct 2025) requires HTTP/2 from net/http's
+// bundled implementation. Excluding it leaves the wasm client unable
+// to negotiate with any control plane.
+var baseTags = []string{
+	"tailscale_go",
+	"osusergo",
+	"netgo",
+	"omitidna",
+	"omitpemdecrypt",
+}
+
+// Omit is the set of feature/featuretags tags excluded from the
+// cmd/tsconnect/wasm build via their ts_omit_ build tag (computed by
+// [Tags]). Everything else in [featuretags.Features] stays linked.
+//
+// Upstream uses the opposite polarity here — a small allow-list — because
+// its wasm client is only an SSH/fetch-in-browser tool. This fork's JS
+// bridge exposes Taildrop, Taildrive, Funnel/serve, ACME certs, exit node
+// selection, service advertisement and the peerAPI, so an allow-list is
+// the wrong default: a missing entry is not a compile error, it is a
+// feature that silently stops working at runtime (an omitted extension
+// simply never registers its hooks). Linking everything also matches how
+// this build behaved before upstream introduced featuretags.
+//
+// The init() below panics if any entry is unknown to feature/featuretags,
+// so a rename / removal in that registry fails loudly here.
+//
+// Trimming the bundle by omitting more features is worthwhile but should
+// be done with measurements and per-feature runtime verification, not by
+// assuming a feature is unreachable from the browser.
+var Omit = []featuretags.FeatureTag{
+	// feature/ace does not compile for GOOS=js: control/controlhttp only
+	// installs HookMakeACEDialer on non-js platforms, so feature/ace's
+	// reference to it is undefined here.
+	"ace",
+}
+
+func init() {
+	for _, ft := range Omit {
+		if _, ok := featuretags.Features[ft]; !ok {
+			panic(fmt.Sprintf("wasmbuild.Omit references unknown feature tag %q; "+
+				"did feature/featuretags rename or remove it?", ft))
+		}
+	}
+}
+
+// ProdLDFlags is the -ldflags value used in production wasm builds.
+// -s strips the symbol table, -w strips DWARF, both to shrink the
+// shipped artifact.
+const ProdLDFlags = "-s -w"
+
+// BuildInfoFile is the basename of the JSON manifest that build-pkg
+// writes alongside main.wasm, recording the sha256 of the raw
+// (pre-wasm-opt) go-build output. Tests use this to detect a stale
+// pkg/main.wasm without having to re-run wasm-opt themselves.
+const BuildInfoFile = "build-info.json"
+
+// BuildInfo is the JSON contents of [BuildInfoFile].
+type BuildInfo struct {
+	// RawWasmSHA256 is the lowercase hex sha256 of the wasm bytes as
+	// they came out of `go build` (before wasm-opt was run in place).
+	RawWasmSHA256 string `json:"raw_wasm_sha256"`
+}
+
+// Tags returns the joined -tags value for the wasm build: [baseTags]
+// plus a ts_omit_<feature> for every entry in [Omit].
+//
+// The result is sorted so that the same source tree always produces
+// the same string (and therefore the same wasm bytes, given identical
+// inputs to `go build`).
+func Tags() string {
+	omit := map[featuretags.FeatureTag]bool{}
+	for _, ft := range Omit {
+		omit[ft] = true
+	}
+	tags := slices.Clone(baseTags)
+	for ft := range featuretags.Features {
+		if ft == "" || !ft.IsOmittable() {
+			continue
+		}
+		if omit[ft] {
+			tags = append(tags, ft.OmitTag())
+		}
+	}
+	slices.Sort(tags)
+	return strings.Join(tags, ",")
+}
+
+// ProdCommand returns an *exec.Cmd that runs `go build` for
+// cmd/tsconnect/wasm with the production flags, writing the raw
+// (pre-wasm-opt) wasm to outputPath. GOOS=js GOARCH=wasm is set in the
+// command's environment. The caller is responsible for wiring
+// Stdin/Stdout/Stderr and invoking Run.
+//
+// If goBin is empty, runtime.GOROOT()+"/bin/go" is used so that the
+// build runs under the same toolchain that built the caller.
+func ProdCommand(goBin, outputPath string) *exec.Cmd {
+	if goBin == "" {
+		goBin = filepath.Join(runtime.GOROOT(), "bin", "go")
+	}
+	cmd := exec.Command(goBin, "build",
+		"-tags", Tags(),
+		"-trimpath",
+		"-ldflags", ProdLDFlags,
+		"-o", outputPath,
+		"tailscale.com/cmd/tsconnect/wasm",
+	)
+	cmd.Env = append(os.Environ(), "GOOS=js", "GOARCH=wasm")
+	return cmd
+}
diff --git a/cmd/tsidp/depaware.txt b/cmd/tsidp/depaware.txt
index 360437860..0e107b4f0 100644
--- a/cmd/tsidp/depaware.txt
+++ b/cmd/tsidp/depaware.txt
@@ -6,81 +6,9 @@ tailscale.com/cmd/tsidp dependencies: (generated by github.com/tailscale/depawar
    W 💣 github.com/alexbrainman/sspi                                 from github.com/alexbrainman/sspi/internal/common+
    W    github.com/alexbrainman/sspi/internal/common                 from github.com/alexbrainman/sspi/negotiate
    W 💣 github.com/alexbrainman/sspi/negotiate                       from tailscale.com/net/tshttpproxy
-        github.com/aws/aws-sdk-go-v2/aws                             from github.com/aws/aws-sdk-go-v2/aws/defaults+
-        github.com/aws/aws-sdk-go-v2/aws/defaults                    from github.com/aws/aws-sdk-go-v2/service/sso+
-        github.com/aws/aws-sdk-go-v2/aws/middleware                  from github.com/aws/aws-sdk-go-v2/aws/retry+
-        github.com/aws/aws-sdk-go-v2/aws/protocol/query              from github.com/aws/aws-sdk-go-v2/service/sts
-        github.com/aws/aws-sdk-go-v2/aws/protocol/restjson           from github.com/aws/aws-sdk-go-v2/service/sso+
-        github.com/aws/aws-sdk-go-v2/aws/protocol/xml                from github.com/aws/aws-sdk-go-v2/service/sts
-        github.com/aws/aws-sdk-go-v2/aws/ratelimit                   from github.com/aws/aws-sdk-go-v2/aws/retry
-        github.com/aws/aws-sdk-go-v2/aws/retry                       from github.com/aws/aws-sdk-go-v2/credentials/endpointcreds/internal/client+
-        github.com/aws/aws-sdk-go-v2/aws/signer/internal/v4          from github.com/aws/aws-sdk-go-v2/aws/signer/v4
-        github.com/aws/aws-sdk-go-v2/aws/signer/v4                   from github.com/aws/aws-sdk-go-v2/internal/auth/smithy+
-        github.com/aws/aws-sdk-go-v2/aws/transport/http              from github.com/aws/aws-sdk-go-v2/config+
-        github.com/aws/aws-sdk-go-v2/config                          from tailscale.com/wif
-        github.com/aws/aws-sdk-go-v2/credentials                     from github.com/aws/aws-sdk-go-v2/config
-        github.com/aws/aws-sdk-go-v2/credentials/ec2rolecreds        from github.com/aws/aws-sdk-go-v2/config
-        github.com/aws/aws-sdk-go-v2/credentials/endpointcreds       from github.com/aws/aws-sdk-go-v2/config
-        github.com/aws/aws-sdk-go-v2/credentials/endpointcreds/internal/client from github.com/aws/aws-sdk-go-v2/credentials/endpointcreds
-        github.com/aws/aws-sdk-go-v2/credentials/processcreds        from github.com/aws/aws-sdk-go-v2/config
-        github.com/aws/aws-sdk-go-v2/credentials/ssocreds            from github.com/aws/aws-sdk-go-v2/config
-        github.com/aws/aws-sdk-go-v2/credentials/stscreds            from github.com/aws/aws-sdk-go-v2/config
-        github.com/aws/aws-sdk-go-v2/feature/ec2/imds                from github.com/aws/aws-sdk-go-v2/config+
-        github.com/aws/aws-sdk-go-v2/feature/ec2/imds/internal/config from github.com/aws/aws-sdk-go-v2/feature/ec2/imds
-        github.com/aws/aws-sdk-go-v2/internal/auth                   from github.com/aws/aws-sdk-go-v2/aws/signer/v4+
-        github.com/aws/aws-sdk-go-v2/internal/auth/smithy            from github.com/aws/aws-sdk-go-v2/service/sso+
-        github.com/aws/aws-sdk-go-v2/internal/configsources          from github.com/aws/aws-sdk-go-v2/service/sso+
-        github.com/aws/aws-sdk-go-v2/internal/context                from github.com/aws/aws-sdk-go-v2/aws/retry+
-        github.com/aws/aws-sdk-go-v2/internal/endpoints              from github.com/aws/aws-sdk-go-v2/service/sso+
-        github.com/aws/aws-sdk-go-v2/internal/endpoints/awsrulesfn   from github.com/aws/aws-sdk-go-v2/service/sso+
-        github.com/aws/aws-sdk-go-v2/internal/endpoints/v2           from github.com/aws/aws-sdk-go-v2/service/sso/internal/endpoints+
-        github.com/aws/aws-sdk-go-v2/internal/ini                    from github.com/aws/aws-sdk-go-v2/config
-        github.com/aws/aws-sdk-go-v2/internal/middleware             from github.com/aws/aws-sdk-go-v2/service/sso+
-        github.com/aws/aws-sdk-go-v2/internal/rand                   from github.com/aws/aws-sdk-go-v2/aws+
-        github.com/aws/aws-sdk-go-v2/internal/sdk                    from github.com/aws/aws-sdk-go-v2/aws+
-        github.com/aws/aws-sdk-go-v2/internal/sdkio                  from github.com/aws/aws-sdk-go-v2/credentials/processcreds
-        github.com/aws/aws-sdk-go-v2/internal/shareddefaults         from github.com/aws/aws-sdk-go-v2/config+
-        github.com/aws/aws-sdk-go-v2/internal/strings                from github.com/aws/aws-sdk-go-v2/aws/signer/internal/v4
-        github.com/aws/aws-sdk-go-v2/internal/sync/singleflight      from github.com/aws/aws-sdk-go-v2/aws
-        github.com/aws/aws-sdk-go-v2/internal/timeconv               from github.com/aws/aws-sdk-go-v2/aws/retry
-        github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding from github.com/aws/aws-sdk-go-v2/service/sts
-        github.com/aws/aws-sdk-go-v2/service/internal/presigned-url  from github.com/aws/aws-sdk-go-v2/service/sts
-        github.com/aws/aws-sdk-go-v2/service/sso                     from github.com/aws/aws-sdk-go-v2/config+
-        github.com/aws/aws-sdk-go-v2/service/sso/internal/endpoints  from github.com/aws/aws-sdk-go-v2/service/sso
-        github.com/aws/aws-sdk-go-v2/service/sso/types               from github.com/aws/aws-sdk-go-v2/service/sso
-        github.com/aws/aws-sdk-go-v2/service/ssooidc                 from github.com/aws/aws-sdk-go-v2/config+
-        github.com/aws/aws-sdk-go-v2/service/ssooidc/internal/endpoints from github.com/aws/aws-sdk-go-v2/service/ssooidc
-        github.com/aws/aws-sdk-go-v2/service/ssooidc/types           from github.com/aws/aws-sdk-go-v2/service/ssooidc
-        github.com/aws/aws-sdk-go-v2/service/sts                     from github.com/aws/aws-sdk-go-v2/config+
-        github.com/aws/aws-sdk-go-v2/service/sts/internal/endpoints  from github.com/aws/aws-sdk-go-v2/service/sts
-        github.com/aws/aws-sdk-go-v2/service/sts/types               from github.com/aws/aws-sdk-go-v2/credentials/stscreds+
-        github.com/aws/smithy-go                                     from github.com/aws/aws-sdk-go-v2/aws/protocol/restjson+
-        github.com/aws/smithy-go/auth                                from github.com/aws/aws-sdk-go-v2/internal/auth+
-        github.com/aws/smithy-go/auth/bearer                         from github.com/aws/aws-sdk-go-v2/aws+
-        github.com/aws/smithy-go/context                             from github.com/aws/smithy-go/auth/bearer
-        github.com/aws/smithy-go/document                            from github.com/aws/aws-sdk-go-v2/service/sso+
-        github.com/aws/smithy-go/encoding                            from github.com/aws/smithy-go/encoding/json+
-        github.com/aws/smithy-go/encoding/httpbinding                from github.com/aws/aws-sdk-go-v2/aws/protocol/query+
-        github.com/aws/smithy-go/encoding/json                       from github.com/aws/aws-sdk-go-v2/service/ssooidc
-        github.com/aws/smithy-go/encoding/xml                        from github.com/aws/aws-sdk-go-v2/service/sts
-        github.com/aws/smithy-go/endpoints                           from github.com/aws/aws-sdk-go-v2/service/sso+
-        github.com/aws/smithy-go/endpoints/private/rulesfn           from github.com/aws/aws-sdk-go-v2/service/sts
-        github.com/aws/smithy-go/internal/sync/singleflight          from github.com/aws/smithy-go/auth/bearer
-        github.com/aws/smithy-go/io                                  from github.com/aws/aws-sdk-go-v2/feature/ec2/imds+
-        github.com/aws/smithy-go/logging                             from github.com/aws/aws-sdk-go-v2/aws+
-        github.com/aws/smithy-go/metrics                             from github.com/aws/aws-sdk-go-v2/aws/retry+
-        github.com/aws/smithy-go/middleware                          from github.com/aws/aws-sdk-go-v2/aws+
-        github.com/aws/smithy-go/private/requestcompression          from github.com/aws/aws-sdk-go-v2/config
-        github.com/aws/smithy-go/ptr                                 from github.com/aws/aws-sdk-go-v2/aws+
-        github.com/aws/smithy-go/rand                                from github.com/aws/aws-sdk-go-v2/aws/middleware
-        github.com/aws/smithy-go/time                                from github.com/aws/aws-sdk-go-v2/service/sso+
-        github.com/aws/smithy-go/tracing                             from github.com/aws/aws-sdk-go-v2/aws/middleware+
-        github.com/aws/smithy-go/transport/http                      from github.com/aws/aws-sdk-go-v2/aws+
-        github.com/aws/smithy-go/transport/http/internal/io          from github.com/aws/smithy-go/transport/http
         github.com/coder/websocket                                   from tailscale.com/util/eventbus
         github.com/coder/websocket/internal/errd                     from github.com/coder/websocket
         github.com/coder/websocket/internal/util                     from github.com/coder/websocket
-        github.com/coder/websocket/internal/xsync                    from github.com/coder/websocket
         github.com/creachadair/msync/trigger                         from tailscale.com/logtail
    W 💣 github.com/dblohm7/wingoes                                   from tailscale.com/net/tshttpproxy+
    W 💣 github.com/dblohm7/wingoes/com                               from tailscale.com/util/osdiag+
@@ -102,10 +30,10 @@ tailscale.com/cmd/tsidp dependencies: (generated by github.com/tailscale/depawar
         github.com/go-json-experiment/json/internal/jsonopts         from github.com/go-json-experiment/json+
         github.com/go-json-experiment/json/internal/jsonwire         from github.com/go-json-experiment/json+
         github.com/go-json-experiment/json/jsontext                  from github.com/go-json-experiment/json+
+        github.com/go-json-experiment/json/v1                        from tailscale.com/net/routecheck+
    L 💣 github.com/godbus/dbus/v5                                    from tailscale.com/net/dns
         github.com/golang/groupcache/lru                             from tailscale.com/net/dnscache
         github.com/google/btree                                      from gvisor.dev/gvisor/pkg/tcpip/transport/tcp
-   D    github.com/google/uuid                                       from github.com/prometheus-community/pro-bing
         github.com/hdevalence/ed25519consensus                       from tailscale.com/tka
         github.com/huin/goupnp                                       from github.com/huin/goupnp/dcps/internetgateway2+
         github.com/huin/goupnp/dcps/internetgateway2                 from tailscale.com/net/portmapper
@@ -128,15 +56,14 @@ tailscale.com/cmd/tsidp dependencies: (generated by github.com/tailscale/depawar
    L 💣 github.com/mdlayher/socket                                   from github.com/mdlayher/netlink+
      💣 github.com/mitchellh/go-ps                                   from tailscale.com/safesocket
         github.com/pires/go-proxyproto                               from tailscale.com/ipn/ipnlocal
-   D    github.com/prometheus-community/pro-bing                     from tailscale.com/wgengine/netstack
    L 💣 github.com/safchain/ethtool                                  from tailscale.com/net/netkernelconf
-   W 💣 github.com/tailscale/certstore                               from tailscale.com/control/controlclient
+  DW 💣 github.com/tailscale/certstore                               from tailscale.com/control/controlclient
    W 💣 github.com/tailscale/go-winio                                from tailscale.com/safesocket
    W 💣 github.com/tailscale/go-winio/internal/fs                    from github.com/tailscale/go-winio
    W 💣 github.com/tailscale/go-winio/internal/socket                from github.com/tailscale/go-winio
    W    github.com/tailscale/go-winio/internal/stringbuffer          from github.com/tailscale/go-winio/internal/fs
    W    github.com/tailscale/go-winio/pkg/guid                       from github.com/tailscale/go-winio+
-        github.com/tailscale/hujson                                  from tailscale.com/ipn/conffile
+        github.com/tailscale/hujson                                  from tailscale.com/ipn/conffile+
   LD    github.com/tailscale/peercred                                from tailscale.com/ipn/ipnauth
         github.com/tailscale/web-client-prebuilt                     from tailscale.com/client/web
      💣 github.com/tailscale/wireguard-go/conn                       from github.com/tailscale/wireguard-go/device+
@@ -220,17 +147,18 @@ tailscale.com/cmd/tsidp dependencies: (generated by github.com/tailscale/depawar
         tailscale.com/envknob                                        from tailscale.com/client/local+
         tailscale.com/envknob/featureknob                            from tailscale.com/client/web+
         tailscale.com/feature                                        from tailscale.com/ipn/ipnext+
+        tailscale.com/feature/acme                                   from tailscale.com/tsnet
         tailscale.com/feature/buildfeatures                          from tailscale.com/wgengine/magicsock+
         tailscale.com/feature/c2n                                    from tailscale.com/tsnet
         tailscale.com/feature/condlite/expvar                        from tailscale.com/wgengine/magicsock
-        tailscale.com/feature/condregister/identityfederation        from tailscale.com/tsnet
+        tailscale.com/feature/condregister/netlog                    from tailscale.com/tsnet
         tailscale.com/feature/condregister/oauthkey                  from tailscale.com/tsnet
         tailscale.com/feature/condregister/portmapper                from tailscale.com/tsnet
         tailscale.com/feature/condregister/useproxy                  from tailscale.com/tsnet
-        tailscale.com/feature/identityfederation                     from tailscale.com/feature/condregister/identityfederation
+        tailscale.com/feature/netlog                                 from tailscale.com/feature/condregister/netlog
         tailscale.com/feature/oauthkey                               from tailscale.com/feature/condregister/oauthkey
         tailscale.com/feature/portmapper                             from tailscale.com/feature/condregister/portmapper
-        tailscale.com/feature/syspolicy                              from tailscale.com/logpolicy
+        tailscale.com/feature/serviceclientprefs/serviceclient       from tailscale.com/client/local
         tailscale.com/feature/useproxy                               from tailscale.com/feature/condregister/useproxy
         tailscale.com/health                                         from tailscale.com/control/controlclient+
         tailscale.com/health/healthmsg                               from tailscale.com/ipn/ipnlocal
@@ -244,7 +172,7 @@ tailscale.com/cmd/tsidp dependencies: (generated by github.com/tailscale/depawar
         tailscale.com/ipn/ipnlocal/netmapcache                       from tailscale.com/ipn/ipnlocal
         tailscale.com/ipn/ipnstate                                   from tailscale.com/client/local+
         tailscale.com/ipn/localapi                                   from tailscale.com/tsnet
-        tailscale.com/ipn/store                                      from tailscale.com/ipn/ipnlocal+
+        tailscale.com/ipn/store                                      from tailscale.com/tsnet+
         tailscale.com/ipn/store/mem                                  from tailscale.com/ipn/ipnlocal+
         tailscale.com/kube/kubetypes                                 from tailscale.com/envknob
         tailscale.com/licenses                                       from tailscale.com/client/web
@@ -254,9 +182,8 @@ tailscale.com/cmd/tsidp dependencies: (generated by github.com/tailscale/depawar
         tailscale.com/logtail                                        from tailscale.com/control/controlclient+
         tailscale.com/logtail/filch                                  from tailscale.com/log/sockstatlog+
         tailscale.com/metrics                                        from tailscale.com/tsweb+
-        tailscale.com/net/bakedroots                                 from tailscale.com/ipn/ipnlocal+
+        tailscale.com/net/bakedroots                                 from tailscale.com/net/tlsdial+
      💣 tailscale.com/net/batching                                   from tailscale.com/wgengine/magicsock
-        tailscale.com/net/captivedetection                           from tailscale.com/ipn/ipnlocal+
         tailscale.com/net/dns                                        from tailscale.com/ipn/ipnlocal+
         tailscale.com/net/dns/publicdns                              from tailscale.com/net/dns+
         tailscale.com/net/dns/resolvconffile                         from tailscale.com/net/dns+
@@ -267,7 +194,7 @@ tailscale.com/cmd/tsidp dependencies: (generated by github.com/tailscale/depawar
         tailscale.com/net/ipset                                      from tailscale.com/ipn/ipnlocal+
         tailscale.com/net/memnet                                     from tailscale.com/tsnet
         tailscale.com/net/netaddr                                    from tailscale.com/ipn+
-        tailscale.com/net/netcheck                                   from tailscale.com/ipn/ipnlocal+
+        tailscale.com/net/netcheck                                   from tailscale.com/wgengine/magicsock
         tailscale.com/net/neterror                                   from tailscale.com/net/dns/resolver+
         tailscale.com/net/netkernelconf                              from tailscale.com/ipn/ipnlocal
         tailscale.com/net/netknob                                    from tailscale.com/logpolicy+
@@ -281,12 +208,16 @@ tailscale.com/cmd/tsidp dependencies: (generated by github.com/tailscale/depawar
         tailscale.com/net/portmapper                                 from tailscale.com/feature/portmapper
         tailscale.com/net/portmapper/portmappertype                  from tailscale.com/net/netcheck+
         tailscale.com/net/proxymux                                   from tailscale.com/tsnet
+        tailscale.com/net/routecheck                                 from tailscale.com/client/local+
+        tailscale.com/net/routecheck/peernode                        from tailscale.com/ipn/ipnlocal+
+        tailscale.com/net/routemanager                               from tailscale.com/ipn/ipnlocal+
      💣 tailscale.com/net/sockopts                                   from tailscale.com/wgengine/magicsock
         tailscale.com/net/socks5                                     from tailscale.com/tsnet
         tailscale.com/net/sockstats                                  from tailscale.com/control/controlclient+
         tailscale.com/net/stun                                       from tailscale.com/ipn/localapi+
         tailscale.com/net/tlsdial                                    from tailscale.com/control/controlclient+
         tailscale.com/net/tlsdial/blockblame                         from tailscale.com/net/tlsdial
+        tailscale.com/net/traffic                                    from tailscale.com/ipn/ipnlocal+
         tailscale.com/net/tsaddr                                     from tailscale.com/client/web+
         tailscale.com/net/tsdial                                     from tailscale.com/control/controlclient+
      💣 tailscale.com/net/tshttpproxy                                from tailscale.com/feature/useproxy
@@ -299,7 +230,7 @@ tailscale.com/cmd/tsidp dependencies: (generated by github.com/tailscale/depawar
      💣 tailscale.com/safesocket                                     from tailscale.com/client/local+
         tailscale.com/syncs                                          from tailscale.com/control/controlhttp+
         tailscale.com/tailcfg                                        from tailscale.com/client/local+
-        tailscale.com/tempfork/acme                                  from tailscale.com/ipn/ipnlocal
+        tailscale.com/tempfork/acme                                  from tailscale.com/feature/acme
         tailscale.com/tempfork/heap                                  from tailscale.com/wgengine/magicsock
         tailscale.com/tempfork/httprec                               from tailscale.com/feature/c2n
         tailscale.com/tka                                            from tailscale.com/client/local+
@@ -309,7 +240,7 @@ tailscale.com/cmd/tsidp dependencies: (generated by github.com/tailscale/depawar
         tailscale.com/tstime                                         from tailscale.com/control/controlclient+
         tailscale.com/tstime/mono                                    from tailscale.com/net/tstun+
         tailscale.com/tstime/rate                                    from tailscale.com/wgengine/filter
-        tailscale.com/tsweb                                          from tailscale.com/util/eventbus
+        tailscale.com/tsweb                                          from tailscale.com/util/eventbus+
         tailscale.com/tsweb/varz                                     from tailscale.com/tsweb+
         tailscale.com/types/appctype                                 from tailscale.com/ipn/ipnlocal+
         tailscale.com/types/bools                                    from tailscale.com/tsnet+
@@ -321,7 +252,7 @@ tailscale.com/cmd/tsidp dependencies: (generated by github.com/tailscale/depawar
         tailscale.com/types/lazy                                     from tailscale.com/cmd/tsidp+
         tailscale.com/types/logger                                   from tailscale.com/appc+
         tailscale.com/types/logid                                    from tailscale.com/ipn/ipnlocal+
-        tailscale.com/types/mapx                                     from tailscale.com/ipn/ipnext
+        tailscale.com/types/mapx                                     from tailscale.com/ipn/ipnext+
         tailscale.com/types/netlogfunc                               from tailscale.com/net/tstun+
         tailscale.com/types/netlogtype                               from tailscale.com/wgengine/netlog
         tailscale.com/types/netmap                                   from tailscale.com/control/controlclient+
@@ -343,6 +274,7 @@ tailscale.com/cmd/tsidp dependencies: (generated by github.com/tailscale/depawar
   LW    tailscale.com/util/cmpver                                    from tailscale.com/net/dns+
         tailscale.com/util/ctxkey                                    from tailscale.com/client/tailscale/apitype+
      💣 tailscale.com/util/deephash                                  from tailscale.com/util/syspolicy/setting
+        tailscale.com/util/def                                       from tailscale.com/ipn/localapi
    L 💣 tailscale.com/util/dirwalk                                   from tailscale.com/metrics
         tailscale.com/util/dnsname                                   from tailscale.com/appc+
         tailscale.com/util/eventbus                                  from tailscale.com/client/local+
@@ -365,16 +297,15 @@ tailscale.com/cmd/tsidp dependencies: (generated by github.com/tailscale/depawar
         tailscale.com/util/set                                       from tailscale.com/control/controlclient+
         tailscale.com/util/singleflight                              from tailscale.com/control/controlclient+
         tailscale.com/util/slicesx                                   from tailscale.com/appc+
-        tailscale.com/util/syspolicy                                 from tailscale.com/feature/syspolicy
-        tailscale.com/util/syspolicy/internal                        from tailscale.com/util/syspolicy+
-        tailscale.com/util/syspolicy/internal/loggerx                from tailscale.com/util/syspolicy+
+        tailscale.com/util/syspolicy/internal                        from tailscale.com/util/syspolicy/internal/metrics+
+        tailscale.com/util/syspolicy/internal/loggerx                from tailscale.com/util/syspolicy/internal/metrics+
         tailscale.com/util/syspolicy/internal/metrics                from tailscale.com/util/syspolicy/source
         tailscale.com/util/syspolicy/pkey                            from tailscale.com/control/controlclient+
         tailscale.com/util/syspolicy/policyclient                    from tailscale.com/control/controlclient+
-        tailscale.com/util/syspolicy/ptype                           from tailscale.com/util/syspolicy+
-        tailscale.com/util/syspolicy/rsop                            from tailscale.com/ipn/localapi+
+        tailscale.com/util/syspolicy/ptype                           from tailscale.com/ipn/ipnlocal+
+        tailscale.com/util/syspolicy/rsop                            from tailscale.com/ipn/localapi
         tailscale.com/util/syspolicy/setting                         from tailscale.com/client/local+
-        tailscale.com/util/syspolicy/source                          from tailscale.com/util/syspolicy+
+        tailscale.com/util/syspolicy/source                          from tailscale.com/util/syspolicy/rsop
         tailscale.com/util/testenv                                   from tailscale.com/control/controlclient+
         tailscale.com/util/truncate                                  from tailscale.com/logtail
         tailscale.com/util/usermetric                                from tailscale.com/health+
@@ -391,15 +322,13 @@ tailscale.com/cmd/tsidp dependencies: (generated by github.com/tailscale/depawar
         tailscale.com/wgengine/filter                                from tailscale.com/control/controlclient+
         tailscale.com/wgengine/filter/filtertype                     from tailscale.com/types/netmap+
      💣 tailscale.com/wgengine/magicsock                             from tailscale.com/ipn/ipnlocal+
-        tailscale.com/wgengine/netlog                                from tailscale.com/wgengine
+        tailscale.com/wgengine/netlog                                from tailscale.com/feature/netlog
         tailscale.com/wgengine/netstack                              from tailscale.com/tsnet
         tailscale.com/wgengine/netstack/gro                          from tailscale.com/net/tstun+
         tailscale.com/wgengine/router                                from tailscale.com/ipn/ipnlocal+
         tailscale.com/wgengine/wgcfg                                 from tailscale.com/ipn/ipnlocal+
-        tailscale.com/wgengine/wgcfg/nmcfg                           from tailscale.com/ipn/ipnlocal
      💣 tailscale.com/wgengine/wgint                                 from tailscale.com/wgengine+
         tailscale.com/wgengine/wglog                                 from tailscale.com/wgengine
-        tailscale.com/wif                                            from tailscale.com/feature/identityfederation
         golang.org/x/crypto/argon2                                   from tailscale.com/tka
         golang.org/x/crypto/blake2b                                  from golang.org/x/crypto/argon2+
         golang.org/x/crypto/blake2s                                  from github.com/tailscale/wireguard-go/device+
@@ -421,16 +350,16 @@ tailscale.com/cmd/tsidp dependencies: (generated by github.com/tailscale/depawar
         golang.org/x/net/dns/dnsmessage                              from tailscale.com/appc+
         golang.org/x/net/http/httpguts                               from tailscale.com/ipn/ipnlocal
         golang.org/x/net/http/httpproxy                              from tailscale.com/net/tshttpproxy
-        golang.org/x/net/icmp                                        from github.com/prometheus-community/pro-bing+
+        golang.org/x/net/icmp                                        from tailscale.com/net/ping
         golang.org/x/net/idna                                        from golang.org/x/net/http/httpguts+
         golang.org/x/net/internal/iana                               from golang.org/x/net/icmp+
-        golang.org/x/net/internal/socket                             from golang.org/x/net/icmp+
+        golang.org/x/net/internal/socket                             from golang.org/x/net/ipv4+
         golang.org/x/net/internal/socks                              from golang.org/x/net/proxy
-        golang.org/x/net/ipv4                                        from github.com/prometheus-community/pro-bing+
-        golang.org/x/net/ipv6                                        from github.com/prometheus-community/pro-bing+
+        golang.org/x/net/ipv4                                        from github.com/tailscale/wireguard-go/conn+
+        golang.org/x/net/ipv6                                        from github.com/tailscale/wireguard-go/conn+
         golang.org/x/net/proxy                                       from tailscale.com/net/netns
    D    golang.org/x/net/route                                       from tailscale.com/net/netmon+
-        golang.org/x/oauth2                                          from golang.org/x/oauth2/clientcredentials+
+        golang.org/x/oauth2                                          from golang.org/x/oauth2/clientcredentials
         golang.org/x/oauth2/clientcredentials                        from tailscale.com/feature/oauthkey
         golang.org/x/oauth2/internal                                 from golang.org/x/oauth2+
         golang.org/x/sync/errgroup                                   from github.com/mdlayher/socket+
@@ -488,23 +417,24 @@ tailscale.com/cmd/tsidp dependencies: (generated by github.com/tailscale/depawar
         crypto/internal/boring/bbig                                  from crypto/ecdsa+
         crypto/internal/boring/sig                                   from crypto/internal/boring
         crypto/internal/constanttime                                 from crypto/internal/fips140/edwards25519+
-        crypto/internal/fips140                                      from crypto/internal/fips140/aes+
+        crypto/internal/fips140                                      from crypto/fips140+
         crypto/internal/fips140/aes                                  from crypto/aes+
         crypto/internal/fips140/aes/gcm                              from crypto/cipher+
         crypto/internal/fips140/alias                                from crypto/cipher+
         crypto/internal/fips140/bigmod                               from crypto/internal/fips140/ecdsa+
-        crypto/internal/fips140/check                                from crypto/internal/fips140/aes+
-        crypto/internal/fips140/drbg                                 from crypto/internal/fips140/aes/gcm+
+        crypto/internal/fips140/check                                from crypto/fips140+
+        crypto/internal/fips140/drbg                                 from crypto/hpke+
         crypto/internal/fips140/ecdh                                 from crypto/ecdh
         crypto/internal/fips140/ecdsa                                from crypto/ecdsa
         crypto/internal/fips140/ed25519                              from crypto/ed25519
         crypto/internal/fips140/edwards25519                         from crypto/internal/fips140/ed25519
         crypto/internal/fips140/edwards25519/field                   from crypto/ecdh+
-        crypto/internal/fips140/hkdf                                 from crypto/internal/fips140/tls13+
+        crypto/internal/fips140/hkdf                                 from crypto/hkdf+
         crypto/internal/fips140/hmac                                 from crypto/hmac+
         crypto/internal/fips140/mlkem                                from crypto/mlkem
-        crypto/internal/fips140/nistec                               from crypto/elliptic+
+        crypto/internal/fips140/nistec                               from crypto/ecdsa+
         crypto/internal/fips140/nistec/fiat                          from crypto/internal/fips140/nistec
+        crypto/internal/fips140/pbkdf2                               from crypto/pbkdf2
         crypto/internal/fips140/rsa                                  from crypto/rsa
         crypto/internal/fips140/sha256                               from crypto/internal/fips140/check+
         crypto/internal/fips140/sha3                                 from crypto/internal/fips140/hmac+
@@ -525,6 +455,7 @@ tailscale.com/cmd/tsidp dependencies: (generated by github.com/tailscale/depawar
         crypto/internal/sysrand                                      from crypto/internal/fips140/drbg
         crypto/md5                                                   from crypto/tls+
         crypto/mlkem                                                 from crypto/hpke+
+        crypto/pbkdf2                                                from golang.org/x/crypto/pbkdf2
         crypto/rand                                                  from crypto/ed25519+
         crypto/rc4                                                   from crypto/tls
         crypto/rsa                                                   from crypto/tls+
@@ -533,12 +464,11 @@ tailscale.com/cmd/tsidp dependencies: (generated by github.com/tailscale/depawar
         crypto/sha3                                                  from crypto/internal/fips140hash+
         crypto/sha512                                                from crypto/ecdsa+
         crypto/subtle                                                from crypto/cipher+
-        crypto/tls                                                   from github.com/prometheus-community/pro-bing+
+        crypto/tls                                                   from net/http+
         crypto/tls/internal/fips140tls                               from crypto/tls
         crypto/x509                                                  from crypto/tls+
    D    crypto/x509/internal/macos                                   from crypto/x509
         crypto/x509/pkix                                             from crypto/x509+
-   D    database/sql/driver                                          from github.com/google/uuid
    W    debug/dwarf                                                  from debug/pe
    W    debug/pe                                                     from github.com/dblohm7/wingoes/pe
         embed                                                        from github.com/tailscale/web-client-prebuilt+
@@ -558,6 +488,7 @@ tailscale.com/cmd/tsidp dependencies: (generated by github.com/tailscale/depawar
         hash                                                         from crypto+
    W    hash/adler32                                                 from compress/zlib
         hash/crc32                                                   from compress/gzip+
+        hash/fnv                                                     from tailscale.com/net/traffic
         hash/maphash                                                 from go4.org/mem
         html                                                         from html/template+
         html/template                                                from tailscale.com/util/eventbus+
@@ -572,13 +503,13 @@ tailscale.com/cmd/tsidp dependencies: (generated by github.com/tailscale/depawar
         internal/filepathlite                                        from os+
         internal/fmtsort                                             from fmt+
         internal/goarch                                              from crypto/internal/fips140deps/cpu+
-        internal/godebug                                             from crypto/internal/fips140deps/godebug+
+        internal/godebug                                             from crypto/ed25519+
         internal/godebugs                                            from internal/godebug+
         internal/goexperiment                                        from net/http/pprof+
         internal/goos                                                from crypto/x509+
         internal/msan                                                from internal/runtime/maps+
         internal/nettrace                                            from net+
-        internal/oserror                                             from io/fs+
+        internal/oserror                                             from internal/syscall/windows+
         internal/poll                                                from net+
         internal/profile                                             from net/http/pprof
         internal/profilerecord                                       from runtime+
@@ -588,9 +519,9 @@ tailscale.com/cmd/tsidp dependencies: (generated by github.com/tailscale/depawar
         internal/runtime/atomic                                      from internal/runtime/exithook+
    L    internal/runtime/cgroup                                      from runtime
         internal/runtime/exithook                                    from runtime
-        internal/runtime/gc                                          from runtime+
+        internal/runtime/gc                                          from internal/runtime/gc/scan+
         internal/runtime/gc/scan                                     from runtime
-        internal/runtime/maps                                        from reflect+
+        internal/runtime/maps                                        from hash/maphash+
         internal/runtime/math                                        from internal/runtime/maps+
         internal/runtime/pprof/label                                 from runtime+
         internal/runtime/sys                                         from crypto/subtle+
@@ -604,7 +535,7 @@ tailscale.com/cmd/tsidp dependencies: (generated by github.com/tailscale/depawar
         internal/synctest                                            from sync
         internal/syscall/execenv                                     from os+
   LD    internal/syscall/unix                                        from crypto/internal/sysrand+
-   W    internal/syscall/windows                                     from crypto/internal/sysrand+
+   W    internal/syscall/windows                                     from crypto/internal/fips140deps/time+
    W    internal/syscall/windows/registry                            from mime+
    W    internal/syscall/windows/sysdll                              from internal/syscall/windows+
         internal/testlog                                             from os
@@ -612,7 +543,7 @@ tailscale.com/cmd/tsidp dependencies: (generated by github.com/tailscale/depawar
         internal/unsafeheader                                        from internal/reflectlite+
         io                                                           from bufio+
         io/fs                                                        from crypto/x509+
-        io/ioutil                                                    from github.com/godbus/dbus/v5+
+        io/ioutil                                                    from github.com/huin/goupnp/soap+
         iter                                                         from bytes+
         log                                                          from expvar+
         log/internal                                                 from log
@@ -627,7 +558,7 @@ tailscale.com/cmd/tsidp dependencies: (generated by github.com/tailscale/depawar
         mime/quotedprintable                                         from mime/multipart
         net                                                          from crypto/tls+
         net/http                                                     from expvar+
-        net/http/httptrace                                           from github.com/prometheus-community/pro-bing+
+        net/http/httptrace                                           from net/http+
         net/http/httputil                                            from tailscale.com/client/web+
         net/http/internal                                            from net/http+
         net/http/internal/ascii                                      from net/http+
@@ -642,11 +573,11 @@ tailscale.com/cmd/tsidp dependencies: (generated by github.com/tailscale/depawar
         os/user                                                      from github.com/godbus/dbus/v5+
         path                                                         from debug/dwarf+
         path/filepath                                                from crypto/x509+
-        reflect                                                      from database/sql/driver+
+        reflect                                                      from encoding/asn1+
         regexp                                                       from github.com/huin/goupnp/httpu+
         regexp/syntax                                                from regexp
         runtime                                                      from crypto/internal/fips140+
-        runtime/debug                                                from github.com/coder/websocket/internal/xsync+
+        runtime/debug                                                from github.com/klauspost/compress/zstd+
         runtime/pprof                                                from net/http/pprof+
         runtime/trace                                                from net/http/pprof
         slices                                                       from crypto/tls+
diff --git a/cmd/tsidp/tsidp.go b/cmd/tsidp/tsidp.go
index d6dfc7900..24c823d71 100644
--- a/cmd/tsidp/tsidp.go
+++ b/cmd/tsidp/tsidp.go
@@ -1403,7 +1403,7 @@ func readUint64(r io.Reader) (uint64, error) {
 	}
 }
 
-// rsaPrivateKeyJSONWrapper is the the JSON serialization
+// rsaPrivateKeyJSONWrapper is the JSON serialization
 // format used by RSAPrivateKey.
 type rsaPrivateKeyJSONWrapper struct {
 	Key string
diff --git a/cmd/tsnet-proxy/tsnet-proxy.go b/cmd/tsnet-proxy/tsnet-proxy.go
new file mode 100644
index 000000000..0a83fd1a8
--- /dev/null
+++ b/cmd/tsnet-proxy/tsnet-proxy.go
@@ -0,0 +1,173 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// The tsnet-proxy command exposes a local port on the tailnet under a
+// chosen hostname. By default it proxies raw TCP; pass --http to reverse
+// proxy as HTTP, or --https to reverse proxy as HTTPS with an auto-issued
+// Tailscale cert. Both HTTP modes inject Tailscale-User-* identity headers
+// from WhoIs.
+//
+// Arguments are <name> <local> [tailnet]: local is the port on localhost
+// to proxy to and tailnet is the port to expose on the tailnet. If tailnet
+// is omitted, it defaults to 443 for --https, 80 for --http, and the local
+// port otherwise.
+//
+//	go run ./cmd/tsnet-proxy myapp 8080           # raw TCP, tailnet :8080
+//	go run ./cmd/tsnet-proxy myapp 22 2222        # raw TCP, tailnet :2222
+//	go run ./cmd/tsnet-proxy --http myapp 8080    # tailnet :80
+//	go run ./cmd/tsnet-proxy --https myapp 8080   # tailnet :443
+//
+// Or run directly from the module, no checkout required:
+//
+//	go run tailscale.com/cmd/tsnet-proxy@latest myapp 8080
+package main
+
+import (
+	"flag"
+	"fmt"
+	"io"
+	"log"
+	"mime"
+	"net"
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+	"os"
+	"strconv"
+	"unicode/utf8"
+
+	"tailscale.com/client/local"
+	"tailscale.com/tsnet"
+)
+
+func main() {
+	asHTTP := flag.Bool("http", false, "reverse proxy as HTTP and inject Tailscale-User-* headers")
+	asHTTPS := flag.Bool("https", false, "reverse proxy as HTTPS with an auto-issued Tailscale cert; implies --http")
+	dir := flag.String("dir", "", "directory to persist tsnet state (default: per-user config dir)")
+	verbose := flag.Bool("v", false, "verbose tsnet backend logs")
+	flag.Usage = func() {
+		fmt.Fprintf(flag.CommandLine.Output(), "usage: %s [flags] <name> <local> [tailnet]\n", flag.CommandLine.Name())
+		flag.PrintDefaults()
+	}
+	flag.Parse()
+
+	if n := flag.NArg(); n != 2 && n != 3 {
+		flag.Usage()
+		os.Exit(2)
+	}
+	name := flag.Arg(0)
+	localPort, err := parsePort(flag.Arg(1))
+	if err != nil {
+		log.Fatalf("invalid local port %q: %v", flag.Arg(1), err)
+	}
+	tailnetPort := defaultTailnetPort(localPort, *asHTTP, *asHTTPS)
+	if flag.NArg() == 3 {
+		tailnetPort, err = parsePort(flag.Arg(2))
+		if err != nil {
+			log.Fatalf("invalid tailnet port %q: %v", flag.Arg(2), err)
+		}
+	}
+
+	target := "localhost:" + strconv.Itoa(localPort)
+	addr := ":" + strconv.Itoa(tailnetPort)
+
+	s := &tsnet.Server{Hostname: name, Dir: *dir}
+	if *verbose {
+		s.Logf = log.Printf
+	}
+	defer s.Close()
+
+	var ln net.Listener
+	if *asHTTPS {
+		ln, err = s.ListenTLS("tcp", addr)
+	} else {
+		ln, err = s.Listen("tcp", addr)
+	}
+	if err != nil {
+		log.Fatal(err)
+	}
+	defer ln.Close()
+
+	log.Printf("proxying %s -> %s on tailnet", target, name+addr)
+
+	if *asHTTP || *asHTTPS {
+		lc, err := s.LocalClient()
+		if err != nil {
+			log.Fatal(err)
+		}
+		targetURL := &url.URL{Scheme: "http", Host: target}
+		rp := &httputil.ReverseProxy{
+			Rewrite: func(r *httputil.ProxyRequest) {
+				r.SetURL(targetURL)
+				r.SetXForwarded()
+				addTailscaleIdentityHeaders(lc, r)
+			},
+		}
+		log.Fatal(http.Serve(ln, rp))
+	}
+
+	for {
+		c, err := ln.Accept()
+		if err != nil {
+			log.Fatal(err)
+		}
+		go proxyTCP(c, target)
+	}
+}
+
+func parsePort(s string) (int, error) {
+	p, err := strconv.Atoi(s)
+	if err != nil || p <= 0 || p > 65535 {
+		return 0, fmt.Errorf("bad port")
+	}
+	return p, nil
+}
+
+// defaultTailnetPort returns the tailnet port when the user didn't
+// specify one: 443 for HTTPS, 80 for HTTP, else the local port.
+func defaultTailnetPort(local int, asHTTP, asHTTPS bool) int {
+	switch {
+	case asHTTPS:
+		return 443
+	case asHTTP:
+		return 80
+	}
+	return local
+}
+
+func proxyTCP(c net.Conn, target string) {
+	defer c.Close()
+	d, err := net.Dial("tcp", target)
+	if err != nil {
+		log.Printf("dial %s: %v", target, err)
+		return
+	}
+	defer d.Close()
+	go io.Copy(d, c)
+	io.Copy(c, d)
+}
+
+func addTailscaleIdentityHeaders(lc *local.Client, r *httputil.ProxyRequest) {
+	r.Out.Header.Del("Tailscale-User-Login")
+	r.Out.Header.Del("Tailscale-User-Name")
+	r.Out.Header.Del("Tailscale-User-Profile-Pic")
+	r.Out.Header.Del("Tailscale-Funnel-Request")
+	r.Out.Header.Del("Tailscale-Headers-Info")
+
+	who, err := lc.WhoIs(r.In.Context(), r.In.RemoteAddr)
+	if err != nil || who == nil || who.Node.IsTagged() {
+		return
+	}
+	r.Out.Header.Set("Tailscale-User-Login", encHeader(who.UserProfile.LoginName))
+	r.Out.Header.Set("Tailscale-User-Name", encHeader(who.UserProfile.DisplayName))
+	r.Out.Header.Set("Tailscale-User-Profile-Pic", who.UserProfile.ProfilePicURL)
+}
+
+// encHeader mirrors the encoding tailscaled's serve path applies to
+// user-provided strings destined for HTTP headers.
+func encHeader(v string) string {
+	if !utf8.ValidString(v) {
+		return ""
+	}
+	return mime.QEncoding.Encode("utf-8", v)
+}
diff --git a/cmd/tsp/tsp.go b/cmd/tsp/tsp.go
new file mode 100644
index 000000000..911af72cb
--- /dev/null
+++ b/cmd/tsp/tsp.go
@@ -0,0 +1,513 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Program tsp is a low-level Tailscale protocol tool for performing
+// composable building block operations like generating keys and
+// registering nodes.
+package main
+
+import (
+	"bytes"
+	"cmp"
+	"context"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"os"
+	"reflect"
+	"strings"
+
+	"github.com/peterbourgon/ff/v3/ffcli"
+	"tailscale.com/control/tsp"
+	"tailscale.com/hostinfo"
+	"tailscale.com/tailcfg"
+	"tailscale.com/types/key"
+)
+
+var globalArgs struct {
+	// serverURL is the base URL of the coordination server (-s flag).
+	// If empty, tsp.DefaultServerURL is used.
+	serverURL string
+
+	// controlKeyFile is a path to a file containing the server's
+	// MachinePublic key in MarshalText form (--control-key flag).
+	// When set, server key discovery is skipped.
+	controlKeyFile string
+}
+
+func main() {
+	args := os.Args[1:]
+	if err := rootCmd.Parse(args); err != nil {
+		fmt.Fprintln(os.Stderr, err.Error())
+		os.Exit(1)
+	}
+	err := rootCmd.Run(context.Background())
+	if errors.Is(err, flag.ErrHelp) {
+		os.Exit(0)
+	}
+	if err != nil {
+		fmt.Fprintln(os.Stderr, err.Error())
+		os.Exit(1)
+	}
+}
+
+var rootCmd = &ffcli.Command{
+	Name:       "tsp",
+	ShortUsage: "tsp [-s url] <subcommand> [flags]",
+	ShortHelp:  "Low-level Tailscale protocol tool.",
+	FlagSet: (func() *flag.FlagSet {
+		fs := flag.NewFlagSet("tsp", flag.ExitOnError)
+		fs.StringVar(&globalArgs.serverURL, "s", "", "base URL of coordination server (default: "+tsp.DefaultServerURL+")")
+		fs.StringVar(&globalArgs.controlKeyFile, "control-key", "", "file containing the server's public key (skips discovery)")
+		return fs
+	})(),
+	Subcommands: []*ffcli.Command{
+		newMachineKeyCmd,
+		newNodeKeyCmd,
+		newNodeCmd,
+		registerCmd,
+		mapCmd,
+		discoverServerKeyCmd,
+	},
+	Exec: func(ctx context.Context, args []string) error {
+		return flag.ErrHelp
+	},
+}
+
+var newMachineKeyArgs struct {
+	output string
+}
+
+var newMachineKeyCmd = &ffcli.Command{
+	Name:       "new-machine-key",
+	ShortUsage: "tsp new-machine-key [-o file]",
+	ShortHelp:  "Generate a new machine key.",
+	FlagSet: (func() *flag.FlagSet {
+		fs := flag.NewFlagSet("new-machine-key", flag.ExitOnError)
+		fs.StringVar(&newMachineKeyArgs.output, "o", "", "output file (default: stdout)")
+		return fs
+	})(),
+	Exec: runNewMachineKey,
+}
+
+func runNewMachineKey(ctx context.Context, args []string) error {
+	k := key.NewMachine()
+	text, err := k.MarshalText()
+	if err != nil {
+		return err
+	}
+	text = append(text, '\n')
+	return writeOutput(newMachineKeyArgs.output, text)
+}
+
+var newNodeKeyArgs struct {
+	output string
+}
+
+var newNodeKeyCmd = &ffcli.Command{
+	Name:       "new-node-key",
+	ShortUsage: "tsp new-node-key [-o file]",
+	ShortHelp:  "Generate a new node key.",
+	FlagSet: (func() *flag.FlagSet {
+		fs := flag.NewFlagSet("new-node-key", flag.ExitOnError)
+		fs.StringVar(&newNodeKeyArgs.output, "o", "", "output file (default: stdout)")
+		return fs
+	})(),
+	Exec: runNewNodeKey,
+}
+
+func runNewNodeKey(ctx context.Context, args []string) error {
+	k := key.NewNode()
+	text, err := k.MarshalText()
+	if err != nil {
+		return err
+	}
+	text = append(text, '\n')
+	return writeOutput(newNodeKeyArgs.output, text)
+}
+
+var discoverServerKeyArgs struct {
+	output string
+}
+
+var discoverServerKeyCmd = &ffcli.Command{
+	Name:       "discover-server-key",
+	ShortUsage: "tsp [-s url] discover-server-key [-o file]",
+	ShortHelp:  "Discover and print the coordination server's public key.",
+	FlagSet: (func() *flag.FlagSet {
+		fs := flag.NewFlagSet("discover-server-key", flag.ExitOnError)
+		fs.StringVar(&discoverServerKeyArgs.output, "o", "", "output file (default: stdout)")
+		return fs
+	})(),
+	Exec: runDiscoverServerKey,
+}
+
+func runDiscoverServerKey(ctx context.Context, args []string) error {
+	k, err := tsp.DiscoverServerKey(ctx, globalArgs.serverURL)
+	if err != nil {
+		return err
+	}
+	text, err := k.MarshalText()
+	if err != nil {
+		return fmt.Errorf("marshaling server key: %w", err)
+	}
+	text = append(text, '\n')
+	return writeOutput(discoverServerKeyArgs.output, text)
+}
+
+var newNodeArgs struct {
+	nodeKeyFile    string
+	machineKeyFile string
+	output         string
+}
+
+var newNodeCmd = &ffcli.Command{
+	Name:       "new-node",
+	ShortUsage: "tsp [-s url] [--control-key file] new-node [-n node-key-file] [-m machine-key-file] [-o output]",
+	ShortHelp:  "Generate a new node JSON file with keys and server info.",
+	FlagSet: (func() *flag.FlagSet {
+		fs := flag.NewFlagSet("new-node", flag.ExitOnError)
+		fs.StringVar(&newNodeArgs.nodeKeyFile, "n", "", "existing node key file (default: generate new)")
+		fs.StringVar(&newNodeArgs.machineKeyFile, "m", "", "existing machine key file (default: generate new)")
+		fs.StringVar(&newNodeArgs.output, "o", "", "output file (default: stdout)")
+		return fs
+	})(),
+	Exec: runNewNode,
+}
+
+func runNewNode(ctx context.Context, args []string) error {
+	var nodeKey key.NodePrivate
+	if newNodeArgs.nodeKeyFile != "" {
+		var err error
+		nodeKey, err = readNodeKeyFile(newNodeArgs.nodeKeyFile)
+		if err != nil {
+			return fmt.Errorf("reading node key: %w", err)
+		}
+	} else {
+		nodeKey = key.NewNode()
+	}
+
+	var machineKey key.MachinePrivate
+	if newNodeArgs.machineKeyFile != "" {
+		var err error
+		machineKey, err = readMachineKeyFile(newNodeArgs.machineKeyFile)
+		if err != nil {
+			return fmt.Errorf("reading machine key: %w", err)
+		}
+	} else {
+		machineKey = key.NewMachine()
+	}
+
+	serverURL := cmp.Or(globalArgs.serverURL, tsp.DefaultServerURL)
+
+	var serverKey key.MachinePublic
+	if globalArgs.controlKeyFile != "" {
+		var err error
+		serverKey, err = readControlKeyFile(globalArgs.controlKeyFile)
+		if err != nil {
+			return fmt.Errorf("reading control key: %w", err)
+		}
+	} else {
+		var err error
+		serverKey, err = tsp.DiscoverServerKey(ctx, serverURL)
+		if err != nil {
+			return fmt.Errorf("discovering server key: %w", err)
+		}
+	}
+
+	nf := tsp.NodeFile{
+		NodeKey:    nodeKey,
+		MachineKey: machineKey,
+		ServerInfo: tsp.ServerInfo{URL: serverURL, Key: serverKey},
+	}
+
+	out, err := json.MarshalIndent(nf, "", "  ")
+	if err != nil {
+		return fmt.Errorf("encoding node file: %w", err)
+	}
+	out = append(out, '\n')
+	return writeOutput(newNodeArgs.output, out)
+}
+
+var registerArgs struct {
+	nodeFile  string
+	output    string
+	hostname  string
+	ephemeral bool
+	authKey   string
+	tags      string
+}
+
+var registerCmd = &ffcli.Command{
+	Name:       "register",
+	ShortUsage: "tsp [-s url] register -n <node-file> [flags]",
+	ShortHelp:  "Register a node key with a coordination server.",
+	FlagSet: (func() *flag.FlagSet {
+		fs := flag.NewFlagSet("register", flag.ExitOnError)
+		fs.StringVar(&registerArgs.nodeFile, "n", "", "node JSON file (required)")
+		fs.StringVar(&registerArgs.output, "o", "", "output file (default: stdout)")
+		fs.StringVar(&registerArgs.hostname, "hostname", "", "hostname to register")
+		fs.BoolVar(&registerArgs.ephemeral, "ephemeral", false, "register as ephemeral node")
+		fs.StringVar(&registerArgs.authKey, "auth-key", "", "pre-authorized auth key or file containing one")
+		fs.StringVar(&registerArgs.tags, "tags", "", "comma-separated ACL tags")
+		return fs
+	})(),
+	Exec: runRegister,
+}
+
+func runRegister(ctx context.Context, args []string) error {
+	if registerArgs.nodeFile == "" {
+		return fmt.Errorf("flag -n (node file) is required")
+	}
+
+	nf, err := tsp.ReadNodeFile(registerArgs.nodeFile)
+	if err != nil {
+		return fmt.Errorf("reading node file: %w", err)
+	}
+
+	hi := hostinfo.New()
+	if registerArgs.hostname != "" {
+		hi.Hostname = registerArgs.hostname
+	}
+
+	var tags []string
+	if registerArgs.tags != "" {
+		tags = strings.Split(registerArgs.tags, ",")
+	}
+
+	authKey, err := resolveAuthKey(registerArgs.authKey)
+	if err != nil {
+		return err
+	}
+
+	client, err := tsp.NewClient(tsp.ClientOpts{
+		ServerURL:  cmp.Or(globalArgs.serverURL, nf.URL),
+		MachineKey: nf.MachineKey,
+	})
+	if err != nil {
+		return fmt.Errorf("creating client: %w", err)
+	}
+	defer client.Close()
+
+	if globalArgs.controlKeyFile != "" {
+		controlKey, err := readControlKeyFile(globalArgs.controlKeyFile)
+		if err != nil {
+			return fmt.Errorf("reading control key: %w", err)
+		}
+		client.SetControlPublicKey(controlKey)
+	} else {
+		client.SetControlPublicKey(nf.ServerInfo.Key)
+	}
+
+	resp, err := client.Register(ctx, tsp.RegisterOpts{
+		NodeKey:   nf.NodeKey,
+		Hostinfo:  hi,
+		Ephemeral: registerArgs.ephemeral,
+		AuthKey:   authKey,
+		Tags:      tags,
+	})
+	if err != nil {
+		return err
+	}
+
+	out, err := json.MarshalIndent(resp, "", "  ")
+	if err != nil {
+		return fmt.Errorf("encoding response: %w", err)
+	}
+	out = append(out, '\n')
+
+	if err := writeOutput(registerArgs.output, out); err != nil {
+		return err
+	}
+
+	if resp.AuthURL != "" {
+		fmt.Fprintf(os.Stderr, "AuthURL: %s\n", resp.AuthURL)
+	}
+	return nil
+}
+
+var mapArgs struct {
+	nodeFile string
+	stream   bool
+	peers    bool
+	quiet    bool
+	output   string
+}
+
+var mapCmd = &ffcli.Command{
+	Name:       "map",
+	ShortUsage: "tsp [-s url] map -n <node-file> [-stream]",
+	ShortHelp:  "Send a map request to the coordination server.",
+	FlagSet: (func() *flag.FlagSet {
+		fs := flag.NewFlagSet("map", flag.ExitOnError)
+		fs.StringVar(&mapArgs.nodeFile, "n", "", "node JSON file (required)")
+		fs.BoolVar(&mapArgs.stream, "stream", false, "stream map responses")
+		fs.BoolVar(&mapArgs.peers, "peers", true, "include peers in map response")
+		fs.BoolVar(&mapArgs.quiet, "quiet", true, "suppress keepalives and handled c2n ping requests from output")
+		fs.StringVar(&mapArgs.output, "o", "", "output file (default: stdout)")
+		return fs
+	})(),
+	Exec: runMap,
+}
+
+func runMap(ctx context.Context, args []string) error {
+	if mapArgs.nodeFile == "" {
+		return fmt.Errorf("flag -n (node file) is required")
+	}
+
+	nf, err := tsp.ReadNodeFile(mapArgs.nodeFile)
+	if err != nil {
+		return fmt.Errorf("reading node file: %w", err)
+	}
+
+	if globalArgs.serverURL != "" && globalArgs.serverURL != nf.URL {
+		return fmt.Errorf("server URL mismatch: -s flag is %q but node file is for %q", globalArgs.serverURL, nf.URL)
+	}
+
+	hi := hostinfo.New()
+
+	client, err := tsp.NewClient(tsp.ClientOpts{
+		ServerURL:  cmp.Or(globalArgs.serverURL, nf.URL),
+		MachineKey: nf.MachineKey,
+	})
+	if err != nil {
+		return fmt.Errorf("creating client: %w", err)
+	}
+	defer client.Close()
+
+	if globalArgs.controlKeyFile != "" {
+		controlKey, err := readControlKeyFile(globalArgs.controlKeyFile)
+		if err != nil {
+			return fmt.Errorf("reading control key: %w", err)
+		}
+		client.SetControlPublicKey(controlKey)
+	} else {
+		client.SetControlPublicKey(nf.ServerInfo.Key)
+	}
+
+	session, err := client.Map(ctx, tsp.MapOpts{
+		NodeKey:   nf.NodeKey,
+		Hostinfo:  hi,
+		Stream:    mapArgs.stream,
+		OmitPeers: !mapArgs.peers,
+	})
+	if err != nil {
+		return err
+	}
+	defer session.Close()
+
+	gotResponse := false
+	for {
+		resp, err := session.Next()
+		if err == io.EOF {
+			if !gotResponse {
+				return fmt.Errorf("server returned no map response")
+			}
+			return nil
+		}
+		if err != nil {
+			return fmt.Errorf("reading map response: %w", err)
+		}
+		gotResponse = true
+
+		if pr := resp.PingRequest; pr != nil && pr.Types == "c2n" {
+			if client.AnswerC2NPing(ctx, pr, session.NoiseRoundTrip) && mapArgs.quiet {
+				resp.PingRequest = nil
+			}
+		}
+		if mapArgs.quiet {
+			resp.KeepAlive = false
+		}
+
+		if isZeroMapResponse(resp) {
+			continue
+		}
+
+		out, err := json.MarshalIndent(resp, "", "  ")
+		if err != nil {
+			return fmt.Errorf("encoding response: %w", err)
+		}
+		out = append(out, '\n')
+		if err := writeOutput(mapArgs.output, out); err != nil {
+			return err
+		}
+	}
+}
+
+// readMachineKeyFile reads a machine private key from a file.
+func readMachineKeyFile(path string) (key.MachinePrivate, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return key.MachinePrivate{}, err
+	}
+	var k key.MachinePrivate
+	if err := k.UnmarshalText(bytes.TrimSpace(data)); err != nil {
+		return key.MachinePrivate{}, fmt.Errorf("parsing machine key from %q: %w", path, err)
+	}
+	return k, nil
+}
+
+// readNodeKeyFile reads a node private key from a file.
+func readNodeKeyFile(path string) (key.NodePrivate, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return key.NodePrivate{}, err
+	}
+	var k key.NodePrivate
+	if err := k.UnmarshalText(bytes.TrimSpace(data)); err != nil {
+		return key.NodePrivate{}, fmt.Errorf("parsing node key from %q: %w", path, err)
+	}
+	return k, nil
+}
+
+// readControlKeyFile reads a file containing a server's MachinePublic key
+// in its MarshalText form (e.g. "mkey:...").
+func readControlKeyFile(path string) (key.MachinePublic, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return key.MachinePublic{}, err
+	}
+	var k key.MachinePublic
+	if err := k.UnmarshalText(bytes.TrimSpace(data)); err != nil {
+		return key.MachinePublic{}, fmt.Errorf("parsing control key from %q: %w", path, err)
+	}
+	return k, nil
+}
+
+// resolveAuthKey returns the auth key from v. If v is empty, it returns "".
+// If v starts with "tskey-", it's used directly. Otherwise v is treated as a
+// filename and its contents are read and trimmed.
+func resolveAuthKey(v string) (string, error) {
+	if v == "" {
+		return "", nil
+	}
+	if strings.HasPrefix(strings.TrimSpace(v), "tskey-") {
+		return strings.TrimSpace(v), nil
+	}
+	data, err := os.ReadFile(v)
+	if err != nil {
+		return "", fmt.Errorf("reading auth key file: %w", err)
+	}
+	return strings.TrimSpace(string(data)), nil
+}
+
+func writeOutput(path string, data []byte) error {
+	if path == "" {
+		_, err := os.Stdout.Write(data)
+		return err
+	}
+	return os.WriteFile(path, data, 0600)
+}
+
+// isZeroMapResponse reports whether all fields of resp are zero values.
+func isZeroMapResponse(resp *tailcfg.MapResponse) bool {
+	v := reflect.ValueOf(*resp)
+	for _, field := range v.Fields() {
+		if !field.IsZero() {
+			return false
+		}
+	}
+	return true
+}
diff --git a/cmd/tta/bypass_linux.go b/cmd/tta/bypass_linux.go
new file mode 100644
index 000000000..868cd716f
--- /dev/null
+++ b/cmd/tta/bypass_linux.go
@@ -0,0 +1,39 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package main
+
+import (
+	"fmt"
+	"syscall"
+
+	"golang.org/x/sys/unix"
+	"tailscale.com/net/netmon"
+)
+
+// bypassControlFunc is set as net.Dialer.Control so that sockets dialed by
+// TTA bypass tailscaled's policy routing. Without it, sockets opened before
+// tailscaled installs an exit-node route would have their packets rerouted
+// via the exit node when the route is later installed, breaking the
+// existing connection.
+//
+// We bind the socket to the default route's interface (typically the VM's
+// LAN-facing NIC) rather than relying on the bypass fwmark. The fwmark
+// approach is conditional on tailscaled having configured SO_MARK-based
+// policy routing; binding to the underlying interface is unconditional.
+func bypassControlFunc(network, address string, c syscall.RawConn) error {
+	ifc, err := netmon.DefaultRouteInterface()
+	if err != nil {
+		return fmt.Errorf("netmon.DefaultRouteInterface: %w", err)
+	}
+	var sockErr error
+	if err := c.Control(func(fd uintptr) {
+		sockErr = unix.SetsockoptString(int(fd), unix.SOL_SOCKET, unix.SO_BINDTODEVICE, ifc)
+	}); err != nil {
+		return err
+	}
+	if sockErr != nil {
+		return fmt.Errorf("setting SO_BINDTODEVICE on %q: %w", ifc, sockErr)
+	}
+	return nil
+}
diff --git a/cmd/tta/bypass_other.go b/cmd/tta/bypass_other.go
new file mode 100644
index 000000000..e6b453f49
--- /dev/null
+++ b/cmd/tta/bypass_other.go
@@ -0,0 +1,14 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !linux
+
+package main
+
+import "syscall"
+
+// bypassControlFunc is a no-op on non-Linux platforms; SO_MARK is a Linux
+// concept and exit-node routing only matters here for Linux VMs in vmtest.
+func bypassControlFunc(network, address string, c syscall.RawConn) error {
+	return nil
+}
diff --git a/cmd/tta/ipassign_darwin.go b/cmd/tta/ipassign_darwin.go
new file mode 100644
index 000000000..69a178956
--- /dev/null
+++ b/cmd/tta/ipassign_darwin.go
@@ -0,0 +1,135 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build darwin
+
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"log"
+	"net"
+	"os/exec"
+	"strconv"
+	"time"
+	"unsafe"
+
+	"golang.org/x/sys/unix"
+	"tailscale.com/tstest/natlab/vnet"
+)
+
+const (
+	afVSOCK       = 40    // AF_VSOCK on macOS
+	vmaddrCIDHost = 2     // VMADDR_CID_HOST
+	vsockPort     = 51011 // port for IP assignment protocol
+)
+
+// sockaddrVM is the Go equivalent of struct sockaddr_vm from <sys/vsock.h>.
+type sockaddrVM struct {
+	Len       uint8
+	Family    uint8
+	Reserved1 uint16
+	Port      uint32
+	CID       uint32
+}
+
+type netConfig struct {
+	IP   string `json:"ip"`
+	Mask string `json:"mask"`
+	GW   string `json:"gw"`
+}
+
+// startIPAssignLoop starts a background goroutine that polls the host
+// via the virtio socket for an IP assignment. When the host responds
+// with a JSON config (rather than "wait"), TTA sets the IP statically
+// using ifconfig and stops polling.
+func startIPAssignLoop() {
+	go ipAssignLoop()
+}
+
+func ipAssignLoop() {
+	log.Printf("ipassign: starting vsock poll loop")
+	var lastErr string
+	for attempt := 0; ; attempt++ {
+		resp, err := askHostForIP()
+		if err != nil {
+			if e := err.Error(); e != lastErr {
+				log.Printf("ipassign: attempt %d: %v", attempt, err)
+				lastErr = e
+			}
+			time.Sleep(500 * time.Millisecond)
+			continue
+		}
+		if resp == "wait" {
+			time.Sleep(500 * time.Millisecond)
+			continue
+		}
+		var nc netConfig
+		if err := json.Unmarshal([]byte(resp), &nc); err != nil {
+			log.Printf("ipassign: bad config: %v", err)
+			time.Sleep(500 * time.Millisecond)
+			continue
+		}
+		if err := setStaticIP(nc); err != nil {
+			log.Printf("ipassign: %v", err)
+			time.Sleep(500 * time.Millisecond)
+			continue
+		}
+		log.Printf("ipassign: configured en0 with %s/%s gw %s", nc.IP, nc.Mask, nc.GW)
+
+		// Switch the driver address from the DNS name to the IP directly
+		// (avoids DNS resolution delay) and kick the dial-out loop so it
+		// retries immediately with the new address.
+		ipAddr := net.JoinHostPort(vnet.TestDriverIPv4().String(), strconv.Itoa(vnet.TestDriverPort))
+		*driverAddr = ipAddr
+		log.Printf("ipassign: switched driver addr to %s", ipAddr)
+		resetDialCancels()
+		return
+	}
+}
+
+// askHostForIP connects to the host via AF_VSOCK and reads the response.
+func askHostForIP() (string, error) {
+	fd, err := unix.Socket(afVSOCK, unix.SOCK_STREAM, 0)
+	if err != nil {
+		return "", fmt.Errorf("socket: %w", err)
+	}
+	defer unix.Close(fd)
+
+	// Set a short connect+read timeout via SO_RCVTIMEO.
+	tv := unix.Timeval{Sec: 1}
+	unix.SetsockoptTimeval(fd, unix.SOL_SOCKET, unix.SO_RCVTIMEO, &tv)
+
+	addr := sockaddrVM{
+		Len:    uint8(unsafe.Sizeof(sockaddrVM{})),
+		Family: afVSOCK,
+		Port:   vsockPort,
+		CID:    vmaddrCIDHost,
+	}
+	_, _, errno := unix.RawSyscall(unix.SYS_CONNECT, uintptr(fd),
+		uintptr(unsafe.Pointer(&addr)), unsafe.Sizeof(addr))
+	if errno != 0 {
+		return "", fmt.Errorf("connect: %w", errno)
+	}
+
+	var buf [1024]byte
+	n, err := unix.Read(fd, buf[:])
+	if err != nil {
+		return "", fmt.Errorf("read: %w", err)
+	}
+	return string(buf[:n]), nil
+}
+
+// setStaticIP configures en0 with a static IP address and default route.
+func setStaticIP(nc netConfig) error {
+	out, err := exec.Command("ifconfig", "en0", nc.IP, "netmask", nc.Mask, "up").CombinedOutput()
+	if err != nil {
+		return fmt.Errorf("ifconfig: %v: %s", err, out)
+	}
+	out, err = exec.Command("route", "add", "default", nc.GW).CombinedOutput()
+	if err != nil {
+		return fmt.Errorf("route add: %v: %s", err, out)
+	}
+	return nil
+}
diff --git a/cmd/tta/ipassign_other.go b/cmd/tta/ipassign_other.go
new file mode 100644
index 000000000..dc331b5e0
--- /dev/null
+++ b/cmd/tta/ipassign_other.go
@@ -0,0 +1,14 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !darwin
+
+package main
+
+// startIPAssignLoop is a no-op on non-macOS platforms.
+// macOS VMs use vsock-based IP assignment to bypass slow DHCP.
+func startIPAssignLoop() {}
+
+// Reference resetDialCancels to prevent unused-function lint errors.
+// It's called from ipassign_darwin.go on macOS builds.
+var _ = resetDialCancels
diff --git a/cmd/tta/restart_tailscaled_linux.go b/cmd/tta/restart_tailscaled_linux.go
new file mode 100644
index 000000000..accf2b404
--- /dev/null
+++ b/cmd/tta/restart_tailscaled_linux.go
@@ -0,0 +1,47 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package main
+
+import (
+	"fmt"
+	"os"
+	"strconv"
+	"strings"
+)
+
+func init() {
+	restartTailscaled = restartTailscaledLinux
+}
+
+// restartTailscaledLinux finds the tailscaled process by walking /proc and
+// sends it SIGKILL. On gokrazy, the supervisor will restart tailscaled within
+// a few seconds. The PID of the process that was killed is returned.
+func restartTailscaledLinux() (int, error) {
+	ents, err := os.ReadDir("/proc")
+	if err != nil {
+		return 0, err
+	}
+	for _, e := range ents {
+		pid, err := strconv.Atoi(e.Name())
+		if err != nil {
+			continue
+		}
+		comm, err := os.ReadFile("/proc/" + e.Name() + "/comm")
+		if err != nil {
+			continue
+		}
+		if strings.TrimSpace(string(comm)) != "tailscaled" {
+			continue
+		}
+		proc, err := os.FindProcess(pid)
+		if err != nil {
+			return 0, err
+		}
+		if err := proc.Kill(); err != nil {
+			return 0, fmt.Errorf("killing tailscaled pid %d: %w", pid, err)
+		}
+		return pid, nil
+	}
+	return 0, fmt.Errorf("tailscaled process not found in /proc")
+}
diff --git a/cmd/tta/tta.go b/cmd/tta/tta.go
index cf5dc4162..ecda18bd2 100644
--- a/cmd/tta/tta.go
+++ b/cmd/tta/tta.go
@@ -24,7 +24,9 @@ import (
 	"net/url"
 	"os"
 	"os/exec"
+	"path/filepath"
 	"regexp"
+	"runtime"
 	"strconv"
 	"strings"
 	"sync"
@@ -103,6 +105,10 @@ func main() {
 	}
 	flag.Parse()
 
+	// On macOS VMs, start polling the host via vsock for an IP assignment.
+	// This bypasses DHCP for near-instant network configuration.
+	startIPAssignLoop()
+
 	debug := false
 	if distro.Get() == distro.Gokrazy {
 		cmdLine, _ := os.ReadFile("/proc/cmdline")
@@ -192,6 +198,9 @@ func main() {
 		if r.URL.Query().Get("accept-routes") == "true" {
 			args = append(args, "--accept-routes")
 		}
+		if r.URL.Query().Get("ssh") == "true" {
+			args = append(args, "--ssh")
+		}
 		serveCmd(w, "tailscale", args...)
 	})
 	ttaMux.HandleFunc("/set", func(w http.ResponseWriter, r *http.Request) {
@@ -202,8 +211,29 @@ func main() {
 		if routes := r.URL.Query().Get("advertise-routes"); routes != "" {
 			args = append(args, "--advertise-routes="+routes)
 		}
+		if snat := r.URL.Query().Get("snat-subnet-routes"); snat != "" {
+			args = append(args, "--snat-subnet-routes="+snat)
+		}
 		serveCmd(w, "tailscale", args...)
 	})
+	ttaMux.HandleFunc("/tailscale", func(w http.ResponseWriter, r *http.Request) {
+		serveCmd(w, "tailscale", r.URL.Query()["arg"]...)
+	})
+	ttaMux.HandleFunc("/gokrazy-root", func(w http.ResponseWriter, r *http.Request) {
+		cmdLine, err := os.ReadFile("/proc/cmdline")
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+		for s := range strings.FieldsSeq(string(cmdLine)) {
+			if root, ok := strings.CutPrefix(s, "root="); ok {
+				w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+				io.WriteString(w, root+"\n")
+				return
+			}
+		}
+		http.Error(w, "no root= in /proc/cmdline", http.StatusInternalServerError)
+	})
 	ttaMux.HandleFunc("/ip", func(w http.ResponseWriter, r *http.Request) {
 		conn, ok := r.Context().Value(connContextKey).(net.Conn)
 		if !ok {
@@ -222,6 +252,20 @@ func main() {
 			serveCmd(w, "ping", "-c", "4", "-W", "1", host)
 		}
 	})
+	ttaMux.HandleFunc("/add-route", func(w http.ResponseWriter, r *http.Request) {
+		prefix := r.URL.Query().Get("prefix")
+		via := r.URL.Query().Get("via")
+		if prefix == "" || via == "" {
+			http.Error(w, "missing prefix or via", http.StatusBadRequest)
+			return
+		}
+		switch runtime.GOOS {
+		case "linux":
+			serveCmd(w, "ip", "route", "add", prefix, "via", via)
+		default:
+			http.Error(w, "add-route not supported on "+runtime.GOOS, http.StatusNotImplemented)
+		}
+	})
 	ttaMux.HandleFunc("/start-webserver", func(w http.ResponseWriter, r *http.Request) {
 		port := r.URL.Query().Get("port")
 		name := r.URL.Query().Get("name")
@@ -236,7 +280,8 @@ func main() {
 		go func() {
 			mux := http.NewServeMux()
 			mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
-				fmt.Fprintf(w, "Hello world I am %s", name)
+				host, _, _ := net.SplitHostPort(r.RemoteAddr)
+				fmt.Fprintf(w, "Hello world I am %s from %s", name, host)
 			})
 			if err := http.ListenAndServe(":"+port, mux); err != nil {
 				log.Printf("webserver on :%s failed: %v", port, err)
@@ -244,6 +289,72 @@ func main() {
 		}()
 		io.WriteString(w, "OK\n")
 	})
+	ttaMux.HandleFunc("/taildrop-send", func(w http.ResponseWriter, r *http.Request) {
+		to := r.URL.Query().Get("to") // peer's Tailscale IP
+		name := r.URL.Query().Get("name")
+		if to == "" || name == "" {
+			http.Error(w, "missing to or name", http.StatusBadRequest)
+			return
+		}
+		if strings.ContainsAny(name, "/\\") {
+			http.Error(w, "bad name", http.StatusBadRequest)
+			return
+		}
+		dir, err := os.MkdirTemp("", "taildrop-send-")
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+		defer os.RemoveAll(dir)
+		path := filepath.Join(dir, name)
+		f, err := os.Create(path)
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+		if _, err := io.Copy(f, r.Body); err != nil {
+			f.Close()
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+		if err := f.Close(); err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+		serveCmd(w, "tailscale", "file", "cp", path, to+":")
+	})
+	ttaMux.HandleFunc("/taildrop-recv", func(w http.ResponseWriter, r *http.Request) {
+		dir, err := os.MkdirTemp("", "taildrop-recv-")
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+		defer os.RemoveAll(dir)
+		ctx, cancel := context.WithTimeout(r.Context(), 60*time.Second)
+		defer cancel()
+		cmd := exec.CommandContext(ctx, absify("tailscale"), "file", "get", "--wait", dir)
+		if out, err := cmd.CombinedOutput(); err != nil {
+			http.Error(w, fmt.Sprintf("tailscale file get: %v\n%s", err, out), http.StatusInternalServerError)
+			return
+		}
+		ents, err := os.ReadDir(dir)
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+		if len(ents) != 1 {
+			http.Error(w, fmt.Sprintf("got %d files, want 1", len(ents)), http.StatusInternalServerError)
+			return
+		}
+		data, err := os.ReadFile(filepath.Join(dir, ents[0].Name()))
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+		w.Header().Set("Taildrop-Filename", ents[0].Name())
+		w.Header().Set("Content-Type", "application/octet-stream")
+		w.Write(data)
+	})
 	ttaMux.HandleFunc("/http-get", func(w http.ResponseWriter, r *http.Request) {
 		targetURL := r.URL.Query().Get("url")
 		if targetURL == "" {
@@ -258,6 +369,9 @@ func main() {
 			http.Error(w, err.Error(), http.StatusInternalServerError)
 			return
 		}
+		if cookie := r.Header.Get("Cookie"); cookie != "" {
+			req.Header.Set("Cookie", cookie)
+		}
 		// Use Tailscale's SOCKS5 proxy if available, so traffic to Tailscale
 		// subnet routes goes through the WireGuard tunnel instead of the
 		// host network stack (which may not have the routes, especially
@@ -289,11 +403,33 @@ func main() {
 			return
 		}
 		defer resp.Body.Close()
+		for _, sc := range resp.Header.Values("Set-Cookie") {
+			w.Header().Add("Set-Cookie", sc)
+		}
 		w.Header().Set("X-Upstream-Status", strconv.Itoa(resp.StatusCode))
 		w.WriteHeader(resp.StatusCode)
 		io.Copy(w, resp.Body)
 	})
 	ttaMux.HandleFunc("/fw", addFirewallHandler)
+	ttaMux.HandleFunc("/wg-server-up", func(w http.ResponseWriter, r *http.Request) {
+		if wgServerUp == nil {
+			http.Error(w, "wg-server-up not supported on this platform", http.StatusNotImplemented)
+			return
+		}
+		wgServerUp(w, r)
+	})
+	ttaMux.HandleFunc("/restart-tailscaled", func(w http.ResponseWriter, r *http.Request) {
+		if restartTailscaled == nil {
+			http.Error(w, "restart-tailscaled not supported on this platform", http.StatusNotImplemented)
+			return
+		}
+		pid, err := restartTailscaled()
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+		fmt.Fprintf(w, "killed tailscaled pid %d (supervisor will respawn)\n", pid)
+	})
 	ttaMux.HandleFunc("/logs", func(w http.ResponseWriter, r *http.Request) {
 		logBuf.mu.Lock()
 		defer logBuf.mu.Unlock()
@@ -315,10 +451,48 @@ func main() {
 	revSt.runDialOutLoop(conns)
 }
 
+// dialCancels tracks cancel funcs for in-flight connect() and sleep contexts.
+// resetDialCancels cancels them all so the dial loop retries immediately.
+var (
+	dialCancelMu sync.Mutex
+	dialCancels  set.HandleSet[context.CancelFunc]
+)
+
+// registerDialCancel adds a cancel func and returns a handle for removal.
+func registerDialCancel(cancel context.CancelFunc) set.Handle {
+	dialCancelMu.Lock()
+	defer dialCancelMu.Unlock()
+	return dialCancels.Add(cancel)
+}
+
+// unregisterDialCancel removes a previously registered cancel func.
+func unregisterDialCancel(h set.Handle) {
+	dialCancelMu.Lock()
+	defer dialCancelMu.Unlock()
+	delete(dialCancels, h)
+}
+
+// resetDialCancels cancels all in-flight connect and sleep contexts,
+// causing the dial loop to retry immediately with the updated driver address.
+func resetDialCancels() {
+	dialCancelMu.Lock()
+	defer dialCancelMu.Unlock()
+	for h, cancel := range dialCancels {
+		cancel()
+		delete(dialCancels, h)
+	}
+}
+
 func connect() (net.Conn, error) {
-	var d net.Dialer
+	d := net.Dialer{
+		Control: bypassControlFunc,
+	}
 	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
-	defer cancel()
+	h := registerDialCancel(cancel)
+	defer func() {
+		cancel()
+		unregisterDialCancel(h)
+	}()
 	c, err := d.DialContext(ctx, "tcp", *driverAddr)
 	if err != nil {
 		return nil, err
@@ -415,7 +589,11 @@ func (s *revDialState) runDialOutLoop(conns chan<- net.Conn) {
 				log.Printf("[dial-driver] connect failure: %v", s)
 			}
 			lastErr = s
-			time.Sleep(time.Second)
+			sleepCtx, sleepCancel := context.WithTimeout(context.Background(), time.Second)
+			h := registerDialCancel(sleepCancel)
+			<-sleepCtx.Done()
+			sleepCancel()
+			unregisterDialCancel(h)
 			continue
 		}
 		if !connected {
@@ -456,6 +634,16 @@ func addFirewallHandler(w http.ResponseWriter, r *http.Request) {
 
 var addFirewall func() error // set by fw_linux.go
 
+// wgServerUp brings up a userspace WireGuard "Mullvad-style" exit-node
+// server on this VM. It is set by wgserver_linux.go and is nil on
+// non-Linux.
+var wgServerUp func(w http.ResponseWriter, r *http.Request)
+
+// restartTailscaled sends SIGKILL to the local tailscaled process so the
+// gokrazy supervisor restarts it. It is set by restart_tailscaled_linux.go
+// and is nil on non-Linux.
+var restartTailscaled func() (pid int, err error)
+
 // logBuffer is a bytes.Buffer that is safe for concurrent use
 // intended to capture early logs from the process, even if
 // gokrazy's syslog streaming isn't working or yet working.
diff --git a/cmd/tta/wgserver_linux.go b/cmd/tta/wgserver_linux.go
new file mode 100644
index 000000000..62ea1787c
--- /dev/null
+++ b/cmd/tta/wgserver_linux.go
@@ -0,0 +1,156 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package main
+
+import (
+	"cmp"
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/hex"
+	"fmt"
+	"log"
+	"net/http"
+	"os"
+	"os/exec"
+	"sync"
+
+	"golang.org/x/crypto/curve25519"
+
+	// Stock wireguard-go to simulate non-Tailscale peers.
+	extwgconn "golang.zx2c4.com/wireguard/conn"
+	extwgdevice "golang.zx2c4.com/wireguard/device"
+	extwgtun "golang.zx2c4.com/wireguard/tun"
+)
+
+func init() {
+	wgServerUp = wgServerUpLinux
+}
+
+var (
+	wgServerMu  sync.Mutex
+	wgServerDev *extwgdevice.Device // retained so the goroutines stay alive
+)
+
+// wgServerUpLinux brings up a userspace WireGuard interface on the local VM
+// configured as a single-peer "Mullvad-style" exit node, then sets up the
+// kernel-side IP/forwarding/MASQUERADE so that decrypted traffic from the
+// peer egresses to the test internet.
+//
+// Required URL query parameters:
+//   - addr: CIDR for the WG interface (e.g. "10.64.0.1/24")
+//   - listen-port: WG listen port
+//   - peer-pub-b64: base64-encoded 32-byte WG public key of the only peer
+//   - peer-allowed-ip: prefix the peer is allowed to source from
+//     (e.g. "10.64.0.2/32")
+//   - masq-src: prefix to MASQUERADE on egress (e.g. "10.64.0.0/24")
+//
+// Optional:
+//   - name: TUN device name (default "wg0")
+//
+// On success, it writes "PUBKEY=<base64>\n" — the freshly generated public
+// key the caller must pin as the peer's WG public key.
+func wgServerUpLinux(w http.ResponseWriter, r *http.Request) {
+	wgServerMu.Lock()
+	defer wgServerMu.Unlock()
+	if wgServerDev != nil {
+		http.Error(w, "wg server already up", http.StatusConflict)
+		return
+	}
+
+	q := r.URL.Query()
+	name := cmp.Or(q.Get("name"), "wg0")
+	addr := q.Get("addr")
+	listenPort := q.Get("listen-port")
+	peerPubB64 := q.Get("peer-pub-b64")
+	peerAllowedIP := q.Get("peer-allowed-ip")
+	masqSrc := q.Get("masq-src")
+	for _, kv := range []struct{ k, v string }{
+		{"addr", addr},
+		{"listen-port", listenPort},
+		{"peer-pub-b64", peerPubB64},
+		{"peer-allowed-ip", peerAllowedIP},
+		{"masq-src", masqSrc},
+	} {
+		if kv.v == "" {
+			http.Error(w, "missing "+kv.k, http.StatusBadRequest)
+			return
+		}
+	}
+
+	peerPub, err := base64.StdEncoding.DecodeString(peerPubB64)
+	if err != nil || len(peerPub) != 32 {
+		http.Error(w, fmt.Sprintf("bad peer-pub-b64: %v (len=%d)", err, len(peerPub)), http.StatusBadRequest)
+		return
+	}
+
+	var priv [32]byte
+	if _, err := rand.Read(priv[:]); err != nil {
+		http.Error(w, "rand: "+err.Error(), http.StatusInternalServerError)
+		return
+	}
+	// X25519 key clamping.
+	priv[0] &= 248
+	priv[31] = (priv[31] & 127) | 64
+
+	pub, err := curve25519.X25519(priv[:], curve25519.Basepoint)
+	if err != nil {
+		http.Error(w, "deriving pubkey: "+err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	tdev, err := extwgtun.CreateTUN(name, extwgdevice.DefaultMTU)
+	if err != nil {
+		http.Error(w, "tun.CreateTUN: "+err.Error(), http.StatusInternalServerError)
+		return
+	}
+	wglog := &extwgdevice.Logger{
+		Verbosef: func(string, ...any) {},
+		Errorf:   func(f string, a ...any) { log.Printf("wg-server: "+f, a...) },
+	}
+	dev := extwgdevice.NewDevice(tdev, extwgconn.NewDefaultBind(), wglog)
+
+	uapi := fmt.Sprintf("private_key=%s\nlisten_port=%s\npublic_key=%s\nallowed_ip=%s\n",
+		hex.EncodeToString(priv[:]), listenPort,
+		hex.EncodeToString(peerPub), peerAllowedIP)
+	if err := dev.IpcSet(uapi); err != nil {
+		dev.Close()
+		http.Error(w, "IpcSet: "+err.Error(), http.StatusInternalServerError)
+		return
+	}
+	if err := dev.Up(); err != nil {
+		dev.Close()
+		http.Error(w, "dev.Up: "+err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	steps := []struct {
+		why  string
+		exec []string
+		file struct{ path, data string }
+	}{
+		{why: "ip addr add", exec: []string{"ip", "addr", "add", addr, "dev", name}},
+		{why: "ip link up", exec: []string{"ip", "link", "set", name, "up"}},
+		{why: "enable forwarding", file: struct{ path, data string }{"/proc/sys/net/ipv4/ip_forward", "1\n"}},
+		{why: "FORWARD policy", exec: []string{"iptables", "-P", "FORWARD", "ACCEPT"}},
+		{why: "MASQUERADE", exec: []string{"iptables", "-t", "nat", "-A", "POSTROUTING", "-s", masqSrc, "-j", "MASQUERADE"}},
+	}
+	for _, s := range steps {
+		if s.file.path != "" {
+			if err := os.WriteFile(s.file.path, []byte(s.file.data), 0644); err != nil {
+				dev.Close()
+				http.Error(w, fmt.Sprintf("%s: %v", s.why, err), http.StatusInternalServerError)
+				return
+			}
+			continue
+		}
+		if out, err := exec.Command(s.exec[0], s.exec[1:]...).CombinedOutput(); err != nil {
+			dev.Close()
+			http.Error(w, fmt.Sprintf("%s: %v: %s", s.why, err, out), http.StatusInternalServerError)
+			return
+		}
+	}
+
+	wgServerDev = dev
+	fmt.Fprintf(w, "PUBKEY=%s\n", base64.StdEncoding.EncodeToString(pub))
+}
diff --git a/cmd/vet/jsontags/analyzer.go b/cmd/vet/jsontags/analyzer.go
index c69634ecd..5842fc1c1 100644
--- a/cmd/vet/jsontags/analyzer.go
+++ b/cmd/vet/jsontags/analyzer.go
@@ -38,7 +38,7 @@ func run(pass *analysis.Pass) (any, error) {
 			if tag == "" {
 				continue
 			}
-			var seenName, hasFormat bool
+			var seenName bool
 			for opt := range strings.SplitSeq(tag, ",") {
 				if !seenName {
 					seenName = true
@@ -116,13 +116,18 @@ func run(pass *analysis.Pass) (any, error) {
 						report(pass, structType, fieldVar, StringOnNonNumericKind)
 					}
 				default:
-					key, _, ok := strings.Cut(opt, ":")
-					hasFormat = key == "format" && ok
+					// The `format` tag option did not make the cut for
+					// Go 1.27's encoding/json/v2. Its mere presence in a
+					// struct tag makes both v1 and v2 marshaling fail at
+					// runtime unless the caller passes the
+					// jsonv2.ExperimentalSupportFormatTag option.
+					// See https://go.dev/issue/71631 and
+					// https://github.com/tailscale/tailscale/issues/20528.
+					if key, _, ok := strings.Cut(opt, ":"); ok && key == "format" {
+						report(pass, structType, fieldVar, FormatUnsupported)
+					}
 				}
 			}
-			if !hasFormat && isTimeDuration(mayPointerElem(fieldVar.Type())) {
-				report(pass, structType, fieldVar, FormatMissingOnTimeDuration)
-			}
 		}
 	})
 	return nil, nil
@@ -152,26 +157,6 @@ func isString(t types.Type) bool {
 	return ok && basic.Kind() == types.String
 }
 
-// isTimeDuration reports whether t is a time.Duration type.
-func isTimeDuration(t types.Type) bool {
-	return isNamed(t, "time", "Duration")
-}
-
-// mayPointerElem returns the pointed-at type if t is a pointer,
-// otherwise it returns t as-is.
-func mayPointerElem(t types.Type) types.Type {
-	if pointer, ok := t.(*types.Pointer); ok {
-		return pointer.Elem()
-	}
-	return t
-}
-
-// isNamed reports t is a named typed of the given path and name.
-func isNamed(t types.Type, path, name string) bool {
-	gotPath, gotName := typeName(t)
-	return gotPath == path && gotName == name
-}
-
 // typeName reports the pkgPath and name of the type.
 // It recursively follows type aliases to get the underlying named type.
 func typeName(t types.Type) (pkgPath, name string) {
diff --git a/cmd/vet/jsontags/report.go b/cmd/vet/jsontags/report.go
index 702de1c4d..022bfc2f1 100644
--- a/cmd/vet/jsontags/report.go
+++ b/cmd/vet/jsontags/report.go
@@ -74,7 +74,7 @@ const (
 	OmitEmptyShouldBeOmitZero             ReportKind = "OmitEmptyShouldBeOmitZero"
 	OmitEmptyShouldBeOmitZeroButHasIsZero ReportKind = "OmitEmptyShouldBeOmitZeroButHasIsZero"
 	StringOnNonNumericKind                ReportKind = "StringOnNonNumericKind"
-	FormatMissingOnTimeDuration           ReportKind = "FormatMissingOnTimeDuration"
+	FormatUnsupported                     ReportKind = "FormatUnsupported"
 )
 
 func (k ReportKind) message() string {
@@ -89,8 +89,8 @@ func (k ReportKind) message() string {
 		return "should probably use `omitzero` instead of `omitempty`"
 	case StringOnNonNumericKind:
 		return "must not use `string` on non-numeric types"
-	case FormatMissingOnTimeDuration:
-		return "must use an explicit `format` tag (e.g., `format:nano`) on a time.Duration type; see https://go.dev/issue/71631"
+	case FormatUnsupported:
+		return "must not use the `format` tag option; Go 1.27's encoding/json rejects it at runtime (see tailscale/tailscale#20528)"
 	default:
 		return string(k)
 	}
diff --git a/cmd/vet/jsontags_allowlist b/cmd/vet/jsontags_allowlist
index b9f91d562..8d44c6e6c 100644
--- a/cmd/vet/jsontags_allowlist
+++ b/cmd/vet/jsontags_allowlist
@@ -195,6 +195,7 @@ OmitEmptyUnsupportedInV2	tailscale.com/ipn.MaskedPrefs.OperatorUserSet
 OmitEmptyUnsupportedInV2	tailscale.com/ipn.MaskedPrefs.PostureCheckingSet
 OmitEmptyUnsupportedInV2	tailscale.com/ipn.MaskedPrefs.ProfileNameSet
 OmitEmptyUnsupportedInV2	tailscale.com/ipn.MaskedPrefs.RelayServerPortSet
+OmitEmptyUnsupportedInV2	tailscale.com/ipn.MaskedPrefs.RemoteConfigSet
 OmitEmptyUnsupportedInV2	tailscale.com/ipn.MaskedPrefs.RouteAllSet
 OmitEmptyUnsupportedInV2	tailscale.com/ipn.MaskedPrefs.RunSSHSet
 OmitEmptyUnsupportedInV2	tailscale.com/ipn.MaskedPrefs.RunWebClientSet
diff --git a/cmd/vet/lowerell/analyzer.go b/cmd/vet/lowerell/analyzer.go
new file mode 100644
index 000000000..a62f79bdc
--- /dev/null
+++ b/cmd/vet/lowerell/analyzer.go
@@ -0,0 +1,132 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package lowerell forbids variables named "l" (lowercase ell) or "I"
+// (uppercase i), because they are hard to distinguish from the digit
+// "1" and from each other in too many fonts.
+package lowerell
+
+import (
+	"go/ast"
+	"go/token"
+
+	"golang.org/x/tools/go/analysis"
+)
+
+// Analyzer reports variables named "l" (lowercase ell) or "I" (uppercase i).
+var Analyzer = &analysis.Analyzer{
+	Name: "lowerell",
+	Doc:  `forbid variables named "l" (lowercase ell) or "I" (uppercase i), which are hard to distinguish from "1"`,
+	Run:  run,
+}
+
+// messages maps a banned identifier name to the diagnostic shown to users.
+// Each message names the specific symbol that triggered it, so the
+// reader does not have to guess which of "l" or "I" they typed.
+var messages = map[string]string{
+	"l": `do not use "l" (lowercase ell) as a variable name; it is hard to distinguish from "1" and "I" in too many fonts; see https://github.com/tailscale/tailscale/issues/19631`,
+	"I": `do not use "I" (uppercase i) as a variable name; it is hard to distinguish from "1" and "l" in too many fonts; see https://github.com/tailscale/tailscale/issues/19631`,
+}
+
+// reported tracks identifier positions already reported, to avoid duplicate
+// diagnostics when the same declaration is reachable from multiple AST nodes.
+type reportedSet map[token.Pos]bool
+
+func (rs reportedSet) check(pass *analysis.Pass, ident *ast.Ident) {
+	if ident == nil {
+		return
+	}
+	msg, ok := messages[ident.Name]
+	if !ok {
+		return
+	}
+	if rs[ident.Pos()] {
+		return
+	}
+	rs[ident.Pos()] = true
+	pass.Reportf(ident.Pos(), "%s", msg)
+}
+
+func (rs reportedSet) checkFieldList(pass *analysis.Pass, fl *ast.FieldList) {
+	if fl == nil {
+		return
+	}
+	for _, f := range fl.List {
+		for _, n := range f.Names {
+			rs.check(pass, n)
+		}
+	}
+}
+
+func run(pass *analysis.Pass) (any, error) {
+	rs := reportedSet{}
+
+	for _, file := range pass.Files {
+		ast.Inspect(file, func(n ast.Node) bool {
+			switch n := n.(type) {
+			case *ast.FuncDecl:
+				// Receiver name.
+				rs.checkFieldList(pass, n.Recv)
+				// Parameters, results, and type parameters
+				// are checked via the FuncType case below.
+
+			case *ast.FuncType:
+				rs.checkFieldList(pass, n.TypeParams)
+				rs.checkFieldList(pass, n.Params)
+				rs.checkFieldList(pass, n.Results)
+
+			case *ast.StructType:
+				rs.checkFieldList(pass, n.Fields)
+
+			case *ast.GenDecl:
+				if n.Tok != token.VAR && n.Tok != token.CONST {
+					return true
+				}
+				for _, spec := range n.Specs {
+					vs, ok := spec.(*ast.ValueSpec)
+					if !ok {
+						continue
+					}
+					for _, name := range vs.Names {
+						rs.check(pass, name)
+					}
+				}
+
+			case *ast.AssignStmt:
+				if n.Tok != token.DEFINE {
+					return true
+				}
+				for _, lhs := range n.Lhs {
+					if id, ok := lhs.(*ast.Ident); ok {
+						rs.check(pass, id)
+					}
+				}
+
+			case *ast.RangeStmt:
+				if n.Tok != token.DEFINE {
+					return true
+				}
+				if id, ok := n.Key.(*ast.Ident); ok {
+					rs.check(pass, id)
+				}
+				if id, ok := n.Value.(*ast.Ident); ok {
+					rs.check(pass, id)
+				}
+
+			case *ast.TypeSwitchStmt:
+				// switch l := x.(type) { ... }
+				as, ok := n.Assign.(*ast.AssignStmt)
+				if !ok || as.Tok != token.DEFINE {
+					return true
+				}
+				for _, lhs := range as.Lhs {
+					if id, ok := lhs.(*ast.Ident); ok {
+						rs.check(pass, id)
+					}
+				}
+			}
+			return true
+		})
+	}
+	return nil, nil
+}
diff --git a/cmd/vet/lowerell/analyzer_test.go b/cmd/vet/lowerell/analyzer_test.go
new file mode 100644
index 000000000..c566c2ec4
--- /dev/null
+++ b/cmd/vet/lowerell/analyzer_test.go
@@ -0,0 +1,15 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package lowerell
+
+import (
+	"testing"
+
+	"golang.org/x/tools/go/analysis/analysistest"
+)
+
+func TestAnalyzer(t *testing.T) {
+	testdata := analysistest.TestData()
+	analysistest.Run(t, testdata, Analyzer, "example")
+}
diff --git a/cmd/vet/lowerell/testdata/src/example/example.go b/cmd/vet/lowerell/testdata/src/example/example.go
new file mode 100644
index 000000000..c67c19781
--- /dev/null
+++ b/cmd/vet/lowerell/testdata/src/example/example.go
@@ -0,0 +1,100 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package example
+
+import "sync"
+
+// Bad: var declarations.
+var l int // want `do not use "l"`
+var I int // want `do not use "I"`
+
+// OK: variables named "ll", "II", "i" are fine.
+var (
+	ll int
+	II int
+	i  int
+)
+
+// Bad: const declaration in a function scope.
+func F0() {
+	const l = 3 // want `do not use "l"`
+	const I = 4 // want `do not use "I"`
+	_ = l
+	_ = I
+}
+
+// Bad: function parameters.
+func F1a(l int) {} // want `do not use "l"`
+func F1b(I int) {} // want `do not use "I"`
+
+// Bad: named return values.
+func F2a() (l int) { return } // want `do not use "l"`
+func F2b() (I int) { return } // want `do not use "I"`
+
+// Bad: receiver names.
+type T struct{}
+
+func (l *T) Ml() {} // want `do not use "l"`
+func (I *T) MI() {} // want `do not use "I"`
+
+// Bad: struct fields.
+type S struct {
+	l int // want `do not use "l"`
+	I int // want `do not use "I"`
+}
+
+// Bad: short variable declarations.
+func F3() {
+	l := 1 // want `do not use "l"`
+	I := 2 // want `do not use "I"`
+	_ = l
+	_ = I
+}
+
+// Bad: var statement inside a function.
+func F4() {
+	var l int // want `do not use "l"`
+	var I int // want `do not use "I"`
+	_ = l
+	_ = I
+}
+
+// Bad: range key/value.
+func F5(xs []int) {
+	for l, v := range xs { // want `do not use "l"`
+		_ = l
+		_ = v
+	}
+	for _, I := range xs { // want `do not use "I"`
+		_ = I
+	}
+}
+
+// Bad: type parameters.
+func F6a[l any](x l) l { return x } // want `do not use "l"`
+func F6b[I any](x I) I { return x } // want `do not use "I"`
+
+// Bad: type switch guards.
+func F7(x any) {
+	switch l := x.(type) { // want `do not use "l"`
+	case int:
+		_ = l
+	}
+	switch I := x.(type) { // want `do not use "I"`
+	case int:
+		_ = I
+	}
+}
+
+// OK: clean code with no banned variables.
+func F8() {
+	count := 0
+	for i := 0; i < 10; i++ {
+		count++
+	}
+	_ = count
+}
+
+// OK: sync.Mutex named "mu".
+var mu sync.Mutex
diff --git a/cmd/vet/vet.go b/cmd/vet/vet.go
index 4087f7073..38ffdb6d0 100644
--- a/cmd/vet/vet.go
+++ b/cmd/vet/vet.go
@@ -9,6 +9,7 @@ import (
 
 	"golang.org/x/tools/go/analysis/unitchecker"
 	"tailscale.com/cmd/vet/jsontags"
+	"tailscale.com/cmd/vet/lowerell"
 	"tailscale.com/cmd/vet/subtestnames"
 )
 
@@ -21,5 +22,5 @@ func init() {
 }
 
 func main() {
-	unitchecker.Main(jsontags.Analyzer, subtestnames.Analyzer)
+	unitchecker.Main(jsontags.Analyzer, lowerell.Analyzer, subtestnames.Analyzer)
 }
diff --git a/cmd/viewer/tests/tests.go b/cmd/viewer/tests/tests.go
index 060ac9d8e..5e3e71896 100644
--- a/cmd/viewer/tests/tests.go
+++ b/cmd/viewer/tests/tests.go
@@ -6,6 +6,7 @@ package tests
 
 import (
 	"fmt"
+	"maps"
 	"net/netip"
 
 	"golang.org/x/exp/constraints"
@@ -252,9 +253,7 @@ func (m NamedMap) Clone() NamedMap {
 		return nil
 	}
 	m2 := make(NamedMap, len(m))
-	for k, v := range m {
-		m2[k] = v
-	}
+	maps.Copy(m2, m)
 	return m2
 }
 
diff --git a/cmd/viewer/tests/tests_clone.go b/cmd/viewer/tests/tests_clone.go
index 08cae87e2..bc576ec97 100644
--- a/cmd/viewer/tests/tests_clone.go
+++ b/cmd/viewer/tests/tests_clone.go
@@ -96,14 +96,36 @@ func (src *Map) Clone() *Map {
 	dst.StructWithoutPtr = maps.Clone(src.StructWithoutPtr)
 	if dst.SlicesWithPtrs != nil {
 		dst.SlicesWithPtrs = map[string][]*StructWithPtrs{}
-		for k := range src.SlicesWithPtrs {
-			dst.SlicesWithPtrs[k] = append([]*StructWithPtrs{}, src.SlicesWithPtrs[k]...)
+		for k, sv := range src.SlicesWithPtrs {
+			if sv == nil {
+				dst.SlicesWithPtrs[k] = nil
+				continue
+			}
+			dst.SlicesWithPtrs[k] = make([]*StructWithPtrs, len(sv))
+			for i := range sv {
+				if sv[i] == nil {
+					dst.SlicesWithPtrs[k][i] = nil
+				} else {
+					dst.SlicesWithPtrs[k][i] = sv[i].Clone()
+				}
+			}
 		}
 	}
 	if dst.SlicesWithoutPtrs != nil {
 		dst.SlicesWithoutPtrs = map[string][]*StructWithoutPtrs{}
-		for k := range src.SlicesWithoutPtrs {
-			dst.SlicesWithoutPtrs[k] = append([]*StructWithoutPtrs{}, src.SlicesWithoutPtrs[k]...)
+		for k, sv := range src.SlicesWithoutPtrs {
+			if sv == nil {
+				dst.SlicesWithoutPtrs[k] = nil
+				continue
+			}
+			dst.SlicesWithoutPtrs[k] = make([]*StructWithoutPtrs, len(sv))
+			for i := range sv {
+				if sv[i] == nil {
+					dst.SlicesWithoutPtrs[k][i] = nil
+				} else {
+					dst.SlicesWithoutPtrs[k][i] = new(*sv[i])
+				}
+			}
 		}
 	}
 	dst.StructWithoutPtrKey = maps.Clone(src.StructWithoutPtrKey)
@@ -115,8 +137,19 @@ func (src *Map) Clone() *Map {
 	}
 	if dst.SliceIntPtr != nil {
 		dst.SliceIntPtr = map[string][]*int{}
-		for k := range src.SliceIntPtr {
-			dst.SliceIntPtr[k] = append([]*int{}, src.SliceIntPtr[k]...)
+		for k, sv := range src.SliceIntPtr {
+			if sv == nil {
+				dst.SliceIntPtr[k] = nil
+				continue
+			}
+			dst.SliceIntPtr[k] = make([]*int, len(sv))
+			for i := range sv {
+				if sv[i] == nil {
+					dst.SliceIntPtr[k][i] = nil
+				} else {
+					dst.SliceIntPtr[k][i] = new(*sv[i])
+				}
+			}
 		}
 	}
 	dst.PointerKey = maps.Clone(src.PointerKey)
@@ -399,8 +432,15 @@ func (src *GenericCloneableStruct[T, V]) Clone() *GenericCloneableStruct[T, V] {
 	}
 	if dst.SliceMap != nil {
 		dst.SliceMap = map[string][]T{}
-		for k := range src.SliceMap {
-			dst.SliceMap[k] = append([]T{}, src.SliceMap[k]...)
+		for k, sv := range src.SliceMap {
+			if sv == nil {
+				dst.SliceMap[k] = nil
+				continue
+			}
+			dst.SliceMap[k] = make([]T, len(sv))
+			for i := range sv {
+				dst.SliceMap[k][i] = sv[i].Clone()
+			}
 		}
 	}
 	return dst
@@ -500,14 +540,36 @@ func (src *StructWithTypeAliasFields) Clone() *StructWithTypeAliasFields {
 	}
 	if dst.MapOfSlicesWithPtrs != nil {
 		dst.MapOfSlicesWithPtrs = map[string][]*StructWithPtrsAlias{}
-		for k := range src.MapOfSlicesWithPtrs {
-			dst.MapOfSlicesWithPtrs[k] = append([]*StructWithPtrsAlias{}, src.MapOfSlicesWithPtrs[k]...)
+		for k, sv := range src.MapOfSlicesWithPtrs {
+			if sv == nil {
+				dst.MapOfSlicesWithPtrs[k] = nil
+				continue
+			}
+			dst.MapOfSlicesWithPtrs[k] = make([]*StructWithPtrsAlias, len(sv))
+			for i := range sv {
+				if sv[i] == nil {
+					dst.MapOfSlicesWithPtrs[k][i] = nil
+				} else {
+					dst.MapOfSlicesWithPtrs[k][i] = sv[i].Clone()
+				}
+			}
 		}
 	}
 	if dst.MapOfSlicesWithoutPtrs != nil {
 		dst.MapOfSlicesWithoutPtrs = map[string][]*StructWithoutPtrsAlias{}
-		for k := range src.MapOfSlicesWithoutPtrs {
-			dst.MapOfSlicesWithoutPtrs[k] = append([]*StructWithoutPtrsAlias{}, src.MapOfSlicesWithoutPtrs[k]...)
+		for k, sv := range src.MapOfSlicesWithoutPtrs {
+			if sv == nil {
+				dst.MapOfSlicesWithoutPtrs[k] = nil
+				continue
+			}
+			dst.MapOfSlicesWithoutPtrs[k] = make([]*StructWithoutPtrsAlias, len(sv))
+			for i := range sv {
+				if sv[i] == nil {
+					dst.MapOfSlicesWithoutPtrs[k][i] = nil
+				} else {
+					dst.MapOfSlicesWithoutPtrs[k][i] = new(*sv[i])
+				}
+			}
 		}
 	}
 	return dst
diff --git a/cmd/vnet/run-krazy.sh b/cmd/vnet/run-krazy.sh
index a55da6b95..d00abd5c1 100755
--- a/cmd/vnet/run-krazy.sh
+++ b/cmd/vnet/run-krazy.sh
@@ -12,7 +12,7 @@ set -eux
 qemu-system-x86_64 -M microvm,isa-serial=off \
     -m 1G \
     -nodefaults -no-user-config -nographic \
-    -kernel $HOME/src/github.com/tailscale/gokrazy-kernel/vmlinuz \
+    -kernel $HOME/src/github.com/gokrazy/kernel.amd64/vmlinuz \
     -append "console=hvc0 root=PARTUUID=60c24cc1-f3f9-427a-8199-76baa2d60001/PARTNROFF=1 ro init=/gokrazy/init panic=10 oops=panic pci=off nousb tsc=unstable clocksource=hpet tailscale-tta=1 tailscaled.env=TS_DEBUG_RAW_DISCO=1 ${EXTRA_ARG}" \
     -drive id=blk0,file=$HOME/src/tailscale.com/gokrazy/natlabapp.img,format=raw \
     -device virtio-blk-device,drive=blk0 \
diff --git a/control/controlclient/auto.go b/control/controlclient/auto.go
index b087e1444..b8f39adce 100644
--- a/control/controlclient/auto.go
+++ b/control/controlclient/auto.go
@@ -20,10 +20,12 @@ import (
 	"tailscale.com/types/netmap"
 	"tailscale.com/types/persist"
 	"tailscale.com/types/structs"
+	"tailscale.com/types/views"
 	"tailscale.com/util/backoff"
 	"tailscale.com/util/clientmetric"
 	"tailscale.com/util/execqueue"
 	"tailscale.com/util/testenv"
+	"tailscale.com/wgengine/filter"
 )
 
 type LoginGoal struct {
@@ -302,6 +304,12 @@ func (c *Auto) restartMap() {
 	c.updateControl()
 }
 
+// RestartMap cancels the existing map poll and starts a fresh streaming one,
+// forcing the control server to send a new full netmap response.
+func (c *Auto) RestartMap() {
+	c.restartMap()
+}
+
 func (c *Auto) authRoutine() {
 	defer close(c.authDone)
 	bo := backoff.NewBackoff("authRoutine", c.logf, 30*time.Second)
@@ -356,7 +364,15 @@ func (c *Auto) authRoutine() {
 		if err != nil {
 			c.direct.health.SetAuthRoutineInError(err)
 			report(err, f)
-			bo.BackOff(ctx, err)
+			if rle, ok := errors.AsType[*rateLimitError](err); ok {
+				c.logf("authRoutine: %s", rle)
+				select {
+				case <-ctx.Done():
+				case <-time.After(rle.retryAfter):
+				}
+			} else {
+				bo.BackOff(ctx, err)
+			}
 			continue
 		}
 		if url != "" {
@@ -370,9 +386,15 @@ func (c *Auto) authRoutine() {
 			}
 			c.mu.Lock()
 			c.urlToVisit = url
-			c.loginGoal = &LoginGoal{
-				flags: LoginDefault,
-				url:   url,
+			// Only store the URL follow-up goal if no concurrent Login() call has
+			// replaced the goal we were processing while our control plane request
+			// was in flight. Otherwise, the intent from the more recent goal gets
+			// lost.
+			if c.loginGoal == goal {
+				c.loginGoal = &LoginGoal{
+					flags: LoginDefault,
+					url:   url,
+				}
 			}
 			c.mu.Unlock()
 
@@ -390,13 +412,25 @@ func (c *Auto) authRoutine() {
 		// success
 		c.direct.health.SetAuthRoutineInError(nil)
 		c.mu.Lock()
-		c.urlToVisit = ""
-		c.loggedIn = true
-		c.loginGoal = nil
+		// Only commit the login success if no concurrent Login()
+		// call has reset the goal and no Logout() has moved on
+		// while our control plane request was in flight. In the
+		// first case, clearing the goal would prevent the next
+		// iteration from picking it up and running with it. In
+		// the second case, we would record that we're loggedIn
+		// even though we're logged out.
+		goalStillCurrentGoal := c.loginGoal == goal
+		if goalStillCurrentGoal {
+			c.urlToVisit = ""
+			c.loggedIn = true
+			c.loginGoal = nil
+		}
 		c.mu.Unlock()
 
-		c.sendStatus("authRoutine-success", nil, "", nil)
-		c.restartMap()
+		if goalStillCurrentGoal {
+			c.sendStatus("authRoutine-success", nil, "", nil)
+			c.restartMap()
+		}
 		bo.Reset()
 	}
 }
@@ -462,36 +496,106 @@ func (mrs mapRoutineState) UpdateNetmapDelta(muts []netmap.NodeMutation) bool {
 	c.mu.Lock()
 	goodState := c.loggedIn && c.inMapPoll
 	ndu, canDelta := c.observer.(NetmapDeltaUpdater)
+	mapCtx := c.mapCtx
 	c.mu.Unlock()
 
 	if !goodState || !canDelta {
 		return false
 	}
 
-	ctx, cancel := context.WithTimeout(c.mapCtx, 2*time.Second)
+	ctx, cancel := context.WithTimeout(mapCtx, 2*time.Second)
 	defer cancel()
 
-	var ok bool
-	err := c.observerQueue.RunSync(ctx, func() {
-		ok = ndu.UpdateNetmapDelta(muts)
+	ch := make(chan bool, 1)
+	c.observerQueue.Add(func() {
+		ch <- ndu.UpdateNetmapDelta(muts)
 	})
-	return err == nil && ok
+	select {
+	case ok := <-ch:
+		return ok
+	case <-ctx.Done():
+		return false
+	}
 }
 
-var _ patchDiscoKeyer = mapRoutineState{}
+var (
+	_ PacketFilterUpdater = mapRoutineState{}
+	_ UserProfileUpdater  = mapRoutineState{}
+)
+
+// UpdatePacketFilter implements [PacketFilterUpdater] by forwarding to
+// [Auto.observer] if it implements [PacketFilterUpdater]. It returns
+// false (signaling fall back to a full netmap rebuild) if the
+// downstream observer doesn't implement [PacketFilterUpdater] or isn't
+// in a state to accept updates.
+func (mrs mapRoutineState) UpdatePacketFilter(rules views.Slice[tailcfg.FilterRule], parsed []filter.Match) bool {
+	c := mrs.c
+	c.mu.Lock()
+	goodState := c.loggedIn && c.inMapPoll
+	pfu, ok := c.observer.(PacketFilterUpdater)
+	mapCtx := c.mapCtx
+	c.mu.Unlock()
+	if !goodState || !ok {
+		return false
+	}
+	ctx, cancel := context.WithTimeout(mapCtx, 2*time.Second)
+	defer cancel()
+	ch := make(chan bool, 1)
+	c.observerQueue.Add(func() {
+		ch <- pfu.UpdatePacketFilter(rules, parsed)
+	})
+	select {
+	case applied := <-ch:
+		return applied
+	case <-ctx.Done():
+		return false
+	}
+}
+
+// UpdateUserProfiles implements [UserProfileUpdater] by forwarding to
+// [Auto.observer] if it implements [UserProfileUpdater]. It returns
+// false (signaling fall back to a full netmap rebuild) if the
+// downstream observer doesn't implement [UserProfileUpdater] or isn't
+// in a state to accept updates.
+func (mrs mapRoutineState) UpdateUserProfiles(profiles map[tailcfg.UserID]tailcfg.UserProfileView) bool {
+	c := mrs.c
+	c.mu.Lock()
+	goodState := c.loggedIn && c.inMapPoll
+	upu, ok := c.observer.(UserProfileUpdater)
+	mapCtx := c.mapCtx
+	c.mu.Unlock()
+	if !goodState || !ok {
+		return false
+	}
+	ctx, cancel := context.WithTimeout(mapCtx, 2*time.Second)
+	defer cancel()
+	ch := make(chan bool, 1)
+	c.observerQueue.Add(func() {
+		ch <- upu.UpdateUserProfiles(profiles)
+	})
+	select {
+	case applied := <-ch:
+		return applied
+	case <-ctx.Done():
+		return false
+	}
+}
+
+var _ DiscoKeyUpdater = mapRoutineState{}
 
 func (mrs mapRoutineState) PatchDiscoKey(pub key.NodePublic, disco key.DiscoPublic) {
 	c := mrs.c
 	c.mu.Lock()
 	goodState := c.loggedIn && c.inMapPoll
-	dun, ok := c.observer.(patchDiscoKeyer)
+	dun, ok := c.observer.(DiscoKeyUpdater)
+	mapCtx := c.mapCtx
 	c.mu.Unlock()
 
 	if !goodState || !ok {
 		return
 	}
 
-	ctx, cancel := context.WithTimeout(c.mapCtx, 2*time.Second)
+	ctx, cancel := context.WithTimeout(mapCtx, 2*time.Second)
 	defer cancel()
 
 	c.observerQueue.RunSync(ctx, func() {
diff --git a/control/controlclient/auto_test.go b/control/controlclient/auto_test.go
new file mode 100644
index 000000000..1c7e89521
--- /dev/null
+++ b/control/controlclient/auto_test.go
@@ -0,0 +1,66 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package controlclient
+
+import (
+	"context"
+	"sync"
+	"testing"
+	"time"
+
+	"tailscale.com/tailcfg"
+)
+
+type userProfileUpdateObserver struct{}
+
+func (userProfileUpdateObserver) SetControlClientStatus(Client, Status) {}
+
+func (userProfileUpdateObserver) UpdateUserProfiles(map[tailcfg.UserID]tailcfg.UserProfileView) bool {
+	return true
+}
+
+func TestMapRoutineStateUpdateUserProfilesConcurrentCancelMapCtx(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	c := &Auto{
+		logf:      func(string, ...any) {},
+		observer:  userProfileUpdateObserver{},
+		mapCtx:    ctx,
+		mapCancel: cancel,
+		loggedIn:  true,
+		inMapPoll: true,
+	}
+	mrs := mapRoutineState{c: c}
+
+	start := make(chan struct{})
+	var wg sync.WaitGroup
+	for range 4 {
+		wg.Go(func() {
+			<-start
+			for range 2000 {
+				c.mu.Lock()
+				c.cancelMapCtxLocked()
+				c.mu.Unlock()
+			}
+		})
+	}
+	for range 4 {
+		wg.Go(func() {
+			<-start
+			for range 2000 {
+				mrs.UpdateUserProfiles(nil)
+			}
+		})
+	}
+
+	close(start)
+	wg.Wait()
+
+	waitCtx, cancel := context.WithTimeout(t.Context(), 5*time.Second)
+	defer cancel()
+	if err := c.observerQueue.Wait(waitCtx); err != nil {
+		t.Fatal(err)
+	}
+	c.observerQueue.Shutdown()
+	c.mapCancel()
+}
diff --git a/control/controlclient/controlclient_test.go b/control/controlclient/controlclient_test.go
index 2205a0eb3..5c25af0f4 100644
--- a/control/controlclient/controlclient_test.go
+++ b/control/controlclient/controlclient_test.go
@@ -406,6 +406,118 @@ func testHTTPS(t *testing.T, withProxy bool) {
 	}
 }
 
+// TestRegisterRateLimited verifies that the client correctly handles 429
+// responses to registration requests by parsing the Retry-After header
+// and returning a rateLimitError.
+func TestRegisterRateLimited(t *testing.T) {
+	bakedroots.ResetForTest(t, tlstest.TestRootCA())
+
+	bus := eventbustest.NewBus(t)
+
+	controlLn, err := tls.Listen("tcp", "127.0.0.1:0", tlstest.ControlPlane.ServerTLSConfig())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer controlLn.Close()
+
+	var registerAttempts atomic.Int64
+	tc := &testcontrol.Server{
+		Logf: tstest.WhileTestRunningLogger(t),
+		MaybeRateLimitRegister: func() (bool, string, string) {
+			if registerAttempts.Add(1) == 1 {
+				return true, "30", "try again later"
+			}
+			return false, "", ""
+		},
+	}
+	controlSrv := &http.Server{
+		Handler:  tc,
+		ErrorLog: logger.StdLogger(t.Logf),
+	}
+	go controlSrv.Serve(controlLn)
+
+	const fakeControlIP = "1.2.3.4"
+
+	dialer := &tsdial.Dialer{}
+	dialer.SetNetMon(netmon.NewStatic())
+	dialer.SetBus(bus)
+	dialer.SetSystemDialerForTest(func(ctx context.Context, network, addr string) (net.Conn, error) {
+		host, _, err := net.SplitHostPort(addr)
+		if err != nil {
+			return nil, fmt.Errorf("SplitHostPort(%q): %v", addr, err)
+		}
+		var d net.Dialer
+		if host == fakeControlIP {
+			return d.DialContext(ctx, network, controlLn.Addr().String())
+		}
+		return nil, fmt.Errorf("unexpected dial to %q", addr)
+	})
+
+	opts := Options{
+		Persist: persist.Persist{},
+		GetMachinePrivateKey: func() (key.MachinePrivate, error) {
+			return key.NewMachine(), nil
+		},
+		ServerURL: "https://controlplane.tstest",
+		Clock:     tstime.StdClock{},
+		Hostinfo: &tailcfg.Hostinfo{
+			BackendLogID: "test-backend-log-id",
+		},
+		DiscoPublicKey: key.NewDisco().Public(),
+		Logf:           t.Logf,
+		HealthTracker:  health.NewTracker(bus),
+		PopBrowserURL: func(url string) {
+			t.Logf("PopBrowserURL: %q", url)
+		},
+		Dialer: dialer,
+		Bus:    bus,
+	}
+	d, err := NewDirect(opts)
+	if err != nil {
+		t.Fatalf("NewDirect: %v", err)
+	}
+
+	d.dnsCache.LookupIPForTest = func(ctx context.Context, host string) ([]netip.Addr, error) {
+		if host == "controlplane.tstest" {
+			return []netip.Addr{netip.MustParseAddr(fakeControlIP)}, nil
+		}
+		t.Errorf("unexpected DNS query for %q", host)
+		return nil, fmt.Errorf("unexpected DNS lookup for %q", host)
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	// First attempt should get a 429 and return a rateLimitError.
+	_, err = d.TryLogin(ctx, LoginEphemeral)
+	if err == nil {
+		t.Fatal("expected rate limit error on first attempt, got nil")
+	}
+	var rle *rateLimitError
+	if !errors.As(err, &rle) {
+		t.Fatalf("expected *rateLimitError, got %T: %v", err, err)
+	}
+	if rle.retryAfter != 30*time.Second {
+		t.Errorf("retryAfter = %v, want 30s", rle.retryAfter)
+	}
+	if rle.msg != "try again later" {
+		t.Errorf("msg = %q, want %q", rle.msg, "try again later")
+	}
+
+	// Second attempt should succeed (server no longer rate-limiting).
+	url, err := d.TryLogin(ctx, LoginEphemeral)
+	if err != nil {
+		t.Fatalf("TryLogin after rate limit: %v", err)
+	}
+	if url != "" {
+		t.Errorf("got URL %q, want empty", url)
+	}
+
+	if got := registerAttempts.Load(); got != 2 {
+		t.Errorf("register attempts = %d, want 2", got)
+	}
+}
+
 func connectProxyTo(t testing.TB, target, backendAddrPort string, reqs *atomic.Int64) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.RequestURI != target {
diff --git a/control/controlclient/direct.go b/control/controlclient/direct.go
index d873cc745..8ac635616 100644
--- a/control/controlclient/direct.go
+++ b/control/controlclient/direct.go
@@ -17,6 +17,7 @@ import (
 	"fmt"
 	"io"
 	"log"
+	"math/rand/v2"
 	"net"
 	"net/http"
 	"net/netip"
@@ -24,6 +25,7 @@ import (
 	"reflect"
 	"runtime"
 	"slices"
+	"strconv"
 	"strings"
 	"sync/atomic"
 	"time"
@@ -41,6 +43,7 @@ import (
 	"tailscale.com/net/dnscache"
 	"tailscale.com/net/dnsfallback"
 	"tailscale.com/net/netmon"
+	"tailscale.com/net/netutil"
 	"tailscale.com/net/netx"
 	"tailscale.com/net/tlsdial"
 	"tailscale.com/net/tsdial"
@@ -54,6 +57,7 @@ import (
 	"tailscale.com/types/netmap"
 	"tailscale.com/types/persist"
 	"tailscale.com/types/tkatype"
+	"tailscale.com/types/views"
 	"tailscale.com/util/clientmetric"
 	"tailscale.com/util/eventbus"
 	"tailscale.com/util/singleflight"
@@ -62,6 +66,7 @@ import (
 	"tailscale.com/util/testenv"
 	"tailscale.com/util/vizerror"
 	"tailscale.com/util/zstdframe"
+	"tailscale.com/wgengine/filter"
 )
 
 // Direct is the client that connects to a tailcontrol server for a node.
@@ -224,6 +229,9 @@ type NetmapUpdater interface {
 // rather than just full updates.
 type NetmapDeltaUpdater interface {
 	// UpdateNetmapDelta is called with discrete changes to the network map.
+	// The mutation slice may contain [netmap.NodeMutationUpsert] entries when
+	// peers are inserted or replaced, and [netmap.NodeMutationRemove] entries
+	// when peers are removed, alongside per-field patches.
 	//
 	// The ok result is whether the implementation was able to apply the
 	// mutations. It might return false if its internal state doesn't
@@ -232,10 +240,56 @@ type NetmapDeltaUpdater interface {
 	UpdateNetmapDelta([]netmap.NodeMutation) (ok bool)
 }
 
-// patchDiscoKeyer is an optional interface that can be implemented by an [Observer] to be
+// PacketFilterUpdater is an optional interface that can be implemented by
+// NetmapUpdater implementations to receive incremental packet-filter updates
+// without a full netmap rebuild.
+//
+// It exists because the packet filter currently changes on every peer
+// addition, so a MapResponse carrying PeersChanged almost always also carries
+// PacketFilter (or PacketFilters). Handling the filter narrowly keeps peer
+// churn O(1) on the controlclient side.
+type PacketFilterUpdater interface {
+	// UpdatePacketFilter is called when a MapResponse's PacketFilter (or
+	// PacketFilters) changed. rules is the already-merged concatenation of
+	// the session's named packet filter chunks; parsed is the parsed form.
+	//
+	// It returns false to signal the caller to fall back to a full
+	// netmap rebuild. Proxy/forwarder implementations return false when
+	// their downstream destination doesn't implement
+	// [PacketFilterUpdater]; concrete implementations return true on
+	// successful apply.
+	UpdatePacketFilter(rules views.Slice[tailcfg.FilterRule], parsed []filter.Match) bool
+}
+
+// UserProfileUpdater is an optional interface that can be implemented by
+// NetmapUpdater implementations to receive incremental UserProfile updates
+// without a full netmap rebuild.
+//
+// It exists so consumers of [ipn.Notify.UserProfiles] can be told about
+// new or updated UserProfiles before (or with) the [ipn.Notify.PeersChanged]
+// or [ipn.Notify.PeerChangedPatch] entry that references the corresponding
+// UserID.
+type UserProfileUpdater interface {
+	// UpdateUserProfiles is called when a MapResponse carries UserProfiles
+	// entries. profiles is the new/updated subset (NOT the full map);
+	// implementations should merge with whatever they already know.
+	//
+	// The values are [tailcfg.UserProfileView]s sharing backing memory
+	// with the caller's tracking map; implementations may store them
+	// directly without copying.
+	//
+	// It returns false to signal the caller to fall back to a full
+	// netmap rebuild. Proxy/forwarder implementations return false when
+	// their downstream destination doesn't implement
+	// [UserProfileUpdater]; concrete implementations return true on
+	// successful apply.
+	UpdateUserProfiles(profiles map[tailcfg.UserID]tailcfg.UserProfileView) bool
+}
+
+// DiscoKeyUpdater is an optional interface that can be implemented by an [Observer] to be
 // notified about node disco keys received out-of-band from control, via
 // existing connection state.
-type patchDiscoKeyer interface {
+type DiscoKeyUpdater interface {
 	// PatchDiscoKey reports to the receiver that the specified disco key
 	// for node was obtained out-of-band from control.
 	PatchDiscoKey(key.NodePublic, key.DiscoPublic)
@@ -294,7 +348,7 @@ func NewDirect(opts Options) (*Direct, error) {
 	}
 	var interceptedDial *atomic.Bool
 	if httpc == nil {
-		tr := http.DefaultTransport.(*http.Transport).Clone()
+		tr := netutil.NewDefaultTransport()
 		if buildfeatures.HasUseProxy {
 			tr.Proxy = feature.HookProxyFromEnvironment.GetOrNil()
 			if f, ok := feature.HookProxySetTransportGetProxyConnectHeader.GetOk(); ok {
@@ -575,6 +629,37 @@ var macOSScreenTime = health.Register(&health.Warnable{
 	ImpactsConnectivity: true,
 })
 
+type rateLimitError struct {
+	msg        string
+	retryAfter time.Duration
+}
+
+func (e *rateLimitError) Error() string {
+	return fmt.Sprintf("rate limited: %s (retry after %v)", e.msg, e.retryAfter)
+}
+
+func parseRateLimitError(res *http.Response) *rateLimitError {
+	msg, _ := io.ReadAll(res.Body)
+	res.Body.Close()
+
+	ret := &rateLimitError{
+		msg: strings.TrimSpace(string(msg)),
+	}
+
+	v := res.Header.Get("Retry-After")
+	if i, err := strconv.Atoi(v); err == nil {
+		ret.retryAfter = time.Duration(i) * time.Second
+	} else if t, err := http.ParseTime(v); err == nil {
+		ret.retryAfter = time.Until(t)
+	}
+
+	// If the server didn't give us a valid Retry-After, default to 10s.
+	if ret.retryAfter <= 0 || ret.retryAfter > time.Hour {
+		ret.retryAfter = 5*time.Second + rand.N(5*time.Second)
+	}
+	return ret
+}
+
 func (c *Direct) doLogin(ctx context.Context, opt loginOpt) (mustRegen bool, newURL string, nks tkatype.MarshaledSignature, err error) {
 	if c.panicOnUse {
 		panic("tainted client")
@@ -769,6 +854,12 @@ func (c *Direct) doLogin(ctx context.Context, opt loginOpt) (mustRegen bool, new
 	if err != nil {
 		return regen, opt.URL, nil, fmt.Errorf("register request: %w", err)
 	}
+	// Handle 429 Too Many Requests with a specific error type that includes the retry-after duration.
+	if res.StatusCode == 429 {
+		rle := parseRateLimitError(res)
+		msg := fmt.Sprintf("node registration rate limited; will retry after %v", rle.retryAfter)
+		return false, "", nil, vizerror.WrapWithMessage(rle, msg)
+	}
 	if res.StatusCode != 200 {
 		msg, _ := io.ReadAll(res.Body)
 		res.Body.Close()
diff --git a/control/controlclient/direct_test.go b/control/controlclient/direct_test.go
index d10b346ae..98741482f 100644
--- a/control/controlclient/direct_test.go
+++ b/control/controlclient/direct_test.go
@@ -5,9 +5,11 @@ package controlclient
 
 import (
 	"encoding/json"
+	"errors"
 	"net/http"
 	"net/http/httptest"
 	"net/netip"
+	"strings"
 	"testing"
 	"time"
 
@@ -126,6 +128,109 @@ func fakeEndpoints(ports ...uint16) (ret []tailcfg.Endpoint) {
 	return
 }
 
+func TestParseRateLimitError(t *testing.T) {
+	tests := []struct {
+		name       string
+		statusCode int
+		body       string
+		retryAfter string // Retry-After header value
+		wantMsg    string
+		wantMin    time.Duration // minimum expected retryAfter
+		wantMax    time.Duration // maximum expected retryAfter
+	}{
+		{
+			name:       "retry-after-seconds",
+			statusCode: 429,
+			body:       "too many requests",
+			retryAfter: "30",
+			wantMsg:    "too many requests",
+			wantMin:    30 * time.Second,
+			wantMax:    30 * time.Second,
+		},
+		{
+			name:       "no-retry-after-header",
+			statusCode: 429,
+			body:       "slow down",
+			retryAfter: "",
+			wantMsg:    "slow down",
+			wantMin:    5 * time.Second,
+			wantMax:    10 * time.Second,
+		},
+		{
+			name:       "unparseable-retry-after",
+			statusCode: 429,
+			body:       "rate limited",
+			retryAfter: "not-a-number",
+			wantMsg:    "rate limited",
+			wantMin:    5 * time.Second,
+			wantMax:    10 * time.Second,
+		},
+		{
+			name:       "empty-body",
+			statusCode: 429,
+			body:       "",
+			retryAfter: "5",
+			wantMsg:    "",
+			wantMin:    5 * time.Second,
+			wantMax:    5 * time.Second,
+		},
+		{
+			name:       "body-with-whitespace",
+			statusCode: 429,
+			body:       "  too many requests  \n",
+			retryAfter: "10",
+			wantMsg:    "too many requests",
+			wantMin:    10 * time.Second,
+			wantMax:    10 * time.Second,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			rec := httptest.NewRecorder()
+			if tt.retryAfter != "" {
+				rec.Header().Set("Retry-After", tt.retryAfter)
+			}
+			rec.WriteHeader(tt.statusCode)
+			rec.Body.WriteString(tt.body)
+			res := rec.Result()
+
+			err := parseRateLimitError(res)
+			if err == nil {
+				t.Fatal("expected non-nil error")
+			}
+
+			var rle *rateLimitError
+			if !errors.As(err, &rle) {
+				t.Fatalf("error is not a *rateLimitError: %T", err)
+			}
+			if rle.msg != tt.wantMsg {
+				t.Errorf("msg = %q, want %q", rle.msg, tt.wantMsg)
+			}
+			if rle.retryAfter < tt.wantMin || rle.retryAfter > tt.wantMax {
+				t.Errorf("retryAfter = %v, want between %v and %v", rle.retryAfter, tt.wantMin, tt.wantMax)
+			}
+
+			// Verify the Error() string contains useful information.
+			errStr := err.Error()
+			if !strings.Contains(errStr, "rate limited") {
+				t.Errorf("Error() = %q, want it to contain 'rate limited'", errStr)
+			}
+		})
+	}
+}
+
+func TestRateLimitErrorIsError(t *testing.T) {
+	err := &rateLimitError{msg: "test", retryAfter: 5 * time.Second}
+	var target *rateLimitError
+	if !errors.As(err, &target) {
+		t.Fatal("errors.As should match *rateLimitError")
+	}
+	if target.retryAfter != 5*time.Second {
+		t.Errorf("retryAfter = %v, want 5s", target.retryAfter)
+	}
+}
+
 func TestTsmpPing(t *testing.T) {
 	hi := hostinfo.New()
 	ni := tailcfg.NetInfo{LinkType: "wired"}
diff --git a/control/controlclient/map.go b/control/controlclient/map.go
index c8cbdbce5..77ca0e68d 100644
--- a/control/controlclient/map.go
+++ b/control/controlclient/map.go
@@ -200,6 +200,11 @@ func (ms *mapSession) Close() {
 var ErrChangeQueueClosed = errors.New("change queue closed")
 
 func (ms *mapSession) updateDiscoForNode(id tailcfg.NodeID, key key.NodePublic, discoKey key.DiscoPublic, lastSeen time.Time, online bool) error {
+	if discoKey.IsZero() {
+		ms.logf("[v1] controlclient: received zero disco key update from nodeID %v", id)
+		return nil
+	}
+
 	ms.cqmu.Lock()
 
 	if ms.changeQueueClosed {
@@ -207,6 +212,7 @@ func (ms *mapSession) updateDiscoForNode(id tailcfg.NodeID, key key.NodePublic,
 		ms.processQueue.Wait()
 		return ErrChangeQueueClosed
 	}
+	defer ms.cqmu.Unlock()
 
 	resp := responseWithSource{
 		response: &tailcfg.MapResponse{
@@ -220,12 +226,24 @@ func (ms *mapSession) updateDiscoForNode(id tailcfg.NodeID, key key.NodePublic,
 		},
 		viaTSMP: true,
 	}
-	ms.changeQueue <- resp
-	ms.cqmu.Unlock()
-	return nil
+	return ms.addRespToQueue(resp)
 }
 
+// HandleNonKeepAliveMapResponse handles a non-KeepAlive MapResponse (full or
+// incremental).
+//
+// All fields that are valid on a KeepAlive MapResponse have already been
+// handled.
+//
+// Debug messages are handled first, followed by pushing the response onto a
+// queue for new updates handled sequentially.
 func (ms *mapSession) HandleNonKeepAliveMapResponse(ctx context.Context, resp *tailcfg.MapResponse) error {
+	if debug := resp.Debug; debug != nil {
+		if err := ms.onDebug(ctx, debug); err != nil {
+			return err
+		}
+	}
+
 	ms.cqmu.Lock()
 
 	if ms.changeQueueClosed {
@@ -234,14 +252,23 @@ func (ms *mapSession) HandleNonKeepAliveMapResponse(ctx context.Context, resp *t
 		return ErrChangeQueueClosed
 	}
 
+	defer ms.cqmu.Unlock()
+
 	change := responseWithSource{
 		response: resp,
 		viaTSMP:  false,
 	}
 
-	ms.changeQueue <- change
-	ms.cqmu.Unlock()
-	return nil
+	return ms.addRespToQueue(change)
+}
+
+func (ms *mapSession) addRespToQueue(resp responseWithSource) error {
+	select {
+	case ms.changeQueue <- resp:
+		return nil
+	case <-ms.sessionAliveCtx.Done():
+		return ErrChangeQueueClosed
+	}
 }
 
 // handleNonKeepAliveMapResponse handles a non-KeepAlive MapResponse (full or
@@ -253,12 +280,6 @@ func (ms *mapSession) HandleNonKeepAliveMapResponse(ctx context.Context, resp *t
 // TODO(bradfitz): make this handle all fields later. For now (2023-08-20) this
 // is [re]factoring progress enough.
 func (ms *mapSession) handleNonKeepAliveMapResponse(ctx context.Context, resp *tailcfg.MapResponse, viaTSMP bool) error {
-	if debug := resp.Debug; debug != nil {
-		if err := ms.onDebug(ctx, debug); err != nil {
-			return err
-		}
-	}
-
 	if DevKnob.StripEndpoints() {
 		for _, p := range resp.Peers {
 			p.Endpoints = nil
@@ -298,7 +319,12 @@ func (ms *mapSession) handleNonKeepAliveMapResponse(ctx context.Context, resp *t
 
 	ms.patchifyPeersChanged(resp)
 
-	ms.removeUnwantedDiscoUpdates(resp)
+	ms.removeUnwantedDiscoUpdates(resp, viaTSMP)
+
+	// TSMP learned key was rejected, no need to do any more work in the engine.
+	if viaTSMP && len(resp.PeersChangedPatch) == 0 {
+		return nil
+	}
 	ms.removeUnwantedDiscoUpdatesFromFullNetmapUpdate(resp)
 
 	ms.updateStateFromResponse(resp)
@@ -311,9 +337,11 @@ func (ms *mapSession) handleNonKeepAliveMapResponse(ctx context.Context, resp *t
 	}
 
 	if ms.tryHandleIncrementally(resp) {
+		metricMapResponseHandledIncrementally.Add(1)
 		ms.occasionallyPrintSummary(ms.lastNetmapSummary)
 		return nil
 	}
+	metricMapResponseHandledFullRebuild.Add(1)
 
 	// We have to rebuild the whole netmap (lots of garbage & work downstream of
 	// our UpdateFullNetmap call). This is the part we tried to avoid but
@@ -339,7 +367,7 @@ func (ms *mapSession) handleNonKeepAliveMapResponse(ctx context.Context, resp *t
 }
 
 func (ms *mapSession) tryMarkDiscoAsLearnedFromTSMP(res *tailcfg.MapResponse) {
-	dun, ok := ms.netmapUpdater.(patchDiscoKeyer)
+	dun, ok := ms.netmapUpdater.(DiscoKeyUpdater)
 	if !ok {
 		return
 	}
@@ -378,6 +406,12 @@ func upgradeNode(n *tailcfg.Node) {
 	if n.AllowedIPs == nil {
 		n.AllowedIPs = slices.Clone(n.Addresses)
 	}
+	// Unsigned peers aren't covered by tailnet lock, so a (possibly malicious)
+	// control server must not grant them network access via advertised routes.
+	// Strip any AllowedIPs beyond their own addresses.
+	if n.UnsignedPeerAPIOnly && !slices.Equal(n.AllowedIPs, n.Addresses) {
+		n.AllowedIPs = slices.Clone(n.Addresses)
+	}
 }
 
 func (ms *mapSession) tryHandleIncrementally(res *tailcfg.MapResponse) bool {
@@ -388,11 +422,49 @@ func (ms *mapSession) tryHandleIncrementally(res *tailcfg.MapResponse) bool {
 	if !ok {
 		return false
 	}
+	// If the response carries a new packet filter, the updater must
+	// support pushing it narrowly; otherwise fall back to a full netmap
+	// rebuild. PacketFilter/PacketFilters are no longer in
+	// mapResponseContainsNonPatchFields, so MutationsFromMapResponse will
+	// happily return mutations alongside a filter change — we need to
+	// deliver the filter separately before those mutations land.
+	if res.PacketFilter != nil || res.PacketFilters != nil {
+		pfu, ok := ms.netmapUpdater.(PacketFilterUpdater)
+		if !ok {
+			return false
+		}
+		if !pfu.UpdatePacketFilter(ms.lastPacketFilterRules, ms.lastParsedPacketFilter) {
+			return false
+		}
+	}
+	// Same shape for UserProfiles: deliver any new/updated profiles before
+	// the peer mutations that may reference them, so bus consumers never
+	// see a UserID for which a profile hasn't been published. The values
+	// are read from ms.lastUserProfile (just populated by
+	// updateStateFromResponse) so views are shared with mapSession's
+	// store; downstream consumers can use [UserProfileView.Equal] for
+	// dedup without copying.
+	if len(res.UserProfiles) > 0 {
+		upu, ok := ms.netmapUpdater.(UserProfileUpdater)
+		if !ok {
+			return false
+		}
+		profiles := make(map[tailcfg.UserID]tailcfg.UserProfileView, len(res.UserProfiles))
+		for _, up := range res.UserProfiles {
+			profiles[up.ID] = ms.lastUserProfile[up.ID]
+		}
+		if !upu.UpdateUserProfiles(profiles) {
+			return false
+		}
+	}
 	mutations, ok := netmap.MutationsFromMapResponse(res, time.Now())
-	if ok && len(mutations) > 0 {
+	if !ok {
+		return false
+	}
+	if len(mutations) > 0 {
 		return nud.UpdateNetmapDelta(mutations)
 	}
-	return ok
+	return true
 }
 
 // updateStats are some stats from updateStateFromResponse, primarily for
@@ -407,7 +479,7 @@ type updateStats struct {
 
 // removeUnwantedDiscoUpdates goes over the patchified updates and reject items
 // where the node is offline and has last been seen before the recorded last seen.
-func (ms *mapSession) removeUnwantedDiscoUpdates(resp *tailcfg.MapResponse) {
+func (ms *mapSession) removeUnwantedDiscoUpdates(resp *tailcfg.MapResponse, viaTSMP bool) {
 	ms.peersMu.RLock()
 	defer ms.peersMu.RUnlock()
 
@@ -422,6 +494,30 @@ func (ms *mapSession) removeUnwantedDiscoUpdates(resp *tailcfg.MapResponse) {
 			continue
 		}
 
+		existingNode, ok := ms.peers[change.NodeID]
+		// Accept if:
+		// - Cannot find the peer, don't have enough data.
+		if !ok {
+			acceptedDiscoUpdates = append(acceptedDiscoUpdates, change)
+			continue
+		}
+
+		// Reject if:
+		// - key was learned via tsmp AND,
+		// - existing node is online AND,
+		// - key did not change.
+		// Here to avoid a deeper reconfig in the case where we get a TSMP key
+		// exchange while that node is already in a connected state (from the view
+		// of the control plane). This is meant to keep the node stable, avoiding a
+		// reconfiguration of the node deeper down in the engine.
+		// With this, we are avoiding updating the LastSeen and Online fields from
+		// TSMP updates when that is not relevant, overall making the connection
+		// state change less, and updating the engine less.
+		if viaTSMP && existingNode.Online().Get() &&
+			*change.DiscoKey == existingNode.DiscoKey() {
+			continue
+		}
+
 		// Accept if:
 		// - Node is online.
 		if *change.Online {
@@ -429,17 +525,10 @@ func (ms *mapSession) removeUnwantedDiscoUpdates(resp *tailcfg.MapResponse) {
 			continue
 		}
 
-		existingNode, ok := ms.peers[change.NodeID]
 		// Accept if:
-		// - Cannot find the peer, don't have enough data
-		if !ok {
-			acceptedDiscoUpdates = append(acceptedDiscoUpdates, change)
-			continue
-		}
-
-		// Accept if:
-		// - lastSeen moved forward in time.
-		if existingLastSeen, ok := existingNode.LastSeen().GetOk(); ok &&
+		// - if we don't have a last seen to compare against on the existing node.
+		// - OR lastSeen moved forward in time.
+		if existingLastSeen, ok := existingNode.LastSeen().GetOk(); !ok ||
 			change.LastSeen.After(existingLastSeen) {
 			acceptedDiscoUpdates = append(acceptedDiscoUpdates, change)
 		}
@@ -497,8 +586,13 @@ func (ms *mapSession) removeUnwantedDiscoUpdatesFromFullNetmapUpdate(resp *tailc
 			continue
 		}
 
-		// Overwrite the key in the full netmap update.
+		// Overwrite the key and last seen in the full netmap update.
 		peer.DiscoKey = existingNode.DiscoKey()
+		if t, ok := existingNode.LastSeen().GetOk(); ok {
+			peer.LastSeen = new(t)
+		} else {
+			peer.LastSeen = nil
+		}
 	}
 }
 
@@ -670,6 +764,17 @@ var (
 
 	patchifiedPeer      = clientmetric.NewCounter("controlclient_patchified_peer")
 	patchifiedPeerEqual = clientmetric.NewCounter("controlclient_patchified_peer_equal")
+
+	// metricMapResponseHandledIncrementally counts non-keepalive MapResponses
+	// that were processed via [mapSession.tryHandleIncrementally] (i.e. the
+	// "fast" delta path that avoids rebuilding the full netmap).
+	metricMapResponseHandledIncrementally = clientmetric.NewCounter("controlclient_map_response_handled_incrementally")
+
+	// metricMapResponseHandledFullRebuild counts non-keepalive MapResponses
+	// that fell through to the full netmap rebuild path because they
+	// carried a field that the incremental path can't handle. See
+	// [netmap.mapResponseContainsNonPatchFields].
+	metricMapResponseHandledFullRebuild = clientmetric.NewCounter("controlclient_map_response_handled_full_rebuild")
 )
 
 // updatePeersStateFromResponseres updates ms.peers from resp.
@@ -812,13 +917,22 @@ func (ms *mapSession) addUserProfile(nm *netmap.NetworkMap, userID tailcfg.UserI
 }
 
 var debugPatchifyPeer = envknob.RegisterBool("TS_DEBUG_PATCHIFY_PEER")
+var debugPatchifyPeerMiss = envknob.RegisterBool("TS_DEBUG_PATCHIFY_PEER_MISS")
+
+// patchifyMissOnFalse, if non-nil, is called with the field name when
+// patchifyPeer fails. It is set by an init func in map_debug.go.
+var patchifyMissOnFalse func(string)
 
 // patchifyPeersChanged mutates resp to promote PeersChanged entries to PeersChangedPatch
 // when possible.
 func (ms *mapSession) patchifyPeersChanged(resp *tailcfg.MapResponse) {
+	var onFalse func(string)
+	if debugPatchifyPeerMiss() {
+		onFalse = patchifyMissOnFalse
+	}
 	filtered := resp.PeersChanged[:0]
 	for _, n := range resp.PeersChanged {
-		if p, ok := ms.patchifyPeer(n); ok {
+		if p, ok := ms.patchifyPeer(n, onFalse); ok {
 			patchifiedPeer.Add(1)
 			if debugPatchifyPeer() {
 				patchj, _ := json.Marshal(p)
@@ -856,21 +970,27 @@ func getNodeFields() []string {
 //
 // It returns ok=false if a patch can't be made, (V, ok) on a delta, or (nil,
 // true) if all the fields were identical (a zero change).
-func (ms *mapSession) patchifyPeer(n *tailcfg.Node) (_ *tailcfg.PeerChange, ok bool) {
+func (ms *mapSession) patchifyPeer(n *tailcfg.Node, onFalse func(string)) (_ *tailcfg.PeerChange, ok bool) {
 	ms.peersMu.RLock()
 	defer ms.peersMu.RUnlock()
 
 	was, ok := ms.peers[n.ID]
 	if !ok {
+		if onFalse != nil {
+			onFalse("peer_not_found")
+		}
 		return nil, false
 	}
-	return peerChangeDiff(was, n)
+	return peerChangeDiff(was, n, onFalse)
 }
 
 // peerChangeDiff returns the difference from 'was' to 'n', if possible.
 //
 // It returns (nil, true) if the fields were identical.
-func peerChangeDiff(was tailcfg.NodeView, n *tailcfg.Node) (_ *tailcfg.PeerChange, ok bool) {
+func peerChangeDiff(was tailcfg.NodeView, n *tailcfg.Node, onFalse func(string)) (_ *tailcfg.PeerChange, ok bool) {
+	if onFalse == nil {
+		onFalse = func(string) {}
+	}
 	var ret *tailcfg.PeerChange
 	pc := func() *tailcfg.PeerChange {
 		if ret == nil {
@@ -894,22 +1014,27 @@ func peerChangeDiff(was tailcfg.NodeView, n *tailcfg.Node) (_ *tailcfg.PeerChang
 			// And it was never sent by any known control server.
 		case "ID":
 			if was.ID() != n.ID {
+				onFalse(field)
 				return nil, false
 			}
 		case "StableID":
 			if was.StableID() != n.StableID {
+				onFalse(field)
 				return nil, false
 			}
 		case "Name":
 			if was.Name() != n.Name {
+				onFalse(field)
 				return nil, false
 			}
 		case "User":
 			if was.User() != n.User {
+				onFalse(field)
 				return nil, false
 			}
 		case "Sharer":
 			if was.Sharer() != n.Sharer {
+				onFalse(field)
 				return nil, false
 			}
 		case "Key":
@@ -926,6 +1051,7 @@ func peerChangeDiff(was tailcfg.NodeView, n *tailcfg.Node) (_ *tailcfg.PeerChang
 			}
 		case "Machine":
 			if was.Machine() != n.Machine {
+				onFalse(field)
 				return nil, false
 			}
 		case "DiscoKey":
@@ -934,10 +1060,12 @@ func peerChangeDiff(was tailcfg.NodeView, n *tailcfg.Node) (_ *tailcfg.PeerChang
 			}
 		case "Addresses":
 			if !views.SliceEqual(was.Addresses(), views.SliceOf(n.Addresses)) {
+				onFalse(field)
 				return nil, false
 			}
 		case "AllowedIPs":
 			if !views.SliceEqual(was.AllowedIPs(), views.SliceOf(n.AllowedIPs)) {
+				onFalse(field)
 				return nil, false
 			}
 		case "Endpoints":
@@ -957,13 +1085,16 @@ func peerChangeDiff(was tailcfg.NodeView, n *tailcfg.Node) (_ *tailcfg.PeerChang
 				continue
 			}
 			if !was.Hostinfo().Valid() || !n.Hostinfo.Valid() {
+				onFalse(field)
 				return nil, false
 			}
 			if !was.Hostinfo().Equal(n.Hostinfo) {
+				onFalse(field)
 				return nil, false
 			}
 		case "Created":
 			if !was.Created().Equal(n.Created) {
+				onFalse(field)
 				return nil, false
 			}
 		case "Cap":
@@ -991,10 +1122,12 @@ func peerChangeDiff(was tailcfg.NodeView, n *tailcfg.Node) (_ *tailcfg.PeerChang
 			}
 		case "Tags":
 			if !views.SliceEqual(was.Tags(), views.SliceOf(n.Tags)) {
+				onFalse(field)
 				return nil, false
 			}
 		case "PrimaryRoutes":
 			if !views.SliceEqual(was.PrimaryRoutes(), views.SliceOf(n.PrimaryRoutes)) {
+				onFalse(field)
 				return nil, false
 			}
 		case "Online":
@@ -1007,22 +1140,27 @@ func peerChangeDiff(was tailcfg.NodeView, n *tailcfg.Node) (_ *tailcfg.PeerChang
 			}
 		case "MachineAuthorized":
 			if was.MachineAuthorized() != n.MachineAuthorized {
+				onFalse(field)
 				return nil, false
 			}
 		case "UnsignedPeerAPIOnly":
 			if was.UnsignedPeerAPIOnly() != n.UnsignedPeerAPIOnly {
+				onFalse(field)
 				return nil, false
 			}
 		case "IsWireGuardOnly":
 			if was.IsWireGuardOnly() != n.IsWireGuardOnly {
+				onFalse(field)
 				return nil, false
 			}
 		case "IsJailed":
 			if was.IsJailed() != n.IsJailed {
+				onFalse(field)
 				return nil, false
 			}
 		case "Expired":
 			if was.Expired() != n.Expired {
+				onFalse(field)
 				return nil, false
 			}
 		case "SelfNodeV4MasqAddrForThisPeer":
@@ -1031,6 +1169,7 @@ func peerChangeDiff(was tailcfg.NodeView, n *tailcfg.Node) (_ *tailcfg.PeerChang
 				continue
 			}
 			if va, ok := va.GetOk(); !ok || vb == nil || va != *vb {
+				onFalse(field)
 				return nil, false
 			}
 		case "SelfNodeV6MasqAddrForThisPeer":
@@ -1039,17 +1178,20 @@ func peerChangeDiff(was tailcfg.NodeView, n *tailcfg.Node) (_ *tailcfg.PeerChang
 				continue
 			}
 			if va, ok := va.GetOk(); !ok || vb == nil || va != *vb {
+				onFalse(field)
 				return nil, false
 			}
 		case "ExitNodeDNSResolvers":
 			va, vb := was.ExitNodeDNSResolvers(), views.SliceOfViews(n.ExitNodeDNSResolvers)
 
 			if va.Len() != vb.Len() {
+				onFalse(field)
 				return nil, false
 			}
 
 			for i := range va.Len() {
 				if !va.At(i).Equal(vb.At(i)) {
+					onFalse(field)
 					return nil, false
 				}
 			}
diff --git a/control/controlclient/map_debug.go b/control/controlclient/map_debug.go
new file mode 100644
index 000000000..2d6012211
--- /dev/null
+++ b/control/controlclient/map_debug.go
@@ -0,0 +1,16 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !ts_omit_debug
+
+package controlclient
+
+import "tailscale.com/metrics"
+
+var patchifyMissStats = metrics.NewLabelMap("counter_patchify_miss", "why")
+
+func init() {
+	patchifyMissOnFalse = func(field string) {
+		patchifyMissStats.Add(field, 1)
+	}
+}
diff --git a/control/controlclient/map_test.go b/control/controlclient/map_test.go
index f057345d9..fb4307c39 100644
--- a/control/controlclient/map_test.go
+++ b/control/controlclient/map_test.go
@@ -14,6 +14,7 @@ import (
 	"strings"
 	"sync/atomic"
 	"testing"
+	"testing/synctest"
 	"time"
 
 	"github.com/google/go-cmp/cmp"
@@ -33,9 +34,7 @@ import (
 	"tailscale.com/util/eventbus/eventbustest"
 	"tailscale.com/util/mak"
 	"tailscale.com/util/must"
-	"tailscale.com/util/usermetric"
 	"tailscale.com/util/zstdframe"
-	"tailscale.com/wgengine"
 )
 
 func eps(s ...string) []netip.AddrPort {
@@ -630,81 +629,171 @@ func TestUpdateDiscoForNode(t *testing.T) {
 		name            string
 		initialOnline   bool
 		initialLastSeen time.Time
+		updateDiscoKey  func() key.DiscoPublic
 		updateOnline    bool
 		updateLastSeen  time.Time
 		wantUpdate      bool
+		wantKeyChanged  bool
 	}{
 		{
 			name:            "newer_key_not_online",
 			initialOnline:   true,
 			initialLastSeen: time.Unix(1, 0),
+			updateDiscoKey:  key.NewDisco().Public,
 			updateOnline:    false,
 			updateLastSeen:  time.Now(),
 			wantUpdate:      true,
+			wantKeyChanged:  true,
 		},
 		{
 			name:            "newer_key_online",
 			initialOnline:   true,
 			initialLastSeen: time.Unix(1, 0),
+			updateDiscoKey:  key.NewDisco().Public,
 			updateOnline:    true,
 			updateLastSeen:  time.Now(),
 			wantUpdate:      true,
+			wantKeyChanged:  true,
 		},
 		{
 			name:            "older_key_not_online",
 			initialOnline:   false,
 			initialLastSeen: time.Now(),
+			updateDiscoKey:  key.NewDisco().Public,
 			updateOnline:    false,
 			updateLastSeen:  time.Unix(1, 0),
 			wantUpdate:      false,
+			wantKeyChanged:  false,
 		},
 		{
 			name:            "older_key_online",
 			initialOnline:   false,
 			initialLastSeen: time.Now(),
+			updateDiscoKey:  key.NewDisco().Public,
 			updateOnline:    true,
 			updateLastSeen:  time.Unix(1, 0),
 			wantUpdate:      true,
+			wantKeyChanged:  true,
+		},
+		{
+			name:            "same_newer_key_not_online",
+			initialOnline:   true,
+			initialLastSeen: time.Unix(1, 0),
+			updateDiscoKey:  nil,
+			updateOnline:    false,
+			updateLastSeen:  time.Now(),
+			wantUpdate:      false,
+			wantKeyChanged:  false,
+		},
+		{
+			name:            "same_newer_key_online",
+			initialOnline:   true,
+			initialLastSeen: time.Unix(1, 0),
+			updateDiscoKey:  nil,
+			updateOnline:    true,
+			updateLastSeen:  time.Now(),
+			wantUpdate:      false,
+			wantKeyChanged:  false,
+		},
+		{
+			name:            "same_older_key_not_online",
+			initialOnline:   false,
+			initialLastSeen: time.Now(),
+			updateDiscoKey:  nil,
+			updateOnline:    false,
+			updateLastSeen:  time.Unix(1, 0),
+			wantUpdate:      false,
+			wantKeyChanged:  false,
+		},
+		{
+			name:            "same_older_key_online",
+			initialOnline:   false,
+			initialLastSeen: time.Now(),
+			updateDiscoKey:  nil,
+			updateOnline:    true,
+			updateLastSeen:  time.Unix(1, 0),
+			wantUpdate:      true,
+			wantKeyChanged:  false,
+		},
+		{
+			name:           "no_initial_last_seen",
+			initialOnline:  false,
+			updateDiscoKey: key.NewDisco().Public,
+			updateOnline:   false,
+			updateLastSeen: time.Now(),
+			wantUpdate:     true,
+			wantKeyChanged: true,
+		},
+		{
+			name:          "zero_key",
+			initialOnline: false,
+			updateDiscoKey: func() key.DiscoPublic {
+				return key.DiscoPublic{}
+			},
+			updateOnline:   false,
+			updateLastSeen: time.Now(),
+			wantUpdate:     false,
+			wantKeyChanged: false,
 		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			nu := &rememberLastNetmapUpdater{
-				done: make(chan any, 1),
-			}
-			ms := newTestMapSession(t, nu)
+			synctest.Test(t, func(*testing.T) {
+				nu := &rememberLastNetmapUpdater{
+					done: make(chan any, 1),
+				}
+				ms := newTestMapSession(t, nu)
+				defer ms.Close()
 
-			oldKey := key.NewDisco()
+				oldKey := key.NewDisco()
 
-			// Insert existing node
-			node := tailcfg.Node{
-				ID:       1,
-				Key:      key.NewNode().Public(),
-				DiscoKey: oldKey.Public(),
-				Online:   &tt.initialOnline,
-				LastSeen: &tt.initialLastSeen,
-			}
+				// Insert existing node
+				node := tailcfg.Node{
+					ID:       1,
+					Key:      key.NewNode().Public(),
+					DiscoKey: oldKey.Public(),
+					Online:   &tt.initialOnline,
+				}
+				if !tt.initialLastSeen.IsZero() {
+					node.LastSeen = &tt.initialLastSeen
+				}
 
-			if nm := ms.netmapForResponse(&tailcfg.MapResponse{
-				Peers: []*tailcfg.Node{&node},
-			}); len(nm.Peers) != 1 {
-				t.Fatalf("node not inserted")
-			}
+				if nm := ms.netmapForResponse(&tailcfg.MapResponse{
+					Peers: []*tailcfg.Node{&node},
+				}); len(nm.Peers) != 1 {
+					t.Fatalf("node not inserted")
+				}
 
-			newKey := key.NewDisco()
-			ms.updateDiscoForNode(node.ID, node.Key, newKey.Public(), tt.updateLastSeen, tt.updateOnline)
-			<-nu.done
+				newKey := oldKey.Public()
+				if tt.updateDiscoKey != nil {
+					newKey = tt.updateDiscoKey()
+				}
+				ms.updateDiscoForNode(node.ID, node.Key, newKey, tt.updateLastSeen, tt.updateOnline)
 
-			peer, ok := ms.peers[node.ID]
-			if !ok {
-				t.Fatal("node not found")
-			}
+				// We have an early escape that would not trigger the netmap updater.
+				synctest.Wait()
+				select {
+				case <-nu.done:
+					if !tt.wantUpdate {
+						t.Errorf("did not expect update, got: %v", nu.last)
+					}
+				default:
+					if tt.wantUpdate {
+						t.Errorf("expected update, did not get any")
+					}
+				}
 
-			updated := peer.DiscoKey().Compare(newKey.Public()) == 0
-			if updated != tt.wantUpdate {
-				t.Fatalf("Disco key update: %t, wanted update: %t", updated, tt.wantUpdate)
-			}
+				peer, ok := ms.peers[node.ID]
+				if !ok {
+					t.Fatal("node not found")
+				}
+
+				keyChanged := peer.DiscoKey().Compare(oldKey.Public()) != 0
+				if keyChanged != tt.wantKeyChanged {
+					t.Errorf("Disco key update: %t, wanted update: %t", keyChanged, tt.wantKeyChanged)
+				}
+			})
 		})
 	}
 }
@@ -785,6 +874,53 @@ func TestUpdateDiscoForNodeCallback(t *testing.T) {
 				nu.lastTSMPKey, nu.lastTSMPDisco)
 		}
 	})
+
+	t.Run("test_deadlock", func(t *testing.T) {
+		nu := &rememberLastNetmapUpdater{
+			done: make(chan any, 1),
+		}
+		ms := newTestMapSession(t, nu)
+		// Very barebones onDebug func that will let us exercise sleep command
+		// from control and potentially induce deadlocks.
+		ms.onDebug = func(ctx context.Context, d *tailcfg.Debug) error {
+			time.Sleep(time.Duration(d.SleepSeconds * float64(time.Second)))
+			return nil
+		}
+
+		oldKey := key.NewDisco()
+
+		// Insert existing node
+		node := tailcfg.Node{
+			ID:       1,
+			Key:      key.NewNode().Public(),
+			DiscoKey: oldKey.Public(),
+			Online:   new(false),
+			LastSeen: new(time.Unix(1, 0)),
+		}
+
+		if nm := ms.netmapForResponse(&tailcfg.MapResponse{
+			Peers: []*tailcfg.Node{&node},
+		}); len(nm.Peers) != 1 {
+			t.Fatalf("node not inserted")
+		}
+
+		sleep1 := &tailcfg.MapResponse{
+			Debug: &tailcfg.Debug{
+				SleepSeconds: 1.0,
+			},
+		}
+		ms.HandleNonKeepAliveMapResponse(t.Context(), sleep1)
+
+		// Resembles the disco key advert subscriber running in a separate context.
+		go func() {
+			newKey := key.NewDisco()
+			ms.updateDiscoForNode(node.ID, node.Key, newKey.Public(), time.Now(), false)
+		}()
+
+		ms.Close()
+
+		<-nu.done
+	})
 }
 
 func TestUpdateDiscoForNodeCallbackWithFullNetmap(t *testing.T) {
@@ -831,6 +967,14 @@ func TestUpdateDiscoForNodeCallbackWithFullNetmap(t *testing.T) {
 			updateLastSeen:  now,
 			expectNewDisco:  true,
 		},
+		{
+			name:            "local-lastseen-preserved-after-first-reconnect",
+			initialOnline:   false,
+			initialLastSeen: now,
+			updateOnline:    false,
+			updateLastSeen:  now,
+			expectNewDisco:  false,
+		},
 	}
 
 	for _, tt := range tests {
@@ -1115,17 +1259,20 @@ func TestPeerChangeDiff(t *testing.T) {
 			a:    &tailcfg.Node{ID: 1, CapMap: tailcfg.NodeCapMap{tailcfg.CapabilityAdmin: nil}},
 			b:    &tailcfg.Node{ID: 1, CapMap: tailcfg.NodeCapMap{tailcfg.CapabilityAdmin: nil, tailcfg.CapabilityDebug: nil}},
 			want: &tailcfg.PeerChange{NodeID: 1, CapMap: tailcfg.NodeCapMap{tailcfg.CapabilityAdmin: nil, tailcfg.CapabilityDebug: nil}},
-		}, {
+		},
+		{
 			name: "patch-capmap-remove-key",
 			a:    &tailcfg.Node{ID: 1, CapMap: tailcfg.NodeCapMap{tailcfg.CapabilityAdmin: nil}},
 			b:    &tailcfg.Node{ID: 1, CapMap: tailcfg.NodeCapMap{}},
 			want: &tailcfg.PeerChange{NodeID: 1, CapMap: tailcfg.NodeCapMap{}},
-		}, {
+		},
+		{
 			name: "patch-capmap-remove-as-nil",
 			a:    &tailcfg.Node{ID: 1, CapMap: tailcfg.NodeCapMap{tailcfg.CapabilityAdmin: nil}},
 			b:    &tailcfg.Node{ID: 1},
 			want: &tailcfg.PeerChange{NodeID: 1, CapMap: tailcfg.NodeCapMap{}},
-		}, {
+		},
+		{
 			name: "patch-capmap-add-key-to-empty-map",
 			a:    &tailcfg.Node{ID: 1},
 			b:    &tailcfg.Node{ID: 1, CapMap: tailcfg.NodeCapMap{tailcfg.CapabilityAdmin: nil}},
@@ -1140,7 +1287,7 @@ func TestPeerChangeDiff(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			pc, ok := peerChangeDiff(tt.a.View(), tt.b)
+			pc, ok := peerChangeDiff(tt.a.View(), tt.b, nil)
 			if tt.wantEqual {
 				if !ok || pc != nil {
 					t.Errorf("got (%p, %v); want (nil, true); pc=%v", pc, ok, logger.AsJSON(pc))
@@ -1161,7 +1308,7 @@ func TestPeerChangeDiffAllocs(t *testing.T) {
 	a := &tailcfg.Node{ID: 1}
 	b := &tailcfg.Node{ID: 1}
 	n := testing.AllocsPerRun(10000, func() {
-		diff, ok := peerChangeDiff(a.View(), b)
+		diff, ok := peerChangeDiff(a.View(), b, nil)
 		if !ok || diff != nil {
 			t.Fatalf("unexpected result: (%s, %v)", logger.AsJSON(diff), ok)
 		}
@@ -1179,6 +1326,56 @@ func (nu *countingNetmapUpdater) UpdateFullNetmap(nm *netmap.NetworkMap) {
 	nu.full.Add(1)
 }
 
+type countingDeltaNetmapUpdater struct {
+	countingNetmapUpdater
+	delta atomic.Int64
+}
+
+func (nu *countingDeltaNetmapUpdater) UpdateNetmapDelta([]netmap.NodeMutation) bool {
+	nu.delta.Add(1)
+	return true
+}
+
+func TestExistingPeerReplacementHandledIncrementally(t *testing.T) {
+	nu := &countingDeltaNetmapUpdater{}
+	ms := newTestMapSession(t, nu)
+	ctx := t.Context()
+
+	peer := &tailcfg.Node{
+		ID:         1,
+		StableID:   "peer",
+		Name:       "peer.example.ts.net.",
+		Key:        key.NewNode().Public(),
+		DiscoKey:   key.NewDisco().Public(),
+		Addresses:  []netip.Prefix{netip.MustParsePrefix("100.64.0.1/32")},
+		AllowedIPs: []netip.Prefix{netip.MustParsePrefix("100.64.0.1/32")},
+		Hostinfo:   (&tailcfg.Hostinfo{}).View(),
+	}
+	if err := ms.handleNonKeepAliveMapResponse(ctx, &tailcfg.MapResponse{
+		Node:  &tailcfg.Node{Name: "self.example.ts.net."},
+		Peers: []*tailcfg.Node{peer},
+	}, false); err != nil {
+		t.Fatal(err)
+	}
+	if got := nu.full.Load(); got != 1 {
+		t.Fatalf("full updates after initial response = %d; want 1", got)
+	}
+
+	replacement := peer.Clone()
+	replacement.AllowedIPs = append(replacement.AllowedIPs, netip.MustParsePrefix("100.64.0.2/32"))
+	if err := ms.handleNonKeepAliveMapResponse(ctx, &tailcfg.MapResponse{
+		PeersChanged: []*tailcfg.Node{replacement},
+	}, false); err != nil {
+		t.Fatal(err)
+	}
+	if got := nu.full.Load(); got != 1 {
+		t.Errorf("full updates after route-changing peer replacement = %d; want 1", got)
+	}
+	if got := nu.delta.Load(); got != 1 {
+		t.Errorf("delta updates after route-changing peer replacement = %d; want 1", got)
+	}
+}
+
 // tests (*mapSession).patchifyPeersChanged; smaller tests are in TestPeerChangeDiff
 func TestPatchifyPeersChanged(t *testing.T) {
 	hi := (&tailcfg.Hostinfo{}).View()
@@ -1350,6 +1547,24 @@ func TestUpgradeNode(t *testing.T) {
 			in:   &tailcfg.Node{Addresses: []netip.Prefix{a1, a2}, AllowedIPs: []netip.Prefix{}},
 			want: &tailcfg.Node{Addresses: []netip.Prefix{a1, a2}, AllowedIPs: []netip.Prefix{}},
 		},
+		{
+			// An unsigned peer is not covered by tailnet lock and must not carry advertised routes
+			name: "unsigned-peer-strips-extra-allowed-ips",
+			in:   &tailcfg.Node{Addresses: []netip.Prefix{a1, a2}, AllowedIPs: []netip.Prefix{a1, a2, a3, a4}, UnsignedPeerAPIOnly: true},
+			want: &tailcfg.Node{Addresses: []netip.Prefix{a1, a2}, AllowedIPs: []netip.Prefix{a1, a2}, UnsignedPeerAPIOnly: true},
+		},
+		{
+			// An unsigned peer whose AllowedIPs already equal its Addresses is left untouched
+			name: "unsigned-peer-allowed-ips-equal-addresses",
+			in:   &tailcfg.Node{Addresses: []netip.Prefix{a1, a2}, AllowedIPs: []netip.Prefix{a1, a2}, UnsignedPeerAPIOnly: true},
+			want: &tailcfg.Node{Addresses: []netip.Prefix{a1, a2}, AllowedIPs: []netip.Prefix{a1, a2}, UnsignedPeerAPIOnly: true},
+		},
+		{
+			// A signed peer keeps its advertised routes: the strip only applies to unsigned peers
+			name: "signed-peer-keeps-extra-allowed-ips",
+			in:   &tailcfg.Node{Addresses: []netip.Prefix{a1, a2}, AllowedIPs: []netip.Prefix{a1, a2, a3, a4}},
+			want: &tailcfg.Node{Addresses: []netip.Prefix{a1, a2}, AllowedIPs: []netip.Prefix{a1, a2, a3, a4}},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -1366,7 +1581,6 @@ func TestUpgradeNode(t *testing.T) {
 			}
 		})
 	}
-
 }
 
 func BenchmarkMapSessionDelta(b *testing.B) {
@@ -1762,25 +1976,6 @@ func TestLearnZstdOfKeepAlive(t *testing.T) {
 	}
 }
 
-func TestPathDiscokeyerImplementations(t *testing.T) {
-	bus := eventbustest.NewBus(t)
-	ht := health.NewTracker(bus)
-	reg := new(usermetric.Registry)
-	e, err := wgengine.NewFakeUserspaceEngine(t.Logf, 0, ht, reg, bus)
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(e.Close)
-	if _, ok := e.(patchDiscoKeyer); !ok {
-		t.Error("wgengine.userspaceEngine must implement patchDiscoKeyer")
-	}
-
-	wd := wgengine.NewWatchdog(e)
-	if _, ok := wd.(patchDiscoKeyer); !ok {
-		t.Error("wgengine.watchdogEngine must implement patchDiscoKeyer")
-	}
-}
-
 func TestPeerIDAndKeyByTailscaleIP(t *testing.T) {
 	peerKey1 := key.NewNode().Public()
 	peerKey2 := key.NewNode().Public()
@@ -1838,3 +2033,101 @@ func TestPeerIDAndKeyByTailscaleIP(t *testing.T) {
 		}
 	})
 }
+
+func TestRemoveUnwantedDiscoUpdates(t *testing.T) {
+	tests := []struct {
+		name           string
+		viaTSMP        bool
+		existingOnline bool
+		sameKey        bool
+		newerLastSeen  bool
+		wantAccepted   bool
+	}{
+		{
+			name:           "tsmp_online_peer_same_key",
+			viaTSMP:        true,
+			existingOnline: true,
+			sameKey:        true,
+			newerLastSeen:  true,
+			wantAccepted:   false,
+		},
+		{
+			name:           "not_tsmp_online_peer_same_key",
+			viaTSMP:        false,
+			existingOnline: true,
+			sameKey:        true,
+			newerLastSeen:  true,
+			wantAccepted:   true,
+		},
+		{
+			name:           "tsmp_offline_peer_same_key",
+			viaTSMP:        true,
+			existingOnline: false,
+			sameKey:        true,
+			newerLastSeen:  true,
+			wantAccepted:   true,
+		},
+		{
+			name:           "tsmp_online_peer_diff_key",
+			viaTSMP:        true,
+			existingOnline: true,
+			sameKey:        false,
+			newerLastSeen:  true,
+			wantAccepted:   true,
+		},
+		{
+			name:           "tsmp_online_peer_same_key_old_lastseen",
+			viaTSMP:        true,
+			existingOnline: true,
+			sameKey:        true,
+			newerLastSeen:  false,
+			wantAccepted:   false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ms := newTestMapSession(t, &rememberLastNetmapUpdater{done: make(chan any, 1)})
+
+			existingKey := key.NewDisco().Public()
+			existingOnline := tt.existingOnline
+			initialLastSeen := time.Unix(1, 0)
+
+			ms.updateStateFromResponse(&tailcfg.MapResponse{
+				Peers: []*tailcfg.Node{{
+					ID:       1,
+					Key:      key.NewNode().Public(),
+					DiscoKey: existingKey,
+					Online:   &existingOnline,
+					LastSeen: &initialLastSeen,
+				}},
+			})
+
+			changeKey := existingKey
+			if !tt.sameKey {
+				changeKey = key.NewDisco().Public()
+			}
+			changeOnline := false // must be false to reach the new guard
+			updateLastSeen := time.Unix(2, 0)
+			if !tt.newerLastSeen {
+				updateLastSeen = time.Unix(0, 0)
+			}
+
+			resp := &tailcfg.MapResponse{
+				PeersChangedPatch: []*tailcfg.PeerChange{{
+					NodeID:   1,
+					DiscoKey: &changeKey,
+					Online:   &changeOnline,
+					LastSeen: &updateLastSeen,
+				}},
+			}
+
+			ms.removeUnwantedDiscoUpdates(resp, tt.viaTSMP)
+
+			got := len(resp.PeersChangedPatch) > 0
+			if got != tt.wantAccepted {
+				t.Errorf("accepted=%v, want %v", got, tt.wantAccepted)
+			}
+		})
+	}
+}
diff --git a/control/controlclient/sign_supported.go b/control/controlclient/sign_supported.go
index ea6fa28e3..f3340d5a6 100644
--- a/control/controlclient/sign_supported.go
+++ b/control/controlclient/sign_supported.go
@@ -1,9 +1,7 @@
 // Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
-//go:build windows
-
-// darwin,cgo is also supported by certstore but untested, so it is not enabled.
+//go:build windows || (darwin && !ios && cgo)
 
 package controlclient
 
diff --git a/control/controlclient/sign_unsupported.go b/control/controlclient/sign_unsupported.go
index ff830282e..a371cbaf1 100644
--- a/control/controlclient/sign_unsupported.go
+++ b/control/controlclient/sign_unsupported.go
@@ -1,7 +1,7 @@
 // Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
-//go:build !windows
+//go:build (!windows && !(darwin && cgo)) || ios
 
 package controlclient
 
diff --git a/control/controlhttp/client.go b/control/controlhttp/client.go
index 2aabcbb64..d93e19b95 100644
--- a/control/controlhttp/client.go
+++ b/control/controlhttp/client.go
@@ -459,7 +459,7 @@ func (a *Dialer) tryURLUpgrade(ctx context.Context, u *url.URL, optAddr netip.Ad
 		}()
 	}
 
-	tr := http.DefaultTransport.(*http.Transport).Clone()
+	tr := netutil.NewDefaultTransport()
 	defer tr.CloseIdleConnections()
 	if optACEHost != "" {
 		// If using ACE, we don't want to use any HTTP proxy.
diff --git a/control/controlhttp/client_js.go b/control/controlhttp/client_js.go
index a3ce7ffe5..e9a4e7dbb 100644
--- a/control/controlhttp/client_js.go
+++ b/control/controlhttp/client_js.go
@@ -32,7 +32,9 @@ func (d *Dialer) Dial(ctx context.Context) (*ClientConn, error) {
 	host := d.Hostname
 	// If using a custom control server (on a non-standard port), prefer that.
 	// This mirrors the port selection in newNoiseClient from noise.go.
-	if d.HTTPPort != "" && d.HTTPPort != "80" && d.HTTPSPort == "443" {
+	// Also use ws:// when HTTPS is explicitly disabled (NoPort), which happens
+	// for http:// URLs with private hostnames (e.g. http://localhost:31544).
+	if d.HTTPPort != "" && d.HTTPPort != "80" && (d.HTTPSPort == "443" || d.HTTPSPort == NoPort) {
 		wsScheme = "ws"
 		host = net.JoinHostPort(host, d.HTTPPort)
 	}
diff --git a/control/controlknobs/controlknobs.go b/control/controlknobs/controlknobs.go
index 14f30d9ce..280953cd9 100644
--- a/control/controlknobs/controlknobs.go
+++ b/control/controlknobs/controlknobs.go
@@ -21,16 +21,11 @@ type Knobs struct {
 	// DisableUPnP indicates whether to attempt UPnP mapping.
 	DisableUPnP atomic.Bool
 
-	// KeepFullWGConfig is whether we should disable the lazy wireguard
-	// programming and instead give WireGuard the full netmap always, even for
-	// idle peers.
-	KeepFullWGConfig atomic.Bool
-
 	// RandomizeClientPort is whether control says we should randomize
 	// the client port.
 	RandomizeClientPort atomic.Bool
 
-	// OneCGNAT is whether the the node should make one big CGNAT route
+	// OneCGNAT is whether the node should make one big CGNAT route
 	// in the OS rather than one /32 per peer.
 	OneCGNAT syncs.AtomicValue[opt.Bool]
 
@@ -62,12 +57,6 @@ type Knobs struct {
 	// netfiltering, unless overridden by the user.
 	LinuxForceNfTables atomic.Bool
 
-	// SeamlessKeyRenewal is whether to renew node keys without breaking connections.
-	// This is enabled by default in 1.90 and later, but we but we can remotely disable
-	// it from the control plane if there's a problem.
-	// http://go/seamless-key-renewal
-	SeamlessKeyRenewal atomic.Bool
-
 	// ProbeUDPLifetime is whether the node should probe UDP path lifetime on
 	// the tail end of an active direct connection in magicsock.
 	ProbeUDPLifetime atomic.Bool
@@ -121,6 +110,36 @@ type Knobs struct {
 	// See https://github.com/tailscale/tailscale/issues/15404.
 	// TODO(bradfitz): remove this a few releases after 2026-02-16.
 	ForceRegisterMagicDNSIPv4Only atomic.Bool
+
+	// EmitRuntimeMetrics is whether the node should poll and emit [runtime/metrics]
+	// as [tailscale.com/util/clientmetric]'s.
+	EmitRuntimeMetrics atomic.Bool
+
+	// DisableUDPGRO disables UDP GRO on the magicsock UDP socket. See
+	// [tailcfg.NodeAttrDisableUDPGRO].
+	DisableUDPGRO atomic.Bool
+
+	// DisableUDPGSO disables UDP GSO on the magicsock UDP socket. See
+	// [tailcfg.NodeAttrDisableUDPGSO].
+	DisableUDPGSO atomic.Bool
+
+	// DisableTUNUDPGRO disables UDP GRO on the Tailscale TUN device. See
+	// [tailcfg.NodeAttrDisableTUNUDPGRO].
+	DisableTUNUDPGRO atomic.Bool
+
+	// DisableTUNTCPGRO disables TCP GRO on the Tailscale TUN device. See
+	// [tailcfg.NodeAttrDisableTUNTCPGRO].
+	DisableTUNTCPGRO atomic.Bool
+
+	// NeverGSOEqualTail enables a UDP GSO sentinel-tail workaround in the
+	// underlay UDP packet TX path on Linux. Applies to magicsock and peer relay
+	// UDP sockets. See [tailcfg.NodeAttrNeverGSOEqualTail].
+	NeverGSOEqualTail atomic.Bool
+
+	// CacheNetworkMaps is whether the node should persistently cache network
+	// maps and use them to establish peer connectivity on start, if doing so
+	// is supported by the client and storage is available.
+	CacheNetworkMaps atomic.Bool
 }
 
 // UpdateFromNodeAttributes updates k (if non-nil) based on the provided self
@@ -131,7 +150,6 @@ func (k *Knobs) UpdateFromNodeAttributes(capMap tailcfg.NodeCapMap) {
 	}
 	has := capMap.Contains
 	var (
-		keepFullWG                           = has(tailcfg.NodeAttrDebugDisableWGTrim)
 		disableUPnP                          = has(tailcfg.NodeAttrDisableUPnP)
 		randomizeClientPort                  = has(tailcfg.NodeAttrRandomizeClientPort)
 		disableDeltaUpdates                  = has(tailcfg.NodeAttrDisableDeltaUpdates)
@@ -142,8 +160,6 @@ func (k *Knobs) UpdateFromNodeAttributes(capMap tailcfg.NodeCapMap) {
 		silentDisco                          = has(tailcfg.NodeAttrSilentDisco)
 		forceIPTables                        = has(tailcfg.NodeAttrLinuxMustUseIPTables)
 		forceNfTables                        = has(tailcfg.NodeAttrLinuxMustUseNfTables)
-		seamlessKeyRenewal                   = has(tailcfg.NodeAttrSeamlessKeyRenewal)
-		disableSeamlessKeyRenewal            = has(tailcfg.NodeAttrDisableSeamlessKeyRenewal)
 		probeUDPLifetime                     = has(tailcfg.NodeAttrProbeUDPLifetime)
 		appCStoreRoutes                      = has(tailcfg.NodeAttrStoreAppCRoutes)
 		userDialUseRoutes                    = has(tailcfg.NodeAttrUserDialUseRoutes)
@@ -153,6 +169,13 @@ func (k *Knobs) UpdateFromNodeAttributes(capMap tailcfg.NodeCapMap) {
 		disableSkipStatusQueue               = has(tailcfg.NodeAttrDisableSkipStatusQueue)
 		disableHostsFileUpdates              = has(tailcfg.NodeAttrDisableHostsFileUpdates)
 		forceRegisterMagicDNSIPv4Only        = has(tailcfg.NodeAttrForceRegisterMagicDNSIPv4Only)
+		emitRuntimeMetrics                   = has(tailcfg.NodeAttrEmitRuntimeMetrics)
+		disableUDPGRO                        = has(tailcfg.NodeAttrDisableUDPGRO)
+		disableUDPGSO                        = has(tailcfg.NodeAttrDisableUDPGSO)
+		disableTUNUDPGRO                     = has(tailcfg.NodeAttrDisableTUNUDPGRO)
+		disableTUNTCPGRO                     = has(tailcfg.NodeAttrDisableTUNTCPGRO)
+		neverGSOEqualTail                    = has(tailcfg.NodeAttrNeverGSOEqualTail)
+		cacheNetworkMaps                     = has(tailcfg.NodeAttrCacheNetworkMaps)
 	)
 
 	if has(tailcfg.NodeAttrOneCGNATEnable) {
@@ -161,7 +184,6 @@ func (k *Knobs) UpdateFromNodeAttributes(capMap tailcfg.NodeCapMap) {
 		oneCGNAT.Set(false)
 	}
 
-	k.KeepFullWGConfig.Store(keepFullWG)
 	k.DisableUPnP.Store(disableUPnP)
 	k.RandomizeClientPort.Store(randomizeClientPort)
 	k.OneCGNAT.Store(oneCGNAT)
@@ -181,21 +203,13 @@ func (k *Knobs) UpdateFromNodeAttributes(capMap tailcfg.NodeCapMap) {
 	k.DisableSkipStatusQueue.Store(disableSkipStatusQueue)
 	k.DisableHostsFileUpdates.Store(disableHostsFileUpdates)
 	k.ForceRegisterMagicDNSIPv4Only.Store(forceRegisterMagicDNSIPv4Only)
-
-	// If both attributes are present, then "enable" should win.  This reflects
-	// the history of seamless key renewal.
-	//
-	// Before 1.90, seamless was a private alpha, opt-in feature.  Devices would
-	// only seamless do if customers opted in using the seamless renewal attr.
-	//
-	// In 1.90 and later, seamless is the default behaviour, and devices will use
-	// seamless unless explicitly told not to by control (e.g. if we discover
-	// a bug and want clients to use the prior behaviour).
-	//
-	// If a customer has opted in to the pre-1.90 seamless implementation, we
-	// don't want to switch it off for them -- we only want to switch it off for
-	// devices that haven't opted in.
-	k.SeamlessKeyRenewal.Store(seamlessKeyRenewal || !disableSeamlessKeyRenewal)
+	k.EmitRuntimeMetrics.Store(emitRuntimeMetrics)
+	k.DisableUDPGRO.Store(disableUDPGRO)
+	k.DisableUDPGSO.Store(disableUDPGSO)
+	k.DisableTUNUDPGRO.Store(disableTUNUDPGRO)
+	k.DisableTUNTCPGRO.Store(disableTUNTCPGRO)
+	k.NeverGSOEqualTail.Store(neverGSOEqualTail)
+	k.CacheNetworkMaps.Store(cacheNetworkMaps)
 }
 
 // AsDebugJSON returns k as something that can be marshalled with json.Marshal
diff --git a/control/tsp/map.go b/control/tsp/map.go
new file mode 100644
index 000000000..961c5dd57
--- /dev/null
+++ b/control/tsp/map.go
@@ -0,0 +1,415 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package tsp
+
+import (
+	"bytes"
+	"cmp"
+	"context"
+	"encoding/binary"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"sync"
+	"sync/atomic"
+
+	"github.com/klauspost/compress/zstd"
+	"tailscale.com/control/ts2021"
+	"tailscale.com/tailcfg"
+	"tailscale.com/types/key"
+)
+
+// errSessionClosed is returned by [MapSession.Next] and
+// [MapSession.NextInto] when called after [MapSession.Close].
+var errSessionClosed = errors.New("tsp: map session closed")
+
+// DefaultMaxMessageSize is the default cap, in bytes, on the size of a
+// single compressed map response frame. See [MapOpts.MaxMessageSize].
+const DefaultMaxMessageSize = 4 << 20
+
+// zstdDecoderPool is a pool of *zstd.Decoder reused across MapSessions to
+// amortize the cost of setting up zstd state. Decoders are returned via
+// [MapSession.Close]; entries are reclaimed by the runtime under memory
+// pressure via sync.Pool semantics.
+var zstdDecoderPool sync.Pool // of *zstd.Decoder
+
+// MapOpts contains options for sending a map request.
+type MapOpts struct {
+	// NodeKey is the node's private key. Required.
+	NodeKey key.NodePrivate
+
+	// Hostinfo is the host information to send. Optional;
+	// if nil, a minimal default is used.
+	Hostinfo *tailcfg.Hostinfo
+
+	// Stream is whether to receive multiple MapResponses over
+	// the same HTTP connection.
+	Stream bool
+
+	// OmitPeers is whether the client is okay with the Peers list
+	// being omitted in the response.
+	OmitPeers bool
+
+	// MaxMessageSize is the maximum size in bytes of any single
+	// compressed map response frame on the wire. If zero,
+	// [DefaultMaxMessageSize] is used.
+	MaxMessageSize int64
+}
+
+// framedReader is an io.Reader that consumes a stream of length-prefixed
+// frames (each a little-endian uint32 length followed by that many bytes)
+// from r and yields only the frame payloads back-to-back.
+//
+// This lets us feed the concatenated zstd frames from our wire protocol
+// into a single streaming zstd decoder. Zstd's file format permits
+// concatenation (RFC 8478 §2), and klauspost's decoder handles it
+// transparently.
+//
+// If onNewFrame is non-nil, it is called after each new 4-byte length
+// header is successfully read. Used to reset the per-message decoded-size
+// budget downstream.
+type framedReader struct {
+	r          io.Reader
+	maxSize    int64 // per-frame compressed-size cap
+	remain     int   // bytes remaining in the current frame
+	onNewFrame func()
+}
+
+func (f *framedReader) Read(p []byte) (int, error) {
+	if f.remain == 0 {
+		var hdr [4]byte
+		if _, err := io.ReadFull(f.r, hdr[:]); err != nil {
+			return 0, err
+		}
+		sz := int64(binary.LittleEndian.Uint32(hdr[:]))
+		if sz == 0 {
+			return 0, fmt.Errorf("map response: zero-length frame")
+		}
+		if sz > f.maxSize {
+			return 0, fmt.Errorf("map response frame size %d exceeds max %d", sz, f.maxSize)
+		}
+		f.remain = int(sz)
+		if f.onNewFrame != nil {
+			f.onNewFrame()
+		}
+	}
+	if len(p) > f.remain {
+		p = p[:f.remain]
+	}
+	n, err := f.r.Read(p)
+	f.remain -= n
+	return n, err
+}
+
+// boundedReader is an io.Reader that yields at most remain bytes from r
+// before returning an error. Call reset to raise the budget back to max,
+// typically at a new message boundary.
+//
+// Used to cap the decoded size of a single map response so a malicious
+// server can't send a small zstd frame that explodes into gigabytes of
+// junk for the json.Decoder to consume.
+type boundedReader struct {
+	r      io.Reader
+	max    int64
+	remain int64
+}
+
+func (b *boundedReader) Read(p []byte) (int, error) {
+	if b.remain <= 0 {
+		return 0, fmt.Errorf("map response decoded size exceeds max %d", b.max)
+	}
+	if int64(len(p)) > b.remain {
+		p = p[:b.remain]
+	}
+	n, err := b.r.Read(p)
+	b.remain -= int64(n)
+	return n, err
+}
+
+func (b *boundedReader) reset() { b.remain = b.max }
+
+// MapSession wraps an in-progress map response stream. Call Next to read
+// each MapResponse. Call Close when done.
+type MapSession struct {
+	res       *http.Response
+	stream    bool
+	noiseDoer func(*http.Request) (*http.Response, error)
+
+	// inNext detects concurrent NextInto callers. It CAS-flips
+	// false→true on entry and back to false on exit; a failed CAS
+	// panics, akin to how the Go runtime detects concurrent map
+	// access. It does not serialize Close vs. NextInto; that's
+	// nextMu's job.
+	inNext atomic.Bool
+
+	// nextMu is held while [MapSession.NextInto] is running jdec.Decode,
+	// so that Close can wait for an in-flight Decode to unwind before it
+	// touches zdec (Reset, pool-Put) and avoids racing with the running
+	// Read chain that Decode drives.
+	nextMu sync.Mutex
+	read   int           // guarded by nextMu
+	closed bool          // guarded by nextMu
+	zdec   *zstd.Decoder // reads from a framedReader wrapping res.Body
+	jdec   *json.Decoder // reads decompressed JSON from zdec
+
+	closeOnce sync.Once
+	closeErr  error
+}
+
+// NoiseRoundTrip sends an HTTP request over the Noise channel used by this map session.
+func (s *MapSession) NoiseRoundTrip(req *http.Request) (*http.Response, error) {
+	return s.noiseDoer(req)
+}
+
+// Next reads and returns the next MapResponse from the stream.
+// For non-streaming sessions, the first call returns the single response
+// and subsequent calls return io.EOF.
+// For streaming sessions, Next blocks until the next response arrives
+// or the server closes the connection.
+//
+// Each call allocates a fresh MapResponse. Callers that want to amortize
+// the allocation across calls can use [MapSession.NextInto].
+//
+// Next and NextInto are not safe to call concurrently from multiple
+// goroutines on the same [MapSession]; a concurrent call panics, akin
+// to the Go runtime's concurrent map access detection. [MapSession.Close]
+// may be called concurrently to abort an in-flight Next.
+func (s *MapSession) Next() (*tailcfg.MapResponse, error) {
+	var resp tailcfg.MapResponse
+	if err := s.NextInto(&resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+// NextInto is like [MapSession.Next] but decodes the next MapResponse into
+// the caller-supplied *resp rather than allocating a new one. The pointer's
+// pointee is zeroed before decoding so fields from a prior response do not
+// persist.
+//
+// For non-streaming sessions, the first call decodes the single response
+// and subsequent calls return io.EOF.
+// For streaming sessions, NextInto blocks until the next response arrives
+// or the server closes the connection.
+//
+// See [MapSession.Next] for concurrency rules; those apply to NextInto too.
+func (s *MapSession) NextInto(resp *tailcfg.MapResponse) error {
+	if !s.inNext.CompareAndSwap(false, true) {
+		panic("tsp: invalid concurrent call to MapSession.Next/NextInto")
+	}
+	defer s.inNext.Store(false)
+
+	s.nextMu.Lock()
+	defer s.nextMu.Unlock()
+	if s.closed {
+		return errSessionClosed
+	}
+	if !s.stream && s.read > 0 {
+		return io.EOF
+	}
+	*resp = tailcfg.MapResponse{}
+	if err := s.jdec.Decode(resp); err != nil {
+		return err
+	}
+	s.read++
+	return nil
+}
+
+// Close returns the session's zstd decoder to the pool and closes the
+// underlying HTTP response body. It is safe to call Close multiple times
+// and from multiple goroutines, including while a [MapSession.Next] or
+// [MapSession.NextInto] call is in flight on another goroutine (which
+// will return an error once the body close propagates).
+func (s *MapSession) Close() error {
+	// Callers are likely to race a deferred Close with a time.AfterFunc
+	// timeout (or similar) Close that aborts a hung Next. Without the
+	// Once, both Closes would Put the same *zstd.Decoder into the pool,
+	// corrupting it, and the Reset/Put in one would race with the
+	// zdec.Read that the hung Next is driving.
+	//
+	// Ordering inside the Once: close the body first to unblock any
+	// in-flight NextInto (its Read chain ends at res.Body and will
+	// return an error once it's closed). That lets NextInto unwind and
+	// release nextMu. Only then do we take nextMu ourselves and touch
+	// zdec, which is safe because no goroutine is still reading from
+	// it. Acquiring nextMu before closing the body would deadlock
+	// against a hung NextInto.
+	s.closeOnce.Do(func() {
+		s.closeErr = s.res.Body.Close()
+		s.nextMu.Lock()
+		defer s.nextMu.Unlock()
+		s.closed = true
+		s.zdec.Reset(nil)
+		zstdDecoderPool.Put(s.zdec)
+	})
+	return s.closeErr
+}
+
+// SendMapUpdateOpts contains options for [Client.SendMapUpdate].
+type SendMapUpdateOpts struct {
+	// NodeKey is the node's private key. Required.
+	NodeKey key.NodePrivate
+
+	// DiscoKey, if non-zero, is the node's disco public key.
+	// Peers use it to verify disco pings from this node, which is
+	// what enables direct (non-DERP) paths.
+	DiscoKey key.DiscoPublic
+
+	// Hostinfo is the host information to send. Optional;
+	// if nil, a minimal default is used.
+	Hostinfo *tailcfg.Hostinfo
+}
+
+// SendMapUpdate sends a one-shot, non-streaming MapRequest to push small
+// updates (such as the node's endpoints, hostinfo, or disco public key) to the
+// coordination server without starting or disturbing a streaming map session.
+func (c *Client) SendMapUpdate(ctx context.Context, opts SendMapUpdateOpts) error {
+	if opts.NodeKey.IsZero() {
+		return fmt.Errorf("NodeKey is required")
+	}
+
+	hi := opts.Hostinfo
+	if hi == nil {
+		hi = defaultHostinfo()
+	}
+
+	mapReq := tailcfg.MapRequest{
+		Version:  tailcfg.CurrentCapabilityVersion,
+		NodeKey:  opts.NodeKey.Public(),
+		DiscoKey: opts.DiscoKey,
+		Hostinfo: hi,
+		Compress: "zstd",
+
+		// A lite update that lets the server persist our state without breaking
+		// any existing streaming map session. See the [tailcfg.MapResponse]
+		// OmitPeers docs.
+		OmitPeers: true,
+		Stream:    false,
+		ReadOnly:  false,
+	}
+
+	body, err := json.Marshal(mapReq)
+	if err != nil {
+		return fmt.Errorf("encoding map request: %w", err)
+	}
+
+	nc, err := c.noiseClient(ctx)
+	if err != nil {
+		return fmt.Errorf("establishing noise connection: %w", err)
+	}
+
+	url := c.serverURL + "/machine/map"
+	url = strings.Replace(url, "http:", "https:", 1)
+	req, err := http.NewRequestWithContext(ctx, "POST", url, bytes.NewReader(body))
+	if err != nil {
+		return fmt.Errorf("creating map request: %w", err)
+	}
+	ts2021.AddLBHeader(req, opts.NodeKey.Public())
+
+	res, err := nc.Do(req)
+	if err != nil {
+		return fmt.Errorf("map request: %w", err)
+	}
+	defer res.Body.Close()
+
+	if res.StatusCode != 200 {
+		msg, _ := io.ReadAll(res.Body)
+		return fmt.Errorf("map request: http %d: %.200s",
+			res.StatusCode, strings.TrimSpace(string(msg)))
+	}
+	io.Copy(io.Discard, res.Body)
+	return nil
+}
+
+// Map sends a map request to the coordination server and returns a MapSession
+// for reading the framed, zstd-compressed response(s).
+func (c *Client) Map(ctx context.Context, opts MapOpts) (*MapSession, error) {
+	if opts.NodeKey.IsZero() {
+		return nil, fmt.Errorf("NodeKey is required")
+	}
+
+	hi := opts.Hostinfo
+	if hi == nil {
+		hi = defaultHostinfo()
+	}
+
+	mapReq := tailcfg.MapRequest{
+		Version:   tailcfg.CurrentCapabilityVersion,
+		NodeKey:   opts.NodeKey.Public(),
+		Hostinfo:  hi,
+		Stream:    opts.Stream,
+		Compress:  "zstd",
+		OmitPeers: opts.OmitPeers,
+		// Streaming requires the server to track us as "connected",
+		// which in turn requires ReadOnly=false. Non-streaming polls
+		// stay ReadOnly to minimize side effects.
+		ReadOnly: !opts.Stream,
+	}
+
+	body, err := json.Marshal(mapReq)
+	if err != nil {
+		return nil, fmt.Errorf("encoding map request: %w", err)
+	}
+
+	nc, err := c.noiseClient(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("establishing noise connection: %w", err)
+	}
+
+	url := c.serverURL + "/machine/map"
+	url = strings.Replace(url, "http:", "https:", 1)
+	req, err := http.NewRequestWithContext(ctx, "POST", url, bytes.NewReader(body))
+	if err != nil {
+		return nil, fmt.Errorf("creating map request: %w", err)
+	}
+	ts2021.AddLBHeader(req, opts.NodeKey.Public())
+
+	res, err := nc.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("map request: %w", err)
+	}
+
+	if res.StatusCode != 200 {
+		msg, _ := io.ReadAll(res.Body)
+		res.Body.Close()
+		return nil, fmt.Errorf("map request: http %d: %.200s",
+			res.StatusCode, strings.TrimSpace(string(msg)))
+	}
+
+	maxMessageSize := cmp.Or(opts.MaxMessageSize, DefaultMaxMessageSize)
+	bounded := &boundedReader{max: maxMessageSize, remain: maxMessageSize}
+	fr := &framedReader{
+		r:          res.Body,
+		maxSize:    maxMessageSize,
+		onNewFrame: bounded.reset,
+	}
+
+	zdec, _ := zstdDecoderPool.Get().(*zstd.Decoder)
+	if zdec != nil {
+		if err := zdec.Reset(fr); err != nil {
+			// Reset can fail if the previous stream is in a bad state; drop
+			// the decoder and create a fresh one.
+			zdec = nil
+		}
+	}
+	if zdec == nil {
+		zdec, err = zstd.NewReader(fr, zstd.WithDecoderConcurrency(1))
+		if err != nil {
+			res.Body.Close()
+			return nil, fmt.Errorf("creating zstd decoder: %w", err)
+		}
+	}
+	bounded.r = zdec
+
+	return &MapSession{
+		res:       res,
+		stream:    opts.Stream,
+		noiseDoer: nc.Do,
+		zdec:      zdec,
+		jdec:      json.NewDecoder(bounded),
+	}, nil
+}
diff --git a/control/tsp/map_test.go b/control/tsp/map_test.go
new file mode 100644
index 000000000..ddfde3971
--- /dev/null
+++ b/control/tsp/map_test.go
@@ -0,0 +1,409 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package tsp
+
+import (
+	"bytes"
+	"context"
+	"encoding/binary"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/klauspost/compress/zstd"
+	"tailscale.com/health"
+	"tailscale.com/tailcfg"
+	"tailscale.com/tstest/integration/testcontrol"
+	"tailscale.com/types/key"
+)
+
+func TestMapAgainstTestControl(t *testing.T) {
+	ctrl := &testcontrol.Server{}
+	ctrl.HTTPTestServer = httptest.NewUnstartedServer(ctrl)
+	ctrl.HTTPTestServer.Start()
+	t.Cleanup(ctrl.HTTPTestServer.Close)
+	baseURL := ctrl.HTTPTestServer.URL
+
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	ht := new(health.Tracker)
+
+	serverKey, err := DiscoverServerKey(ctx, baseURL)
+	if err != nil {
+		t.Fatalf("DiscoverServerKey: %v", err)
+	}
+
+	register := func(hostname string) (nodeKey key.NodePrivate, machineKey key.MachinePrivate) {
+		t.Helper()
+		nodeKey = key.NewNode()
+		machineKey = key.NewMachine()
+		c, err := NewClient(ClientOpts{
+			ServerURL:     baseURL,
+			MachineKey:    machineKey,
+			HealthTracker: ht,
+		})
+		if err != nil {
+			t.Fatalf("NewClient %s: %v", hostname, err)
+		}
+		defer c.Close()
+		c.SetControlPublicKey(serverKey)
+		if _, err := c.Register(ctx, RegisterOpts{
+			NodeKey:  nodeKey,
+			Hostinfo: &tailcfg.Hostinfo{Hostname: hostname},
+		}); err != nil {
+			t.Fatalf("Register %s: %v", hostname, err)
+		}
+		return nodeKey, machineKey
+	}
+
+	nodeKeyA, machineKeyA := register("a")
+	nodeKeyB, _ := register("b")
+
+	clientA, err := NewClient(ClientOpts{
+		ServerURL:     baseURL,
+		MachineKey:    machineKeyA,
+		HealthTracker: ht,
+	})
+	if err != nil {
+		t.Fatalf("NewClient A: %v", err)
+	}
+	defer clientA.Close()
+	clientA.SetControlPublicKey(serverKey)
+
+	session, err := clientA.Map(ctx, MapOpts{
+		NodeKey:  nodeKeyA,
+		Hostinfo: &tailcfg.Hostinfo{Hostname: "a"},
+		Stream:   true,
+	})
+	if err != nil {
+		t.Fatalf("Map: %v", err)
+	}
+	defer session.Close()
+
+	// nextNonKeepalive returns the next non-keepalive MapResponse, to keep
+	// the test robust if a server-side keepalive arrives mid-test.
+	nextNonKeepalive := func() *tailcfg.MapResponse {
+		t.Helper()
+		for {
+			resp, err := session.Next()
+			if err != nil {
+				t.Fatalf("session.Next: %v", err)
+			}
+			if resp.KeepAlive {
+				continue
+			}
+			return resp
+		}
+	}
+
+	// First MapResponse: expect node A as self and node B in Peers.
+	first := nextNonKeepalive()
+	if first.Node == nil {
+		t.Fatal("first response has nil Node")
+	}
+	if got, want := first.Node.Key, nodeKeyA.Public(); got != want {
+		t.Errorf("first Node.Key = %v, want %v", got, want)
+	}
+	var foundB bool
+	for _, p := range first.Peers {
+		if p.Key == nodeKeyB.Public() {
+			foundB = true
+			break
+		}
+	}
+	if !foundB {
+		t.Errorf("peer B (%v) not in first response's Peers (%d peers)", nodeKeyB.Public(), len(first.Peers))
+	}
+
+	// Inject raw MapResponses and verify they come out the reader, in order.
+	// msgToSend is single-slot, so we must consume each before injecting the next.
+	for i := range 3 {
+		want := fmt.Sprintf("injected-%d.example.com", i)
+		inject := &tailcfg.MapResponse{Domain: want}
+		if !ctrl.AddRawMapResponse(nodeKeyA.Public(), inject) {
+			t.Fatalf("AddRawMapResponse %d: node not connected", i)
+		}
+		got := nextNonKeepalive()
+		if got.Domain != want {
+			t.Errorf("injected %d: got Domain=%q, want %q", i, got.Domain, want)
+		}
+	}
+}
+
+// TestSendMapUpdateAgainstTestControl verifies that a [Client.SendMapUpdate]
+// call from one node lands on the coordination server and that peer nodes
+// subsequently observe the updated DiscoKey via their own streaming map poll.
+func TestSendMapUpdateAgainstTestControl(t *testing.T) {
+	ctrl := &testcontrol.Server{}
+	ctrl.HTTPTestServer = httptest.NewUnstartedServer(ctrl)
+	ctrl.HTTPTestServer.Start()
+	t.Cleanup(ctrl.HTTPTestServer.Close)
+	baseURL := ctrl.HTTPTestServer.URL
+
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	ht := new(health.Tracker)
+
+	serverKey, err := DiscoverServerKey(ctx, baseURL)
+	if err != nil {
+		t.Fatalf("DiscoverServerKey: %v", err)
+	}
+
+	register := func(hostname string) (nodeKey key.NodePrivate, machineKey key.MachinePrivate) {
+		t.Helper()
+		nodeKey = key.NewNode()
+		machineKey = key.NewMachine()
+		c, err := NewClient(ClientOpts{
+			ServerURL:     baseURL,
+			MachineKey:    machineKey,
+			HealthTracker: ht,
+		})
+		if err != nil {
+			t.Fatalf("NewClient %s: %v", hostname, err)
+		}
+		defer c.Close()
+		c.SetControlPublicKey(serverKey)
+		if _, err := c.Register(ctx, RegisterOpts{
+			NodeKey:  nodeKey,
+			Hostinfo: &tailcfg.Hostinfo{Hostname: hostname},
+		}); err != nil {
+			t.Fatalf("Register %s: %v", hostname, err)
+		}
+		return nodeKey, machineKey
+	}
+
+	nodeKeyA, machineKeyA := register("a")
+	nodeKeyB, machineKeyB := register("b")
+
+	// B starts a streaming map poll so we can observe updates about peer A.
+	clientB, err := NewClient(ClientOpts{
+		ServerURL:     baseURL,
+		MachineKey:    machineKeyB,
+		HealthTracker: ht,
+	})
+	if err != nil {
+		t.Fatalf("NewClient B: %v", err)
+	}
+	defer clientB.Close()
+	clientB.SetControlPublicKey(serverKey)
+
+	session, err := clientB.Map(ctx, MapOpts{
+		NodeKey:  nodeKeyB,
+		Hostinfo: &tailcfg.Hostinfo{Hostname: "b"},
+		Stream:   true,
+	})
+	if err != nil {
+		t.Fatalf("Map B: %v", err)
+	}
+	defer session.Close()
+
+	nextNonKeepalive := func() *tailcfg.MapResponse {
+		t.Helper()
+		for {
+			resp, err := session.Next()
+			if err != nil {
+				t.Fatalf("session.Next: %v", err)
+			}
+			if resp.KeepAlive {
+				continue
+			}
+			return resp
+		}
+	}
+
+	// Drain B's initial MapResponse. A should be present as a peer with a
+	// zero DiscoKey (it never pushed one).
+	first := nextNonKeepalive()
+	var initialA *tailcfg.Node
+	for _, p := range first.Peers {
+		if p.Key == nodeKeyA.Public() {
+			initialA = p
+			break
+		}
+	}
+	if initialA == nil {
+		t.Fatalf("peer A (%v) not in B's first MapResponse", nodeKeyA.Public())
+	}
+	if !initialA.DiscoKey.IsZero() {
+		t.Fatalf("peer A initial DiscoKey = %v, want zero", initialA.DiscoKey)
+	}
+
+	// A pushes its disco key via SendMapUpdate.
+	clientA, err := NewClient(ClientOpts{
+		ServerURL:     baseURL,
+		MachineKey:    machineKeyA,
+		HealthTracker: ht,
+	})
+	if err != nil {
+		t.Fatalf("NewClient A: %v", err)
+	}
+	defer clientA.Close()
+	clientA.SetControlPublicKey(serverKey)
+
+	wantDisco := key.NewDisco().Public()
+	if err := clientA.SendMapUpdate(ctx, SendMapUpdateOpts{
+		NodeKey:  nodeKeyA,
+		DiscoKey: wantDisco,
+		Hostinfo: &tailcfg.Hostinfo{Hostname: "a"},
+	}); err != nil {
+		t.Fatalf("SendMapUpdate: %v", err)
+	}
+
+	// B should now observe A's new DiscoKey in a subsequent MapResponse.
+	for {
+		resp := nextNonKeepalive()
+		for _, p := range resp.Peers {
+			if p.Key != nodeKeyA.Public() {
+				continue
+			}
+			if p.DiscoKey == wantDisco {
+				return // success
+			}
+		}
+	}
+}
+
+// newTestPipeline builds the same framedReader → zstd → boundedReader →
+// json.Decoder pipeline that [Client.Map] builds for a live session, but
+// feeds it from a raw byte slice. Returned jdec can be used with Decode to
+// pull out MapResponses.
+func newTestPipeline(t testing.TB, wire []byte, maxMessageSize int64) *json.Decoder {
+	t.Helper()
+	bounded := &boundedReader{max: maxMessageSize, remain: maxMessageSize}
+	fr := &framedReader{
+		r:          bytes.NewReader(wire),
+		maxSize:    maxMessageSize,
+		onNewFrame: bounded.reset,
+	}
+	zdec, err := zstd.NewReader(fr, zstd.WithDecoderConcurrency(1))
+	if err != nil {
+		t.Fatalf("zstd.NewReader: %v", err)
+	}
+	t.Cleanup(zdec.Close)
+	bounded.r = zdec
+	return json.NewDecoder(bounded)
+}
+
+// zstdFrame returns a zstd-compressed frame of b.
+func zstdFrame(t testing.TB, b []byte) []byte {
+	t.Helper()
+	enc, err := zstd.NewWriter(io.Discard, zstd.WithEncoderConcurrency(1))
+	if err != nil {
+		t.Fatalf("zstd.NewWriter: %v", err)
+	}
+	defer enc.Close()
+	return enc.EncodeAll(b, nil)
+}
+
+// wireFrame writes a 4-byte little-endian length prefix plus payload to buf.
+func wireFrame(buf *bytes.Buffer, payload []byte) {
+	var hdr [4]byte
+	binary.LittleEndian.PutUint32(hdr[:], uint32(len(payload)))
+	buf.Write(hdr[:])
+	buf.Write(payload)
+}
+
+// TestMapFrameSizeTooLarge verifies that a 4-byte length prefix claiming
+// a frame larger than the configured cap is rejected before any payload
+// bytes are read from the stream.
+func TestMapFrameSizeTooLarge(t *testing.T) {
+	const max = 4 << 20
+	var wire bytes.Buffer
+	var hdr [4]byte
+	binary.LittleEndian.PutUint32(hdr[:], (max + 1))
+	wire.Write(hdr[:])
+
+	jdec := newTestPipeline(t, wire.Bytes(), max)
+	var resp tailcfg.MapResponse
+	err := jdec.Decode(&resp)
+	if err == nil {
+		t.Fatal("Decode: got nil error, want frame-too-large")
+	}
+	if !strings.Contains(err.Error(), "exceeds max") {
+		t.Errorf("Decode error = %q, want one containing %q", err, "exceeds max")
+	}
+}
+
+// TestMapDecodedSizeTooLarge verifies that a small on-wire frame (well
+// under the cap) which decompresses into a huge JSON payload is rejected.
+// This is the "zstd bomb" case: a tiny compressed frame that would
+// explode into a huge decoded payload for json.Decoder to consume.
+func TestMapDecodedSizeTooLarge(t *testing.T) {
+	const max = 4 << 20
+	big := strings.Repeat("a", 5<<20) // 5 MiB of 'a'
+	raw, err := json.Marshal(&tailcfg.MapResponse{Domain: big})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if int64(len(raw)) <= max {
+		t.Fatalf("raw JSON unexpectedly small: %d", len(raw))
+	}
+	compressed := zstdFrame(t, raw)
+	if int64(len(compressed)) >= max {
+		t.Fatalf("compressed too large (%d); test needs a more compressible payload", len(compressed))
+	}
+
+	var wire bytes.Buffer
+	wireFrame(&wire, compressed)
+
+	jdec := newTestPipeline(t, wire.Bytes(), max)
+	var resp tailcfg.MapResponse
+	err = jdec.Decode(&resp)
+	if err == nil {
+		t.Fatal("Decode: got nil error, want decoded-size-exceeded")
+	}
+	if !strings.Contains(err.Error(), "exceeds max") {
+		t.Errorf("Decode error = %q, want one containing %q", err, "exceeds max")
+	}
+}
+
+// TestMapBudgetResetsBetweenFrames verifies that the per-message decoded
+// budget is reset at each new frame boundary. Two consecutive 3-MiB frames
+// should both decode successfully under a 4-MiB per-frame cap. Without the
+// reset, the second frame would fail (remaining budget after frame 1 =
+// 4MiB - 3MiB = 1MiB, and we'd try to read 3MiB more).
+func TestMapBudgetResetsBetweenFrames(t *testing.T) {
+	const max = 4 << 20
+	payload := strings.Repeat("a", 3<<20)
+	r1 := &tailcfg.MapResponse{Domain: payload + "-one"}
+	r2 := &tailcfg.MapResponse{Domain: payload + "-two"}
+
+	var wire bytes.Buffer
+	for _, r := range []*tailcfg.MapResponse{r1, r2} {
+		raw, err := json.Marshal(r)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if int64(len(raw)) >= max {
+			t.Fatalf("raw JSON size %d >= max %d; would fail budget check by itself", len(raw), max)
+		}
+		compressed := zstdFrame(t, raw)
+		if int64(len(compressed)) >= max {
+			t.Fatalf("compressed size %d >= max %d", len(compressed), max)
+		}
+		wireFrame(&wire, compressed)
+	}
+
+	jdec := newTestPipeline(t, wire.Bytes(), max)
+
+	var got1, got2 tailcfg.MapResponse
+	if err := jdec.Decode(&got1); err != nil {
+		t.Fatalf("first Decode: %v", err)
+	}
+	if got1.Domain != r1.Domain {
+		t.Errorf("first Domain mismatch (len %d vs %d)", len(got1.Domain), len(r1.Domain))
+	}
+	if err := jdec.Decode(&got2); err != nil {
+		t.Fatalf("second Decode: %v", err)
+	}
+	if got2.Domain != r2.Domain {
+		t.Errorf("second Domain mismatch (len %d vs %d)", len(got2.Domain), len(r2.Domain))
+	}
+}
diff --git a/control/tsp/nodefile.go b/control/tsp/nodefile.go
new file mode 100644
index 000000000..8cae11ba9
--- /dev/null
+++ b/control/tsp/nodefile.go
@@ -0,0 +1,105 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package tsp
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+
+	"tailscale.com/types/key"
+)
+
+// ServerInfo identifies a coordination server by its URL and Noise public key.
+type ServerInfo struct {
+	// URL is the base URL of the coordination server, without any path
+	// (e.g. "https://controlplane.tailscale.com").
+	//
+	// There is no default value; a URL must always be supplied.
+	URL string `json:"server_url"`
+
+	// Key is the server's Noise public key, used to establish an encrypted
+	// channel between the client and the coordination server.
+	Key key.MachinePublic `json:"server_key"`
+}
+
+// NodeFile is the JSON structure for a node credentials file. It contains
+// the private keys that authenticate a node to a coordination server.
+//
+// Example:
+//
+//	{
+//	  "node_key": "privkey:...",
+//	  "machine_key": "privkey:...",
+//	  "server_url": "https://controlplane.tailscale.com",
+//	  "server_key": "mkey:..."
+//	}
+//
+// Note that node and machine private keys share the same "privkey:"
+// textual form; they are disambiguated by the surrounding JSON field
+// names rather than by any prefix in the key itself.
+type NodeFile struct {
+	// NodeKey is the node's WireGuard private key. The corresponding
+	// public key identifies this node to other peers.
+	NodeKey key.NodePrivate `json:"node_key"`
+
+	// MachineKey is the machine's private key. It authenticates this
+	// machine to the coordination server over Noise.
+	MachineKey key.MachinePrivate `json:"machine_key"`
+
+	ServerInfo // server_url and server_key
+}
+
+// ReadNodeFile reads and parses a node JSON file.
+func ReadNodeFile(path string) (NodeFile, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return NodeFile{}, err
+	}
+	var nf NodeFile
+	if err := json.Unmarshal(data, &nf); err != nil {
+		return NodeFile{}, fmt.Errorf("parsing node file %q: %w", path, err)
+	}
+	return nf, nil
+}
+
+// WriteNodeFile writes a node JSON file. The file is created with mode 0600.
+func WriteNodeFile(path string, nf NodeFile) error {
+	if err := nf.Check(); err != nil {
+		return fmt.Errorf("invalid NodeFile: %w", err)
+	}
+	return os.WriteFile(path, nf.AsJSON(), 0600)
+}
+
+// AsJSON returns nf as a pretty-printed JSON object, terminated by a newline.
+//
+// It always succeeds and always returns a valid JSON object. It does not
+// validate that the fields of nf are non-zero; it is the caller's
+// responsibility to call [NodeFile.Check] first if they want to reject
+// incomplete NodeFiles.
+func (nf NodeFile) AsJSON() []byte {
+	out, err := json.MarshalIndent(nf, "", "  ")
+	if err != nil {
+		panic(fmt.Sprintf("NodeFile.AsJSON: %v", err)) // unreachable: all fields marshal successfully
+	}
+	return append(out, '\n')
+}
+
+// Check reports whether nf has all required fields set.
+// It returns an error describing the first zero-valued field, if any.
+func (nf NodeFile) Check() error {
+	if nf.NodeKey.IsZero() {
+		return fmt.Errorf("node_key is missing")
+	}
+	if nf.MachineKey.IsZero() {
+		return fmt.Errorf("machine_key is missing")
+	}
+	if nf.URL == "" {
+		return fmt.Errorf("server_url is missing")
+	}
+	if nf.ServerInfo.Key.IsZero() {
+		return fmt.Errorf("server_key is missing")
+	}
+	return nil
+}
diff --git a/control/tsp/nodefile_test.go b/control/tsp/nodefile_test.go
new file mode 100644
index 000000000..4a019f25f
--- /dev/null
+++ b/control/tsp/nodefile_test.go
@@ -0,0 +1,116 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package tsp
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"tailscale.com/types/key"
+)
+
+func TestNodeFileRoundTrip(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "node.json")
+
+	nf := NodeFile{
+		NodeKey:    key.NewNode(),
+		MachineKey: key.NewMachine(),
+		ServerInfo: ServerInfo{
+			URL: "https://controlplane.tailscale.com",
+			Key: key.NewMachine().Public(),
+		},
+	}
+
+	if err := WriteNodeFile(path, nf); err != nil {
+		t.Fatalf("WriteNodeFile: %v", err)
+	}
+
+	got, err := ReadNodeFile(path)
+	if err != nil {
+		t.Fatalf("ReadNodeFile: %v", err)
+	}
+	if !got.NodeKey.Equal(nf.NodeKey) {
+		t.Errorf("node key mismatch")
+	}
+	if !got.MachineKey.Equal(nf.MachineKey) {
+		t.Errorf("machine key mismatch")
+	}
+	if got.URL != nf.URL {
+		t.Errorf("server URL = %q, want %q", got.URL, nf.URL)
+	}
+	if got.ServerInfo.Key != nf.ServerInfo.Key {
+		t.Errorf("server key mismatch")
+	}
+}
+
+// TestNodeFileFormat verifies that ReadNodeFile can parse a fixed JSON literal,
+// ensuring we don't accidentally change the on-disk format.
+func TestNodeFileFormat(t *testing.T) {
+	const fileContents = `{
+  "node_key": "privkey:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
+  "machine_key": "privkey:fedcba9876543210fedcba9876543210fedcba9876543210fedcba9876543210",
+  "server_url": "https://controlplane.tailscale.com",
+  "server_key": "mkey:1111111111111111111111111111111111111111111111111111111111111111"
+}`
+	dir := t.TempDir()
+	path := filepath.Join(dir, "node.json")
+	if err := os.WriteFile(path, []byte(fileContents), 0600); err != nil {
+		t.Fatal(err)
+	}
+
+	nf, err := ReadNodeFile(path)
+	if err != nil {
+		t.Fatalf("ReadNodeFile: %v", err)
+	}
+	if nf.NodeKey.IsZero() {
+		t.Error("node key is zero")
+	}
+	if nf.MachineKey.IsZero() {
+		t.Error("machine key is zero")
+	}
+	if nf.URL != "https://controlplane.tailscale.com" {
+		t.Errorf("server URL = %q", nf.URL)
+	}
+	if nf.ServerInfo.Key.IsZero() {
+		t.Error("server key is zero")
+	}
+}
+
+// TestNodeFileWriteFormat verifies that WriteNodeFile produces the expected
+// JSON field names.
+func TestNodeFileWriteFormat(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "node.json")
+
+	nf := NodeFile{
+		NodeKey:    key.NewNode(),
+		MachineKey: key.NewMachine(),
+		ServerInfo: ServerInfo{
+			URL: "https://example.com",
+			Key: key.NewMachine().Public(),
+		},
+	}
+
+	if err := WriteNodeFile(path, nf); err != nil {
+		t.Fatalf("WriteNodeFile: %v", err)
+	}
+
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	var raw map[string]json.RawMessage
+	if err := json.Unmarshal(data, &raw); err != nil {
+		t.Fatalf("parsing written JSON: %v", err)
+	}
+	for _, field := range []string{"node_key", "machine_key", "server_url", "server_key"} {
+		if _, ok := raw[field]; !ok {
+			t.Errorf("missing JSON field %q in written file", field)
+		}
+	}
+}
diff --git a/control/tsp/register.go b/control/tsp/register.go
new file mode 100644
index 000000000..0d2baf75f
--- /dev/null
+++ b/control/tsp/register.go
@@ -0,0 +1,116 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package tsp
+
+import (
+	"bytes"
+	"cmp"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+
+	"tailscale.com/control/ts2021"
+	"tailscale.com/tailcfg"
+	"tailscale.com/types/key"
+)
+
+// RegisterOpts contains options for registering a node.
+type RegisterOpts struct {
+	// NodeKey is the node's private key. Required.
+	NodeKey key.NodePrivate
+
+	// Hostinfo is the host information to send. Optional;
+	// if nil, a minimal default is used.
+	Hostinfo *tailcfg.Hostinfo
+
+	// Ephemeral marks the node as ephemeral.
+	Ephemeral bool
+
+	// AuthKey is a pre-authorized auth key.
+	AuthKey string
+
+	// Tags is a list of ACL tags to request.
+	Tags []string
+
+	// MaxResponseSize is the maximum size in bytes of the register
+	// response body. If zero, [DefaultMaxMessageSize] is used.
+	MaxResponseSize int64
+}
+
+// Register sends a registration request to the coordination server
+// and returns the response.
+func (c *Client) Register(ctx context.Context, opts RegisterOpts) (*tailcfg.RegisterResponse, error) {
+	hi := opts.Hostinfo
+	if hi == nil {
+		hi = defaultHostinfo()
+	}
+	if len(opts.Tags) > 0 {
+		hi.RequestTags = opts.Tags
+	}
+
+	regReq := tailcfg.RegisterRequest{
+		Version:   tailcfg.CurrentCapabilityVersion,
+		NodeKey:   opts.NodeKey.Public(),
+		Hostinfo:  hi,
+		Ephemeral: opts.Ephemeral,
+	}
+	if opts.AuthKey != "" {
+		regReq.Auth = &tailcfg.RegisterResponseAuth{
+			AuthKey: opts.AuthKey,
+		}
+	}
+
+	body, err := json.Marshal(regReq)
+	if err != nil {
+		return nil, fmt.Errorf("encoding register request: %w", err)
+	}
+
+	nc, err := c.noiseClient(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("establishing noise connection: %w", err)
+	}
+
+	url := c.serverURL + "/machine/register"
+	url = strings.Replace(url, "http:", "https:", 1)
+	req, err := http.NewRequestWithContext(ctx, "POST", url, bytes.NewReader(body))
+	if err != nil {
+		return nil, fmt.Errorf("creating register request: %w", err)
+	}
+	ts2021.AddLBHeader(req, opts.NodeKey.Public())
+
+	res, err := nc.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("register request: %w", err)
+	}
+	defer res.Body.Close()
+
+	maxResponseSize := cmp.Or(opts.MaxResponseSize, DefaultMaxMessageSize)
+
+	if res.StatusCode != 200 {
+		msg, _ := io.ReadAll(io.LimitReader(res.Body, maxResponseSize))
+		return nil, fmt.Errorf("register request: http %d: %.200s",
+			res.StatusCode, strings.TrimSpace(string(msg)))
+	}
+
+	// Read up to maxResponseSize+1 so we can distinguish "exactly at cap" from
+	// "over the cap" rather than relying on a truncated json parse error.
+	data, err := io.ReadAll(io.LimitReader(res.Body, maxResponseSize+1))
+	if err != nil {
+		return nil, fmt.Errorf("reading register response: %w", err)
+	}
+	if int64(len(data)) > maxResponseSize {
+		return nil, fmt.Errorf("register response exceeds max %d", maxResponseSize)
+	}
+	var resp tailcfg.RegisterResponse
+	if err := json.Unmarshal(data, &resp); err != nil {
+		return nil, fmt.Errorf("decoding register response: %w", err)
+	}
+	if resp.Error != "" {
+		return nil, fmt.Errorf("register: %s", resp.Error)
+	}
+	return &resp, nil
+}
diff --git a/control/tsp/tsp.go b/control/tsp/tsp.go
new file mode 100644
index 000000000..23f2fc261
--- /dev/null
+++ b/control/tsp/tsp.go
@@ -0,0 +1,257 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package tsp provides a client for speaking the Tailscale protocol
+// to a coordination server over Noise.
+package tsp
+
+import (
+	"bufio"
+	"bytes"
+	"cmp"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"strconv"
+	"sync"
+
+	"tailscale.com/control/ts2021"
+	"tailscale.com/health"
+	"tailscale.com/ipn"
+	"tailscale.com/net/tsdial"
+	"tailscale.com/tailcfg"
+	"tailscale.com/types/key"
+	"tailscale.com/types/logger"
+	"tailscale.com/version"
+)
+
+// DefaultServerURL is the default coordination server base URL,
+// used when ClientOpts.ServerURL is empty.
+const DefaultServerURL = ipn.DefaultControlURL
+
+// ClientOpts contains options for creating a new Client.
+type ClientOpts struct {
+	// ServerURL is the base URL of the coordination server
+	// (e.g. "https://controlplane.tailscale.com").
+	// If empty, DefaultServerURL is used.
+	ServerURL string
+
+	// MachineKey is this node's machine private key. Required.
+	MachineKey key.MachinePrivate
+
+	// Logf is the log function. If nil, logger.Discard is used.
+	Logf logger.Logf
+
+	// HealthTracker, if non-nil, is the health tracker passed through
+	// to the underlying noise client. May be nil.
+	HealthTracker *health.Tracker
+}
+
+// Client is a Tailscale protocol client that speaks to a coordination
+// server over Noise.
+type Client struct {
+	opts      ClientOpts
+	serverURL string
+	logf      logger.Logf
+
+	mu        sync.Mutex
+	nc        *ts2021.Client    // nil until noiseClient called
+	serverPub key.MachinePublic // zero until set or discovered
+}
+
+// NewClient creates a new Client configured to talk to the coordination server
+// specified in opts. It performs no I/O; the server's public key is discovered
+// lazily on first use or can be set explicitly via SetControlPublicKey.
+func NewClient(opts ClientOpts) (*Client, error) {
+	if opts.MachineKey.IsZero() {
+		return nil, fmt.Errorf("MachineKey is required")
+	}
+	logf := opts.Logf
+	if logf == nil {
+		logf = logger.Discard
+	}
+	return &Client{
+		opts:      opts,
+		serverURL: cmp.Or(opts.ServerURL, DefaultServerURL),
+		logf:      logf,
+	}, nil
+}
+
+// SetControlPublicKey sets the server's public key, bypassing lazy discovery.
+// Any existing noise client is invalidated and will be re-created on next use.
+func (c *Client) SetControlPublicKey(k key.MachinePublic) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.serverPub = k
+	c.nc = nil
+}
+
+// DiscoverServerKey fetches the server's public key from the coordination
+// server and stores it for subsequent use. Any existing noise client is
+// invalidated.
+func (c *Client) DiscoverServerKey(ctx context.Context) (key.MachinePublic, error) {
+	k, err := DiscoverServerKey(ctx, c.serverURL)
+	if err != nil {
+		return key.MachinePublic{}, err
+	}
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.serverPub = k
+	c.nc = nil
+	return k, nil
+}
+
+// DiscoverServerKey fetches the coordination server's public key from the
+// given server URL. It is a standalone function that requires no client state.
+func DiscoverServerKey(ctx context.Context, serverURL string) (key.MachinePublic, error) {
+	serverURL = cmp.Or(serverURL, DefaultServerURL)
+	keysURL := serverURL + "/key?v=" + strconv.Itoa(int(tailcfg.CurrentCapabilityVersion))
+	req, err := http.NewRequestWithContext(ctx, "GET", keysURL, nil)
+	if err != nil {
+		return key.MachinePublic{}, fmt.Errorf("creating key request: %w", err)
+	}
+	res, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return key.MachinePublic{}, fmt.Errorf("fetching server key: %w", err)
+	}
+	defer res.Body.Close()
+	if res.StatusCode != 200 {
+		return key.MachinePublic{}, fmt.Errorf("fetching server key: %s", res.Status)
+	}
+	var keys struct {
+		PublicKey key.MachinePublic
+	}
+	if err := json.NewDecoder(res.Body).Decode(&keys); err != nil {
+		return key.MachinePublic{}, fmt.Errorf("decoding server key: %w", err)
+	}
+	return keys.PublicKey, nil
+}
+
+// noiseClient returns the ts2021 noise client, creating it lazily if needed.
+// If the server's public key is not yet known, it is discovered via HTTP.
+func (c *Client) noiseClient(ctx context.Context) (*ts2021.Client, error) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	if c.nc != nil {
+		return c.nc, nil
+	}
+
+	if c.serverPub.IsZero() {
+		// Discover server key without holding the lock, to avoid blocking
+		// other callers during the HTTP request.
+		c.mu.Unlock()
+		k, err := DiscoverServerKey(ctx, c.serverURL)
+		c.mu.Lock()
+		if err != nil {
+			return nil, err
+		}
+		// Re-check: another goroutine may have set it while we were unlocked.
+		if c.serverPub.IsZero() {
+			c.serverPub = k
+		}
+		// If nc was created by another goroutine while unlocked, use it.
+		if c.nc != nil {
+			return c.nc, nil
+		}
+	}
+
+	nc, err := ts2021.NewClient(ts2021.ClientOpts{
+		ServerURL:     c.serverURL,
+		PrivKey:       c.opts.MachineKey,
+		ServerPubKey:  c.serverPub,
+		Dialer:        tsdial.NewFromFuncForDebug(c.logf, (&net.Dialer{}).DialContext),
+		Logf:          c.logf,
+		HealthTracker: c.opts.HealthTracker,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("creating noise client: %w", err)
+	}
+	c.nc = nc
+	return nc, nil
+}
+
+// AnswerC2NPing handles a c2n PingRequest from the control plane by parsing the
+// embedded HTTP request in the payload, routing it locally, and POSTing the HTTP
+// response back to pr.URL using doNoiseRequest. The POST is done in a new
+// goroutine so this method does not block.
+//
+// It reports whether the ping was handled. Unhandled pings (nil pr, non-c2n
+// types, or unrecognized c2n paths) return false.
+func (c *Client) AnswerC2NPing(ctx context.Context, pr *tailcfg.PingRequest, doNoiseRequest func(*http.Request) (*http.Response, error)) (handled bool) {
+	if pr == nil || pr.Types != "c2n" {
+		return false
+	}
+
+	// Parse the HTTP request from the payload.
+	httpReq, err := http.ReadRequest(bufio.NewReader(bytes.NewReader(pr.Payload)))
+	if err != nil {
+		c.logf("parsing c2n ping payload: %v", err)
+		return false
+	}
+
+	// Route the request locally.
+	var httpResp *http.Response
+	switch httpReq.URL.Path {
+	case "/echo":
+		body, _ := io.ReadAll(httpReq.Body)
+		httpResp = &http.Response{
+			StatusCode:    200,
+			Status:        "200 OK",
+			Proto:         "HTTP/1.1",
+			ProtoMajor:    1,
+			ProtoMinor:    1,
+			Header:        http.Header{},
+			Body:          io.NopCloser(bytes.NewReader(body)),
+			ContentLength: int64(len(body)),
+		}
+	default:
+		c.logf("ignoring c2n ping request for unhandled path %q", httpReq.URL.Path)
+		return false
+	}
+
+	// Serialize the HTTP response.
+	var buf bytes.Buffer
+	if err := httpResp.Write(&buf); err != nil {
+		c.logf("serializing c2n ping response: %v", err)
+		return false
+	}
+
+	// Send the response back to the control plane over the Noise channel.
+	go func() {
+		req, err := http.NewRequestWithContext(ctx, "POST", pr.URL, &buf)
+		if err != nil {
+			c.logf("creating c2n ping reply request: %v", err)
+			return
+		}
+		resp, err := doNoiseRequest(req)
+		if err != nil {
+			c.logf("sending c2n ping reply: %v", err)
+			return
+		}
+		resp.Body.Close()
+	}()
+	return true
+}
+
+// Close closes the client and releases resources.
+func (c *Client) Close() error {
+	c.mu.Lock()
+	nc := c.nc
+	c.nc = nil
+	c.mu.Unlock()
+	if nc != nil {
+		nc.Close()
+	}
+	return nil
+}
+
+func defaultHostinfo() *tailcfg.Hostinfo {
+	return &tailcfg.Hostinfo{
+		OS:         version.OS(),
+		IPNVersion: version.Long(),
+	}
+}
diff --git a/derp/README.md b/derp/README.md
index 16877020d..c4c09da8a 100644
--- a/derp/README.md
+++ b/derp/README.md
@@ -39,7 +39,7 @@ geographic regions to make sure users have low latency to their DERP home.
 Regions generally have multiple nodes per region "meshed" (routing to each
 other) together for redundancy: it allows for cloud failures or upgrades without
 kicking users out to a higher latency region. Instead, clients will reconnect to
-the next node in the region. Each node in the region is required to to be meshed
+the next node in the region. Each node in the region is required to be meshed
 with every other node in the region and forward packets to the other nodes in
 the region. Packets are forwarded only one hop within the region. There is no
 routing between regions. The assumption is that the mesh TCP connections are
diff --git a/derp/derp_client.go b/derp/derp_client.go
index f786179d6..e907b7657 100644
--- a/derp/derp_client.go
+++ b/derp/derp_client.go
@@ -33,6 +33,7 @@ type Client struct {
 	meshKey     key.DERPMesh
 	canAckPings bool
 	isProber    bool
+	appName     string
 
 	wmu  sync.Mutex // hold while writing to bw
 	bw   *bufio.Writer
@@ -60,6 +61,7 @@ type clientOpt struct {
 	ServerPub   key.NodePublic
 	CanAckPings bool
 	IsProber    bool
+	AppName     string
 }
 
 // MeshKey returns a ClientOpt to pass to the DERP server during connect to get
@@ -69,7 +71,7 @@ type clientOpt struct {
 func MeshKey(k key.DERPMesh) ClientOpt { return clientOptFunc(func(o *clientOpt) { o.MeshKey = k }) }
 
 // IsProber returns a ClientOpt to pass to the DERP server during connect to
-// declare that this client is a a prober.
+// declare that this client is a prober.
 func IsProber(v bool) ClientOpt { return clientOptFunc(func(o *clientOpt) { o.IsProber = v }) }
 
 // ServerPublicKey returns a ClientOpt to declare that the server's DERP public key is known.
@@ -84,6 +86,13 @@ func CanAckPings(v bool) ClientOpt {
 	return clientOptFunc(func(o *clientOpt) { o.CanAckPings = v })
 }
 
+// AppName returns a ClientOpt to set an opaque app name string to
+// advertise to the DERP server for stats purposes. It is sent to the
+// server in the ClientInfo.
+func AppName(name string) ClientOpt {
+	return clientOptFunc(func(o *clientOpt) { o.AppName = name })
+}
+
 func NewClient(privateKey key.NodePrivate, nc Conn, brw *bufio.ReadWriter, logf logger.Logf, opts ...ClientOpt) (*Client, error) {
 	var opt clientOpt
 	for _, o := range opts {
@@ -106,6 +115,7 @@ func newClient(privateKey key.NodePrivate, nc Conn, brw *bufio.ReadWriter, logf
 		meshKey:     opt.MeshKey,
 		canAckPings: opt.CanAckPings,
 		isProber:    opt.IsProber,
+		appName:     opt.AppName,
 		clock:       tstime.StdClock{},
 	}
 	if opt.ServerPub.IsZero() {
@@ -167,7 +177,7 @@ type ClientInfo struct {
 	// trusted clients.  It's required to subscribe to the
 	// connection list & forward packets. It's empty for regular
 	// users.
-	MeshKey key.DERPMesh `json:"meshKey,omitempty,omitzero"`
+	MeshKey key.DERPMesh `json:"meshKey,omitzero"`
 
 	// Version is the DERP protocol version that the client was built with.
 	// See the ProtocolVersion const.
@@ -179,6 +189,10 @@ type ClientInfo struct {
 
 	// IsProber is whether this client is a prober.
 	IsProber bool `json:",omitempty"`
+
+	// AppName is an optional opaque app name string the client
+	// advertises to the server for stats purposes.
+	AppName string `json:",omitempty"`
 }
 
 // Equal reports if two clientInfo values are equal.
@@ -186,7 +200,7 @@ func (c *ClientInfo) Equal(other *ClientInfo) bool {
 	if c == nil || other == nil {
 		return c == other
 	}
-	if c.Version != other.Version || c.CanAckPings != other.CanAckPings || c.IsProber != other.IsProber {
+	if c.Version != other.Version || c.CanAckPings != other.CanAckPings || c.IsProber != other.IsProber || c.AppName != other.AppName {
 		return false
 	}
 	return c.MeshKey.Equal(other.MeshKey)
@@ -198,6 +212,7 @@ func (c *Client) sendClientKey() error {
 		MeshKey:     c.meshKey,
 		CanAckPings: c.canAckPings,
 		IsProber:    c.isProber,
+		AppName:     c.appName,
 	})
 	if err != nil {
 		return err
diff --git a/derp/derp_test.go b/derp/derp_test.go
index 24d509944..0edbaff17 100644
--- a/derp/derp_test.go
+++ b/derp/derp_test.go
@@ -353,7 +353,7 @@ func TestSendRecv(t *testing.T) {
 		}
 	}
 
-	serverMetrics := s.ExpVar().(*metrics.Set)
+	serverMetrics := s.ExpVar(false).(*metrics.Set)
 
 	wantActive := func(total, home int64) {
 		t.Helper()
diff --git a/derp/derphttp/derphttp_client.go b/derp/derphttp/derphttp_client.go
index 3c8408e95..7ba21983e 100644
--- a/derp/derphttp/derphttp_client.go
+++ b/derp/derphttp/derphttp_client.go
@@ -60,6 +60,7 @@ type Client struct {
 	DNSCache      *dnscache.Resolver // optional; nil means no caching
 	MeshKey       key.DERPMesh       // optional; for trusted clients
 	IsProber      bool               // optional; for probers to optional declare themselves as such
+	AppName       string             // optional; opaque app name to advertise to the server for stats
 
 	// WatchConnectionChanges is whether the client wishes to subscribe to
 	// notifications about clients connecting & disconnecting.
@@ -179,7 +180,7 @@ func NewClient(privateKey key.NodePrivate, serverURL string, logf logger.Logf, n
 
 // isStarted reports whether this client has been used yet.
 //
-// If if reports false, it may still have its exported fields configured.
+// If it reports false, it may still have its exported fields configured.
 func (c *Client) isStarted() bool {
 	c.mu.Lock()
 	defer c.mu.Unlock()
@@ -280,10 +281,16 @@ func (c *Client) urlString(node *tailcfg.DERPNode) string {
 		return c.url.String()
 	}
 	proto := "https"
+	defaultPort := 443
 	if debugUseDERPHTTP() {
 		proto = "http"
+		defaultPort = 80
 	}
-	return fmt.Sprintf("%s://%s/derp", proto, node.HostName)
+	host := node.HostName
+	if node.DERPPort != 0 && node.DERPPort != defaultPort {
+		host = net.JoinHostPort(host, fmt.Sprint(node.DERPPort))
+	}
+	return fmt.Sprintf("%s://%s/derp", proto, host)
 }
 
 // AddressFamilySelector decides whether IPv6 is preferred for
@@ -407,6 +414,7 @@ func (c *Client) connect(ctx context.Context, caller string) (client *derp.Clien
 			derp.MeshKey(c.MeshKey),
 			derp.CanAckPings(c.canAckPings),
 			derp.IsProber(c.IsProber),
+			derp.AppName(c.AppName),
 		)
 		if err != nil {
 			return nil, 0, err
@@ -552,6 +560,7 @@ func (c *Client) connect(ctx context.Context, caller string) (client *derp.Clien
 		derp.ServerPublicKey(serverPub),
 		derp.CanAckPings(c.canAckPings),
 		derp.IsProber(c.IsProber),
+		derp.AppName(c.AppName),
 	)
 	if err != nil {
 		return nil, 0, err
@@ -867,7 +876,15 @@ func (c *Client) dialNodeUsingProxy(ctx context.Context, n *tailcfg.DERPNode, pr
 		}
 	}()
 
-	target := net.JoinHostPort(n.HostName, "443")
+	// Keep port selection in sync with dialNode.
+	port := "443"
+	if !c.useHTTPS() {
+		port = "3340"
+	}
+	if n.DERPPort != 0 {
+		port = fmt.Sprint(n.DERPPort)
+	}
+	target := net.JoinHostPort(n.HostName, port)
 
 	var authHeader string
 	if buildfeatures.HasUseProxy {
diff --git a/derp/derphttp/derphttp_test.go b/derp/derphttp/derphttp_test.go
index 304906b74..1f28a9b90 100644
--- a/derp/derphttp/derphttp_test.go
+++ b/derp/derphttp/derphttp_test.go
@@ -4,6 +4,7 @@
 package derphttp_test
 
 import (
+	"bufio"
 	"bytes"
 	"context"
 	"crypto/tls"
@@ -11,11 +12,14 @@ import (
 	"errors"
 	"flag"
 	"fmt"
+	"io"
 	"maps"
 	"net"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
 	"slices"
+	"strconv"
 	"strings"
 	"sync"
 	"testing"
@@ -25,6 +29,7 @@ import (
 	"tailscale.com/derp"
 	"tailscale.com/derp/derphttp"
 	"tailscale.com/derp/derpserver"
+	"tailscale.com/feature"
 	"tailscale.com/net/memnet"
 	"tailscale.com/net/netmon"
 	"tailscale.com/net/netx"
@@ -625,3 +630,118 @@ func TestURLDial(t *testing.T) {
 		t.Fatalf("rc.Connect: %v", err)
 	}
 }
+
+// startFakeCONNECTProxy starts a loopback HTTP proxy that records each
+// CONNECT target and best-effort tunnels bytes upstream.
+func startFakeCONNECTProxy(t *testing.T) (proxyURL *url.URL, targets <-chan string) {
+	t.Helper()
+	ln, err := net.Listen("tcp4", "localhost:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { ln.Close() })
+
+	ch := make(chan string, 1)
+	go func() {
+		for {
+			conn, err := ln.Accept()
+			if err != nil {
+				return
+			}
+			go func(conn net.Conn) {
+				defer conn.Close()
+				br := bufio.NewReader(conn)
+				req, err := http.ReadRequest(br)
+				if err != nil {
+					return
+				}
+				if req.Method != "CONNECT" {
+					fmt.Fprint(conn, "HTTP/1.1 400 Bad Request\r\n\r\n")
+					return
+				}
+				ch <- req.Host
+				fmt.Fprint(conn, "HTTP/1.1 200 OK\r\n\r\n")
+				up, err := net.Dial("tcp", req.Host)
+				if err != nil {
+					return
+				}
+				defer up.Close()
+				done := make(chan struct{}, 2)
+				go func() { io.Copy(up, br); done <- struct{}{} }()
+				go func() { io.Copy(conn, up); done <- struct{}{} }()
+				<-done
+			}(conn)
+		}
+	}()
+	return &url.URL{Scheme: "http", Host: ln.Addr().String()}, ch
+}
+
+// TestConnectThroughProxyHonorsDERPPort verifies that the CONNECT
+// target honors DERPNode.DERPPort when a DERP client is routed through
+// an HTTPS_PROXY. Regression test for #19748.
+func TestConnectThroughProxyHonorsDERPPort(t *testing.T) {
+	// Real DERP server on TLS, ephemeral loopback port.
+	serverKey := key.NewNode()
+	s := derpserver.New(serverKey, t.Logf)
+	defer s.Close()
+
+	derpSrv := httptest.NewUnstartedServer(derpserver.Handler(s))
+	derpSrv.StartTLS()
+	defer derpSrv.Close()
+
+	derpURL, err := url.Parse(derpSrv.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	derpPort, err := strconv.Atoi(derpURL.Port())
+	if err != nil {
+		t.Fatalf("parsing derp port %q: %v", derpURL.Port(), err)
+	}
+	if derpPort == 443 {
+		t.Fatalf("test server bound to :443; can't distinguish bug from fix")
+	}
+
+	proxyURL, targets := startFakeCONNECTProxy(t)
+	restore := feature.HookProxyFromEnvironment.SetForTest(func(*http.Request) (*url.URL, error) {
+		return proxyURL, nil
+	})
+	defer restore()
+
+	region := &tailcfg.DERPRegion{
+		RegionID:   1,
+		RegionCode: "test",
+		Nodes: []*tailcfg.DERPNode{{
+			Name:             "1a",
+			RegionID:         1,
+			HostName:         "127.0.0.1",
+			IPv4:             "127.0.0.1",
+			DERPPort:         derpPort,
+			InsecureForTests: true,
+		}},
+	}
+	c := derphttp.NewRegionClient(key.NewNode(), t.Logf, netmon.NewStatic(),
+		func() *tailcfg.DERPRegion { return region })
+	defer c.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	if err := c.Connect(ctx); err != nil {
+		t.Fatalf("Connect: %v", err)
+	}
+
+	// Pump Recv so the PONG gets dispatched.
+	go func() {
+		for {
+			if _, err := c.Recv(); err != nil {
+				return
+			}
+		}
+	}()
+	if err := c.Ping(ctx); err != nil {
+		t.Fatalf("Ping through proxy tunnel: %v", err)
+	}
+
+	if got, want := <-targets, fmt.Sprintf("127.0.0.1:%d", derpPort); got != want {
+		t.Errorf("proxy CONNECT target = %q, want %q", got, want)
+	}
+}
diff --git a/derp/derpserver/derpserver.go b/derp/derpserver/derpserver.go
index ae8e9d433..d0e2f6dc0 100644
--- a/derp/derpserver/derpserver.go
+++ b/derp/derpserver/derpserver.go
@@ -38,6 +38,7 @@ import (
 	"time"
 
 	"github.com/axiomhq/hyperloglog"
+	"github.com/go4org/hashtriemap"
 	"go4.org/mem"
 	"golang.org/x/sync/errgroup"
 	xrate "golang.org/x/time/rate"
@@ -140,6 +141,12 @@ type Server struct {
 	debug       bool
 	localClient local.Client
 
+	// onClientInfoForTest, if non-nil, is called with each connecting
+	// client's key and ClientInfo. It is set (before the server accepts
+	// any connections) via forTest.SetOnClientInfo and is nil outside
+	// of tests.
+	onClientInfoForTest func(key.NodePublic, derp.ClientInfo)
+
 	// Counters:
 	packetsSent, bytesSent     expvar.Int
 	packetsRecv, bytesRecv     expvar.Int
@@ -172,6 +179,8 @@ type Server struct {
 	meshUpdateBatchSize        *metrics.Histogram
 	meshUpdateLoopCount        *metrics.Histogram
 	bufferedWriteFrames        *metrics.Histogram // how many sendLoop frames (or groups of related frames) get written per flush
+	rateLimitPerClientWaited   expvar.Int         // number of times per-client rate limit caused a wait
+	// TODO(illotum): add metrics for rate limited wait time, consider total seconds vs a histogram.
 
 	// verifyClientsLocalTailscaled only accepts client connections to the DERP
 	// server if the clientKey is a known peer in the network, as specified by a
@@ -181,11 +190,23 @@ type Server struct {
 	verifyClientsURL         string
 	verifyClientsURLFailOpen bool
 
-	mu       syncs.Mutex
+	perClientSendQueueDepth int // Sets the client send queue depth for the server.
+	tcpWriteTimeout         time.Duration
+	clock                   tstime.Clock
+
+	mu       syncs.Mutex // guards the following fields
 	closed   bool
 	netConns map[derp.Conn]chan struct{} // chan is closed when conn closes
-	clients  map[key.NodePublic]*clientSet
-	watchers set.Set[*sclient] // mesh peers
+	// clients holds the set of clients connected locally to this server,
+	// keyed by their public key. Writes happen under Server.mu so they
+	// stay consistent with clientsMesh, watchers, dup tracking, and the
+	// numLocalClientKeys counter. Reads on the packet send hot path
+	// are performed lock-free; see lookupDest.
+	clients hashtriemap.HashTrieMap[key.NodePublic, *clientSet]
+	// numLocalClientKeys is the number of distinct keys in clients.
+	// HashTrieMap has no Len, so the count is tracked here.
+	numLocalClientKeys int
+	watchers           set.Set[*sclient] // mesh peers
 	// clientsMesh tracks all clients in the cluster, both locally
 	// and to mesh peers.  If the value is nil, that means the
 	// peer is only local (and thus in the clients Map, but not
@@ -197,25 +218,9 @@ type Server struct {
 	// is gone from the region, we notify all of these watchers,
 	// calling their funcs in a new goroutine.
 	peerGoneWatchers map[key.NodePublic]set.HandleSet[func(key.NodePublic)]
-
 	// maps from netip.AddrPort to a client's public key
-	keyOfAddr map[netip.AddrPort]key.NodePublic
-
-	// Sets the client send queue depth for the server.
-	perClientSendQueueDepth int
-
-	tcpWriteTimeout time.Duration
-
-	// perClientRecvBytesPerSec is the rate limit for receiving data from
-	// a single client connection, in bytes per second. 0 means unlimited.
-	// Mesh peers are exempt from this limit.
-	perClientRecvBytesPerSec uint
-	// perClientRecvBurst is the burst size in bytes for the per-client
-	// receive rate limiter. perClientRecvBurst is only relevant when
-	// perClientRecvBytesPerSec is nonzero.
-	perClientRecvBurst uint
-
-	clock tstime.Clock
+	keyOfAddr  map[netip.AddrPort]key.NodePublic
+	rateConfig RateConfig // per-client DERP frame rate limiting config
 }
 
 // clientSet represents 1 or more *sclients.
@@ -239,10 +244,6 @@ type clientSet struct {
 	// activeClient holds the currently active connection for the set. It's nil
 	// if there are no connections or the connection is disabled.
 	//
-	// A pointer to a clientSet can be held by peers for long periods of time
-	// without holding Server.mu to avoid mutex contention on Server.mu, only
-	// re-acquiring the mutex and checking the clients map if activeClient is
-	// nil.
 	activeClient atomic.Pointer[sclient]
 
 	// dup is non-nil if there are multiple connections for the
@@ -378,7 +379,6 @@ func New(privateKey key.NodePrivate, logf logger.Logf) *Server {
 		logf:                logf,
 		limitedLogf:         logger.RateLimitedFn(logf, 30*time.Second, 5, 100),
 		packetsRecvByKind:   metrics.LabelMap{Label: "kind"},
-		clients:             map[key.NodePublic]*clientSet{},
 		clientsMesh:         map[key.NodePublic]PacketForwarder{},
 		netConns:            map[derp.Conn]chan struct{}{},
 		memSys0:             ms.Sys,
@@ -518,14 +518,77 @@ func (s *Server) SetTCPWriteTimeout(d time.Duration) {
 	s.tcpWriteTimeout = d
 }
 
-// SetPerClientRateLimit sets the per-client receive rate limit in bytes per
-// second and the burst size in bytes. Mesh peers are exempt from this limit.
-// The burst is at least [derp.MaxPacketSize], or burst, if burst is greater
-// than [derp.MaxPacketSize]. This ensures at least a full packet can
-// be received in a burst, even if the rate limit is low.
-func (s *Server) SetPerClientRateLimit(bytesPerSec, burst uint) {
-	s.perClientRecvBytesPerSec = bytesPerSec
-	s.perClientRecvBurst = max(burst, derp.MaxPacketSize)
+// minRateLimitTokenBucketSize represents the minimum size of a token bucket
+// applied for the purposes of rate limiting a DERP connection per received DERP
+// frame.
+//
+// Note: The DERP protocol supports frames larger than this ([math.MaxUint32] length),
+// but a [derp.FrameSendPacket] cannot exceed this value, which is what we optimize
+// our token bucket calls for.
+const minRateLimitTokenBucketSize = derp.MaxPacketSize + derp.KeyLen
+
+// RateConfig is a JSON-serializable configuration for rate limits. Values are
+// in bytes.
+type RateConfig struct {
+	// PerClientRateLimitBytesPerSec represents the per-client
+	// rate limit in bytes per second. A zero value disables all rate limiting.
+	PerClientRateLimitBytesPerSec uint64 `json:",omitzero"`
+	// PerClientRateBurstBytes represents the per-client token bucket depth,
+	// or burst, in bytes. Any value lower than [minRateLimitTokenBucketSize]
+	// will be increased to [minRateLimitTokenBucketSize] before application. Only
+	// relevant if PerClientRateLimitBytesPerSec is nonzero.
+	PerClientRateBurstBytes uint64 `json:",omitzero"`
+}
+
+// LoadRateConfig reads and JSON-unmarshals a [RateConfig] from the file at path.
+func LoadRateConfig(path string) (RateConfig, error) {
+	if path == "" {
+		return RateConfig{}, errors.New("rate config path is empty")
+	}
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return RateConfig{}, fmt.Errorf("error reading rate config: %w", err)
+	}
+	var rc RateConfig
+	if err := json.Unmarshal(b, &rc); err != nil {
+		return RateConfig{}, fmt.Errorf("error parsing rate config: %w", err)
+	}
+	return rc, nil
+}
+
+// LoadAndApplyRateConfig reads a [RateConfig] from the file at path and
+// applies it to the server via [Server.UpdateRateLimits].
+func (s *Server) LoadAndApplyRateConfig(path string) error {
+	rc, err := LoadRateConfig(path)
+	if err != nil {
+		return err
+	}
+	applied := s.UpdateRateLimits(rc)
+	s.logf("rate config applied: client-rate=%d bytes/sec, client-burst=%d bytes",
+		applied.PerClientRateLimitBytesPerSec, applied.PerClientRateBurstBytes)
+	return nil
+}
+
+// UpdateRateLimits sets the receive rate limits, updating all existing client
+// connections. It returns the applied config, which may differ from rc. If the
+// per-client rate limits is 0, rate limiting is disabled. Mesh peers are always
+// exempt from rate limiting.
+func (s *Server) UpdateRateLimits(rc RateConfig) (applied RateConfig) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if rc.PerClientRateLimitBytesPerSec == 0 {
+		// all rate limiting is disabled
+		rc = RateConfig{}
+	} else {
+		rc.PerClientRateBurstBytes = max(rc.PerClientRateBurstBytes, minRateLimitTokenBucketSize)
+	}
+	s.rateConfig = rc
+	for _, cs := range s.clients.All() {
+		cs.ForeachClient(func(c *sclient) {
+			c.setRateLimit(rc.PerClientRateLimitBytesPerSec, rc.PerClientRateBurstBytes)
+		})
+	}
+	return rc
 }
 
 // HasMeshKey reports whether the server is configured with a mesh key.
@@ -577,7 +640,7 @@ func (s *Server) isClosed() bool {
 func (s *Server) IsClientConnectedForTest(k key.NodePublic) bool {
 	s.mu.Lock()
 	defer s.mu.Unlock()
-	x, ok := s.clients[k]
+	x, ok := s.clients.Load(k)
 	if !ok {
 		return false
 	}
@@ -662,7 +725,9 @@ func (s *Server) initMetacert() {
 func (s *Server) MetaCert() []byte { return s.metaCert }
 
 // ModifyTLSConfigToAddMetaCert modifies c.GetCertificate to make
-// it append s.MetaCert to the returned certificates.
+// it append s.MetaCert to the returned certificates. The certificate
+// returned by the underlying GetCertificate is not mutated; a copy
+// with the meta cert appended is returned instead.
 //
 // It panics if c or c.GetCertificate is nil.
 func (s *Server) ModifyTLSConfigToAddMetaCert(c *tls.Config) {
@@ -675,8 +740,18 @@ func (s *Server) ModifyTLSConfigToAddMetaCert(c *tls.Config) {
 		if err != nil {
 			return nil, err
 		}
-		cert.Certificate = append(cert.Certificate, s.MetaCert())
-		return cert, nil
+		if cert == nil {
+			// Underlying GetCertificate returned (nil, nil) to signal
+			// fallback to Config.Certificates et al. Pass that through.
+			return nil, nil
+		}
+		// Don't mutate the *tls.Certificate pointed to by cert: the
+		// underlying GetCertificate implementation may return a shared
+		// cached value. Return a shallow copy with the meta cert
+		// appended to a freshly allocated chain slice.
+		certCopy := *cert
+		certCopy.Certificate = append(slices.Clip(cert.Certificate), s.MetaCert())
+		return &certCopy, nil
 	}
 }
 
@@ -690,11 +765,14 @@ func (s *Server) registerClient(c *sclient) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
-	cs, ok := s.clients[c.key]
+	c.setRateLimit(s.rateConfig.PerClientRateLimitBytesPerSec, s.rateConfig.PerClientRateBurstBytes)
+
+	cs, ok := s.clients.Load(c.key)
 	if !ok {
 		c.debugLogf("register single client")
 		cs = &clientSet{}
-		s.clients[c.key] = cs
+		s.clients.Store(c.key, cs)
+		s.numLocalClientKeys++
 	}
 	was := cs.activeClient.Load()
 	if was == nil {
@@ -760,7 +838,7 @@ func (s *Server) unregisterClient(c *sclient) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
-	set, ok := s.clients[c.key]
+	set, ok := s.clients.Load(c.key)
 	if !ok {
 		c.logf("[unexpected]; clients map is empty")
 		return
@@ -780,7 +858,9 @@ func (s *Server) unregisterClient(c *sclient) {
 		}
 		c.debugLogf("removed connection")
 		set.activeClient.Store(nil)
-		delete(s.clients, c.key)
+		if s.clients.CompareAndDelete(c.key, set) {
+			s.numLocalClientKeys--
+		}
 		if v, ok := s.clientsMesh[c.key]; ok && v == nil {
 			delete(s.clientsMesh, c.key)
 			s.notePeerGoneFromRegionLocked(c.key)
@@ -911,7 +991,7 @@ func (s *Server) addWatcher(c *sclient) {
 	defer s.mu.Unlock()
 
 	// Queue messages for each already-connected client.
-	for peer, clientSet := range s.clients {
+	for peer, clientSet := range s.clients.All() {
 		ac := clientSet.activeClient.Load()
 		if ac == nil {
 			continue
@@ -975,9 +1055,6 @@ func (s *Server) accept(ctx context.Context, nc derp.Conn, brw *bufio.ReadWriter
 		peerGoneLim:    rate.NewLimiter(rate.Every(time.Second), 3),
 	}
 
-	if s.perClientRecvBytesPerSec > 0 && !c.canMesh {
-		c.recvLim = xrate.NewLimiter(xrate.Limit(s.perClientRecvBytesPerSec), int(s.perClientRecvBurst))
-	}
 	if c.canMesh {
 		c.meshUpdate = make(chan struct{}, 1) // must be buffered; >1 is fine but wasteful
 	}
@@ -990,6 +1067,9 @@ func (s *Server) accept(ctx context.Context, nc derp.Conn, brw *bufio.ReadWriter
 	if s.debug {
 		c.debug = true
 	}
+	if f := s.onClientInfoForTest; f != nil {
+		f(clientKey, c.info)
+	}
 
 	s.registerClient(c)
 	defer s.unregisterClient(c)
@@ -1050,10 +1130,9 @@ func (c *sclient) run(ctx context.Context) error {
 			}
 			return fmt.Errorf("client %s: readFrameHeader: %w", c.key.ShortString(), err)
 		}
-		// Rate limit by DERP frame length (fl), which excludes DERP
-		// and TLS protocol overheads.
+		// Rate-limit by DERP frame length (fl), which excludes TLS protocol and
+		// DERP frame length field overheads.
 		// Note: meshed clients are exempt from rate limits.
-		// meshed clients are exempt from rate limits
 		if err := c.rateLimit(int(fl)); err != nil {
 			return err // context canceled, connection closing
 		}
@@ -1153,7 +1232,7 @@ func (c *sclient) handleFrameClosePeer(ft derp.FrameType, fl uint32) error {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
-	if set, ok := s.clients[targetKey]; ok {
+	if set, ok := s.clients.Load(targetKey); ok {
 		if set.Len() == 1 {
 			c.logf("frameClosePeer closing peer %x", targetKey)
 		} else {
@@ -1183,15 +1262,10 @@ func (c *sclient) handleFrameForwardPacket(_ derp.FrameType, fl uint32) error {
 	}
 	s.packetsForwardedIn.Add(1)
 
-	var dstLen int
-	var dst *sclient
-
-	s.mu.Lock()
-	if set, ok := s.clients[dstKey]; ok {
-		dstLen = set.Len()
-		dst = set.activeClient.Load()
-	}
-	s.mu.Unlock()
+	// Use the same lock-free fast path as the local send path. The mesh
+	// forwarder return is intentionally discarded: we never re-forward an
+	// already-forwarded packet.
+	dst, _, dstLen := c.lookupDest(dstKey)
 
 	if dst == nil {
 		reason := dropReasonUnknownDestOnFwd
@@ -1213,6 +1287,40 @@ func (c *sclient) handleFrameForwardPacket(_ derp.FrameType, fl uint32) error {
 	})
 }
 
+// lookupDest returns the local client, mesh forwarder, or duplicate-client
+// count for dst. dstLen is only meaningful when the returned local client is
+// nil; when a local client is returned, dstLen is just non-zero.
+//
+// The fast path reads Server.clients lock-free: if a *clientSet is present
+// for dst and has an active client, we return that without taking Server.mu.
+// Misses, inactive clientSets, duplicate-client accounting, and mesh
+// forwarder lookups fall through to a slow path under Server.mu. At most
+// one local client and PacketForwarder can be non-nil: local clients win
+// over mesh forwarding, and mesh forwarding is considered only when there
+// is no local clientSet.
+func (c *sclient) lookupDest(dst key.NodePublic) (_ *sclient, fwd PacketForwarder, dstLen int) {
+	s := c.s
+	if set, ok := s.clients.Load(dst); ok {
+		if dst := set.activeClient.Load(); dst != nil {
+			return dst, nil, 1
+		}
+	}
+	// Slow path: no active local client. Take Server.mu to read the
+	// duplicate-client count and clientsMesh consistently.
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if set, ok := s.clients.Load(dst); ok {
+		if dst := set.activeClient.Load(); dst != nil {
+			return dst, nil, 1
+		}
+		dstLen = set.Len()
+	}
+	if dstLen < 1 {
+		fwd = s.clientsMesh[dst]
+	}
+	return nil, fwd, dstLen
+}
+
 // handleFrameSendPacket reads a "send packet" frame from the client.
 func (c *sclient) handleFrameSendPacket(_ derp.FrameType, fl uint32) error {
 	s := c.s
@@ -1222,19 +1330,7 @@ func (c *sclient) handleFrameSendPacket(_ derp.FrameType, fl uint32) error {
 		return fmt.Errorf("client %v: recvPacket: %v", c.key, err)
 	}
 
-	var fwd PacketForwarder
-	var dstLen int
-	var dst *sclient
-
-	s.mu.Lock()
-	if set, ok := s.clients[dstKey]; ok {
-		dstLen = set.Len()
-		dst = set.activeClient.Load()
-	}
-	if dst == nil && dstLen < 1 {
-		fwd = s.clientsMesh[dstKey]
-	}
-	s.mu.Unlock()
+	dst, fwd, dstLen := c.lookupDest(dstKey)
 
 	if dst == nil {
 		if fwd != nil {
@@ -1267,19 +1363,78 @@ func (c *sclient) handleFrameSendPacket(_ derp.FrameType, fl uint32) error {
 	return c.sendPkt(dst, p)
 }
 
-// rateLimit applies the per-client receive rate limit, if configured.
+// setRateLimit updates the receive rate limiter. When bytesPerSec is 0, or the
+// client is a mesh peer, the limiter is set to nil so that [sclient.rateLimit] is a no-op.
+func (c *sclient) setRateLimit(bytesPerSec, burst uint64) {
+	if c.canMesh || bytesPerSec == 0 {
+		c.recvLim.Store(nil)
+		return
+	}
+	limiter := xrate.NewLimiter(xrate.Limit(bytesPerSec), int(burst))
+	c.recvLim.Store(limiter)
+}
+
+// rateLimitWait is a reimplementation of [xrate.Limiter.WaitN] via [xrate.Limiter.ReserveN].
+// It returns the duration waited for tokens to become available.
+func rateLimitWait(ctx context.Context, lim *xrate.Limiter, n int, now time.Time, newTimer func(time.Duration) (<-chan time.Time, func() bool)) (time.Duration, error) {
+	r := lim.ReserveN(now, n)
+	if !r.OK() {
+		return 0, fmt.Errorf("rate: Wait(n=%d) exceeds limiter's burst %d", n, lim.Burst())
+	}
+	delay := r.DelayFrom(now)
+	if delay == 0 {
+		return 0, nil
+	}
+	ch, stop := newTimer(delay)
+	defer stop()
+	select {
+	case <-ch:
+		// Note: We return the predicted delay as wall-clock duration. May be not the same.
+		return delay, nil
+	case <-ctx.Done():
+		r.Cancel()
+		return 0, ctx.Err()
+	}
+}
+
+// rateLimit applies the receive rate limit.
 // By limiting here we prevent reading from the buffered reader
 // [sclient.br] if the limit has been exceeded. Any reads done here provide space
 // within the buffered reader to fill back in with data from
 // the TCP socket. Pacing reads acts as a form of natural
 // backpressure via TCP flow control.
-// meshed clients are exempt from rate limits.
+// When rate limiting is disabled or the client is a mesh peer, recvLim is nil
+// and this is a no-op.
 func (c *sclient) rateLimit(n int) error {
-	if c.recvLim == nil || c.canMesh {
-		return nil
+	if lim := c.recvLim.Load(); lim != nil {
+		newTimer := func(d time.Duration) (<-chan time.Time, func() bool) {
+			tc, ch := c.s.clock.NewTimer(d)
+			return ch, tc.Stop
+		}
+		// If n exceeds the capacity of the bucket, then WaitN will return
+		// an error and consume zero tokens. To prevent this, clamp n to
+		// [minRateLimitTokenBucketSize].
+		//
+		// While we could call WaitN multiple times and/or more precisely for
+		// lim.Burst(), it's better to return early as a larger DERP frame:
+		//   1. is unexpected
+		//   2. is only partially read off the socket (bufio)
+		//   3. would cause the connection to close shortly after rate limiting, anyway.
+		clampedN := min(n, minRateLimitTokenBucketSize)
+		now := c.s.clock.Now()
+		var (
+			durationWaited time.Duration
+			err            error
+		)
+		durationWaited, err = rateLimitWait(c.ctx, lim, clampedN, now, newTimer)
+		if err != nil {
+			return err
+		}
+		if durationWaited > 0 {
+			c.s.rateLimitPerClientWaited.Add(1)
+		}
 	}
-
-	return c.recvLim.WaitN(c.ctx, n)
+	return nil
 }
 
 func (c *sclient) debugLogf(format string, v ...any) {
@@ -1507,7 +1662,7 @@ func (s *Server) noteClientActivity(c *sclient) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
-	cs, ok := s.clients[c.key]
+	cs, ok := s.clients.Load(c.key)
 	if !ok {
 		return
 	}
@@ -1714,10 +1869,15 @@ type sclient struct {
 	// through us with a peer we have no record of.
 	peerGoneLim *rate.Limiter
 
-	// recvLim is the per-connection receive rate limiter. If non-nil,
-	// the server calls WaitN per received DERP frame in order to
-	// apply TCP backpressure and throttle the sender.
-	recvLim *xrate.Limiter
+	// recvLim is the receive rate limiter. When rate limiting is enabled for a
+	// non-mesh client, it points to a [xrate.Limiter]. When rate limiting
+	// is disabled or the client is a mesh peer, it is nil and [sclient.rateLimit]
+	// is a no-op. Updated atomically by [sclient.setRateLimit] so that
+	// [sclient.rateLimit] can load it without holding [Server.mu].
+	//
+	// TODO: consider porting the required APIs from [xrate.Limiter] to [rate.Limiter],
+	// which is already optimized to use [mono.Time].
+	recvLim atomic.Pointer[xrate.Limiter]
 }
 
 func (c *sclient) presentFlags() derp.PeerPresentFlags {
@@ -2168,7 +2328,7 @@ func (s *Server) RemovePacketForwarder(dst key.NodePublic, fwd PacketForwarder)
 		return
 	}
 
-	if _, isLocal := s.clients[dst]; isLocal {
+	if _, isLocal := s.clients.Load(dst); isLocal {
 		s.clientsMesh[dst] = nil
 	} else {
 		delete(s.clientsMesh, dst)
@@ -2258,7 +2418,7 @@ func (s *Server) expVarFunc(f func() any) expvar.Func {
 }
 
 // ExpVar returns an expvar variable suitable for registering with expvar.Publish.
-func (s *Server) ExpVar() expvar.Var {
+func (s *Server) ExpVar(rateLimitEnabled bool) expvar.Var {
 	m := new(metrics.Set)
 	m.Set("gauge_memstats_sys0", expvar.Func(func() any { return int64(s.memSys0) }))
 	m.Set("gauge_watchers", s.expVarFunc(func() any { return len(s.watchers) }))
@@ -2267,8 +2427,8 @@ func (s *Server) ExpVar() expvar.Var {
 	m.Set("gauge_current_home_connections", &s.curHomeClients)
 	m.Set("gauge_current_notideal_connections", &s.curClientsNotIdeal)
 	m.Set("gauge_clients_total", s.expVarFunc(func() any { return len(s.clientsMesh) }))
-	m.Set("gauge_clients_local", s.expVarFunc(func() any { return len(s.clients) }))
-	m.Set("gauge_clients_remote", s.expVarFunc(func() any { return len(s.clientsMesh) - len(s.clients) }))
+	m.Set("gauge_clients_local", s.expVarFunc(func() any { return s.numLocalClientKeys }))
+	m.Set("gauge_clients_remote", s.expVarFunc(func() any { return len(s.clientsMesh) - s.numLocalClientKeys }))
 	m.Set("gauge_current_dup_client_keys", &s.dupClientKeys)
 	m.Set("gauge_current_dup_client_conns", &s.dupClientConns)
 	m.Set("counter_total_dup_client_conns", &s.dupClientConnTotal)
@@ -2301,6 +2461,18 @@ func (s *Server) ExpVar() expvar.Var {
 	var expvarVersion expvar.String
 	expvarVersion.Set(version.Long())
 	m.Set("version", &expvarVersion)
+	if rateLimitEnabled {
+		// Rate limiting is currently experimental, its APIs are unstable, and it must
+		// be opted-in via --rate-config. Therefore, we only publish related metrics
+		// on demand, to avoid polluting uninterested metrics consumers.
+		m.Set("rate_limit_per_client_bytes_per_second", s.expVarFunc(func() any {
+			return s.rateConfig.PerClientRateLimitBytesPerSec
+		}))
+		m.Set("rate_limit_per_client_burst_bytes", s.expVarFunc(func() any {
+			return s.rateConfig.PerClientRateBurstBytes
+		}))
+		m.Set("rate_limit_per_client_waited", &s.rateLimitPerClientWaited)
+	}
 	return m
 }
 
@@ -2313,7 +2485,7 @@ func (s *Server) ConsistencyCheck() error {
 	var nilMeshNotInClient int
 	for k, f := range s.clientsMesh {
 		if f == nil {
-			if _, ok := s.clients[k]; !ok {
+			if _, ok := s.clients.Load(k); !ok {
 				nilMeshNotInClient++
 			}
 		}
@@ -2323,7 +2495,7 @@ func (s *Server) ConsistencyCheck() error {
 	}
 
 	var clientNotInMesh int
-	for k := range s.clients {
+	for k := range s.clients.All() {
 		if _, ok := s.clientsMesh[k]; !ok {
 			clientNotInMesh++
 		}
@@ -2332,10 +2504,10 @@ func (s *Server) ConsistencyCheck() error {
 		errs = append(errs, fmt.Sprintf("%d s.clients keys not in s.clientsMesh", clientNotInMesh))
 	}
 
-	if s.curClients.Value() != int64(len(s.clients)) {
+	if s.curClients.Value() != int64(s.numLocalClientKeys) {
 		errs = append(errs, fmt.Sprintf("expvar connections = %d != clients map says of %d",
 			s.curClients.Value(),
-			len(s.clients)))
+			s.numLocalClientKeys))
 	}
 
 	if s.verifyClientsLocalTailscaled {
@@ -2431,7 +2603,7 @@ func (s *Server) ServeDebugTraffic(w http.ResponseWriter, r *http.Request) {
 			if prev.Sent < next.Sent || prev.Recv < next.Recv {
 				if pkey, ok := s.keyOfAddr[k]; ok {
 					next.Key = pkey
-					if cs, ok := s.clients[pkey]; ok {
+					if cs, ok := s.clients.Load(pkey); ok {
 						if c := cs.activeClient.Load(); c != nil {
 							next.UniqueSenders = c.EstimatedUniqueSenders()
 						}
diff --git a/derp/derpserver/derpserver_test.go b/derp/derpserver/derpserver_test.go
index 3fb4b838e..afb329b39 100644
--- a/derp/derpserver/derpserver_test.go
+++ b/derp/derpserver/derpserver_test.go
@@ -5,8 +5,10 @@ package derpserver
 
 import (
 	"bufio"
+	"bytes"
 	"cmp"
 	"context"
+	"crypto/tls"
 	"crypto/x509"
 	"encoding/asn1"
 	"encoding/binary"
@@ -15,6 +17,7 @@ import (
 	"log"
 	"net"
 	"os"
+	"path/filepath"
 	"reflect"
 	"strconv"
 	"sync"
@@ -28,8 +31,10 @@ import (
 	"golang.org/x/time/rate"
 	"tailscale.com/derp"
 	"tailscale.com/derp/derpconst"
+	"tailscale.com/tstime"
 	"tailscale.com/types/key"
 	"tailscale.com/types/logger"
+	"tailscale.com/util/set"
 )
 
 const testMeshKey = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
@@ -146,7 +151,6 @@ func pubAll(b byte) (ret key.NodePublic) {
 
 func TestForwarderRegistration(t *testing.T) {
 	s := &Server{
-		clients:     make(map[key.NodePublic]*clientSet),
 		clientsMesh: map[key.NodePublic]PacketForwarder{},
 	}
 	want := func(want map[key.NodePublic]PacketForwarder) {
@@ -228,7 +232,7 @@ func TestForwarderRegistration(t *testing.T) {
 		key:  u1,
 		logf: logger.Discard,
 	}
-	s.clients[u1] = singleClient(u1c)
+	s.clients.Store(u1, singleClient(u1c))
 	s.RemovePacketForwarder(u1, testFwd(100))
 	want(map[key.NodePublic]PacketForwarder{
 		u1: nil,
@@ -248,7 +252,7 @@ func TestForwarderRegistration(t *testing.T) {
 	// Now pretend u1 was already connected locally (so clientsMesh[u1] is nil), and then we heard
 	// that they're also connected to a peer of ours. That shouldn't transition the forwarder
 	// from nil to the new one, not a multiForwarder.
-	s.clients[u1] = singleClient(u1c)
+	s.clients.Store(u1, singleClient(u1c))
 	s.clientsMesh[u1] = nil
 	want(map[key.NodePublic]PacketForwarder{
 		u1: nil,
@@ -280,7 +284,6 @@ func TestMultiForwarder(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 
 	s := &Server{
-		clients:     make(map[key.NodePublic]*clientSet),
 		clientsMesh: map[key.NodePublic]PacketForwarder{},
 	}
 	u := pubAll(1)
@@ -359,6 +362,70 @@ func TestMetaCert(t *testing.T) {
 	}
 }
 
+// TestModifyTLSConfigToAddMetaCert verifies that the wrapped GetCertificate
+// appends the meta cert to a copy of the provider's chain without mutating
+// the shared *tls.Certificate returned by the underlying provider (issue
+// 20352). Cert providers such as autocert cache and return the same
+// *tls.Certificate for concurrent handshakes, so appending to its
+// Certificate slice in place is both a data race and unbounded growth of
+// the served chain.
+func TestModifyTLSConfigToAddMetaCert(t *testing.T) {
+	s := New(key.NewNode(), t.Logf)
+
+	// Give the shared chain slice spare capacity so that a regression to a
+	// plain append (rather than a copy into a freshly allocated slice)
+	// writes into the shared backing array. Concurrent goroutines doing so
+	// is a write-write race caught by the race detector, and the write
+	// itself is caught by the backing-array check after wg.Wait below.
+	chain := make([][]byte, 1, 2)
+	chain[0] = []byte{1, 2, 3}
+	shared := &tls.Certificate{
+		Certificate: chain,
+	}
+	c := &tls.Config{
+		GetCertificate: func(*tls.ClientHelloInfo) (*tls.Certificate, error) {
+			return shared, nil
+		},
+	}
+	s.ModifyTLSConfigToAddMetaCert(c)
+
+	var wg sync.WaitGroup
+	// The goroutine count and iteration count are arbitrary: correctness is
+	// checked deterministically by the assertions below; the concurrency
+	// exists only to give the race detector overlapping calls to observe.
+	for range 10 {
+		wg.Go(func() {
+			for range 10 {
+				cert, err := c.GetCertificate(&tls.ClientHelloInfo{})
+				if err != nil {
+					t.Errorf("GetCertificate: %v", err)
+					return
+				}
+				if len(cert.Certificate) != 2 {
+					t.Errorf("chain length = %d; want 2", len(cert.Certificate))
+					return
+				}
+				if !bytes.Equal(cert.Certificate[0], []byte{1, 2, 3}) {
+					t.Errorf("chain[0] = %v; want provider's leaf cert %v", cert.Certificate[0], []byte{1, 2, 3})
+					return
+				}
+				if !bytes.Equal(cert.Certificate[1], s.MetaCert()) {
+					t.Errorf("chain[1] = %v; want meta cert", cert.Certificate[1])
+					return
+				}
+			}
+		})
+	}
+	wg.Wait()
+
+	if len(shared.Certificate) != 1 {
+		t.Errorf("shared cert chain length = %d; want 1 (must not be mutated)", len(shared.Certificate))
+	}
+	if got := chain[:cap(chain)][1]; got != nil {
+		t.Errorf("shared cert backing array was written: %v", got)
+	}
+}
+
 func TestServerDupClients(t *testing.T) {
 	serverPriv := key.NewNode()
 	var s *Server
@@ -389,7 +456,7 @@ func TestServerDupClients(t *testing.T) {
 	}
 	wantSingleClient := func(t *testing.T, want *sclient) {
 		t.Helper()
-		got, ok := s.clients[want.key]
+		got, ok := s.clients.Load(want.key)
 		if !ok {
 			t.Error("no clients for key")
 			return
@@ -412,7 +479,7 @@ func TestServerDupClients(t *testing.T) {
 	}
 	wantNoClient := func(t *testing.T) {
 		t.Helper()
-		_, ok := s.clients[clientPub]
+		_, ok := s.clients.Load(clientPub)
 		if !ok {
 			// Good
 			return
@@ -421,7 +488,7 @@ func TestServerDupClients(t *testing.T) {
 	}
 	wantDupSet := func(t *testing.T) *dupClientSet {
 		t.Helper()
-		cs, ok := s.clients[clientPub]
+		cs, ok := s.clients.Load(clientPub)
 		if !ok {
 			t.Fatal("no set for key; want dup set")
 			return nil
@@ -434,7 +501,7 @@ func TestServerDupClients(t *testing.T) {
 	}
 	wantActive := func(t *testing.T, want *sclient) {
 		t.Helper()
-		set, ok := s.clients[clientPub]
+		set, ok := s.clients.Load(clientPub)
 		if !ok {
 			t.Error("no set for key")
 			return
@@ -775,7 +842,7 @@ func TestServeDebugTrafficUniqueSenders(t *testing.T) {
 	s.mu.Lock()
 	cs := &clientSet{}
 	cs.activeClient.Store(c)
-	s.clients[clientKey] = cs
+	s.clients.Store(clientKey, cs)
 	s.mu.Unlock()
 
 	estimate := c.EstimatedUniqueSenders()
@@ -957,25 +1024,34 @@ func BenchmarkHyperLogLogEstimate(b *testing.B) {
 func TestPerClientRateLimit(t *testing.T) {
 	t.Run("throttled", func(t *testing.T) {
 		synctest.Test(t, func(t *testing.T) {
-			// 100 bytes/sec with a burst of 100 bytes.
-			const bytesPerSec = 100
-			const burst = 100
-
 			ctx, cancel := context.WithCancel(context.Background())
 			t.Cleanup(cancel)
 
+			s := New(key.NewNode(), logger.Discard)
+			defer s.Close()
+
 			c := &sclient{
-				ctx:     ctx,
-				recvLim: rate.NewLimiter(rate.Limit(bytesPerSec), burst),
+				ctx: ctx,
+				s:   s,
+			}
+			lim := rate.NewLimiter(rate.Limit(minRateLimitTokenBucketSize), minRateLimitTokenBucketSize)
+			c.recvLim.Store(lim)
+			wantTokens := func(t *testing.T, wantTokens float64) {
+				t.Helper()
+				if lim.Tokens() != wantTokens {
+					t.Fatalf("want tokens: %v got: %v", wantTokens, lim.Tokens())
+				}
 			}
 
 			// First call within burst should not block.
-			c.rateLimit(burst)
+			c.rateLimit(minRateLimitTokenBucketSize)
+
+			wantTokens(t, 0)
 
 			// Next call exceeds burst, should block until tokens replenish.
 			done := make(chan error, 1)
 			go func() {
-				done <- c.rateLimit(burst)
+				done <- c.rateLimit(minRateLimitTokenBucketSize)
 			}()
 
 			// After settling, the goroutine should be blocked (no result yet).
@@ -986,7 +1062,7 @@ func TestPerClientRateLimit(t *testing.T) {
 			default:
 			}
 
-			// Advance time by 1 second; 100 bytes/sec * 1s = 100 bytes = burst.
+			// Advance time by 1 second, the goroutine should be unblocked
 			time.Sleep(1 * time.Second)
 			synctest.Wait()
 
@@ -998,6 +1074,13 @@ func TestPerClientRateLimit(t *testing.T) {
 			default:
 				t.Fatal("rateLimit should have unblocked after 1s")
 			}
+
+			wantTokens(t, 0)
+
+			// The second rateLimit call had to wait
+			if got := s.rateLimitPerClientWaited.Value(); got != 1 {
+				t.Fatalf("rateLimitPerClientWaited = %d, want 1", got)
+			}
 		})
 	})
 
@@ -1005,19 +1088,24 @@ func TestPerClientRateLimit(t *testing.T) {
 		synctest.Test(t, func(t *testing.T) {
 			ctx, cancel := context.WithCancel(context.Background())
 
+			s := New(key.NewNode(), logger.Discard)
+			defer s.Close()
+
 			c := &sclient{
-				ctx:     ctx,
-				recvLim: rate.NewLimiter(rate.Limit(100), 100),
+				ctx: ctx,
+				s:   s,
 			}
+			lim := rate.NewLimiter(rate.Limit(minRateLimitTokenBucketSize), minRateLimitTokenBucketSize)
+			c.recvLim.Store(lim)
 
 			// Exhaust burst.
-			if err := c.rateLimit(100); err != nil {
+			if err := c.rateLimit(minRateLimitTokenBucketSize); err != nil {
 				t.Fatalf("rateLimit: %v", err)
 			}
 
 			done := make(chan error, 1)
 			go func() {
-				done <- c.rateLimit(100)
+				done <- c.rateLimit(minRateLimitTokenBucketSize)
 			}()
 			synctest.Wait()
 
@@ -1040,37 +1128,520 @@ func TestPerClientRateLimit(t *testing.T) {
 		ctx, cancel := context.WithCancel(context.Background())
 		t.Cleanup(cancel)
 
+		// Mesh peers have nil recvLim, so rate limiting is a no-op.
 		c := &sclient{
 			ctx:     ctx,
 			canMesh: true,
-			recvLim: rate.NewLimiter(rate.Limit(1), 1), // would block immediately if not exempt
 		}
 
-		// rateLimit should be a no-op for mesh peers.
 		if err := c.rateLimit(1000); err != nil {
 			t.Fatalf("mesh peer rateLimit should be no-op: %v", err)
 		}
 	})
 
-	t.Run("nil_limiter_no_op", func(t *testing.T) {
-		ctx, cancel := context.WithCancel(context.Background())
-		t.Cleanup(cancel)
-
-		c := &sclient{
-			ctx: ctx,
-		}
-
-		// rateLimit with nil recvLim should be a no-op.
-		if err := c.rateLimit(1000); err != nil {
-			t.Fatalf("nil limiter rateLimit should be no-op: %v", err)
-		}
-	})
-
 	t.Run("zero_config_no_limiter", func(t *testing.T) {
 		s := New(key.NewNode(), logger.Discard)
 		defer s.Close()
-		if s.perClientRecvBytesPerSec != 0 {
-			t.Errorf("expected zero rate limit, got %d", s.perClientRecvBytesPerSec)
+		if !reflect.DeepEqual(s.rateConfig, RateConfig{}) {
+			t.Errorf("expected zero rate limit, got %+v", s.rateConfig)
+		}
+	})
+}
+
+// zeroTimer returns a timer that fires immediately.
+func zeroTimer(_ time.Duration) (<-chan time.Time, func() bool) {
+	t := time.NewTimer(0)
+	return t.C, t.Stop
+}
+
+// neverTimer returns a timer that never fires.
+func neverTimer(_ time.Duration) (<-chan time.Time, func() bool) {
+	return make(chan time.Time), func() bool { return false }
+}
+
+func TestRateLimitWait(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("no_wait", func(t *testing.T) {
+		lim := rate.NewLimiter(10, 10)
+		waited, err := rateLimitWait(ctx, lim, 5, time.Now(), zeroTimer)
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if waited != 0 {
+			t.Fatalf("waited = %v, want 0", waited)
+		}
+	})
+
+	t.Run("wait_for_tokens", func(t *testing.T) {
+		lim := rate.NewLimiter(10, 10)
+		now := time.Now()
+		waited, err := rateLimitWait(ctx, lim, 10, now, zeroTimer) // exhaust all tokens
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if waited != 0 {
+			t.Fatalf("waited = %v, want 0", waited)
+		}
+		waited, err = rateLimitWait(ctx, lim, 10, now, zeroTimer)
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if waited == 0 {
+			t.Fatal("waited = 0, want > 0")
+		}
+	})
+
+	t.Run("context_canceled", func(t *testing.T) {
+		lim := rate.NewLimiter(10, 10)
+		now := time.Now()
+		_, err := rateLimitWait(ctx, lim, 10, now, zeroTimer) // exhaust all tokens
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		canceled, cancel := context.WithCancel(ctx) // cancel context so the select picks ctx.Done()
+		cancel()
+		waited, err := rateLimitWait(canceled, lim, 10, now, neverTimer) // neverTimer to only unblock via context
+		if err == nil {
+			t.Fatal("expected error from canceled context")
+		}
+		if waited != 0 {
+			t.Fatalf("waited = %v, want 0", waited)
+		}
+	})
+
+	t.Run("n_exceeds_burst", func(t *testing.T) {
+		lim := rate.NewLimiter(10, 5)
+		waited, err := rateLimitWait(ctx, lim, 10, time.Now(), zeroTimer)
+		if err == nil {
+			t.Fatal("expected error when n > burst")
+		}
+		if waited != 0 {
+			t.Fatalf("waited = %v, want 0", waited)
+		}
+	})
+}
+
+func verifyLimiter(t *testing.T, lim *rate.Limiter, wantRateConfig RateConfig) {
+	t.Helper()
+	if got := lim.Limit(); got != rate.Limit(wantRateConfig.PerClientRateLimitBytesPerSec) {
+		t.Errorf("client rate limit = %v; want %d", got, wantRateConfig.PerClientRateLimitBytesPerSec)
+	}
+	if got := lim.Burst(); got != int(wantRateConfig.PerClientRateBurstBytes) {
+		t.Errorf("client burst = %v; want %d", got, wantRateConfig.PerClientRateBurstBytes)
+	}
+}
+
+func TestUpdateRateLimits(t *testing.T) {
+	const (
+		testClientBurst1 = minRateLimitTokenBucketSize + 1
+		testClientRate1  = minRateLimitTokenBucketSize + 2
+		testClientBurst2 = minRateLimitTokenBucketSize + 3
+		testClientRate2  = minRateLimitTokenBucketSize + 4
+	)
+
+	s := New(key.NewNode(), t.Logf)
+	defer s.Close()
+
+	// Create a non-mesh client with no initial limiter.
+	clientKey := key.NewNode().Public()
+	c := &sclient{
+		key:     clientKey,
+		s:       s,
+		logf:    logger.Discard,
+		canMesh: false,
+	}
+	cs := &clientSet{}
+	cs.activeClient.Store(c)
+
+	s.mu.Lock()
+	s.clients.Store(clientKey, cs)
+	s.mu.Unlock()
+
+	rc := RateConfig{
+		PerClientRateLimitBytesPerSec: testClientRate1,
+		PerClientRateBurstBytes:       testClientBurst1,
+	}
+	s.UpdateRateLimits(rc)
+
+	lim := c.recvLim.Load()
+	if lim == nil {
+		t.Fatal("expected non-nil limiter after update")
+	}
+	verifyLimiter(t, lim, rc)
+
+	// Verify server fields updated.
+	s.mu.Lock()
+	if !reflect.DeepEqual(s.rateConfig, rc) {
+		t.Errorf("s.rateConfig = %+v; want %+v", s.rateConfig, rc)
+	}
+	s.mu.Unlock()
+
+	// Update again with different nonzero values.
+	rc = RateConfig{
+		PerClientRateLimitBytesPerSec: testClientRate2,
+		PerClientRateBurstBytes:       testClientBurst2,
+	}
+	s.UpdateRateLimits(rc)
+	lim = c.recvLim.Load()
+	if lim == nil {
+		t.Fatal("expected non-nil limiter")
+	}
+	verifyLimiter(t, lim, rc)
+
+	// Disable rate limiting (set to 0).
+	s.UpdateRateLimits(RateConfig{})
+
+	if got := c.recvLim.Load(); got != nil {
+		t.Errorf("expected nil limiter after disable, got limit=%v", got.Limit())
+	}
+
+	// Mesh peer should always have nil limiter regardless of update.
+	meshKey := key.NewNode().Public()
+	meshClient := &sclient{
+		key:     meshKey,
+		s:       s,
+		logf:    logger.Discard,
+		canMesh: true,
+	}
+	meshCS := &clientSet{}
+	meshCS.activeClient.Store(meshClient)
+
+	s.mu.Lock()
+	s.clients.Store(meshKey, meshCS)
+	s.mu.Unlock()
+
+	rc = RateConfig{
+		PerClientRateLimitBytesPerSec: testClientRate2,
+		PerClientRateBurstBytes:       testClientBurst2,
+	}
+	s.UpdateRateLimits(rc)
+
+	if got := meshClient.recvLim.Load(); got != nil {
+		t.Errorf("mesh peer should have nil limiter, got limit=%v", got.Limit())
+	}
+	// Non-mesh client should be updated.
+	lim = c.recvLim.Load()
+	if lim == nil {
+		t.Fatal("expected non-nil limiter for non-mesh client")
+	}
+	verifyLimiter(t, lim, rc)
+
+	// Verify dup clients are also updated.
+	dupKey := key.NewNode().Public()
+	d1 := &sclient{key: dupKey, s: s, logf: logger.Discard}
+	d2 := &sclient{key: dupKey, s: s, logf: logger.Discard}
+	dupCS := &clientSet{}
+	dupCS.activeClient.Store(d1)
+	dupCS.dup = &dupClientSet{set: set.Of(d1, d2)}
+	s.mu.Lock()
+	s.clients.Store(dupKey, dupCS)
+	s.mu.Unlock()
+
+	rc = RateConfig{
+		PerClientRateLimitBytesPerSec: testClientRate1,
+		PerClientRateBurstBytes:       testClientBurst1,
+	}
+	s.UpdateRateLimits(rc)
+	for i, d := range []*sclient{d1, d2} {
+		dl := d.recvLim.Load()
+		if dl == nil {
+			t.Fatalf("dup client %d: expected non-nil limiter", i)
+		}
+		verifyLimiter(t, dl, rc)
+	}
+}
+
+func TestLoadRateConfig(t *testing.T) {
+	for _, tt := range []struct {
+		name           string
+		json           string
+		wantRateConfig RateConfig
+	}{
+		{"all_set", `{"PerClientRateLimitBytesPerSec": 1, "PerClientRateBurstBytes": 2}`, RateConfig{
+			PerClientRateLimitBytesPerSec: 1,
+			PerClientRateBurstBytes:       2,
+		}},
+		{"rate_only", `{"PerClientRateLimitBytesPerSec": 1}`, RateConfig{
+			PerClientRateLimitBytesPerSec: 1,
+		}},
+		{"zeros", `{"PerClientRateLimitBytesPerSec": 0, "PerClientRateBurstBytes": 0}`, RateConfig{}},
+		{"empty_json", `{}`, RateConfig{}},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			f := filepath.Join(t.TempDir(), "rate.json")
+			if err := os.WriteFile(f, []byte(tt.json), 0644); err != nil {
+				t.Fatal(err)
+			}
+			rc, err := LoadRateConfig(f)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if !reflect.DeepEqual(rc, tt.wantRateConfig) {
+				t.Errorf("rate config = %v want %v", rc, tt.wantRateConfig)
+			}
+		})
+	}
+
+	for _, tt := range []struct {
+		name    string
+		path    string
+		content string // written to loaded path if non-empty; path used as-is if empty
+	}{
+		{"empty_path", "", ""},
+		{"missing_file", filepath.Join(t.TempDir(), "nonexistent.json"), ""},
+		{"invalid_json", "", "not json"},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			path := tt.path
+			if tt.content != "" {
+				path = filepath.Join(t.TempDir(), "rate.json")
+				if err := os.WriteFile(path, []byte(tt.content), 0644); err != nil {
+					t.Fatal(err)
+				}
+			}
+			_, err := LoadRateConfig(path)
+			if err == nil {
+				t.Fatal("expected error")
+			}
+		})
+	}
+}
+
+func TestLoadAndApplyRateConfig(t *testing.T) {
+	writeConfig := func(t *testing.T, json string) string {
+		t.Helper()
+		f := filepath.Join(t.TempDir(), "rate.json")
+		if err := os.WriteFile(f, []byte(json), 0644); err != nil {
+			t.Fatal(err)
+		}
+		return f
+	}
+
+	t.Run("applies_and_updates_clients", func(t *testing.T) {
+		s := New(key.NewNode(), t.Logf)
+		defer s.Close()
+
+		clientKey := key.NewNode().Public()
+		c := &sclient{key: clientKey, s: s, logf: logger.Discard}
+		cs := &clientSet{}
+		cs.activeClient.Store(c)
+		s.mu.Lock()
+		s.clients.Store(clientKey, cs)
+		s.mu.Unlock()
+
+		f := writeConfig(t, fmt.Sprintf(`{"PerClientRateLimitBytesPerSec": %d, "PerClientRateBurstBytes": %d}`,
+			minRateLimitTokenBucketSize, minRateLimitTokenBucketSize+1))
+		if err := s.LoadAndApplyRateConfig(f); err != nil {
+			t.Fatalf("LoadAndApplyRateConfig: %v", err)
+		}
+
+		// Verify server fields.
+		wantRateConfig := RateConfig{
+			PerClientRateLimitBytesPerSec: minRateLimitTokenBucketSize,
+			PerClientRateBurstBytes:       minRateLimitTokenBucketSize + 1,
+		}
+		s.mu.Lock()
+		if !reflect.DeepEqual(s.rateConfig, wantRateConfig) {
+			t.Errorf("s.rateConfig = %+v; want %+v", s.rateConfig, wantRateConfig)
+		}
+		s.mu.Unlock()
+
+		// Verify client limiter.
+		lim := c.recvLim.Load()
+		if lim == nil {
+			t.Fatal("expected non-nil limiter")
+		}
+		verifyLimiter(t, lim, wantRateConfig)
+	})
+
+	t.Run("burst_is_at_least_minRateLimitTokenBucketSize", func(t *testing.T) {
+		s := New(key.NewNode(), t.Logf)
+		defer s.Close()
+
+		f := writeConfig(t, `{"PerClientRateLimitBytesPerSec": 1250000, "PerClientRateBurstBytes": 10}`)
+		if err := s.LoadAndApplyRateConfig(f); err != nil {
+			t.Fatalf("LoadAndApplyRateConfig: %v", err)
+		}
+
+		s.mu.Lock()
+		gotClientBurst := s.rateConfig.PerClientRateBurstBytes
+		s.mu.Unlock()
+		if gotClientBurst != minRateLimitTokenBucketSize {
+			t.Errorf("client burst = %d; want %d", gotClientBurst, minRateLimitTokenBucketSize)
+		}
+	})
+
+	t.Run("reload_disables_limiting", func(t *testing.T) {
+		s := New(key.NewNode(), t.Logf)
+		defer s.Close()
+
+		f := writeConfig(t, `{"PerClientRateLimitBytesPerSec": 1250000, "PerClientRateBurstBytes": 2500000}`)
+		if err := s.LoadAndApplyRateConfig(f); err != nil {
+			t.Fatal(err)
+		}
+		s.mu.Lock()
+		if reflect.DeepEqual(s.rateConfig, RateConfig{}) {
+			t.Error("s.rateConfig is zero val; want nonzero rates")
+		}
+		s.mu.Unlock()
+
+		if err := os.WriteFile(f, []byte(`{}`), 0644); err != nil {
+			t.Fatal(err)
+		}
+		if err := s.LoadAndApplyRateConfig(f); err != nil {
+			t.Fatal(err)
+		}
+
+		s.mu.Lock()
+		if !reflect.DeepEqual(s.rateConfig, RateConfig{}) {
+			t.Errorf("s.rateConfig = %+v; want %+v", s.rateConfig, RateConfig{})
+		}
+		s.mu.Unlock()
+	})
+
+	t.Run("propagates_errors", func(t *testing.T) {
+		s := New(key.NewNode(), t.Logf)
+		defer s.Close()
+
+		if err := s.LoadAndApplyRateConfig(filepath.Join(t.TempDir(), "nonexistent.json")); err == nil {
+			t.Fatal("expected error")
+		}
+	})
+}
+
+func TestLookupDestHashTrieFastPath(t *testing.T) {
+	s := &Server{
+		clientsMesh: map[key.NodePublic]PacketForwarder{},
+		clock:       tstime.StdClock{},
+	}
+	src := pubAll(1)
+	dst := pubAll(2)
+	dstClient := &sclient{key: dst}
+	cs := &clientSet{}
+	cs.activeClient.Store(dstClient)
+	s.clients.Store(dst, cs)
+
+	c := &sclient{s: s, key: src}
+	got, fwd, dstLen := c.lookupDest(dst)
+	if got != dstClient || fwd != nil || dstLen != 1 {
+		t.Fatalf("lookupDest = (%v, %v, %d), want (%v, nil, 1)", got, fwd, dstLen, dstClient)
+	}
+
+	// This must not deadlock while s.mu is held; the hashtrie fast path
+	// should not acquire Server.mu.
+	s.mu.Lock()
+	got, _, _ = c.lookupDest(dst)
+	s.mu.Unlock()
+	if got != dstClient {
+		t.Fatalf("lookupDest got %v, want %v", got, dstClient)
+	}
+}
+
+func TestLookupDestHashTrieFallsBackForForwarder(t *testing.T) {
+	s := &Server{
+		clientsMesh: map[key.NodePublic]PacketForwarder{},
+		clock:       tstime.StdClock{},
+	}
+	src := pubAll(1)
+	dst := pubAll(2)
+	c := &sclient{s: s, key: src}
+
+	s.clientsMesh[dst] = testFwd(1)
+	got, fwd, dstLen := c.lookupDest(dst)
+	if got != nil || fwd != testFwd(1) || dstLen != 0 {
+		t.Fatalf("lookupDest = (%v, %v, %d), want (nil, testFwd(1), 0)", got, fwd, dstLen)
+	}
+}
+
+func TestLookupDestHashTrieIgnoresInactiveSet(t *testing.T) {
+	s := &Server{
+		clientsMesh: map[key.NodePublic]PacketForwarder{},
+		clock:       tstime.StdClock{},
+	}
+	src := pubAll(1)
+	dst := pubAll(2)
+	c := &sclient{s: s, key: src}
+
+	// A clientSet with no activeClient (a transient state during
+	// register/unregister) must not be returned by the fast path.
+	cs := &clientSet{}
+	s.clients.Store(dst, cs)
+
+	got, fwd, dstLen := c.lookupDest(dst)
+	if got != nil || fwd != nil || dstLen != 0 {
+		t.Fatalf("lookupDest with inactive set = (%v, %v, %d), want (nil, nil, 0)", got, fwd, dstLen)
+	}
+
+	// Setting activeClient on the same in-map entry must make the next
+	// fast-path lookup observe it.
+	newClient := &sclient{key: dst}
+	cs.activeClient.Store(newClient)
+	got, fwd, dstLen = c.lookupDest(dst)
+	if got != newClient || fwd != nil || dstLen != 1 {
+		t.Fatalf("lookupDest after activation = (%v, %v, %d), want (%v, nil, 1)", got, fwd, dstLen, newClient)
+	}
+}
+
+func TestLookupDestHashTrieNoAlloc(t *testing.T) {
+	s := &Server{
+		clientsMesh: map[key.NodePublic]PacketForwarder{},
+		clock:       tstime.StdClock{},
+	}
+	var dstKeys [4]key.NodePublic
+	var dstClients [4]*sclient
+	for i := range dstKeys {
+		dstKeys[i] = pubAll(byte(i + 2))
+		dstClients[i] = &sclient{key: dstKeys[i]}
+		cs := &clientSet{}
+		cs.activeClient.Store(dstClients[i])
+		s.clients.Store(dstKeys[i], cs)
+	}
+	c := &sclient{s: s, key: pubAll(1)}
+
+	var i int
+	var got *sclient
+	allocs := testing.AllocsPerRun(1000, func() {
+		idx := i & (len(dstKeys) - 1)
+		got, _, _ = c.lookupDest(dstKeys[idx])
+		i++
+	})
+	if got == nil {
+		t.Fatal("lookupDest returned nil")
+	}
+	if allocs != 0 {
+		t.Fatalf("lookupDest allocated %v times per run, want 0", allocs)
+	}
+}
+
+func BenchmarkLookupDestHashTrie(b *testing.B) {
+	s := &Server{
+		clientsMesh: map[key.NodePublic]PacketForwarder{},
+		clock:       tstime.StdClock{},
+	}
+	var dstKeys [4]key.NodePublic
+	var dstClients [4]*sclient
+	for i := range dstKeys {
+		dstKeys[i] = pubAll(byte(i + 2))
+		dstClients[i] = &sclient{key: dstKeys[i]}
+		cs := &clientSet{}
+		cs.activeClient.Store(dstClients[i])
+		s.clients.Store(dstKeys[i], cs)
+	}
+
+	b.ReportAllocs()
+	b.SetParallelism(32)
+	b.ResetTimer()
+	b.RunParallel(func(pb *testing.PB) {
+		c := &sclient{s: s, key: pubAll(1)}
+		var i int
+		for pb.Next() {
+			idx := i & (len(dstKeys) - 1)
+			got, fwd, dstLen := c.lookupDest(dstKeys[idx])
+			if got != dstClients[idx] || fwd != nil {
+				b.Fatalf("lookupDest = (%v, %v, %d), want (%v, nil, _)", got, fwd, dstLen, dstClients[idx])
+			}
+			i++
 		}
 	})
 }
diff --git a/derp/derpserver/fortest.go b/derp/derpserver/fortest.go
new file mode 100644
index 000000000..c8741b0bc
--- /dev/null
+++ b/derp/derpserver/fortest.go
@@ -0,0 +1,30 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package derpserver
+
+import (
+	"tailscale.com/derp"
+	"tailscale.com/types/key"
+	"tailscale.com/util/testenv"
+)
+
+// forTest is an unexported type to hide the test-only methods on
+// [Server] from godoc.
+type forTest struct{ s *Server }
+
+// ForTest returns a handle to test-only methods on s. The resulting
+// type is unexported to make it very obvious in godoc that this is
+// not stable API. This method panics if called outside of tests,
+// which also centralizes all must-be-in-tests validation.
+func (s *Server) ForTest() forTest {
+	testenv.AssertInTest()
+	return forTest{s}
+}
+
+// SetOnClientInfo sets a func to be called with each connecting
+// client's key and the ClientInfo it sent. It must be called before
+// the server accepts any connections.
+func (f forTest) SetOnClientInfo(fn func(key.NodePublic, derp.ClientInfo)) {
+	f.s.onClientInfoForTest = fn
+}
diff --git a/cmd/derper/websocket.go b/derp/derpserver/websocket.go
similarity index 75%
rename from cmd/derper/websocket.go
rename to derp/derpserver/websocket.go
index 1929f1690..8bad080c0 100644
--- a/cmd/derper/websocket.go
+++ b/derp/derpserver/websocket.go
@@ -1,7 +1,7 @@
 // Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
-package main
+package derpserver
 
 import (
 	"bufio"
@@ -11,14 +11,20 @@ import (
 	"strings"
 
 	"github.com/coder/websocket"
-	"tailscale.com/derp/derpserver"
 	"tailscale.com/net/wsconn"
 )
 
 var counterWebSocketAccepts = expvar.NewInt("derp_websocket_accepts")
 
-// addWebSocketSupport returns a Handle wrapping base that adds WebSocket server support.
-func addWebSocketSupport(s *derpserver.Server, base http.Handler) http.Handler {
+// AddWebSocketSupport returns an http.Handler wrapping base that adds
+// WebSocket-DERP support. WebSocket-DERP requests (those with an Upgrade:
+// websocket header and a "derp" Sec-WebSocket-Protocol value) are
+// handled here; all other requests pass through to base.
+//
+// The browser-side Tailscale client (cmd/tsconnect/wasm) can only reach DERP
+// via WebSocket, so any DERP server intended to be reachable from browsers
+// must wrap derpserver.Handler with this function.
+func AddWebSocketSupport(s *Server, base http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		up := strings.ToLower(r.Header.Get("Upgrade"))
 
diff --git a/derp/xdp/xdp_linux_test.go b/derp/xdp/xdp_linux_test.go
index cb59721f7..d8de2bf62 100644
--- a/derp/xdp/xdp_linux_test.go
+++ b/derp/xdp/xdp_linux_test.go
@@ -18,6 +18,7 @@ import (
 	"gvisor.dev/gvisor/pkg/tcpip/checksum"
 	"gvisor.dev/gvisor/pkg/tcpip/header"
 	"tailscale.com/net/stun"
+	"tailscale.com/tstest"
 )
 
 type xdpAction uint32
@@ -271,6 +272,7 @@ func getIPv6STUNBindingResp() []byte {
 }
 
 func TestXDP(t *testing.T) {
+	tstest.RequireRoot(t)
 	ipv4STUNBindingReqTX := getIPv4STUNBindingReq(nil)
 	ipv6STUNBindingReqTX := getIPv6STUNBindingReq(nil)
 
@@ -957,10 +959,6 @@ func TestXDP(t *testing.T) {
 	server, err := NewSTUNServer(&STUNServerConfig{DeviceName: "fake", DstPort: defaultSTUNPort},
 		&noAttachOption{})
 	if err != nil {
-		if errors.Is(err, unix.EPERM) {
-			// TODO(jwhited): get this running
-			t.Skip("skipping due to EPERM error; test requires elevated privileges")
-		}
 		t.Fatalf("error constructing STUN server: %v", err)
 	}
 	defer server.Close()
diff --git a/disco/disco.go b/disco/disco.go
index 19a172412..0ed626f91 100644
--- a/disco/disco.go
+++ b/disco/disco.go
@@ -605,7 +605,7 @@ func (m *UDPRelayEndpoint) decode(b []byte) error {
 	b = b[8:]
 	m.SteadyStateLifetime = time.Duration(binary.BigEndian.Uint64(b[:8]))
 	b = b[8:]
-	m.AddrPorts = make([]netip.AddrPort, 0, len(b)-udpRelayEndpointLenMinusAddrPorts/epLength)
+	m.AddrPorts = make([]netip.AddrPort, 0, len(b)/epLength)
 	for len(b) > 0 {
 		var a [16]byte
 		copy(a[:], b)
diff --git a/docs/cli.md b/docs/cli.md
new file mode 100644
index 000000000..ecd05f33b
--- /dev/null
+++ b/docs/cli.md
@@ -0,0 +1,298 @@
+# Tailscale CLI evolution guidelines
+
+This document offers guidance for evolving the Tailscale core command-line
+interface(s), principally `tailscale` (and, where relevant, `tailscaled`). It
+is intentionally lightweight. It describes the *spirit* we want to preserve as
+the CLI grows, not a rigid specification. As with all style guides, some of it
+is subjective and exists mainly to codify existing conventions and promote
+consistency; other parts have stronger reasoning, such as compatibility,
+accessibility, or long-term maintenance burden.
+
+When a guideline here conflicts with good judgement in a specific case,
+prefer good judgement, but raise the conflict so the guidance can be improved.
+These are defaults and tie-breakers, not laws.
+
+## Collaboration and design review
+
+CLI design is a collaborative process, and these guidelines are best applied in
+conversation rather than in isolation.
+
+Tailscalars should seek collaboration in the **#cli** channel in Slack for
+design reviews early, before significant implementation work, while a design is
+still easy to change.
+
+Open-source contributors should anticipate feedback on CLI changes and expect to
+be asked to approach design review collaboratively and thoughtfully. CLI surface
+is long-lived and hard to change once shipped, so a proposed change may go
+through more discussion than a typical bug fix. This is not a barrier; it is how
+we keep the CLI coherent. Engaging openly with that review process is the fastest
+path to getting a change merged.
+
+## Influences and non-goals
+
+Some good concepts and vocabulary here are drawn from the Fuchsia CLI
+guidelines:
+
+* https://fuchsia.dev/fuchsia-src/development/api/cli
+* https://fuchsia.dev/fuchsia-src/development/api/cli_help
+
+We borrow ideas, not rules. Those documents are more prescriptive than we want
+to be, and several of their specifics do not apply to us. In particular:
+
+* We are **not** adopting their `--help` output format. Our help output has its
+  own history and conventions, and we will not switch formats arbitrarily.
+* We have many **pre-existing** commands and behaviors that predate any of
+  this guidance. We accept them as-is. This document is about how we *grow*
+  from here, not a mandate to retrofit existing surfaces.
+
+## Guiding principles
+
+The Tailscale CLI is one of the most visible parts of the product. It is used
+interactively by humans, embedded in scripts and pipelines, read by screen
+readers, and depended on for automation. Small decisions compound. We would
+rather do the harder work of getting a surface right than take the easier
+short-term path of adding one more toggle.
+
+### Keep overall configurability low
+
+We aim to keep the overall configurability of the Tailscale client *low*. It is
+strongly preferred to identify broadly common solutions to heterogeneous user
+challenges and apply them holistically, rather than exposing large configuration
+surfaces.
+
+Wide configuration surfaces are deceptively expensive: they invite users to
+spend effort tuning them, they increase the support load, they multiply the
+combinations we must test and reason about, and they tend to ossify into
+compatibility obligations. Prefer doing the hard work of getting the default
+right over the easy "now" work of adding another option.
+
+This is a default bias, not an absolute prohibition. When a setting is genuinely
+necessary, add it deliberately and in the right place (see below).
+
+## Command structure
+
+### Top-level commands
+
+The top-level command surface (`tailscale <command>`) is precious. Every
+addition there is effectively permanent and competes for the user's attention
+and memory. We want it to grow slowly.
+
+Some commands earn a place at the top level because they are used so frequently
+that the brevity is worth it:
+
+* `tailscale set` and `tailscale get` are fine as independent top-level
+  commands, in large part *because their usage is so frequent*. The cost of an
+  extra level of nesting would be paid constantly.
+
+### Prefer `tailscale <noun> <verb>` for features
+
+For new "feature"-oriented designs, we will generally prefer a
+`tailscale <noun> <verb>` structure (for example `tailscale <feature> status`,
+`tailscale <feature> enable`). This lets a feature's surface grow over time
+without growing the top-level CLI surface too quickly. New verbs and options
+live under the noun, where they are discoverable in context and do not crowd the
+root.
+
+This is a guideline, not a cage. Do not force a design into
+`<noun> <verb>` if there is wide consensus that the resulting structure is
+awkward. Naturalness and usability win over structural purity.
+
+### Noun naming
+
+Prefer **singular** nouns (`tailscale cert`, `tailscale ip`) unless a singular
+form is strongly unnatural for the concept. Consistency in number makes commands
+easier to predict and remember.
+
+### `tailscale up` is closed for extension
+
+`tailscale up` is now effectively **closed for extension**. New configuration
+features should prefer to go into `set` rather than `up`.
+
+The reason is historical and concrete: `up` has the long-standing problem that
+its flags describe a desired *complete* state, so a later invocation must repeat
+(or carefully manage) all of the earlier flags or risk resetting them. `set` was
+introduced precisely to allow incremental, additive configuration changes
+without that footgun. New knobs belong there.
+
+### Extend existing surfaces when it fits the spirit
+
+Existing surfaces should be extended where appropriate, provided the extension
+does not substantially change the *spirit* of the surface.
+
+For example, adding new target query types to `tailscale ip` is a good fit where
+those targets are sufficiently visible to clients: it is the same operation
+("resolve a thing to an IP") applied to more inputs. That is extension in the
+spirit of the command, not scope creep.
+
+### Avoid arbitrary growth in complexity
+
+Resist the temptation to grow a command to match the full surface of some
+external tool it resembles. For example, `tailscale ssh` does **not** intend to
+reimplement the full flag surface of `ssh` over time. Doing so would be an
+enormous and open-ended maintenance burden, and `ssh` itself is essentially
+ubiquitously available and already serves that purpose. A Tailscale command
+should do its job well, not absorb an entire adjacent ecosystem.
+
+## Debug commands
+
+Heavily used `debug` subcommands should, over time, graduate into proper
+features of the main program when they prove broadly useful.
+
+`debug` subcommands are explicitly **not** subject to our usual compatibility
+promises. They are best-effort and may change or be removed. Treat them as a
+staging ground and a power-user/diagnostic surface, not as a stable API. If a
+debug command becomes load-bearing for users, that is a signal to promote and
+stabilize it deliberately rather than to quietly grant it stability by neglect.
+
+## Configuration: where settings live
+
+### Profile-local preferences are the default home
+
+Most configuration should be **profile-local** preferences, set and read via
+`set`/`get`, and modifiable at runtime. This is where the overwhelming majority
+of user-facing configuration belongs.
+
+### `tailscaled` flags are a last resort
+
+Daemon (`tailscaled`) command-line flags should ideally be added **only** when a
+setting is truly *process-global* and *immutable after launch*. If something can
+reasonably be a profile-local preference that is changeable via `set`/`get`, it
+should be, not a daemon flag.
+
+Daemon flags are sticky and global; they are the wrong place for anything a user
+might want to change per-profile or at runtime.
+
+Daemon flags are also, in practice, **almost Linux-only**. Most GUI platforms
+(for example macOS, Windows, and mobile) make it very difficult for a user to
+adjust how the tailscale backend (e.g. `tailscaled`) is launched, so a setting
+that lives only in a daemon flag is effectively unreachable for most of our
+users. This is another reason to prefer profile-local preferences via
+`set`/`get`, which work uniformly across platforms.
+
+### Prefer preferences over environment variables
+
+For both `tailscale` and `tailscaled` configuration surfaces, prefer
+preferences (`set`/`get`) over environment variables. Environment variables are
+hard to discover, hard to deprecate, and tend to leak into permanence.
+
+### `TS_DEBUG` environment knobs
+
+Add `TS_DEBUG`-style env knobs freely as development work requires them. These
+are explicitly **for development only**. They are not intended for end users and
+should not be documented or encouraged for public use.
+
+A cautionary note: we already have cases of debug env knobs that became
+load-bearing for someone and which we may never be able to remove. That is an
+undesirable outcome. Keeping these clearly internal and undocumented is what
+preserves our freedom to change or delete them.
+
+## Output and streams
+
+### `--json` and stable machine output
+
+Commands should offer a **stable** JSON format behind a `--json` flag. Once a
+feature is generally available (GA), that JSON format is maintained in a
+backward-compatible way as much as possible, in keeping with Tailscale's broad
+compatibility policy.
+
+Backward compatibility here means existing fields keep their meaning. **Adding
+new fields is allowed** and expected; consumers must tolerate unknown fields.
+
+### Human-readable (non-JSON) output
+
+Non-JSON command output is the default and should be optimized, first and
+foremost, for *easy reading by sighted humans*, and, where possible, to *read
+well with a screen reader*. Concretely:
+
+* Avoid decorative Unicode output. Prefer plain ASCII.
+* Convey information in the **text**, not only via color or position. Do not
+  rely on color to communicate meaning (see "Color and decoration" below).
+* Keep output uncluttered and scannable.
+
+The `grep`/`awk`-ability of stdout output should be considered and maintained on
+a **best-effort** basis, but it is **not** a hard compatibility guarantee when
+readability or usability would suffer substantially as a result.
+
+In practice this means being conservative with the *shape* of stable output. For
+example:
+
+* Adding a **new column** in the middle of already-stable tabular output should
+  only be done after strongly weighing the tradeoffs, and most often should not
+  be done, because it breaks naive positional parsers.
+* Adding **new in-column behavior** can be done with care. A good example: the
+  idle/connected/DERP/relay status field was extended to describe relays
+  *within the existing column* rather than by adding a new column. That
+  technically introduced new parsable content into the column (so the strictest
+  parsers might notice), but it avoided breaking the common case, and *not*
+  conveying the information would have been too large a usability and
+  readability loss.
+
+The principle: prefer changes that preserve the common parser and the human
+reader simultaneously; when forced to choose, protect the human reader, and make
+machine consumers use `--json`.
+
+### stdout vs. stderr
+
+**stderr is the standard *information* stream.** It is not only for errors. It
+carries all informational, diagnostic, and progress output that is not the
+direct intended output of the command.
+
+**stdout** should contain (within reason) the command's *intended* output — the
+thing the user actually asked for — or nothing. Everything else (status notes,
+progress, warnings, diagnostics) goes to stderr.
+
+This separation is what makes the CLI usable in pipelines: a user can pipe
+stdout into another tool without having diagnostic chatter corrupt the data
+stream.
+
+A couple of implications worth calling out:
+
+* `--help` is *intended* output: when the user asks for help, help text should
+  go to **stdout**.
+* An *error* about bad flags that happens to print usage as part of a
+  diagnostic message is diagnostic output and should go to **stderr**, not
+  stdout.
+
+  (At the time of writing, our handling of this distinction for help output is
+  an existing bug. New code should follow the correct behavior, and we should
+  fix the existing behavior over time.)
+
+### TTY-dependent behavior
+
+Altering behavior based on whether stdout is a TTY is sometimes genuinely
+helpful (for example, suppressing a spinner when not interactive). Use it
+sparingly.
+
+Major changes in behavior or output based on TTY detection are an impediment to
+use and should not be added arbitrarily. Requiring something like
+`tailscale foo | less` in order to *discover* a behavior should not become a
+standard pattern: it is a usability issue that excludes many users, including
+those using screen readers and automation.
+
+### Color and decoration
+
+Support for, and further discussion of, colored or heavily decorated output is
+**deferred at this time** and should not be added until guidance is clarified.
+
+The primary concern is accessibility: colored and decorated output is often
+hostile to screen-reader users, and information encoded only in color is
+invisible to many people. Until we have clear guidance, keep output plain and
+ensure all meaning is present in the text itself.
+
+## Summary checklist
+
+When adding or changing CLI surface, ask:
+
+* Tailscalars can raise a thread in #cli
+* Could this be a profile-local preference via `set`/`get` instead of a new
+  top-level command, a `up` flag, a daemon flag, or an env var? Usually it
+  should be.
+* Does it fit a `tailscale <noun> <verb>` shape without being awkward?
+* Is the noun singular (unless that's strongly unnatural)?
+* Does it provide stable `--json` output, and is the human output plain,
+  screen-reader-friendly, and free of color-only meaning?
+* Does intended output go to stdout and everything else to stderr?
+* Are you extending an existing surface in its spirit, rather than growing
+  complexity arbitrarily?
+* If it's a debug command, is it clearly best-effort and not silently becoming
+  a stable dependency?
diff --git a/docs/commit-messages.md b/docs/commit-messages.md
index 57047a803..b0d3e12e7 100644
--- a/docs/commit-messages.md
+++ b/docs/commit-messages.md
@@ -74,7 +74,7 @@ For the body (the rest of the description):
 - blank line after the subject (first) line
 - the text should be wrapped to ~76 characters (to appease git viewing tools, mainly), unless you really need longer lines (e.g. for ASCII art, tables, or long links)
 - there must be a `Fixes` or `Updates` line for all non-cleanup commits linking to a tracking bug. This goes after the body with a blank newline separating the two. A pull request may be referenced rather than a tracking bug (using the same format, e.g. `Updates #12345`), though a bug is generally preferred. [Cleanup commits](#is-it-a-cleanup) can use `Updates #cleanup` instead of an issue.
-- `Change-Id` lines should be included in commits. You can configure Git to do this for you by running `./tool/go run misc/install-git-hooks.go` from the root of the repo. This was originally a Gerrit thing and we don't use Gerrit, but it lets tooling track commits as they're cherry-picked between branches. Also, tools like [git-cleanup](https://github.com/bradfitz/gitutil) use it to clean up your old local branches once they're merged upstream.
+- `Change-Id` lines should be included in commits. You can configure Git to do this for you by running `./tool/go run misc/add-git-hooks.go` from the root of the repo. This was originally a Gerrit thing and we don't use Gerrit, but it lets tooling track commits as they're cherry-picked between branches. Also, tools like [git-cleanup](https://github.com/bradfitz/gitutil) use it to clean up your old local branches once they're merged upstream.
 - we don't use Markdown in commit messages. (Accidental Markdown like bulleted lists or even headings is fine, but not links)
 - we require `Signed-off-by` lines in public repos (such as `tailscale/tailscale`). Add them using `git commit --signoff` or `git commit -s` for short. You can use them in private repos but do not have to.
 - when moving code between repos, include the repository name, and git hash that it was moved from/to, so it is easier to trace history/blame.
diff --git a/drive/driveimpl/compositedav/stat_cache.go b/drive/driveimpl/compositedav/stat_cache.go
index 2e53c8241..176a09d84 100644
--- a/drive/driveimpl/compositedav/stat_cache.go
+++ b/drive/driveimpl/compositedav/stat_cache.go
@@ -13,6 +13,7 @@ import (
 	"time"
 
 	"github.com/jellydator/ttlcache/v3"
+	"golang.org/x/text/unicode/norm"
 	"tailscale.com/drive/driveimpl/shared"
 )
 
@@ -20,6 +21,17 @@ var (
 	notFound = newCacheEntry(http.StatusNotFound, nil)
 )
 
+// normalize converts the given path into a canonical form for use as a cache
+// key. In addition to path cleanup, it applies Unicode NFC normalization so
+// that canonically equivalent names (e.g. the NFC name on disk and the NFD
+// name requested by a macOS WebDAV client) share a single cache entry.
+// Without this, a depth 0 lookup for the NFD form of a name would miss the
+// entry cached from the NFC href in the parent directory's listing, and get
+// would wrongly infer that the file doesn't exist.
+func normalize(p string) string {
+	return norm.NFC.String(shared.Normalize(p))
+}
+
 // StatCache provides a cache for directory listings and file metadata.
 // Especially when used from the command-line, mapped WebDAV drives can
 // generate repetitive requests for the same file metadata. This cache helps
@@ -89,7 +101,7 @@ func (c *StatCache) get(name string, depth int) *cacheEntry {
 		return nil
 	}
 
-	name = shared.Normalize(name)
+	name = normalize(name)
 
 	c.mu.Lock()
 	defer c.mu.Unlock()
@@ -142,7 +154,7 @@ func (c *StatCache) set(name string, depth int, ce *cacheEntry) {
 		return
 	}
 
-	name = shared.Normalize(name)
+	name = normalize(name)
 
 	var self *cacheEntry
 	var children map[string]*cacheEntry
@@ -171,7 +183,7 @@ func (c *StatCache) set(name string, depth int, ce *cacheEntry) {
 					log.Printf("statcache.set child parse error: %s", err)
 					return
 				}
-				name = shared.Normalize(name)
+				name = normalize(name)
 				raw := marshalMultiStatus(response)
 				entry := newCacheEntry(ce.Status, raw)
 				if i == 0 {
diff --git a/drive/driveimpl/compositedav/stat_cache_test.go b/drive/driveimpl/compositedav/stat_cache_test.go
index b982a3aad..9be286389 100644
--- a/drive/driveimpl/compositedav/stat_cache_test.go
+++ b/drive/driveimpl/compositedav/stat_cache_test.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"log"
 	"net/http"
+	"net/url"
 	"path"
 	"strings"
 	"testing"
@@ -211,3 +212,51 @@ func TestParentChildRelationship(t *testing.T) {
 		})
 	}
 }
+
+// TestUnicodeNormalizationInsensitivity verifies that cache lookups treat
+// canonically equivalent names as the same key. A parent directory listing
+// caches children under the names from the server's hrefs (often NFC), while
+// macOS WebDAV clients request the same files using NFD names. Without
+// normalization, the depth 0 lookup would miss and get would wrongly infer
+// notFound from the cached parent.
+func TestUnicodeNormalizationInsensitivity(t *testing.T) {
+	// Make sure we don't leak goroutines
+	tstest.ResourceCheck(t)
+
+	c := &StatCache{TTL: 24 * time.Hour} // don't expire
+	defer c.stop()
+
+	const (
+		nfcParent = "\u30ae\u30bf\u30fc"           // ギター in NFC: ギ is the single code point U+30AE
+		nfdParent = "\u30ad\u3099\u30bf\u30fc"     // same name in NFD: キ U+30AD plus combining voiced mark U+3099
+		nfcChild  = "\u30c6\u30ba\u30c8.wav"       // テズト.wav in NFC: ズ is the single code point U+30BA
+		nfdChild  = "\u30c6\u30b9\u3099\u30c8.wav" // same name in NFD: ス U+30B9 plus combining voiced mark U+3099
+	)
+	nfcParentPath := "/" + nfcParent
+	nfdParentPath := "/" + nfdParent
+	nfcChildPath := nfcParentPath + "/" + nfcChild
+	nfdChildPath := nfdParentPath + "/" + nfdChild
+
+	// The hrefs in a real PROPFIND response contain the percent-encoded UTF-8
+	// bytes of the names as they appear on the server's disk, here NFC.
+	unicodeParentResponse := strings.ReplaceAll(parentResponse, "/parent%20with%20spaces/", "/"+url.PathEscape(nfcParent)+"/")
+	unicodeChildResponse := strings.ReplaceAll(childResponse, "/parent%20with%20spaces/child.txt", "/"+url.PathEscape(nfcParent)+"/"+url.PathEscape(nfcChild))
+	unicodeFullParent := []byte(
+		strings.ReplaceAll(
+			fmt.Sprintf(`<?xml version="1.0" encoding="UTF-8"?><D:multistatus xmlns:D="DAV:">%s%s</D:multistatus>`, unicodeParentResponse, unicodeChildResponse),
+			"\n", ""))
+	unicodeFullChild := []byte(
+		strings.ReplaceAll(
+			fmt.Sprintf(`<?xml version="1.0" encoding="UTF-8"?><D:multistatus xmlns:D="DAV:">%s</D:multistatus>`, unicodeChildResponse),
+			"\n", ""))
+
+	c.set(nfcParentPath, 1, newCacheEntry(http.StatusMultiStatus, unicodeFullParent))
+
+	want := newCacheEntry(http.StatusMultiStatus, unicodeFullChild)
+	for _, childPath := range []string{nfcChildPath, nfdChildPath} {
+		got := c.get(childPath, 0)
+		if diff := cmp.Diff(got, want); diff != "" {
+			t.Errorf("get(%q): unexpected cached value; (-got+want):%v", childPath, diff)
+		}
+	}
+}
diff --git a/drive/driveimpl/drive_test.go b/drive/driveimpl/drive_test.go
index 8f9b43d6b..4c3426254 100644
--- a/drive/driveimpl/drive_test.go
+++ b/drive/driveimpl/drive_test.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"io"
 	"io/fs"
+	"iter"
 	"log"
 	"net"
 	"net/http"
@@ -239,7 +240,7 @@ func TestLOCK(t *testing.T) {
 	}
 
 	u := fmt.Sprintf("http://%s/%s/%s/%s/%s",
-		s.local.l.Addr(),
+		s.local.ln.Addr(),
 		url.PathEscape(domain),
 		url.PathEscape(remote1),
 		url.PathEscape(share11),
@@ -365,7 +366,7 @@ func TestUNLOCK(t *testing.T) {
 	}
 
 	u := fmt.Sprintf("http://%s/%s/%s/%s/%s",
-		s.local.l.Addr(),
+		s.local.ln.Addr(),
 		url.PathEscape(domain),
 		url.PathEscape(remote1),
 		url.PathEscape(share11),
@@ -428,12 +429,12 @@ func TestUNLOCK(t *testing.T) {
 }
 
 type local struct {
-	l  net.Listener
+	ln net.Listener
 	fs *FileSystemForLocal
 }
 
 type remote struct {
-	l           net.Listener
+	ln          net.Listener
 	fs          *FileSystemForRemote
 	fileServer  *FileServer
 	shares      map[string]string
@@ -456,10 +457,48 @@ func (r *remote) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 }
 
 type system struct {
-	t       *testing.T
-	local   *local
-	client  *gowebdav.Client
+	t         *testing.T
+	local     *local
+	client    *gowebdav.Client
+	transport http.RoundTripper
+
+	mu      sync.Mutex
 	remotes map[string]*remote
+	gen     uint64
+}
+
+// Domain implements [drive.RemoteSource].
+func (s *system) Domain() string { return domain }
+
+// Transport implements [drive.RemoteSource].
+func (s *system) Transport() http.RoundTripper { return s.transport }
+
+// Remotes implements [drive.RemoteSource].
+func (s *system) Remotes() iter.Seq[*drive.Remote] {
+	s.mu.Lock()
+	rs := make([]*drive.Remote, 0, len(s.remotes))
+	for name, r := range s.remotes {
+		url := fmt.Sprintf("http://%s", r.ln.Addr())
+		rs = append(rs, &drive.Remote{
+			Name: name,
+			URL:  func() string { return url },
+		})
+	}
+	s.mu.Unlock()
+	return func(yield func(*drive.Remote) bool) {
+		for _, r := range rs {
+			if !yield(r) {
+				return
+			}
+		}
+	}
+}
+
+// Generation implements [drive.RemoteSource].
+func (s *system) Generation() uint64 {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.gen
 }
 
 func newSystem(t *testing.T) *system {
@@ -483,14 +522,19 @@ func newSystem(t *testing.T) *system {
 		}
 	}()
 
-	client := gowebdav.NewAuthClient(fmt.Sprintf("http://%s", ln.Addr()), &noopAuthorizer{})
+	client := gowebdav.NewClient(fmt.Sprintf("http://%s", ln.Addr()), "", "")
 	client.SetTransport(&http.Transport{DisableKeepAlives: true})
 	s := &system{
-		t:       t,
-		local:   &local{l: ln, fs: fs},
+		t:     t,
+		local: &local{ln: ln, fs: fs},
+		transport: &http.Transport{
+			DisableKeepAlives:     true,
+			ResponseHeaderTimeout: 5 * time.Second,
+		},
 		client:  client,
 		remotes: make(map[string]*remote),
 	}
+	fs.SetRemoteSource(s)
 	t.Cleanup(s.stop)
 	return s
 }
@@ -510,7 +554,7 @@ func (s *system) addRemote(name string) string {
 	s.t.Logf("FileServer for %v listening at %s", name, fileServer.Addr())
 
 	r := &remote{
-		l:           ln,
+		ln:          ln,
 		fileServer:  fileServer,
 		fs:          NewFileSystemForRemote(log.Printf),
 		shares:      make(map[string]string),
@@ -518,22 +562,11 @@ func (s *system) addRemote(name string) string {
 	}
 	r.fs.SetFileServerAddr(fileServer.Addr())
 	go http.Serve(ln, r)
-	s.remotes[name] = r
 
-	remotes := make([]*drive.Remote, 0, len(s.remotes))
-	for name, r := range s.remotes {
-		remotes = append(remotes, &drive.Remote{
-			Name: name,
-			URL:  func() string { return fmt.Sprintf("http://%s", r.l.Addr()) },
-		})
-	}
-	s.local.fs.SetRemotes(
-		domain,
-		remotes,
-		&http.Transport{
-			DisableKeepAlives:     true,
-			ResponseHeaderTimeout: 5 * time.Second,
-		})
+	s.mu.Lock()
+	s.remotes[name] = r
+	s.gen++
+	s.mu.Unlock()
 
 	return fileServer.Addr()
 }
@@ -683,7 +716,7 @@ func (s *system) stop() {
 		s.t.Fatalf("failed to Close fs: %s", err)
 	}
 
-	err = s.local.l.Close()
+	err = s.local.ln.Close()
 	if err != nil {
 		s.t.Fatalf("failed to Close listener: %s", err)
 	}
@@ -694,7 +727,7 @@ func (s *system) stop() {
 			s.t.Fatalf("failed to Close remote fs: %s", err)
 		}
 
-		err = r.l.Close()
+		err = r.ln.Close()
 		if err != nil {
 			s.t.Fatalf("failed to Close remote listener: %s", err)
 		}
@@ -739,36 +772,6 @@ func pathTo(remote, share, name string) string {
 	return path.Join(domain, remote, share, name)
 }
 
-// noopAuthorizer implements gowebdav.Authorizer. It does no actual
-// authorizing. We use it in place of gowebdav's built-in authorizer in order
-// to avoid a race condition in that authorizer.
-type noopAuthorizer struct{}
-
-func (a *noopAuthorizer) NewAuthenticator(body io.Reader) (gowebdav.Authenticator, io.Reader) {
-	return &noopAuthenticator{}, nil
-}
-
-func (a *noopAuthorizer) AddAuthenticator(key string, fn gowebdav.AuthFactory) {
-}
-
-type noopAuthenticator struct{}
-
-func (a *noopAuthenticator) Authorize(c *http.Client, rq *http.Request, path string) error {
-	return nil
-}
-
-func (a *noopAuthenticator) Verify(c *http.Client, rs *http.Response, path string) (redo bool, err error) {
-	return false, nil
-}
-
-func (a *noopAuthenticator) Clone() gowebdav.Authenticator {
-	return &noopAuthenticator{}
-}
-
-func (a *noopAuthenticator) Close() error {
-	return nil
-}
-
 const lockBody = `<?xml version="1.0" encoding="utf-8" ?>
 <D:lockinfo xmlns:D='DAV:'>
   <D:lockscope><D:exclusive/></D:lockscope>
diff --git a/drive/driveimpl/fileserver.go b/drive/driveimpl/fileserver.go
index 6aedfef2c..41a6e71a0 100644
--- a/drive/driveimpl/fileserver.go
+++ b/drive/driveimpl/fileserver.go
@@ -102,7 +102,7 @@ func (s *FileServer) ClearSharesLocked() {
 // has been called first.
 func (s *FileServer) AddShareLocked(share, path string) {
 	s.shareHandlers[share] = &webdav.Handler{
-		FileSystem: &birthTimingFS{webdav.Dir(path)},
+		FileSystem: &birthTimingFS{&normalizingFS{webdav.Dir(path)}},
 		LockSystem: webdav.NewMemLS(),
 	}
 }
diff --git a/drive/driveimpl/local_impl.go b/drive/driveimpl/local_impl.go
index ab908c0d3..1ac6b1395 100644
--- a/drive/driveimpl/local_impl.go
+++ b/drive/driveimpl/local_impl.go
@@ -8,6 +8,7 @@ import (
 	"log"
 	"net"
 	"net/http"
+	"sync"
 	"time"
 
 	"tailscale.com/drive"
@@ -52,10 +53,18 @@ type FileSystemForLocal struct {
 	logf     logger.Logf
 	h        *compositedav.Handler
 	listener *connListener
+
+	// sourceMu guards source and cachedGen. It also serializes the
+	// rebuild path so concurrent requests don't race to replace
+	// children with stale data.
+	sourceMu  sync.Mutex
+	source    drive.RemoteSource
+	cachedGen uint64
+	haveGen   bool // true once cachedGen reflects an actual source.Generation call
 }
 
 func (s *FileSystemForLocal) startServing() {
-	hs := &http.Server{Handler: s.h}
+	hs := &http.Server{Handler: http.HandlerFunc(s.serveHTTP)}
 	go func() {
 		err := hs.Serve(s.listener)
 		if err != nil {
@@ -65,17 +74,35 @@ func (s *FileSystemForLocal) startServing() {
 	}()
 }
 
-// HandleConn handles connections from local WebDAV clients
-func (s *FileSystemForLocal) HandleConn(conn net.Conn, remoteAddr net.Addr) error {
-	return s.listener.HandleConn(conn, remoteAddr)
+// serveHTTP refreshes the underlying compositedav children from the
+// remote source if its generation has changed, then delegates to the
+// composite handler. The refresh path is skipped entirely when the
+// generation is unchanged, which is the common case.
+func (s *FileSystemForLocal) serveHTTP(w http.ResponseWriter, r *http.Request) {
+	s.refresh()
+	s.h.ServeHTTP(w, r)
 }
 
-// SetRemotes sets the complete set of remotes on the given tailnet domain
-// using a map of name -> url. If transport is specified, that transport
-// will be used to connect to these remotes.
-func (s *FileSystemForLocal) SetRemotes(domain string, remotes []*drive.Remote, transport http.RoundTripper) {
-	children := make([]*compositedav.Child, 0, len(remotes))
-	for _, remote := range remotes {
+// refresh rebuilds the compositedav children from the current source
+// if its generation has changed since the last refresh. It is a no-op
+// when no source is set or when the generation matches the cached
+// value.
+func (s *FileSystemForLocal) refresh() {
+	s.sourceMu.Lock()
+	defer s.sourceMu.Unlock()
+
+	source := s.source
+	if source == nil {
+		return
+	}
+	gen := source.Generation()
+	if s.haveGen && gen == s.cachedGen {
+		return
+	}
+
+	transport := source.Transport()
+	var children []*compositedav.Child
+	for remote := range source.Remotes() {
 		children = append(children, &compositedav.Child{
 			Child: &dirfs.Child{
 				Name:      remote.Name,
@@ -85,8 +112,25 @@ func (s *FileSystemForLocal) SetRemotes(domain string, remotes []*drive.Remote,
 			Transport: transport,
 		})
 	}
+	s.h.SetChildren(source.Domain(), children...)
+	s.cachedGen = gen
+	s.haveGen = true
+}
 
-	s.h.SetChildren(domain, children...)
+// HandleConn handles connections from local WebDAV clients
+func (s *FileSystemForLocal) HandleConn(conn net.Conn, remoteAddr net.Addr) error {
+	return s.listener.HandleConn(conn, remoteAddr)
+}
+
+// SetRemoteSource sets the source from which the filesystem reads the
+// current set of remotes. It replaces any previously set source and
+// forces a rebuild on the next incoming request.
+func (s *FileSystemForLocal) SetRemoteSource(source drive.RemoteSource) {
+	s.sourceMu.Lock()
+	s.source = source
+	s.cachedGen = 0
+	s.haveGen = false
+	s.sourceMu.Unlock()
 }
 
 // Close() stops serving the WebDAV content
diff --git a/drive/driveimpl/normfs.go b/drive/driveimpl/normfs.go
new file mode 100644
index 000000000..66f28f610
--- /dev/null
+++ b/drive/driveimpl/normfs.go
@@ -0,0 +1,113 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package driveimpl
+
+import (
+	"context"
+	"errors"
+	iofs "io/fs"
+	"os"
+	"path"
+	"strings"
+
+	"github.com/tailscale/xnet/webdav"
+	"golang.org/x/text/unicode/norm"
+)
+
+// normalizingFS extends a webdav.FileSystem to resolve paths in a Unicode
+// normalization-insensitive way. Different clients encode non-ASCII filenames
+// differently: for example, macOS WebDAV clients request paths in NFD form,
+// while files on disk are often named in NFC form. On normalization-sensitive
+// filesystems like ext4, opening the NFD name of an NFC file fails. When an
+// exact lookup fails, normalizingFS rescans the parent directory for an entry
+// whose name is canonically equivalent to the requested one and uses that
+// instead. See https://github.com/tailscale/tailscale/issues/15020.
+type normalizingFS struct {
+	webdav.FileSystem
+}
+
+func (fs *normalizingFS) Mkdir(ctx context.Context, name string, perm os.FileMode) error {
+	return fs.FileSystem.Mkdir(ctx, fs.resolve(ctx, name), perm)
+}
+
+func (fs *normalizingFS) OpenFile(ctx context.Context, name string, flag int, perm os.FileMode) (webdav.File, error) {
+	return fs.FileSystem.OpenFile(ctx, fs.resolve(ctx, name), flag, perm)
+}
+
+func (fs *normalizingFS) RemoveAll(ctx context.Context, name string) error {
+	return fs.FileSystem.RemoveAll(ctx, fs.resolve(ctx, name))
+}
+
+func (fs *normalizingFS) Rename(ctx context.Context, oldName, newName string) error {
+	return fs.FileSystem.Rename(ctx, fs.resolve(ctx, oldName), fs.resolve(ctx, newName))
+}
+
+func (fs *normalizingFS) Stat(ctx context.Context, name string) (os.FileInfo, error) {
+	return fs.FileSystem.Stat(ctx, fs.resolve(ctx, name))
+}
+
+// resolve maps name to the path of an existing file whose name is canonically
+// equivalent to name under Unicode NFC normalization. Exact matches always
+// win. Path components with no existing equivalent are left as given, so that
+// newly created files keep the exact name that the client requested.
+func (fs *normalizingFS) resolve(ctx context.Context, name string) string {
+	if isASCII(name) {
+		// ASCII strings are canonically equivalent only to themselves.
+		return name
+	}
+	if _, err := fs.FileSystem.Stat(ctx, name); err == nil || !errors.Is(err, iofs.ErrNotExist) {
+		return name
+	}
+	resolved := "/"
+	parts := strings.Split(strings.Trim(path.Clean("/"+name), "/"), "/")
+	for i, part := range parts {
+		candidate := path.Join(resolved, part)
+		if isASCII(part) {
+			resolved = candidate
+			continue
+		}
+		if _, err := fs.FileSystem.Stat(ctx, candidate); err == nil {
+			resolved = candidate
+			continue
+		}
+		match, ok := fs.findEquivalent(ctx, resolved, part)
+		if !ok {
+			// No equivalent entry exists. Keep the remaining components
+			// as given; deeper lookups would fail anyway.
+			return path.Join(append([]string{resolved}, parts[i:]...)...)
+		}
+		resolved = path.Join(resolved, match)
+	}
+	return resolved
+}
+
+// findEquivalent scans the directory at dir for an entry whose name is
+// canonically equivalent to name, returning the on-disk name if found.
+func (fs *normalizingFS) findEquivalent(ctx context.Context, dir, name string) (string, bool) {
+	d, err := fs.FileSystem.OpenFile(ctx, dir, os.O_RDONLY, 0)
+	if err != nil {
+		return "", false
+	}
+	defer d.Close()
+	fis, err := d.Readdir(0)
+	if err != nil {
+		return "", false
+	}
+	want := norm.NFC.String(name)
+	for _, fi := range fis {
+		if norm.NFC.String(fi.Name()) == want {
+			return fi.Name(), true
+		}
+	}
+	return "", false
+}
+
+func isASCII(s string) bool {
+	for i := 0; i < len(s); i++ {
+		if s[i] >= 0x80 {
+			return false
+		}
+	}
+	return true
+}
diff --git a/drive/driveimpl/remote_impl.go b/drive/driveimpl/remote_impl.go
index 0ff27dc64..c9b42f1ab 100644
--- a/drive/driveimpl/remote_impl.go
+++ b/drive/driveimpl/remote_impl.go
@@ -315,9 +315,7 @@ func (s *userServer) runLoop() {
 			consecutiveFailures = 1
 		}
 		sleepTime := time.Duration(math.Pow(2, consecutiveFailures)) * time.Millisecond
-		if sleepTime > maxSleepTime {
-			sleepTime = maxSleepTime
-		}
+		sleepTime = min(sleepTime, maxSleepTime)
 		s.logf("user server % v stopped with error %v, will try again in %v", s.executable, err, sleepTime)
 		time.Sleep(sleepTime)
 	}
diff --git a/drive/driveimpl/shared/readonlydir.go b/drive/driveimpl/shared/readonlydir.go
index b0f958231..e2d3a469b 100644
--- a/drive/driveimpl/shared/readonlydir.go
+++ b/drive/driveimpl/shared/readonlydir.go
@@ -42,10 +42,7 @@ func (d *DirFile) Readdir(count int) ([]fs.FileInfo, error) {
 		return result, nil
 	}
 
-	n := len(d.children)
-	if count < n {
-		n = count
-	}
+	n := min(count, len(d.children))
 	result := d.children[:n]
 	d.children = d.children[n:]
 	if len(d.children) == 0 {
diff --git a/drive/driveimpl/unicode_test.go b/drive/driveimpl/unicode_test.go
new file mode 100644
index 000000000..bdce6c3ac
--- /dev/null
+++ b/drive/driveimpl/unicode_test.go
@@ -0,0 +1,114 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package driveimpl
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"tailscale.com/drive"
+)
+
+// Unicode filenames from https://github.com/tailscale/tailscale/issues/15020,
+// in both NFC (precomposed) and NFD (decomposed) forms. The two forms are
+// canonically equivalent but byte-wise different, so on
+// normalization-sensitive filesystems like ext4 they name different files.
+const (
+	nfcName = "\u30c6\u30ba\u30c8 \u00e4.wav"        // テズト ä.wav, precomposed
+	nfdName = "\u30c6\u30b9\u3099\u30c8 a\u0308.wav" // same name, decomposed
+	nfcDir  = "\u30ae\u30bf\u30fc"                   // ギター, precomposed
+	nfdDir  = "\u30ad\u3099\u30bf\u30fc"             // same name, decomposed
+)
+
+// TestUnicodeRoundTrip verifies that a file written via WebDAV with a
+// non-ASCII name can be statted and read back with the identical name.
+func TestUnicodeRoundTrip(t *testing.T) {
+	s := newSystem(t)
+	s.addRemote(remote1)
+	s.addShare(remote1, share11, drive.PermissionReadWrite)
+
+	s.writeFile("writing unicode file should succeed", remote1, share11, nfcName, "hello", true)
+	s.checkFileStatus(remote1, share11, nfcName)
+	s.checkFileContents(remote1, share11, nfcName)
+}
+
+// TestUnicodeNormalizationMismatch verifies that a file whose on-disk name is
+// in one Unicode normalization form can be read, statted and overwritten via
+// WebDAV using a canonically equivalent name in the other form. This is what
+// happens when a macOS WebDAV client (which sends NFD paths) accesses a share
+// with NFC filenames on disk, and vice versa.
+func TestUnicodeNormalizationMismatch(t *testing.T) {
+	tests := []struct {
+		name               string
+		onDisk, viaRequest string
+	}{
+		{"nfc-on-disk-nfd-request", nfcName, nfdName},
+		{"nfd-on-disk-nfc-request", nfdName, nfcName},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			s := newSystem(t)
+			s.addRemote(remote1)
+			s.addShare(remote1, share11, drive.PermissionReadWrite)
+
+			// Write the file directly to disk with one form, then read and
+			// stat it via WebDAV using the other form.
+			s.write(remote1, share11, tt.onDisk, "hello world")
+			if got := s.readViaWebDAV(remote1, share11, tt.viaRequest); got != "hello world" {
+				t.Errorf("read: got %q, want %q", got, "hello world")
+			}
+			s.statViaWebDAV(remote1, share11, tt.viaRequest)
+
+			// Overwriting via the other form must update the existing file
+			// rather than creating a second one.
+			s.writeFile("overwrite with equivalent name should succeed", remote1, share11, tt.viaRequest, "updated", true)
+			if got := s.read(remote1, share11, tt.onDisk); got != "updated" {
+				t.Errorf("read from disk after overwrite: got %q, want %q", got, "updated")
+			}
+			shareDir := s.remotes[remote1].shares[share11]
+			entries, err := os.ReadDir(shareDir)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if len(entries) != 1 {
+				t.Errorf("got %d files on disk, want 1: %q", len(entries), entries)
+			}
+		})
+	}
+}
+
+// TestUnicodeNormalizationMismatchInDir is like
+// TestUnicodeNormalizationMismatch, but with the mismatch in a directory
+// component of the path rather than in the filename.
+func TestUnicodeNormalizationMismatchInDir(t *testing.T) {
+	s := newSystem(t)
+	s.addRemote(remote1)
+	s.addShare(remote1, share11, drive.PermissionReadWrite)
+
+	shareDir := s.remotes[remote1].shares[share11]
+	if err := os.Mkdir(filepath.Join(shareDir, nfcDir), 0755); err != nil {
+		t.Fatal(err)
+	}
+	s.write(remote1, share11, filepath.Join(nfcDir, nfcName), "hello world")
+
+	got := s.readViaWebDAV(remote1, share11, nfdDir+"/"+nfdName)
+	if got != "hello world" {
+		t.Errorf("read: got %q, want %q", got, "hello world")
+	}
+}
+
+// TestUnicodeNewFileKeepsRequestedName verifies that creating a new file
+// keeps the exact bytes of the name that the client sent when no equivalent
+// file exists yet.
+func TestUnicodeNewFileKeepsRequestedName(t *testing.T) {
+	s := newSystem(t)
+	s.addRemote(remote1)
+	s.addShare(remote1, share11, drive.PermissionReadWrite)
+
+	s.writeFile("writing new NFD file should succeed", remote1, share11, nfdName, "hello", true)
+	if got := s.read(remote1, share11, nfdName); got != "hello" {
+		t.Errorf("read from disk: got %q, want %q", got, "hello")
+	}
+}
diff --git a/drive/local.go b/drive/local.go
index 300d142d4..8e200c3e2 100644
--- a/drive/local.go
+++ b/drive/local.go
@@ -10,6 +10,7 @@
 package drive
 
 import (
+	"iter"
 	"net"
 	"net/http"
 )
@@ -21,16 +22,46 @@ type Remote struct {
 	Available func() bool
 }
 
+// RemoteSource provides the current set of remote Taildrive nodes
+// on demand. The drive filesystem consults Generation on each request
+// and only rebuilds its internal child list when the value differs
+// from the previously cached one. This lets callers avoid the
+// per-netmap O(n) rebuild that an eager SetRemotes call would
+// require.
+//
+// All methods may be called concurrently.
+type RemoteSource interface {
+	// Domain returns the current tailnet domain under which remotes
+	// appear as sub-folders.
+	Domain() string
+
+	// Transport returns the http.RoundTripper used to reach remotes.
+	Transport() http.RoundTripper
+
+	// Remotes yields the current set of remote nodes.
+	// It is called by the drive filesystem only when Generation has
+	// changed since the last call.
+	Remotes() iter.Seq[*Remote]
+
+	// Generation returns a monotonically-increasing counter that
+	// changes whenever the values returned by Domain, Transport, or
+	// Remotes might have changed. The drive filesystem reads it on
+	// every request and skips the rebuild path entirely when it
+	// matches the previously-cached value.
+	Generation() uint64
+}
+
 // FileSystemForLocal is the Taildrive filesystem exposed to local clients. It
 // provides a unified WebDAV interface to remote Taildrive shares on other nodes.
 type FileSystemForLocal interface {
 	// HandleConn handles connections from local WebDAV clients
 	HandleConn(conn net.Conn, remoteAddr net.Addr) error
 
-	// SetRemotes sets the complete set of remotes on the given tailnet domain
-	// using a map of name -> url. If transport is specified, that transport
-	// will be used to connect to these remotes.
-	SetRemotes(domain string, remotes []*Remote, transport http.RoundTripper)
+	// SetRemoteSource sets the source from which the filesystem
+	// reads the current set of remotes. The source is consulted
+	// lazily on incoming WebDAV requests, so a stale cap or empty
+	// tailnet costs nothing per netmap update.
+	SetRemoteSource(source RemoteSource)
 
 	// Close() stops serving the WebDAV content
 	Close() error
diff --git a/envknob/logknob/logknob.go b/envknob/logknob/logknob.go
deleted file mode 100644
index bc6e8c362..000000000
--- a/envknob/logknob/logknob.go
+++ /dev/null
@@ -1,83 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-// Package logknob provides a helpful wrapper that allows enabling logging
-// based on either an envknob or other methods of enablement.
-package logknob
-
-import (
-	"sync/atomic"
-
-	"tailscale.com/envknob"
-	"tailscale.com/tailcfg"
-	"tailscale.com/types/logger"
-)
-
-// TODO(andrew-d): should we have a package-global registry of logknobs? It
-// would allow us to update from a netmap in a central location, which might be
-// reason enough to do it...
-
-// LogKnob allows configuring verbose logging, with multiple ways to enable. It
-// supports enabling logging via envknob, via atomic boolean (for use in e.g.
-// c2n log level changes), and via capabilities from a NetMap (so users can
-// enable logging via the ACL JSON).
-type LogKnob struct {
-	capName tailcfg.NodeCapability
-	cap     atomic.Bool
-	env     func() bool
-	manual  atomic.Bool
-}
-
-// NewLogKnob creates a new LogKnob, with the provided environment variable
-// name and/or NetMap capability.
-func NewLogKnob(env string, cap tailcfg.NodeCapability) *LogKnob {
-	if env == "" && cap == "" {
-		panic("must provide either an environment variable or capability")
-	}
-
-	lk := &LogKnob{
-		capName: cap,
-	}
-	if env != "" {
-		lk.env = envknob.RegisterBool(env)
-	} else {
-		lk.env = func() bool { return false }
-	}
-	return lk
-}
-
-// Set will cause logs to be printed when called with Set(true). When called
-// with Set(false), logs will not be printed due to an earlier call of
-// Set(true), but may be printed due to either the envknob and/or capability of
-// this LogKnob.
-func (lk *LogKnob) Set(v bool) {
-	lk.manual.Store(v)
-}
-
-// NetMap is an interface for the parts of netmap.NetworkMap that we care
-// about; we use this rather than a concrete type to avoid a circular
-// dependency.
-type NetMap interface {
-	HasSelfCapability(tailcfg.NodeCapability) bool
-}
-
-// UpdateFromNetMap will enable logging if the SelfNode in the provided NetMap
-// contains the capability provided for this LogKnob.
-func (lk *LogKnob) UpdateFromNetMap(nm NetMap) {
-	if lk.capName == "" {
-		return
-	}
-	lk.cap.Store(nm.HasSelfCapability(lk.capName))
-}
-
-// Do will call log with the provided format and arguments if any of the
-// configured methods for enabling logging are true.
-func (lk *LogKnob) Do(log logger.Logf, format string, args ...any) {
-	if lk.shouldLog() {
-		log(format, args...)
-	}
-}
-
-func (lk *LogKnob) shouldLog() bool {
-	return lk.manual.Load() || lk.env() || lk.cap.Load()
-}
diff --git a/envknob/logknob/logknob_test.go b/envknob/logknob/logknob_test.go
deleted file mode 100644
index 9e7ab8aef..000000000
--- a/envknob/logknob/logknob_test.go
+++ /dev/null
@@ -1,99 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-package logknob
-
-import (
-	"bytes"
-	"fmt"
-	"testing"
-
-	"tailscale.com/envknob"
-	"tailscale.com/tailcfg"
-	"tailscale.com/types/netmap"
-	"tailscale.com/util/set"
-)
-
-var testKnob = NewLogKnob(
-	"TS_TEST_LOGKNOB",
-	"https://tailscale.com/cap/testing",
-)
-
-// Static type assertion for our interface type.
-var _ NetMap = &netmap.NetworkMap{}
-
-func TestLogKnob(t *testing.T) {
-	t.Run("Default", func(t *testing.T) {
-		if testKnob.shouldLog() {
-			t.Errorf("expected default shouldLog()=false")
-		}
-		assertNoLogs(t)
-	})
-	t.Run("Manual", func(t *testing.T) {
-		t.Cleanup(func() { testKnob.Set(false) })
-
-		assertNoLogs(t)
-		testKnob.Set(true)
-		if !testKnob.shouldLog() {
-			t.Errorf("expected shouldLog()=true")
-		}
-		assertLogs(t)
-	})
-	t.Run("Env", func(t *testing.T) {
-		t.Cleanup(func() {
-			envknob.Setenv("TS_TEST_LOGKNOB", "")
-		})
-
-		assertNoLogs(t)
-		if testKnob.shouldLog() {
-			t.Errorf("expected default shouldLog()=false")
-		}
-
-		envknob.Setenv("TS_TEST_LOGKNOB", "true")
-		if !testKnob.shouldLog() {
-			t.Errorf("expected shouldLog()=true")
-		}
-		assertLogs(t)
-	})
-	t.Run("NetMap", func(t *testing.T) {
-		t.Cleanup(func() { testKnob.cap.Store(false) })
-
-		assertNoLogs(t)
-		if testKnob.shouldLog() {
-			t.Errorf("expected default shouldLog()=false")
-		}
-
-		testKnob.UpdateFromNetMap(&netmap.NetworkMap{
-			AllCaps: set.Of(tailcfg.NodeCapability("https://tailscale.com/cap/testing")),
-		})
-		if !testKnob.shouldLog() {
-			t.Errorf("expected shouldLog()=true")
-		}
-		assertLogs(t)
-	})
-}
-
-func assertLogs(t *testing.T) {
-	var buf bytes.Buffer
-	logf := func(format string, args ...any) {
-		fmt.Fprintf(&buf, format, args...)
-	}
-
-	testKnob.Do(logf, "hello %s", "world")
-	const want = "hello world"
-	if got := buf.String(); got != want {
-		t.Errorf("got %q, want %q", got, want)
-	}
-}
-
-func assertNoLogs(t *testing.T) {
-	var buf bytes.Buffer
-	logf := func(format string, args ...any) {
-		fmt.Fprintf(&buf, format, args...)
-	}
-
-	testKnob.Do(logf, "hello %s", "world")
-	if got := buf.String(); got != "" {
-		t.Errorf("expected no logs, but got: %q", got)
-	}
-}
diff --git a/feature/README.md b/feature/README.md
new file mode 100644
index 000000000..cea8407c6
--- /dev/null
+++ b/feature/README.md
@@ -0,0 +1,366 @@
+# Modular Tailscale features
+
+This directory contains Tailscale's modular feature system. The Tailscale
+client has grown large; not every user wants every feature (an IoT device on
+a few-dollar chip does not need Taildrop, WebDAV, ACME, or SSH). The
+`feature/` tree is how we make individual features conditionally linkable so
+that resource-constrained builds can omit them, and so that new code lives
+in small self-contained packages instead of being dumped into
+`LocalBackend`.
+
+## New code lives here
+
+**The preferred home for new functionality is a `feature/<name>` package.**
+If there is any plausible user who might not want your feature in their
+build (which is almost always the case), it should be modular from the
+start. A feature package should install itself into the rest of Tailscale
+via hooks, extensions, and registrations from its own `init` (see
+"Hooks and registration" below). It should not export API used by callers
+elsewhere in the tree; callers reach the feature through the hook, not by
+importing it.
+
+Think your functionality is so core that it must always be linked in?
+Imagine any plausible user who might not want it. If you cannot,
+[ask](#asking-questions) before dumping code into `ipn/ipnlocal` or
+similar.
+
+## The half-migrated reality
+
+Much of the tree is in a **half-migrated state**. A given feature may:
+
+- Have a `ts_omit_<name>` build tag declared in
+  [`featuretags/featuretags.go`](featuretags/featuretags.go), and
+- Have some of its code moved to `feature/<name>/`, but
+- Still have significant code living in `ipn/ipnlocal`, `cmd/tailscaled`,
+  or elsewhere, either:
+  - Behind a build-tag-conditional file (a whole `.go` file gated with
+    `//go:build !ts_omit_<name>`), or
+  - Guarded at runtime by an `if buildfeatures.HasFoo { ... }` block that
+    the compiler and linker dead-code-eliminate when the tag is set.
+
+When you touch one of these features, prefer to keep migrating code into
+its `feature/<name>` package rather than adding more to the old location.
+But do not feel obligated to finish the migration in one PR.
+
+## The registry: `feature/featuretags`
+
+[`featuretags/featuretags.go`](featuretags/featuretags.go) is the single
+source of truth. It declares the [`Features`](https://pkg.go.dev/tailscale.com/feature/featuretags#Features)
+map: for each feature tag (a
+lowercase string like `acme` or `taildrop`), it records the exported symbol
+name used by generated constants, a human-readable description, and any
+other features it depends on (forming a DAG).
+
+Adding a new feature starts with adding an entry there. See the top of the
+file for the tag naming convention: feature `foo` corresponds to build tag
+`ts_omit_foo` (opt-out). The one exception is `cli`, which is opt-in via
+`ts_include_cli`; see [`FeatureTag.IsOmittable`](https://pkg.go.dev/tailscale.com/feature/featuretags#FeatureTag.IsOmittable).
+
+Features can be marked [`ImplementationDetail: true`](https://pkg.go.dev/tailscale.com/feature/featuretags#FeatureMeta)
+when they are internal
+plumbing (e.g. `dbus`, `c2n`) that users would not select directly; they
+exist only so that user-visible features can depend on them.
+
+## Generated constants: `feature/buildfeatures`
+
+After editing `featuretags.go`, run:
+
+    ./tool/go generate ./feature/buildfeatures
+
+(or the meta `make generate`). That regenerates two files per feature in
+[`buildfeatures/`](buildfeatures/): `feature_<name>_enabled.go` and
+`feature_<name>_disabled.go`, gated with `//go:build !ts_omit_<name>` and
+`//go:build ts_omit_<name>` respectively. Each pair exports a single
+boolean constant, e.g. `HasACME`. Because these are Go constants, code of
+the form:
+
+    if buildfeatures.HasACME {
+        // ...
+    }
+
+is dead-code-eliminated by the compiler and linker when the feature is
+omitted. Constants can eliminate *code* but they cannot remove *imports*;
+for that you still need a build-tag-gated file.
+
+Use constants when moving code to `feature/<name>` is impractical (e.g.
+the code has to sit inside `LocalBackend`), or when a small conditional
+inside otherwise-shared logic is clearer than splitting into two files.
+Prefer separate packages when you can.
+
+## `feature/condregister`: opt-out registration
+
+[`condregister/`](condregister/) is the one central package that
+`tailscaled` (and the macOS/iOS closed-source client) empty-imports so
+that all "on by default" features get registered. Every feature that
+should ship in `tailscaled` by default has a `maybe_<name>.go` file here
+of the form:
+
+    //go:build !ts_omit_<name>
+
+    package condregister
+
+    import _ "tailscale.com/feature/<name>"
+
+That is the whole file. The build tag is the only mechanism that decides
+whether the feature is compiled in. Because `tailscaled` imports
+`condregister`, all these `maybe_*` files pull in their respective
+`feature/<name>` packages by default; adding `ts_omit_<name>` to the
+build removes the file, and with it the import, and with it the
+package's `init` and everything it transitively depends on.
+
+Some `maybe_*` files carry additional build tags (e.g.
+`//go:build !ios && !ts_omit_capture`) when a feature should be excluded
+on specific platforms.
+
+### The `feature/<name>` package should not carry `ts_omit_*` tags
+
+The `ts_omit_<name>` tag lives only on the `condregister/maybe_<name>.go`
+(and analogous `tsnet/maybe_<name>.go`) import shim, not on the
+`feature/<name>/*.go` files themselves. Keeping the feature package
+free of its own omit tag lets any program directly opt in with a blank
+import regardless of what `ts_omit_*` tags are set on the top-level
+build:
+
+    import _ "tailscale.com/feature/foo"
+
+That is how a `tsnet`-using application pulls a feature in on its own
+terms without having to reason about which `ts_omit_*` tags are in
+effect.
+
+OS-specific build tags inside `feature/<name>/` are fine, and often
+desirable: if the feature only makes sense on some platforms, gating
+its files with `//go:build linux` (or `!ios`, etc.) both keeps
+`go test ./...` passing on every GOOS and prevents a `tsnet` user on an
+unsupported platform from accidentally blank-importing a package that
+would fail to compile or run there.
+
+## `tsnet` does NOT depend on `condregister`
+
+`tsnet` is a library, not a daemon, and it links in a different (and
+generally smaller) default feature set than `tailscaled`. `tsnet` has its
+own top-level `maybe_*.go` files that decide which features it opts in
+to, and its own `depaware.txt`.
+
+**Consequence:** you cannot assume `buildfeatures.HasFoo == true` means
+feature `foo` was actually linked. In a `tsnet` build, `ts_omit_foo` may
+not be set (so `HasFoo` is `true`), yet `tsnet` may have never imported
+`feature/foo`, so its `init` never ran and no hooks were installed.
+
+`buildfeatures.HasFoo` really means "not explicitly omitted by build
+tag." Whether the feature is actually present is
+[`feature.IsRegistered("foo")`](https://pkg.go.dev/tailscale.com/feature#IsRegistered).
+The idiom is:
+
+    buildfeatures.HasFoo && feature.IsRegistered("foo")
+
+`HasFoo` lets the compiler DCE the whole expression in `ts_omit_foo`
+builds; `IsRegistered` guards against the `tsnet` case where the tag is
+unset but the package was never imported.
+
+## The `feature` API
+
+Package [`feature`](https://pkg.go.dev/tailscale.com/feature) itself
+exposes the small runtime API used by feature packages and their callers:
+
+- [`feature.Register(name)`](https://pkg.go.dev/tailscale.com/feature#Register):
+  a feature package calls this from its `init` to record that it was
+  linked in. Callers use
+  [`feature.IsRegistered(name)`](https://pkg.go.dev/tailscale.com/feature#IsRegistered)
+  to check.
+- [`feature.Hook[Func]`](https://pkg.go.dev/tailscale.com/feature#Hook):
+  a single-writer, single-reader hook. The
+  extension point declares a `var HookX feature.Hook[func(...)]`, the
+  feature package `Set`s it once from `init`, and callers use
+  `GetOk`/`GetOrNil`/`IsSet` to invoke it. `Set` panics if called twice.
+- [`feature.Hooks[Func]`](https://pkg.go.dev/tailscale.com/feature#Hooks):
+  a slice of hooks for extension points that may
+  legitimately have multiple registrants.
+- Common cross-feature hooks (auto-update, proxy, TPM, SSH host keys,
+  hardware attestation) live in [`hooks.go`](hooks.go) alongside their
+  small dispatcher functions like
+  [`feature.CanAutoUpdate()`](https://pkg.go.dev/tailscale.com/feature#CanAutoUpdate)
+  and
+  [`feature.TPMAvailable()`](https://pkg.go.dev/tailscale.com/feature#TPMAvailable).
+  Add hooks here only sparingly: every hook in this package is loaded
+  by every consumer of `feature`, so its function signature must not
+  reference types from "heavy" packages. By heavy we mean any package
+  whose presence in this signature would unnecessarily grow
+  [`cmd/tailscaled/depaware-min.txt`](../cmd/tailscaled/depaware-min.txt):
+  packages with a large API/dependency footprint (e.g. `net/http`,
+  `crypto/tls`, `golang.org/x/crypto/ssh`, `k8s.io/...`), or packages
+  that trigger expensive runtime features like `reflect`-based
+  registration. The minimal build's depaware file is sacred and must
+  not grow without good reason. Prefer primitives, small `types/...`
+  packages, or interfaces. If your hook needs a wide type, keep the
+  hook (and its dispatcher) in the caller's package instead of
+  promoting it here.
+
+[`ipnext.RegisterExtension`](https://pkg.go.dev/tailscale.com/ipn/ipnext#RegisterExtension)
+(in `ipn/ipnext`) is the corresponding
+mechanism for features that need to hook into `LocalBackend`; see the
+next section.
+
+## IPN extensions: `ipn/ipnext`
+
+For features that need to attach state and behavior to `LocalBackend`,
+the plain `feature.Hook` mechanism is not enough; you also need
+per-`LocalBackend` state and a well-defined lifecycle. That is what
+[`ipn/ipnext`](https://pkg.go.dev/tailscale.com/ipn/ipnext) provides.
+
+Per-`LocalBackend` state matters because a single process can have more
+than one `LocalBackend` alive at once: a `tsnet` program can host many
+`tsnet.Server` nodes concurrently, each with its own `LocalBackend`.
+Package-global variables in a feature package would be shared across all
+of them, which should be avoided unless it is otherwise infeasible. An
+[`ipnext.Extension`](https://pkg.go.dev/tailscale.com/ipn/ipnext#Extension)
+is instantiated once *per* `LocalBackend`, so each node gets its own
+copy of the extension's state.
+
+(A related, not-yet-realized goal is letting different `tsnet` nodes in
+the same process opt in to different sets of hooks. Today the hook
+registration is still process-global (the `init` runs once and the hook
+is on for every `LocalBackend`), but the extension design leaves room to
+make this per-node in the future. Don't rely on the process-global
+behavior; keep state on the extension instance, not in globals.)
+
+An `ipnext.Extension` is created once per `LocalBackend`. From `init`, a
+feature package registers a factory:
+
+    func init() {
+        feature.Register("taildrop")
+        ipnext.RegisterExtension("taildrop", newExtension)
+    }
+
+When `LocalBackend.Start` runs, it instantiates each registered
+extension and calls its
+`Init(host `[`ipnext.Host`](https://pkg.go.dev/tailscale.com/ipn/ipnext#Host)`) error`
+method. `Init` is where the extension wires up its per-backend hooks
+against `host.Hooks()`:
+
+    func (e *extension) Init(h ipnext.Host) error {
+        h.Hooks().ProfileStateChange.Add(e.onChangeProfile)
+        h.Hooks().OnSelfChange.Add(e.onSelfChange)
+        h.Hooks().MutateNotifyLocked.Add(e.setNotifyFilesWaiting)
+        h.Hooks().SetPeerStatus.Add(e.setPeerStatus)
+        h.Hooks().BackendStateChange.Add(e.onBackendStateChange)
+        return nil
+    }
+
+[`ipnext.Hooks`](https://pkg.go.dev/tailscale.com/ipn/ipnext#Hooks)
+is a struct of `feature.Hook`/`feature.Hooks` fields
+covering `LocalBackend`'s extension points: backend and profile state
+changes, netmap toggles, self-node changes, notify mutation, peer
+status, packet-filter hooks, audit logging, and more. Read the type in
+`ipn/ipnext/ipnext.go` for the current list; new hooks are added there
+as needed.
+
+Extension hooks run synchronously with the triggering `LocalBackend`
+operation and can influence its outcome. Because multiple extensions may
+touch the same shared state (prefs, active profile, exit node, etc.),
+new hooks should be designed with a clear conflict-resolution story
+rather than assuming a single writer.
+
+To get back to your extension from a `LocalBackend` inside a LocalAPI or
+C2N handler, use
+[`ipnlocal.GetExt[*yourExtType](b)`](https://pkg.go.dev/tailscale.com/ipn/ipnlocal#GetExt).
+
+Canonical examples:
+
+- [`feature/taildrop/ext.go`](taildrop/ext.go): full extension with
+  per-backend state.
+- [`feature/acme/acme.go`](acme/acme.go): extension that also `Set`s a
+  handful of `ipnlocal.Hook*` singletons.
+
+The `ipnext` mechanism is a work in progress and not every part of
+`LocalBackend` has been converted to hooks yet. If you need a new
+extension point, [ask](#asking-questions).
+
+## Tests: `featuretags` and `depaware` / `depchecker`
+
+Tests come in three flavors:
+
+1. **`feature/featuretags` self-tests** ([`featuretags_test.go`](featuretags/featuretags_test.go))
+   validate the registry itself: that every declared dependency exists,
+   that there are no cycles, that `Requires`/`RequiredBy` return the
+   expected sets, and that every `ts_omit_*` string that appears
+   anywhere in the tree (via `git grep`) is declared in the map.
+
+2. **`depaware`** ([github.com/tailscale/depaware](https://github.com/tailscale/depaware))
+   snapshots the full set of Go packages linked into each binary into
+   a checked-in `depaware.txt` file. Its job is right there in the
+   name: to force us to be *aware of our deps*. Every change to the
+   dependency graph shows up as a diff to `depaware.txt` in the same
+   PR that introduced it, so reviewers can see, prominently, exactly
+   what got pulled in or dropped. We use this to have an auditable
+   history of the dependency footprint of key programs and libraries.
+   We track several flavors:
+   - full `tailscaled` on all GOOSes
+   - full `tailscale` CLI on all GOOSes
+   - `cmd/derper`
+   - minimal `tailscaled`+CLI (`depaware-min.txt`, `depaware-minbox.txt`)
+   - `tsnet` (has its own `depaware.txt`)
+   - `k8s-operator`, which uses `tsnet`
+
+   When reviewing a PR, look at the depaware diff to see what got pulled
+   in or dropped, and make sure the changes make sense.
+
+3. **[`deptest.DepChecker`](https://pkg.go.dev/tailscale.com/tstest/deptest#DepChecker)**
+   lets you *lock down* omissions once you've
+   achieved them. Rather than hoping nobody accidentally adds a
+   `taildrop` import back into a `ts_omit_taildrop` build, you write:
+
+        func TestOmitACME(t *testing.T) {
+            deptest.DepChecker{
+                GOOS:   "linux",
+                GOARCH: "amd64",
+                Tags:   "ts_omit_acme,ts_include_cli",
+                OnDep: func(dep string) {
+                    if strings.Contains(dep, "/acme") {
+                        t.Errorf("unexpected dep with ts_omit_acme: %q", dep)
+                    }
+                },
+            }.Check(t)
+        }
+
+   `cmd/tailscaled/deps_test.go` has many examples; add new ones there
+   or wherever they fit. `tsnet` has its own `TestDeps` in
+   [`tsnet_test.go`](../tsnet/tsnet_test.go) with a `BadDeps` map
+   asserting that things like `feature/remoteconfig`,
+   `feature/syspolicy`, and `x/crypto/ssh` never sneak into `tsnet`.
+
+## Tooling
+
+- `cmd/featuretags` constructs valid sets of Go omit build tags. Start
+  from a minimal build and add features with `--min --add=...`, or start
+  from a full build and remove with `--remove=...`; either way it
+  respects the declared dependency DAG.
+- `build_dist.sh` uses `cmd/featuretags` under the hood, so you do not
+  need to hand-maintain its build-tag lists as new features are added.
+
+## Summary of what to do for a new feature
+
+1. Add an entry to `Features` in `feature/featuretags/featuretags.go`,
+   including any `Deps`.
+2. Run `./tool/go generate ./feature/buildfeatures` (or `make generate`).
+3. Create `feature/<name>/` with the code, and register hooks and any
+   `ipnext.Extension` from its `init`. Call `feature.Register("<name>")`
+   from `init` too.
+4. If the feature should be on by default in `tailscaled`, add
+   `feature/condregister/maybe_<name>.go` with `//go:build !ts_omit_<name>`
+   and a blank import of `tailscale.com/feature/<name>`.
+5. If `tsnet` should also link it, add an equivalent `maybe_<name>.go`
+   under `tsnet/`. Otherwise remember `buildfeatures.HasFoo` alone is not
+   enough; pair it with `feature.IsRegistered("foo")`.
+6. Add a `deptest.DepChecker` test to lock down what does *not* get
+   linked when the feature is omitted.
+7. Regenerate depaware and review the diff.
+
+## Asking questions
+
+If something in this document is unclear, if you are not sure whether
+your work should be modular, or if you need a new extension point:
+
+- **Tailscale employees:** ask in the `#client` Slack channel.
+- **Open source contributors:** file a public GitHub issue with your
+  proposal or question at
+  [github.com/tailscale/tailscale/issues](https://github.com/tailscale/tailscale/issues).
diff --git a/feature/acme/acme.go b/feature/acme/acme.go
new file mode 100644
index 000000000..dd9fe0209
--- /dev/null
+++ b/feature/acme/acme.go
@@ -0,0 +1,301 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package acme registers the ACME/TLS-cert feature and implements its
+// associated [ipnext.Extension]. The extension owns the per-LocalBackend
+// ACME serialization mutex, in-flight cert tracking, the refresh loop's
+// cancel func, and the test-only cert override; together with the cert
+// acquisition logic in this package, it is everything tailscaled needs
+// to obtain and renew TLS certificates via ACME.
+//
+// In builds without ACME support (js or ts_omit_acme), this package is
+// not linked in; [ipn/ipnlocal] then exposes only stub wrappers that
+// return errNoCerts or no-op.
+package acme
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"net/http"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"tailscale.com/feature"
+	"tailscale.com/health"
+	"tailscale.com/ipn"
+	"tailscale.com/ipn/ipnext"
+	"tailscale.com/ipn/ipnlocal"
+	"tailscale.com/syncs"
+	xacme "tailscale.com/tempfork/acme"
+	"tailscale.com/tsconst"
+	"tailscale.com/types/logger"
+	"tailscale.com/util/clientmetric"
+	"tailscale.com/util/mak"
+	"tailscale.com/util/set"
+)
+
+// featureName is the name of the feature implemented by this package.
+const featureName = "acme"
+
+func init() {
+	feature.Register(featureName)
+	ipnext.RegisterExtension(featureName, newExtension)
+
+	ipnlocal.HookGetCertPEM.Set(getCertPEMHook)
+	ipnlocal.HookGetACMETLSALPNCert.Set(getACMETLSALPNCertHook)
+	ipnlocal.HookGetACMETLSALPNProto.Set(getACMETLSALPNProtoHook)
+	ipnlocal.HookUpdateCertRefreshLoop.Set(updateCertRefreshLoopHook)
+	ipnlocal.HookShutdownCertRefreshLoop.Set(shutdownCertRefreshLoopHook)
+	ipnlocal.HookConfigureCertsForTest.Set(configureCertsForTestHook)
+	ipnlocal.HookHandleC2NTLSCertStatus.Set(handleC2NTLSCertStatus)
+}
+
+// errNoExt is returned when a hook is invoked on a [*ipnlocal.LocalBackend]
+// that has no [extension] registered (shouldn't happen in practice, but
+// guards against misuse from tests that swap extension registrations).
+var errNoExt = errors.New("acme extension not registered on this LocalBackend")
+
+// extension is the ACME/cert [ipnext.Extension]. It owns the
+// per-[*ipnlocal.LocalBackend] state previously held in package-level
+// globals and in [*ipnlocal.LocalBackend] fields.
+//
+// All methods that take a [*ipnlocal.LocalBackend] argument operate on
+// the backend the extension was instantiated for; the argument is
+// passed through from the hook in [ipn/ipnlocal] rather than stored on
+// the extension, which keeps the extension's lifecycle independent of
+// any specific backend reference.
+type extension struct {
+	logf logger.Logf
+
+	// domainsMu guards domainLocks.
+	domainsMu syncs.Mutex
+	// domainLocks holds a per-domain mutex serialising ACME operations
+	// for that domain. Different domains run concurrently; the same
+	// domain still queues so the first goroutine fills the on-disk
+	// cache and the rest reuse it. Entries are never removed; a node
+	// only ever has a handful of domains so the map stays small.
+	domainLocks map[string]*syncs.Mutex
+
+	// accountMu serialises ACME account setup (key generation, LE
+	// registration) so two first-time issuances don't create separate
+	// accounts.
+	accountMu syncs.Mutex
+
+	// renewMu guards renewCertAt.
+	// Lock order: per-domain lock before renewMu.
+	renewMu     syncs.Mutex
+	renewCertAt map[string]time.Time // lazily initialized under renewMu
+
+	// pendingACMETLSALPNCerts maps SNI names to short-lived ACME
+	// tls-alpn-01 challenge certificates while an ACME order is
+	// waiting for validation. Entries are deleted by the cleanup
+	// function returned from storeACMETLSALPNCert after the challenge
+	// validation path finishes, whether it succeeds or fails.
+	pendingACMETLSALPNCerts syncs.Map[string, *tls.Certificate]
+
+	// pendingCertDomains tracks the set of domains for which an ACME
+	// issuance is currently in flight with no usable cached cert. It
+	// backs the tls-cert-pending health Warnable.
+	// Guarded by pendingCertDomainsMu.
+	pendingCertDomainsMu sync.Mutex
+	pendingCertDomains   set.Set[string]
+
+	// wg tracks all background goroutines spawned by this extension
+	// (async cert renewals, the cert refresh loop and its per-domain
+	// workers). [extension.Shutdown] waits on it.
+	wg sync.WaitGroup
+
+	// goroutinesStarted counts goroutines started via [extension.Go].
+	// Tests use it to assert whether an operation kicked off async work.
+	goroutinesStarted atomic.Int64
+
+	// mu guards the test/lifecycle fields below.
+	mu sync.Mutex
+
+	// getCertForTest is used to retrieve TLS certificates in tests.
+	// See [LocalBackend.ConfigureCertsForTest].
+	getCertForTest func(hostname string) (*ipnlocal.TLSCertKeyPair, error)
+
+	// certRefreshCancel cancels the background TLS cert refresh loop
+	// that periodically pokes [LocalBackend.GetCertPEM] so renewals
+	// happen on idle nodes. Non-nil while the loop is running.
+	certRefreshCancel context.CancelFunc
+
+	// httpClient, if non-nil, is used for all ACME HTTP requests instead of
+	// http.DefaultClient. Set via [SetHTTPClient] before first cert use.
+	httpClient *http.Client
+}
+
+// SetHTTPClient sets a custom HTTP client for ACME certificate operations on
+// b. On js/wasm this can route requests through the Tailscale network stack to
+// bypass browser CORS if Let's Encrypt endpoints fail preflight. A nil value
+// (the default) uses http.DefaultClient.
+func SetHTTPClient(b *ipnlocal.LocalBackend, c *http.Client) error {
+	e, err := extFor(b)
+	if err != nil {
+		return err
+	}
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	e.httpClient = c
+	return nil
+}
+
+// lockDomain returns the mutex for domain, creating it on first use.
+func (e *extension) lockDomain(domain string) *syncs.Mutex {
+	e.domainsMu.Lock()
+	defer e.domainsMu.Unlock()
+	if m, ok := e.domainLocks[domain]; ok {
+		return m
+	}
+	m := new(syncs.Mutex)
+	mak.Set(&e.domainLocks, domain, m)
+	return m
+}
+
+// Go runs f in a new goroutine tracked by e.wg. [extension.Shutdown]
+// waits for all such goroutines to finish.
+func (e *extension) Go(f func()) {
+	e.wg.Add(1)
+	e.goroutinesStarted.Add(1)
+	go func() {
+		defer e.wg.Done()
+		f()
+	}()
+}
+
+// newExtension is the [ipnext.NewExtensionFn] registered for this
+// feature. It is called once per [*ipnlocal.LocalBackend].
+func newExtension(logf logger.Logf, _ ipnext.SafeBackend) (ipnext.Extension, error) {
+	return &extension{
+		logf: logger.WithPrefix(logf, featureName+": "),
+	}, nil
+}
+
+// Name implements [ipnext.Extension].
+func (e *extension) Name() string { return featureName }
+
+// Init implements [ipnext.Extension].
+func (e *extension) Init(ipnext.Host) error { return nil }
+
+// Shutdown implements [ipnext.Extension]. It cancels the cert refresh
+// loop if it's running, then waits for all in-flight goroutines
+// (async renewals, refresh loop workers) to finish.
+func (e *extension) Shutdown() error {
+	e.mu.Lock()
+	if e.certRefreshCancel != nil {
+		e.certRefreshCancel()
+		e.certRefreshCancel = nil
+	}
+	e.mu.Unlock()
+	e.wg.Wait()
+	return nil
+}
+
+// extFor returns the [*extension] for b, or an error if no acme
+// extension is registered on b.
+func extFor(b *ipnlocal.LocalBackend) (*extension, error) {
+	e, ok := ipnlocal.GetExt[*extension](b)
+	if !ok {
+		return nil, errNoExt
+	}
+	return e, nil
+}
+
+// Hook adapter funcs that thread (b *ipnlocal.LocalBackend) into the
+// extension's methods. These are what get installed in
+// [ipnlocal.Hook*] at init time.
+
+func getCertPEMHook(ctx context.Context, b *ipnlocal.LocalBackend, domain string, minValidity time.Duration) (*ipnlocal.TLSCertKeyPair, error) {
+	e, err := extFor(b)
+	if err != nil {
+		return nil, err
+	}
+	pair, err := e.getCertPEMWithValidity(ctx, b, domain, minValidity)
+	if err != nil {
+		if ae, ok := errors.AsType[*xacme.Error](err); ok {
+			if d, ok := xacme.RateLimit(ae); ok {
+				return nil, certRateLimitedError{retryAfter: d, underlying: err}
+			}
+		}
+		return nil, err
+	}
+	return pair, nil
+}
+
+func getACMETLSALPNCertHook(b *ipnlocal.LocalBackend, hi *tls.ClientHelloInfo) (*tls.Certificate, bool) {
+	e, err := extFor(b)
+	if err != nil {
+		return nil, false
+	}
+	return e.getACMETLSALPNCert(hi)
+}
+
+func getACMETLSALPNProtoHook(b *ipnlocal.LocalBackend, hi *tls.ClientHelloInfo) (string, bool) {
+	e, err := extFor(b)
+	if err != nil {
+		return "", false
+	}
+	return e.getACMETLSALPNProto(hi)
+}
+
+func updateCertRefreshLoopHook(b *ipnlocal.LocalBackend, state ipn.State, sc ipn.ServeConfigView) {
+	e, err := extFor(b)
+	if err != nil {
+		return
+	}
+	e.updateCertRefreshLoop(b, state, sc)
+}
+
+func shutdownCertRefreshLoopHook(b *ipnlocal.LocalBackend) {
+	e, err := extFor(b)
+	if err != nil {
+		return
+	}
+	e.Shutdown()
+}
+
+func configureCertsForTestHook(b *ipnlocal.LocalBackend, getCert func(string) (*ipnlocal.TLSCertKeyPair, error)) {
+	e, err := extFor(b)
+	if err != nil {
+		panic(err)
+	}
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	e.getCertForTest = getCert
+}
+
+func handleC2NTLSCertStatus(b *ipnlocal.LocalBackend, w http.ResponseWriter, r *http.Request) {
+	e, err := extFor(b)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	e.handleC2NTLSCertStatus(b, w, r)
+}
+
+// ACME / cert metrics. These are package-level (process-wide) because
+// they aggregate across all [*extension]s in the process.
+var (
+	metricACMEDNS01Start       = clientmetric.NewCounter("cert_acme_dns01_start")
+	metricACMEDNS01Success     = clientmetric.NewCounter("cert_acme_dns01_success")
+	metricACMEDNS01Failure     = clientmetric.NewCounter("cert_acme_dns01_failure")
+	metricACMETLSALPN01Start   = clientmetric.NewCounter("cert_acme_tls_alpn01_start")
+	metricACMETLSALPN01Success = clientmetric.NewCounter("cert_acme_tls_alpn01_success")
+	metricACMETLSALPN01Failure = clientmetric.NewCounter("cert_acme_tls_alpn01_failure")
+)
+
+// certPendingWarnable fires while ACME is fetching a TLS certificate
+// for which no usable cached copy exists (initial issuance or after
+// the cached cert has expired). Async renewal of a still-valid cert
+// does not fire it.
+var certPendingWarnable = health.Register(&health.Warnable{
+	Code:     tsconst.HealthWarnableTLSCertPending,
+	Title:    "Fetching TLS certificate",
+	Severity: health.SeverityLow,
+	Text: func(args health.Args) string {
+		return "Fetching TLS certificate via ACME for: " + args[health.ArgDomains]
+	},
+})
diff --git a/feature/acme/c2n.go b/feature/acme/c2n.go
new file mode 100644
index 000000000..a1b921ead
--- /dev/null
+++ b/feature/acme/c2n.go
@@ -0,0 +1,75 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package acme
+
+import (
+	"crypto/x509"
+	"encoding/json"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"net/http"
+	"time"
+
+	"tailscale.com/ipn"
+	"tailscale.com/ipn/ipnlocal"
+	"tailscale.com/tailcfg"
+)
+
+// handleC2NTLSCertStatus returns info about the last TLS certificate
+// issued for the provided domain. It is the implementation of
+// [ipnlocal.HookHandleC2NTLSCertStatus]; control calls it to clean up
+// DNS TXT records when they're no longer needed by LetsEncrypt.
+//
+// It does not kick off a cert fetch or async refresh. It only reports
+// anything that's already sitting on disk, and only reports metadata
+// about the public cert (stuff that'd be the in CT logs anyway).
+func (e *extension) handleC2NTLSCertStatus(b *ipnlocal.LocalBackend, w http.ResponseWriter, r *http.Request) {
+	cs, err := e.getCertStore(b)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	domain := r.FormValue("domain")
+	if domain == "" {
+		http.Error(w, "no 'domain'", http.StatusBadRequest)
+		return
+	}
+
+	ret := &tailcfg.C2NTLSCertInfo{}
+	pair, err := getCertPEMCached(cs, domain, b.Clock().Now())
+	ret.Valid = err == nil
+	if err != nil {
+		ret.Error = err.Error()
+		if errors.Is(err, errCertExpired) {
+			ret.Expired = true
+		} else if errors.Is(err, ipn.ErrStateNotExist) {
+			ret.Missing = true
+			ret.Error = "no certificate"
+		}
+	} else {
+		block, _ := pem.Decode(pair.CertPEM)
+		if block == nil {
+			ret.Error = "invalid PEM"
+			ret.Valid = false
+		} else {
+			cert, err := x509.ParseCertificate(block.Bytes)
+			if err != nil {
+				ret.Error = fmt.Sprintf("invalid certificate: %v", err)
+				ret.Valid = false
+			} else {
+				ret.NotBefore = cert.NotBefore.UTC().Format(time.RFC3339)
+				ret.NotAfter = cert.NotAfter.UTC().Format(time.RFC3339)
+			}
+		}
+	}
+
+	writeJSON(w, ret)
+}
+
+func writeJSON(w http.ResponseWriter, v any) {
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(v)
+}
diff --git a/feature/acme/c2n_test.go b/feature/acme/c2n_test.go
new file mode 100644
index 000000000..d6eb4f898
--- /dev/null
+++ b/feature/acme/c2n_test.go
@@ -0,0 +1,135 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !ios && !android && !js
+
+package acme
+
+import (
+	"cmp"
+	"crypto/x509"
+	"encoding/json"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"path/filepath"
+	"reflect"
+	"testing"
+	"time"
+
+	"tailscale.com/ipn/ipnlocal/ipnlocaltest"
+	"tailscale.com/tailcfg"
+	"tailscale.com/tstest"
+	"tailscale.com/types/logger"
+	"tailscale.com/util/must"
+)
+
+func TestHandleC2NTLSCertStatus(t *testing.T) {
+	b := ipnlocaltest.NewBackend(t)
+	b.SetVarRoot(t.TempDir())
+	e := extOf(t, b)
+
+	certDirPath, err := certDir(b)
+	if err != nil {
+		t.Fatalf("certDir error: %v", err)
+	}
+	if _, err := e.getCertStore(b); err != nil {
+		t.Fatalf("getCertStore error: %v", err)
+	}
+
+	testRoot, err := certTestFS.ReadFile("testdata/rootCA.pem")
+	if err != nil {
+		t.Fatal(err)
+	}
+	roots := x509.NewCertPool()
+	if !roots.AppendCertsFromPEM(testRoot) {
+		t.Fatal("Unable to add test CA to the cert pool")
+	}
+	testX509Roots = roots
+	defer func() { testX509Roots = nil }()
+
+	tests := []struct {
+		name       string
+		domain     string
+		copyFile   bool   // copy testdata/example.com.pem to the certDir
+		wantStatus int    // 0 means 200
+		wantError  string // wanted non-JSON non-200 error
+		now        time.Time
+		want       *tailcfg.C2NTLSCertInfo
+	}{
+		{
+			name:       "no-domain",
+			wantStatus: 400,
+			wantError:  "no 'domain'\n",
+		},
+		{
+			name:   "missing",
+			domain: "example.com",
+			want: &tailcfg.C2NTLSCertInfo{
+				Error:   "no certificate",
+				Missing: true,
+			},
+		},
+		{
+			name:     "valid",
+			domain:   "example.com",
+			now:      time.Date(2023, time.February, 20, 0, 0, 0, 0, time.UTC),
+			copyFile: true,
+			want: &tailcfg.C2NTLSCertInfo{
+				Valid:     true,
+				NotBefore: "2023-02-07T20:34:18Z",
+				NotAfter:  "2025-05-07T19:34:18Z",
+			},
+		},
+		{
+			name:     "expired",
+			domain:   "example.com",
+			now:      time.Date(2030, time.February, 20, 0, 0, 0, 0, time.UTC),
+			copyFile: true,
+			want: &tailcfg.C2NTLSCertInfo{
+				Error:   "cert expired",
+				Expired: true,
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			os.RemoveAll(certDirPath) // reset per test
+			if tt.copyFile {
+				os.MkdirAll(certDirPath, 0755)
+				if err := os.WriteFile(filepath.Join(certDirPath, "example.com.crt"),
+					must.Get(certTestFS.ReadFile("testdata/example.com.pem")), 0644); err != nil {
+					t.Fatal(err)
+				}
+				if err := os.WriteFile(filepath.Join(certDirPath, "example.com.key"),
+					must.Get(certTestFS.ReadFile("testdata/example.com-key.pem")), 0644); err != nil {
+					t.Fatal(err)
+				}
+			}
+			b.ForTest().SetClock(tstest.NewClock(tstest.ClockOpts{
+				Start: tt.now,
+			}))
+
+			rec := httptest.NewRecorder()
+			e.handleC2NTLSCertStatus(b, rec, httptest.NewRequest("GET", "/tls-cert-status?domain="+url.QueryEscape(tt.domain), nil))
+			res := rec.Result()
+			wantStatus := cmp.Or(tt.wantStatus, 200)
+			if res.StatusCode != wantStatus {
+				t.Fatalf("status code = %v; want %v. Body: %s", res.Status, wantStatus, rec.Body.Bytes())
+			}
+			if wantStatus == 200 {
+				var got tailcfg.C2NTLSCertInfo
+				if err := json.Unmarshal(rec.Body.Bytes(), &got); err != nil {
+					t.Fatalf("bad JSON: %v", err)
+				}
+				if !reflect.DeepEqual(&got, tt.want) {
+					t.Errorf("got %v; want %v", logger.AsJSON(got), logger.AsJSON(tt.want))
+				}
+			} else if tt.wantError != "" {
+				if got := rec.Body.String(); got != tt.wantError {
+					t.Errorf("body = %q; want %q", got, tt.wantError)
+				}
+			}
+		})
+	}
+}
diff --git a/feature/acme/cert.go b/feature/acme/cert.go
new file mode 100644
index 000000000..0d9b7408e
--- /dev/null
+++ b/feature/acme/cert.go
@@ -0,0 +1,737 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package acme
+
+import (
+	"bytes"
+	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/json"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"log"
+	randv2 "math/rand/v2"
+	"net"
+	"slices"
+	"strings"
+	"time"
+
+	"tailscale.com/envknob"
+	"tailscale.com/health"
+	"tailscale.com/ipn"
+	"tailscale.com/ipn/ipnlocal"
+	"tailscale.com/tailcfg"
+	xacme "tailscale.com/tempfork/acme"
+	"tailscale.com/types/logger"
+	"tailscale.com/util/mak"
+	"tailscale.com/util/set"
+	"tailscale.com/util/slicesx"
+	"tailscale.com/util/testenv"
+)
+
+type acmeChallengeType string
+
+const (
+	acmeChallengeDNS01     acmeChallengeType = "dns-01"
+	acmeChallengeTLSALPN01 acmeChallengeType = "tls-alpn-01"
+)
+
+var acmeDebug = envknob.RegisterBool("TS_DEBUG_ACME")
+
+// getACMETLSALPNCert returns the short-lived ACME challenge certificate
+// for hi.ServerName. The ok result reports whether hi offered acme-tls/1
+// and an ACME order is actively waiting on that challenge for
+// hi.ServerName.
+func (e *extension) getACMETLSALPNCert(hi *tls.ClientHelloInfo) (cert *tls.Certificate, ok bool) {
+	if hi == nil || hi.ServerName == "" || !slices.Contains(hi.SupportedProtos, xacme.ALPNProto) {
+		return nil, false
+	}
+	cert, ok = e.pendingACMETLSALPNCerts.Load(hi.ServerName)
+	return cert, ok
+}
+
+// getACMETLSALPNProto reports whether serveTLSConfig should advertise
+// an ACME ALPN protocol for this ClientHello.
+func (e *extension) getACMETLSALPNProto(hi *tls.ClientHelloInfo) (proto string, ok bool) {
+	if _, ok := e.getACMETLSALPNCert(hi); !ok {
+		return "", false
+	}
+	return xacme.ALPNProto, true
+}
+
+// storeACMETLSALPNCert publishes cert to Serve TLS handshakes for domain
+// until the returned cleanup function is called.
+func (e *extension) storeACMETLSALPNCert(domain string, cert *tls.Certificate) (cleanup func()) {
+	e.pendingACMETLSALPNCerts.Store(domain, cert)
+	return func() {
+		e.pendingACMETLSALPNCerts.Delete(domain)
+	}
+}
+
+// getCertPEMWithValidity gets the TLSCertKeyPair for domain, either
+// from cache or via ACME. ACME is used for new domain certs, existing
+// expired certs, or existing certs that should be renewed sooner than
+// minValidity.
+func (e *extension) getCertPEMWithValidity(ctx context.Context, b *ipnlocal.LocalBackend, domain string, minValidity time.Duration) (*ipnlocal.TLSCertKeyPair, error) {
+	e.mu.Lock()
+	getCertForTest := e.getCertForTest
+	e.mu.Unlock()
+
+	if getCertForTest != nil {
+		testenv.AssertInTest()
+		return getCertForTest(domain)
+	}
+
+	// Trim a trailing dot from the domain (e.g. from an SNI ServerName of
+	// "host.ts.net.") before lookup. Per RFC 6066 §3 the SNI HostName has
+	// no trailing dot, but some clients send a fully-qualified name with
+	// one, and cert store names have no trailing dot. See
+	// https://github.com/tailscale/tailscale/issues/10233.
+	domain = strings.TrimSuffix(domain, ".")
+
+	if !validLookingCertDomain(domain) {
+		return nil, errors.New("invalid domain")
+	}
+
+	certDomain, err := e.resolveCertDomain(b, domain)
+	if err != nil {
+		return nil, err
+	}
+	logf := logger.WithPrefix(b.Logger(), fmt.Sprintf("cert(%q): ", domain))
+	now := b.Clock().Now()
+	traceACME := func(v any) {
+		if !acmeDebug() {
+			return
+		}
+		j, _ := json.MarshalIndent(v, "", "\t")
+		log.Printf("acme %T: %s", v, j)
+	}
+
+	cs, err := e.getCertStore(b)
+	if err != nil {
+		return nil, err
+	}
+
+	pair, cacheErr := getCertPEMCached(cs, certDomain, now)
+	if cacheErr == nil {
+		if envknob.IsCertShareReadOnlyMode() {
+			return pair, nil
+		}
+		// If we got here, we have a valid unexpired cert.
+		// Check whether we should start an async renewal.
+		shouldRenew, err := e.shouldStartDomainRenewal(b, cs, certDomain, now, pair, minValidity)
+		if err != nil {
+			logf("error checking for certificate renewal: %v", err)
+			// Renewal check failed, but the current cert is valid and not
+			// expired, so it's safe to return.
+			return pair, nil
+		}
+		if !shouldRenew {
+			return pair, nil
+		}
+		if minValidity == 0 {
+			logf("starting async renewal")
+			// Start renewal in the background, return current valid cert.
+			e.Go(func() {
+				if _, err := getCertPEM(context.Background(), e, b, cs, logf, traceACME, certDomain, now, minValidity); err != nil {
+					logf("async renewal failed: getCertPem: %v", err)
+				}
+			})
+			return pair, nil
+		}
+		// If the caller requested a specific validity duration, fall through
+		// to synchronous renewal to fulfill that.
+		logf("starting sync renewal")
+	}
+
+	if envknob.IsCertShareReadOnlyMode() {
+		return nil, fmt.Errorf("retrieving cached TLS certificate failed and cert store is configured in read-only mode, not attempting to issue a new certificate: %w", cacheErr)
+	}
+
+	pair, err = getCertPEM(ctx, e, b, cs, logf, traceACME, certDomain, now, minValidity)
+	if err != nil {
+		logf("getCertPEM: %v", err)
+		return nil, err
+	}
+	return pair, nil
+}
+
+// shouldStartDomainRenewal reports whether the domain's cert should be
+// renewed based on the current time, the cert's expiry, and the ARI
+// check.
+func (e *extension) shouldStartDomainRenewal(b *ipnlocal.LocalBackend, cs certStore, domain string, now time.Time, pair *ipnlocal.TLSCertKeyPair, minValidity time.Duration) (bool, error) {
+	if minValidity != 0 {
+		cert, err := parseCertificate(pair)
+		if err != nil {
+			return false, fmt.Errorf("parsing certificate: %w", err)
+		}
+		return cert.NotAfter.Sub(now) < minValidity, nil
+	}
+	e.renewMu.Lock()
+	defer e.renewMu.Unlock()
+	if renewAt, ok := e.renewCertAt[domain]; ok {
+		return now.After(renewAt), nil
+	}
+
+	renewTime, err := e.domainRenewalTimeByARI(b, cs, pair)
+	if err != nil {
+		// Log any ARI failure and fall back to checking for renewal by expiry.
+		b.Logger()("acme: ARI check failed: %v; falling back to expiry-based check", err)
+		renewTime, err = domainRenewalTimeByExpiry(pair)
+		if err != nil {
+			return false, err
+		}
+	}
+
+	mak.Set(&e.renewCertAt, domain, renewTime)
+	return now.After(renewTime), nil
+}
+
+func (e *extension) domainRenewed(domain string) {
+	e.renewMu.Lock()
+	defer e.renewMu.Unlock()
+	delete(e.renewCertAt, domain)
+}
+
+func domainRenewalTimeByExpiry(pair *ipnlocal.TLSCertKeyPair) (time.Time, error) {
+	cert, err := parseCertificate(pair)
+	if err != nil {
+		return time.Time{}, fmt.Errorf("parsing certificate: %w", err)
+	}
+
+	certLifetime := cert.NotAfter.Sub(cert.NotBefore)
+	if certLifetime < 0 {
+		return time.Time{}, fmt.Errorf("negative certificate lifetime %v", certLifetime)
+	}
+
+	// Per https://github.com/tailscale/tailscale/issues/8204, check
+	// whether we're more than 2/3 of the way through the certificate's
+	// lifetime, which is the officially-recommended best practice by Let's
+	// Encrypt.
+	renewalDuration := certLifetime * 2 / 3
+	renewAt := cert.NotBefore.Add(renewalDuration)
+	return renewAt, nil
+}
+
+func (e *extension) shouldUseACMETLSALPN01(b *ipnlocal.LocalBackend, domain string, previous *ipnlocal.TLSCertKeyPair, logf logger.Logf) bool {
+	if isWildcardDomain(domain) {
+		logf("acme: using dns-01: tls-alpn-01 does not support wildcard certificates")
+		return false
+	}
+	if !b.HasFunnelForHostPort(domain, 443) {
+		logf("acme: using dns-01: Funnel is not enabled for %s:443", domain)
+		return false
+	}
+	if e.isBYOFunnelDomain(b, domain) {
+		// BYO Funnel domain: dns-01 is not a viable path because control
+		// does not own the user's DNS zone. Use tls-alpn-01 even on
+		// first issuance.
+		logf("acme: using tls-alpn-01 (BYO Funnel domain)")
+		return true
+	}
+	if previous == nil {
+		logf("acme: using dns-01: no cached certificate for Funnel renewal")
+		return false
+	}
+	logf("acme: using tls-alpn-01")
+	return true
+}
+
+// isBYOFunnelDomain reports whether domain is a "bring your own" Funnel
+// hostname: a domain that is not in the netmap's CertDomains but is
+// referenced as a Funnel target on :443 by the local serve config.
+// BYO domains can only be issued via tls-alpn-01 because control does
+// not own their DNS zone.
+func (e *extension) isBYOFunnelDomain(b *ipnlocal.LocalBackend, domain string) bool {
+	if domain == "" || isWildcardDomain(domain) {
+		return false
+	}
+	nm := b.NetMapNoPeers()
+	if nm != nil && slices.Contains(nm.DNS.CertDomains, domain) {
+		return false
+	}
+	return b.HasFunnelForHostPort(domain, 443)
+}
+
+func challengeByType(challenges []*xacme.Challenge, typ string) *xacme.Challenge {
+	for _, ch := range challenges {
+		if ch.Type == typ {
+			return ch
+		}
+	}
+	return nil
+}
+
+func isWildcardDomain(domain string) bool {
+	return strings.HasPrefix(domain, "*.")
+}
+
+func (e *extension) domainRenewalTimeByARI(b *ipnlocal.LocalBackend, cs certStore, pair *ipnlocal.TLSCertKeyPair) (time.Time, error) {
+	var blocks []*pem.Block
+	rest := pair.CertPEM
+	for len(rest) > 0 {
+		var block *pem.Block
+		block, rest = pem.Decode(rest)
+		if block == nil {
+			return time.Time{}, fmt.Errorf("parsing certificate PEM")
+		}
+		blocks = append(blocks, block)
+	}
+	if len(blocks) < 1 {
+		return time.Time{}, fmt.Errorf("could not parse certificate chain from certStore, got %d PEM block(s)", len(blocks))
+	}
+	ac, err := e.acmeClient(cs)
+	if err != nil {
+		return time.Time{}, err
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	ri, err := ac.FetchRenewalInfo(ctx, blocks[0].Bytes)
+	if err != nil {
+		return time.Time{}, fmt.Errorf("failed to fetch renewal info from ACME server: %w", err)
+	}
+	if acmeDebug() {
+		b.Logger()("acme: ARI response: %+v", ri)
+	}
+
+	// Select a random time in the suggested window and renew if that time has
+	// passed. Time is randomized per recommendation in
+	// https://datatracker.ietf.org/doc/draft-ietf-acme-ari/
+	start, end := ri.SuggestedWindow.Start, ri.SuggestedWindow.End
+	renewTime := start.Add(randv2.N(end.Sub(start)))
+	return renewTime, nil
+}
+
+// getCertPEM checks if a cert needs to be renewed and if so, renews it.
+// domain is the resolved cert domain (e.g., "*.node.ts.net" for
+// wildcards). It can be overridden in tests.
+var getCertPEM = func(ctx context.Context, e *extension, b *ipnlocal.LocalBackend, cs certStore, logf logger.Logf, traceACME func(any), domain string, now time.Time, minValidity time.Duration) (*ipnlocal.TLSCertKeyPair, error) {
+	dm := e.lockDomain(domain)
+	dm.Lock()
+	defer dm.Unlock()
+
+	// In case this method was triggered multiple times in parallel (when
+	// serving incoming requests), check whether one of the other goroutines
+	// already renewed the cert before us.
+	previous, err := getCertPEMCached(cs, domain, now)
+	if err == nil {
+		// shouldStartDomainRenewal caches its result so it's OK to call this
+		// frequently.
+		shouldRenew, err := e.shouldStartDomainRenewal(b, cs, domain, now, previous, minValidity)
+		if err != nil {
+			logf("error checking for certificate renewal: %v", err)
+		} else if !shouldRenew {
+			return previous, nil
+		}
+	} else if !errors.Is(err, ipn.ErrStateNotExist) && !errors.Is(err, errCertExpired) {
+		return nil, err
+	}
+
+	// If we have no usable cached cert (either nothing on disk, or what is
+	// on disk has expired or otherwise failed verification), surface a
+	// health warning to the user for the duration of the ACME flow. We
+	// don't fire the warning when previous is non-nil because then we have
+	// a working cert and the renewal is happening behind the scenes.
+	if previous == nil {
+		e.setCertPending(b, domain, true)
+		defer e.setCertPending(b, domain, false)
+	}
+
+	ac, err := e.acmeClient(cs)
+	if err != nil {
+		return nil, err
+	}
+
+	if !isDefaultDirectoryURL(ac.DirectoryURL) {
+		logf("acme: using Directory URL %q", ac.DirectoryURL)
+	}
+
+	a, err := e.ensureAccount(ctx, ac, logf, traceACME)
+	if err != nil {
+		return nil, err
+	}
+	if a.Status != xacme.StatusValid {
+		return nil, fmt.Errorf("unexpected ACME account status %q", a.Status)
+	}
+
+	// If we have a previous cert, include it in the order via the ARI
+	// "replaces" extension so LE classifies the new cert as a renewal
+	// and exempts it from the per-registered-domain rate limit. Stores
+	// that can tell the current ACME account did not issue the previous
+	// cert opt out via [ARIReplacesAllower]; see #18251.
+	var opts []xacme.OrderOption
+	if previous != nil && !envknob.Bool("TS_DEBUG_ACME_FORCE_RENEWAL") {
+		prevCrt, err := parseCertificate(previous)
+		if err == nil {
+			useReplaces := true
+			if a, ok := cs.(ARIReplacesAllower); ok {
+				if allowed, err := a.ShouldUseARIReplacesForRenewal(domain); err != nil {
+					// Fail open: an error means we couldn't check
+					// eligibility, not that the account is misaligned.
+					logf("acme: failed to check ARI 'replaces' eligibility for %q, defaulting to use it: %v", domain, err)
+				} else {
+					useReplaces = allowed
+				}
+			}
+			if useReplaces {
+				opts = append(opts, xacme.WithOrderReplacesCert(prevCrt))
+			} else {
+				logf("account key mismatch for previous cert; skipping ARI 'replaces' hint")
+			}
+		}
+	}
+
+	issueArgs := acmeCertIssueArgs{
+		cs:        cs,
+		logf:      logf,
+		traceACME: traceACME,
+		domain:    domain,
+		opts:      opts,
+	}
+	if e.shouldUseACMETLSALPN01(b, domain, previous, logf) {
+		issueArgs.challengeType = acmeChallengeTLSALPN01
+		pair, err := e.issueACMECert(ctx, b, ac, issueArgs)
+		if err == nil {
+			return pair, nil
+		}
+		if ctx.Err() != nil {
+			return nil, ctx.Err()
+		}
+		if e.isBYOFunnelDomain(b, domain) {
+			// BYO domains have no working dns-01 path (control does not
+			// own the zone), so surface the tls-alpn-01 error instead of
+			// burning an ACME attempt on a guaranteed-to-fail fallback.
+			return nil, err
+		}
+		logf("acme: tls-alpn-01 failed; falling back to dns-01: %v", err)
+	}
+	issueArgs.challengeType = acmeChallengeDNS01
+	return e.issueACMECert(ctx, b, ac, issueArgs)
+}
+
+// ensureAccount returns a valid ACME account, registering one if
+// needed. Locked so two first-time issuances don't both create one.
+func (e *extension) ensureAccount(ctx context.Context, ac *xacme.Client, logf logger.Logf, traceACME func(any)) (*xacme.Account, error) {
+	e.accountMu.Lock()
+	defer e.accountMu.Unlock()
+	a, err := ac.GetReg(ctx, "" /* pre-RFC param */)
+	switch {
+	case err == nil:
+		logf("already had ACME account.")
+		return a, nil
+	case err == xacme.ErrNoAccount:
+		a, err = ac.Register(ctx, new(xacme.Account), xacme.AcceptTOS)
+		if err == xacme.ErrAccountAlreadyExists {
+			a, err = ac.GetReg(ctx, "" /* pre-RFC param */)
+		}
+		if err != nil {
+			return nil, fmt.Errorf("acme.Register: %w", err)
+		}
+		logf("registered ACME account.")
+		traceACME(a)
+		return a, nil
+	default:
+		return nil, fmt.Errorf("acme.GetReg: %w", err)
+	}
+}
+
+type acmeCertIssueArgs struct {
+	cs            certStore          // certificate and ACME account storage
+	logf          logger.Logf        // logs ACME progress and failures
+	traceACME     func(any)          // optional hook for logging ACME messages
+	domain        string             // certificate domain being issued
+	opts          []xacme.OrderOption // ACME order options
+	challengeType acmeChallengeType  // challenge type to fulfill
+}
+
+func (args acmeCertIssueArgs) baseDomain() string { return strings.TrimPrefix(args.domain, "*.") }
+func (args acmeCertIssueArgs) isWildcard() bool   { return isWildcardDomain(args.domain) }
+
+func (e *extension) issueACMECert(ctx context.Context, b *ipnlocal.LocalBackend, ac *xacme.Client, args acmeCertIssueArgs) (ret *ipnlocal.TLSCertKeyPair, err error) {
+	if args.traceACME == nil {
+		args.traceACME = func(any) {}
+	}
+
+	switch args.challengeType {
+	case acmeChallengeTLSALPN01:
+		metricACMETLSALPN01Start.Add(1)
+		defer func() {
+			if err == nil {
+				metricACMETLSALPN01Success.Add(1)
+			} else {
+				metricACMETLSALPN01Failure.Add(1)
+			}
+		}()
+	case acmeChallengeDNS01:
+		metricACMEDNS01Start.Add(1)
+		defer func() {
+			if err == nil {
+				metricACMEDNS01Success.Add(1)
+			} else {
+				metricACMEDNS01Failure.Add(1)
+			}
+		}()
+	default:
+		return nil, fmt.Errorf("unknown ACME challenge type %q", args.challengeType)
+	}
+
+	// For wildcards, we need to authorize both the wildcard and base domain.
+	var authzIDs []xacme.AuthzID
+	if args.isWildcard() {
+		authzIDs = []xacme.AuthzID{
+			{Type: "dns", Value: args.domain},
+			{Type: "dns", Value: args.baseDomain()},
+		}
+	} else {
+		authzIDs = []xacme.AuthzID{{Type: "dns", Value: args.domain}}
+	}
+	order, err := ac.AuthorizeOrder(ctx, authzIDs, args.opts...)
+	if err != nil {
+		return nil, err
+	}
+	args.traceACME(order)
+
+	for _, aurl := range order.AuthzURLs {
+		az, err := ac.GetAuthorization(ctx, aurl)
+		if err != nil {
+			return nil, err
+		}
+		args.traceACME(az)
+		switch args.challengeType {
+		case acmeChallengeTLSALPN01:
+			ch := challengeByType(az.Challenges, string(acmeChallengeTLSALPN01))
+			if ch == nil {
+				return nil, errors.New("tls-alpn-01 challenge not offered")
+			}
+			cert, err := ac.TLSALPN01ChallengeCert(ch.Token, az.Identifier.Value)
+			if err != nil {
+				return nil, fmt.Errorf("TLSALPN01ChallengeCert: %w", err)
+			}
+			cleanup := e.storeACMETLSALPNCert(az.Identifier.Value, &cert)
+			defer cleanup()
+			chal, err := ac.Accept(ctx, ch)
+			if err != nil {
+				return nil, fmt.Errorf("Accept: %v", err)
+			}
+			args.traceACME(chal)
+		case acmeChallengeDNS01:
+			if err := fulfillACMEDNS01Challenge(ctx, b, ac, az, args.logf, args.traceACME); err != nil {
+				return nil, err
+			}
+		default:
+			return nil, fmt.Errorf("unknown ACME challenge type %q", args.challengeType)
+		}
+	}
+
+	orderURI := order.URI
+	order, err = ac.WaitOrder(ctx, orderURI)
+	if err != nil {
+		if ctx.Err() != nil {
+			return nil, ctx.Err()
+		}
+		if oe, ok := err.(*xacme.OrderError); ok {
+			args.logf("acme: WaitOrder: OrderError status %q", oe.Status)
+		} else {
+			args.logf("acme: WaitOrder error: %v", err)
+		}
+		return nil, err
+	}
+	args.traceACME(order)
+
+	certPrivKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		return nil, err
+	}
+	var privPEM bytes.Buffer
+	if err := encodeECDSAKey(&privPEM, certPrivKey); err != nil {
+		return nil, err
+	}
+
+	csr, err := certRequest(certPrivKey, args.domain, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	args.logf("requesting cert...")
+	args.traceACME(csr)
+	der, _, err := ac.CreateOrderCert(ctx, order.FinalizeURL, csr, true)
+	if err != nil {
+		return nil, fmt.Errorf("CreateOrder: %v", err)
+	}
+	args.logf("got cert")
+
+	var certPEM bytes.Buffer
+	for _, b := range der {
+		pb := &pem.Block{Type: "CERTIFICATE", Bytes: b}
+		if err := pem.Encode(&certPEM, pb); err != nil {
+			return nil, err
+		}
+	}
+	if err := args.cs.WriteTLSCertAndKey(args.domain, certPEM.Bytes(), privPEM.Bytes()); err != nil {
+		return nil, err
+	}
+	e.domainRenewed(args.domain)
+
+	return &ipnlocal.TLSCertKeyPair{CertPEM: certPEM.Bytes(), KeyPEM: privPEM.Bytes()}, nil
+}
+
+func fulfillACMEDNS01Challenge(ctx context.Context, b *ipnlocal.LocalBackend, ac *xacme.Client, az *xacme.Authorization, logf logger.Logf, traceACME func(any)) error {
+	for _, ch := range az.Challenges {
+		if ch.Type != string(acmeChallengeDNS01) {
+			continue
+		}
+		rec, err := ac.DNS01ChallengeRecord(ch.Token)
+		if err != nil {
+			return err
+		}
+		// For wildcards, the challenge is on the base domain.
+		// e.g., "*.node.ts.net" -> "_acme-challenge.node.ts.net"
+		key := "_acme-challenge." + strings.TrimPrefix(az.Identifier.Value, "*.")
+
+		// Do a best-effort lookup to see if we've already created this DNS name
+		// in a previous attempt. Don't burn too much time on it, though. Worst
+		// case we ask the server to create something that already exists.
+		var resolver net.Resolver
+		lookupCtx, lookupCancel := context.WithTimeout(ctx, 500*time.Millisecond)
+		txts, _ := resolver.LookupTXT(lookupCtx, key)
+		lookupCancel()
+		if slices.Contains(txts, rec) {
+			logf("TXT record already existed for %s", key)
+		} else {
+			logf("starting SetDNS call for %s...", key)
+			err = b.SetDNS(ctx, key, rec)
+			if err != nil {
+				return fmt.Errorf("SetDNS %q => %q: %w", key, rec, err)
+			}
+			logf("did SetDNS for %s", key)
+		}
+
+		chal, err := ac.Accept(ctx, ch)
+		if err != nil {
+			return fmt.Errorf("Accept: %v", err)
+		}
+		traceACME(chal)
+		return nil
+	}
+	return errors.New("dns-01 challenge not offered")
+}
+
+// validLookingCertDomain reports whether name looks like a valid domain
+// name that we might be able to get a cert for.
+//
+// It's a light check primarily for double checking before it's used as
+// part of a filesystem path. The actual validation happens in
+// resolveCertDomain.
+func validLookingCertDomain(name string) bool {
+	if name == "" ||
+		strings.Contains(name, "..") ||
+		strings.ContainsAny(name, ":/\\\x00") ||
+		!strings.Contains(name, ".") {
+		return false
+	}
+	// Only allow * as a wildcard prefix "*.domain.tld"
+	if rest, ok := strings.CutPrefix(name, "*."); ok {
+		if strings.Contains(rest, "*") || !strings.Contains(rest, ".") {
+			return false
+		}
+	} else if strings.Contains(name, "*") {
+		return false
+	}
+	return true
+}
+
+// resolveCertDomain validates a domain and returns the cert domain to use.
+//
+//   - "node.ts.net" -> "node.ts.net" (exact CertDomain match)
+//   - "*.node.ts.net" -> "*.node.ts.net" (explicit wildcard, requires NodeAttrDNSSubdomainResolve)
+//   - "foo.com" -> "foo.com" (bring-your-own Funnel domain referenced by the
+//     local serve config; issued via tls-alpn-01 in getCertPEM)
+//
+// Subdomain requests like "app.node.ts.net" are rejected; callers should
+// request "*.node.ts.net" explicitly for subdomain coverage.
+func (e *extension) resolveCertDomain(b *ipnlocal.LocalBackend, domain string) (string, error) {
+	if domain == "" {
+		return "", errors.New("missing domain name")
+	}
+
+	// Read the netmap once to get both CertDomains and capabilities atomically.
+	nm := b.NetMapNoPeers()
+	if nm == nil {
+		return "", errors.New("no netmap available")
+	}
+	certDomains := nm.DNS.CertDomains
+	if len(certDomains) == 0 && !e.isBYOFunnelDomain(b, domain) {
+		return "", errors.New("your Tailscale account does not support getting TLS certs")
+	}
+
+	// Wildcard request like "*.node.ts.net".
+	if base, ok := strings.CutPrefix(domain, "*."); ok {
+		if !nm.AllCaps.Contains(tailcfg.NodeAttrDNSSubdomainResolve) {
+			return "", fmt.Errorf("wildcard certificates are not enabled for this node")
+		}
+		if !slices.Contains(certDomains, base) {
+			return "", fmt.Errorf("invalid domain %q; wildcard certificates are not enabled for this domain", domain)
+		}
+		return domain, nil
+	}
+
+	// Exact CertDomain match.
+	if slices.Contains(certDomains, domain) {
+		return domain, nil
+	}
+
+	// Bring-your-own Funnel domain (e.g. "foo.com"). The serve config
+	// references the domain as a Funnel target on :443; cert acquisition
+	// happens via tls-alpn-01 in getCertPEM.
+	if e.isBYOFunnelDomain(b, domain) {
+		return domain, nil
+	}
+
+	return "", fmt.Errorf("invalid domain %q; must be one of %q", domain, certDomains)
+}
+
+// setCertPending sets or clears the in-flight ACME issuance state for
+// domain and updates the [certPendingWarnable] to reflect the current
+// set of pending domains.
+func (e *extension) setCertPending(b *ipnlocal.LocalBackend, domain string, pending bool) {
+	e.pendingCertDomainsMu.Lock()
+	defer e.pendingCertDomainsMu.Unlock()
+	if pending {
+		e.pendingCertDomains.Make()
+		e.pendingCertDomains.Add(domain)
+	} else {
+		e.pendingCertDomains.Delete(domain)
+	}
+	if e.pendingCertDomains.Len() == 0 {
+		b.HealthTracker().SetHealthy(certPendingWarnable)
+		return
+	}
+	b.HealthTracker().SetUnhealthy(certPendingWarnable, health.Args{
+		health.ArgDomains: joinedPendingCertDomainsLocked(e.pendingCertDomains),
+	})
+}
+
+func joinedPendingCertDomainsLocked(s set.Set[string]) string {
+	ds := slicesx.MapKeys(s)
+	slices.Sort(ds)
+	return strings.Join(ds, ", ")
+}
+
+// parseCertificate returns the leaf certificate from the given
+// TLSCertKeyPair's CertPEM.
+func parseCertificate(kp *ipnlocal.TLSCertKeyPair) (*x509.Certificate, error) {
+	block, _ := pem.Decode(kp.CertPEM)
+	if block == nil {
+		return nil, fmt.Errorf("error parsing certificate PEM")
+	}
+	if block.Type != "CERTIFICATE" {
+		return nil, fmt.Errorf("PEM block is %q, not a CERTIFICATE", block.Type)
+	}
+	return x509.ParseCertificate(block.Bytes)
+}
diff --git a/feature/acme/cert_test.go b/feature/acme/cert_test.go
new file mode 100644
index 000000000..2ed4f28e5
--- /dev/null
+++ b/feature/acme/cert_test.go
@@ -0,0 +1,1156 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !ios && !android && !js
+
+package acme
+
+import (
+	"bytes"
+	"context"
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"embed"
+	"encoding/pem"
+	"maps"
+	"math/big"
+	"os"
+	"path/filepath"
+	"slices"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/google/go-cmp/cmp"
+	"tailscale.com/envknob"
+	"tailscale.com/health"
+	"tailscale.com/ipn"
+	"tailscale.com/ipn/ipnlocal"
+	"tailscale.com/ipn/ipnlocal/ipnlocaltest"
+	"tailscale.com/ipn/store/mem"
+	"tailscale.com/tailcfg"
+	xacme "tailscale.com/tempfork/acme"
+	"tailscale.com/tsconst"
+	"tailscale.com/tstest"
+	"tailscale.com/types/logger"
+	"tailscale.com/types/netmap"
+	"tailscale.com/util/must"
+	"tailscale.com/util/set"
+)
+
+//go:embed testdata/*
+var certTestFS embed.FS
+
+// extOf returns the [*extension] registered on b, failing the test if
+// it's not present.
+func extOf(t *testing.T, b *ipnlocal.LocalBackend) *extension {
+	t.Helper()
+	e, ok := ipnlocal.GetExt[*extension](b)
+	if !ok {
+		t.Fatal("acme extension not registered on backend")
+	}
+	return e
+}
+
+func TestCertRequest(t *testing.T) {
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatalf("GenerateKey: %v", err)
+	}
+
+	tests := []struct {
+		name     string
+		domain   string
+		wantSANs []string
+	}{
+		{
+			name:     "example-com",
+			domain:   "example.com",
+			wantSANs: []string{"example.com"},
+		},
+		{
+			name:     "wildcard-example-com",
+			domain:   "*.example.com",
+			wantSANs: []string{"*.example.com", "example.com"},
+		},
+		{
+			name:     "wildcard-foo-bar-com",
+			domain:   "*.foo.bar.com",
+			wantSANs: []string{"*.foo.bar.com", "foo.bar.com"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			csrDER, err := certRequest(key, tt.domain, nil)
+			if err != nil {
+				t.Fatalf("certRequest: %v", err)
+			}
+			csr, err := x509.ParseCertificateRequest(csrDER)
+			if err != nil {
+				t.Fatalf("ParseCertificateRequest: %v", err)
+			}
+			if csr.Subject.CommonName != tt.domain {
+				t.Errorf("CommonName = %q, want %q", csr.Subject.CommonName, tt.domain)
+			}
+			if !slices.Equal(csr.DNSNames, tt.wantSANs) {
+				t.Errorf("DNSNames = %v, want %v", csr.DNSNames, tt.wantSANs)
+			}
+		})
+	}
+}
+
+func TestResolveCertDomain(t *testing.T) {
+	tests := []struct {
+		name        string
+		domain      string
+		certDomains []string
+		hasCap      bool
+		skipNetmap  bool
+		want        string
+		wantErr     string
+	}{
+		{
+			name:        "exact_match",
+			domain:      "node.ts.net",
+			certDomains: []string{"node.ts.net"},
+			want:        "node.ts.net",
+		},
+		{
+			name:        "exact_match_with_cap",
+			domain:      "node.ts.net",
+			certDomains: []string{"node.ts.net"},
+			hasCap:      true,
+			want:        "node.ts.net",
+		},
+		{
+			name:        "wildcard_with_cap",
+			domain:      "*.node.ts.net",
+			certDomains: []string{"node.ts.net"},
+			hasCap:      true,
+			want:        "*.node.ts.net",
+		},
+		{
+			name:        "wildcard_without_cap",
+			domain:      "*.node.ts.net",
+			certDomains: []string{"node.ts.net"},
+			wantErr:     "wildcard certificates are not enabled for this node",
+		},
+		{
+			name:        "wildcard_wrong_domain_with_cap",
+			domain:      "*.other.com",
+			certDomains: []string{"node.ts.net"},
+			hasCap:      true,
+			wantErr:     `invalid domain "*.other.com"; wildcard certificates are not enabled for this domain`,
+		},
+		{
+			name:        "missing_domain",
+			domain:      "",
+			certDomains: []string{"node.ts.net"},
+			wantErr:     "missing domain name",
+		},
+		{
+			name:        "no_cert_domains_with_cap",
+			domain:      "node.ts.net",
+			certDomains: nil,
+			hasCap:      true,
+			wantErr:     "your Tailscale account does not support getting TLS certs",
+		},
+		{
+			name:        "no_cert_domains_without_cap",
+			domain:      "node.ts.net",
+			certDomains: nil,
+			wantErr:     "your Tailscale account does not support getting TLS certs",
+		},
+		{
+			name:        "subdomain_request_rejected_without_cap",
+			domain:      "app.node.ts.net",
+			certDomains: []string{"node.ts.net"},
+			wantErr:     `invalid domain "app.node.ts.net"; must be one of ["node.ts.net"]`,
+		},
+		{
+			name:        "subdomain_request_rejected_with_cap",
+			domain:      "app.node.ts.net",
+			certDomains: []string{"node.ts.net"},
+			hasCap:      true,
+			wantErr:     `invalid domain "app.node.ts.net"; must be one of ["node.ts.net"]`,
+		},
+		{
+			name:       "nil_netmap",
+			domain:     "node.ts.net",
+			skipNetmap: true,
+			wantErr:    "no netmap available",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			b := ipnlocaltest.NewBackend(t)
+			e := extOf(t, b)
+
+			if !tt.skipNetmap {
+				var allCaps set.Set[tailcfg.NodeCapability]
+				if tt.hasCap {
+					allCaps = set.Of(tailcfg.NodeAttrDNSSubdomainResolve)
+				}
+				b.ForTest().SetNetMap(&netmap.NetworkMap{
+					SelfNode: (&tailcfg.Node{}).View(),
+					DNS: tailcfg.DNSConfig{
+						CertDomains: tt.certDomains,
+					},
+					AllCaps: allCaps,
+				})
+			}
+
+			got, err := e.resolveCertDomain(b, tt.domain)
+			if tt.wantErr != "" {
+				if err == nil {
+					t.Errorf("resolveCertDomain(%q) = %q, want error %q", tt.domain, got, tt.wantErr)
+				} else if err.Error() != tt.wantErr {
+					t.Errorf("resolveCertDomain(%q) error = %q, want %q", tt.domain, err.Error(), tt.wantErr)
+				}
+				return
+			}
+			if err != nil {
+				t.Errorf("resolveCertDomain(%q) error = %v, want nil", tt.domain, err)
+				return
+			}
+			if got != tt.want {
+				t.Errorf("resolveCertDomain(%q) = %q, want %q", tt.domain, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestValidLookingCertDomain(t *testing.T) {
+	tests := []struct {
+		in   string
+		want bool
+	}{
+		{"foo.com", true},
+		{"foo..com", false},
+		{"foo/com.com", false},
+		{"NUL", false},
+		{"", false},
+		{"foo\\bar.com", false},
+		{"foo\x00bar.com", false},
+		// Wildcard tests
+		{"*.foo.com", true},
+		{"*.foo.bar.com", true},
+		{"*foo.com", false},      // must be *.
+		{"*.com", false},         // must have domain after *.
+		{"*.", false},            // must have domain after *.
+		{"*.*.foo.com", false},   // no nested wildcards
+		{"foo.*.bar.com", false}, // no wildcard mid-string
+		{"app.foo.com", true},    // regular subdomain
+		{"*", false},             // bare asterisk
+	}
+	for _, tt := range tests {
+		if got := validLookingCertDomain(tt.in); got != tt.want {
+			t.Errorf("validLookingCertDomain(%q) = %v, want %v", tt.in, got, tt.want)
+		}
+	}
+}
+
+func TestACMETLSALPNCertHook(t *testing.T) {
+	b := ipnlocaltest.NewBackend(t)
+	e := extOf(t, b)
+	cert := &tls.Certificate{}
+	cleanup := e.storeACMETLSALPNCert("example.com", cert)
+	defer cleanup()
+
+	if got, ok := b.ForTest().GetACMETLSALPNCert(&tls.ClientHelloInfo{
+		ServerName:      "example.com",
+		SupportedProtos: []string{xacme.ALPNProto},
+	}); !ok || got != cert {
+		t.Fatalf("getACMETLSALPNCert = %v, %v; want stored cert, true", got, ok)
+	}
+	if _, ok := b.ForTest().GetACMETLSALPNCert(&tls.ClientHelloInfo{
+		ServerName:      "example.com",
+		SupportedProtos: []string{"http/1.1"},
+	}); ok {
+		t.Fatal("getACMETLSALPNCert without acme ALPN = ok, want false")
+	}
+	if _, ok := b.ForTest().GetACMETLSALPNCert(&tls.ClientHelloInfo{
+		ServerName:      "other.example.com",
+		SupportedProtos: []string{xacme.ALPNProto},
+	}); ok {
+		t.Fatal("getACMETLSALPNCert for other name = ok, want false")
+	}
+
+	otherBackend := ipnlocaltest.NewBackend(t)
+	if _, ok := otherBackend.ForTest().GetACMETLSALPNCert(&tls.ClientHelloInfo{
+		ServerName:      "example.com",
+		SupportedProtos: []string{xacme.ALPNProto},
+	}); ok {
+		t.Fatal("getACMETLSALPNCert on different LocalBackend = ok, want false")
+	}
+}
+
+func TestShouldUseACMETLSALPN01(t *testing.T) {
+	const (
+		tsNetDomain = "node.ts.net"
+		byoDomain   = "foo.com"
+	)
+	previous := &ipnlocal.TLSCertKeyPair{}
+
+	setFunnel := func(b *ipnlocal.LocalBackend, hosts ...string) {
+		funnel := map[ipn.HostPort]bool{}
+		for _, h := range hosts {
+			funnel[ipn.HostPort(h+":443")] = true
+		}
+		b.ForTest().SetServeConfig((&ipn.ServeConfig{AllowFunnel: funnel}).View())
+	}
+	setNetmap := func(b *ipnlocal.LocalBackend, certDomains ...string) {
+		b.ForTest().SetNetMap(&netmap.NetworkMap{
+			SelfNode: (&tailcfg.Node{}).View(),
+			DNS:      tailcfg.DNSConfig{CertDomains: certDomains},
+		})
+	}
+
+	tests := []struct {
+		name     string
+		domain   string
+		previous *ipnlocal.TLSCertKeyPair
+		funnel   []string
+		netmap   []string // CertDomains; if nil, no netmap installed
+		want     bool
+	}{
+		{
+			name:     "tsnet_renewal",
+			domain:   tsNetDomain,
+			previous: previous,
+			funnel:   []string{tsNetDomain},
+			netmap:   []string{tsNetDomain},
+			want:     true,
+		},
+		{
+			name:     "tsnet_first_issuance_prefers_dns01",
+			domain:   tsNetDomain,
+			previous: nil,
+			funnel:   []string{tsNetDomain},
+			netmap:   []string{tsNetDomain},
+			want:     false,
+		},
+		{
+			name:     "tsnet_wildcard_rejected",
+			domain:   "*." + tsNetDomain,
+			previous: previous,
+			funnel:   []string{tsNetDomain},
+			netmap:   []string{tsNetDomain},
+			want:     false,
+		},
+		{
+			name:     "tsnet_without_funnel_rejected",
+			domain:   tsNetDomain,
+			previous: previous,
+			funnel:   nil,
+			netmap:   []string{tsNetDomain},
+			want:     false,
+		},
+		{
+			name:     "byo_first_issuance_uses_alpn",
+			domain:   byoDomain,
+			previous: nil,
+			funnel:   []string{byoDomain},
+			netmap:   []string{tsNetDomain},
+			want:     true,
+		},
+		{
+			name:     "byo_renewal_uses_alpn",
+			domain:   byoDomain,
+			previous: previous,
+			funnel:   []string{byoDomain},
+			netmap:   []string{tsNetDomain},
+			want:     true,
+		},
+		{
+			name:     "byo_without_funnel_rejected",
+			domain:   byoDomain,
+			previous: previous,
+			funnel:   nil,
+			netmap:   []string{tsNetDomain},
+			want:     false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			b := ipnlocaltest.NewBackend(t)
+			e := extOf(t, b)
+			if tt.netmap != nil {
+				setNetmap(b, tt.netmap...)
+			}
+			setFunnel(b, tt.funnel...)
+			if got := e.shouldUseACMETLSALPN01(b, tt.domain, tt.previous, t.Logf); got != tt.want {
+				t.Errorf("shouldUseACMETLSALPN01(%q, previous=%v) = %v, want %v",
+					tt.domain, tt.previous != nil, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestIsBYOFunnelDomain(t *testing.T) {
+	setFunnel := func(b *ipnlocal.LocalBackend, hosts ...string) {
+		funnel := map[ipn.HostPort]bool{}
+		for _, h := range hosts {
+			funnel[ipn.HostPort(h+":443")] = true
+		}
+		b.ForTest().SetServeConfig((&ipn.ServeConfig{AllowFunnel: funnel}).View())
+	}
+	setNetmap := func(b *ipnlocal.LocalBackend, certDomains ...string) {
+		b.ForTest().SetNetMap(&netmap.NetworkMap{
+			SelfNode: (&tailcfg.Node{}).View(),
+			DNS:      tailcfg.DNSConfig{CertDomains: certDomains},
+		})
+	}
+
+	tests := []struct {
+		name        string
+		domain      string
+		certDomains []string
+		funnel      []string
+		want        bool
+	}{
+		{name: "byo_with_funnel", domain: "foo.com", certDomains: []string{"node.ts.net"}, funnel: []string{"foo.com"}, want: true},
+		{name: "byo_without_funnel", domain: "foo.com", certDomains: []string{"node.ts.net"}, want: false},
+		{name: "tsnet_exact_match_not_byo", domain: "node.ts.net", certDomains: []string{"node.ts.net"}, funnel: []string{"node.ts.net"}, want: false},
+		{name: "wildcard_never_byo", domain: "*.foo.com", certDomains: []string{"node.ts.net"}, funnel: []string{"foo.com"}, want: false},
+		{name: "empty_never_byo", domain: "", certDomains: []string{"node.ts.net"}, funnel: []string{"foo.com"}, want: false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			b := ipnlocaltest.NewBackend(t)
+			e := extOf(t, b)
+			setNetmap(b, tt.certDomains...)
+			setFunnel(b, tt.funnel...)
+			if got := e.isBYOFunnelDomain(b, tt.domain); got != tt.want {
+				t.Errorf("isBYOFunnelDomain(%q) = %v, want %v", tt.domain, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestResolveCertDomainBYO(t *testing.T) {
+	const (
+		tsNetDomain = "node.ts.net"
+		byoDomain   = "foo.com"
+	)
+	b := ipnlocaltest.NewBackend(t)
+	e := extOf(t, b)
+	b.ForTest().SetNetMap(&netmap.NetworkMap{
+		SelfNode: (&tailcfg.Node{}).View(),
+		DNS:      tailcfg.DNSConfig{CertDomains: []string{tsNetDomain}},
+	})
+
+	// Without a serve config, BYO is rejected.
+	if _, err := e.resolveCertDomain(b, byoDomain); err == nil {
+		t.Fatalf("resolveCertDomain(%q) without serve config: want error, got nil", byoDomain)
+	}
+
+	// Web entry alone (no AllowFunnel) is not enough; the gate is Funnel.
+	b.ForTest().SetServeConfig((&ipn.ServeConfig{
+		Web: map[ipn.HostPort]*ipn.WebServerConfig{
+			byoDomain + ":443": {Handlers: map[string]*ipn.HTTPHandler{"/": {Proxy: "http://127.0.0.1:8080"}}},
+		},
+	}).View())
+	if _, err := e.resolveCertDomain(b, byoDomain); err == nil {
+		t.Fatalf("resolveCertDomain(%q) with Web but no Funnel: want error, got nil", byoDomain)
+	}
+
+	// With AllowFunnel, BYO is accepted.
+	b.ForTest().SetServeConfig((&ipn.ServeConfig{
+		Web: map[ipn.HostPort]*ipn.WebServerConfig{
+			byoDomain + ":443": {Handlers: map[string]*ipn.HTTPHandler{"/": {Proxy: "http://127.0.0.1:8080"}}},
+		},
+		AllowFunnel: map[ipn.HostPort]bool{byoDomain + ":443": true},
+	}).View())
+	got, err := e.resolveCertDomain(b, byoDomain)
+	if err != nil {
+		t.Fatalf("resolveCertDomain(%q): %v", byoDomain, err)
+	}
+	if got != byoDomain {
+		t.Errorf("resolveCertDomain(%q) = %q, want %q", byoDomain, got, byoDomain)
+	}
+
+	// The ts.net path still works alongside BYO entries.
+	got, err = e.resolveCertDomain(b, tsNetDomain)
+	if err != nil {
+		t.Fatalf("resolveCertDomain(%q): %v", tsNetDomain, err)
+	}
+	if got != tsNetDomain {
+		t.Errorf("resolveCertDomain(%q) = %q, want %q", tsNetDomain, got, tsNetDomain)
+	}
+}
+
+func TestCertStoreRoundTrip(t *testing.T) {
+	const testDomain = "example.com"
+
+	// Use fixed verification timestamps so validity doesn't change over time.
+	// If you update the test data below, these may also need to be updated.
+	testNow := time.Date(2023, time.February, 10, 0, 0, 0, 0, time.UTC)
+	testExpired := time.Date(2026, time.February, 10, 0, 0, 0, 0, time.UTC)
+
+	// To re-generate a root certificate and domain certificate for testing,
+	// use:
+	//
+	//   	go run filippo.io/mkcert@latest example.com
+	//
+	// The content is not important except to be structurally valid so we can be
+	// sure the round-trip succeeds.
+	testRoot, err := certTestFS.ReadFile("testdata/rootCA.pem")
+	if err != nil {
+		t.Fatal(err)
+	}
+	roots := x509.NewCertPool()
+	if !roots.AppendCertsFromPEM(testRoot) {
+		t.Fatal("Unable to add test CA to the cert pool")
+	}
+
+	testCert, err := certTestFS.ReadFile("testdata/example.com.pem")
+	if err != nil {
+		t.Fatal(err)
+	}
+	testKey, err := certTestFS.ReadFile("testdata/example.com-key.pem")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	tests := []struct {
+		name         string
+		store        certStore
+		debugACMEURL bool
+	}{
+		{"FileStore", certFileStore{dir: t.TempDir(), testRoots: roots}, false},
+		{"FileStore_UnknownCA", certFileStore{dir: t.TempDir()}, true},
+		{"StateStore", certStateStore{StateStore: new(mem.Store), testRoots: roots}, false},
+		{"StateStore_UnknownCA", certStateStore{StateStore: new(mem.Store)}, true},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			if test.debugACMEURL {
+				t.Setenv("TS_DEBUG_ACME_DIRECTORY_URL", "https://acme-staging-v02.api.letsencrypt.org/directory")
+			}
+			if err := test.store.WriteTLSCertAndKey(testDomain, testCert, testKey); err != nil {
+				t.Fatalf("WriteTLSCertAndKey: unexpected error: %v", err)
+			}
+			kp, err := test.store.Read(testDomain, testNow)
+			if err != nil {
+				t.Fatalf("Read: unexpected error: %v", err)
+			}
+			if diff := cmp.Diff(kp.CertPEM, testCert); diff != "" {
+				t.Errorf("Certificate (-got, +want):\n%s", diff)
+			}
+			if diff := cmp.Diff(kp.KeyPEM, testKey); diff != "" {
+				t.Errorf("Key (-got, +want):\n%s", diff)
+			}
+			unexpected, err := test.store.Read(testDomain, testExpired)
+			if err != errCertExpired {
+				t.Fatalf("Read: expected expiry error: %v", string(unexpected.CertPEM))
+			}
+		})
+	}
+}
+
+func TestShouldStartDomainRenewal(t *testing.T) {
+	mustMakePair := func(template *x509.Certificate) *ipnlocal.TLSCertKeyPair {
+		priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+		if err != nil {
+			panic(err)
+		}
+
+		b, err := x509.CreateCertificate(rand.Reader, template, template, &priv.PublicKey, priv)
+		if err != nil {
+			panic(err)
+		}
+		certPEM := pem.EncodeToMemory(&pem.Block{
+			Type:  "CERTIFICATE",
+			Bytes: b,
+		})
+
+		return &ipnlocal.TLSCertKeyPair{
+			Cached:  false,
+			CertPEM: certPEM,
+			KeyPEM:  []byte("unused"),
+		}
+	}
+
+	now := time.Unix(1685714838, 0)
+	subject := pkix.Name{
+		Organization:  []string{"Tailscale, Inc."},
+		Country:       []string{"CA"},
+		Province:      []string{"ON"},
+		Locality:      []string{"Toronto"},
+		StreetAddress: []string{"290 Bremner Blvd"},
+		PostalCode:    []string{"M5V 3L9"},
+	}
+
+	testCases := []struct {
+		name      string
+		notBefore time.Time
+		lifetime  time.Duration
+		want      bool
+		wantErr   string
+	}{
+		{
+			name:      "should-renew",
+			notBefore: now.AddDate(0, 0, -89),
+			lifetime:  90 * 24 * time.Hour,
+			want:      true,
+		},
+		{
+			name:      "short-lived-renewal",
+			notBefore: now.AddDate(0, 0, -7),
+			lifetime:  10 * 24 * time.Hour,
+			want:      true,
+		},
+		{
+			name:      "no-renew",
+			notBefore: now.AddDate(0, 0, -59), // 59 days ago == not 2/3rds of the way through 90 days yet
+			lifetime:  90 * 24 * time.Hour,
+			want:      false,
+		},
+	}
+	for _, tt := range testCases {
+		t.Run(tt.name, func(t *testing.T) {
+			ret, err := domainRenewalTimeByExpiry(mustMakePair(&x509.Certificate{
+				SerialNumber: big.NewInt(2019),
+				Subject:      subject,
+				NotBefore:    tt.notBefore,
+				NotAfter:     tt.notBefore.Add(tt.lifetime),
+			}))
+
+			if tt.wantErr != "" {
+				if err == nil {
+					t.Errorf("wanted error, got nil")
+				} else if err.Error() != tt.wantErr {
+					t.Errorf("got err=%q, want %q", err.Error(), tt.wantErr)
+				}
+			} else {
+				renew := now.After(ret)
+				if renew != tt.want {
+					t.Errorf("got renew=%v (ret=%v), want renew %v", renew, ret, tt.want)
+				}
+			}
+		})
+	}
+}
+
+func TestDebugACMEDirectoryURL(t *testing.T) {
+	for _, tc := range []string{"", "https://acme-staging-v02.api.letsencrypt.org/directory"} {
+		const setting = "TS_DEBUG_ACME_DIRECTORY_URL"
+		t.Run(tc, func(t *testing.T) {
+			t.Setenv(setting, tc)
+			e := &extension{}
+			ac, err := e.acmeClient(certStateStore{StateStore: new(mem.Store)})
+			if err != nil {
+				t.Fatalf("acmeClient creation err: %v", err)
+			}
+			if ac.DirectoryURL != tc {
+				t.Fatalf("acmeClient.DirectoryURL = %q, want %q", ac.DirectoryURL, tc)
+			}
+		})
+	}
+}
+
+func TestGetCertPEMWithValidity(t *testing.T) {
+	const testDomain = "example.com"
+	b := ipnlocaltest.NewBackend(t)
+	b.SetVarRoot(t.TempDir())
+	e := extOf(t, b)
+
+	// Set up netmap with CertDomains so resolveCertDomain works.
+	b.ForTest().SetNetMap(&netmap.NetworkMap{
+		SelfNode: (&tailcfg.Node{}).View(),
+		DNS: tailcfg.DNSConfig{
+			CertDomains: []string{testDomain},
+		},
+	})
+
+	certDirPath, err := certDir(b)
+	if err != nil {
+		t.Fatalf("certDir error: %v", err)
+	}
+	if _, err := e.getCertStore(b); err != nil {
+		t.Fatalf("getCertStore error: %v", err)
+	}
+	testRoot, err := certTestFS.ReadFile("testdata/rootCA.pem")
+	if err != nil {
+		t.Fatal(err)
+	}
+	roots := x509.NewCertPool()
+	if !roots.AppendCertsFromPEM(testRoot) {
+		t.Fatal("Unable to add test CA to the cert pool")
+	}
+	testX509Roots = roots
+	defer func() { testX509Roots = nil }()
+	tests := []struct {
+		name string
+		now  time.Time
+		// storeCerts is true if the test cert and key should be written to store.
+		storeCerts       bool
+		readOnlyMode     bool // TS_READ_ONLY_CERTS env var
+		wantAsyncRenewal bool // async issuance should be started
+		wantIssuance     bool // sync issuance should be started
+		wantErr          bool
+	}{
+		{
+			name:             "valid_no_renewal",
+			now:              time.Date(2023, time.February, 20, 0, 0, 0, 0, time.UTC),
+			storeCerts:       true,
+			wantAsyncRenewal: false,
+			wantIssuance:     false,
+			wantErr:          false,
+		},
+		{
+			name:             "issuance_needed",
+			now:              time.Date(2023, time.February, 20, 0, 0, 0, 0, time.UTC),
+			storeCerts:       false,
+			wantAsyncRenewal: false,
+			wantIssuance:     true,
+			wantErr:          false,
+		},
+		{
+			name:             "renewal_needed",
+			now:              time.Date(2025, time.May, 1, 0, 0, 0, 0, time.UTC),
+			storeCerts:       true,
+			wantAsyncRenewal: true,
+			wantIssuance:     false,
+			wantErr:          false,
+		},
+		{
+			name:             "renewal_needed_read_only_mode",
+			now:              time.Date(2025, time.May, 1, 0, 0, 0, 0, time.UTC),
+			storeCerts:       true,
+			readOnlyMode:     true,
+			wantAsyncRenewal: false,
+			wantIssuance:     false,
+			wantErr:          false,
+		},
+		{
+			name:             "no_certs_read_only_mode",
+			now:              time.Date(2025, time.May, 1, 0, 0, 0, 0, time.UTC),
+			storeCerts:       false,
+			readOnlyMode:     true,
+			wantAsyncRenewal: false,
+			wantIssuance:     false,
+			wantErr:          true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+
+			tstest.AssertNotParallel(t)
+			if tt.readOnlyMode {
+				envknob.Setenv("TS_CERT_SHARE_MODE", "ro")
+			} else {
+				envknob.Setenv("TS_CERT_SHARE_MODE", "")
+			}
+
+			os.RemoveAll(certDirPath)
+			if tt.storeCerts {
+				os.MkdirAll(certDirPath, 0755)
+				if err := os.WriteFile(filepath.Join(certDirPath, "example.com.crt"),
+					must.Get(certTestFS.ReadFile("testdata/example.com.pem")), 0644); err != nil {
+					t.Fatal(err)
+				}
+				if err := os.WriteFile(filepath.Join(certDirPath, "example.com.key"),
+					must.Get(certTestFS.ReadFile("testdata/example.com-key.pem")), 0644); err != nil {
+					t.Fatal(err)
+				}
+			}
+
+			b.ForTest().SetClock(tstest.NewClock(tstest.ClockOpts{Start: tt.now}))
+
+			// Set to true if getCertPEM is called. GetCertPEM can be called in
+			// a goroutine for async renewal or in the main goroutine if
+			// issuance is required to obtain valid TLS credentials.
+			getCertPemWasCalled := false
+			orig := getCertPEM
+			getCertPEM = func(ctx context.Context, e *extension, b *ipnlocal.LocalBackend, cs certStore, logf logger.Logf, traceACME func(any), domain string, now time.Time, minValidity time.Duration) (*ipnlocal.TLSCertKeyPair, error) {
+				getCertPemWasCalled = true
+				return nil, nil
+			}
+			t.Cleanup(func() { getCertPEM = orig })
+			prevGo := e.goroutinesStarted.Load()
+			_, err = b.GetCertPEMWithValidity(context.Background(), testDomain, 0)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("b.GetCertPemWithValidity got err %v, wants error: '%v'", err, tt.wantErr)
+			}
+			// GetCertPEMWithValidity spawns one tracked goroutine (via
+			// extension.Go) iff it kicked off async renewal.
+			gotAsyncRenewal := e.goroutinesStarted.Load()-prevGo != 0
+			if gotAsyncRenewal {
+				done := make(chan struct{})
+				go func() { e.wg.Wait(); close(done) }()
+				select {
+				case <-time.After(5 * time.Second):
+					t.Fatal("timed out waiting for async renewal goroutine to finish")
+				case <-done:
+				}
+			}
+			// Verify that async renewal was triggered if expected.
+			if tt.wantAsyncRenewal != gotAsyncRenewal {
+				t.Fatalf("wants getCertPem to be called async: %v, got called %v", tt.wantAsyncRenewal, gotAsyncRenewal)
+			}
+			// Verify that (non-async) issuance was started if expected.
+			gotIssuance := getCertPemWasCalled && !gotAsyncRenewal
+			if tt.wantIssuance != gotIssuance {
+				t.Errorf("wants getCertPem to be called: %v, got called %v", tt.wantIssuance, gotIssuance)
+			}
+		})
+	}
+}
+
+// TestGetCertPEMWithValidityTrimsTrailingDot verifies that an SNI
+// ServerName with a trailing dot (e.g. "example.com.") resolves to the
+// same cached certificate as the dotless form. Per RFC 6066 §3 the SNI
+// HostName carries no trailing dot, but some clients send an FQDN with
+// one; the cert store keys certs by the dotless domain, so the trailing
+// dot must be trimmed before lookup. See tailscale/tailscale#10233.
+func TestGetCertPEMWithValidityTrimsTrailingDot(t *testing.T) {
+	tstest.AssertNotParallel(t)
+
+	const testDomain = "example.com"
+	b := ipnlocaltest.NewBackend(t)
+	b.SetVarRoot(t.TempDir())
+	e := extOf(t, b)
+
+	// Set up netmap with CertDomains so resolveCertDomain works. Note
+	// CertDomains holds the dotless domain, matching what control sends.
+	b.ForTest().SetNetMap(&netmap.NetworkMap{
+		SelfNode: (&tailcfg.Node{}).View(),
+		DNS: tailcfg.DNSConfig{
+			CertDomains: []string{testDomain},
+		},
+	})
+
+	certDirPath, err := certDir(b)
+	if err != nil {
+		t.Fatalf("certDir error: %v", err)
+	}
+	if _, err := e.getCertStore(b); err != nil {
+		t.Fatalf("getCertStore error: %v", err)
+	}
+	testRoot, err := certTestFS.ReadFile("testdata/rootCA.pem")
+	if err != nil {
+		t.Fatal(err)
+	}
+	roots := x509.NewCertPool()
+	if !roots.AppendCertsFromPEM(testRoot) {
+		t.Fatal("Unable to add test CA to the cert pool")
+	}
+	testX509Roots = roots
+	defer func() { testX509Roots = nil }()
+
+	// Store a valid, unexpired cached cert under the dotless domain.
+	os.MkdirAll(certDirPath, 0755)
+	if err := os.WriteFile(filepath.Join(certDirPath, "example.com.crt"),
+		must.Get(certTestFS.ReadFile("testdata/example.com.pem")), 0644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(certDirPath, "example.com.key"),
+		must.Get(certTestFS.ReadFile("testdata/example.com-key.pem")), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	// A time at which the stored cert is valid and does not need renewal.
+	b.ForTest().SetClock(tstest.NewClock(tstest.ClockOpts{
+		Start: time.Date(2023, time.February, 20, 0, 0, 0, 0, time.UTC),
+	}))
+
+	// Fail loudly if issuance/renewal is attempted: a trailing-dot lookup
+	// must hit the cached cert, not trigger a fresh ACME order.
+	orig := getCertPEM
+	getCertPEM = func(ctx context.Context, e *extension, b *ipnlocal.LocalBackend, cs certStore, logf logger.Logf, traceACME func(any), domain string, now time.Time, minValidity time.Duration) (*ipnlocal.TLSCertKeyPair, error) {
+		t.Errorf("unexpected getCertPEM call for domain %q; trailing-dot lookup should have hit the cache", domain)
+		return nil, nil
+	}
+	t.Cleanup(func() { getCertPEM = orig })
+
+	pair, err := b.GetCertPEMWithValidity(context.Background(), testDomain+".", 0)
+	if err != nil {
+		t.Fatalf("GetCertPEMWithValidity(%q) error = %v, want cached cert", testDomain+".", err)
+	}
+	if pair == nil || !pair.Cached {
+		t.Fatalf("GetCertPEMWithValidity(%q) = %+v, want cached cert", testDomain+".", pair)
+	}
+}
+
+func TestCertPendingWarnable(t *testing.T) {
+	b := ipnlocaltest.NewBackend(t)
+	e := extOf(t, b)
+
+	// currentWarning returns the pending warning's rendered text and
+	// domain-list arg, or "", "" if the warnable is currently healthy.
+	currentWarning := func() (text, domains string) {
+		ws, ok := b.HealthTracker().CurrentState().Warnings[tsconst.HealthWarnableTLSCertPending]
+		if !ok {
+			return "", ""
+		}
+		return ws.Text, ws.Args[health.ArgDomains]
+	}
+
+	if b.HealthTracker().IsUnhealthy(certPendingWarnable) {
+		t.Fatal("warnable unexpectedly unhealthy before any setCertPending")
+	}
+
+	e.setCertPending(b, "a.example.com", true)
+	if !b.HealthTracker().IsUnhealthy(certPendingWarnable) {
+		t.Fatal("warnable not unhealthy after first setCertPending")
+	}
+	if text, domains := currentWarning(); domains != "a.example.com" ||
+		text != "Fetching TLS certificate via ACME for: a.example.com" {
+		t.Errorf("after first setCertPending: text=%q domains=%q", text, domains)
+	}
+
+	e.setCertPending(b, "b.example.com", true)
+	if !b.HealthTracker().IsUnhealthy(certPendingWarnable) {
+		t.Fatal("warnable not unhealthy after second setCertPending")
+	}
+	if text, domains := currentWarning(); domains != "a.example.com, b.example.com" ||
+		text != "Fetching TLS certificate via ACME for: a.example.com, b.example.com" {
+		t.Errorf("after second setCertPending: text=%q domains=%q", text, domains)
+	}
+
+	e.setCertPending(b, "a.example.com", false)
+	if !b.HealthTracker().IsUnhealthy(certPendingWarnable) {
+		t.Fatal("warnable cleared too early; one domain still pending")
+	}
+	if text, domains := currentWarning(); domains != "b.example.com" ||
+		text != "Fetching TLS certificate via ACME for: b.example.com" {
+		t.Errorf("after clearing a.example.com: text=%q domains=%q", text, domains)
+	}
+
+	e.setCertPending(b, "b.example.com", false)
+	if b.HealthTracker().IsUnhealthy(certPendingWarnable) {
+		t.Fatal("warnable still unhealthy after clearing all domains")
+	}
+	if text, domains := currentWarning(); text != "" || domains != "" {
+		t.Errorf("after clearing all domains: text=%q domains=%q", text, domains)
+	}
+}
+
+func TestServeConfigUsesACMECerts(t *testing.T) {
+	tests := []struct {
+		name string
+		sc   *ipn.ServeConfig
+		want bool
+	}{
+		{"nil", nil, false},
+		{"empty", &ipn.ServeConfig{}, false},
+		{
+			name: "background_web",
+			sc: &ipn.ServeConfig{
+				Web: map[ipn.HostPort]*ipn.WebServerConfig{
+					"node.ts.net:443": {},
+				},
+			},
+			want: true,
+		},
+		{
+			name: "tcp_forward_no_tls",
+			sc: &ipn.ServeConfig{
+				TCP: map[uint16]*ipn.TCPPortHandler{443: {TCPForward: "127.0.0.1:443"}},
+			},
+			want: false,
+		},
+		{
+			name: "tls_terminated_tcp",
+			sc: &ipn.ServeConfig{
+				TCP: map[uint16]*ipn.TCPPortHandler{
+					443: {TCPForward: "127.0.0.1:443", TerminateTLS: "node.ts.net"},
+				},
+			},
+			want: true,
+		},
+		{
+			name: "service_tls_terminated_tcp",
+			sc: &ipn.ServeConfig{
+				Services: map[tailcfg.ServiceName]*ipn.ServiceConfig{
+					"svc:web": {
+						TCP: map[uint16]*ipn.TCPPortHandler{
+							443: {TCPForward: "127.0.0.1:443", TerminateTLS: "web.svc.ts.net"},
+						},
+					},
+				},
+			},
+			want: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var v ipn.ServeConfigView
+			if tt.sc != nil {
+				v = tt.sc.View()
+			}
+			if got := serveConfigUsesACMECerts(v); got != tt.want {
+				t.Errorf("serveConfigUsesACMECerts = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestRefreshApplicableCerts(t *testing.T) {
+	const (
+		certDomain = "node1.example.com"
+		byoDomain  = "byo.example.org"
+	)
+	b := ipnlocaltest.NewBackend(t)
+	b.SetVarRoot(t.TempDir())
+	e := extOf(t, b)
+
+	b.ForTest().SetNetMap(&netmap.NetworkMap{
+		SelfNode: (&tailcfg.Node{}).View(),
+		DNS: tailcfg.DNSConfig{
+			CertDomains: []string{certDomain},
+		},
+	})
+	b.ForTest().SetServeConfig((&ipn.ServeConfig{
+		Web: map[ipn.HostPort]*ipn.WebServerConfig{
+			ipn.HostPort(certDomain + ":443"): {},
+			ipn.HostPort(byoDomain + ":443"):  {},
+			// Not in CertDomains and no Funnel entry; must be filtered out.
+			ipn.HostPort("not-ours.other.tld:443"): {},
+		},
+		AllowFunnel: map[ipn.HostPort]bool{
+			ipn.HostPort(byoDomain + ":443"): true,
+		},
+	}).View())
+
+	gotCh := make(chan string, 4)
+	b.ForTest().ConfigureCerts(func(host string) (*ipnlocal.TLSCertKeyPair, error) {
+		gotCh <- host
+		return &ipnlocal.TLSCertKeyPair{}, nil
+	})
+
+	e.refreshApplicableCerts(context.Background(), b)
+
+	want := set.Of(certDomain, byoDomain)
+	got := set.Set[string]{}
+	for got.Len() < want.Len() {
+		select {
+		case h := <-gotCh:
+			got.Add(h)
+		case <-time.After(5 * time.Second):
+			t.Fatalf("timed out waiting for refresh workers; got %v, want %v", got, want)
+		}
+	}
+	if !maps.Equal(got, want) {
+		t.Errorf("got fetches %v, want %v", got, want)
+	}
+	select {
+	case h := <-gotCh:
+		t.Errorf("unexpected extra fetch for %q", h)
+	default:
+	}
+}
+
+// TestLockDomain_SameDomainReturnsSameMutex verifies the repeat
+// calls for the same domain return the same mutex, and different
+// domains get distinct mutexes.
+func TestLockDomain_SameDomainReturnsSameMutex(t *testing.T) {
+	const domA, domB = "a.example.com", "b.example.com"
+	e := &extension{}
+	a1 := e.lockDomain(domA)
+	a2 := e.lockDomain(domA)
+	b := e.lockDomain(domB)
+	if a1 != a2 {
+		t.Errorf("lockDomain(%q) second call = %p, want %p", domA, a2, a1)
+	}
+	if a1 == b {
+		t.Errorf("lockDomain(%q) = lockDomain(%q) = %p, want different", domA, domB, a1)
+	}
+}
+
+// TestLockDomain_PerDomainConcurrency verifies a lock on one
+// domain doesn't block another, and the same domain blocks while held
+// and is acquireable again after release.
+func TestLockDomain_PerDomainConcurrency(t *testing.T) {
+	const domA, domB = "a.example.com", "b.example.com"
+	e := &extension{}
+
+	aLock := e.lockDomain(domA)
+	aLock.Lock()
+
+	bLock := e.lockDomain(domB)
+	if !bLock.TryLock() {
+		t.Errorf("lockDomain(%q).TryLock() = false while %q held, want true", domB, domA)
+	} else {
+		bLock.Unlock()
+	}
+
+	if aLock.TryLock() {
+		t.Errorf("lockDomain(%q).TryLock() = true while held, want false", domA)
+	}
+
+	aLock.Unlock()
+
+	if !aLock.TryLock() {
+		t.Errorf("lockDomain(%q).TryLock() = false after release, want true", domA)
+	}
+	aLock.Unlock()
+}
+
+// TestAcmeKey_ConcurrentFirstCall verifies that N goroutines racing on
+// an empty store all return the key that ends up persisted.
+func TestAcmeKey_ConcurrentFirstCall(t *testing.T) {
+	e := &extension{}
+	cs := certStateStore{StateStore: new(mem.Store)}
+
+	const n = 16
+	type result struct {
+		key crypto.Signer
+		err error
+	}
+	results := make(chan result, n)
+	var start sync.WaitGroup
+	start.Add(1)
+	for range n {
+		go func() {
+			start.Wait()
+			k, err := e.acmeKey(cs)
+			results <- result{k, err}
+		}()
+	}
+	start.Done()
+
+	var keys []crypto.Signer
+	for range n {
+		r := <-results
+		if r.err != nil {
+			t.Fatalf("acmeKey: %v", r.err)
+		}
+		keys = append(keys, r.key)
+	}
+
+	persisted, err := cs.ACMEKey()
+	if err != nil {
+		t.Fatalf("cs.ACMEKey after race: %v", err)
+	}
+	block, _ := pem.Decode(persisted)
+	if block == nil {
+		t.Fatal("no PEM block in persisted ACME key")
+	}
+	want, err := parsePrivateKey(block.Bytes)
+	if err != nil {
+		t.Fatalf("parsing persisted key: %v", err)
+	}
+	wantPub, err := x509.MarshalPKIXPublicKey(want.Public())
+	if err != nil {
+		t.Fatalf("marshaling persisted pubkey: %v", err)
+	}
+	for i, k := range keys {
+		gotPub, err := x509.MarshalPKIXPublicKey(k.Public())
+		if err != nil {
+			t.Fatalf("marshaling returned key %d: %v", i, err)
+		}
+		if !bytes.Equal(gotPub, wantPub) {
+			t.Errorf("goroutine %d returned a different account key than the persisted one", i)
+		}
+	}
+}
diff --git a/feature/acme/certstore.go b/feature/acme/certstore.go
new file mode 100644
index 000000000..563acdca0
--- /dev/null
+++ b/feature/acme/certstore.go
@@ -0,0 +1,486 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package acme
+
+import (
+	"bytes"
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"time"
+
+	"tailscale.com/atomicfile"
+	"tailscale.com/envknob"
+	"tailscale.com/feature/buildfeatures"
+	"tailscale.com/hostinfo"
+	"tailscale.com/ipn"
+	"tailscale.com/ipn/ipnlocal"
+	"tailscale.com/ipn/store"
+	"tailscale.com/ipn/store/mem"
+	"tailscale.com/net/bakedroots"
+	xacme "tailscale.com/tempfork/acme"
+	"tailscale.com/util/testenv"
+	"tailscale.com/version"
+	"tailscale.com/version/distro"
+)
+
+// certStore provides a way to perist and retrieve TLS certificates.
+// As of 2023-02-01, we store certs in directories on disk everywhere
+// except on Kubernetes, where we use the state store.
+type certStore interface {
+	// Read returns the cert and key for domain, if they exist and are valid
+	// for now. If they're expired, it returns errCertExpired.
+	// If they don't exist, it returns ipn.ErrStateNotExist.
+	Read(domain string, now time.Time) (*ipnlocal.TLSCertKeyPair, error)
+	// ACMEKey returns the value previously stored via WriteACMEKey.
+	// It is a PEM encoded ECDSA key.
+	ACMEKey() ([]byte, error)
+	// WriteACMEKey stores the provided PEM encoded ECDSA key.
+	WriteACMEKey([]byte) error
+	// WriteTLSCertAndKey writes the cert and key for domain.
+	WriteTLSCertAndKey(domain string, cert, key []byte) error
+}
+
+var errCertExpired = errors.New("cert expired")
+
+var testX509Roots *x509.CertPool // set non-nil by tests
+
+// certDir returns (creating if needed) the directory in which cached
+// cert keypairs are stored.
+func certDir(b *ipnlocal.LocalBackend) (string, error) {
+	d := b.TailscaleVarRoot()
+
+	// As a workaround for Synology DSM6 not having a "var" directory, use the
+	// app's "etc" directory (on a small partition) to hold certs at least.
+	// See https://github.com/tailscale/tailscale/issues/4060#issuecomment-1186592251
+	if buildfeatures.HasSynology && d == "" && runtime.GOOS == "linux" && distro.Get() == distro.Synology && distro.DSMVersion() == 6 {
+		d = "/var/packages/Tailscale/etc" // base; we append "certs" below
+	}
+	if d == "" {
+		return "", errors.New("no TailscaleVarRoot")
+	}
+	full := filepath.Join(d, "certs")
+	if err := os.MkdirAll(full, 0700); err != nil {
+		return "", err
+	}
+	return full, nil
+}
+
+func (e *extension) getCertStore(b *ipnlocal.LocalBackend) (certStore, error) {
+	st := b.Sys().StateStore.Get()
+	if runtime.GOOS == "js" {
+		// No filesystem to hold a cert directory; the state store is all we have.
+		return certStateStore{StateStore: st}, nil
+	}
+	switch st.(type) {
+	case *store.FileStore:
+	case *mem.Store:
+	default:
+		if hostinfo.GetEnvType() == hostinfo.Kubernetes {
+			// We're running in Kubernetes with a custom StateStore,
+			// use that instead of the cert directory.
+			// TODO(maisem): expand this to other environments?
+			return certStateStore{StateStore: st}, nil
+		}
+	}
+	dir, err := certDir(b)
+	if err != nil {
+		return nil, err
+	}
+	if testX509Roots != nil && !testenv.InTest() {
+		panic("use of test hook outside of tests")
+	}
+	return certFileStore{dir: dir, testRoots: testX509Roots}, nil
+}
+
+// certFileStore implements certStore by storing the cert & key files in
+// the named directory.
+type certFileStore struct {
+	dir string
+
+	// This field allows a test to override the CA root(s) for certificate
+	// verification. If nil the default system pool is used.
+	testRoots *x509.CertPool
+}
+
+const acmePEMName = "acme-account.key.pem"
+
+func (f certFileStore) ACMEKey() ([]byte, error) {
+	pemName := filepath.Join(f.dir, acmePEMName)
+	v, err := os.ReadFile(pemName)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, ipn.ErrStateNotExist
+		}
+		return nil, err
+	}
+	return v, nil
+}
+
+func (f certFileStore) WriteACMEKey(b []byte) error {
+	pemName := filepath.Join(f.dir, acmePEMName)
+	return atomicfile.WriteFile(pemName, b, 0600)
+}
+
+func (f certFileStore) Read(domain string, now time.Time) (*ipnlocal.TLSCertKeyPair, error) {
+	certPEM, err := os.ReadFile(certFile(f.dir, domain))
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, ipn.ErrStateNotExist
+		}
+		return nil, err
+	}
+	keyPEM, err := os.ReadFile(keyFile(f.dir, domain))
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, ipn.ErrStateNotExist
+		}
+		return nil, err
+	}
+	if !validCertPEM(domain, keyPEM, certPEM, f.testRoots, now) {
+		return nil, errCertExpired
+	}
+	return &ipnlocal.TLSCertKeyPair{CertPEM: certPEM, KeyPEM: keyPEM, Cached: true}, nil
+}
+
+func (f certFileStore) WriteCert(domain string, cert []byte) error {
+	return atomicfile.WriteFile(certFile(f.dir, domain), cert, 0644)
+}
+
+func (f certFileStore) WriteKey(domain string, key []byte) error {
+	return atomicfile.WriteFile(keyFile(f.dir, domain), key, 0600)
+}
+
+func (f certFileStore) WriteTLSCertAndKey(domain string, cert, key []byte) error {
+	if err := f.WriteKey(domain, key); err != nil {
+		return err
+	}
+	return f.WriteCert(domain, cert)
+}
+
+// certStateStore implements certStore by storing the cert & key files
+// in an ipn.StateStore.
+type certStateStore struct {
+	ipn.StateStore
+
+	// This field allows a test to override the CA root(s) for certificate
+	// verification. If nil the default system pool is used.
+	testRoots *x509.CertPool
+}
+
+// TLSCertKeyReader is an interface implemented by state stores where it
+// makes sense to read the TLS cert and key in a single operation that
+// can be distinguished from generic state value reads. Currently this
+// is only implemented by the kubestore.Store, which, in some cases,
+// needs to read cert and key from a non-cached TLS Secret.
+type TLSCertKeyReader interface {
+	ReadTLSCertAndKey(domain string) ([]byte, []byte, error)
+}
+
+// ARIReplacesAllower is optionally implemented by state stores to opt
+// out of the ARI "replaces" hint on a per-domain basis at renewal time.
+// When implemented and returning false, the renewal path submits a plain
+// newOrder instead of claiming renewal exemption via "replaces".
+//
+// Used by the k8s cert-share store to prevent submitting a "replaces"
+// claim that Let's Encrypt would reject because the current ACME
+// account did not issue the previous cert (which can happen when a
+// shared per-tailnet account key is adopted after a cert was already
+// issued by a per-pod account). See #18251.
+type ARIReplacesAllower interface {
+	// ShouldUseARIReplacesForRenewal reports whether the renewal order
+	// for domain should carry the ARI "replaces" hint. It is advisory:
+	// a non-nil error means eligibility could not be determined, not
+	// that the hint should be skipped, and callers fail open (use the
+	// hint) in that case.
+	ShouldUseARIReplacesForRenewal(domain string) (bool, error)
+}
+
+func (s certStateStore) Read(domain string, now time.Time) (*ipnlocal.TLSCertKeyPair, error) {
+	// If we're using a store that supports atomic reads, use that
+	if kr, ok := s.StateStore.(TLSCertKeyReader); ok {
+		cert, key, err := kr.ReadTLSCertAndKey(domain)
+		if err != nil {
+			return nil, err
+		}
+		if !validCertPEM(domain, key, cert, s.testRoots, now) {
+			return nil, errCertExpired
+		}
+		return &ipnlocal.TLSCertKeyPair{CertPEM: cert, KeyPEM: key, Cached: true}, nil
+	}
+
+	// Otherwise fall back to separate reads
+	certPEM, err := s.ReadState(ipn.StateKey(domain + ".crt"))
+	if err != nil {
+		return nil, err
+	}
+	keyPEM, err := s.ReadState(ipn.StateKey(domain + ".key"))
+	if err != nil {
+		return nil, err
+	}
+	if !validCertPEM(domain, keyPEM, certPEM, s.testRoots, now) {
+		return nil, errCertExpired
+	}
+	return &ipnlocal.TLSCertKeyPair{CertPEM: certPEM, KeyPEM: keyPEM, Cached: true}, nil
+}
+
+// ShouldUseARIReplacesForRenewal delegates to the underlying state store
+// if it implements [ARIReplacesAllower]. Stores that don't opt in default
+// to true (attempt "replaces"), preserving the pre-hook behaviour.
+func (s certStateStore) ShouldUseARIReplacesForRenewal(domain string) (bool, error) {
+	if a, ok := s.StateStore.(ARIReplacesAllower); ok {
+		return a.ShouldUseARIReplacesForRenewal(domain)
+	}
+	return true, nil
+}
+
+func (s certStateStore) WriteCert(domain string, cert []byte) error {
+	return ipn.WriteState(s.StateStore, ipn.StateKey(domain+".crt"), cert)
+}
+
+func (s certStateStore) WriteKey(domain string, key []byte) error {
+	return ipn.WriteState(s.StateStore, ipn.StateKey(domain+".key"), key)
+}
+
+func (s certStateStore) ACMEKey() ([]byte, error) {
+	return s.ReadState(ipn.StateKey(acmePEMName))
+}
+
+func (s certStateStore) WriteACMEKey(key []byte) error {
+	return ipn.WriteState(s.StateStore, ipn.StateKey(acmePEMName), key)
+}
+
+// TLSCertKeyWriter is an interface implemented by state stores that can
+// write the TLS cert and key in a single atomic operation. Currently
+// this is only implemented by the kubestore.StoreKube.
+type TLSCertKeyWriter interface {
+	WriteTLSCertAndKey(domain string, cert, key []byte) error
+}
+
+// WriteTLSCertAndKey writes the TLS cert and key for domain to the
+// current LocalBackend's StateStore.
+func (s certStateStore) WriteTLSCertAndKey(domain string, cert, key []byte) error {
+	// If we're using a store that supports atomic writes, use that.
+	if aw, ok := s.StateStore.(TLSCertKeyWriter); ok {
+		return aw.WriteTLSCertAndKey(domain, cert, key)
+	}
+	// Otherwise fall back to separate writes for cert and key.
+	if err := s.WriteKey(domain, key); err != nil {
+		return err
+	}
+	return s.WriteCert(domain, cert)
+}
+
+func keyFile(dir, domain string) string {
+	return filepath.Join(dir, strings.Replace(domain, "*.", "wildcard_.", 1)+".key")
+}
+func certFile(dir, domain string) string {
+	return filepath.Join(dir, strings.Replace(domain, "*.", "wildcard_.", 1)+".crt")
+}
+
+// getCertPEMCached returns a non-nil keyPair if a cached keypair for
+// domain exists in the certStore that is valid at the provided now time.
+//
+// If the keypair is expired, it returns errCertExpired.
+// If the keypair doesn't exist, it returns ipn.ErrStateNotExist.
+func getCertPEMCached(cs certStore, domain string, now time.Time) (p *ipnlocal.TLSCertKeyPair, err error) {
+	if !validLookingCertDomain(domain) {
+		// Before we read files from disk using it, validate it's halfway
+		// reasonable looking.
+		return nil, fmt.Errorf("invalid domain %q", domain)
+	}
+	return cs.Read(domain, now)
+}
+
+// certRequest generates a CSR for the given domain and optional SANs.
+func certRequest(key crypto.Signer, domain string, ext []pkix.Extension) ([]byte, error) {
+	dnsNames := []string{domain}
+	if base, ok := strings.CutPrefix(domain, "*."); ok {
+		// Wildcard cert must also include the base domain as a SAN.
+		// This is load-bearing: getCertPEMCached validates certs using
+		// the storage key (base domain), which only passes x509 verification
+		// if the base domain is in DNSNames.
+		dnsNames = append(dnsNames, base)
+	}
+	req := &x509.CertificateRequest{
+		Subject:         pkix.Name{CommonName: domain},
+		DNSNames:        dnsNames,
+		ExtraExtensions: ext,
+	}
+	return x509.CreateCertificateRequest(rand.Reader, req, key)
+}
+
+func encodeECDSAKey(w io.Writer, key *ecdsa.PrivateKey) error {
+	b, err := x509.MarshalECPrivateKey(key)
+	if err != nil {
+		return err
+	}
+	pb := &pem.Block{Type: "EC PRIVATE KEY", Bytes: b}
+	return pem.Encode(w, pb)
+}
+
+// parsePrivateKey is a copy of x/crypto/acme's parsePrivateKey.
+//
+// Attempt to parse the given private key DER block. OpenSSL 0.9.8
+// generates PKCS#1 private keys by default, while OpenSSL 1.0.0
+// generates PKCS#8 keys. OpenSSL ecparam generates SEC1 EC private keys
+// for ECDSA. We try all three.
+//
+// Inspired by parsePrivateKey in crypto/tls/tls.go.
+func parsePrivateKey(der []byte) (crypto.Signer, error) {
+	if key, err := x509.ParsePKCS1PrivateKey(der); err == nil {
+		return key, nil
+	}
+	if key, err := x509.ParsePKCS8PrivateKey(der); err == nil {
+		switch key := key.(type) {
+		case *rsa.PrivateKey:
+			return key, nil
+		case *ecdsa.PrivateKey:
+			return key, nil
+		default:
+			return nil, errors.New("acme/autocert: unknown private key type in PKCS#8 wrapping")
+		}
+	}
+	if key, err := x509.ParseECPrivateKey(der); err == nil {
+		return key, nil
+	}
+
+	return nil, errors.New("acme/autocert: failed to parse private key")
+}
+
+func (e *extension) acmeKey(cs certStore) (crypto.Signer, error) {
+	// Lock so two callers don't both generate a key and race on the
+	// write.
+	e.accountMu.Lock()
+	defer e.accountMu.Unlock()
+
+	if v, err := cs.ACMEKey(); err == nil {
+		priv, _ := pem.Decode(v)
+		if priv == nil || !strings.Contains(priv.Type, "PRIVATE") {
+			return nil, errors.New("acme/autocert: invalid account key found in cache")
+		}
+		return parsePrivateKey(priv.Bytes)
+	} else if !errors.Is(err, ipn.ErrStateNotExist) {
+		return nil, err
+	}
+
+	privKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		return nil, err
+	}
+	var pemBuf bytes.Buffer
+	if err := encodeECDSAKey(&pemBuf, privKey); err != nil {
+		return nil, err
+	}
+	if err := cs.WriteACMEKey(pemBuf.Bytes()); err != nil {
+		return nil, err
+	}
+	return privKey, nil
+}
+
+func (e *extension) acmeClient(cs certStore) (*xacme.Client, error) {
+	key, err := e.acmeKey(cs)
+	if err != nil {
+		return nil, fmt.Errorf("acmeKey: %w", err)
+	}
+	// Note: if we add support for additional ACME providers (other than
+	// LetsEncrypt), we should make sure that they support ARI extension (see
+	// shouldStartDomainRenewalARI).
+	e.mu.Lock()
+	httpClient := e.httpClient
+	e.mu.Unlock()
+	return &xacme.Client{
+		Key:          key,
+		UserAgent:    "tailscaled/" + version.Long(),
+		DirectoryURL: envknob.String("TS_DEBUG_ACME_DIRECTORY_URL"),
+		HTTPClient:   httpClient,
+	}, nil
+}
+
+// validCertPEM reports whether the given certificate is valid for
+// domain at now.
+//
+// If roots != nil, it is used instead of the system root pool. This is
+// meant to support testing; production code should pass roots == nil.
+func validCertPEM(domain string, keyPEM, certPEM []byte, roots *x509.CertPool, now time.Time) bool {
+	if len(keyPEM) == 0 || len(certPEM) == 0 {
+		return false
+	}
+	tlsCert, err := tls.X509KeyPair(certPEM, keyPEM)
+	if err != nil {
+		return false
+	}
+
+	var leaf *x509.Certificate
+	intermediates := x509.NewCertPool()
+	for i, certDER := range tlsCert.Certificate {
+		cert, err := x509.ParseCertificate(certDER)
+		if err != nil {
+			return false
+		}
+		if i == 0 {
+			leaf = cert
+		} else {
+			intermediates.AddCert(cert)
+		}
+	}
+	return validateLeaf(leaf, intermediates, domain, now, roots)
+}
+
+// validateLeaf is a helper for [validCertPEM].
+//
+// If called with roots == nil, it will use the system root pool as well
+// as the baked-in roots. If non-nil, only those roots are used.
+func validateLeaf(leaf *x509.Certificate, intermediates *x509.CertPool, domain string, now time.Time, roots *x509.CertPool) bool {
+	if leaf == nil {
+		return false
+	}
+	_, err := leaf.Verify(x509.VerifyOptions{
+		DNSName:       domain,
+		CurrentTime:   now,
+		Roots:         roots,
+		Intermediates: intermediates,
+	})
+	if err != nil && roots == nil {
+		// If validation failed and they specified nil for roots (meaning to use
+		// the system roots), then give it another chance to validate using the
+		// binary's baked-in roots (LetsEncrypt). See tailscale/tailscale#14690.
+		return validateLeaf(leaf, intermediates, domain, now, bakedroots.Get())
+	}
+
+	if err == nil {
+		return true
+	}
+
+	// When pointed at a non-prod ACME server, we don't expect to have the CA
+	// in our system or baked-in roots. Verify only throws UnknownAuthorityError
+	// after first checking the leaf cert's expiry, hostnames etc, so we know
+	// that the only reason for an error is to do with constructing a full chain.
+	// Allow this error so that cert caching still works in testing environments.
+	if errors.As(err, &x509.UnknownAuthorityError{}) {
+		acmeURL := envknob.String("TS_DEBUG_ACME_DIRECTORY_URL")
+		if !isDefaultDirectoryURL(acmeURL) {
+			return true
+		}
+	}
+
+	return false
+}
+
+func isDefaultDirectoryURL(u string) bool {
+	return u == "" || u == xacme.LetsEncryptURL
+}
diff --git a/feature/acme/errors.go b/feature/acme/errors.go
new file mode 100644
index 000000000..c77b38f3b
--- /dev/null
+++ b/feature/acme/errors.go
@@ -0,0 +1,36 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package acme
+
+import (
+	"net/http"
+	"strconv"
+	"time"
+
+	"tailscale.com/tsweb"
+)
+
+// certRateLimitedError is returned when the upstream ACME CA rate-limited
+// the issuance. It exists so cert-fetching failures can surface as HTTP
+// 429 responses via [tsweb.HTTPStatuser].
+type certRateLimitedError struct {
+	retryAfter time.Duration
+	underlying error
+}
+
+func (e certRateLimitedError) Error() string { return e.underlying.Error() }
+func (e certRateLimitedError) Unwrap() error { return e.underlying }
+
+// HTTPStatus implements [tsweb.HTTPStatuser].
+func (e certRateLimitedError) HTTPStatus() tsweb.HTTPError {
+	h := http.Header{}
+	if e.retryAfter > 0 {
+		h.Set("Retry-After", strconv.Itoa(int(e.retryAfter.Seconds())))
+	}
+	return tsweb.HTTPError{
+		Code:   http.StatusTooManyRequests,
+		Msg:    e.Error(),
+		Header: h,
+	}
+}
diff --git a/feature/acme/refresh.go b/feature/acme/refresh.go
new file mode 100644
index 000000000..4e8bd9355
--- /dev/null
+++ b/feature/acme/refresh.go
@@ -0,0 +1,154 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package acme
+
+import (
+	"context"
+	"net"
+	"time"
+
+	"tailscale.com/envknob"
+	"tailscale.com/ipn"
+	"tailscale.com/ipn/ipnlocal"
+	"tailscale.com/util/set"
+)
+
+// certRefreshInterval is how often the background loop iterates the set
+// of applicable cert domains and pokes the renewal machinery. The loop
+// is only started while there's at least one HTTPS Web entry in the
+// ServeConfig, so this cadence doesn't tick on idle/mobile nodes.
+const certRefreshInterval = time.Hour
+
+// updateCertRefreshLoop starts or stops the background TLS cert refresh
+// loop based on whether the backend currently has any HTTPS-serving
+// hostname whose cert should be kept fresh. The loop runs only while:
+//
+//   - the node is in [ipn.Running], and
+//   - the current [ipn.ServeConfig] has at least one HTTPS-serving entry.
+//
+// We deliberately don't keep an idle timer around on hosts that have no
+// certs to maintain (e.g. mobile devices that never run Serve), so this
+// is called whenever any of those inputs change: state transitions and
+// ServeConfig reloads. The caller (in [ipn/ipnlocal]) holds b.mu when
+// invoking this; we use our own e.mu for the refresh-loop bookkeeping.
+func (e *extension) updateCertRefreshLoop(b *ipnlocal.LocalBackend, state ipn.State, sc ipn.ServeConfigView) {
+	shouldRun := state == ipn.Running && serveConfigUsesACMECerts(sc)
+
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	switch {
+	case shouldRun && e.certRefreshCancel == nil:
+		ctx, cancel := context.WithCancel(context.Background())
+		e.certRefreshCancel = cancel
+		e.Go(func() { e.certRefreshLoop(ctx, b) })
+	case !shouldRun && e.certRefreshCancel != nil:
+		e.certRefreshCancel()
+		e.certRefreshCancel = nil
+	}
+}
+
+// certRefreshLoop periodically iterates the domains configured for
+// Serve or Funnel HTTPS and calls GetCertPEM on each. The existing
+// renewal machinery in getCertPEM decides whether anything needs to
+// happen (ARI check or expiry-based fallback); the loop just ensures
+// it runs even on nodes that see no inbound TLS traffic.
+//
+// The first iteration runs immediately so that a node coming back
+// online with stale or absent certs starts ACME within seconds rather
+// than waiting a full interval.
+func (e *extension) certRefreshLoop(ctx context.Context, b *ipnlocal.LocalBackend) {
+	if envknob.IsCertShareReadOnlyMode() {
+		b.Logger()("cert refresh loop: cert-share read-only mode; loop is a no-op")
+		return
+	}
+
+	ticker, tickerCh := b.Clock().NewTicker(certRefreshInterval)
+	defer ticker.Stop()
+	for {
+		e.refreshApplicableCerts(ctx, b)
+		select {
+		case <-tickerCh:
+		case <-ctx.Done():
+			return
+		}
+	}
+}
+
+// refreshApplicableCerts is one iteration of the cert refresh loop.
+//
+// It enumerates the Serve/Funnel-configured HTTPS hostnames, keeps
+// those that resolveCertDomain accepts (CertDomain, wildcard, or BYO
+// Funnel domain), and calls [LocalBackend.GetCertPEM] for each. The
+// renewal decision is delegated to the existing logic in getCertPEM.
+func (e *extension) refreshApplicableCerts(ctx context.Context, b *ipnlocal.LocalBackend) {
+	sc := b.ServeConfig()
+	if !sc.Valid() {
+		return
+	}
+
+	want := set.Set[string]{}
+	consider := func(host string) {
+		if host == "" {
+			return
+		}
+		if _, err := e.resolveCertDomain(b, host); err != nil {
+			return
+		}
+		want.Add(host)
+	}
+	for hp := range sc.Webs() {
+		host, _, err := net.SplitHostPort(string(hp))
+		if err != nil {
+			continue
+		}
+		consider(host)
+	}
+	for _, tcp := range sc.TCPs() {
+		consider(tcp.TerminateTLS())
+	}
+	for _, svc := range sc.Services().All() {
+		for _, tcp := range svc.TCP().All() {
+			consider(tcp.TerminateTLS())
+		}
+	}
+	if want.Len() == 0 {
+		return
+	}
+
+	for d := range want {
+		e.Go(func() {
+			ctx, cancel := context.WithTimeout(ctx, 2*time.Minute)
+			defer cancel()
+			if _, err := e.getCertPEMWithValidity(ctx, b, d, 0); err != nil {
+				b.Logger()("cert refresh: %s: %v", d, err)
+			}
+		})
+	}
+}
+
+// serveConfigUsesACMECerts reports whether sc has any entry that
+// causes tailscaled to obtain ACME-managed TLS certs: an HTTPS Web
+// entry (background, foreground, or service) or a TCP handler with
+// TerminateTLS set (`tailscale serve --tls-terminated-tcp`).
+func serveConfigUsesACMECerts(sc ipn.ServeConfigView) bool {
+	if !sc.Valid() {
+		return false
+	}
+	for range sc.Webs() {
+		return true
+	}
+	for _, tcp := range sc.TCPs() {
+		if tcp.TerminateTLS() != "" {
+			return true
+		}
+	}
+	for _, svc := range sc.Services().All() {
+		for _, tcp := range svc.TCP().All() {
+			if tcp.TerminateTLS() != "" {
+				return true
+			}
+		}
+	}
+	return false
+}
diff --git a/feature/acme/testdata/example.com-key.pem b/feature/acme/testdata/example.com-key.pem
new file mode 100644
index 000000000..06902f4c9
--- /dev/null
+++ b/feature/acme/testdata/example.com-key.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCejQaJrntrJSgE
+QtScyTU6TXOU+v1FdFjrsyHFK5mjV1C5pVQxnLn93GRshtIrGOLLrd3Wv2TVYZOX
+xH7f1ZLFbneDURCXbS+7nmsg+TLHRSRKfODbE3oYZj7NSJ163CCvwSJKTdmLpXbn
+ui9F04tyk0zxO4Wre4ukwf6xtse8G5zl2RJrueiVAiouTG/pJdIS08dGQa0GM1n9
+Aesa+TerlZcpRZR6X402yQqa8q/QqbIuzrlfDmgOb8sm6T8+JMtj3hEvnYdpMVOg
+w/XiTlX0v/YrB9sVQ9XnqGsqwTL0OMG0choMNKipwLi2n+XPSCIiRhi666zNNivE
+K1qaPS5RAgMBAAECggEAV9dAGQWPISR70CiKjLa5A60nbRHFQjackTE0c32daC6W
+7dOYGsh/DxOMm8fyJqhp9nhEYJa3MbUWxU27ER3NbA6wrhM6gvqeKG8zYRhPNrGq
+0o3vMdDPozb6cldZ0Fimz1jMO6h373NjtiyjxibWqkrLpRbaDtCq5EQKbMEcVa2D
+Xt5hxCOaCA3OZ/mAcGUNFmDNgNsGP/r6eXdI5pbqnUNMPkv/JsHl8h2HuyKUm4hf
+TRnXPAak6DkUod9QXYFKVBVPa5pjiO09e0aiMUvJ8vYd/6bNIsAKWLPa1PYuUE2l
+kg8Nik+P/XLzffKsLxiFKY0nCqrorM9K5q7baofGdQKBgQDPujjebFg6OKw6MS3S
+PESopvL//C/XgtgifcSSZCWzIZRVBVTbbJCGRtqFzF0XO4YRX3EOAyD/L7wYUPzO
++W3AU2W3/DVJYdcm2CASABbHNy0kk52LI0HHAssbFDgyB9XuuWP+vVZk7B5OmCAD
+Bppuj6Mnu03i282nKNJzvRiVnwKBgQDDZUXv22K8y7GkKw/ZW/wQP2zBNtFc15he
+1EOyUGHlXuQixnDSaqonkwec6IOlo7Sx/vwO/7+v4Jzc24Wq3DFAmMu/EYJgvI+m
+m3kpB4H7Xus4JqnhxqN7GB7zOdguCWZF1HLemZNZlVrUjG5mQ9cizzvvYptnQDLq
+FEJ1hddWDwKBgB+vy276Xfb7oCH8UH4KXXrQhK7RvEaGmgug3bRq/Gk3zRWvC4Ox
+KtagxkK0qtqZZNkPkwJNLeJfWLTo3beAyuIUlqabHVHFT/mH7FRymQbofsVekyCf
+TzBZV7wYuH3BPjv9IajBHwWkEvdwMyni/vmwhXXRF49schF2o6uuA6sHAoGBAL1J
+Xnb+EKjUq0JedPwcIBOdXb3PXQKT2QgEmZAkTrHlOxx1INa2fh/YT4ext9a+wE2u
+tn/RQeEfttY90z+yEASEAN0YGTWddYvxEW6t1z2stjGvQuN1ium0dEcrwkDW2jzL
+knwSSqx+A3/kiw6GqeMO3wEIhYOArdIVzkwLXJABAoGAOXLGhz5u5FWjF3zAeYme
+uHTU/3Z3jeI80PvShGrgAakPOBt3cIFpUaiOEslcqqgDUSGE3EnmkRqaEch+UapF
+ty6Zz7cKjXhQSWOjew1uUW2ANNEpsnYbmZOOnfvosd7jfHSVbL6KIhWmIdC6h0NP
+c/bJnTXEEVsWjLZTwYaq0Us=
+-----END PRIVATE KEY-----
\ No newline at end of file
diff --git a/feature/acme/testdata/example.com.pem b/feature/acme/testdata/example.com.pem
new file mode 100644
index 000000000..588850813
--- /dev/null
+++ b/feature/acme/testdata/example.com.pem
@@ -0,0 +1,26 @@
+-----BEGIN CERTIFICATE-----
+MIIEcDCCAtigAwIBAgIRAPmUKRkyFAkVVxFblB/233cwDQYJKoZIhvcNAQELBQAw
+gZ8xHjAcBgNVBAoTFW1rY2VydCBkZXZlbG9wbWVudCBDQTE6MDgGA1UECwwxZnJv
+bWJlcmdlckBzdGFyZHVzdC5sb2NhbCAoTWljaGFlbCBKLiBGcm9tYmVyZ2VyKTFB
+MD8GA1UEAww4bWtjZXJ0IGZyb21iZXJnZXJAc3RhcmR1c3QubG9jYWwgKE1pY2hh
+ZWwgSi4gRnJvbWJlcmdlcikwHhcNMjMwMjA3MjAzNDE4WhcNMjUwNTA3MTkzNDE4
+WjBlMScwJQYDVQQKEx5ta2NlcnQgZGV2ZWxvcG1lbnQgY2VydGlmaWNhdGUxOjA4
+BgNVBAsMMWZyb21iZXJnZXJAc3RhcmR1c3QubG9jYWwgKE1pY2hhZWwgSi4gRnJv
+bWJlcmdlcikwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCejQaJrntr
+JSgEQtScyTU6TXOU+v1FdFjrsyHFK5mjV1C5pVQxnLn93GRshtIrGOLLrd3Wv2TV
+YZOXxH7f1ZLFbneDURCXbS+7nmsg+TLHRSRKfODbE3oYZj7NSJ163CCvwSJKTdmL
+pXbnui9F04tyk0zxO4Wre4ukwf6xtse8G5zl2RJrueiVAiouTG/pJdIS08dGQa0G
+M1n9Aesa+TerlZcpRZR6X402yQqa8q/QqbIuzrlfDmgOb8sm6T8+JMtj3hEvnYdp
+MVOgw/XiTlX0v/YrB9sVQ9XnqGsqwTL0OMG0choMNKipwLi2n+XPSCIiRhi666zN
+NivEK1qaPS5RAgMBAAGjYDBeMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUEDDAKBggr
+BgEFBQcDATAfBgNVHSMEGDAWgBTXyq2jQVrnqQKL8fB9C4L0QJftwDAWBgNVHREE
+DzANggtleGFtcGxlLmNvbTANBgkqhkiG9w0BAQsFAAOCAYEAQWzpOaBkRR4M+WqB
+CsT4ARyM6WpZ+jpeSblCzPdlDRW+50G1HV7K930zayq4DwncPY/SqSn0Q31WuzZv
+bTWHkWa+MLPGYANHsusOmMR8Eh16G4+5+GGf8psWa0npAYO35cuNkyyCCc1LEB4M
+NrzCB2+KZ+SyOdfCCA5VzEKN3I8wvVLaYovi24Zjwv+0uETG92TlZmLQRhj8uPxN
+deeLM45aBkQZSYCbGMDVDK/XYKBkNLn3kxD/eZeXxxr41v4pH44+46FkYcYJzdn8
+ccAg5LRGieqTozhLiXARNK1vTy6kR1l/Az8DIx6GN4sP2/LMFYFijiiOCDKS1wWA
+xQgZeHt4GIuBym+Kd+Z5KXcP0AT+47Cby3+B10Kq8vHwjTELiF0UFeEYYMdynPAW
+pbEwVLhsfMsBqFtj3dsxHr8Kz3rnarOYzkaw7EMZnLAthb2CN7y5uGV9imQC5RMI
+/qZdRSuCYZ3A1E/WJkGbPY/YdPql/IE+LIAgKGFHZZNftBCo
+-----END CERTIFICATE-----
\ No newline at end of file
diff --git a/feature/acme/testdata/rootCA.pem b/feature/acme/testdata/rootCA.pem
new file mode 100644
index 000000000..88a16f47a
--- /dev/null
+++ b/feature/acme/testdata/rootCA.pem
@@ -0,0 +1,30 @@
+-----BEGIN CERTIFICATE-----
+MIIFEDCCA3igAwIBAgIRANf5NdPojIfj70wMfJVYUg8wDQYJKoZIhvcNAQELBQAw
+gZ8xHjAcBgNVBAoTFW1rY2VydCBkZXZlbG9wbWVudCBDQTE6MDgGA1UECwwxZnJv
+bWJlcmdlckBzdGFyZHVzdC5sb2NhbCAoTWljaGFlbCBKLiBGcm9tYmVyZ2VyKTFB
+MD8GA1UEAww4bWtjZXJ0IGZyb21iZXJnZXJAc3RhcmR1c3QubG9jYWwgKE1pY2hh
+ZWwgSi4gRnJvbWJlcmdlcikwHhcNMjMwMjA3MjAzNDE4WhcNMzMwMjA3MjAzNDE4
+WjCBnzEeMBwGA1UEChMVbWtjZXJ0IGRldmVsb3BtZW50IENBMTowOAYDVQQLDDFm
+cm9tYmVyZ2VyQHN0YXJkdXN0LmxvY2FsIChNaWNoYWVsIEouIEZyb21iZXJnZXIp
+MUEwPwYDVQQDDDhta2NlcnQgZnJvbWJlcmdlckBzdGFyZHVzdC5sb2NhbCAoTWlj
+aGFlbCBKLiBGcm9tYmVyZ2VyKTCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoC
+ggGBAL5uXNnrZ6dgjcvK0Hc7ZNUIRYEWst9qbO0P9H7le08pJ6d9T2BUWruZtVjk
+Q12msv5/bVWHhVk8dZclI9FLXuMsIrocH8bsoP4wruPMyRyp6EedSKODN51fFSRv
+/jHbS5vzUVAWTYy9qYmd6qL0uhsHCZCCT6gfigamHPUFKM3sHDn5ZHWvySMwcyGl
+AicmPAIkBWqiCZAkB5+WM7+oyRLjmrIalfWIZYxW/rojGLwTfneHv6J5WjVQnpJB
+ayWCzCzaiXukK9MeBWeTOe8UfVN0Engd74/rjLWvjbfC+uZSr6RVkZvs2jANLwPF
+zgzBPHgRPfAhszU1NNAMjnNQ47+OMOTKRt7e6jYzhO5fyO1qVAAvGBqcfpj+JfDk
+cccaUMhUvdiGrhGf1V1tN/PislxvALirzcFipjD01isBKwn0fxRugzvJNrjEo8RA
+RvbcdeKcwex7M0o/Cd0+G2B13gZNOFvR33PmG7iTpp7IUrUKfQg28I83Sp8tMY3s
+ljJSawIDAQABo0UwQzAOBgNVHQ8BAf8EBAMCAgQwEgYDVR0TAQH/BAgwBgEB/wIB
+ADAdBgNVHQ4EFgQU18qto0Fa56kCi/HwfQuC9ECX7cAwDQYJKoZIhvcNAQELBQAD
+ggGBAAzs96LwZVOsRSlBdQqMo8oMAvs7HgnYbXt8SqaACLX3+kJ3cV/vrCE3iJrW
+ma4CiQbxS/HqsiZjota5m4lYeEevRnUDpXhp+7ugZTiz33Flm1RU99c9UYfQ+919
+ANPAKeqNpoPco/HF5Bz0ocepjcfKQrVZZNTj6noLs8o12FHBLO5976AcF9mqlNfh
+8/F0gDJXq6+x7VT5y8u0rY004XKPRe3CklRt8kpeMiP6mhRyyUehOaHeIbNx8ubi
+Pi44ByN/ueAnuRhF9zYtyZVZZOaSLysJge01tuPXF8rBXGruoJIv35xTTBa9BzaP
+YDOGbGn1ZnajdNagHqCba8vjTLDSpqMvgRj3TFrGHdETA2LDQat38uVxX8gxm68K
+va5Tyv7n+6BQ5YTpJjTPnmSJKaXZrrhdLPvG0OU2TxeEsvbcm5LFQofirOOw86Se
+vzF2cQ94mmHRZiEk0Av3NO0jF93ELDrBCuiccVyEKq6TknuvPQlutCXKDOYSEb8I
+MHctBg==
+-----END CERTIFICATE-----
\ No newline at end of file
diff --git a/feature/bird/bird.go b/feature/bird/bird.go
new file mode 100644
index 000000000..13b5fb065
--- /dev/null
+++ b/feature/bird/bird.go
@@ -0,0 +1,107 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package bird integrates Tailscale with the BIRD Internet Routing
+// Daemon: it enables the "tailscale" protocol in BIRD while this node
+// is a primary subnet router and disables it otherwise. The BIRD
+// client implementation lives in tailscale.com/chirp.
+package bird
+
+import (
+	"net/netip"
+
+	"tailscale.com/chirp"
+	"tailscale.com/feature"
+	"tailscale.com/tailcfg"
+	"tailscale.com/types/logger"
+	"tailscale.com/types/views"
+	"tailscale.com/wgengine"
+)
+
+func init() {
+	feature.Register("bird")
+	wgengine.HookNewBird.Set(newBird)
+}
+
+// protocolName is the name of the BIRD protocol that Tailscale enables
+// while this node is a primary subnet router.
+const protocolName = "tailscale"
+
+// bird implements [wgengine.Bird] on top of [chirp.BIRDClient],
+// tracking the primary subnet router state across engine
+// reconfigurations. One bird exists per engine.
+type bird struct {
+	logf   logger.Logf
+	client *chirp.BIRDClient
+
+	// The fields below are only accessed from Reconfig and
+	// ReconfigDone, which the engine serializes under its internal
+	// lock.
+
+	// isSubnetRouter is whether the last Reconfig found this node to
+	// be a primary subnet router.
+	isSubnetRouter bool
+	// lastIsSubnetRouter is the primary subnet router state last
+	// successfully applied to BIRD. ReconfigDone compares it against
+	// isSubnetRouter to decide whether to toggle the protocol.
+	lastIsSubnetRouter bool
+}
+
+func newBird(logf logger.Logf, socketPath string) (wgengine.Bird, error) {
+	logf("wgengine: connecting to BIRD at %s ...", socketPath)
+	client, err := chirp.New(socketPath)
+	if err != nil {
+		return nil, err
+	}
+	// Disable the protocol at start time; ReconfigDone enables it only
+	// once this node becomes a primary subnet router.
+	if err := client.DisableProtocol(protocolName); err != nil {
+		return nil, err
+	}
+	return &bird{logf: logf, client: client}, nil
+}
+
+func (b *bird) Reconfig(self tailcfg.NodeView) (changed bool) {
+	b.isSubnetRouter = false
+	if self.Valid() {
+		b.isSubnetRouter = hasOverlap(self.PrimaryRoutes(), self.Hostinfo().RoutableIPs())
+		b.logf("[v1] Reconfig: hasOverlap(%v, %v) = %v; isSubnetRouter=%v lastIsSubnetRouter=%v",
+			self.PrimaryRoutes(), self.Hostinfo().RoutableIPs(),
+			b.isSubnetRouter, b.isSubnetRouter, b.lastIsSubnetRouter)
+	}
+	return b.isSubnetRouter != b.lastIsSubnetRouter
+}
+
+func (b *bird) ReconfigDone() {
+	if b.isSubnetRouter == b.lastIsSubnetRouter {
+		return
+	}
+	b.logf("wgengine: Reconfig: configuring BIRD")
+	var err error
+	if b.isSubnetRouter {
+		err = b.client.EnableProtocol(protocolName)
+	} else {
+		err = b.client.DisableProtocol(protocolName)
+	}
+	if err != nil {
+		// Log but don't fail here; a later Reconfig will retry.
+		b.logf("wgengine: error configuring BIRD: %v", err)
+		return
+	}
+	b.lastIsSubnetRouter = b.isSubnetRouter
+}
+
+func (b *bird) Close() {
+	b.client.DisableProtocol(protocolName)
+	b.client.Close()
+}
+
+// hasOverlap reports whether any prefix in rips is also present in aips.
+func hasOverlap(aips, rips views.Slice[netip.Prefix]) bool {
+	for _, aip := range aips.All() {
+		if views.SliceContains(rips, aip) {
+			return true
+		}
+	}
+	return false
+}
diff --git a/feature/bird/bird_test.go b/feature/bird/bird_test.go
new file mode 100644
index 000000000..a5fe66e57
--- /dev/null
+++ b/feature/bird/bird_test.go
@@ -0,0 +1,205 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package bird
+
+import (
+	"bufio"
+	"errors"
+	"fmt"
+	"net"
+	"net/netip"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"tailscale.com/feature"
+	"tailscale.com/tailcfg"
+	"tailscale.com/wgengine"
+)
+
+// fakeBIRD is a fake BIRD server listening on a unix socket. It speaks
+// enough of the BIRD CLI wire protocol to satisfy chirp and records the
+// commands it receives so tests can assert on them.
+type fakeBIRD struct {
+	ln   net.Listener
+	sock string
+
+	mu       sync.Mutex
+	calls    []string // commands received, e.g. "enable tailscale"
+	enabled  bool     // whether the "tailscale" protocol is enabled
+	failNext bool     // whether to reply to the next command with a runtime error
+}
+
+func newFakeBIRD(t *testing.T) *fakeBIRD {
+	t.Helper()
+	sock := filepath.Join(t.TempDir(), "bird.sock")
+	ln, err := net.Listen("unix", sock)
+	if err != nil {
+		t.Fatal(err)
+	}
+	fb := &fakeBIRD{ln: ln, sock: sock}
+	t.Cleanup(func() { ln.Close() })
+	go fb.listen()
+	return fb
+}
+
+func (fb *fakeBIRD) listen() {
+	for {
+		c, err := fb.ln.Accept()
+		if err != nil {
+			if errors.Is(err, net.ErrClosed) {
+				return
+			}
+			panic(err)
+		}
+		go fb.handle(c)
+	}
+}
+
+func (fb *fakeBIRD) handle(c net.Conn) {
+	fmt.Fprintln(c, "0001 BIRD 2.0.8 ready.")
+	sc := bufio.NewScanner(c)
+	for sc.Scan() {
+		cmd := sc.Text()
+		var proto string
+		var wantEnabled bool
+		switch {
+		case strings.HasPrefix(cmd, "enable "):
+			proto, wantEnabled = strings.TrimPrefix(cmd, "enable "), true
+		case strings.HasPrefix(cmd, "disable "):
+			proto, wantEnabled = strings.TrimPrefix(cmd, "disable "), false
+		}
+
+		fb.mu.Lock()
+		fb.calls = append(fb.calls, cmd)
+		fail := fb.failNext
+		fb.failNext = false
+		switch {
+		case proto != protocolName:
+			fmt.Fprintln(c, "9001 syntax error, unexpected CF_SYM_UNDEFINED, expecting CF_SYM_KNOWN or TEXT or ALL")
+		case fail:
+			fmt.Fprintln(c, "8001 fake runtime error")
+		case wantEnabled == fb.enabled:
+			fmt.Fprintf(c, "0010-%s: already %s\n0000 \n", proto, verb(wantEnabled))
+		default:
+			fb.enabled = wantEnabled
+			fmt.Fprintf(c, "0011-%s: %s\n0000 \n", proto, verb(wantEnabled))
+		}
+		fb.mu.Unlock()
+	}
+	if err := sc.Err(); err != nil && !errors.Is(err, net.ErrClosed) {
+		panic(err)
+	}
+}
+
+func verb(enabled bool) string {
+	if enabled {
+		return "enabled"
+	}
+	return "disabled"
+}
+
+// takeCalls returns the commands received since the last call and
+// resets the record. It is safe to call once the chirp request that
+// caused them has returned, as chirp waits for each response.
+func (fb *fakeBIRD) takeCalls() []string {
+	fb.mu.Lock()
+	defer fb.mu.Unlock()
+	calls := fb.calls
+	fb.calls = nil
+	return calls
+}
+
+func (fb *fakeBIRD) checkCalls(t *testing.T, want ...string) {
+	t.Helper()
+	if diff := cmp.Diff(fb.takeCalls(), want, cmpopts.EquateEmpty()); diff != "" {
+		t.Errorf("BIRD calls mismatch (-got +want):\n%s", diff)
+	}
+}
+
+func node(primaryRoutes, routableIPs []netip.Prefix) tailcfg.NodeView {
+	return (&tailcfg.Node{
+		PrimaryRoutes: primaryRoutes,
+		Hostinfo:      (&tailcfg.Hostinfo{RoutableIPs: routableIPs}).View(),
+	}).View()
+}
+
+func TestBird(t *testing.T) {
+	if !feature.IsRegistered("bird") {
+		t.Fatal("bird feature not registered")
+	}
+
+	fb := newFakeBIRD(t)
+	newBird, ok := wgengine.HookNewBird.GetOk()
+	if !ok {
+		t.Fatal("HookNewBird not set")
+	}
+	b, err := newBird(t.Logf, fb.sock)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Construction disables the protocol.
+	fb.checkCalls(t, "disable tailscale")
+
+	pfx := netip.MustParsePrefix
+	subnetRouter := node(
+		[]netip.Prefix{pfx("192.168.1.0/24")},
+		[]netip.Prefix{pfx("192.168.1.0/24"), pfx("10.0.0.0/8")},
+	)
+	notSubnetRouter := node(
+		[]netip.Prefix{pfx("192.168.2.0/24")},
+		[]netip.Prefix{pfx("192.168.1.0/24")},
+	)
+
+	// An invalid self node is not a subnet router; no state change, no calls.
+	if changed := b.Reconfig(tailcfg.NodeView{}); changed {
+		t.Error("Reconfig(invalid) reported change")
+	}
+	b.ReconfigDone()
+	fb.checkCalls(t)
+
+	// Becoming a primary subnet router enables the protocol.
+	if changed := b.Reconfig(subnetRouter); !changed {
+		t.Error("Reconfig(subnetRouter) reported no change")
+	}
+	b.ReconfigDone()
+	fb.checkCalls(t, "enable tailscale")
+
+	// Reconfig with the same state is a no-op.
+	if changed := b.Reconfig(subnetRouter); changed {
+		t.Error("Reconfig(subnetRouter) again reported change")
+	}
+	b.ReconfigDone()
+	fb.checkCalls(t)
+
+	// A BIRD failure leaves the state unapplied, so the next Reconfig
+	// still reports a change and retries.
+	fb.mu.Lock()
+	fb.failNext = true
+	fb.mu.Unlock()
+	if changed := b.Reconfig(notSubnetRouter); !changed {
+		t.Error("Reconfig(notSubnetRouter) reported no change")
+	}
+	b.ReconfigDone()
+	fb.checkCalls(t, "disable tailscale")
+	if changed := b.Reconfig(notSubnetRouter); !changed {
+		t.Error("Reconfig(notSubnetRouter) retry reported no change")
+	}
+	b.ReconfigDone()
+	fb.checkCalls(t, "disable tailscale")
+
+	// And becoming a subnet router again enables it again.
+	if changed := b.Reconfig(subnetRouter); !changed {
+		t.Error("Reconfig(subnetRouter) reported no change")
+	}
+	b.ReconfigDone()
+	fb.checkCalls(t, "enable tailscale")
+
+	// Close disables the protocol on the way out.
+	b.Close()
+	fb.checkCalls(t, "disable tailscale")
+}
diff --git a/feature/buildfeatures/feature_flashappliance_disabled.go b/feature/buildfeatures/feature_flashappliance_disabled.go
new file mode 100644
index 000000000..30d44696d
--- /dev/null
+++ b/feature/buildfeatures/feature_flashappliance_disabled.go
@@ -0,0 +1,13 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Code generated by gen.go; DO NOT EDIT.
+
+//go:build ts_omit_flashappliance
+
+package buildfeatures
+
+// HasFlashAppliance is whether the binary was built with support for modular feature "'tailscale configure flash-appliance' and 'pve-appliance' CLI commands for deploying Tailscale appliance images".
+// Specifically, it's whether the binary was NOT built with the "ts_omit_flashappliance" build tag.
+// It's a const so it can be used for dead code elimination.
+const HasFlashAppliance = false
diff --git a/feature/buildfeatures/feature_flashappliance_enabled.go b/feature/buildfeatures/feature_flashappliance_enabled.go
new file mode 100644
index 000000000..b8852009f
--- /dev/null
+++ b/feature/buildfeatures/feature_flashappliance_enabled.go
@@ -0,0 +1,13 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Code generated by gen.go; DO NOT EDIT.
+
+//go:build !ts_omit_flashappliance
+
+package buildfeatures
+
+// HasFlashAppliance is whether the binary was built with support for modular feature "'tailscale configure flash-appliance' and 'pve-appliance' CLI commands for deploying Tailscale appliance images".
+// Specifically, it's whether the binary was NOT built with the "ts_omit_flashappliance" build tag.
+// It's a const so it can be used for dead code elimination.
+const HasFlashAppliance = true
diff --git a/feature/buildfeatures/feature_remoteconfig_disabled.go b/feature/buildfeatures/feature_remoteconfig_disabled.go
new file mode 100644
index 000000000..710a7bba2
--- /dev/null
+++ b/feature/buildfeatures/feature_remoteconfig_disabled.go
@@ -0,0 +1,13 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Code generated by gen.go; DO NOT EDIT.
+
+//go:build ts_omit_remoteconfig
+
+package buildfeatures
+
+// HasRemoteConfig is whether the binary was built with support for modular feature "Full remote configuration of this node by the tailnet admin, opting out of Tailscale's per-feature double opt-in in favor of a single client-side trust decision".
+// Specifically, it's whether the binary was NOT built with the "ts_omit_remoteconfig" build tag.
+// It's a const so it can be used for dead code elimination.
+const HasRemoteConfig = false
diff --git a/feature/buildfeatures/feature_remoteconfig_enabled.go b/feature/buildfeatures/feature_remoteconfig_enabled.go
new file mode 100644
index 000000000..746fb21d7
--- /dev/null
+++ b/feature/buildfeatures/feature_remoteconfig_enabled.go
@@ -0,0 +1,13 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Code generated by gen.go; DO NOT EDIT.
+
+//go:build !ts_omit_remoteconfig
+
+package buildfeatures
+
+// HasRemoteConfig is whether the binary was built with support for modular feature "Full remote configuration of this node by the tailnet admin, opting out of Tailscale's per-feature double opt-in in favor of a single client-side trust decision".
+// Specifically, it's whether the binary was NOT built with the "ts_omit_remoteconfig" build tag.
+// It's a const so it can be used for dead code elimination.
+const HasRemoteConfig = true
diff --git a/feature/buildfeatures/feature_routecheck_disabled.go b/feature/buildfeatures/feature_routecheck_disabled.go
new file mode 100644
index 000000000..e728fc91d
--- /dev/null
+++ b/feature/buildfeatures/feature_routecheck_disabled.go
@@ -0,0 +1,13 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Code generated by gen.go; DO NOT EDIT.
+
+//go:build ts_omit_routecheck
+
+package buildfeatures
+
+// HasRouteCheck is whether the binary was built with support for modular feature "Support checking the reachability of overlapping routers, for choosing between multiple network paths to the same IP address".
+// Specifically, it's whether the binary was NOT built with the "ts_omit_routecheck" build tag.
+// It's a const so it can be used for dead code elimination.
+const HasRouteCheck = false
diff --git a/feature/buildfeatures/feature_routecheck_enabled.go b/feature/buildfeatures/feature_routecheck_enabled.go
new file mode 100644
index 000000000..34fffb835
--- /dev/null
+++ b/feature/buildfeatures/feature_routecheck_enabled.go
@@ -0,0 +1,13 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Code generated by gen.go; DO NOT EDIT.
+
+//go:build !ts_omit_routecheck
+
+package buildfeatures
+
+// HasRouteCheck is whether the binary was built with support for modular feature "Support checking the reachability of overlapping routers, for choosing between multiple network paths to the same IP address".
+// Specifically, it's whether the binary was NOT built with the "ts_omit_routecheck" build tag.
+// It's a const so it can be used for dead code elimination.
+const HasRouteCheck = true
diff --git a/feature/buildfeatures/feature_runtimemetrics_disabled.go b/feature/buildfeatures/feature_runtimemetrics_disabled.go
new file mode 100644
index 000000000..9e582bdd8
--- /dev/null
+++ b/feature/buildfeatures/feature_runtimemetrics_disabled.go
@@ -0,0 +1,13 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Code generated by gen.go; DO NOT EDIT.
+
+//go:build ts_omit_runtimemetrics
+
+package buildfeatures
+
+// HasRuntimeMetrics is whether the binary was built with support for modular feature "Support emission of runtime/metrics as clientmetrics".
+// Specifically, it's whether the binary was NOT built with the "ts_omit_runtimemetrics" build tag.
+// It's a const so it can be used for dead code elimination.
+const HasRuntimeMetrics = false
diff --git a/feature/buildfeatures/feature_runtimemetrics_enabled.go b/feature/buildfeatures/feature_runtimemetrics_enabled.go
new file mode 100644
index 000000000..c95bb83cb
--- /dev/null
+++ b/feature/buildfeatures/feature_runtimemetrics_enabled.go
@@ -0,0 +1,13 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Code generated by gen.go; DO NOT EDIT.
+
+//go:build !ts_omit_runtimemetrics
+
+package buildfeatures
+
+// HasRuntimeMetrics is whether the binary was built with support for modular feature "Support emission of runtime/metrics as clientmetrics".
+// Specifically, it's whether the binary was NOT built with the "ts_omit_runtimemetrics" build tag.
+// It's a const so it can be used for dead code elimination.
+const HasRuntimeMetrics = true
diff --git a/feature/buildfeatures/feature_serviceclientprefs_disabled.go b/feature/buildfeatures/feature_serviceclientprefs_disabled.go
new file mode 100644
index 000000000..480b5726c
--- /dev/null
+++ b/feature/buildfeatures/feature_serviceclientprefs_disabled.go
@@ -0,0 +1,13 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Code generated by gen.go; DO NOT EDIT.
+
+//go:build ts_omit_serviceclientprefs
+
+package buildfeatures
+
+// HasServiceClientPrefs is whether the binary was built with support for modular feature "Desktop client service launch preferences".
+// Specifically, it's whether the binary was NOT built with the "ts_omit_serviceclientprefs" build tag.
+// It's a const so it can be used for dead code elimination.
+const HasServiceClientPrefs = false
diff --git a/feature/buildfeatures/feature_serviceclientprefs_enabled.go b/feature/buildfeatures/feature_serviceclientprefs_enabled.go
new file mode 100644
index 000000000..eeda83c81
--- /dev/null
+++ b/feature/buildfeatures/feature_serviceclientprefs_enabled.go
@@ -0,0 +1,13 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Code generated by gen.go; DO NOT EDIT.
+
+//go:build !ts_omit_serviceclientprefs
+
+package buildfeatures
+
+// HasServiceClientPrefs is whether the binary was built with support for modular feature "Desktop client service launch preferences".
+// Specifically, it's whether the binary was NOT built with the "ts_omit_serviceclientprefs" build tag.
+// It's a const so it can be used for dead code elimination.
+const HasServiceClientPrefs = true
diff --git a/feature/buildfeatures/feature_lazywg_disabled.go b/feature/buildfeatures/feature_syslog_disabled.go
similarity index 54%
rename from feature/buildfeatures/feature_lazywg_disabled.go
rename to feature/buildfeatures/feature_syslog_disabled.go
index af1ad388c..2e15efe8a 100644
--- a/feature/buildfeatures/feature_lazywg_disabled.go
+++ b/feature/buildfeatures/feature_syslog_disabled.go
@@ -3,11 +3,11 @@
 
 // Code generated by gen.go; DO NOT EDIT.
 
-//go:build ts_omit_lazywg
+//go:build ts_omit_syslog
 
 package buildfeatures
 
-// HasLazyWG is whether the binary was built with support for modular feature "Lazy WireGuard configuration for memory-constrained devices with large netmaps".
-// Specifically, it's whether the binary was NOT built with the "ts_omit_lazywg" build tag.
+// HasSyslog is whether the binary was built with support for modular feature "tailscaled --syslog flag support to send logs to the system syslog daemon".
+// Specifically, it's whether the binary was NOT built with the "ts_omit_syslog" build tag.
 // It's a const so it can be used for dead code elimination.
-const HasLazyWG = false
+const HasSyslog = false
diff --git a/feature/buildfeatures/feature_lazywg_enabled.go b/feature/buildfeatures/feature_syslog_enabled.go
similarity index 54%
rename from feature/buildfeatures/feature_lazywg_enabled.go
rename to feature/buildfeatures/feature_syslog_enabled.go
index f2d6a10f8..3167c971a 100644
--- a/feature/buildfeatures/feature_lazywg_enabled.go
+++ b/feature/buildfeatures/feature_syslog_enabled.go
@@ -3,11 +3,11 @@
 
 // Code generated by gen.go; DO NOT EDIT.
 
-//go:build !ts_omit_lazywg
+//go:build !ts_omit_syslog
 
 package buildfeatures
 
-// HasLazyWG is whether the binary was built with support for modular feature "Lazy WireGuard configuration for memory-constrained devices with large netmaps".
-// Specifically, it's whether the binary was NOT built with the "ts_omit_lazywg" build tag.
+// HasSyslog is whether the binary was built with support for modular feature "tailscaled --syslog flag support to send logs to the system syslog daemon".
+// Specifically, it's whether the binary was NOT built with the "ts_omit_syslog" build tag.
 // It's a const so it can be used for dead code elimination.
-const HasLazyWG = true
+const HasSyslog = true
diff --git a/feature/captiveportal/captiveportal.go b/feature/captiveportal/captiveportal.go
new file mode 100644
index 000000000..7295c02f6
--- /dev/null
+++ b/feature/captiveportal/captiveportal.go
@@ -0,0 +1,285 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package captiveportal provides optional captive portal detection,
+// warning the user via the health tracker when their network requires
+// a browser login before traffic can flow.
+package captiveportal
+
+import (
+	"context"
+	"time"
+
+	"tailscale.com/feature"
+	_ "tailscale.com/feature/captiveportal/netcheckhook" // install the netcheck probe hook too
+	"tailscale.com/health"
+	"tailscale.com/ipn"
+	"tailscale.com/ipn/ipnext"
+	"tailscale.com/net/captivedetection"
+	"tailscale.com/syncs"
+	"tailscale.com/types/logger"
+	"tailscale.com/util/clientmetric"
+	"tailscale.com/util/eventbus"
+)
+
+const featureName = "captiveportal"
+
+func init() {
+	feature.Register(featureName)
+	ipnext.RegisterExtension(featureName, newExtension)
+}
+
+var metricCaptivePortalDetected = clientmetric.NewCounter("captiveportal_detected")
+
+// captivePortalDetectionInterval is the duration to wait in an unhealthy state with connectivity broken
+// before running captive portal detection.
+const captivePortalDetectionInterval = 2 * time.Second
+
+// captivePortalWarnable is a Warnable which is set to an unhealthy state when a captive portal is detected.
+var captivePortalWarnable = health.Register(&health.Warnable{
+	Code:  "captive-portal-detected",
+	Title: "Captive portal detected",
+	// High severity, because captive portals block all traffic and require user intervention.
+	Severity:            health.SeverityHigh,
+	Text:                health.StaticMessage("This network requires you to log in using your web browser."),
+	ImpactsConnectivity: true,
+})
+
+// Extension is the captive portal detection extension.
+// There is one per [ipnext.Host] (and hence per LocalBackend).
+type Extension struct {
+	logf   logger.Logf
+	sb     ipnext.SafeBackend
+	host   ipnext.Host // from Init
+	health *health.Tracker
+	ec     *eventbus.Client
+
+	mu syncs.Mutex
+	// captiveCtx and captiveCancel are used to control captive portal
+	// detection. They are protected by 'mu' and can be changed during the
+	// lifetime of the extension.
+	//
+	// captiveCtx will always be non-nil, though it might be a canceled
+	// context. captiveCancel is non-nil if checkCaptivePortalLoop is
+	// running, and is set to nil after being canceled.
+	captiveCtx    context.Context
+	captiveCancel context.CancelFunc
+
+	// needsCaptiveDetection is a channel that is used to signal either
+	// that captive portal detection is required (sending true) or that the
+	// backend is healthy and captive portal detection is not required
+	// (sending false).
+	needsCaptiveDetection chan bool
+}
+
+func newExtension(logf logger.Logf, sb ipnext.SafeBackend) (ipnext.Extension, error) {
+	// Initialize the context used to control the captive portal detection
+	// goroutine in a canceled state, so that it is always non-nil and safe
+	// to wait on even before the loop has ever started.
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	return &Extension{
+		logf:                  logf,
+		sb:                    sb,
+		health:                sb.Sys().HealthTracker.Get(),
+		captiveCtx:            ctx,
+		needsCaptiveDetection: make(chan bool),
+	}, nil
+}
+
+func (e *Extension) Name() string { return featureName }
+
+func (e *Extension) Init(h ipnext.Host) error {
+	e.host = h
+	h.Hooks().BackendStateChange.Add(e.onBackendStateChange)
+	e.ec = e.sb.Sys().Bus.Get().Client("captiveportal")
+	eventbus.SubscribeFunc(e.ec, e.onHealthChange)
+	return nil
+}
+
+func (e *Extension) Shutdown() error {
+	e.mu.Lock()
+	if e.captiveCancel != nil {
+		e.captiveCancel()
+		e.captiveCancel = nil
+	}
+	e.mu.Unlock()
+	if e.ec != nil {
+		e.ec.Close()
+	}
+	return nil
+}
+
+// onBackendStateChange starts or stops the captive portal detection loop as
+// the backend enters or leaves the Running state. It is called with
+// LocalBackend's mutex held, so it must not call back into LocalBackend.
+func (e *Extension) onBackendStateChange(st ipn.State) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	if st == ipn.Running {
+		// Start a captive portal detection loop if none has been
+		// started.
+		if e.captiveCancel == nil {
+			e.captiveCtx, e.captiveCancel = context.WithCancel(context.Background())
+			go e.checkCaptivePortalLoop(e.captiveCtx)
+		}
+	} else if e.captiveCancel != nil {
+		// Transitioning away from Running; stop any existing captive
+		// portal detection loop.
+		e.captiveCancel()
+		e.captiveCancel = nil
+
+		// NOTE: don't set captiveCtx to nil here, to ensure that we
+		// always have a (canceled) context to wait on in
+		// onHealthChange.
+	}
+}
+
+// onHealthChange is called (via the eventbus) whenever the node's health
+// state changes. If connectivity appears to be impacted, it signals the
+// detection loop to check for a captive portal.
+func (e *Extension) onHealthChange(health.Change) {
+	state := e.health.CurrentState()
+	isConnectivityImpacted := false
+	for _, w := range state.Warnings {
+		// Ignore the captive portal warnable itself.
+		if w.ImpactsConnectivity && w.WarnableCode != captivePortalWarnable.Code {
+			isConnectivityImpacted = true
+			break
+		}
+	}
+
+	// captiveCtx can be changed, and is protected with 'mu'; grab that
+	// before we start our select, below.
+	//
+	// It is guaranteed to be non-nil.
+	e.mu.Lock()
+	ctx := e.captiveCtx
+	e.mu.Unlock()
+
+	// If the context is canceled, we don't need to do anything.
+	if ctx.Err() != nil {
+		return
+	}
+
+	if isConnectivityImpacted {
+		e.logf("health: connectivity impacted; triggering captive portal detection")
+
+		// Ensure that we select on captiveCtx so that we can time out
+		// triggering captive portal detection if the loop is shut down.
+		select {
+		case e.needsCaptiveDetection <- true:
+		case <-ctx.Done():
+		}
+	} else {
+		// If connectivity is not impacted, we know for sure we're not behind a captive portal,
+		// so drop any warning, and signal that we don't need captive portal detection.
+		e.health.SetHealthy(captivePortalWarnable)
+		select {
+		case e.needsCaptiveDetection <- false:
+		case <-ctx.Done():
+		}
+	}
+}
+
+func (e *Extension) checkCaptivePortalLoop(ctx context.Context) {
+	var tmr *time.Timer
+
+	maybeStartTimer := func() {
+		// If there's an existing timer, nothing to do; just continue
+		// waiting for it to expire. Otherwise, create a new timer.
+		if tmr == nil {
+			tmr = time.NewTimer(captivePortalDetectionInterval)
+		}
+	}
+	maybeStopTimer := func() {
+		if tmr == nil {
+			return
+		}
+		if !tmr.Stop() {
+			<-tmr.C
+		}
+		tmr = nil
+	}
+
+	for {
+		if ctx.Err() != nil {
+			maybeStopTimer()
+			return
+		}
+
+		// First, see if we have a signal on our "healthy" channel, which
+		// takes priority over an existing timer. Because a select is
+		// nondeterministic, we explicitly check this channel before
+		// entering the main select below, so that we're guaranteed to
+		// stop the timer before starting captive portal detection.
+		select {
+		case needsCaptiveDetection := <-e.needsCaptiveDetection:
+			if needsCaptiveDetection {
+				maybeStartTimer()
+			} else {
+				maybeStopTimer()
+			}
+		default:
+		}
+
+		var timerChan <-chan time.Time
+		if tmr != nil {
+			timerChan = tmr.C
+		}
+		select {
+		case <-ctx.Done():
+			// All done; stop the timer and then exit.
+			maybeStopTimer()
+			return
+		case <-timerChan:
+			// Kick off captive portal check
+			e.performCaptiveDetection(ctx)
+			// nil out the timer and its channel to force recreation
+			tmr, timerChan = nil, nil
+		case needsCaptiveDetection := <-e.needsCaptiveDetection:
+			if needsCaptiveDetection {
+				maybeStartTimer()
+			} else {
+				// Healthy; cancel any existing timer
+				maybeStopTimer()
+			}
+		}
+	}
+}
+
+// shouldRunCaptivePortalDetection reports whether captive portal detection
+// should be run. It is enabled by default, but can be disabled via a control
+// knob. It is also only run when the user explicitly wants the backend to be
+// running.
+func (e *Extension) shouldRunCaptivePortalDetection() bool {
+	return !e.sb.Sys().ControlKnobs().DisableCaptivePortalDetection.Load() &&
+		e.host.Profiles().CurrentPrefs().WantRunning()
+}
+
+// performCaptiveDetection checks if captive portal detection is enabled via controlknob. If so, it runs
+// the detection and updates the Warnable accordingly.
+func (e *Extension) performCaptiveDetection(ctx context.Context) {
+	if !e.shouldRunCaptivePortalDetection() {
+		return
+	}
+
+	d := captivedetection.NewDetector(e.logf)
+	dm := e.host.NodeBackend().DERPMap()
+	preferredDERP := 0
+	if mc, ok := e.sb.Sys().MagicSock.GetOK(); ok {
+		if report := mc.GetLastNetcheckReport(ctx); report != nil {
+			preferredDERP = report.PreferredDERP
+		}
+	}
+	netMon := e.sb.Sys().NetMon.Get()
+	found := d.Detect(ctx, netMon, dm, preferredDERP)
+	if found {
+		if !e.health.IsUnhealthy(captivePortalWarnable) {
+			metricCaptivePortalDetected.Add(1)
+		}
+		e.health.SetUnhealthy(captivePortalWarnable, health.Args{})
+	} else {
+		e.health.SetHealthy(captivePortalWarnable)
+	}
+}
diff --git a/feature/captiveportal/netcheckhook/netcheckhook.go b/feature/captiveportal/netcheckhook/netcheckhook.go
new file mode 100644
index 000000000..15c2de249
--- /dev/null
+++ b/feature/captiveportal/netcheckhook/netcheckhook.go
@@ -0,0 +1,67 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package netcheckhook makes netcheck probe for captive portals during
+// full reports. It does so as a side effect of being imported, by
+// installing a netcheck hook from init.
+package netcheckhook
+
+import (
+	"context"
+	"log"
+	"time"
+
+	"tailscale.com/net/captivedetection"
+	"tailscale.com/net/netcheck"
+	"tailscale.com/tailcfg"
+)
+
+func init() {
+	netcheck.HookStartCaptivePortalDetection.Set(startCaptivePortalDetection)
+}
+
+// captivePortalDelay is the duration to wait after starting a netcheck before
+// also probing for a captive portal, to let UDP STUN finish first and avoid
+// the probe if it's unnecessary. Chosen semi-arbitrarily.
+const captivePortalDelay = 200 * time.Millisecond
+
+func startCaptivePortalDetection(ctx context.Context, c *netcheck.Client, dm *tailcfg.DERPMap, preferredDERP int, setCaptivePortal func(bool)) (done <-chan struct{}, stop func()) {
+	logf := c.Logf
+	if logf == nil {
+		logf = log.Printf
+	}
+
+	// This goroutine can't be tracked by the wait group that
+	// netcheck.GetReport uses for its probes, since GetReport doesn't
+	// wait for that group to finish before returning and we'd get a
+	// data race. Instead, completion is signaled by closing ch, which
+	// GetReport receives as the done channel.
+	ch := make(chan struct{})
+
+	tmr := time.AfterFunc(captivePortalDelay, func() {
+		defer close(ch)
+		d := captivedetection.NewDetector(logf)
+		found := d.Detect(ctx, c.NetMon, dm, preferredDERP)
+		setCaptivePortal(found)
+	})
+
+	if c.Verbose {
+		// Don't cancel our captive portal check if we're
+		// explicitly doing a verbose netcheck.
+		return ch, func() {}
+	}
+
+	stop = func() {
+		if tmr.Stop() {
+			// Stopped successfully; need to close the
+			// signal channel ourselves.
+			close(ch)
+			return
+		}
+
+		// Did not stop; do nothing and it'll finish by itself
+		// and close the signal channel.
+	}
+
+	return ch, stop
+}
diff --git a/feature/clientupdate/clientupdate.go b/feature/clientupdate/clientupdate.go
index d47d04815..4bbd5e1ba 100644
--- a/feature/clientupdate/clientupdate.go
+++ b/feature/clientupdate/clientupdate.go
@@ -36,6 +36,7 @@ import (
 )
 
 func init() {
+	feature.Register("clientupdate")
 	ipnext.RegisterExtension("clientupdate", newExt)
 
 	// C2N
@@ -163,6 +164,7 @@ func (e *extension) DoSelfUpdate() {
 	})
 	if err != nil {
 		e.pushSelfUpdateProgress(ipnstate.NewUpdateProgress(ipnstate.UpdateFailed, err.Error()))
+		return
 	}
 	err = up.Update()
 	if err != nil {
diff --git a/feature/condlite/expvar/omit.go b/feature/condlite/expvar/omit.go
index b5481695c..188de2af2 100644
--- a/feature/condlite/expvar/omit.go
+++ b/feature/condlite/expvar/omit.go
@@ -3,7 +3,6 @@
 
 //go:build ts_omit_debug && ts_omit_clientmetrics && ts_omit_usermetrics
 
-// excluding the package from builds.
 package expvar
 
 type Int int64
diff --git a/feature/condregister/maybe_acme.go b/feature/condregister/maybe_acme.go
new file mode 100644
index 000000000..e07d3de2f
--- /dev/null
+++ b/feature/condregister/maybe_acme.go
@@ -0,0 +1,8 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !ts_omit_acme
+
+package condregister
+
+import _ "tailscale.com/feature/acme"
diff --git a/feature/condregister/maybe_bird.go b/feature/condregister/maybe_bird.go
new file mode 100644
index 000000000..b2cae98b0
--- /dev/null
+++ b/feature/condregister/maybe_bird.go
@@ -0,0 +1,8 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !ts_omit_bird && (linux || darwin || freebsd || openbsd)
+
+package condregister
+
+import _ "tailscale.com/feature/bird"
diff --git a/feature/condregister/maybe_captiveportal.go b/feature/condregister/maybe_captiveportal.go
new file mode 100644
index 000000000..8086e89fe
--- /dev/null
+++ b/feature/condregister/maybe_captiveportal.go
@@ -0,0 +1,8 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !ts_omit_captiveportal
+
+package condregister
+
+import _ "tailscale.com/feature/captiveportal"
diff --git a/feature/condregister/maybe_netlog.go b/feature/condregister/maybe_netlog.go
new file mode 100644
index 000000000..f7b72e155
--- /dev/null
+++ b/feature/condregister/maybe_netlog.go
@@ -0,0 +1,6 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package condregister
+
+import _ "tailscale.com/feature/condregister/netlog"
diff --git a/feature/condregister/maybe_remoteconfig.go b/feature/condregister/maybe_remoteconfig.go
new file mode 100644
index 000000000..a4958430b
--- /dev/null
+++ b/feature/condregister/maybe_remoteconfig.go
@@ -0,0 +1,8 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !ts_omit_remoteconfig
+
+package condregister
+
+import _ "tailscale.com/feature/remoteconfig"
diff --git a/feature/condregister/maybe_routecheck.go b/feature/condregister/maybe_routecheck.go
new file mode 100644
index 000000000..2d98c43db
--- /dev/null
+++ b/feature/condregister/maybe_routecheck.go
@@ -0,0 +1,8 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !ts_omit_routecheck
+
+package condregister
+
+import _ "tailscale.com/feature/routecheck"
diff --git a/feature/condregister/maybe_runtimemetrics.go b/feature/condregister/maybe_runtimemetrics.go
new file mode 100644
index 000000000..7b0883ca2
--- /dev/null
+++ b/feature/condregister/maybe_runtimemetrics.go
@@ -0,0 +1,8 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !ts_omit_runtimemetrics
+
+package condregister
+
+import _ "tailscale.com/feature/runtimemetrics"
diff --git a/feature/condregister/maybe_serviceclientprefs.go b/feature/condregister/maybe_serviceclientprefs.go
new file mode 100644
index 000000000..461276bf1
--- /dev/null
+++ b/feature/condregister/maybe_serviceclientprefs.go
@@ -0,0 +1,8 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !ts_omit_serviceclientprefs
+
+package condregister
+
+import _ "tailscale.com/feature/serviceclientprefs"
diff --git a/feature/condregister/maybe_syslog.go b/feature/condregister/maybe_syslog.go
new file mode 100644
index 000000000..9527c472b
--- /dev/null
+++ b/feature/condregister/maybe_syslog.go
@@ -0,0 +1,8 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build (linux || freebsd || openbsd) && !ts_omit_syslog
+
+package condregister
+
+import _ "tailscale.com/feature/syslog"
diff --git a/feature/condregister/maybe_tailnetlock.go b/feature/condregister/maybe_tailnetlock.go
new file mode 100644
index 000000000..80a3dffe3
--- /dev/null
+++ b/feature/condregister/maybe_tailnetlock.go
@@ -0,0 +1,8 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !ts_omit_tailnetlock
+
+package condregister
+
+import _ "tailscale.com/feature/tailnetlock"
diff --git a/feature/condregister/netlog/doc.go b/feature/condregister/netlog/doc.go
new file mode 100644
index 000000000..ff939ce5a
--- /dev/null
+++ b/feature/condregister/netlog/doc.go
@@ -0,0 +1,8 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package netlog registers support for network flow logging if it's
+// not disabled via the ts_omit_netlog or ts_omit_logtail build tags.
+// It is pulled out separately from the main condregister package so
+// that tsnet can link it without linking every conditional feature.
+package netlog
diff --git a/feature/condregister/netlog/maybe_netlog.go b/feature/condregister/netlog/maybe_netlog.go
new file mode 100644
index 000000000..ec7a79133
--- /dev/null
+++ b/feature/condregister/netlog/maybe_netlog.go
@@ -0,0 +1,8 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !ts_omit_netlog && !ts_omit_logtail
+
+package netlog
+
+import _ "tailscale.com/feature/netlog"
diff --git a/feature/conn25/addrAssignments.go b/feature/conn25/addrAssignments.go
new file mode 100644
index 000000000..3c05b8cc7
--- /dev/null
+++ b/feature/conn25/addrAssignments.go
@@ -0,0 +1,188 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package conn25
+
+import (
+	"container/heap"
+	"errors"
+	"net/netip"
+	"time"
+
+	"tailscale.com/tstime"
+	"tailscale.com/util/dnsname"
+	"tailscale.com/util/mak"
+)
+
+// domainDst is a key for looking up an existing address assignment by the
+// DNS response domain and destination IP pair.
+type domainDst struct {
+	domain dnsname.FQDN
+	dst    netip.Addr
+}
+
+// addrAssignments is the collection of addrs assigned by this client
+// supporting lookup by magic IP, transit IP or domain+dst, or to lookup all
+// transit IPs associated with a given connector (identified by its node key).
+type addrAssignments struct {
+	byMagicIP   map[netip.Addr]*addrs
+	byTransitIP map[netip.Addr]*addrs
+	byDomainDst map[domainDst]*addrs
+	byExpiresAt addrsHeap
+	clock       tstime.Clock
+}
+
+const defaultExpiry = 48 * time.Hour
+
+func clampExpiryFromTTL(ttl time.Duration) time.Duration {
+	const minTTL = time.Minute * 1
+	const maxTTL = time.Hour * 72
+	expiry := max(minTTL, ttl)
+	return min(maxTTL, expiry)
+}
+
+func (a *addrAssignments) insert(as *addrs) error {
+	return a.insertWithExpiry(as, defaultExpiry)
+}
+
+func (a *addrAssignments) insertFromTTL(as *addrs, ttl time.Duration) error {
+	return a.insertWithExpiry(as, clampExpiryFromTTL(ttl))
+}
+
+func (a *addrAssignments) updateFromTTL(as *addrs, ttl time.Duration) {
+	a.updateExpiry(as, clampExpiryFromTTL(ttl))
+}
+
+func (a *addrAssignments) insertWithExpiry(as *addrs, d time.Duration) error {
+	now := a.clock.Now()
+	if !as.expiresAt.IsZero() && !as.expiresAt.Before(now) {
+		return errors.New("expiresAt already set")
+	}
+	// addresses must be removed (eg by popExpired) before they can be reused
+	if _, ok := a.byMagicIP[as.magic]; ok {
+		return errors.New("byMagicIP key exists")
+	}
+	ddst := domainDst{domain: as.domain, dst: as.dst}
+	if _, ok := a.byDomainDst[ddst]; ok {
+		return errors.New("byDomainDst key exists")
+	}
+	if _, ok := a.byTransitIP[as.transit]; ok {
+		return errors.New("byTransitIP key exists")
+	}
+	as.expiresAt = now.Add(d)
+	mak.Set(&a.byMagicIP, as.magic, as)
+	mak.Set(&a.byTransitIP, as.transit, as)
+	mak.Set(&a.byDomainDst, ddst, as)
+	heap.Push(&a.byExpiresAt, as)
+	return nil
+}
+
+func (a *addrAssignments) lookupByDomainDst(domain dnsname.FQDN, dst netip.Addr) (*addrs, bool) {
+	v, ok := a.byDomainDst[domainDst{domain: domain, dst: dst}]
+	if !ok {
+		return &addrs{}, false
+	}
+	return v, true
+}
+
+func (a *addrAssignments) lookupByMagicIP(mip netip.Addr) (*addrs, bool) {
+	v, ok := a.byMagicIP[mip]
+	if !ok {
+		return &addrs{}, false
+	}
+	return v, true
+}
+
+func (a *addrAssignments) lookupByTransitIP(tip netip.Addr) (*addrs, bool) {
+	v, ok := a.byTransitIP[tip]
+	if !ok {
+		return &addrs{}, false
+	}
+	return v, true
+}
+
+const (
+	// deadFlowWaitTimeout is the minimum time after the active flow count
+	// drops to zero that we keep an address mapping in our table of address
+	// mappings.
+	deadFlowWaitTimeout = 2 * time.Minute
+
+	// extendForActiveFlowDuration is the minimum time we will wait to recheck
+	// an address mapping with a positive active flow count for removal from
+	// the table of address mappings.
+	extendForActiveFlowDuration = 24 * time.Hour
+)
+
+// popExpired attempts to remove from all the indexes one address
+// mapping, and return that mapping, or nil if there were no eligible mappings.
+// An address mapping is eligible for removal if:
+// - the current time is past the expiresAt time on the mapping
+// - and, the active flow count is 0
+// - and, it's been long enough since the active flow count dropped to 0
+// We're using a heap on expiresAt to efficiently find addresses that
+// are eligible for removal. expiresAt is initially set according to the
+// TTL on the DNS response. If the current time is past the expiresAt, but
+// there are active flows, we extend the expiresAt time into the future.
+func (a *addrAssignments) popExpired(now time.Time) *addrs {
+	if a.byExpiresAt.Len() == 0 {
+		return nil
+	}
+	var v *addrs
+	// Look for an address we can remove.
+	for {
+		if !a.byExpiresAt.peek().expiresAt.Before(now) {
+			// There's no longer anything outside the expiry window.
+			return nil
+		}
+		candidate := heap.Pop(&a.byExpiresAt).(*addrs)
+		if candidate.activeFlowCount == 0 && candidate.zeroFlowTime.Add(deadFlowWaitTimeout).Before(now) {
+			// Found one.
+			v = candidate
+			break
+		}
+		// Candidate can't be removed due to active flows. Extend expiresAt, and put it back in the heap.
+		candidate.expiresAt = now.Add(extendForActiveFlowDuration)
+		// TODO(mzb/fran): This is an expensive operation we could consider optimizing.
+		heap.Push(&a.byExpiresAt, candidate)
+	}
+	delete(a.byMagicIP, v.magic)
+	delete(a.byTransitIP, v.transit)
+	dd := domainDst{domain: v.domain, dst: v.dst}
+	delete(a.byDomainDst, dd)
+	return v
+}
+
+func (a *addrAssignments) updateExpiry(as *addrs, expiresIn time.Duration) {
+	now := a.clock.Now()
+	as.expiresAt = now.Add(expiresIn)
+	// TODO(fran) 2026-05-26 We can make this perform better.
+	//  * With a bit of extra effort, we can track the index so that heap.Fix can
+	//    be used.
+	//  * Alternatively, marking the heap dirty and waiting until the next
+	//    operation that requires it to be in the correct order would mean a
+	//    whole slew of updates can accumulate before paying for a heap.Init.
+	heap.Init(&a.byExpiresAt)
+}
+
+type addrsHeap []*addrs
+
+func (h addrsHeap) Len() int           { return len(h) }
+func (h addrsHeap) Less(i, j int) bool { return h[i].expiresAt.Before(h[j].expiresAt) }
+func (h addrsHeap) Swap(i, j int)      { h[i], h[j] = h[j], h[i] }
+func (h *addrsHeap) Push(x any) {
+	as, ok := x.(*addrs)
+	if !ok {
+		panic("unexpected not an addrs")
+	}
+	*h = append(*h, as)
+}
+func (h *addrsHeap) Pop() any {
+	old := *h
+	n := len(old)
+	x := old[n-1]
+	*h = old[0 : n-1]
+	return x
+}
+func (h addrsHeap) peek() *addrs {
+	return (h)[0]
+}
diff --git a/feature/conn25/addrAssignments_test.go b/feature/conn25/addrAssignments_test.go
new file mode 100644
index 000000000..ce26b80a1
--- /dev/null
+++ b/feature/conn25/addrAssignments_test.go
@@ -0,0 +1,176 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package conn25
+
+import (
+	"fmt"
+	"net/netip"
+	"testing"
+	"time"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"tailscale.com/tstest"
+)
+
+func TestAssignmentsExpire(t *testing.T) {
+	clock := tstest.NewClock(tstest.ClockOpts{Start: time.Now()})
+	assignments := addrAssignments{clock: clock}
+	as := &addrs{
+		dst:     netip.MustParseAddr("0.0.0.1"),
+		magic:   netip.MustParseAddr("0.0.0.2"),
+		transit: netip.MustParseAddr("0.0.0.3"),
+		app:     "a",
+		domain:  "example.com.",
+	}
+	err := assignments.insert(as)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Time has not passed since the insert, the assignment should be returned.
+	foundAs, ok := assignments.lookupByMagicIP(as.magic)
+	if !ok {
+		t.Fatal("expected to find")
+	}
+	if foundAs.dst != as.dst {
+		t.Fatalf("want %v; got %v", as.dst, foundAs.dst)
+	}
+	// and we cannot insert over the addresses
+	err = assignments.insert(as)
+	if err == nil {
+		t.Fatal("expected an error but got nil")
+	}
+	// We should only be able to write old addresses again if they've been removed from the maps (eg with popExpired).
+	clock.Advance(defaultExpiry * 2)
+	err = assignments.insert(as)
+	if err == nil {
+		t.Fatal("expected an error but got nil")
+	}
+}
+
+func TestPopExpired(t *testing.T) {
+	clock := tstest.NewClock(tstest.ClockOpts{Start: time.Now()})
+	assignments := addrAssignments{clock: clock}
+	makeAndAddAddrs := func(n int) *addrs {
+		t.Helper()
+		as := &addrs{
+			dst:     netip.MustParseAddr(fmt.Sprintf("0.0.1.%d", n)),
+			magic:   netip.MustParseAddr(fmt.Sprintf("0.0.2.%d", n)),
+			transit: netip.MustParseAddr(fmt.Sprintf("0.0.3.%d", n)),
+			app:     "a",
+			domain:  "example.com.",
+		}
+		err := assignments.insert(as)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return as
+	}
+	// cmp.Diff addrs ignoring expiresAt
+	doDiff := func(want, got *addrs) string {
+		t.Helper()
+		return cmp.Diff(
+			want,
+			got,
+			cmp.AllowUnexported(addrs{}),
+			cmpopts.EquateComparable(netip.Addr{}),
+			cmpopts.IgnoreFields(addrs{}, "expiresAt"),
+		)
+	}
+	testAddrs := []*addrs{}
+	for i := range 2 {
+		testAddrs = append(testAddrs, makeAndAddAddrs(i+1))
+		clock.Advance(1 * time.Second)
+	}
+	if len(assignments.byMagicIP) != 2 {
+		t.Fatalf("test setup wrong")
+	}
+
+	nn := assignments.popExpired(clock.Now())
+	if diff := doDiff(nil, nn); diff != "" {
+		t.Fatalf("only expired addresses are removed: %s", diff)
+	}
+	if len(assignments.byMagicIP) != 2 {
+		t.Fatalf("nothing should have been removed")
+	}
+
+	clock.Advance(2 * defaultExpiry) // all addrs are now expired
+
+	want := testAddrs[0]
+	nn = assignments.popExpired(clock.Now())
+	if diff := doDiff(want, nn); diff != "" {
+		t.Fatal(diff)
+	}
+	if len(assignments.byMagicIP) != 1 {
+		t.Fatalf("an assignment should have been removed")
+	}
+
+	want = testAddrs[1]
+	nn = assignments.popExpired(clock.Now())
+	if diff := doDiff(want, nn); diff != "" {
+		t.Fatal(diff)
+	}
+	if len(assignments.byMagicIP) != 0 {
+		t.Fatalf("an assignment should have been removed")
+	}
+
+	nn = assignments.popExpired(clock.Now())
+	if diff := doDiff(nil, nn); diff != "" {
+		t.Fatal(diff)
+	}
+	if len(assignments.byMagicIP) != 0 {
+		t.Fatalf("there should have been no change")
+	}
+}
+
+func TestPopExpiredHandlesExpiresAtChanges(t *testing.T) {
+	expiryInterval := time.Second * 5
+	clock := tstest.NewClock(tstest.ClockOpts{Start: time.Now()})
+	assignments := addrAssignments{clock: clock}
+	makeAndAddAddrs := func(n int) *addrs {
+		t.Helper()
+		as := &addrs{
+			dst:     netip.MustParseAddr(fmt.Sprintf("0.0.1.%d", n)),
+			magic:   netip.MustParseAddr(fmt.Sprintf("0.0.2.%d", n)),
+			transit: netip.MustParseAddr(fmt.Sprintf("0.0.3.%d", n)),
+			app:     "a",
+			domain:  "example.com.",
+		}
+		err := assignments.insertWithExpiry(as, expiryInterval)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return as
+	}
+	addresses := []*addrs{}
+	// t = 0
+	for i := range 10 {
+		addresses = append(addresses, makeAndAddAddrs(i)) // expires at t=i+5
+		// We track the next addr to expire with a heap. updateExpiry changes the heap invariant.
+		// Twiddling the addrs in this particular way (updating item 1 after inserting 7) shows that
+		// we are fixing the heap after updating the invariant (if we weren't the test would fail).
+		if i == 6 {
+			assignments.updateExpiry(addresses[1], 20*time.Second) // addresses[1] expires at t=26
+		}
+		clock.Advance(time.Second)
+	}
+	// t = 10
+
+	expectedOrder := []int{0, 2, 3, 4, 5, 6, 7, 8, 9, 1}
+	i := 0
+	for tick := range 18 {
+		a := assignments.popExpired(clock.Now())
+		if a != nil {
+			expectedIdx := expectedOrder[i]
+			if a != addresses[expectedIdx] {
+				t.Fatalf("want %v, got %v at tick=%v", addresses[expectedIdx].magic, a.magic, tick)
+			}
+			i++
+		}
+		clock.Advance(time.Second)
+	}
+	if len(assignments.byMagicIP) != 0 {
+		t.Fatalf("expected assignments to be exhausted")
+	}
+}
diff --git a/feature/conn25/api.go b/feature/conn25/api.go
new file mode 100644
index 000000000..4b3953d42
--- /dev/null
+++ b/feature/conn25/api.go
@@ -0,0 +1,229 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package conn25
+
+import (
+	"cmp"
+	"encoding/json"
+	"maps"
+	"net/http"
+	"net/netip"
+	"slices"
+	"strings"
+
+	"tailscale.com/envknob"
+	"tailscale.com/ipn/ipnlocal"
+	"tailscale.com/ipn/localapi"
+	"tailscale.com/types/appctype"
+	"tailscale.com/util/dnsname"
+	"tailscale.com/util/httpm"
+	"tailscale.com/util/mak"
+	"tailscale.com/util/testenv"
+)
+
+// serveLocalAPIStateGet serves the localapi endpoint /conn25/state.
+// See also [*Conn25.GetActiveState].
+func serveLocalAPIStateGet(h *localapi.Handler, w http.ResponseWriter, r *http.Request) {
+	// TODO(tailscale/corp#39033): Remove for alpha release.
+	if !envknob.UseWIPCode() && !testenv.InTest() {
+		w.WriteHeader(http.StatusNotImplemented)
+		return
+	}
+	if !h.PermitRead {
+		http.Error(w, "conn25/state access denied", http.StatusForbidden)
+		return
+	}
+	if r.Method != httpm.GET {
+		http.Error(w, "GET required", http.StatusMethodNotAllowed)
+		return
+	}
+	ext, ok := ipnlocal.GetExt[*extension](h.LocalBackend())
+	if !ok {
+		http.Error(w, "miswired", http.StatusInternalServerError)
+		return
+	}
+	state := ext.conn25.GetActiveState()
+	w.Header().Set("Content-Type", "application/json")
+	if err := json.NewEncoder(w).Encode(state); err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+}
+
+// serveC2NStateGet serves the C2N endpoint /conn25/state.
+// See also [*Conn25.GetActiveState].
+func serveC2NStateGet(b *ipnlocal.LocalBackend, w http.ResponseWriter, r *http.Request) {
+	// TODO(tailscale/corp#39033): Remove for alpha release.
+	if !envknob.UseWIPCode() && !testenv.InTest() {
+		w.WriteHeader(http.StatusNotImplemented)
+		return
+	}
+
+	logf := b.Logger()
+	logf("c2n: GET /conn25/state received")
+
+	ext, ok := ipnlocal.GetExt[*extension](b)
+	if !ok {
+		http.Error(w, "miswired", http.StatusInternalServerError)
+		return
+	}
+	state := ext.conn25.GetActiveState()
+	w.Header().Set("Content-Type", "application/json")
+	if err := json.NewEncoder(w).Encode(state); err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+}
+
+// GetActiveState returns active state for the client and the connector,
+// including IP pool usage, address mappings, domains, and active flow counts.
+func (c *Conn25) GetActiveState() appctype.Conn25ActiveState {
+	if !c.isConfigured() {
+		return appctype.Conn25ActiveState{}
+	}
+
+	return appctype.Conn25ActiveState{
+		Configured: true,
+		Client:     c.client.getActiveState(),
+		Connector:  c.connector.getActiveState(),
+	}
+}
+
+// getActiveState gets active state from the client.
+// See [appctype.Conn25ClientState] for structure.
+func (c *client) getActiveState() appctype.Conn25ClientState {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	var appToDomains map[string]map[dnsname.FQDN][]appctype.Conn25ClientAddressState
+
+	// Pre-sort addresses by destination IP. They'll later be primary sorted
+	// by active flow count.
+	domainDstKeys := slices.Collect(maps.Keys(c.assignments.byDomainDst))
+	slices.SortFunc(domainDstKeys, func(a, b domainDst) int {
+		return a.dst.Compare(b.dst)
+	})
+
+	for _, domainDstKey := range domainDstKeys {
+		assignment := c.assignments.byDomainDst[domainDstKey]
+		domainMap := appToDomains[assignment.app]
+		addresses := domainMap[assignment.domain]
+		addresses = append(addresses, appctype.Conn25ClientAddressState{
+			ActiveFlowCount: assignment.activeFlowCount,
+			DestinationIP:   assignment.dst.String(),
+			MagicIP:         assignment.magic.String(),
+			TransitIP:       assignment.transit.String(),
+			ExpiresAt:       assignment.expiresAt,
+		})
+
+		mak.Set(&domainMap, assignment.domain, addresses)
+		mak.Set(&appToDomains, assignment.app, domainMap)
+	}
+
+	var apps []appctype.Conn25ClientAppState
+	for appName, domainMap := range appToDomains {
+		var app appctype.Conn25ClientAppState
+		app.App = appName
+		for domain, addresses := range domainMap {
+			var domainState appctype.Conn25ClientDomainState
+			domainState.Domain = domain
+
+			// Sort address mappings by descending active flow count.
+			slices.SortStableFunc(addresses, func(a, b appctype.Conn25ClientAddressState) int {
+				if a.ActiveFlowCount > b.ActiveFlowCount {
+					return -1
+				}
+				if a.ActiveFlowCount < b.ActiveFlowCount {
+					return 1
+				}
+				return 0
+			})
+			domainState.Addresses = addresses
+			app.Domains = append(app.Domains, domainState)
+		}
+
+		// Sort domains by hierarchy, e.g. "example.com", "sub.example.com".
+		slices.SortFunc(app.Domains, compareFQDNHierarchical)
+		apps = append(apps, app)
+	}
+
+	// Sort apps lexicographically.
+	slices.SortFunc(apps, func(a, b appctype.Conn25ClientAppState) int {
+		return strings.Compare(a.App, b.App)
+	})
+
+	return appctype.Conn25ClientState{
+		Apps: apps,
+		IPPoolStats: appctype.Conn25ClientIPPoolStats{
+			IPv4MagicIPsInUse:      c.v4MagicIPPool.inUseCount(),
+			IPv4MagicIPsCapacity:   c.v4MagicIPPool.capacity(),
+			IPv6MagicIPsInUse:      c.v6MagicIPPool.inUseCount(),
+			IPv6MagicIPsCapacity:   c.v6MagicIPPool.capacity(),
+			IPv4TransitIPsInUse:    c.v4TransitIPPool.inUseCount(),
+			IPv4TransitIPsCapacity: c.v4TransitIPPool.capacity(),
+			IPv6TransitIPsInUse:    c.v6TransitIPPool.inUseCount(),
+			IPv6TransitIPsCapacity: c.v6TransitIPPool.capacity(),
+		},
+	}
+}
+
+// getActiveState gets active state from the connector.
+// See [appctype.Conn25ConnectorState] for structure.
+func (c *connector) getActiveState() appctype.Conn25ConnectorState {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	var peers []appctype.Conn25ConnectorPeerState
+	// Sort peers by client IP.
+	for _, clientIP := range slices.SortedFunc(maps.Keys(c.transitIPs), netip.Addr.Compare) {
+		transitToAddr := c.transitIPs[clientIP]
+		var appToAddrs map[string][]appctype.Conn25ConnectorAddressState
+
+		// Sort address mappings by transit IP.
+		for _, transitIP := range slices.SortedFunc(maps.Keys(transitToAddr), netip.Addr.Compare) {
+			addr := transitToAddr[transitIP]
+			apiAddr := appctype.Conn25ConnectorAddressState{
+				DestinationIP: addr.addr.String(),
+				TransitIP:     transitIP.String(),
+			}
+			mak.Set(&appToAddrs, addr.app, append(appToAddrs[addr.app], apiAddr))
+		}
+
+		var apps []appctype.Conn25ConnectorAppState
+		for appName, addrs := range appToAddrs {
+			apps = append(apps, appctype.Conn25ConnectorAppState{
+				App:       appName,
+				Addresses: addrs,
+			})
+		}
+
+		// Sort apps lexicographically.
+		slices.SortFunc(apps, func(a, b appctype.Conn25ConnectorAppState) int {
+			return strings.Compare(a.App, b.App)
+		})
+
+		peers = append(peers, appctype.Conn25ConnectorPeerState{
+			ClientIP: clientIP.String(),
+			Apps:     apps,
+		})
+	}
+
+	return appctype.Conn25ConnectorState{Peers: peers}
+}
+
+// compareFQDNHierarchical sorts [appctype.Conn25ClientDomainState] hierarchically
+// such that parents precede their children, e.g. "example.com" precedes
+// "sub.example.com". If two domains aren't related, they are sorted lexicographically
+// from the root and moving forward, e.g. "example.com" precedes "abc.org".
+func compareFQDNHierarchical(ad, bd appctype.Conn25ClientDomainState) int {
+	a, b := ad.Domain, bd.Domain
+	al := strings.Split(a.WithoutTrailingDot(), ".")
+	bl := strings.Split(b.WithoutTrailingDot(), ".")
+	for i := 1; i <= len(al) && i <= len(bl); i++ {
+		if c := strings.Compare(al[len(al)-i], bl[len(bl)-i]); c != 0 {
+			return c
+		}
+	}
+	return cmp.Compare(len(al), len(bl))
+}
diff --git a/feature/conn25/api_test.go b/feature/conn25/api_test.go
new file mode 100644
index 000000000..b0c034875
--- /dev/null
+++ b/feature/conn25/api_test.go
@@ -0,0 +1,158 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package conn25
+
+import (
+	"net/netip"
+	"testing"
+	"time"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"tailscale.com/types/appctype"
+	"tailscale.com/types/logger"
+	"tailscale.com/util/dnsname"
+	"tailscale.com/util/must"
+)
+
+func TestGetActiveState(t *testing.T) {
+	mustFQDN := func(s string) dnsname.FQDN { return must.Get(dnsname.ToFQDN(s)) }
+	// Fixed, arbitrary expiry so the output is comparable.
+	expires := time.Date(2026, 7, 13, 12, 0, 0, 0, time.UTC)
+
+	t.Run("unconfigured", func(t *testing.T) {
+		c := newConn25(logger.Discard)
+		if diff := cmp.Diff(appctype.Conn25ActiveState{}, c.GetActiveState()); diff != "" {
+			t.Fatalf("unconfigured Conn25ActiveState mismatch (-want +got):\n%s", diff)
+		}
+	})
+
+	t.Run("configured", func(t *testing.T) {
+		c := newConn25(logger.Discard)
+		c.config.Store(&config{isConfigured: true})
+
+		client := c.client
+		client.assignments.byDomainDst = map[domainDst]*addrs{}
+		addClientAssignment := func(app, domain, dst, magic, transit string, flows int) {
+			as := &addrs{
+				app:             app,
+				domain:          mustFQDN(domain),
+				dst:             netip.MustParseAddr(dst),
+				magic:           netip.MustParseAddr(magic),
+				transit:         netip.MustParseAddr(transit),
+				activeFlowCount: flows,
+				expiresAt:       expires,
+			}
+			client.assignments.byDomainDst[domainDst{domain: as.domain, dst: as.dst}] = as
+		}
+		// Two addresses under app1/example.com: should sort by active flow
+		// count descending (5 before 2).
+		addClientAssignment("app1", "example.com", "10.0.0.1", "100.64.0.1", "169.254.0.1", 2)
+		addClientAssignment("app1", "example.com", "10.0.0.2", "100.64.0.2", "169.254.0.2", 5)
+		// example.com (2 labels) sorts before sub.example.com.
+		addClientAssignment("app1", "sub.example.com", "10.0.0.3", "100.64.0.3", "169.254.0.3", 1)
+		// A second app: apps sort by name, so app1 before zebra.
+		addClientAssignment("zebra", "z.example.org", "10.0.0.4", "100.64.0.4", "169.254.0.4", 1)
+
+		// IP addresses should be sorted numerically, not lexigraphically.
+		c.connector.transitIPs = map[netip.Addr]map[netip.Addr]appAddr{
+			netip.MustParseAddr("100.64.0.1"): {
+				netip.MustParseAddr("169.254.0.100"): {app: "app1", addr: netip.MustParseAddr("10.0.0.100")},
+				netip.MustParseAddr("169.254.0.11"):  {app: "app1", addr: netip.MustParseAddr("10.0.0.11")},
+			},
+			netip.MustParseAddr("11.0.0.1"): {
+				netip.MustParseAddr("169.254.0.5"): {app: "zapp", addr: netip.MustParseAddr("10.0.0.5")},
+				netip.MustParseAddr("169.254.0.6"): {app: "app1", addr: netip.MustParseAddr("10.0.0.6")},
+			},
+		}
+
+		// Configure the four IP pools with distinct capacities and hand out a
+		// distinct number of addresses from each.
+		mustPool := func(prefix string, handOut int) *ippool {
+			p := newIPPool(mustIPSetFromPrefix(prefix))
+			for range handOut {
+				if _, err := p.next(); err != nil {
+					t.Fatal(err)
+				}
+			}
+			return p
+		}
+		client.v4MagicIPPool = mustPool("100.64.0.0/30", 1)    // capacity 4
+		client.v6MagicIPPool = mustPool("fd7a:1::/125", 2)     // capacity 8
+		client.v4TransitIPPool = mustPool("169.254.0.0/28", 3) // capacity 16
+		client.v6TransitIPPool = mustPool("fd7a:2::/123", 4)   // capacity 32
+
+		want := appctype.Conn25ActiveState{
+			Configured: true,
+			Client: appctype.Conn25ClientState{
+				Apps: []appctype.Conn25ClientAppState{
+					{
+						App: "app1",
+						Domains: []appctype.Conn25ClientDomainState{
+							{
+								Domain: mustFQDN("example.com"),
+								Addresses: []appctype.Conn25ClientAddressState{
+									{ActiveFlowCount: 5, DestinationIP: "10.0.0.2", MagicIP: "100.64.0.2", TransitIP: "169.254.0.2", ExpiresAt: expires},
+									{ActiveFlowCount: 2, DestinationIP: "10.0.0.1", MagicIP: "100.64.0.1", TransitIP: "169.254.0.1", ExpiresAt: expires},
+								},
+							},
+							{
+								Domain: mustFQDN("sub.example.com"),
+								Addresses: []appctype.Conn25ClientAddressState{
+									{ActiveFlowCount: 1, DestinationIP: "10.0.0.3", MagicIP: "100.64.0.3", TransitIP: "169.254.0.3", ExpiresAt: expires},
+								},
+							},
+						},
+					},
+					{
+						App: "zebra",
+						Domains: []appctype.Conn25ClientDomainState{
+							{
+								Domain: mustFQDN("z.example.org"),
+								Addresses: []appctype.Conn25ClientAddressState{
+									{ActiveFlowCount: 1, DestinationIP: "10.0.0.4", MagicIP: "100.64.0.4", TransitIP: "169.254.0.4", ExpiresAt: expires},
+								},
+							},
+						},
+					},
+				},
+				IPPoolStats: appctype.Conn25ClientIPPoolStats{
+					IPv4MagicIPsInUse:      1,
+					IPv4MagicIPsCapacity:   4,
+					IPv6MagicIPsInUse:      2,
+					IPv6MagicIPsCapacity:   8,
+					IPv4TransitIPsInUse:    3,
+					IPv4TransitIPsCapacity: 16,
+					IPv6TransitIPsInUse:    4,
+					IPv6TransitIPsCapacity: 32,
+				},
+			},
+			Connector: appctype.Conn25ConnectorState{
+				Peers: []appctype.Conn25ConnectorPeerState{
+					{
+						ClientIP: "11.0.0.1",
+						Apps: []appctype.Conn25ConnectorAppState{
+							{App: "app1", Addresses: []appctype.Conn25ConnectorAddressState{{DestinationIP: "10.0.0.6", TransitIP: "169.254.0.6"}}},
+							{App: "zapp", Addresses: []appctype.Conn25ConnectorAddressState{{DestinationIP: "10.0.0.5", TransitIP: "169.254.0.5"}}},
+						},
+					},
+					{
+						ClientIP: "100.64.0.1",
+						Apps: []appctype.Conn25ConnectorAppState{
+							{App: "app1", Addresses: []appctype.Conn25ConnectorAddressState{
+								{DestinationIP: "10.0.0.11", TransitIP: "169.254.0.11"},
+								{DestinationIP: "10.0.0.100", TransitIP: "169.254.0.100"},
+							}},
+						},
+					},
+				},
+			},
+		}
+
+		got := c.GetActiveState()
+		if diff := cmp.Diff(want, got, cmpopts.EquateApproxTime(0)); diff != "" {
+			t.Fatalf("Conn25ActiveState mismatch (-want +got):\n%s", diff)
+		}
+	})
+}
diff --git a/feature/conn25/conn25.go b/feature/conn25/conn25.go
index e716c09d0..3ba94e0d4 100644
--- a/feature/conn25/conn25.go
+++ b/feature/conn25/conn25.go
@@ -14,27 +14,34 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"iter"
 	"net/http"
 	"net/netip"
 	"slices"
 	"strings"
 	"sync"
+	"sync/atomic"
+	"time"
 
 	"go4.org/netipx"
 	"golang.org/x/net/dns/dnsmessage"
 	"tailscale.com/appc"
 	"tailscale.com/envknob"
 	"tailscale.com/feature"
+	"tailscale.com/ipn"
 	"tailscale.com/ipn/ipnext"
 	"tailscale.com/ipn/ipnlocal"
+	"tailscale.com/ipn/localapi"
 	"tailscale.com/net/packet"
 	"tailscale.com/net/tsaddr"
 	"tailscale.com/net/tstun"
 	"tailscale.com/tailcfg"
+	"tailscale.com/tstime"
 	"tailscale.com/types/appctype"
 	"tailscale.com/types/key"
 	"tailscale.com/types/logger"
 	"tailscale.com/types/views"
+	"tailscale.com/util/clientmetric"
 	"tailscale.com/util/dnsname"
 	"tailscale.com/util/mak"
 	"tailscale.com/util/set"
@@ -77,6 +84,9 @@ func init() {
 		}, nil
 	})
 	ipnlocal.RegisterPeerAPIHandler("/v0/connector/transit-ip", handleConnectorTransitIP)
+	ipnlocal.HookReplyToDNSQueries.Add(handleHookReplyToDNSQueries)
+	localapi.Register("conn25/state", serveLocalAPIStateGet)
+	ipnlocal.RegisterC2N("GET /conn25/state", serveC2NStateGet)
 }
 
 func handleConnectorTransitIP(h ipnlocal.PeerAPIHandler, w http.ResponseWriter, r *http.Request) {
@@ -93,6 +103,18 @@ func handleConnectorTransitIP(h ipnlocal.PeerAPIHandler, w http.ResponseWriter,
 	e.handleConnectorTransitIP(h, w, r)
 }
 
+func handleHookReplyToDNSQueries(h ipnlocal.PeerAPIHandler) bool {
+	// TODO(tailscale/corp#39033): Remove for alpha release.
+	if !envknob.UseWIPCode() && !testenv.InTest() {
+		return false
+	}
+	e, ok := ipnlocal.GetExt[*extension](h.LocalBackend())
+	if !ok {
+		return false
+	}
+	return e.handleHookReplyToDNSQueries(h)
+}
+
 // extension is an [ipnext.Extension] managing the connector on platforms
 // that import this package.
 type extension struct {
@@ -120,14 +142,17 @@ func (e *extension) Init(host ipnext.Host) error {
 	}
 	e.host = host
 
-	dph := newDatapathHandler(e.conn25, e.conn25.client.logf)
+	dph := newDatapathHandler(e.conn25, e.conn25.logf)
 	if err := e.installHooks(dph); err != nil {
 		return err
 	}
+	profile, prefs := e.host.Profiles().CurrentProfileState()
+	e.profileStateChange(profile, prefs, false)
 
 	ctx, cancel := context.WithCancelCause(context.Background())
 	e.ctxCancel = cancel
 	go e.sendLoop(ctx)
+	dph.StartFlowExpirySweepers(ctx)
 	return nil
 }
 
@@ -141,6 +166,36 @@ func (e *extension) installHooks(dph *datapathHandler) error {
 	if !ok {
 		return errors.New("could not access system tun")
 	}
+	resolver := dnsManager.Resolver()
+	if resolver == nil {
+		return errors.New("dns manager resolver not ready")
+	}
+
+	if err := resolver.RegisterCustomScheme(appc.DNSAddrScheme, func(addr string) (string, error) {
+		scheme, appName, ok := strings.Cut(addr, ":")
+		if !ok || scheme != appc.DNSAddrScheme {
+			return "", fmt.Errorf("unexpected conn25 scheme %q", scheme)
+		}
+
+		if !e.conn25.isConfigured() {
+			return "", errors.New("conn25 not configured")
+		}
+		cfg, ok := e.conn25.getConfig()
+		if !ok {
+			return "", errors.New("conn25 no config found")
+		}
+		app, ok := cfg.appsByName[appName]
+		if !ok {
+			return "", errors.New("no app found for app name")
+		}
+		_, urlBase := e.pickConnectorURLBase(app)
+		if urlBase == "" {
+			return "", nil
+		}
+		return urlBase + "/dns-query", nil
+	}); err != nil {
+		return fmt.Errorf("could not register DNS resolver scheme: %w", err)
+	}
 
 	// Set up the DNS manager to rewrite responses for app domains
 	// to answer with Magic IPs.
@@ -153,24 +208,33 @@ func (e *extension) installHooks(dph *datapathHandler) error {
 
 	// Intercept packets from the tun device and from WireGuard
 	// to perform DNAT and SNAT.
-	tun.PreFilterPacketOutboundToWireGuardAppConnectorIntercept = func(p *packet.Parsed, _ *tstun.Wrapper) filter.Response {
+	tun.PreFilterPacketOutboundToWireGuardAppConnectorIntercept = func(p *packet.Parsed, tun *tstun.Wrapper) filter.Response {
 		if !e.conn25.isConfigured() {
 			return filter.Accept
 		}
-		return dph.HandlePacketFromTunDevice(p)
+		return dph.HandlePacketFromTunDevice(p, tun)
 	}
-	tun.PostFilterPacketInboundFromWireGuardAppConnector = func(p *packet.Parsed, _ *tstun.Wrapper) filter.Response {
+	tun.PostFilterPacketInboundFromWireGuardAppConnector = func(p *packet.Parsed, tun *tstun.Wrapper) filter.Response {
 		if !e.conn25.isConfigured() {
 			return filter.Accept
 		}
-		return dph.HandlePacketFromWireGuard(p)
+		return dph.HandlePacketFromWireGuard(p, tun)
+	}
+	tun.OnUnmappedTransitIPMessage = func(pkt packet.TailscaleRejectedHeader) {
+		if !e.conn25.isConfigured() {
+			return
+		}
+		e.conn25.client.resendTransitIPMapping(pkt.Dst.Addr())
 	}
 
 	// Manage how we react to changes to the current node,
-	// including property changes (e.g. HostInfo, Capabilities, CapMap)
-	// and profile switches.
+	// including property changes (e.g. HostInfo, Capabilities, CapMap).
 	e.host.Hooks().OnSelfChange.Add(e.onSelfChange)
 
+	// Manage how we react profile state changes, which include
+	// prefs changes.
+	e.host.Hooks().ProfileStateChange.Add(e.profileStateChange)
+
 	// Allow the client to send packets with Transit IP destinations
 	// in the link-local space.
 	e.host.Hooks().Filter.LinkLocalAllowHooks.Add(func(p packet.Parsed) (bool, string) {
@@ -207,29 +271,72 @@ func (e *extension) installHooks(dph *datapathHandler) error {
 	})
 
 	// Tell WireGuard what Transit IPs belong to which connector peers.
-	e.host.Hooks().ExtraWireGuardAllowedIPs.Set(func(k key.NodePublic) views.Slice[netip.Prefix] {
+	e.host.Hooks().ExtraWireGuardAllowedIPs.Set(func(peers iter.Seq2[tailcfg.NodeID, key.NodePublic]) map[tailcfg.NodeID][]netip.Prefix {
 		if !e.conn25.isConfigured() {
-			return views.Slice[netip.Prefix]{}
+			return nil
 		}
-		return e.extraWireGuardAllowedIPs(k)
+		var extras map[tailcfg.NodeID][]netip.Prefix
+		for id, k := range peers {
+			if pfxs := e.extraWireGuardAllowedIPs(k); pfxs.Len() > 0 {
+				mak.Set(&extras, id, pfxs.AsSlice())
+			}
+		}
+		return extras
 	})
 
 	return nil
 }
 
-// ClientTransitIPForMagicIP implements [IPMapper].
+// ClientTransitIPForMagicIP implements [Conn25Datapath].
 func (c *Conn25) ClientTransitIPForMagicIP(m netip.Addr) (netip.Addr, error) {
-	return c.client.transitIPForMagicIP(m)
+	if addr, ok := c.client.transitIPForMagicIP(m); ok {
+		return addr, nil
+	}
+	cfg, ok := c.getConfig()
+	if !ok {
+		return netip.Addr{}, nil
+	}
+	if !cfg.ipSets.v4Magic.Contains(m) && !cfg.ipSets.v6Magic.Contains(m) {
+		return netip.Addr{}, nil
+	}
+	return netip.Addr{}, ErrUnmappedMagicIP
 }
 
-// ConnectorRealIPForTransitIPConnection implements [IPMapper].
+// ClientFlowCreated implements [Conn25Datapath].
+// The datapath notifies Conn25 that a flow with transitIP has been created so
+// that Conn25 can prevent that transit IP and associated addresses from being
+// removed from its state and returned to their pools.
+func (c *Conn25) ClientFlowCreated(transitIP netip.Addr) {
+	c.client.flowCreated(transitIP)
+}
+
+// ClientFlowRemoved implements [Conn25Datapath].
+// See [Conn25.ClientFlowCreated].
+func (c *Conn25) ClientFlowRemoved(transitIP netip.Addr) {
+	c.client.flowRemoved(transitIP)
+}
+
+// ConnectorRealIPForTransitIPConnection implements [Conn25Datapath].
 func (c *Conn25) ConnectorRealIPForTransitIPConnection(src, transit netip.Addr) (netip.Addr, error) {
-	return c.connector.realIPForTransitIPConnection(src, transit)
+	if addr, ok := c.connector.realIPForTransitIPConnection(src, transit); ok {
+		return addr, nil
+	}
+	cfg, ok := c.getConfig()
+	if !ok {
+		return netip.Addr{}, nil
+	}
+	if !cfg.ipSets.v4Transit.Contains(transit) && !cfg.ipSets.v6Transit.Contains(transit) {
+		return netip.Addr{}, nil
+	}
+	return netip.Addr{}, ErrUnmappedSrcAndTransitIP
 }
 
 func (e *extension) getMagicRange() views.Slice[netip.Prefix] {
-	cfg := e.conn25.client.getConfig()
-	return views.SliceOf(slices.Concat(cfg.v4MagicIPSet.Prefixes(), cfg.v6MagicIPSet.Prefixes()))
+	cfg, ok := e.conn25.getConfig()
+	if !ok {
+		return views.Slice[netip.Prefix]{}
+	}
+	return views.SliceOf(slices.Concat(cfg.ipSets.v4Magic.Prefixes(), cfg.ipSets.v6Magic.Prefixes()))
 }
 
 // Shutdown implements [ipnlocal.Extension].
@@ -264,12 +371,30 @@ func (e *extension) handleConnectorTransitIP(h ipnlocal.PeerAPIHandler, w http.R
 	w.Write(bs)
 }
 
+func (e *extension) handleHookReplyToDNSQueries(h ipnlocal.PeerAPIHandler) bool {
+	if !e.conn25.isConfigured() {
+		return false
+	}
+	// TODO(tailscale/corp#40076): verify the peer has access to the query's
+	// app (if any) domain.
+	return true
+}
+
+// onSelfChange implements the [ipnext.Hooks.OnSelfChange] hook.
 func (e *extension) onSelfChange(selfNode tailcfg.NodeView) {
-	err := e.conn25.reconfig(selfNode)
+	cfg, err := configFromNodeView(selfNode)
 	if err != nil {
-		e.conn25.client.logf("error during Reconfig onSelfChange: %v", err)
+		e.conn25.logf("error generating config from self node view: %v", err)
 		return
 	}
+	e.conn25.reconfig(cfg)
+}
+
+// profileStateChange implements the [ipnext.Hooks.ProfileStateChange] hook.
+func (e *extension) profileStateChange(loginProfile ipn.LoginProfileView, prefs ipn.PrefsView, sameNode bool) {
+	// TODO(mzb): Handle node changes. Wipe out all config?
+	// We'll need to look at the ordering of this hook and onSelfChange.
+	e.conn25.prefsAdvertiseConnector.Store(prefs.AppConnector().Advertise)
 }
 
 func (e *extension) extraWireGuardAllowedIPs(k key.NodePublic) views.Slice[netip.Prefix] {
@@ -283,21 +408,44 @@ type appAddr struct {
 
 // Conn25 holds state for routing traffic for a domain via a connector.
 type Conn25 struct {
-	client    *client
-	connector *connector
+	config                  atomic.Pointer[config]
+	prefsAdvertiseConnector atomic.Bool
+	logf                    logger.Logf
+	client                  *client
+	connector               *connector
+}
+
+func (c *Conn25) getConfig() (*config, bool) {
+	cfg := c.config.Load()
+	return cfg, cfg.isConfigured
 }
 
 func (c *Conn25) isConfigured() bool {
-	return c.client.isConfigured()
+	_, ok := c.getConfig()
+	return ok
 }
 
 func newConn25(logf logger.Logf) *Conn25 {
 	c := &Conn25{
-		client: &client{
-			logf:    logf,
-			addrsCh: make(chan addrs, 64),
-		},
-		connector: &connector{logf: logf},
+		logf: logf,
+	}
+	getIPSets := func() ipSets {
+		cfg, ok := c.getConfig()
+		if !ok {
+			return emptyIPSets()
+		}
+		return cfg.ipSets
+	}
+	c.config.Store(&config{}) // initialize with empty to avoid nil checks
+	c.client = &client{
+		logf:        logf,
+		addrsCh:     make(chan addrs, 64),
+		assignments: addrAssignments{clock: tstime.StdClock{}},
+		getIPSets:   getIPSets,
+	}
+	c.connector = &connector{
+		logf:      logf,
+		getIPSets: getIPSets,
 	}
 	return c
 }
@@ -310,24 +458,9 @@ func ipSetFromIPRanges(rs []netipx.IPRange) (*netipx.IPSet, error) {
 	return b.IPSet()
 }
 
-func (c *Conn25) reconfig(selfNode tailcfg.NodeView) error {
-	cfg, err := configFromNodeView(selfNode)
-	if err != nil {
-		return err
-	}
-	if err := c.client.reconfig(cfg); err != nil {
-		return err
-	}
-	if err := c.connector.reconfig(cfg); err != nil {
-		return err
-	}
-	return nil
-}
-
-// mapDNSResponse parses and inspects the DNS response, and uses the
-// contents to assign addresses for connecting.
-func (c *Conn25) mapDNSResponse(buf []byte) []byte {
-	return c.client.mapDNSResponse(buf)
+func (c *Conn25) reconfig(cfg *config) {
+	c.config.Store(cfg)
+	c.client.reconfig()
 }
 
 const dupeTransitIPMessage = "Duplicate transit address in ConnectorTransitIPRequest"
@@ -341,6 +474,21 @@ const unknownAppNameMessage = "The App name in the request does not match a conf
 // family of the transitIP). If a peer has stored this mapping in the connector,
 // Conn25 will route traffic to TransitIPs to DestinationIPs for that peer.
 func (c *Conn25) handleConnectorTransitIPRequest(n tailcfg.NodeView, ctipr ConnectorTransitIPRequest) ConnectorTransitIPResponse {
+	resp := ConnectorTransitIPResponse{}
+	cfg, ok := c.getConfig()
+	if !ok {
+		// TODO(mzb): If this node is no longer configured at the
+		// the time of this call, perhaps there should be a top-level
+		// error, instead of error-per-TransitIP?
+		for range ctipr.TransitIPs {
+			resp.TransitIPs = append(resp.TransitIPs, TransitIPResponse{
+				Code:    UnknownAppName,
+				Message: unknownAppNameMessage,
+			})
+		}
+		return resp
+	}
+
 	var peerIPv4, peerIPv6 netip.Addr
 	for _, ip := range n.Addresses().All() {
 		if !ip.IsSingleIP() || !tsaddr.IsTailscaleIP(ip.Addr()) {
@@ -353,7 +501,6 @@ func (c *Conn25) handleConnectorTransitIPRequest(n tailcfg.NodeView, ctipr Conne
 		}
 	}
 
-	resp := ConnectorTransitIPResponse{}
 	seen := map[netip.Addr]bool{}
 	for _, each := range ctipr.TransitIPs {
 		if seen[each.TransitIP] {
@@ -361,10 +508,20 @@ func (c *Conn25) handleConnectorTransitIPRequest(n tailcfg.NodeView, ctipr Conne
 				Code:    DuplicateTransitIP,
 				Message: dupeTransitIPMessage,
 			})
-			c.connector.logf("[Unexpected] peer attempt to map a transit IP reused a transitIP: node: %s, IP: %v",
+			c.logf("[Unexpected] peer attempt to map a transit IP reused a transitIP: node: %s, IP: %v",
 				n.StableID(), each.TransitIP)
 			continue
 		}
+
+		if _, ok := cfg.appsByName[each.App]; !ok {
+			resp.TransitIPs = append(resp.TransitIPs, TransitIPResponse{
+				Code:    UnknownAppName,
+				Message: unknownAppNameMessage,
+			})
+			c.logf("[Unexpected] peer attempt to map a transit IP referenced unknown app: node: %s, app: %q",
+				n.StableID(), each.App)
+			continue
+		}
 		tipresp := c.connector.handleTransitIPRequest(n, peerIPv4, peerIPv6, each)
 		seen[each.TransitIP] = true
 		resp.TransitIPs = append(resp.TransitIPs, tipresp)
@@ -397,12 +554,6 @@ func (c *connector) handleTransitIPRequest(n tailcfg.NodeView, peerV4 netip.Addr
 
 	c.mu.Lock()
 	defer c.mu.Unlock()
-	if _, ok := c.config.appsByName[tipr.App]; !ok {
-		c.logf("[Unexpected] peer attempt to map a transit IP referenced unknown app: node: %s, app: %q",
-			n.StableID(), tipr.App)
-		return TransitIPResponse{Code: UnknownAppName, Message: unknownAppNameMessage}
-	}
-
 	if c.transitIPs == nil {
 		c.transitIPs = make(map[netip.Addr]map[netip.Addr]appAddr)
 	}
@@ -484,76 +635,111 @@ type ConnectorTransitIPResponse struct {
 }
 
 const AppConnectorsExperimentalAttrName = "tailscale.com/app-connectors-experimental"
+const AppConnectorsExperimentalIPPoolsAttrName = "tailscale.com/app-connectors-experimental-ippools"
 
-// config holds the config from the policy and lookups derived from that.
-// config is not safe for concurrent use.
-type config struct {
-	isConfigured      bool
-	apps              []appctype.Conn25Attr
-	appsByName        map[string]appctype.Conn25Attr
-	appNamesByDomain  map[dnsname.FQDN][]string
-	selfRoutedDomains set.Set[dnsname.FQDN]
-	v4TransitIPSet    netipx.IPSet
-	v4MagicIPSet      netipx.IPSet
-	v6TransitIPSet    netipx.IPSet
-	v6MagicIPSet      netipx.IPSet
+// ipSets wraps all the IPSets the config needs.
+type ipSets struct {
+	v4Transit *netipx.IPSet
+	v4Magic   *netipx.IPSet
+	v6Transit *netipx.IPSet
+	v6Magic   *netipx.IPSet
 }
 
-func configFromNodeView(n tailcfg.NodeView) (config, error) {
+func emptyIPSets() ipSets {
+	return ipSets{
+		v4Transit: &netipx.IPSet{},
+		v4Magic:   &netipx.IPSet{},
+		v6Transit: &netipx.IPSet{},
+		v6Magic:   &netipx.IPSet{},
+	}
+}
+
+// config holds the config derived from the self node view,
+// which includes the policy.
+// config is not safe for concurrent use.
+type config struct {
+	isConfigured       bool
+	apps               []appctype.Conn25Attr
+	appsByName         map[string]appctype.Conn25Attr
+	appNamesByDomain   map[dnsname.FQDN][]string
+	appNamesByWCDomain map[dnsname.FQDN][]string
+	selfAppNames       set.Set[string]
+	ipSets             ipSets
+}
+
+func configFromNodeView(n tailcfg.NodeView) (*config, error) {
 	apps, err := tailcfg.UnmarshalNodeCapViewJSON[appctype.Conn25Attr](n.CapMap(), AppConnectorsExperimentalAttrName)
 	if err != nil {
-		return config{}, err
+		return &config{}, err
 	}
 	if len(apps) == 0 {
-		return config{}, nil
+		return &config{}, nil
 	}
+	poolsSlice, err := tailcfg.UnmarshalNodeCapViewJSON[appctype.Conn25PoolsAttr](n.CapMap(), AppConnectorsExperimentalIPPoolsAttrName)
+	if err != nil {
+		return &config{}, err
+	}
+	if len(poolsSlice) != 1 {
+		return &config{}, errors.New("must be one conn25 pools nodeattr")
+	}
+	pools := poolsSlice[0]
 	selfTags := set.SetOf(n.Tags().AsSlice())
-	cfg := config{
-		isConfigured:      true,
-		apps:              apps,
-		appsByName:        map[string]appctype.Conn25Attr{},
-		appNamesByDomain:  map[dnsname.FQDN][]string{},
-		selfRoutedDomains: set.Set[dnsname.FQDN]{},
+	cfg := &config{
+		isConfigured:       true,
+		apps:               apps,
+		appsByName:         map[string]appctype.Conn25Attr{},
+		appNamesByDomain:   map[dnsname.FQDN][]string{},
+		appNamesByWCDomain: map[dnsname.FQDN][]string{},
+		selfAppNames:       set.Set[string]{},
+		ipSets:             emptyIPSets(),
 	}
 	for _, app := range apps {
-		selfMatchesTags := slices.ContainsFunc(app.Connectors, selfTags.Contains)
+		normalizedDomains := set.Set[dnsname.FQDN]{}
+		normalizedWCDomains := set.Set[dnsname.FQDN]{}
 		for _, d := range app.Domains {
-			fqdn, err := normalizeDNSName(d)
+			domain, isWild := strings.CutPrefix(d, "*.")
+			fqdn, err := normalizeDNSName(domain)
 			if err != nil {
-				return config{}, err
+				return &config{}, err
 			}
-			mak.Set(&cfg.appNamesByDomain, fqdn, append(cfg.appNamesByDomain[fqdn], app.Name))
-			if selfMatchesTags {
-				cfg.selfRoutedDomains.Add(fqdn)
+			if isWild && !normalizedWCDomains.Contains(fqdn) {
+				normalizedWCDomains.Add(fqdn)
+				mak.Set(&cfg.appNamesByWCDomain, fqdn, append(cfg.appNamesByWCDomain[fqdn], app.Name))
+			} else if !isWild && !normalizedDomains.Contains(fqdn) {
+				normalizedDomains.Add(fqdn)
+				mak.Set(&cfg.appNamesByDomain, fqdn, append(cfg.appNamesByDomain[fqdn], app.Name))
 			}
 		}
 		mak.Set(&cfg.appsByName, app.Name, app)
+		if slices.ContainsFunc(app.Connectors, selfTags.Contains) {
+			cfg.selfAppNames.Add(app.Name)
+		}
+
 	}
-	// TODO(fran) 2026-03-18 we don't yet have a proper way to communicate the
-	// global IP pool config. For now just take it from the first app.
-	if len(apps) != 0 {
-		app := apps[0]
-		v4Mipp, err := ipSetFromIPRanges(app.V4MagicIPPool)
-		if err != nil {
-			return config{}, err
-		}
-		v4Tipp, err := ipSetFromIPRanges(app.V4TransitIPPool)
-		if err != nil {
-			return config{}, err
-		}
-		v6Mipp, err := ipSetFromIPRanges(app.V6MagicIPPool)
-		if err != nil {
-			return config{}, err
-		}
-		v6Tipp, err := ipSetFromIPRanges(app.V6TransitIPPool)
-		if err != nil {
-			return config{}, err
-		}
-		cfg.v4MagicIPSet = *v4Mipp
-		cfg.v4TransitIPSet = *v4Tipp
-		cfg.v6MagicIPSet = *v6Mipp
-		cfg.v6TransitIPSet = *v6Tipp
+
+	v4Mipp, err := ipSetFromIPRanges(pools.V4MagicIPPool)
+	if err != nil {
+		return &config{}, err
 	}
+	v4Tipp, err := ipSetFromIPRanges(pools.V4TransitIPPool)
+	if err != nil {
+		return &config{}, err
+	}
+	v6Mipp, err := ipSetFromIPRanges(pools.V6MagicIPPool)
+	if err != nil {
+		return &config{}, err
+	}
+	v6Tipp, err := ipSetFromIPRanges(pools.V6TransitIPPool)
+	if err != nil {
+		return &config{}, err
+	}
+	ipSets := ipSets{
+		v4Magic:   v4Mipp,
+		v4Transit: v4Tipp,
+		v6Magic:   v6Mipp,
+		v6Transit: v6Tipp,
+	}
+	cfg.ipSets = ipSets
 	return cfg, nil
 }
 
@@ -562,8 +748,9 @@ func configFromNodeView(n tailcfg.NodeView) (config, error) {
 // connectors.
 // It's safe for concurrent use.
 type client struct {
-	logf    logger.Logf
-	addrsCh chan addrs
+	logf      logger.Logf
+	addrsCh   chan addrs
+	getIPSets func() ipSets
 
 	mu              sync.Mutex // protects the fields below
 	v4MagicIPPool   *ippool
@@ -571,28 +758,19 @@ type client struct {
 	v6MagicIPPool   *ippool
 	v6TransitIPPool *ippool
 	assignments     addrAssignments
-	config          config
+	byConnKey       map[key.NodePublic]set.Set[netip.Prefix]
 }
 
-func (c *client) getConfig() config {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	return c.config
-}
-
-// transitIPForMagicIP is part of the implementation of the IPMapper interface for dataflows lookups.
-// See also [IPMapper.ClientTransitIPForMagicIP].
-func (c *client) transitIPForMagicIP(magicIP netip.Addr) (netip.Addr, error) {
+// transitIPForMagicIP is part of the implementation of the [Conn25Datapath] interface for dataflow lookups.
+// See also [Conn25Datapath.ClientTransitIPForMagicIP].
+func (c *client) transitIPForMagicIP(magicIP netip.Addr) (netip.Addr, bool) {
 	c.mu.Lock()
 	defer c.mu.Unlock()
 	v, ok := c.assignments.lookupByMagicIP(magicIP)
 	if ok {
-		return v.transit, nil
+		return v.transit, true
 	}
-	if !c.config.v4MagicIPSet.Contains(magicIP) && !c.config.v6MagicIPSet.Contains(magicIP) {
-		return netip.Addr{}, nil
-	}
-	return netip.Addr{}, ErrUnmappedMagicIP
+	return netip.Addr{}, false
 }
 
 // linkLocalAllow returns true if the provided packet with a link-local Dst address has a
@@ -615,88 +793,122 @@ func (c *client) isKnownTransitIP(tip netip.Addr) bool {
 	return ok
 }
 
-func (c *client) isConfigured() bool {
+func (c *client) reconfig() {
 	c.mu.Lock()
 	defer c.mu.Unlock()
-	return c.config.isConfigured
+
+	ipSets := c.getIPSets()
+
+	c.v4MagicIPPool = c.v4MagicIPPool.reconfig(ipSets.v4Magic)
+	c.v4TransitIPPool = c.v4TransitIPPool.reconfig(ipSets.v4Transit)
+	c.v6MagicIPPool = c.v6MagicIPPool.reconfig(ipSets.v6Magic)
+	c.v6TransitIPPool = c.v6TransitIPPool.reconfig(ipSets.v6Transit)
 }
 
-func (c *client) reconfig(newCfg config) error {
-	c.mu.Lock()
-	defer c.mu.Unlock()
+// getAppsForConnectorDomain returns the slice of app names which match the
+// provided domain. Apps which match the domain exactly are preferred,
+// otherwise the list of apps comes from the wildcard domain which matches
+// the longest suffix of the specified domain. A nil or empty slice is returned
+// if no match is found or if the list of matching apps would contain an app
+// which is being handled by the self-node's connector.
+func (cfg *config) getAppsForConnectorDomain(domain dnsname.FQDN, prefsAdvertiseConnector bool) []string {
+	// Lookup exact matches first
+	appNames := cfg.appNamesByDomain[domain]
+	if len(appNames) == 0 {
+		// No exact match, check wildcard domains
+		// We have made the decision that wildcards will match the base domain.
+		// So example.com will be a match for *.example.com, because we think that
+		// this is most likely what users will expect.
+		for d := domain; d != ""; d = d.Parent() {
+			if appNames = cfg.appNamesByWCDomain[d]; len(appNames) > 0 {
+				break
+			}
+		}
+	}
 
-	c.config = newCfg
-
-	c.v4MagicIPPool = newIPPool(&(newCfg.v4MagicIPSet))
-	c.v4TransitIPPool = newIPPool(&(newCfg.v4TransitIPSet))
-	c.v6MagicIPPool = newIPPool(&(newCfg.v6MagicIPSet))
-	c.v6TransitIPPool = newIPPool(&(newCfg.v6TransitIPSet))
-	return nil
-}
-
-func (c *client) isConnectorDomain(domain dnsname.FQDN) bool {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	appNames, ok := c.config.appNamesByDomain[domain]
-	return ok && len(appNames) > 0
+	// If we have a candidate match, make sure that no candidate app is pointing
+	// at a connector on the self-node.
+	if len(appNames) == 0 || (prefsAdvertiseConnector && slices.ContainsFunc(appNames, cfg.selfAppNames.Contains)) {
+		return nil
+	}
+	return appNames
 }
 
 // reserveAddresses tries to make an assignment of addrs from the address pools
 // for this domain+dst address, so that this client can use conn25 connectors.
+// The name of the matching app is also provided, no validation is done to check whether or not
+// the app name refers to a configured app.
 // It checks that this domain should be routed and that this client is not itself a connector for the domain
 // and generally if it is valid to make the assignment.
-func (c *client) reserveAddresses(domain dnsname.FQDN, dst netip.Addr) (addrs, error) {
+func (c *client) reserveAddresses(appName string, domain dnsname.FQDN, dst netip.Addr, ttl time.Duration) (*addrs, error) {
 	if !dst.IsValid() {
-		return addrs{}, errors.New("dst is not valid")
+		return nil, errors.New("dst is not valid")
 	}
 	c.mu.Lock()
 	defer c.mu.Unlock()
 	if existing, ok := c.assignments.lookupByDomainDst(domain, dst); ok {
+		c.assignments.updateFromTTL(existing, ttl)
 		return existing, nil
 	}
-	appNames, _ := c.config.appNamesByDomain[domain]
-	if len(appNames) == 0 {
-		return addrs{}, fmt.Errorf("no app names found for domain %q", domain)
+
+	// Before we check out more addresses from the pools try to return some.
+	// Trying to return any number greater than 1 will cause the number of
+	// addresses used to trend down in general. But as we have 2 different
+	// pools for the different IP versions, use a number a bit higher than
+	// 2 to try and process bursty behavior faster.
+	now := c.assignments.clock.Now()
+	for range 10 {
+		a := c.assignments.popExpired(now)
+		if a == nil {
+			break
+		}
+		if a.is4() {
+			c.v4MagicIPPool.returnAddr(a.magic)
+			c.v4TransitIPPool.returnAddr(a.transit)
+		} else if a.is6() {
+			c.v6MagicIPPool.returnAddr(a.magic)
+			c.v6TransitIPPool.returnAddr(a.transit)
+		} else {
+			return nil, errors.New("unexpected neither 4 nor 6")
+		}
 	}
-	// only reserve for first app
-	app := appNames[0]
 
 	var mip, tip netip.Addr
 	var err error
 	if dst.Is4() {
 		mip, err = c.v4MagicIPPool.next()
 		if err != nil {
-			return addrs{}, err
+			return nil, err
 		}
 		tip, err = c.v4TransitIPPool.next()
 		if err != nil {
-			return addrs{}, err
+			return nil, err
 		}
 	} else if dst.Is6() {
 		mip, err = c.v6MagicIPPool.next()
 		if err != nil {
-			return addrs{}, err
+			return nil, err
 		}
 		tip, err = c.v6TransitIPPool.next()
 		if err != nil {
-			return addrs{}, err
+			return nil, err
 		}
 	} else {
-		return addrs{}, errors.New("unexpected neither 4 nor 6")
+		return nil, errors.New("unexpected neither 4 nor 6")
 	}
-	as := addrs{
+	as := &addrs{
 		dst:     dst,
 		magic:   mip,
 		transit: tip,
-		app:     app,
+		app:     appName,
 		domain:  domain,
 	}
-	if err := c.assignments.insert(as); err != nil {
-		return addrs{}, err
+	if err := c.assignments.insertFromTTL(as, ttl); err != nil {
+		return nil, err
 	}
 	err = c.enqueueAddressAssignment(as)
 	if err != nil {
-		return addrs{}, err
+		return nil, err
 	}
 	return as, nil
 }
@@ -708,7 +920,7 @@ func (c *client) addTransitIPForConnector(tip netip.Addr, conn tailcfg.NodeView)
 
 	c.mu.Lock()
 	defer c.mu.Unlock()
-	return c.assignments.insertTransitConnMapping(tip, conn.Key())
+	return c.insertTransitConnMapping(tip, conn.Key())
 }
 
 func (e *extension) sendLoop(ctx context.Context) {
@@ -718,7 +930,7 @@ func (e *extension) sendLoop(ctx context.Context) {
 			return
 		case as := <-e.conn25.client.addrsCh:
 			if err := e.handleAddressAssignment(ctx, as); err != nil {
-				e.conn25.client.logf("error handling transit IP assignment (app: %s, mip: %v, src: %v): %v", as.app, as.magic, as.dst, err)
+				e.conn25.logf("error handling transit IP assignment (app: %s, mip: %v, src: %v): %v", as.app, as.magic, as.dst, err)
 			}
 		}
 	}
@@ -738,11 +950,11 @@ func (e *extension) handleAddressAssignment(ctx context.Context, as addrs) error
 	return nil
 }
 
-func (c *client) enqueueAddressAssignment(addrs addrs) error {
+func (c *client) enqueueAddressAssignment(addrs *addrs) error {
 	select {
 	// TODO(fran) investigate the value of waiting for multiple addresses and sending them
 	// in one ConnectorTransitIPRequest
-	case c.addrsCh <- addrs:
+	case c.addrsCh <- *addrs:
 		return nil
 	default:
 		c.logf("address assignment queue full, dropping transit assignment for %v", addrs.domain)
@@ -750,10 +962,33 @@ func (c *client) enqueueAddressAssignment(addrs addrs) error {
 	}
 }
 
+func (c *client) flowCreated(transit netip.Addr) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	entry, ok := c.assignments.byTransitIP[transit]
+	if !ok {
+		return
+	}
+	entry.activeFlowCount++
+}
+
+func (c *client) flowRemoved(transit netip.Addr) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	entry, ok := c.assignments.byTransitIP[transit]
+	if !ok {
+		return
+	}
+	entry.activeFlowCount--
+	if entry.activeFlowCount == 0 {
+		entry.zeroFlowTime = c.assignments.clock.Now()
+	}
+}
+
 func (c *client) extraWireGuardAllowedIPs(k key.NodePublic) views.Slice[netip.Prefix] {
 	c.mu.Lock()
 	defer c.mu.Unlock()
-	tips, ok := c.assignments.lookupTransitIPsByConnKey(k)
+	tips, ok := c.lookupTransitIPsByConnKey(k)
 	if !ok {
 		return views.Slice[netip.Prefix]{}
 	}
@@ -801,13 +1036,7 @@ func makePeerAPIReq(ctx context.Context, httpClient *http.Client, urlBase string
 	return nil
 }
 
-func (e *extension) sendAddressAssignment(ctx context.Context, as addrs) (tailcfg.NodeView, error) {
-	app, ok := e.conn25.client.getConfig().appsByName[as.app]
-	if !ok {
-		e.conn25.client.logf("App not found for app: %s (domain: %s)", as.app, as.domain)
-		return tailcfg.NodeView{}, errors.New("app not found")
-	}
-
+func (e *extension) pickConnectorURLBase(app appctype.Conn25Attr) (tailcfg.NodeView, string) {
 	nb := e.host.NodeBackend()
 	peers := appc.PickConnector(nb, app)
 	var urlBase string
@@ -819,6 +1048,20 @@ func (e *extension) sendAddressAssignment(ctx context.Context, as addrs) (tailcf
 			break
 		}
 	}
+	return conn, urlBase
+}
+
+func (e *extension) sendAddressAssignment(ctx context.Context, as addrs) (tailcfg.NodeView, error) {
+	cfg, ok := e.conn25.getConfig()
+	if !ok {
+		return tailcfg.NodeView{}, errors.New("not configured")
+	}
+	app, ok := cfg.appsByName[as.app]
+	if !ok {
+		e.conn25.client.logf("App not found for app: %s (domain: %s)", as.app, as.domain)
+		return tailcfg.NodeView{}, errors.New("app not found")
+	}
+	conn, urlBase := e.pickConnectorURLBase(app)
 	if urlBase == "" {
 		return tailcfg.NodeView{}, errors.New("no connector peer found to handle address assignment")
 	}
@@ -827,8 +1070,9 @@ func (e *extension) sendAddressAssignment(ctx context.Context, as addrs) (tailcf
 }
 
 type dnsResponseRewrite struct {
-	domain dnsname.FQDN
-	dst    netip.Addr
+	domain     dnsname.FQDN
+	dst        netip.Addr
+	ttlSeconds uint32
 }
 
 func makeServFail(logf logger.Logf, h dnsmessage.Header, q dnsmessage.Question) []byte {
@@ -856,16 +1100,31 @@ func makeServFail(logf logger.Logf, h dnsmessage.Header, q dnsmessage.Question)
 	return bs
 }
 
-func (c *client) mapDNSResponse(buf []byte) []byte {
+var (
+	// metricDNSResponseRewriteErrorServfail increments servfail returns
+	// on an error rewriting response for an app connector domain.
+	metricDNSResponseRewriteErrorServfail = clientmetric.NewCounter(
+		"conn25_map_dns_response_rewrite_error_servfail",
+	)
+
+	// metricDNSResponseRewriteUnsupportedQuestionTypeErrorServfail increments servfail returns
+	// on an error rewriting empty answers to an unsupported question type for an app connector domain.
+	metricDNSResponseRewriteUnsupportedQuestionTypeErrorServfail = clientmetric.NewCounter(
+		"conn25_map_dns_response_rewrite_unsupported_question_type_error_servfail",
+	)
+)
+
+// mapDNSResponse parses and inspects the DNS response. If the domain
+// is determined to belong to app this node is client for, it assigns addresses
+// for connecting and rewrites the response to contain Magic IPs.
+func (c *Conn25) mapDNSResponse(buf []byte) []byte {
 	var p dnsmessage.Parser
 	hdr, err := p.Start(buf)
 	if err != nil {
-		c.logf("error parsing dns response: %v", err)
 		return buf
 	}
 	questions, err := p.AllQuestions()
 	if err != nil {
-		c.logf("error parsing dns response: %v", err)
 		return buf
 	}
 	// Any message we are interested in has one question (RFC 9619)
@@ -881,20 +1140,31 @@ func (c *client) mapDNSResponse(buf []byte) []byte {
 	if err != nil {
 		return buf
 	}
-	if !c.isConnectorDomain(queriedDomain) {
+
+	cfg, ok := c.getConfig()
+	if !ok {
 		return buf
 	}
 
+	appNames := cfg.getAppsForConnectorDomain(queriedDomain, c.prefsAdvertiseConnector.Load())
+	if len(appNames) == 0 {
+		return buf
+	}
+
+	// There is guaranteed to be at least one matching app, so just take the first one for now
+	appName := appNames[0]
+
 	// Now we know this is a dns response we think we should rewrite, we're going to provide our response which
 	// currently means we will:
 	//  * write the questions through as they are
 	//  * not send through the additional section
 	//  * provide our answers, or no answers if we don't handle those answers (possibly in the future we should write through answers for eg TypeTXT)
 	var answers []dnsResponseRewrite
+	var cnameChain map[dnsname.FQDN]dnsname.FQDN
 	if question.Type != dnsmessage.TypeA && question.Type != dnsmessage.TypeAAAA {
-		c.logf("mapping dns response for connector domain, unsupported type: %v", question.Type)
-		newBuf, err := c.rewriteDNSResponse(hdr, questions, answers)
+		newBuf, err := c.client.rewriteDNSResponse(appName, hdr, questions, answers)
 		if err != nil {
+			metricDNSResponseRewriteUnsupportedQuestionTypeErrorServfail.Add(1)
 			c.logf("error writing empty response for unsupported type: %v", err)
 			return makeServFail(c.logf, hdr, question)
 		}
@@ -906,87 +1176,112 @@ func (c *client) mapDNSResponse(buf []byte) []byte {
 			break
 		}
 		if err != nil {
-			c.logf("error parsing dns response: %v", err)
 			return makeServFail(c.logf, hdr, question)
 		}
 		// other classes are unsupported, and we checked the question was for ClassINET already
 		if h.Class != dnsmessage.ClassINET {
-			c.logf("unexpected class for connector domain dns response: %v %v", queriedDomain, h.Class)
 			if err := p.SkipAnswer(); err != nil {
-				c.logf("error parsing dns response: %v", err)
 				return makeServFail(c.logf, hdr, question)
 			}
 			continue
 		}
 		switch h.Type {
 		case dnsmessage.TypeCNAME:
-			// An A record was asked for, and the answer is a CNAME, this answer will tell us which domain it's a CNAME for
-			// and a subsequent answer should tell us what the target domains address is (or possibly another CNAME). Drop
-			// this for now (2026-03-11) but in the near future we should collapse the CNAME chain and map to the ultimate
-			// destination address (see eg appc/{appconnector,observe}.go).
-			c.logf("not yet implemented CNAME answer: %v", queriedDomain)
-			if err := p.SkipAnswer(); err != nil {
-				c.logf("error parsing dns response: %v", err)
+			// A DNS response with CNAME records might look a bit like
+			//
+			// a.example.com. CNAME b.example.com.
+			// b.example.com. CNAME example.com.
+			// example.com. A 1.1.1.1
+			//
+			// We don't return CNAME records for our domains. We use them to build a
+			// cname chain so we can rewrite the final A/AAAA record to eg:
+			//
+			// a.example.com A (some magic IP that is associated with 1.1.1.1)
+			r, err := p.CNAMEResource()
+			if err != nil {
 				return makeServFail(c.logf, hdr, question)
 			}
+			src, err := normalizeDNSName(h.Name.String())
+			if err != nil {
+				return makeServFail(c.logf, hdr, question)
+			}
+			target, err := normalizeDNSName(r.CNAME.String())
+			if err != nil {
+				return makeServFail(c.logf, hdr, question)
+			}
+			mak.Set(&cnameChain, src, target)
 		case dnsmessage.TypeA, dnsmessage.TypeAAAA:
 			if h.Type != question.Type {
 				// would not expect a v4 response to a v6 question or vice versa, don't add a rewrite for this.
 				if err := p.SkipAnswer(); err != nil {
-					c.logf("error parsing dns response: %v", err)
 					return makeServFail(c.logf, hdr, question)
 				}
 				continue
 			}
-			domain, err := normalizeDNSName(h.Name.String())
+			answerDomain, err := normalizeDNSName(h.Name.String())
 			if err != nil {
-				c.logf("bad dnsname: %v", err)
 				return makeServFail(c.logf, hdr, question)
 			}
-			// answers should be for the domain that was queried
-			if domain != queriedDomain {
-				c.logf("unexpected domain for connector domain dns response: %v %v", queriedDomain, domain)
-				if err := p.SkipAnswer(); err != nil {
-					c.logf("error parsing dns response: %v", err)
-					return makeServFail(c.logf, hdr, question)
+			// If answerDomain is not the same domain as the domain that was queried for,
+			// try to walk down the cname chain from the queried domain until we find the answerDomain.
+			// If we can't, skip the answer.
+			// If we can, then we will rewrite the dns response to an A/AAAA record pointing
+			// the queriedDomain to the magic IP.
+			if answerDomain != queriedDomain {
+				d := queriedDomain
+				found := false
+				seen := set.Set[dnsname.FQDN]{} // avoid following cname record loops
+				for {
+					target, ok := cnameChain[d]
+					if !ok || seen.Contains(target) {
+						break
+					}
+					if target == answerDomain {
+						found = true
+						break
+					}
+					seen.Add(target)
+					d = target
+				}
+				if !found {
+					if err := p.SkipAnswer(); err != nil {
+						return makeServFail(c.logf, hdr, question)
+					}
+					continue
 				}
-				continue
 			}
 			var dstAddr netip.Addr
 			if h.Type == dnsmessage.TypeA {
 				r, err := p.AResource()
 				if err != nil {
-					c.logf("error parsing dns response: %v", err)
 					return makeServFail(c.logf, hdr, question)
 				}
 				dstAddr = netip.AddrFrom4(r.A)
 			} else {
 				r, err := p.AAAAResource()
 				if err != nil {
-					c.logf("error parsing dns response: %v", err)
 					return makeServFail(c.logf, hdr, question)
 				}
 				dstAddr = netip.AddrFrom16(r.AAAA)
 			}
-			answers = append(answers, dnsResponseRewrite{domain: domain, dst: dstAddr})
+			answers = append(answers, dnsResponseRewrite{domain: queriedDomain, dst: dstAddr, ttlSeconds: h.TTL})
 		default:
 			// we already checked the question was for a supported type, this answer is unexpected
-			c.logf("unexpected type for connector domain dns response: %v %v", queriedDomain, h.Type)
 			if err := p.SkipAnswer(); err != nil {
-				c.logf("error parsing dns response: %v", err)
 				return makeServFail(c.logf, hdr, question)
 			}
 		}
 	}
-	newBuf, err := c.rewriteDNSResponse(hdr, questions, answers)
+	newBuf, err := c.client.rewriteDNSResponse(appName, hdr, questions, answers)
 	if err != nil {
+		metricDNSResponseRewriteErrorServfail.Add(1)
 		c.logf("error rewriting dns response: %v", err)
 		return makeServFail(c.logf, hdr, question)
 	}
 	return newBuf
 }
 
-func (c *client) rewriteDNSResponse(hdr dnsmessage.Header, questions []dnsmessage.Question, answers []dnsResponseRewrite) ([]byte, error) {
+func (c *client) rewriteDNSResponse(appName string, hdr dnsmessage.Header, questions []dnsmessage.Question, answers []dnsResponseRewrite) ([]byte, error) {
 	b := dnsmessage.NewBuilder(nil, hdr)
 	b.EnableCompression()
 	if err := b.StartQuestions(); err != nil {
@@ -1003,7 +1298,7 @@ func (c *client) rewriteDNSResponse(hdr dnsmessage.Header, questions []dnsmessag
 
 	// make an answer for each rewrite
 	for _, rw := range answers {
-		as, err := c.reserveAddresses(rw.domain, rw.dst)
+		as, err := c.reserveAddresses(appName, rw.domain, rw.dst, time.Duration(rw.ttlSeconds)*time.Second)
 		if err != nil {
 			return nil, err
 		}
@@ -1015,12 +1310,12 @@ func (c *client) rewriteDNSResponse(hdr dnsmessage.Header, questions []dnsmessag
 			return nil, err
 		}
 		if rw.dst.Is4() {
-			rhdr := dnsmessage.ResourceHeader{Name: name, Type: dnsmessage.TypeA, Class: dnsmessage.ClassINET, TTL: 0}
+			rhdr := dnsmessage.ResourceHeader{Name: name, Type: dnsmessage.TypeA, Class: dnsmessage.ClassINET, TTL: rw.ttlSeconds}
 			if err := b.AResource(rhdr, dnsmessage.AResource{A: as.magic.As4()}); err != nil {
 				return nil, err
 			}
 		} else if rw.dst.Is6() {
-			rhdr := dnsmessage.ResourceHeader{Name: name, Type: dnsmessage.TypeAAAA, Class: dnsmessage.ClassINET, TTL: 0}
+			rhdr := dnsmessage.ResourceHeader{Name: name, Type: dnsmessage.TypeAAAA, Class: dnsmessage.ClassINET, TTL: rw.ttlSeconds}
 			if err := b.AAAAResource(rhdr, dnsmessage.AAAAResource{AAAA: as.magic.As16()}); err != nil {
 				return nil, err
 			}
@@ -1038,39 +1333,39 @@ func (c *client) rewriteDNSResponse(hdr dnsmessage.Header, questions []dnsmessag
 }
 
 type connector struct {
-	logf logger.Logf
+	logf      logger.Logf
+	getIPSets func() ipSets
 
 	mu sync.Mutex // protects the fields below
 	// transitIPs is a map of connector client peer IP -> client transitIPs that we update as connector client peers instruct us to, and then use to route traffic to its destination on behalf of connector clients.
 	// Note that each peer could potentially have two maps: one for its IPv4 address, and one for its IPv6 address. The transit IPs map for a given peer IP will contain transit IPs of the same family as the peer's IP.
 	transitIPs map[netip.Addr]map[netip.Addr]appAddr
-	config     config
 }
 
-// realIPForTransitIPConnection is part of the implementation of the IPMapper interface for dataflows lookups.
-// See also [IPMapper.ConnectorRealIPForTransitIPConnection].
-func (c *connector) realIPForTransitIPConnection(srcIP netip.Addr, transitIP netip.Addr) (netip.Addr, error) {
+// realIPForTransitIPConnection is part of the implementation of the [Conn25Datapath] interface for dataflow lookups.
+// See also [Conn25Datapath.ConnectorRealIPForTransitIPConnection].
+func (c *connector) realIPForTransitIPConnection(srcIP netip.Addr, transitIP netip.Addr) (netip.Addr, bool) {
 	c.mu.Lock()
 	defer c.mu.Unlock()
 	v, ok := c.lookupBySrcIPAndTransitIP(srcIP, transitIP)
 	if ok {
-		return v.addr, nil
+		return v.addr, true
 	}
-	if !c.config.v4TransitIPSet.Contains(transitIP) && !c.config.v6TransitIPSet.Contains(transitIP) {
-		return netip.Addr{}, nil
-	}
-	return netip.Addr{}, ErrUnmappedSrcAndTransitIP
+	return netip.Addr{}, false
 }
 
 const packetFilterAllowReason = "app connector transit IP"
 
-// packetFilterAllow returns true if the provided packet has a Src that maps to a peer
-// that has a transit IP with us that is the packet Dst, and false otherwise.
+// packetFilterAllow returns true if the provided packet has a Src that is in
+// the configured transit IP range for this connector, false otherwise.
 func (c *connector) packetFilterAllow(p packet.Parsed) (bool, string) {
 	c.mu.Lock()
 	defer c.mu.Unlock()
-	_, ok := c.lookupBySrcIPAndTransitIP(p.Src.Addr(), p.Dst.Addr())
-	if ok {
+	ipSets := c.getIPSets()
+	if ipSets.v4Transit != nil && ipSets.v4Transit.Contains(p.Dst.Addr()) {
+		return true, packetFilterAllowReason
+	}
+	if ipSets.v6Transit != nil && ipSets.v6Transit.Contains(p.Dst.Addr()) {
 		return true, packetFilterAllowReason
 	}
 	return false, ""
@@ -1085,108 +1380,70 @@ func (c *connector) lookupBySrcIPAndTransitIP(srcIP, transitIP netip.Addr) (appA
 	return v, ok
 }
 
-func (c *connector) reconfig(newCfg config) error {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	c.config = newCfg
-	return nil
-}
-
 type addrs struct {
-	dst     netip.Addr
-	magic   netip.Addr
-	transit netip.Addr
-	domain  dnsname.FQDN
-	app     string
+	dst             netip.Addr
+	magic           netip.Addr
+	transit         netip.Addr
+	domain          dnsname.FQDN
+	app             string
+	expiresAt       time.Time
+	activeFlowCount int
+	zeroFlowTime    time.Time
 }
 
-func (c addrs) isValid() bool {
-	return c.dst.IsValid()
+func (as addrs) isValid() bool {
+	return as.dst.IsValid()
 }
 
-// domainDst is a key for looking up an existing address assignment by the
-// DNS response domain and destination IP pair.
-type domainDst struct {
-	domain dnsname.FQDN
-	dst    netip.Addr
+func (as addrs) is4() bool {
+	return as.dst.Is4()
 }
 
-// addrAssignments is the collection of addrs assigned by this client
-// supporting lookup by magic IP, transit IP or domain+dst, or to lookup all
-// transit IPs associated with a given connector (identified by its node key).
-// byConnKey stores netip.Prefix versions of the transit IPs for use in the
-// WireGuard hooks.
-type addrAssignments struct {
-	byMagicIP   map[netip.Addr]addrs
-	byTransitIP map[netip.Addr]addrs
-	byDomainDst map[domainDst]addrs
-	byConnKey   map[key.NodePublic]set.Set[netip.Prefix]
-}
-
-func (a *addrAssignments) insert(as addrs) error {
-	// we likely will want to allow overwriting in the future when we
-	// have address expiry, but for now this should not happen
-	if _, ok := a.byMagicIP[as.magic]; ok {
-		return errors.New("byMagicIP key exists")
-	}
-	ddst := domainDst{domain: as.domain, dst: as.dst}
-	if _, ok := a.byDomainDst[ddst]; ok {
-		return errors.New("byDomainDst key exists")
-	}
-	if _, ok := a.byTransitIP[as.transit]; ok {
-		return errors.New("byTransitIP key exists")
-	}
-
-	mak.Set(&a.byMagicIP, as.magic, as)
-	mak.Set(&a.byTransitIP, as.transit, as)
-	mak.Set(&a.byDomainDst, ddst, as)
-	return nil
+func (as addrs) is6() bool {
+	return as.dst.Is6()
 }
 
 // insertTransitConnMapping adds an entry to the byConnKey map
 // for the provided transitIP (as a prefix).
 // The provided transitIP must already be present in the byTransitIP map.
-func (a *addrAssignments) insertTransitConnMapping(tip netip.Addr, connKey key.NodePublic) error {
-	if _, ok := a.lookupByTransitIP(tip); !ok {
+func (c *client) insertTransitConnMapping(tip netip.Addr, connKey key.NodePublic) error {
+	if _, ok := c.assignments.lookupByTransitIP(tip); !ok {
 		return errors.New("transit IP is not already known")
 	}
 
-	ctips, ok := a.byConnKey[connKey]
+	ctips, ok := c.byConnKey[connKey]
 	tipp := netip.PrefixFrom(tip, tip.BitLen())
-	if ok {
-		if ctips.Contains(tipp) {
-			return errors.New("byConnKey already contains transit")
-		}
-	} else {
+	if !ok {
 		ctips.Make()
-		mak.Set(&a.byConnKey, connKey, ctips)
+		mak.Set(&c.byConnKey, connKey, ctips)
 	}
 	ctips.Add(tipp)
 	return nil
 }
 
-func (a *addrAssignments) lookupByDomainDst(domain dnsname.FQDN, dst netip.Addr) (addrs, bool) {
-	v, ok := a.byDomainDst[domainDst{domain: domain, dst: dst}]
-	return v, ok
-}
-
-func (a *addrAssignments) lookupByMagicIP(mip netip.Addr) (addrs, bool) {
-	v, ok := a.byMagicIP[mip]
-	return v, ok
-}
-
-func (a *addrAssignments) lookupByTransitIP(tip netip.Addr) (addrs, bool) {
-	v, ok := a.byTransitIP[tip]
-	return v, ok
-}
-
 // lookupTransitIPsByConnKey returns a slice containing the transit IPs (as netipPrefix)
 // associated with the given connector (identified by node key), or (nil, false) if there is no entry
 // for the given key.
-func (a *addrAssignments) lookupTransitIPsByConnKey(k key.NodePublic) ([]netip.Prefix, bool) {
-	s, ok := a.byConnKey[k]
+func (c *client) lookupTransitIPsByConnKey(k key.NodePublic) ([]netip.Prefix, bool) {
+	s, ok := c.byConnKey[k]
 	if !ok {
 		return nil, false
 	}
 	return s.Slice(), true
 }
+
+// resendTransitIPMapping enqueues a request to re-establish an existing
+// transit IP-real IP mapping after a connector tells the client that the
+// mapping does not exist on its end. If a mapping is not found on the client
+// either, this is a no-op.
+func (c *client) resendTransitIPMapping(transitIP netip.Addr) {
+	mapping, ok := c.assignments.lookupByTransitIP(transitIP)
+	if !ok {
+		// We have no mappings for this transit IP, so nothing to resend.
+		return
+	}
+	err := c.enqueueAddressAssignment(mapping)
+	if err != nil {
+		c.logf("error enqueueing address assignment for resend: %v", err)
+	}
+}
diff --git a/feature/conn25/conn25_test.go b/feature/conn25/conn25_test.go
index 5f136c556..05ba31e00 100644
--- a/feature/conn25/conn25_test.go
+++ b/feature/conn25/conn25_test.go
@@ -5,6 +5,7 @@ package conn25
 
 import (
 	"encoding/json"
+	"errors"
 	"net/http"
 	"net/http/httptest"
 	"net/netip"
@@ -17,18 +18,22 @@ import (
 	"go4.org/mem"
 	"go4.org/netipx"
 	"golang.org/x/net/dns/dnsmessage"
+	"tailscale.com/ipn"
 	"tailscale.com/ipn/ipnext"
 	"tailscale.com/net/dns"
+	"tailscale.com/net/netmon"
 	"tailscale.com/net/packet"
 	"tailscale.com/net/tsdial"
 	"tailscale.com/net/tstun"
 	"tailscale.com/tailcfg"
 	"tailscale.com/tsd"
+	"tailscale.com/tstest"
 	"tailscale.com/types/appctype"
 	"tailscale.com/types/key"
 	"tailscale.com/types/logger"
 	"tailscale.com/types/opt"
 	"tailscale.com/util/dnsname"
+	"tailscale.com/util/eventbus/eventbustest"
 	"tailscale.com/util/must"
 	"tailscale.com/util/set"
 )
@@ -338,9 +343,10 @@ func TestHandleConnectorTransitIPRequest(t *testing.T) {
 
 			// Use the same Conn25 for each request in the test and seed it with a test app name.
 			c := newConn25(logger.Discard)
-			c.connector.config = config{
-				appsByName: map[string]appctype.Conn25Attr{appName: {}},
-			}
+			c.reconfig(&config{
+				isConfigured: true,
+				appsByName:   map[string]appctype.Conn25Attr{appName: {}},
+			})
 
 			for i, peer := range tt.ctipReqPeers {
 				req := tt.ctipReqs[i]
@@ -390,15 +396,19 @@ func TestHandleConnectorTransitIPRequest(t *testing.T) {
 
 func TestReserveIPs(t *testing.T) {
 	c := newConn25(logger.Discard)
-	c.client.v4MagicIPPool = newIPPool(mustIPSetFromPrefix("100.64.0.0/24"))
-	c.client.v6MagicIPPool = newIPPool(mustIPSetFromPrefix("fd7a:115c:a1e0:a99c:0100::/80"))
-	c.client.v4TransitIPPool = newIPPool(mustIPSetFromPrefix("169.254.0.0/24"))
-	c.client.v6TransitIPPool = newIPPool(mustIPSetFromPrefix("fd7a:115c:a1e0:a99c:0200::/80"))
-	app := "a"
+	const appName = "a"
 	domainStr := "example.com."
-	mbd := map[dnsname.FQDN][]string{}
-	mbd["example.com."] = []string{app}
-	c.client.config.appNamesByDomain = mbd
+	cfg := &config{
+		isConfigured: true,
+		appsByName:   map[string]appctype.Conn25Attr{appName: {}},
+		ipSets: ipSets{
+			v4Magic:   mustIPSetFromPrefix("100.64.0.0/24"),
+			v6Magic:   mustIPSetFromPrefix("fd7a:115c:a1e0:a99c:0100::/80"),
+			v4Transit: mustIPSetFromPrefix("169.254.0.0/24"),
+			v6Transit: mustIPSetFromPrefix("fd7a:115c:a1e0:a99c:0200::/80"),
+		},
+	}
+	c.reconfig(cfg)
 	domain := must.Get(dnsname.ToFQDN(domainStr))
 
 	for _, tt := range []struct {
@@ -421,7 +431,7 @@ func TestReserveIPs(t *testing.T) {
 		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
-			addrs, err := c.client.reserveAddresses(domain, tt.dst)
+			addrs, err := c.client.reserveAddresses(appName, domain, tt.dst, 10)
 			if err != nil {
 				t.Fatal(err)
 			}
@@ -434,8 +444,8 @@ func TestReserveIPs(t *testing.T) {
 			if tt.wantTransit != addrs.transit {
 				t.Errorf("want %v, got %v", tt.wantTransit, addrs.transit)
 			}
-			if app != addrs.app {
-				t.Errorf("want %s, got %s", app, addrs.app)
+			if appName != addrs.app {
+				t.Errorf("want %s, got %s", appName, addrs.app)
 			}
 			if domain != addrs.domain {
 				t.Errorf("want %s, got %s", domain, addrs.domain)
@@ -450,60 +460,101 @@ func TestReconfig(t *testing.T) {
 		tailcfg.NodeCapability(AppConnectorsExperimentalAttrName): []tailcfg.RawMessage{
 			tailcfg.RawMessage(rawCfg),
 		},
+		tailcfg.NodeCapability(AppConnectorsExperimentalIPPoolsAttrName): []tailcfg.RawMessage{
+			tailcfg.RawMessage("{}"),
+		},
 	}
 
 	c := newConn25(logger.Discard)
+	if c.isConfigured() {
+		t.Fatal("expected Conn25 isConfigured() to report unconfigured before reconfig")
+	}
+
 	sn := (&tailcfg.Node{
 		CapMap: capMap,
 	}).View()
+	cfg := mustConfig(t, sn)
+	c.reconfig(cfg)
 
-	err := c.reconfig(sn)
-	if err != nil {
-		t.Fatal(err)
+	if !c.isConfigured() {
+		t.Fatal("expected Conn25 isConfigured() to report configured after reconfig")
 	}
 
-	if len(c.client.config.apps) != 1 || c.client.config.apps[0].Name != "app1" {
-		t.Fatalf("want apps to have one entry 'app1', got %v", c.client.config.apps)
+	cfg, ok := c.getConfig()
+	if !ok {
+		t.Fatal("expected Conn25 getConfig() to report configured after reconfig")
+	}
+
+	if len(cfg.apps) != 1 || cfg.apps[0].Name != "app1" {
+		t.Fatalf("want apps to have one entry 'app1', got %v", cfg.apps)
 	}
 }
 
-func TestConfigReconfig(t *testing.T) {
+func getRawMessages[T any](t *testing.T, attrs []T) []tailcfg.RawMessage {
+	t.Helper()
+	toRet := make([]tailcfg.RawMessage, 0, len(attrs))
+	for _, attr := range attrs {
+		bs, err := json.Marshal(attr)
+		if err != nil {
+			t.Fatalf("unexpected error in test setup: %v", err)
+		}
+		toRet = append(toRet, tailcfg.RawMessage(bs))
+	}
+	return toRet
+}
+
+func TestConfigFromNodeView(t *testing.T) {
 	for _, tt := range []struct {
-		name                  string
-		rawCfg                string
-		cfg                   []appctype.Conn25Attr
-		tags                  []string
-		wantErr               bool
-		wantAppsByDomain      map[dnsname.FQDN][]string
-		wantSelfRoutedDomains set.Set[dnsname.FQDN]
+		name               string
+		rawAppCfg          string
+		appCfg             []appctype.Conn25Attr
+		rawPoolsCfg        string
+		poolsCfg           []appctype.Conn25PoolsAttr
+		tags               []string
+		wantErr            bool
+		wantAppsByDomain   map[dnsname.FQDN][]string
+		wantAppsByWCDomain map[dnsname.FQDN][]string
+		wantSelfAppNames   set.Set[string]
 	}{
 		{
-			name:    "bad-config",
-			rawCfg:  `bad`,
-			wantErr: true,
+			name:        "bad-app-config",
+			rawAppCfg:   `bad`,
+			rawPoolsCfg: "{}",
+			wantErr:     true,
+		},
+		{
+			name: "bad-pool-config",
+			appCfg: []appctype.Conn25Attr{
+				{Name: "one", Domains: []string{"a.example.com"}, Connectors: []string{"tag:one"}},
+			},
+			rawPoolsCfg: "bad",
+			wantErr:     true,
 		},
 		{
 			name: "simple",
-			cfg: []appctype.Conn25Attr{
+			appCfg: []appctype.Conn25Attr{
 				{Name: "one", Domains: []string{"a.example.com"}, Connectors: []string{"tag:one"}},
 				{Name: "two", Domains: []string{"b.example.com"}, Connectors: []string{"tag:two"}},
 			},
-			tags: []string{"tag:one"},
+			rawPoolsCfg: "{}",
+			tags:        []string{"tag:one"},
 			wantAppsByDomain: map[dnsname.FQDN][]string{
 				"a.example.com.": {"one"},
 				"b.example.com.": {"two"},
 			},
-			wantSelfRoutedDomains: set.SetOf([]dnsname.FQDN{"a.example.com."}),
+			wantAppsByWCDomain: map[dnsname.FQDN][]string{},
+			wantSelfAppNames:   set.SetOf([]string{"one"}),
 		},
 		{
-			name: "more-complex",
-			cfg: []appctype.Conn25Attr{
+			name: "more-complex-with-connector-self-domains",
+			appCfg: []appctype.Conn25Attr{
 				{Name: "one", Domains: []string{"1.a.example.com", "1.b.example.com"}, Connectors: []string{"tag:one", "tag:onea"}},
 				{Name: "two", Domains: []string{"2.b.example.com", "2.c.example.com"}, Connectors: []string{"tag:two", "tag:twoa"}},
 				{Name: "three", Domains: []string{"1.b.example.com", "1.c.example.com"}, Connectors: []string{}},
 				{Name: "four", Domains: []string{"4.b.example.com", "4.d.example.com"}, Connectors: []string{"tag:four"}},
 			},
-			tags: []string{"tag:onea", "tag:four", "tag:unrelated"},
+			rawPoolsCfg: "{}",
+			tags:        []string{"tag:onea", "tag:four", "tag:unrelated"},
 			wantAppsByDomain: map[dnsname.FQDN][]string{
 				"1.a.example.com.": {"one"},
 				"1.b.example.com.": {"one", "three"},
@@ -513,28 +564,98 @@ func TestConfigReconfig(t *testing.T) {
 				"4.b.example.com.": {"four"},
 				"4.d.example.com.": {"four"},
 			},
-			wantSelfRoutedDomains: set.SetOf([]dnsname.FQDN{"1.a.example.com.", "1.b.example.com.", "4.b.example.com.", "4.d.example.com."}),
+			wantAppsByWCDomain: map[dnsname.FQDN][]string{},
+			wantSelfAppNames:   set.SetOf([]string{"one", "four"}),
+		},
+		{
+			name: "eligible-connector-no-matching-tag-no-self-domains",
+			appCfg: []appctype.Conn25Attr{
+				{Name: "one", Domains: []string{"a.example.com"}, Connectors: []string{"tag:one"}},
+				{Name: "two", Domains: []string{"b.example.com"}, Connectors: []string{"tag:two"}},
+			},
+			rawPoolsCfg: "{}",
+			tags:        []string{"tag:unrelated"},
+			wantAppsByDomain: map[dnsname.FQDN][]string{
+				"a.example.com.": {"one"},
+				"b.example.com.": {"two"},
+			},
+			wantAppsByWCDomain: map[dnsname.FQDN][]string{}},
+		{
+			name: "wildcard-collapse-and-deduplication",
+			appCfg: []appctype.Conn25Attr{
+				{Name: "one", Domains: []string{"*.example.com", "example.com"}, Connectors: []string{"tag:one"}},
+				{Name: "two", Domains: []string{"example.com", "sub.example.com"}, Connectors: []string{"tag:two"}},
+			},
+			rawPoolsCfg: "{}",
+			tags:        []string{"tag:one", "tag:two"},
+			wantAppsByDomain: map[dnsname.FQDN][]string{
+				"example.com.":     {"one", "two"},
+				"sub.example.com.": {"two"},
+			},
+			wantAppsByWCDomain: map[dnsname.FQDN][]string{
+				"example.com.": {"one"},
+			},
+			wantSelfAppNames: set.SetOf([]string{"one", "two"}),
+		},
+		{
+			// Domain names that differ only in case must be treated as the same
+			// domain and the app name must appear exactly once in appNamesByDomain,
+			// not once per case variant.
+			name: "case-variant-exact-domains-deduplicated-within-app",
+			appCfg: []appctype.Conn25Attr{
+				{Name: "one", Domains: []string{"EXAMPLE.com", "example.COM", "Example.COM"}, Connectors: []string{"tag:one"}},
+			},
+			rawPoolsCfg: "{}",
+			tags:        []string{"tag:one"},
+			wantAppsByDomain: map[dnsname.FQDN][]string{
+				"example.com.": {"one"},
+			},
+			wantAppsByWCDomain: map[dnsname.FQDN][]string{},
+			wantSelfAppNames:   set.SetOf([]string{"one"}),
+		},
+		{
+			// Same as above but for wildcard domains: *.EXAMPLE.com and *.example.COM
+			// must collapse to a single entry in appNamesByWCDomain.
+			name: "case-variant-wildcard-domains-deduplicated-within-app",
+			appCfg: []appctype.Conn25Attr{
+				{Name: "one", Domains: []string{"*.EXAMPLE.com", "*.example.COM"}, Connectors: []string{"tag:one"}},
+			},
+			rawPoolsCfg:        "{}",
+			tags:               []string{"tag:one"},
+			wantAppsByDomain:   map[dnsname.FQDN][]string{},
+			wantAppsByWCDomain: map[dnsname.FQDN][]string{"example.com.": {"one"}},
+			wantSelfAppNames:   set.SetOf([]string{"one"}),
+		},
+		{
+			name: "too-many-pools",
+			appCfg: []appctype.Conn25Attr{
+				{Name: "one", Domains: []string{"a.example.com"}, Connectors: []string{"tag:one"}},
+			},
+			poolsCfg: []appctype.Conn25PoolsAttr{
+				{},
+				{},
+			},
+			wantErr: true,
 		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
-			cfg := []tailcfg.RawMessage{tailcfg.RawMessage(tt.rawCfg)}
-			if tt.cfg != nil {
-				cfg = []tailcfg.RawMessage{}
-				for _, attr := range tt.cfg {
-					bs, err := json.Marshal(attr)
-					if err != nil {
-						t.Fatalf("unexpected error in test setup: %v", err)
-					}
-					cfg = append(cfg, tailcfg.RawMessage(bs))
-				}
+			appCfg := []tailcfg.RawMessage{tailcfg.RawMessage(tt.rawAppCfg)}
+			if tt.appCfg != nil {
+				appCfg = getRawMessages(t, tt.appCfg)
+			}
+			poolsCfg := []tailcfg.RawMessage{tailcfg.RawMessage(tt.rawPoolsCfg)}
+			if tt.poolsCfg != nil {
+				poolsCfg = getRawMessages(t, tt.poolsCfg)
 			}
 			capMap := tailcfg.NodeCapMap{
-				tailcfg.NodeCapability(AppConnectorsExperimentalAttrName): cfg,
+				tailcfg.NodeCapability(AppConnectorsExperimentalAttrName):        appCfg,
+				tailcfg.NodeCapability(AppConnectorsExperimentalIPPoolsAttrName): poolsCfg,
 			}
 			sn := (&tailcfg.Node{
 				CapMap: capMap,
 				Tags:   tt.tags,
 			}).View()
+
 			c, err := configFromNodeView(sn)
 			if (err != nil) != tt.wantErr {
 				t.Fatalf("wantErr: %t, err: %v", tt.wantErr, err)
@@ -542,14 +663,121 @@ func TestConfigReconfig(t *testing.T) {
 			if diff := cmp.Diff(tt.wantAppsByDomain, c.appNamesByDomain); diff != "" {
 				t.Errorf("appsByDomain diff (-want, +got):\n%s", diff)
 			}
-			if diff := cmp.Diff(tt.wantSelfRoutedDomains, c.selfRoutedDomains); diff != "" {
-				t.Errorf("selfRoutedDomains diff (-want, +got):\n%s", diff)
+			if diff := cmp.Diff(tt.wantAppsByWCDomain, c.appNamesByWCDomain); diff != "" {
+				t.Errorf("appsByWCDomain diff (-want, +got):\n%s", diff)
+			}
+			if diff := cmp.Diff(tt.wantSelfAppNames, c.selfAppNames); diff != "" {
+				t.Errorf("selfAppNames diff (-want, +got):\n%s", diff)
 			}
 		})
 	}
 }
 
-func makeSelfNode(t *testing.T, attrs []appctype.Conn25Attr, tags []string) tailcfg.NodeView {
+func TestGetAppsForDomainName(t *testing.T) {
+	defaultSN := makeSelfNode(
+		t,
+		[]appctype.Conn25Attr{
+			{Name: "one", Domains: []string{"*.example.com", "example.com"}, Connectors: []string{"tag:one"}},
+			{Name: "two", Domains: []string{"sub.example.com", "example.com"}, Connectors: []string{"tag:two"}},
+			{Name: "three", Domains: []string{"*.sub.example.com"}, Connectors: []string{"tag:three"}},
+			{Name: "four", Domains: []string{"a.sub.example.com"}, Connectors: []string{"tag:four"}},
+			{Name: "self-routed", Domains: []string{"*.wildcard.com", "exact-match.com"}, Connectors: []string{"tag:self-routed"}},
+		},
+		appctype.Conn25PoolsAttr{},
+		[]string{"tag:self-routed"},
+	)
+
+	for _, tt := range []struct {
+		name        string
+		isConnector bool
+		domain      dnsname.FQDN
+		wantApps    []string
+	}{
+		{
+			name:     "no-match",
+			domain:   "nomatch.com.",
+			wantApps: nil,
+		},
+		{
+			name:     "exact-match",
+			domain:   "example.com.",
+			wantApps: []string{"one", "two"},
+		},
+		{
+			name:     "wildcard-subdomain-match",
+			domain:   "a.example.com.",
+			wantApps: []string{"one"},
+		},
+		{
+			name:     "exact-subdomain-match",
+			domain:   "sub.example.com.",
+			wantApps: []string{"two"},
+		},
+		{
+			name:     "wildcard-sub-of-subdomain-match",
+			domain:   "b.sub.example.com.",
+			wantApps: []string{"three"},
+		},
+		{
+			name:     "exact-sub-of-subdomain-match",
+			domain:   "a.sub.example.com.",
+			wantApps: []string{"four"},
+		},
+		{
+			name:     "exact-domain-matches-wildcard",
+			domain:   "wildcard.com.",
+			wantApps: []string{"self-routed"},
+		},
+		{
+			name:        "self-routed-exact-domain-suppressed",
+			isConnector: true,
+			domain:      "exact-match.com.",
+			wantApps:    nil,
+		},
+		{
+			// Self node is an eligible connector for "wildcard-self-app" via
+			// *.wildcard.com, so the wildcard match must also be suppressed.
+			name:        "self-routed-wildcard-domain-suppressed",
+			isConnector: true,
+			domain:      "sub.wildcard.com.",
+			wantApps:    nil,
+		},
+		{
+			// "other-app" is not on a self-connector tag, so it must not be suppressed.
+			name:        "non-self-routed-domain-not-suppressed",
+			isConnector: true,
+			domain:      "example.com.",
+			wantApps:    []string{"one", "two"},
+		},
+		{
+			// Even though the app's connector tag matches the self node's tags,
+			// if the node is not an eligible connector (Advertise=false) then
+			// isSelfRoutedApp returns false and the domain is forwarded normally.
+			name:     "not-eligible-connector-not-suppressed",
+			domain:   "exact-match.com.",
+			wantApps: []string{"self-routed"},
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			c := newConn25(logger.Discard)
+			if tt.isConnector {
+				c.prefsAdvertiseConnector.Store(true)
+			}
+			cfg := mustConfig(t, defaultSN)
+			c.reconfig(cfg)
+			cfg, ok := c.getConfig()
+			if !ok {
+				t.Fatal("could not get config")
+			}
+			gotApps := cfg.getAppsForConnectorDomain(tt.domain, tt.isConnector)
+			if diff := cmp.Diff(tt.wantApps, gotApps); diff != "" {
+				t.Errorf("unexpected appNames result: diff (-want, +got):\n%s", diff)
+			}
+		})
+	}
+}
+
+func makeSelfNode(t *testing.T, attrs []appctype.Conn25Attr, pools appctype.Conn25PoolsAttr, tags []string) tailcfg.NodeView {
 	t.Helper()
 	cfg := make([]tailcfg.RawMessage, 0, len(attrs))
 	for i, attr := range attrs {
@@ -559,15 +787,34 @@ func makeSelfNode(t *testing.T, attrs []appctype.Conn25Attr, tags []string) tail
 		}
 		cfg = append(cfg, tailcfg.RawMessage(bs))
 	}
-	capMap := tailcfg.NodeCapMap{
-		tailcfg.NodeCapability(AppConnectorsExperimentalAttrName): cfg,
+	poolsBytes, err := json.Marshal(pools)
+	if err != nil {
+		t.Fatalf("unexpected error marshaling pools in test setup: %v", err)
 	}
+	capMap := tailcfg.NodeCapMap{
+		tailcfg.NodeCapability(AppConnectorsExperimentalAttrName):        cfg,
+		tailcfg.NodeCapability(AppConnectorsExperimentalIPPoolsAttrName): {tailcfg.RawMessage(poolsBytes)},
+	}
+
 	return (&tailcfg.Node{
 		CapMap: capMap,
 		Tags:   tags,
 	}).View()
 }
 
+var (
+	testPrefsNotConnector = (&ipn.Prefs{AppConnector: ipn.AppConnectorPrefs{Advertise: false}}).View()
+)
+
+func mustConfig(t *testing.T, selfNode tailcfg.NodeView) *config {
+	t.Helper()
+	cfg, err := configFromNodeView(selfNode)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return cfg
+}
+
 func v4RangeFrom(from, to string) netipx.IPRange {
 	return netipx.IPRangeFrom(
 		netip.MustParseAddr("100.64.0."+from),
@@ -681,6 +928,12 @@ func makeDNSResponseForSections(t *testing.T, questions []dnsmessage.Question, a
 				t.Fatalf("unexpected answer type, update test")
 			}
 			b.AAAAResource(ans.Header, *body)
+		case dnsmessage.TypeCNAME:
+			body, ok := (ans.Body).(*dnsmessage.CNAMEResource)
+			if !ok {
+				t.Fatalf("unexpected answer type, update test")
+			}
+			b.CNAMEResource(ans.Header, *body)
 		default:
 			t.Fatalf("unhandled answer type, update test: %v", ans.Header.Type)
 		}
@@ -706,18 +959,22 @@ func makeDNSResponseForSections(t *testing.T, questions []dnsmessage.Question, a
 
 func TestMapDNSResponseAssignsAddrs(t *testing.T) {
 	for _, tt := range []struct {
-		name          string
-		domain        string
-		v4Addrs       []*dnsmessage.AResource
-		v6Addrs       []*dnsmessage.AAAAResource
-		wantByMagicIP map[netip.Addr]addrs
+		name                string
+		appDomains          []string
+		domain              string
+		v4Addrs             []*dnsmessage.AResource
+		v6Addrs             []*dnsmessage.AAAAResource
+		selfTags            []string
+		isEligibleConnector bool
+		wantByMagicIP       map[netip.Addr]*addrs
 	}{
 		{
-			name:    "one-ip-matches",
-			domain:  "example.com.",
-			v4Addrs: []*dnsmessage.AResource{{A: [4]byte{1, 0, 0, 0}}},
+			name:       "one-ip-matches",
+			appDomains: []string{"example.com"},
+			domain:     "example.com.",
+			v4Addrs:    []*dnsmessage.AResource{{A: [4]byte{1, 0, 0, 0}}},
 			// these are 'expected' because they are the beginning of the provided pools
-			wantByMagicIP: map[netip.Addr]addrs{
+			wantByMagicIP: map[netip.Addr]*addrs{
 				netip.MustParseAddr("100.64.0.0"): {
 					domain:  "example.com.",
 					dst:     netip.MustParseAddr("1.0.0.0"),
@@ -728,13 +985,14 @@ func TestMapDNSResponseAssignsAddrs(t *testing.T) {
 			},
 		},
 		{
-			name:   "v6-ip-matches",
-			domain: "example.com.",
+			name:       "v6-ip-matches",
+			appDomains: []string{"example.com"},
+			domain:     "example.com.",
 			v6Addrs: []*dnsmessage.AAAAResource{
 				{AAAA: [16]byte{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1}},
 				{AAAA: [16]byte{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2}},
 			},
-			wantByMagicIP: map[netip.Addr]addrs{
+			wantByMagicIP: map[netip.Addr]*addrs{
 				netip.MustParseAddr("fd7a:115c:a1e0:a99c::"): {
 					domain:  "example.com.",
 					dst:     netip.MustParseAddr("::1"),
@@ -752,13 +1010,14 @@ func TestMapDNSResponseAssignsAddrs(t *testing.T) {
 			},
 		},
 		{
-			name:   "multiple-ip-matches",
-			domain: "example.com.",
+			name:       "multiple-ip-matches",
+			appDomains: []string{"example.com"},
+			domain:     "example.com.",
 			v4Addrs: []*dnsmessage.AResource{
 				{A: [4]byte{1, 0, 0, 0}},
 				{A: [4]byte{2, 0, 0, 0}},
 			},
-			wantByMagicIP: map[netip.Addr]addrs{
+			wantByMagicIP: map[netip.Addr]*addrs{
 				netip.MustParseAddr("100.64.0.0"): {
 					domain:  "example.com.",
 					dst:     netip.MustParseAddr("1.0.0.0"),
@@ -776,13 +1035,107 @@ func TestMapDNSResponseAssignsAddrs(t *testing.T) {
 			},
 		},
 		{
-			name:   "no-domain-match",
-			domain: "x.example.com.",
+			name:       "no-domain-match",
+			appDomains: []string{"foo.example.com"},
+			domain:     "bad.example.com.",
 			v4Addrs: []*dnsmessage.AResource{
 				{A: [4]byte{1, 0, 0, 0}},
 				{A: [4]byte{2, 0, 0, 0}},
 			},
 		},
+		{
+			name:                "no-rewrite-self-routed-domain",
+			appDomains:          []string{"example.com"},
+			domain:              "example.com.",
+			v4Addrs:             []*dnsmessage.AResource{{A: [4]byte{1, 0, 0, 0}}},
+			selfTags:            []string{"tag:woo"},
+			isEligibleConnector: true,
+		},
+		{
+			name:       "rewrite-tagged-but-not-eligible-connector",
+			appDomains: []string{"example.com"},
+			domain:     "example.com.",
+			v4Addrs:    []*dnsmessage.AResource{{A: [4]byte{1, 0, 0, 0}}},
+			selfTags:   []string{"tag:woo"},
+			// isEligibleConnector is false: tag matches but prefs not set,
+			// so DNS response should be rewritten normally.
+			wantByMagicIP: map[netip.Addr]*addrs{
+				netip.MustParseAddr("100.64.0.0"): {
+					domain:  "example.com.",
+					dst:     netip.MustParseAddr("1.0.0.0"),
+					magic:   netip.MustParseAddr("100.64.0.0"),
+					transit: netip.MustParseAddr("100.64.0.40"),
+					app:     "app1",
+				},
+			},
+		},
+		{
+			name:                "rewrite-eligible-connector-no-matching-tag",
+			appDomains:          []string{"example.com"},
+			domain:              "example.com.",
+			v4Addrs:             []*dnsmessage.AResource{{A: [4]byte{1, 0, 0, 0}}},
+			selfTags:            []string{"tag:unrelated"},
+			isEligibleConnector: true,
+			// isEligibleConnector is true but tag doesn't match the app,
+			// so DNS response should be rewritten normally.
+			wantByMagicIP: map[netip.Addr]*addrs{
+				netip.MustParseAddr("100.64.0.0"): {
+					domain:  "example.com.",
+					dst:     netip.MustParseAddr("1.0.0.0"),
+					magic:   netip.MustParseAddr("100.64.0.0"),
+					transit: netip.MustParseAddr("100.64.0.40"),
+					app:     "app1",
+				},
+			},
+		},
+		{
+			name:       "subdomain-matches-wildcard",
+			appDomains: []string{"*.example.com"},
+			domain:     "sub.example.com.",
+			v4Addrs:    []*dnsmessage.AResource{{A: [4]byte{1, 0, 0, 0}}},
+			// these are 'expected' because they are the beginning of the provided pools
+			wantByMagicIP: map[netip.Addr]*addrs{
+				netip.MustParseAddr("100.64.0.0"): {
+					domain:  "sub.example.com.",
+					dst:     netip.MustParseAddr("1.0.0.0"),
+					magic:   netip.MustParseAddr("100.64.0.0"),
+					transit: netip.MustParseAddr("100.64.0.40"),
+					app:     "app1",
+				},
+			},
+		},
+		{
+			name:       "exact-subdomain-matches",
+			appDomains: []string{"example.com", "sub.example.com"},
+			domain:     "sub.example.com.",
+			v4Addrs:    []*dnsmessage.AResource{{A: [4]byte{1, 0, 0, 0}}},
+			// these are 'expected' because they are the beginning of the provided pools
+			wantByMagicIP: map[netip.Addr]*addrs{
+				netip.MustParseAddr("100.64.0.0"): {
+					domain:  "sub.example.com.",
+					dst:     netip.MustParseAddr("1.0.0.0"),
+					magic:   netip.MustParseAddr("100.64.0.0"),
+					transit: netip.MustParseAddr("100.64.0.40"),
+					app:     "app1",
+				},
+			},
+		},
+		{
+			name:       "wildcard-subdomain-matches-subdomain",
+			appDomains: []string{"example.com", "*.sub.example.com"},
+			domain:     "a.sub.example.com.",
+			v4Addrs:    []*dnsmessage.AResource{{A: [4]byte{1, 0, 0, 0}}},
+			// these are 'expected' because they are the beginning of the provided pools
+			wantByMagicIP: map[netip.Addr]*addrs{
+				netip.MustParseAddr("100.64.0.0"): {
+					domain:  "a.sub.example.com.",
+					dst:     netip.MustParseAddr("1.0.0.0"),
+					magic:   netip.MustParseAddr("100.64.0.0"),
+					transit: netip.MustParseAddr("100.64.0.40"),
+					app:     "app1",
+				},
+			},
+		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
 			var dnsResp []byte
@@ -792,25 +1145,251 @@ func TestMapDNSResponseAssignsAddrs(t *testing.T) {
 				dnsResp = makeV6DNSResponse(t, tt.domain, tt.v6Addrs)
 			}
 			sn := makeSelfNode(t, []appctype.Conn25Attr{{
-				Name:            "app1",
-				Connectors:      []string{"tag:woo"},
-				Domains:         []string{"example.com"},
+				Name:       "app1",
+				Connectors: []string{"tag:woo"},
+				Domains:    tt.appDomains,
+			}}, appctype.Conn25PoolsAttr{
 				V4MagicIPPool:   []netipx.IPRange{v4RangeFrom("0", "10"), v4RangeFrom("20", "30")},
 				V6MagicIPPool:   []netipx.IPRange{v6RangeFrom("0", "10"), v6RangeFrom("20", "30")},
 				V4TransitIPPool: []netipx.IPRange{v4RangeFrom("40", "50")},
 				V6TransitIPPool: []netipx.IPRange{v6RangeFrom("40", "50")},
-			}}, []string{})
+			}, tt.selfTags)
+
 			c := newConn25(logger.Discard)
-			c.reconfig(sn)
+			cfg := mustConfig(t, sn)
+			c.reconfig(cfg)
+			c.prefsAdvertiseConnector.Store(tt.isEligibleConnector)
 
 			c.mapDNSResponse(dnsResp)
-			if diff := cmp.Diff(tt.wantByMagicIP, c.client.assignments.byMagicIP, cmpopts.EquateComparable(addrs{}, netip.Addr{})); diff != "" {
+			if diff := cmp.Diff(
+				tt.wantByMagicIP,
+				c.client.assignments.byMagicIP,
+				cmp.AllowUnexported(addrs{}),
+				cmpopts.IgnoreFields(addrs{}, "expiresAt"),
+				cmpopts.EquateComparable(netip.Addr{}),
+			); diff != "" {
 				t.Errorf("byMagicIP diff (-want, +got):\n%s", diff)
 			}
 		})
 	}
 }
 
+func TestMapDNSResponseSetsExpiryBasedOnTTL(t *testing.T) {
+	configuredDomain := "example.com"
+	domainName := configuredDomain + "."
+	dnsMessageName := dnsmessage.MustNewName(domainName)
+	sn := makeSelfNode(t, []appctype.Conn25Attr{{
+		Name:       "app1",
+		Connectors: []string{"tag:woo"},
+		Domains:    []string{configuredDomain},
+	}}, appctype.Conn25PoolsAttr{
+		V4MagicIPPool:   []netipx.IPRange{v4RangeFrom("0", "10")},
+		V4TransitIPPool: []netipx.IPRange{v4RangeFrom("40", "50")},
+		V6MagicIPPool:   []netipx.IPRange{netipx.IPRangeFrom(netip.MustParseAddr("2606:4700::6812:100"), netip.MustParseAddr("2606:4700::6812:1ff"))},
+		V6TransitIPPool: []netipx.IPRange{netipx.IPRangeFrom(netip.MustParseAddr("2606:4700::6813:100"), netip.MustParseAddr("2606:4700::6813:1ff"))},
+	}, nil)
+
+	c := newConn25(logger.Discard)
+	clock := tstest.NewClock(tstest.ClockOpts{Start: time.Now()})
+	c.client.assignments.clock = clock
+	cfg := mustConfig(t, sn)
+	c.reconfig(cfg)
+
+	ipOne := netip.MustParseAddr("1.0.0.1")
+	ipTwo := netip.MustParseAddr("1.0.0.2")
+	ipTooBig := netip.MustParseAddr("1.0.0.3")
+	ipTooSmall := netip.MustParseAddr("1.0.0.4")
+	dnsResp := makeDNSResponseForSections(t,
+		[]dnsmessage.Question{{Name: dnsMessageName, Type: dnsmessage.TypeA, Class: dnsmessage.ClassINET}},
+		[]dnsmessage.Resource{
+			{
+				Header: dnsmessage.ResourceHeader{Name: dnsMessageName, Type: dnsmessage.TypeA, Class: dnsmessage.ClassINET, TTL: 300},
+				Body:   &dnsmessage.AResource{A: ipOne.As4()},
+			},
+			{
+				Header: dnsmessage.ResourceHeader{Name: dnsMessageName, Type: dnsmessage.TypeA, Class: dnsmessage.ClassINET, TTL: 60},
+				Body:   &dnsmessage.AResource{A: ipTwo.As4()},
+			},
+			{
+				Header: dnsmessage.ResourceHeader{Name: dnsMessageName, Type: dnsmessage.TypeA, Class: dnsmessage.ClassINET, TTL: 1000000},
+				Body:   &dnsmessage.AResource{A: ipTooBig.As4()},
+			},
+			{
+				Header: dnsmessage.ResourceHeader{Name: dnsMessageName, Type: dnsmessage.TypeA, Class: dnsmessage.ClassINET, TTL: 1},
+				Body:   &dnsmessage.AResource{A: ipTooSmall.As4()},
+			},
+		},
+		nil,
+	)
+	c.mapDNSResponse(dnsResp)
+
+	assertExpiresAt := func(addr netip.Addr, want time.Time) {
+		t.Helper()
+		as, ok := c.client.assignments.lookupByDomainDst("example.com.", addr)
+		if !ok {
+			t.Fatal("setup wrong expected to find addrs")
+		}
+		got := as.expiresAt
+		if !got.Equal(want) {
+			t.Fatalf("want %v; got %v", want, got)
+		}
+	}
+
+	assertExpiresAt(ipOne, clock.Now().Add(300*time.Second))
+	assertExpiresAt(ipTwo, clock.Now().Add(60*time.Second))
+	assertExpiresAt(ipTooBig, clock.Now().Add(72*time.Hour))     // max we will do is 72 hours
+	assertExpiresAt(ipTooSmall, clock.Now().Add(60*time.Second)) // min we will do is 1 min
+
+	ipThree := netip.MustParseAddr("::1")
+	ipFour := netip.MustParseAddr("::2")
+	dnsRespV6 := makeDNSResponseForSections(t,
+		[]dnsmessage.Question{{Name: dnsMessageName, Type: dnsmessage.TypeAAAA, Class: dnsmessage.ClassINET}},
+		[]dnsmessage.Resource{
+			{
+				Header: dnsmessage.ResourceHeader{Name: dnsMessageName, Type: dnsmessage.TypeAAAA, Class: dnsmessage.ClassINET, TTL: 301},
+				Body:   &dnsmessage.AAAAResource{AAAA: ipThree.As16()},
+			},
+			{
+				Header: dnsmessage.ResourceHeader{Name: dnsMessageName, Type: dnsmessage.TypeAAAA, Class: dnsmessage.ClassINET, TTL: 61},
+				Body:   &dnsmessage.AAAAResource{AAAA: ipFour.As16()},
+			},
+		},
+		nil,
+	)
+	c.mapDNSResponse(dnsRespV6)
+
+	assertExpiresAt(ipThree, clock.Now().Add(301*time.Second))
+	assertExpiresAt(ipFour, clock.Now().Add(61*time.Second))
+
+	elapsed := time.Second * 30
+	clock.Advance(elapsed)
+	assertExpiresAt(ipThree, clock.Now().Add(301*time.Second).Add(-1*elapsed))
+	assertExpiresAt(ipFour, clock.Now().Add(61*time.Second).Add(-1*elapsed))
+	c.mapDNSResponse(dnsRespV6)
+	// after seeing the addresses again, the expiry time is pushed out.
+	assertExpiresAt(ipThree, clock.Now().Add(301*time.Second))
+	assertExpiresAt(ipFour, clock.Now().Add(61*time.Second))
+
+}
+
+func TestMapDNSResponsePreservesTTL(t *testing.T) {
+	configuredDomain := "example.com"
+	domainName := configuredDomain + "."
+	dnsMessageName := dnsmessage.MustNewName(domainName)
+	sn := makeSelfNode(t, []appctype.Conn25Attr{{
+		Name:       "app1",
+		Connectors: []string{"tag:connector"},
+		Domains:    []string{configuredDomain},
+	}}, appctype.Conn25PoolsAttr{
+		V4MagicIPPool:   []netipx.IPRange{v4RangeFrom("0", "10")},
+		V4TransitIPPool: []netipx.IPRange{v4RangeFrom("40", "50")},
+		V6MagicIPPool:   []netipx.IPRange{netipx.IPRangeFrom(netip.MustParseAddr("2606:4700::6812:100"), netip.MustParseAddr("2606:4700::6812:1ff"))},
+		V6TransitIPPool: []netipx.IPRange{netipx.IPRangeFrom(netip.MustParseAddr("2606:4700::6813:100"), netip.MustParseAddr("2606:4700::6813:1ff"))},
+	}, nil)
+	cfg := mustConfig(t, sn)
+
+	const wantTTL uint32 = 300
+
+	for _, tt := range []struct {
+		name  string
+		toMap []byte
+	}{
+		{
+			name: "typeA",
+			toMap: makeDNSResponseForSections(t,
+				[]dnsmessage.Question{{Name: dnsMessageName, Type: dnsmessage.TypeA, Class: dnsmessage.ClassINET}},
+				[]dnsmessage.Resource{{
+					Header: dnsmessage.ResourceHeader{Name: dnsMessageName, Type: dnsmessage.TypeA, Class: dnsmessage.ClassINET, TTL: wantTTL},
+					Body:   &dnsmessage.AResource{A: netip.MustParseAddr("1.2.3.4").As4()},
+				}},
+				nil,
+			),
+		},
+		{
+			name: "typeAAAA",
+			toMap: makeDNSResponseForSections(t,
+				[]dnsmessage.Question{{Name: dnsMessageName, Type: dnsmessage.TypeAAAA, Class: dnsmessage.ClassINET}},
+				[]dnsmessage.Resource{{
+					Header: dnsmessage.ResourceHeader{Name: dnsMessageName, Type: dnsmessage.TypeAAAA, Class: dnsmessage.ClassINET, TTL: wantTTL},
+					Body:   &dnsmessage.AAAAResource{AAAA: netip.MustParseAddr("2606:4700::6812:1a78").As16()},
+				}},
+				nil,
+			),
+		},
+		{
+			// Use the TTL in the A record, not the CNAME.
+			name: "typeA-cname-chain",
+			toMap: makeDNSResponseForSections(t,
+				[]dnsmessage.Question{{Name: dnsMessageName, Type: dnsmessage.TypeA, Class: dnsmessage.ClassINET}},
+				[]dnsmessage.Resource{
+					{
+						Header: dnsmessage.ResourceHeader{Name: dnsMessageName, Type: dnsmessage.TypeCNAME, Class: dnsmessage.ClassINET, TTL: wantTTL + 999},
+						Body:   &dnsmessage.CNAMEResource{CNAME: dnsmessage.MustNewName("cdn.example.net.")},
+					},
+					{
+						Header: dnsmessage.ResourceHeader{Name: dnsmessage.MustNewName("cdn.example.net."), Type: dnsmessage.TypeA, Class: dnsmessage.ClassINET, TTL: wantTTL},
+						Body:   &dnsmessage.AResource{A: netip.MustParseAddr("1.2.3.4").As4()},
+					},
+				},
+				nil,
+			),
+		},
+		{
+			// Use the TTL in the AAAA record, not the CNAME.
+			name: "typeAAAA-cname-chain",
+			toMap: makeDNSResponseForSections(t,
+				[]dnsmessage.Question{{Name: dnsMessageName, Type: dnsmessage.TypeAAAA, Class: dnsmessage.ClassINET}},
+				[]dnsmessage.Resource{
+					{
+						Header: dnsmessage.ResourceHeader{Name: dnsMessageName, Type: dnsmessage.TypeCNAME, Class: dnsmessage.ClassINET, TTL: wantTTL + 999},
+						Body:   &dnsmessage.CNAMEResource{CNAME: dnsmessage.MustNewName("cdn.example.net.")},
+					},
+					{
+						Header: dnsmessage.ResourceHeader{Name: dnsmessage.MustNewName("cdn.example.net."), Type: dnsmessage.TypeAAAA, Class: dnsmessage.ClassINET, TTL: wantTTL},
+						Body:   &dnsmessage.AAAAResource{AAAA: netip.MustParseAddr("2606:4700::6812:1a78").As16()},
+					},
+				},
+				nil,
+			),
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			c := newConn25(logger.Discard)
+			c.reconfig(cfg)
+			answers, _ := parseResponse(t, c.mapDNSResponse(tt.toMap))
+			if len(answers) != 1 {
+				t.Fatalf("got %d answers, want 1", len(answers))
+			}
+			if got := answers[0].Header.TTL; got != wantTTL {
+				t.Fatalf("rewritten answer TTL = %d, want %d", got, wantTTL)
+			}
+		})
+	}
+}
+
+func TestNormalizedDNSNames(t *testing.T) {
+	tests := []struct {
+		name   string
+		domain string
+		want   dnsname.FQDN
+	}{
+		{name: "no-change", domain: "example.com.", want: "example.com."},
+		{name: "mixed-case", domain: "eXAmPle.COM", want: "example.com."},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := normalizeDNSName(tt.domain)
+			if err != nil {
+				t.Errorf("unexpected error %v", err)
+			}
+			if got != tt.want {
+				t.Errorf("Unexpected result, want %q, got %q", tt.want, got)
+			}
+		})
+	}
+}
+
 func TestReserveAddressesDeduplicated(t *testing.T) {
 	for _, tt := range []struct {
 		name string
@@ -826,30 +1405,33 @@ func TestReserveAddressesDeduplicated(t *testing.T) {
 		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
-			c := newConn25(logger.Discard)
-			c.client.v4MagicIPPool = newIPPool(mustIPSetFromPrefix("100.64.0.0/24"))
-			c.client.v6MagicIPPool = newIPPool(mustIPSetFromPrefix("fd7a:115c:a1e0:a99c:0100::/80"))
-			c.client.v4TransitIPPool = newIPPool(mustIPSetFromPrefix("169.254.0.0/24"))
-			c.client.v6TransitIPPool = newIPPool(mustIPSetFromPrefix("fd7a:115c:a1e0:a99c:0200::/80"))
-			c.client.config.appNamesByDomain = map[dnsname.FQDN][]string{"example.com.": {"a"}}
+			const appName = "a"
+			conn25 := newConn25(t.Logf)
+			c := conn25.client
+			c.v4MagicIPPool = newIPPool(mustIPSetFromPrefix("100.64.0.0/24"))
+			c.v6MagicIPPool = newIPPool(mustIPSetFromPrefix("fd7a:115c:a1e0:a99c:0100::/80"))
+			c.v4TransitIPPool = newIPPool(mustIPSetFromPrefix("169.254.0.0/24"))
+			c.v6TransitIPPool = newIPPool(mustIPSetFromPrefix("fd7a:115c:a1e0:a99c:0200::/80"))
 
-			first, err := c.client.reserveAddresses("example.com.", tt.dst)
+			first, err := c.reserveAddresses(appName, "example.com.", tt.dst, 10)
 			if err != nil {
 				t.Fatal(err)
 			}
 
-			second, err := c.client.reserveAddresses("example.com.", tt.dst)
+			second, err := c.reserveAddresses(appName, "example.com.", tt.dst, 10)
 			if err != nil {
 				t.Fatal(err)
 			}
 
 			if first != second {
-				t.Errorf("expected same addrs on repeated call, got first=%v second=%v", first, second)
+				// reserveAddresses should return the existing entry when called for a domain that already has assigned addrs
+				t.Fatalf("want first==second, got first: %v, second: %v", first, second)
 			}
-			if got := len(c.client.assignments.byMagicIP); got != 1 {
+
+			if got := len(c.assignments.byMagicIP); got != 1 {
 				t.Errorf("want 1 entry in byMagicIP, got %d", got)
 			}
-			if got := len(c.client.assignments.byDomainDst); got != 1 {
+			if got := len(c.assignments.byDomainDst); got != 1 {
 				t.Errorf("want 1 entry in byDomainDst, got %d", got)
 			}
 
@@ -880,30 +1462,42 @@ func (nb *testNodeBackend) PeerAPIBase(p tailcfg.NodeView) string {
 	return nb.peerAPIURL
 }
 
+type testProfileServices struct {
+	ipnext.ProfileServices
+	prefs ipn.PrefsView
+}
+
+func (p *testProfileServices) CurrentPrefs() ipn.PrefsView { return p.prefs }
+func (p *testProfileServices) CurrentProfileState() (ipn.LoginProfileView, ipn.PrefsView) {
+	return ipn.LoginProfileView{}, p.prefs
+}
+
 type testHost struct {
 	ipnext.Host
 	nb                ipnext.NodeBackend
 	hooks             ipnext.Hooks
+	prefs             ipn.PrefsView
 	authReconfigAsync func()
 }
 
-func (h *testHost) NodeBackend() ipnext.NodeBackend { return h.nb }
-func (h *testHost) Hooks() *ipnext.Hooks            { return &h.hooks }
-func (h *testHost) AuthReconfigAsync()              { h.authReconfigAsync() }
+func (h *testHost) NodeBackend() ipnext.NodeBackend  { return h.nb }
+func (h *testHost) Hooks() *ipnext.Hooks             { return &h.hooks }
+func (h *testHost) Profiles() ipnext.ProfileServices { return &testProfileServices{prefs: h.prefs} }
+func (h *testHost) AuthReconfigAsync()               { h.authReconfigAsync() }
 
 type testSafeBackend struct {
 	ipnext.SafeBackend
 	sys *tsd.System
 }
 
-func newTestSafeBackend() *testSafeBackend {
-	sb := &testSafeBackend{}
-	sys := &tsd.System{}
-	sys.Dialer.Set(&tsdial.Dialer{Logf: logger.Discard})
-	sys.DNSManager.Set(&dns.Manager{})
+func newTestSafeBackend(t *testing.T) *testSafeBackend {
+	sys := tsd.NewSystemWithBus(eventbustest.NewBus(t))
+	dialer := tsdial.NewDialer(netmon.NewStatic())
+	sys.Dialer.Set(dialer)
+	ht := sys.HealthTracker.Get()
+	sys.DNSManager.Set(dns.NewManager(logger.Discard, nil, ht, dialer, nil, nil, "", sys.Bus.Get()))
 	sys.Tun.Set(&tstun.Wrapper{})
-	sb.sys = sys
-	return sb
+	return &testSafeBackend{sys: sys}
 }
 
 func (b *testSafeBackend) Sys() *tsd.System { return b.sys }
@@ -942,7 +1536,7 @@ func TestAddressAssignmentIsHandled(t *testing.T) {
 
 	ext := &extension{
 		conn25:  newConn25(logger.Discard),
-		backend: newTestSafeBackend(),
+		backend: newTestSafeBackend(t),
 	}
 	authReconfigAsyncCalled := make(chan struct{}, 1)
 	if err := ext.Init(&testHost{
@@ -950,6 +1544,7 @@ func TestAddressAssignmentIsHandled(t *testing.T) {
 			peers:      []tailcfg.NodeView{connectorPeer},
 			peerAPIURL: peersAPI.URL,
 		},
+		prefs: testPrefsNotConnector,
 		authReconfigAsync: func() {
 			authReconfigAsyncCalled <- struct{}{}
 		},
@@ -962,13 +1557,12 @@ func TestAddressAssignmentIsHandled(t *testing.T) {
 		Name:       "app1",
 		Connectors: []string{"tag:woo"},
 		Domains:    []string{"example.com"},
-	}}, []string{})
-	err := ext.conn25.reconfig(sn)
-	if err != nil {
-		t.Fatal(err)
-	}
+	}}, appctype.Conn25PoolsAttr{}, []string{})
 
-	as := addrs{
+	cfg := mustConfig(t, sn)
+	ext.conn25.reconfig(cfg)
+
+	as := &addrs{
 		dst:     netip.MustParseAddr("1.2.3.4"),
 		magic:   netip.MustParseAddr("100.64.0.0"),
 		transit: netip.MustParseAddr("169.254.0.1"),
@@ -1032,42 +1626,45 @@ func parseResponse(t *testing.T, buf []byte) ([]dnsmessage.Resource, []dnsmessag
 	return answers, additionals
 }
 
+func compareToRecords(t *testing.T, resources []dnsmessage.Resource, want []netip.Addr) {
+	t.Helper()
+	var got []netip.Addr
+	for _, r := range resources {
+		if b, ok := r.Body.(*dnsmessage.AResource); ok {
+			got = append(got, netip.AddrFrom4(b.A))
+		} else if b, ok := r.Body.(*dnsmessage.AAAAResource); ok {
+			got = append(got, netip.AddrFrom16(b.AAAA))
+		}
+	}
+	if diff := cmp.Diff(want, got, cmpopts.EquateComparable(netip.Addr{})); diff != "" {
+		t.Fatalf("A/AAAA records mismatch (-want +got):\n%s", diff)
+	}
+}
+
+func assertParsesToAnswers(want []netip.Addr) func(t *testing.T, bs []byte) {
+	return func(t *testing.T, bs []byte) {
+		t.Helper()
+		answers, _ := parseResponse(t, bs)
+		compareToRecords(t, answers, want)
+	}
+}
+
 func TestMapDNSResponseRewritesResponses(t *testing.T) {
 	configuredDomain := "example.com"
 	domainName := configuredDomain + "."
 	dnsMessageName := dnsmessage.MustNewName(domainName)
 	sn := makeSelfNode(t, []appctype.Conn25Attr{{
-		Name:            "app1",
-		Connectors:      []string{"tag:connector"},
-		Domains:         []string{configuredDomain},
+		Name:       "app1",
+		Connectors: []string{"tag:connector"},
+		Domains:    []string{configuredDomain},
+	}}, appctype.Conn25PoolsAttr{
 		V4MagicIPPool:   []netipx.IPRange{v4RangeFrom("0", "10")},
 		V4TransitIPPool: []netipx.IPRange{v4RangeFrom("40", "50")},
 		V6MagicIPPool:   []netipx.IPRange{netipx.IPRangeFrom(netip.MustParseAddr("2606:4700::6812:100"), netip.MustParseAddr("2606:4700::6812:1ff"))},
 		V6TransitIPPool: []netipx.IPRange{netipx.IPRangeFrom(netip.MustParseAddr("2606:4700::6813:100"), netip.MustParseAddr("2606:4700::6813:1ff"))},
-	}}, []string{})
+	}, []string{})
 
-	compareToRecords := func(t *testing.T, resources []dnsmessage.Resource, want []netip.Addr) {
-		t.Helper()
-		var got []netip.Addr
-		for _, r := range resources {
-			if b, ok := r.Body.(*dnsmessage.AResource); ok {
-				got = append(got, netip.AddrFrom4(b.A))
-			} else if b, ok := r.Body.(*dnsmessage.AAAAResource); ok {
-				got = append(got, netip.AddrFrom16(b.AAAA))
-			}
-		}
-		if diff := cmp.Diff(want, got, cmpopts.EquateComparable(netip.Addr{})); diff != "" {
-			t.Fatalf("A/AAAA records mismatch (-want +got):\n%s", diff)
-		}
-	}
-
-	assertParsesToAnswers := func(want []netip.Addr) func(t *testing.T, bs []byte) {
-		return func(t *testing.T, bs []byte) {
-			t.Helper()
-			answers, _ := parseResponse(t, bs)
-			compareToRecords(t, answers, want)
-		}
-	}
+	cfg := mustConfig(t, sn)
 
 	assertParsesToAdditionals := func(want []netip.Addr) func(t *testing.T, bs []byte) {
 		return func(t *testing.T, bs []byte) {
@@ -1320,12 +1917,178 @@ func TestMapDNSResponseRewritesResponses(t *testing.T) {
 			),
 			assertFx: assertParsesToAnswers([]netip.Addr{netip.MustParseAddr("2606:4700::6812:100")}),
 		},
+		{
+			name: "cname-resolves-to-magic-ip",
+			toMap: makeDNSResponseForSections(t,
+				[]dnsmessage.Question{{Name: dnsMessageName, Type: dnsmessage.TypeA, Class: dnsmessage.ClassINET}},
+				[]dnsmessage.Resource{
+					{
+						Header: dnsmessage.ResourceHeader{
+							Name:  dnsMessageName,
+							Type:  dnsmessage.TypeCNAME,
+							Class: dnsmessage.ClassINET,
+						},
+						Body: &dnsmessage.CNAMEResource{CNAME: dnsmessage.MustNewName("a.example.com.")},
+					},
+					{
+						Header: dnsmessage.ResourceHeader{
+							Name:  dnsmessage.MustNewName("a.example.com."),
+							Type:  dnsmessage.TypeCNAME,
+							Class: dnsmessage.ClassINET,
+						},
+						Body: &dnsmessage.CNAMEResource{CNAME: dnsmessage.MustNewName("b.example.com.")},
+					},
+					{
+						Header: dnsmessage.ResourceHeader{
+							Name:  dnsmessage.MustNewName("b.example.com."),
+							Type:  dnsmessage.TypeCNAME,
+							Class: dnsmessage.ClassINET,
+						},
+						Body: &dnsmessage.CNAMEResource{CNAME: dnsmessage.MustNewName("c.example.com.")},
+					},
+					{
+						Header: dnsmessage.ResourceHeader{
+							Name:  dnsmessage.MustNewName("c.example.com."),
+							Type:  dnsmessage.TypeA,
+							Class: dnsmessage.ClassINET,
+						},
+						Body: &dnsmessage.AResource{A: netip.MustParseAddr("1.2.3.4").As4()},
+					},
+				},
+				nil,
+			),
+			assertFx: assertParsesToAnswers([]netip.Addr{netip.MustParseAddr("100.64.0.0")}),
+		},
+		{
+			name: "cname-aaaa-resolves-to-magic-ip",
+			toMap: makeDNSResponseForSections(t,
+				[]dnsmessage.Question{
+					{
+						Name:  dnsMessageName,
+						Type:  dnsmessage.TypeAAAA,
+						Class: dnsmessage.ClassINET,
+					},
+				},
+				[]dnsmessage.Resource{
+					{
+						Header: dnsmessage.ResourceHeader{
+							Name:  dnsMessageName,
+							Type:  dnsmessage.TypeCNAME,
+							Class: dnsmessage.ClassINET,
+						},
+						Body: &dnsmessage.CNAMEResource{CNAME: dnsmessage.MustNewName("cdn.example.net.")},
+					},
+					{
+						Header: dnsmessage.ResourceHeader{
+							Name:  dnsmessage.MustNewName("cdn.example.net."),
+							Type:  dnsmessage.TypeAAAA,
+							Class: dnsmessage.ClassINET,
+						},
+						Body: &dnsmessage.AAAAResource{AAAA: netip.MustParseAddr("2606:4700::6812:1a78").As16()},
+					},
+				},
+				nil,
+			),
+			assertFx: assertParsesToAnswers([]netip.Addr{netip.MustParseAddr("2606:4700::6812:100")}),
+		},
+		{
+			name: "cname-broken-chain-skips-answer",
+			toMap: makeDNSResponseForSections(t,
+				[]dnsmessage.Question{{Name: dnsMessageName, Type: dnsmessage.TypeA, Class: dnsmessage.ClassINET}},
+				[]dnsmessage.Resource{
+					{
+						Header: dnsmessage.ResourceHeader{
+							Name:  dnsMessageName,
+							Type:  dnsmessage.TypeCNAME,
+							Class: dnsmessage.ClassINET,
+						},
+						Body: &dnsmessage.CNAMEResource{CNAME: dnsmessage.MustNewName("cdn.example.net.")},
+					},
+					{
+						Header: dnsmessage.ResourceHeader{
+							Name:  dnsmessage.MustNewName("unrelated.com."),
+							Type:  dnsmessage.TypeA,
+							Class: dnsmessage.ClassINET,
+						},
+						Body: &dnsmessage.AResource{A: netip.MustParseAddr("1.2.3.4").As4()},
+					},
+				},
+				nil,
+			),
+			assertFx: assertParsesToAnswers(nil),
+		},
+		{
+			name: "cname-multi-source-same-target",
+			toMap: makeDNSResponseForSections(t,
+				[]dnsmessage.Question{{Name: dnsMessageName, Type: dnsmessage.TypeA, Class: dnsmessage.ClassINET}},
+				[]dnsmessage.Resource{
+					{
+						Header: dnsmessage.ResourceHeader{
+							Name:  dnsMessageName,
+							Type:  dnsmessage.TypeCNAME,
+							Class: dnsmessage.ClassINET,
+						},
+						Body: &dnsmessage.CNAMEResource{CNAME: dnsmessage.MustNewName("z.example.com.")},
+					},
+					{
+						Header: dnsmessage.ResourceHeader{
+							Name:  dnsmessage.MustNewName("a.example.com."),
+							Type:  dnsmessage.TypeCNAME,
+							Class: dnsmessage.ClassINET,
+						},
+						Body: &dnsmessage.CNAMEResource{CNAME: dnsmessage.MustNewName("z.example.com.")},
+					},
+					{
+						Header: dnsmessage.ResourceHeader{
+							Name:  dnsmessage.MustNewName("z.example.com."),
+							Type:  dnsmessage.TypeA,
+							Class: dnsmessage.ClassINET,
+						},
+						Body: &dnsmessage.AResource{A: netip.MustParseAddr("1.2.3.4").As4()},
+					},
+				},
+				nil,
+			),
+			assertFx: assertParsesToAnswers([]netip.Addr{netip.MustParseAddr("100.64.0.0")}),
+		},
+		{
+			name: "cname-has-loop",
+			toMap: makeDNSResponseForSections(t,
+				[]dnsmessage.Question{{Name: dnsMessageName, Type: dnsmessage.TypeA, Class: dnsmessage.ClassINET}},
+				[]dnsmessage.Resource{
+					{
+						Header: dnsmessage.ResourceHeader{
+							Name:  dnsMessageName,
+							Type:  dnsmessage.TypeCNAME,
+							Class: dnsmessage.ClassINET,
+						},
+						Body: &dnsmessage.CNAMEResource{CNAME: dnsmessage.MustNewName("a.example.com.")},
+					},
+					{
+						Header: dnsmessage.ResourceHeader{
+							Name:  dnsmessage.MustNewName("a.example.com."),
+							Type:  dnsmessage.TypeCNAME,
+							Class: dnsmessage.ClassINET,
+						},
+						Body: &dnsmessage.CNAMEResource{CNAME: dnsMessageName},
+					},
+					{
+						Header: dnsmessage.ResourceHeader{
+							Name:  dnsmessage.MustNewName("z.example.com."),
+							Type:  dnsmessage.TypeA,
+							Class: dnsmessage.ClassINET,
+						},
+						Body: &dnsmessage.AResource{A: netip.MustParseAddr("1.2.3.4").As4()},
+					},
+				},
+				nil,
+			),
+			assertFx: assertParsesToAnswers(nil),
+		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
 			c := newConn25(logger.Discard)
-			if err := c.reconfig(sn); err != nil {
-				t.Fatal(err)
-			}
+			c.reconfig(cfg)
 			bs := c.mapDNSResponse(tt.toMap)
 			tt.assertFx(t, bs)
 		})
@@ -1368,7 +2131,7 @@ func TestHandleAddressAssignmentStoresTransitIPs(t *testing.T) {
 
 	ext := &extension{
 		conn25:  newConn25(logger.Discard),
-		backend: newTestSafeBackend(),
+		backend: newTestSafeBackend(t),
 	}
 	authReconfigAsyncCalled := make(chan struct{}, 1)
 	if err := ext.Init(&testHost{
@@ -1376,6 +2139,7 @@ func TestHandleAddressAssignmentStoresTransitIPs(t *testing.T) {
 			peers:      connectorPeers,
 			peerAPIURL: peersAPI.URL,
 		},
+		prefs: testPrefsNotConnector,
 		authReconfigAsync: func() {
 			authReconfigAsyncCalled <- struct{}{}
 		},
@@ -1395,11 +2159,10 @@ func TestHandleAddressAssignmentStoresTransitIPs(t *testing.T) {
 			Connectors: []string{"tag:hoo"},
 			Domains:    []string{"hoo.example.com"},
 		},
-	}, []string{})
-	err := ext.conn25.reconfig(sn)
-	if err != nil {
-		t.Fatal(err)
-	}
+	}, appctype.Conn25PoolsAttr{}, []string{})
+
+	cfg := mustConfig(t, sn)
+	ext.conn25.reconfig(cfg)
 
 	type lookup struct {
 		connKey     key.NodePublic
@@ -1416,12 +2179,12 @@ func TestHandleAddressAssignmentStoresTransitIPs(t *testing.T) {
 	// and then does the lookups.
 	steps := []struct {
 		name    string
-		as      addrs
+		as      *addrs
 		lookups []lookup
 	}{
 		{
 			name: "step-1-conn1-tip1",
-			as: addrs{
+			as: &addrs{
 				dst:     netip.MustParseAddr("1.2.3.1"),
 				magic:   netip.MustParseAddr("100.64.0.1"),
 				transit: transitIPs[0].Addr(),
@@ -1445,7 +2208,7 @@ func TestHandleAddressAssignmentStoresTransitIPs(t *testing.T) {
 		},
 		{
 			name: "step-2-conn1-tip2",
-			as: addrs{
+			as: &addrs{
 				dst:     netip.MustParseAddr("1.2.3.2"),
 				magic:   netip.MustParseAddr("100.64.0.2"),
 				transit: transitIPs[1].Addr(),
@@ -1465,7 +2228,7 @@ func TestHandleAddressAssignmentStoresTransitIPs(t *testing.T) {
 		},
 		{
 			name: "step-3-conn2-tip1",
-			as: addrs{
+			as: &addrs{
 				dst:     netip.MustParseAddr("1.2.3.3"),
 				magic:   netip.MustParseAddr("100.64.0.3"),
 				transit: transitIPs[2].Addr(),
@@ -1510,7 +2273,7 @@ func TestHandleAddressAssignmentStoresTransitIPs(t *testing.T) {
 
 			// Check that each of the lookups behaves as expected
 			for i, lu := range tt.lookups {
-				got, ok := ext.conn25.client.assignments.lookupTransitIPsByConnKey(lu.connKey)
+				got, ok := ext.conn25.client.lookupTransitIPsByConnKey(lu.connKey)
 				if ok != lu.expectedOk {
 					t.Fatalf("unexpected ok result at index %d wanted %v, got %v", i, lu.expectedOk, ok)
 				}
@@ -1526,7 +2289,7 @@ func TestHandleAddressAssignmentStoresTransitIPs(t *testing.T) {
 func TestTransitIPConnMapping(t *testing.T) {
 	conn25 := newConn25(t.Logf)
 
-	as := addrs{
+	as := &addrs{
 		dst:     netip.MustParseAddr("1.2.3.1"),
 		magic:   netip.MustParseAddr("100.64.0.1"),
 		transit: netip.MustParseAddr("169.254.0.1"),
@@ -1565,17 +2328,19 @@ func TestTransitIPConnMapping(t *testing.T) {
 	if err := conn25.client.addTransitIPForConnector(as.transit, connectorPeers[1]); err != nil {
 		t.Errorf("unexpected error for first time add: %v", err)
 	}
-	// But doing it again should fail
-	if err := conn25.client.addTransitIPForConnector(as.transit, connectorPeers[1]); err == nil {
-		t.Error("adding a duplicate transitIP for a connector should fail")
+	// And doing it again shouldn't fail (this is done when resending mappings
+	// to a restarted connector)
+	if err := conn25.client.addTransitIPForConnector(as.transit, connectorPeers[1]); err != nil {
+		t.Errorf("error adding duplicate transitIP for a connector: %v", err)
 	}
 }
 
 func TestClientTransitIPForMagicIP(t *testing.T) {
-	sn := makeSelfNode(t, []appctype.Conn25Attr{{
+	sn := makeSelfNode(t, []appctype.Conn25Attr{{Name: "app1"}}, appctype.Conn25PoolsAttr{
 		V4MagicIPPool: []netipx.IPRange{v4RangeFrom("0", "10")}, // 100.64.0.0 - 100.64.0.10
 		V6MagicIPPool: []netipx.IPRange{v6RangeFrom("0", "10")},
-	}}, []string{})
+	}, []string{})
+	cfg := mustConfig(t, sn)
 
 	mappedMip := netip.MustParseAddr("100.64.0.0")
 	mappedTip := netip.MustParseAddr("169.0.0.0")
@@ -1634,24 +2399,23 @@ func TestClientTransitIPForMagicIP(t *testing.T) {
 	} {
 		t.Run(tt.name, func(t *testing.T) {
 			c := newConn25(t.Logf)
-			if err := c.reconfig(sn); err != nil {
-				t.Fatal(err)
-			}
-			if err := c.client.assignments.insert(addrs{
+			c.reconfig(cfg)
+
+			if err := c.client.assignments.insert(&addrs{
 				magic:   mappedMip,
 				transit: mappedTip,
 				dst:     dst,
 			}); err != nil {
 				t.Fatal(err)
 			}
-			if err := c.client.assignments.insert(addrs{
+			if err := c.client.assignments.insert(&addrs{
 				magic:   v6MappedMip,
 				transit: v6MappedTip,
 				dst:     v6Dst,
 			}); err != nil {
 				t.Fatal(err)
 			}
-			tip, err := c.client.transitIPForMagicIP(tt.mip)
+			tip, err := c.ClientTransitIPForMagicIP(tt.mip)
 			if tip != tt.wantTip {
 				t.Fatalf("checking transit ip: want %v, got %v", tt.wantTip, tip)
 			}
@@ -1663,9 +2427,11 @@ func TestClientTransitIPForMagicIP(t *testing.T) {
 }
 
 func TestConnectorRealIPForTransitIPConnection(t *testing.T) {
-	sn := makeSelfNode(t, []appctype.Conn25Attr{{
+	sn := makeSelfNode(t, []appctype.Conn25Attr{{Name: "app1"}}, appctype.Conn25PoolsAttr{
 		V4TransitIPPool: []netipx.IPRange{v4RangeFrom("40", "50")}, // 100.64.0.40 - 100.64.0.50
-	}}, []string{})
+	}, []string{})
+	cfg := mustConfig(t, sn)
+
 	mappedSrc := netip.MustParseAddr("100.0.0.1")
 	unmappedSrc := netip.MustParseAddr("100.0.0.2")
 	mappedTip := netip.MustParseAddr("100.64.0.41")
@@ -1717,13 +2483,11 @@ func TestConnectorRealIPForTransitIPConnection(t *testing.T) {
 	} {
 		t.Run(tt.name, func(t *testing.T) {
 			c := newConn25(t.Logf)
-			if err := c.reconfig(sn); err != nil {
-				t.Fatal(err)
-			}
+			c.reconfig(cfg)
 			c.connector.transitIPs = map[netip.Addr]map[netip.Addr]appAddr{}
 			c.connector.transitIPs[mappedSrc] = map[netip.Addr]appAddr{}
 			c.connector.transitIPs[mappedSrc][mappedTip] = appAddr{addr: mappedMip}
-			mip, err := c.connector.realIPForTransitIPConnection(tt.src, tt.tip)
+			mip, err := c.ConnectorRealIPForTransitIPConnection(tt.src, tt.tip)
 			if mip != tt.wantMip {
 				t.Fatalf("checking magic ip: want %v, got %v", tt.wantMip, mip)
 			}
@@ -1739,9 +2503,13 @@ func TestIsKnownTransitIP(t *testing.T) {
 	unknownTip := netip.MustParseAddr("100.64.0.42")
 
 	c := newConn25(t.Logf)
-	c.client.assignments.insert(addrs{
+	err := c.client.assignments.insert(&addrs{
 		transit: knownTip,
 	})
+	if err != nil {
+		t.Errorf("error inserting address assignment: %v", err)
+		return
+	}
 
 	if !c.client.isKnownTransitIP(knownTip) {
 		t.Fatal("knownTip: should have been known")
@@ -1755,9 +2523,12 @@ func TestLinkLocalAllow(t *testing.T) {
 	knownTip := netip.MustParseAddr("100.64.0.41")
 
 	c := newConn25(t.Logf)
-	c.client.assignments.insert(addrs{
+	err := c.client.assignments.insert(&addrs{
 		transit: knownTip,
 	})
+	if err != nil {
+		t.Fatalf("error inserting address assignment: %v", err)
+	}
 
 	if allow, _ := c.client.linkLocalAllow(packet.Parsed{
 		Dst: netip.AddrPortFrom(knownTip, 1234),
@@ -1773,31 +2544,31 @@ func TestLinkLocalAllow(t *testing.T) {
 }
 
 func TestConnectorPacketFilterAllow(t *testing.T) {
-	knownTip := netip.MustParseAddr("100.64.0.41")
-	knownSrc := netip.MustParseAddr("100.64.0.1")
+	src := netip.MustParseAddr("100.64.0.1")
+	knownTip := netip.MustParseAddr("192.0.2.1")
 	unknownTip := netip.MustParseAddr("100.64.0.42")
-	unknownSrc := netip.MustParseAddr("100.64.0.42")
+
+	v4TransitIPsBuilder := netipx.IPSetBuilder{}
+	v4TransitIPsBuilder.AddPrefix(netip.MustParsePrefix("192.0.2.0/24"))
+	v4TransitIPs := must.Get(v4TransitIPsBuilder.IPSet())
 
 	c := newConn25(t.Logf)
-	c.connector.transitIPs = map[netip.Addr]map[netip.Addr]appAddr{}
-	c.connector.transitIPs[knownSrc] = map[netip.Addr]appAddr{}
-	c.connector.transitIPs[knownSrc][knownTip] = appAddr{}
+	c.reconfig(&config{
+		isConfigured: true,
+		ipSets: ipSets{
+			v4Transit: v4TransitIPs,
+		},
+	})
 
 	if allow, _ := c.connector.packetFilterAllow(packet.Parsed{
-		Src: netip.AddrPortFrom(knownSrc, 1234),
+		Src: netip.AddrPortFrom(src, 1234),
 		Dst: netip.AddrPortFrom(knownTip, 1234),
 	}); !allow {
 		t.Fatal("knownTip: should have been allowed")
 	}
 
 	if allow, _ := c.connector.packetFilterAllow(packet.Parsed{
-		Src: netip.AddrPortFrom(unknownSrc, 1234),
-		Dst: netip.AddrPortFrom(knownTip, 1234),
-	}); allow {
-		t.Fatal("unknownSrc: should not have been allowed")
-	}
-	if allow, _ := c.connector.packetFilterAllow(packet.Parsed{
-		Src: netip.AddrPortFrom(knownSrc, 1234),
+		Src: netip.AddrPortFrom(src, 1234),
 		Dst: netip.AddrPortFrom(unknownTip, 1234),
 	}); allow {
 		t.Fatal("unknownTip: should not have been allowed")
@@ -1806,16 +2577,16 @@ func TestConnectorPacketFilterAllow(t *testing.T) {
 
 func TestGetMagicRange(t *testing.T) {
 	sn := makeSelfNode(t, []appctype.Conn25Attr{{
-		Name:          "app1",
-		Connectors:    []string{"tag:woo"},
-		Domains:       []string{"example.com"},
+		Name:       "app1",
+		Connectors: []string{"tag:woo"},
+		Domains:    []string{"example.com"},
+	}}, appctype.Conn25PoolsAttr{
 		V4MagicIPPool: []netipx.IPRange{netipx.IPRangeFrom(netip.MustParseAddr("0.0.0.1"), netip.MustParseAddr("0.0.0.3"))},
 		V6MagicIPPool: []netipx.IPRange{netipx.IPRangeFrom(netip.MustParseAddr("::1"), netip.MustParseAddr("::3"))},
-	}}, []string{})
+	}, []string{})
+	cfg := mustConfig(t, sn)
 	c := newConn25(t.Logf)
-	if err := c.reconfig(sn); err != nil {
-		t.Fatal(err)
-	}
+	c.reconfig(cfg)
 	ext := &extension{
 		conn25: c,
 	}
@@ -1853,3 +2624,279 @@ func TestGetMagicRange(t *testing.T) {
 		}
 	}
 }
+
+func TestReconfigDoesNotReissueInUseAddresses(t *testing.T) {
+	appName := "app1"
+	mustRange := func(from, to string) netipx.IPRange {
+		return netipx.IPRangeFrom(netip.MustParseAddr(from), netip.MustParseAddr(to))
+	}
+	beforeRangeV4 := mustRange("0.0.0.1", "0.0.0.3")
+	beforeRangeV6 := mustRange("::1", "::3")
+	afterRangeV4 := mustRange("0.0.0.4", "0.0.0.7")
+	afterRangeV6 := mustRange("::4", "::7")
+	makeNodeFromMagicRange := func(v4, v6 netipx.IPRange) tailcfg.NodeView {
+		return makeSelfNode(t, []appctype.Conn25Attr{{
+			Name:       appName,
+			Connectors: []string{"tag:woo"},
+			Domains:    []string{"example.com"},
+		}}, appctype.Conn25PoolsAttr{
+			V4MagicIPPool:   []netipx.IPRange{v4},
+			V6MagicIPPool:   []netipx.IPRange{v6},
+			V4TransitIPPool: []netipx.IPRange{mustRange("169.254.0.0", "169.254.0.10")},
+			V6TransitIPPool: []netipx.IPRange{mustRange("fd7a:115c:a1e0:a99c:0200::", "fd7a:115c:a1e0:a99c:0200::10")},
+		}, []string{})
+	}
+	domain := must.Get(dnsname.ToFQDN("example.com."))
+
+	for _, tt := range []struct {
+		name   string
+		dstOne netip.Addr
+		dstTwo netip.Addr
+	}{
+		{
+			name:   "v4",
+			dstOne: netip.MustParseAddr("0.0.0.100"),
+			dstTwo: netip.MustParseAddr("0.0.0.101"),
+		},
+		{
+			name:   "v6",
+			dstOne: netip.MustParseAddr("::100"),
+			dstTwo: netip.MustParseAddr("::101"),
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			c := newConn25(t.Logf)
+			ext := &extension{
+				conn25: c,
+			}
+
+			_, err := c.client.reserveAddresses(appName, domain, tt.dstOne, 10)
+			if !errors.Is(err, errUninitializedIPPool) {
+				t.Fatalf("want %v, got %v", errUninitializedIPPool, err)
+			}
+
+			ext.onSelfChange(makeNodeFromMagicRange(beforeRangeV4, beforeRangeV6))
+			beforeAddrs, err := c.client.reserveAddresses(appName, domain, tt.dstOne, 10)
+			if err != nil {
+				t.Fatal(err)
+			}
+			ext.onSelfChange(makeNodeFromMagicRange(afterRangeV4, afterRangeV6))
+			afterAddrs, err := c.client.reserveAddresses(appName, domain, tt.dstTwo, 10)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if afterAddrs.magic == beforeAddrs.magic {
+				t.Errorf("pool reissued magic: %v that was already assigned", beforeAddrs.magic)
+			}
+		})
+	}
+}
+
+// TestAddressExpiryDependsOnActiveFlows creates a Conn25 and
+//
+//  1. runs a DNS response through it
+//  2. uses the ClientFlowCreated/Removed API and advances the clock
+//  3. runs a second DNS response through the Conn25
+//  4. asserts things about the expected state of the clients assignments
+//     table based on 1-3
+//
+// to try and verify how the assignments table entries expiration is affected
+// by the presence of active flows for the addresses in the entry
+func TestAddressExpiryDependsOnActiveFlows(t *testing.T) {
+	configuredDomain := "example.com"
+	domainName := configuredDomain + "."
+	dnsMessageName := dnsmessage.MustNewName(domainName)
+	sn := makeSelfNode(t, []appctype.Conn25Attr{{
+		Name:       "app1",
+		Connectors: []string{"tag:woo"},
+		Domains:    []string{configuredDomain},
+	}}, appctype.Conn25PoolsAttr{
+		V4MagicIPPool:   []netipx.IPRange{v4RangeFrom("0", "10")},
+		V4TransitIPPool: []netipx.IPRange{v4RangeFrom("40", "50")},
+		V6MagicIPPool:   []netipx.IPRange{netipx.IPRangeFrom(netip.MustParseAddr("2606:4700::6812:100"), netip.MustParseAddr("2606:4700::6812:1ff"))},
+		V6TransitIPPool: []netipx.IPRange{netipx.IPRangeFrom(netip.MustParseAddr("2606:4700::6813:100"), netip.MustParseAddr("2606:4700::6813:1ff"))},
+	}, nil)
+
+	var ttlSecs uint32 = 300
+	ttlDur := time.Duration(ttlSecs) * time.Second
+
+	ipOne := netip.MustParseAddr("1.0.0.1")
+	dnsRespIPOne := makeDNSResponseForSections(t,
+		[]dnsmessage.Question{{Name: dnsMessageName, Type: dnsmessage.TypeA, Class: dnsmessage.ClassINET}},
+		[]dnsmessage.Resource{
+			{
+				Header: dnsmessage.ResourceHeader{Name: dnsMessageName, Type: dnsmessage.TypeA, Class: dnsmessage.ClassINET, TTL: ttlSecs},
+				Body:   &dnsmessage.AResource{A: ipOne.As4()},
+			},
+		},
+		nil,
+	)
+
+	ipTwo := netip.MustParseAddr("1.0.0.2")
+	dnsRespIPTwo := makeDNSResponseForSections(t,
+		[]dnsmessage.Question{{Name: dnsMessageName, Type: dnsmessage.TypeA, Class: dnsmessage.ClassINET}},
+		[]dnsmessage.Resource{
+			{
+				Header: dnsmessage.ResourceHeader{Name: dnsMessageName, Type: dnsmessage.TypeA, Class: dnsmessage.ClassINET, TTL: ttlSecs},
+				Body:   &dnsmessage.AResource{A: ipTwo.As4()},
+			},
+		},
+		nil,
+	)
+
+	tests := []struct {
+		name                    string
+		flowsAndTimeFx          func(*Conn25, *tstest.Clock, netip.Addr)
+		secondDNSResponse       []byte
+		assertSecondDNSResponse func(*testing.T, []byte)
+		wantUnexpiredDstIPs     set.Set[netip.Addr]
+		wantExpiredAtTime       map[netip.Addr]time.Duration // since the startTime
+	}{
+		{
+			// The first dns response should create an assignments entry for ipOne
+			// (tested elsewhere).
+			// Then time advances past that entry's expiresAt.
+			// Then a second dns response creates an assignments entry for ipTwo.
+			// We clean up some expired assignments entries when we create a new one
+			// and so we expect the entry for ipOne to be removed, and the entry for
+			// ipTwo to be present.
+			name: "flows-zero",
+			flowsAndTimeFx: func(c *Conn25, clock *tstest.Clock, transit netip.Addr) {
+				clock.Advance(30 * time.Hour)
+			},
+			wantUnexpiredDstIPs: set.SetOf([]netip.Addr{ipTwo}),
+			wantExpiredAtTime: map[netip.Addr]time.Duration{
+				ipTwo: (30 * time.Hour) + ttlDur,
+			},
+		},
+		{
+			// Same as flows-zero except this time the datapath has let us know that
+			// there is a flow for the transit address that was assigned to the entry for
+			// ipOne.
+			// And so that entry does not get expired.
+			name: "flows-not-zero",
+			flowsAndTimeFx: func(c *Conn25, clock *tstest.Clock, transit netip.Addr) {
+				c.ClientFlowCreated(transit)
+				clock.Advance(30 * time.Hour)
+			},
+			wantUnexpiredDstIPs: set.SetOf([]netip.Addr{ipOne, ipTwo}),
+			wantExpiredAtTime: map[netip.Addr]time.Duration{
+				ipOne: (30 * time.Hour) + extendForActiveFlowDuration,
+				ipTwo: (30 * time.Hour) + ttlDur,
+			},
+		},
+		{
+			// Like flows-not-zero except that this time the datapath removed the
+			// client flow after creating it.
+			// So the expired entry is removed.
+			name: "last-flow-removed-a-while-ago",
+			flowsAndTimeFx: func(c *Conn25, clock *tstest.Clock, transit netip.Addr) {
+				c.ClientFlowCreated(transit)
+				clock.Advance(30 * time.Hour)
+				c.ClientFlowRemoved(transit)
+				clock.Advance(3 * time.Minute)
+			},
+			wantUnexpiredDstIPs: set.SetOf([]netip.Addr{ipTwo}),
+			wantExpiredAtTime: map[netip.Addr]time.Duration{
+				ipTwo: (30 * time.Hour) + (3 * time.Minute) + ttlDur,
+			},
+		},
+		{
+			// Like last-flow-removed-a-while-ago except the flow was removed recently,
+			// within the cooldown period.
+			// And so the expired entry is not removed.
+			name: "last-flow-recently-removed",
+			flowsAndTimeFx: func(c *Conn25, clock *tstest.Clock, transit netip.Addr) {
+				c.ClientFlowCreated(transit)
+				clock.Advance(30 * time.Hour)
+				c.ClientFlowRemoved(transit)
+				clock.Advance(1 * time.Second)
+			},
+			wantUnexpiredDstIPs: set.SetOf([]netip.Addr{ipOne, ipTwo}),
+			wantExpiredAtTime: map[netip.Addr]time.Duration{
+				ipOne: (30 * time.Hour) + extendForActiveFlowDuration + (1 * time.Second),
+				ipTwo: (30 * time.Hour) + (1 * time.Second) + ttlDur,
+			},
+		},
+		{
+			// Like flows-not-zero except that the second dns response is for the same address as the first.
+			// So the entry is not removed.
+			name:              "repeated-response-with-expired-and-active-flow",
+			secondDNSResponse: dnsRespIPOne,
+			flowsAndTimeFx: func(c *Conn25, clock *tstest.Clock, transit netip.Addr) {
+				c.ClientFlowCreated(transit)
+				clock.Advance(30 * time.Hour)
+			},
+			wantUnexpiredDstIPs: set.SetOf([]netip.Addr{ipOne}),
+			wantExpiredAtTime: map[netip.Addr]time.Duration{
+				ipOne: (30 * time.Hour) + ttlDur,
+			},
+			assertSecondDNSResponse: assertParsesToAnswers(
+				[]netip.Addr{
+					netip.MustParseAddr("100.64.0.0"),
+				},
+			),
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			c := newConn25(logger.Discard)
+			startTime := time.Now()
+			clock := tstest.NewClock(tstest.ClockOpts{Start: startTime})
+			c.client.assignments.clock = clock
+			cfg := mustConfig(t, sn)
+			c.reconfig(cfg)
+
+			// we get a dns response for ipone
+			bs1 := c.mapDNSResponse(dnsRespIPOne)
+			assertParsesToAnswers(
+				[]netip.Addr{
+					netip.MustParseAddr("100.64.0.0"),
+				},
+			)(t, bs1)
+
+			ipOneDD := domainDst{
+				domain: dnsname.FQDN(domainName),
+				dst:    ipOne,
+			}
+
+			// there are client flows and time passes
+			tt.flowsAndTimeFx(c, clock, c.client.assignments.byDomainDst[ipOneDD].transit)
+
+			// then a second dns response
+			dnsR2 := tt.secondDNSResponse
+			assertSecondResponseFx := tt.assertSecondDNSResponse
+			if dnsR2 == nil {
+				dnsR2 = dnsRespIPTwo
+				assertSecondResponseFx = assertParsesToAnswers(
+					[]netip.Addr{
+						netip.MustParseAddr("100.64.0.1"),
+					},
+				)
+			}
+			bs2 := c.mapDNSResponse(dnsR2)
+			assertSecondResponseFx(t, bs2)
+
+			// assert which addresses have expired / remain unexpired
+			assignmentsDsts := set.Set[netip.Addr]{}
+			for _, a := range c.client.assignments.byMagicIP {
+				assignmentsDsts.Add(a.dst)
+			}
+			if !assignmentsDsts.Equal(tt.wantUnexpiredDstIPs) {
+				t.Fatalf("unexpired dst IPs: want: %v, got %v", tt.wantUnexpiredDstIPs, assignmentsDsts)
+			}
+
+			for a, dur := range tt.wantExpiredAtTime {
+				dd := domainDst{
+					domain: dnsname.FQDN(domainName),
+					dst:    a,
+				}
+				as := c.client.assignments.byDomainDst[dd]
+				expected := startTime.Add(dur)
+				if !as.expiresAt.Equal(expected) {
+					t.Fatalf("a: %v, as.ExpiredAt: %v, expected: %v, dur: %v", a, as.expiresAt, expected, dur)
+				}
+			}
+		})
+	}
+}
diff --git a/feature/conn25/datapath.go b/feature/conn25/datapath.go
index b5cdd5155..573add730 100644
--- a/feature/conn25/datapath.go
+++ b/feature/conn25/datapath.go
@@ -4,6 +4,7 @@
 package conn25
 
 import (
+	"context"
 	"errors"
 	"net/netip"
 
@@ -11,6 +12,7 @@ import (
 	"tailscale.com/net/flowtrack"
 	"tailscale.com/net/packet"
 	"tailscale.com/net/packet/checksum"
+	"tailscale.com/net/tstun"
 	"tailscale.com/types/ipproto"
 	"tailscale.com/types/logger"
 	"tailscale.com/wgengine/filter"
@@ -21,9 +23,14 @@ var (
 	ErrUnmappedSrcAndTransitIP = errors.New("unmapped src and transit IP")
 )
 
-// IPMapper provides methods for mapping special app connector IPs to each other
-// in aid of performing DNAT and SNAT on app connector packets.
-type IPMapper interface {
+// Conn25Datapath is the interface for the surface of [*Conn25] that the datapath
+// handler needs. It provides methods for address mapping to help the datapath handler
+// implement DNAT/SNAT, and flow lifecycle handlers so that *Conn25 can keep address
+// assignments active for active flows.
+//
+// [*Conn25] is the only production implementation; the interface exists to let
+// datapath tests substitute a lightweight fake.
+type Conn25Datapath interface {
 	// ClientTransitIPForMagicIP returns a Transit IP for the given magicIP on a client.
 	// If the magicIP is within a configured Magic IP range for an app on the client,
 	// but not mapped to an active Transit IP, implementations should return [ErrUnmappedMagicIP].
@@ -40,6 +47,14 @@ type IPMapper interface {
 	// a nil error, and a zero-value [netip.Addr] to indicate this is potentially valid,
 	// non-app-connector traffic.
 	ConnectorRealIPForTransitIPConnection(srcIP netip.Addr, transitIP netip.Addr) (netip.Addr, error)
+
+	// ClientFlowCreated is called after a client-side flow for transitIP has
+	// been installed in the client flow table.
+	ClientFlowCreated(transitIP netip.Addr)
+	// ClientFlowRemoved is called after such a flow is removed. For each
+	// flow installed in the client flow table, ClientFlowCreated is called
+	// before any ClientFlowRemoved that fires for it.
+	ClientFlowRemoved(transitIP netip.Addr)
 }
 
 // datapathHandler handles packets from the datapath,
@@ -63,16 +78,16 @@ type IPMapper interface {
 // There are two exposed methods, one for handling packets from the tun device,
 // and one for handling packets from WireGuard, but through the use of flow tables,
 // we can handle four cases: client outbound, client return, connector outbound,
-// connector return. The first packet goes through IPMapper, which is where Connectors
-// 2025 authoritative state is stored. For valid packets relevant to connectors,
+// connector return. The first packet goes through [Conn25Datapath], which is where
+// Connectors 2025 authoritative state is stored. For valid packets relevant to connectors,
 // a bidirectional flow entry is installed, so that subsequent packets (and all return traffic)
 // hit that cache. Only outbound (towards internet) packets create new flows; return (from internet)
 // packets either match a cached entry or pass through.
 //
-// We check the cache before IPMapper both for performance, and so that existing flows stay alive
-// even if address mappings change mid-flow.
+// We check the cache before [Conn25Datapath] both for performance, and so that existing flows
+// stay alive even if address mappings change mid-flow.
 type datapathHandler struct {
-	ipMapper IPMapper
+	conn25 Conn25Datapath
 
 	// Flow caches. One for the client, and one for the connector.
 	clientFlowTable    *FlowTable
@@ -82,43 +97,56 @@ type datapathHandler struct {
 	debugLogging bool
 }
 
-func newDatapathHandler(ipMapper IPMapper, logf logger.Logf) *datapathHandler {
-	return &datapathHandler{
-		ipMapper: ipMapper,
+const (
+	maxClientFlows    = 10_000
+	maxConnectorFlows = 100_000
+)
 
-		// TODO(mzb): Figure out sensible default max size for flow tables.
-		// Don't do any LRU eviction until we figure out deletion and expiration.
-		clientFlowTable:    NewFlowTable(0),
-		connectorFlowTable: NewFlowTable(0),
+func newDatapathHandler(conn25 Conn25Datapath, logf logger.Logf) *datapathHandler {
+	return &datapathHandler{
+		conn25:             conn25,
+		clientFlowTable:    NewFlowTable(maxClientFlows),
+		connectorFlowTable: NewFlowTable(maxConnectorFlows),
 		logf:               logf,
 		debugLogging:       envknob.Bool("TS_CONN25_DATAPATH_DEBUG"),
 	}
 }
 
+// StartFlowExpirySweepers starts the sweepers that remove expired flows
+// for both the client and connector flow tables. Each sweeper runs in
+// its own new goroutine.
+func (dh *datapathHandler) StartFlowExpirySweepers(ctx context.Context) {
+	go dh.clientFlowTable.StartExpiredSweeper(ctx)
+	go dh.connectorFlowTable.StartExpiredSweeper(ctx)
+}
+
+func isSupportedProtocol(proto ipproto.Proto) bool {
+	return proto == ipproto.TCP || proto == ipproto.UDP || proto == ipproto.ICMPv4 || proto == ipproto.ICMPv6
+}
+
 // HandlePacketFromWireGuard inspects packets coming from WireGuard, and performs
 // appropriate DNAT or SNAT actions for Connectors 2025. Returning [filter.Accept] signals
 // that the packet should pass through subsequent stages of the datapath pipeline.
 // Returning [filter.Drop] signals the packet should be dropped. This method handles all
 // packets coming from WireGuard, on both connectors, and clients of connectors.
-func (dh *datapathHandler) HandlePacketFromWireGuard(p *packet.Parsed) filter.Response {
-	// TODO(tailscale/corp#38764): Support other protocols, like ICMP for error messages.
-	if p.IPProto != ipproto.TCP && p.IPProto != ipproto.UDP {
+func (dh *datapathHandler) HandlePacketFromWireGuard(p *packet.Parsed, tun *tstun.Wrapper) filter.Response {
+	if !isSupportedProtocol(p.IPProto) {
 		return filter.Accept
 	}
 
 	// Check if this is an existing (return) flow on a client.
 	// If found, perform the action for the existing client flow and return.
-	existing, ok := dh.clientFlowTable.LookupFromWireGuard(flowtrack.MakeTuple(p.IPProto, p.Src, p.Dst))
+	action, ok := dh.clientFlowTable.LookupFromWireGuard(flowtrack.MakeTuple(p.IPProto, p.Src, p.Dst))
 	if ok {
-		existing.Action(p)
+		action(p)
 		return filter.Accept
 	}
 
 	// Check if this is an existing connector outbound flow.
 	// If found, perform the action for the existing connector outbound flow and return.
-	existing, ok = dh.connectorFlowTable.LookupFromWireGuard(flowtrack.MakeTuple(p.IPProto, p.Src, p.Dst))
+	action, ok = dh.connectorFlowTable.LookupFromWireGuard(flowtrack.MakeTuple(p.IPProto, p.Src, p.Dst))
 	if ok {
-		existing.Action(p)
+		action(p)
 		return filter.Accept
 	}
 
@@ -127,10 +155,20 @@ func (dh *datapathHandler) HandlePacketFromWireGuard(p *packet.Parsed) filter.Re
 	// other (non-app-connector) traffic, or broken app-connector traffic
 	// that needs to be re-established by a new outbound packet.
 	transitIP := p.Dst.Addr()
-	realIP, err := dh.ipMapper.ConnectorRealIPForTransitIPConnection(p.Src.Addr(), transitIP)
+	realIP, err := dh.conn25.ConnectorRealIPForTransitIPConnection(p.Src.Addr(), transitIP)
 	if err != nil {
 		if errors.Is(err, ErrUnmappedSrcAndTransitIP) {
-			// TODO(tailscale/corp#34256): This path should deliver an ICMP error to the client.
+			rj := packet.TailscaleRejectedHeader{
+				IPSrc:  p.Dst.Addr(),
+				IPDst:  p.Src.Addr(),
+				Src:    p.Src,
+				Dst:    p.Dst,
+				Proto:  p.IPProto,
+				Reason: packet.RejectedDueToUnknownAppConnectorTransitIP,
+			}
+			if err := tun.InjectOutbound(packet.Generate(rj, nil)); err != nil {
+				dh.debugLogf("error sending TSMP flow rejection packet: %v", err)
+			}
 			return filter.Drop
 		}
 		dh.debugLogf("error mapping src and transit IP, passing packet unmodified: %v", err)
@@ -145,18 +183,18 @@ func (dh *datapathHandler) HandlePacketFromWireGuard(p *packet.Parsed) filter.Re
 	// This is a new outbound flow on a connector. Install a DNAT TransitIP-to-RealIP action
 	// for the outgoing direction, and an SNAT RealIP-to-TransitIP action for the
 	// return direction.
-	outgoing := FlowData{
+	outgoing := TupleAndAction{
 		Tuple:  flowtrack.MakeTuple(p.IPProto, p.Src, p.Dst),
 		Action: dh.dnatAction(realIP),
 	}
-	incoming := FlowData{
+	incoming := TupleAndAction{
 		Tuple:  flowtrack.MakeTuple(p.IPProto, netip.AddrPortFrom(realIP, p.Dst.Port()), p.Src),
 		Action: dh.snatAction(transitIP),
 	}
-	if err := dh.connectorFlowTable.NewFlowFromWireGuard(outgoing, incoming); err != nil {
-		dh.debugLogf("error installing flow, passing packet unmodified: %v", err)
-		return filter.Accept
-	}
+	dh.connectorFlowTable.NewFlow(FlowData{
+		FromTun: incoming,
+		FromWG:  outgoing,
+	})
 	outgoing.Action(p)
 	return filter.Accept
 }
@@ -166,25 +204,24 @@ func (dh *datapathHandler) HandlePacketFromWireGuard(p *packet.Parsed) filter.Re
 // that the packet should pass through subsequent stages of the datapath pipeline.
 // Returning [filter.Drop] signals the packet should be dropped. This method handles all
 // packets coming from the tun device, on both connectors, and clients of connectors.
-func (dh *datapathHandler) HandlePacketFromTunDevice(p *packet.Parsed) filter.Response {
-	// TODO(tailscale/corp#38764): Support other protocols, like ICMP for error messages.
-	if p.IPProto != ipproto.TCP && p.IPProto != ipproto.UDP {
+func (dh *datapathHandler) HandlePacketFromTunDevice(p *packet.Parsed, tun *tstun.Wrapper) filter.Response {
+	if !isSupportedProtocol(p.IPProto) {
 		return filter.Accept
 	}
 
 	// Check if this is an existing client outbound flow.
 	// If found, perform the action for the existing client flow and return.
-	existing, ok := dh.clientFlowTable.LookupFromTunDevice(flowtrack.MakeTuple(p.IPProto, p.Src, p.Dst))
+	action, ok := dh.clientFlowTable.LookupFromTunDevice(flowtrack.MakeTuple(p.IPProto, p.Src, p.Dst))
 	if ok {
-		existing.Action(p)
+		action(p)
 		return filter.Accept
 	}
 
 	// Check if this is an existing connector return flow.
 	// If found, perform the action for the existing connector return flow and return.
-	existing, ok = dh.connectorFlowTable.LookupFromTunDevice(flowtrack.MakeTuple(p.IPProto, p.Src, p.Dst))
+	action, ok = dh.connectorFlowTable.LookupFromTunDevice(flowtrack.MakeTuple(p.IPProto, p.Src, p.Dst))
 	if ok {
-		existing.Action(p)
+		action(p)
 		return filter.Accept
 	}
 
@@ -193,10 +230,12 @@ func (dh *datapathHandler) HandlePacketFromTunDevice(p *packet.Parsed) filter.Re
 	// or broken return app-connector traffic on a connector, which needs to be re-established
 	// with a new outbound packet.
 	magicIP := p.Dst.Addr()
-	transitIP, err := dh.ipMapper.ClientTransitIPForMagicIP(magicIP)
+	transitIP, err := dh.conn25.ClientTransitIPForMagicIP(magicIP)
 	if err != nil {
 		if errors.Is(err, ErrUnmappedMagicIP) {
-			// TODO(tailscale/corp#34257): This path should deliver an ICMP error to the client.
+			// Couldn't find a mapping. Tell the local application the host is
+			// unreachable so it can recover quickly instead of blackholing.
+			dh.sendICMPHostUnreachable(p, tun)
 			return filter.Drop
 		}
 		dh.debugLogf("error mapping magic IP, passing packet unmodified: %v", err)
@@ -211,22 +250,47 @@ func (dh *datapathHandler) HandlePacketFromTunDevice(p *packet.Parsed) filter.Re
 	// This is a new outbound client flow. Install a DNAT MagicIP-to-TransitIP action
 	// for the outgoing direction, and an SNAT TransitIP-to-MagicIP action for the
 	// return direction.
-	outgoing := FlowData{
+	outgoing := TupleAndAction{
 		Tuple:  flowtrack.MakeTuple(p.IPProto, p.Src, p.Dst),
 		Action: dh.dnatAction(transitIP),
 	}
-	incoming := FlowData{
+	incoming := TupleAndAction{
 		Tuple:  flowtrack.MakeTuple(p.IPProto, netip.AddrPortFrom(transitIP, p.Dst.Port()), p.Src),
 		Action: dh.snatAction(magicIP),
 	}
-	if err := dh.clientFlowTable.NewFlowFromTunDevice(outgoing, incoming); err != nil {
-		dh.debugLogf("error installing flow from tun device, passing packet unmodified: %v", err)
-		return filter.Accept
-	}
+
+	// Notify Conn25 that a flow for transitIP is being established before
+	// installing it in the flow table. This guarantees that ClientFlowCreated
+	// for this flow precedes any ClientFlowRemoved that fires for it.
+	dh.conn25.ClientFlowCreated(transitIP)
+
+	dh.clientFlowTable.NewFlow(FlowData{
+		FromTun: outgoing,
+		FromWG:  incoming,
+		OnRemove: func() {
+			dh.conn25.ClientFlowRemoved(transitIP)
+		},
+	})
 	outgoing.Action(p)
 	return filter.Accept
 }
 
+// sendICMPHostUnreachable injects an ICMP "host unreachable" error (or its IPv6
+// equivalent, "address unreachable") back to the local host in response to the
+// tun-device packet p. The error is delivered inbound so the local
+// application that sent p sees it, giving it the chance to recover.
+func (dh *datapathHandler) sendICMPHostUnreachable(p *packet.Parsed, tun *tstun.Wrapper) {
+	// The error appears to come from the unreachable Magic IP, addressed back to
+	// the sender, and embeds data from the invoking packet.
+	errPkt := packet.GenerateICMPHostUnreachable(p.Dst.Addr(), p.Src.Addr(), p)
+	if errPkt == nil {
+		return
+	}
+	if err := tun.InjectInboundCopy(errPkt); err != nil {
+		dh.debugLogf("error injecting ICMP host unreachable packet: %v", err)
+	}
+}
+
 func (dh *datapathHandler) dnatAction(to netip.Addr) PacketAction {
 	return PacketAction(func(p *packet.Parsed) { checksum.UpdateDstAddr(p, to) })
 }
diff --git a/feature/conn25/datapath_test.go b/feature/conn25/datapath_test.go
index f75b89d29..2505bb3da 100644
--- a/feature/conn25/datapath_test.go
+++ b/feature/conn25/datapath_test.go
@@ -4,13 +4,22 @@
 package conn25
 
 import (
+	"bytes"
 	"errors"
 	"net/netip"
 	"testing"
+	"time"
 
+	"github.com/tailscale/wireguard-go/tun/tuntest"
+	"go4.org/netipx"
 	"tailscale.com/net/packet"
+	"tailscale.com/net/tstun"
 	"tailscale.com/types/ipproto"
+	"tailscale.com/types/views"
+	"tailscale.com/util/eventbus/eventbustest"
+	"tailscale.com/util/usermetric"
 	"tailscale.com/wgengine/filter"
+	"tailscale.com/wgengine/filter/filtertype"
 )
 
 type testConn25 struct {
@@ -26,6 +35,9 @@ func (tc *testConn25) ConnectorRealIPForTransitIPConnection(srcIP netip.Addr, tr
 	return tc.connectorRealIPForTransitIPConnectionFn(srcIP, transitIP)
 }
 
+func (tc *testConn25) ClientFlowCreated(transitIP netip.Addr) {}
+func (tc *testConn25) ClientFlowRemoved(transitIP netip.Addr) {}
+
 func TestHandlePacketFromTunDevice(t *testing.T) {
 	clientSrcIP := netip.MustParseAddr("100.70.0.1")
 	magicIP := netip.MustParseAddr("10.64.0.1")
@@ -113,12 +125,14 @@ func TestHandlePacketFromTunDevice(t *testing.T) {
 				return netip.Addr{}, nil
 			}
 			dph := newDatapathHandler(mock, t.Logf)
+			tun := newFakeTUN(t)
+			defer tun.Close()
 
 			tt.p.IPProto = ipproto.UDP
 			tt.p.IPVersion = 4
 			tt.p.StuffForTesting(40)
 
-			if want, got := tt.expectedFilterResponse, dph.HandlePacketFromTunDevice(tt.p); want != got {
+			if want, got := tt.expectedFilterResponse, dph.HandlePacketFromTunDevice(tt.p, tun); want != got {
 				t.Errorf("unexpected filter response: want %v, got %v", want, got)
 			}
 			if want, got := tt.expectedSrc, tt.p.Src; want != got {
@@ -131,6 +145,162 @@ func TestHandlePacketFromTunDevice(t *testing.T) {
 	}
 }
 
+// TestUnmappedMagicIPICMPUnreachable verifies that a packet to a Magic IP with
+// no active Transit IP mapping is dropped and an ICMP host-unreachable error is
+// injected back toward the local host, sourced from the Magic IP and addressed
+// to the original sender.
+func TestUnmappedMagicIPICMPUnreachable(t *testing.T) {
+	const clientPort, serverPort = 1234, 80
+
+	tests := []struct {
+		name        string
+		clientSrcIP netip.Addr
+		magicIP     netip.Addr
+		wantProto   ipproto.Proto
+	}{
+		{
+			name:        "ipv4",
+			clientSrcIP: netip.MustParseAddr("100.70.0.1"),
+			magicIP:     netip.MustParseAddr("10.64.0.2"),
+			wantProto:   ipproto.ICMPv4,
+		},
+		{
+			name:        "ipv6",
+			clientSrcIP: netip.MustParseAddr("fd7a:115c:a1e0::1"),
+			magicIP:     netip.MustParseAddr("fd7a:115c:a1e0::2"),
+			wantProto:   ipproto.ICMPv6,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			mock := &testConn25{}
+			mock.clientTransitIPForMagicIPFn = func(netip.Addr) (netip.Addr, error) {
+				return netip.Addr{}, ErrUnmappedMagicIP
+			}
+			dph := newDatapathHandler(mock, t.Logf)
+			chtun, tun := newChannelTUN(t)
+			defer tun.Close()
+
+			var raw []byte
+			if tt.magicIP.Is6() {
+				raw = packet.Generate(packet.UDP6Header{
+					IP6Header: packet.IP6Header{Src: tt.clientSrcIP, Dst: tt.magicIP},
+					SrcPort:   clientPort,
+					DstPort:   serverPort,
+				}, []byte("hello"))
+			} else {
+				raw = packet.Generate(packet.UDP4Header{
+					IP4Header: packet.IP4Header{Src: tt.clientSrcIP, Dst: tt.magicIP},
+					SrcPort:   clientPort,
+					DstPort:   serverPort,
+				}, []byte("x"))
+			}
+			var p packet.Parsed
+			p.Decode(raw)
+
+			// HandlePacketFromTunDevice blocks until the injected packet is
+			// read, so drain the channel TUN concurrently.
+			gotInboundPacketChan := make(chan []byte, 1)
+			go func() { gotInboundPacketChan <- <-chtun.Inbound }()
+
+			if got, want := dph.HandlePacketFromTunDevice(&p, tun), filter.Drop; got != want {
+				t.Fatalf("unexpected filter response: got %v, want %v", got, want)
+			}
+
+			var injected packet.Parsed
+			select {
+			case b := <-gotInboundPacketChan:
+				injected.Decode(b)
+			case <-time.After(1 * time.Second):
+				t.Fatal("timed out waiting for injected ICMP packet")
+			}
+
+			if !injected.IsError() {
+				t.Errorf("injected packet is not an ICMP error")
+			}
+			if got := injected.IPProto; got != tt.wantProto {
+				t.Errorf("injected packet proto: got %v, want %v", got, tt.wantProto)
+			}
+			// The error should appear to come from the unreachable Magic IP,
+			// addressed back to the original sender.
+			if got, want := injected.Src.Addr(), tt.magicIP; got != want {
+				t.Errorf("injected packet src: got %v, want %v", got, want)
+			}
+			if got, want := injected.Dst.Addr(), tt.clientSrcIP; got != want {
+				t.Errorf("injected packet dst: got %v, want %v", got, want)
+			}
+		})
+	}
+}
+
+func newFakeTUN(t *testing.T) *tstun.Wrapper {
+	t.Helper()
+
+	// Create a TUN device and wrap it.
+	fake := tstun.NewFake()
+	reg := new(usermetric.Registry)
+	bus := eventbustest.NewBus(t)
+	tun := tstun.Wrap(t.Logf, fake, reg, bus)
+
+	// Create a packet filter. We're not testing the filter, so just make
+	// one that allows everything through.
+	protos := views.SliceOf([]ipproto.Proto{
+		ipproto.TCP,
+		ipproto.UDP,
+	})
+	allIPs := netip.MustParsePrefix("0.0.0.0/0")
+	matches := []filter.Match{
+		{
+			IPProto: protos,
+			Srcs:    []netip.Prefix{allIPs},
+			Dsts:    []filtertype.NetPortRange{{Net: allIPs, Ports: filtertype.AllPorts}},
+		},
+	}
+	var sb netipx.IPSetBuilder
+	sb.AddPrefix(allIPs)
+	ipSet, _ := sb.IPSet()
+	tun.SetFilter(filter.New(matches, nil, ipSet, ipSet, nil, t.Logf))
+
+	// Start the TUN device.
+	tun.Start()
+	return tun
+}
+
+// newChannelTUN is like newFakeTUN, but backed by a channel-based TUN device
+// whose Inbound queue captures packets injected toward the local host (e.g. via
+// InjectInboundCopy), so tests can observe them.
+func newChannelTUN(t *testing.T) (*tuntest.ChannelTUN, *tstun.Wrapper) {
+	t.Helper()
+
+	chtun := tuntest.NewChannelTUN()
+	reg := new(usermetric.Registry)
+	bus := eventbustest.NewBus(t)
+	tun := tstun.Wrap(t.Logf, chtun.TUN(), reg, bus)
+
+	protos := views.SliceOf([]ipproto.Proto{
+		ipproto.TCP,
+		ipproto.UDP,
+		ipproto.ICMPv4,
+		ipproto.ICMPv6,
+	})
+	allIPs := netip.MustParsePrefix("0.0.0.0/0")
+	matches := []filter.Match{
+		{
+			IPProto: protos,
+			Srcs:    []netip.Prefix{allIPs},
+			Dsts:    []filtertype.NetPortRange{{Net: allIPs, Ports: filtertype.AllPorts}},
+		},
+	}
+	var sb netipx.IPSetBuilder
+	sb.AddPrefix(allIPs)
+	ipSet, _ := sb.IPSet()
+	tun.SetFilter(filter.New(matches, nil, ipSet, ipSet, nil, t.Logf))
+
+	tun.Start()
+	return chtun, tun
+}
+
 func TestHandlePacketFromWireGuard(t *testing.T) {
 	clientSrcIP := netip.MustParseAddr("100.70.0.1")
 	unknownSrcIP := netip.MustParseAddr("100.99.99.99")
@@ -147,6 +317,7 @@ func TestHandlePacketFromWireGuard(t *testing.T) {
 		expectedSrc            netip.AddrPort
 		expectedDst            netip.AddrPort
 		expectedFilterResponse filter.Response
+		expectedInjectedPkt    []byte
 	}{
 		{
 			description: "accept-and-nat-new-connector-flow-mapped-src-and-transit-ip",
@@ -167,6 +338,14 @@ func TestHandlePacketFromWireGuard(t *testing.T) {
 			expectedSrc:            netip.AddrPortFrom(unknownSrcIP, clientPort),
 			expectedDst:            netip.AddrPortFrom(transitIP, serverPort),
 			expectedFilterResponse: filter.Drop,
+			expectedInjectedPkt: packet.Generate(packet.TailscaleRejectedHeader{
+				IPSrc:  transitIP,
+				IPDst:  unknownSrcIP,
+				Proto:  ipproto.UDP,
+				Src:    netip.AddrPortFrom(unknownSrcIP, clientPort),
+				Dst:    netip.AddrPortFrom(transitIP, serverPort),
+				Reason: packet.RejectedDueToUnknownAppConnectorTransitIP,
+			}, nil),
 		},
 		{
 			description: "accept-dont-nat-other-mapping-error",
@@ -218,12 +397,14 @@ func TestHandlePacketFromWireGuard(t *testing.T) {
 				return netip.Addr{}, nil
 			}
 			dph := newDatapathHandler(mock, t.Logf)
+			tun := newFakeTUN(t)
+			defer tun.Close()
 
 			tt.p.IPProto = ipproto.UDP
 			tt.p.IPVersion = 4
 			tt.p.StuffForTesting(40)
 
-			if want, got := tt.expectedFilterResponse, dph.HandlePacketFromWireGuard(tt.p); want != got {
+			if want, got := tt.expectedFilterResponse, dph.HandlePacketFromWireGuard(tt.p, tun); want != got {
 				t.Errorf("unexpected filter response: want %v, got %v", want, got)
 			}
 			if want, got := tt.expectedSrc, tt.p.Src; want != got {
@@ -232,6 +413,22 @@ func TestHandlePacketFromWireGuard(t *testing.T) {
 			if want, got := tt.expectedDst, tt.p.Dst; want != got {
 				t.Errorf("unexpected packet dst: want %v, got %v", want, got)
 			}
+			if tt.expectedInjectedPkt != nil {
+				var buf [tstun.MaxPacketSize]byte
+				bufs := [][]byte{buf[:]}
+				sizes := []int{0}
+				n, err := tun.Read(bufs, sizes, 0)
+				if err != nil {
+					t.Errorf("error reading injected packet: %v", err)
+				}
+				if n != 1 {
+					t.Errorf("expected to read 1 packet, got %d", n)
+				}
+				if want, got := tt.expectedInjectedPkt, buf[:sizes[0]]; !bytes.Equal(want, got) {
+					t.Errorf("unexpected contents of injected packet: want %+x, got %+x", want, got)
+
+				}
+			}
 		})
 	}
 }
@@ -255,6 +452,8 @@ func TestClientFlowCache(t *testing.T) {
 		return transitIP, nil
 	}
 	dph := newDatapathHandler(mock, t.Logf)
+	tun := newFakeTUN(t)
+	defer tun.Close()
 
 	outgoing := packet.Parsed{
 		IPProto:   ipproto.UDP,
@@ -265,7 +464,7 @@ func TestClientFlowCache(t *testing.T) {
 	outgoing.StuffForTesting(40)
 
 	o1 := outgoing
-	if dph.HandlePacketFromTunDevice(&o1) != filter.Accept {
+	if dph.HandlePacketFromTunDevice(&o1, tun) != filter.Accept {
 		t.Errorf("first call to HandlePacketFromTunDevice was not accepted")
 	}
 	if want, got := netip.AddrPortFrom(transitIP, serverPort), o1.Dst; want != got {
@@ -273,7 +472,7 @@ func TestClientFlowCache(t *testing.T) {
 	}
 	// The second call should use the cache.
 	o2 := outgoing
-	if dph.HandlePacketFromTunDevice(&o2) != filter.Accept {
+	if dph.HandlePacketFromTunDevice(&o2, tun) != filter.Accept {
 		t.Errorf("second call to HandlePacketFromTunDevice was not accepted")
 	}
 	if want, got := netip.AddrPortFrom(transitIP, serverPort), o2.Dst; want != got {
@@ -290,7 +489,7 @@ func TestClientFlowCache(t *testing.T) {
 	}
 	incoming.StuffForTesting(40)
 
-	if dph.HandlePacketFromWireGuard(incoming) != filter.Accept {
+	if dph.HandlePacketFromWireGuard(incoming, tun) != filter.Accept {
 		t.Errorf("call to HandlePacketFromWireGuard was not accepted")
 	}
 	if want, got := netip.AddrPortFrom(magicIP, serverPort), incoming.Src; want != got {
@@ -326,8 +525,11 @@ func TestConnectorFlowCache(t *testing.T) {
 	}
 	outgoing.StuffForTesting(40)
 
+	tun := newFakeTUN(t)
+	defer tun.Close()
+
 	o1 := outgoing
-	if dph.HandlePacketFromWireGuard(&o1) != filter.Accept {
+	if dph.HandlePacketFromWireGuard(&o1, tun) != filter.Accept {
 		t.Errorf("first call to HandlePacketFromWireGuard was not accepted")
 	}
 	if want, got := netip.AddrPortFrom(realIP, serverPort), o1.Dst; want != got {
@@ -335,7 +537,7 @@ func TestConnectorFlowCache(t *testing.T) {
 	}
 	// The second call should use the cache.
 	o2 := outgoing
-	if dph.HandlePacketFromWireGuard(&o2) != filter.Accept {
+	if dph.HandlePacketFromWireGuard(&o2, tun) != filter.Accept {
 		t.Errorf("second call to HandlePacketFromWireGuard was not accepted")
 	}
 	if want, got := netip.AddrPortFrom(realIP, serverPort), o2.Dst; want != got {
@@ -352,7 +554,7 @@ func TestConnectorFlowCache(t *testing.T) {
 	}
 	incoming.StuffForTesting(40)
 
-	if dph.HandlePacketFromTunDevice(incoming) != filter.Accept {
+	if dph.HandlePacketFromTunDevice(incoming, tun) != filter.Accept {
 		t.Errorf("call to HandlePacketFromTunDevice was not accepted")
 	}
 	if want, got := netip.AddrPortFrom(transitIP, serverPort), incoming.Src; want != got {
diff --git a/feature/conn25/flowtable.go b/feature/conn25/flowtable.go
index 27486ded9..5cd883151 100644
--- a/feature/conn25/flowtable.go
+++ b/feature/conn25/flowtable.go
@@ -4,22 +4,42 @@
 package conn25
 
 import (
-	"errors"
+	"container/list"
+	"context"
 	"sync"
+	"time"
 
 	"tailscale.com/net/flowtrack"
 	"tailscale.com/net/packet"
+	"tailscale.com/tstime/mono"
 )
 
 // PacketAction may modify the packet.
 type PacketAction func(*packet.Parsed)
 
-// FlowData is an entry stored in the [FlowTable].
-type FlowData struct {
+// TupleAndAction wraps the [flowtrack.Tuple] and
+// the [PacketAction] to return on lookups to that
+// tuple.
+type TupleAndAction struct {
 	Tuple  flowtrack.Tuple
 	Action PacketAction
 }
 
+// FlowData is an entry stored in the [FlowTable]
+// constructed by the consumer of the table.
+// It specifies tuples and actions for each direction
+// of the flow.
+type FlowData struct {
+	FromTun TupleAndAction
+	FromWG  TupleAndAction
+
+	// OnRemove, if non-nil, is invoked when the flow is removed from the
+	// table for any reason (idle expiration, tuple-collision displacement
+	// in [FlowTable.NewFlow], or capacity eviction). It is called once,
+	// outside the table's mutex, so it may safely acquire other locks.
+	OnRemove func()
+}
+
 // Origin is used to track the direction of a flow.
 type Origin uint8
 
@@ -31,119 +51,253 @@ const (
 	FromWireGuard
 )
 
+// cachedFlow is the main unit of storage in the table.
+// It wraps the [FlowData] passed in by the consumer, as well
+// as internal metadata and callbacks.
 type cachedFlow struct {
-	flow   FlowData
-	paired flowtrack.Tuple // tuple for the other direction
+	data FlowData // user-defined tuples and actions for both directions
+
+	lastSeen mono.Time // tracks when the flow was last hit for expiration management
 }
 
 // FlowTable stores and retrieves [FlowData] that can be looked up
-// by 5-tuple. New entries specify the tuple to use for both directions
+// by 5-tuple [flowtrack.Tuple] and direction.
+// New entries specify the tuple to use for both directions
 // of traffic flow. The underlying cache is LRU, and the maximum number
 // of entries is specified in calls to [NewFlowTable]. FlowTable has
 // its own mutex and is safe for concurrent use.
 type FlowTable struct {
+	maxEntries         int
+	idleTimeout        time.Duration
+	sweepInterval      time.Duration
+	maxRemovedPerSweep int
+
 	mu           sync.Mutex
-	fromTunCache *flowtrack.Cache[cachedFlow] // guarded by mu
-	fromWGCache  *flowtrack.Cache[cachedFlow] // guarded by mu
+	fromTunCache map[flowtrack.Tuple]*list.Element
+	fromWGCache  map[flowtrack.Tuple]*list.Element
+	lru          *list.List
 }
 
-// NewFlowTable returns a [FlowTable] maxEntries maximum entries.
-// A maxEntries of 0 indicates no maximum. See also [FlowTable].
-func NewFlowTable(maxEntries int) *FlowTable {
-	return &FlowTable{
-		fromTunCache: &flowtrack.Cache[cachedFlow]{
-			MaxEntries: maxEntries,
-		},
-		fromWGCache: &flowtrack.Cache[cachedFlow]{
-			MaxEntries: maxEntries,
-		},
+const (
+	// DefaultFlowIdleTimeout is the default idle timeout for a flow.
+	// See also [WithFlowIdleTimeout].
+	DefaultFlowIdleTimeout = 5 * time.Minute
+	// DefaultFlowSweepInterval is the default sweep interval for
+	// automatically removing expired flows. See also [WithFlowSweepInterval].
+	DefaultFlowSweepInterval = 3 * time.Minute
+	// DefaultMaxRemovedFlowsPerSweep is the default maximum number of
+	// flows removed per sweep. It can be used to tune how long the table
+	// mutex is held during sweeps. See also [WithMaxRemovedFlowsPerSweep].
+	DefaultMaxRemovedFlowsPerSweep = 1000
+)
+
+// FlowTableOption configures options for use with [NewFlowTable].
+type FlowTableOption func(ft *FlowTable)
+
+// WithFlowIdleTimeout sets the threshold duration for flow idle time
+// before it is eligible for removal. A flow is considered idle for the
+// time that elapses since its creation or last lookup. A duration of
+// 0 means that expiration is disabled. If WithFlowIdleTimeout is not
+// passed to [NewFlowTable], then [DefaultFlowIdleTimeout] is used.
+func WithFlowIdleTimeout(timeout time.Duration) FlowTableOption {
+	return func(ft *FlowTable) {
+		ft.idleTimeout = timeout
 	}
 }
 
-// LookupFromTunDevice looks up a [FlowData] entry that is valid to run for packets
+// WithFlowSweepInterval sets the interval to automatically
+// remove idle flows that exceed the idle timeout. A value of 0
+// disables automatic sweeping. If WithFlowSweepInterval is not
+// passed to [NewFlowTable], then [DefaultFlowSweepInterval] is used.
+func WithFlowSweepInterval(ival time.Duration) FlowTableOption {
+	return func(ft *FlowTable) {
+		ft.sweepInterval = ival
+	}
+}
+
+// WithMaxRemovedFlowsPerSweep sets maximum number of expired
+// flows that can be removed per sweep. A value of 0 means no
+// maximum. If WithMaxRemovedFlowsPerSweep is not passed to
+// [NewFlowTable], then [DefaultMaxRemovedFlowsPerSweep] is used.
+func WithMaxRemovedFlowsPerSweep(maxPer int) FlowTableOption {
+	return func(ft *FlowTable) {
+		ft.maxRemovedPerSweep = maxPer
+	}
+}
+
+// NewFlowTable returns a [FlowTable] with maxEntries maximum entries.
+// A maxEntries of 0 indicates no maximum. See also [FlowTable].
+func NewFlowTable(maxEntries int, opts ...FlowTableOption) *FlowTable {
+	ft := &FlowTable{
+		maxEntries:         maxEntries,
+		idleTimeout:        DefaultFlowIdleTimeout,
+		sweepInterval:      DefaultFlowSweepInterval,
+		maxRemovedPerSweep: DefaultMaxRemovedFlowsPerSweep,
+		fromTunCache:       make(map[flowtrack.Tuple]*list.Element, maxEntries),
+		fromWGCache:        make(map[flowtrack.Tuple]*list.Element, maxEntries),
+		lru:                list.New(),
+	}
+
+	for _, o := range opts {
+		o(ft)
+	}
+	return ft
+}
+
+// LookupFromTunDevice looks up a [PacketAction] that is valid to run on packets
 // observed as coming from the tun device. The tuple must match the direction it was
 // stored with.
-func (t *FlowTable) LookupFromTunDevice(k flowtrack.Tuple) (FlowData, bool) {
+func (t *FlowTable) LookupFromTunDevice(k flowtrack.Tuple) (PacketAction, bool) {
 	return t.lookup(k, FromTun)
 }
 
-// LookupFromWireGuard looks up a [FlowData] entry that is valid to run for packets
+// LookupFromWireGuard looks up a [PacketAction] that is valid to run for packets
 // observed as coming from the WireGuard tunnel. The tuple must match the direction it was
 // stored with.
-func (t *FlowTable) LookupFromWireGuard(k flowtrack.Tuple) (FlowData, bool) {
+func (t *FlowTable) LookupFromWireGuard(k flowtrack.Tuple) (PacketAction, bool) {
 	return t.lookup(k, FromWireGuard)
 }
 
-func (t *FlowTable) lookup(k flowtrack.Tuple, want Origin) (FlowData, bool) {
-	var cache *flowtrack.Cache[cachedFlow]
-	switch want {
+func (t *FlowTable) lookup(k flowtrack.Tuple, dir Origin) (PacketAction, bool) {
+	var cache map[flowtrack.Tuple]*list.Element
+	switch dir {
 	case FromTun:
 		cache = t.fromTunCache
 	case FromWireGuard:
 		cache = t.fromWGCache
 	default:
-		return FlowData{}, false
+		return nil, false
 	}
 
 	t.mu.Lock()
 	defer t.mu.Unlock()
 
-	v, ok := cache.Get(k)
+	ele, ok := cache[k]
 	if !ok {
-		return FlowData{}, false
-	}
-	return v.flow, true
-}
-
-// NewFlowFromTunDevice installs (or overwrites) both the forward and return entries.
-// The forward tuple is tagged as FromTun, and the return tuple is tagged as FromWireGuard.
-// If overwriting, it removes the old paired tuple for the forward key to avoid stale reverse mappings.
-func (t *FlowTable) NewFlowFromTunDevice(fwd, rev FlowData) error {
-	return t.newFlow(FromTun, fwd, rev)
-}
-
-// NewFlowFromWireGuard installs (or overwrites) both the forward and return entries.
-// The forward tuple is tagged as FromWireGuard, and the return tuple is tagged as FromTun.
-// If overwriting, it removes the old paired tuple for the forward key to avoid stale reverse mappings.
-func (t *FlowTable) NewFlowFromWireGuard(fwd, rev FlowData) error {
-	return t.newFlow(FromWireGuard, fwd, rev)
-}
-
-func (t *FlowTable) newFlow(fwdOrigin Origin, fwd, rev FlowData) error {
-	if fwd.Action == nil || rev.Action == nil {
-		return errors.New("nil action received for flow")
+		return nil, false
 	}
 
-	var fwdCache, revCache *flowtrack.Cache[cachedFlow]
-	switch fwdOrigin {
+	flow := ele.Value.(*cachedFlow)
+
+	var action PacketAction
+	switch dir {
 	case FromTun:
-		fwdCache, revCache = t.fromTunCache, t.fromWGCache
+		action = flow.data.FromTun.Action
 	case FromWireGuard:
-		fwdCache, revCache = t.fromWGCache, t.fromTunCache
-	default:
-		return errors.New("newFlow called with unknown direction")
+		action = flow.data.FromWG.Action
 	}
 
+	// Support LRU.
+	t.lru.MoveToFront(ele)
+
+	flow.lastSeen = mono.Now()
+
+	return action, true
+}
+
+// NewFlow installs data as an flow in the table, and evicts any flow that
+// either tuple already points at. This can result in two flows being evicted
+// if each of the new tuples point at distinct existing flows. If the new flow
+// would cause the table to exceed its maximum size, the least recently used
+// (looked-up or created) flow is evicted. data is not validated, the caller must
+// supply non-nil packet actions.
+//
+// Any [FlowData.OnRemove] callbacks belonging to displaced or evicted flows are
+// invoked after the table's mutex is released, before NewFlow returns.
+func (t *FlowTable) NewFlow(data FlowData) {
+	var onRemoves []func()
+
 	t.mu.Lock()
-	defer t.mu.Unlock()
+	// If either tuple leads to anything existing, remove it.
+	onRemoves = append(onRemoves, t.removeFlowLocked(t.fromTunCache[data.FromTun.Tuple]))
+	onRemoves = append(onRemoves, t.removeFlowLocked(t.fromWGCache[data.FromWG.Tuple]))
 
-	// If overwriting an existing entry, remove its previously-paired mapping so
-	// we don't leave stale tuples around.
-	if old, ok := fwdCache.Get(fwd.Tuple); ok {
-		revCache.Remove(old.paired)
-	}
-	if old, ok := revCache.Get(rev.Tuple); ok {
-		fwdCache.Remove(old.paired)
+	flow := &cachedFlow{
+		data:     data,
+		lastSeen: mono.Now(),
 	}
 
-	fwdCache.Add(fwd.Tuple, cachedFlow{
-		flow:   fwd,
-		paired: rev.Tuple,
-	})
-	revCache.Add(rev.Tuple, cachedFlow{
-		flow:   rev,
-		paired: fwd.Tuple,
-	})
+	ele := t.lru.PushFront(flow)
+	if t.maxEntries > 0 && t.lru.Len() > t.maxEntries {
+		onRemoves = append(onRemoves, t.removeFlowLocked(t.lru.Back()))
+	}
 
-	return nil
+	t.fromTunCache[data.FromTun.Tuple] = ele
+	t.fromWGCache[data.FromWG.Tuple] = ele
+	t.mu.Unlock()
+
+	for _, onRemove := range onRemoves {
+		if onRemove != nil {
+			onRemove()
+		}
+	}
+}
+
+// StartExpiredSweeper starts a sweeper that removes idle flows that have
+// not been created or looked up for a duration greater than the configured
+// idle timeout. See [WithFlowIdleTimeout]. The sweep runs at the configured
+// sweep interval. See [WithFlowSweepInterval]. The sweeper stops when ctx
+// is canceled.
+func (t *FlowTable) StartExpiredSweeper(ctx context.Context) {
+	if t.sweepInterval == 0 || t.idleTimeout == 0 {
+		return
+	}
+
+	ticker := time.NewTicker(t.sweepInterval)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			t.removeIdle(mono.Now())
+		}
+	}
+}
+
+func (t *FlowTable) removeIdle(now mono.Time) int {
+	if t.idleTimeout == 0 {
+		return 0
+	}
+
+	var onRemoves []func()
+	t.mu.Lock()
+
+	removed := 0
+	for ele := t.lru.Back(); ele != nil; ele = t.lru.Back() {
+		if t.maxRemovedPerSweep > 0 && removed >= t.maxRemovedPerSweep {
+			break
+		}
+		flow := ele.Value.(*cachedFlow)
+		if now.Sub(flow.lastSeen) <= t.idleTimeout {
+			break
+		}
+		onRemoves = append(onRemoves, t.removeFlowLocked(ele))
+		removed++
+	}
+	t.mu.Unlock()
+
+	for _, onRemove := range onRemoves {
+		if onRemove != nil {
+			onRemove()
+		}
+	}
+
+	return removed
+}
+
+// removeFlowLocked detaches the flow at ele from t, and returns the flow's
+// [FlowData.OnRemove] callback, which may be nil. The caller must hold the
+// mutex while calling removeFlowLocked, and release it before invoking the
+// callback.
+func (t *FlowTable) removeFlowLocked(ele *list.Element) func() {
+	if ele == nil {
+		return nil
+	}
+
+	flow := t.lru.Remove(ele).(*cachedFlow)
+	delete(t.fromTunCache, flow.data.FromTun.Tuple)
+	delete(t.fromWGCache, flow.data.FromWG.Tuple)
+
+	return flow.data.OnRemove
 }
diff --git a/feature/conn25/flowtable_test.go b/feature/conn25/flowtable_test.go
index 8c3cd63a2..7fbfc074f 100644
--- a/feature/conn25/flowtable_test.go
+++ b/feature/conn25/flowtable_test.go
@@ -4,122 +4,514 @@
 package conn25
 
 import (
+	"fmt"
+	"maps"
 	"net/netip"
 	"testing"
+	"testing/synctest"
+	"time"
 
 	"tailscale.com/net/flowtrack"
 	"tailscale.com/net/packet"
+	"tailscale.com/tstime/mono"
 	"tailscale.com/types/ipproto"
 )
 
-func TestFlowTable(t *testing.T) {
-	ft := NewFlowTable(0)
+var nilPacket *packet.Parsed // nil packet to perform actions against
 
-	fwdTuple := flowtrack.MakeTuple(
+// mkTuple wraps flowtrack.MakeTuple with the UDP proto.
+func mkTuple(src, dst string) flowtrack.Tuple {
+	return flowtrack.MakeTuple(
 		ipproto.UDP,
-		netip.MustParseAddrPort("1.2.3.4:1000"),
-		netip.MustParseAddrPort("4.3.2.1:80"),
-	)
-	// Reverse tuple is defined by caller. Doesn't have to be mirror image of fwd.
-	// To account for intentional modifications, like NAT.
-	revTuple := flowtrack.MakeTuple(
-		ipproto.UDP,
-		netip.MustParseAddrPort("4.3.2.2:80"),
-		netip.MustParseAddrPort("1.2.3.4:1000"),
+		netip.MustParseAddrPort(src),
+		netip.MustParseAddrPort(dst),
 	)
+}
 
-	fwdAction, revAction := 0, 0
-	fwdData := FlowData{
-		Tuple:  fwdTuple,
-		Action: func(_ *packet.Parsed) { fwdAction++ },
-	}
-	revData := FlowData{
-		Tuple:  revTuple,
-		Action: func(_ *packet.Parsed) { revAction++ },
-	}
+func mkFlowWithActions(fromTun, fromWG flowtrack.Tuple) (FlowData, *int, *int) {
+	var tunCalls, wgCalls int
+	fd := mkFlow(fromTun, fromWG)
+	fd.FromTun.Action = func(_ *packet.Parsed) { tunCalls++ }
+	fd.FromWG.Action = func(_ *packet.Parsed) { wgCalls++ }
+	return fd, &tunCalls, &wgCalls
+}
 
-	// For this test setup, from the tun device will be "forward",
-	// and from WG will be "reverse".
-	if err := ft.NewFlowFromTunDevice(fwdData, revData); err != nil {
-		t.Fatalf("got non-nil error for new flow from tun device")
-	}
-
-	// Test basic lookups.
-	lookupFwd, ok := ft.LookupFromTunDevice(fwdTuple)
-	if !ok {
-		t.Fatalf("got not found on first lookup from tun device")
-	}
-	lookupFwd.Action(nil)
-	if fwdAction != 1 {
-		t.Errorf("action for fwd tuple key was not executed")
-	}
-
-	lookupRev, ok := ft.LookupFromWireGuard(revTuple)
-	if !ok {
-		t.Fatalf("got not found on first lookup from WireGuard")
-	}
-	lookupRev.Action(nil)
-	if revAction != 1 {
-		t.Errorf("action for rev tuple key was not executed")
-	}
-
-	// Test not found error.
-	notFoundTuple := flowtrack.MakeTuple(
-		ipproto.UDP,
-		netip.MustParseAddrPort("1.2.3.4:1000"),
-		netip.MustParseAddrPort("4.0.4.4:80"),
-	)
-	if _, ok := ft.LookupFromTunDevice(notFoundTuple); ok {
-		t.Errorf("expected not found for foreign tuple")
-	}
-
-	// Wrong direction is also not found.
-	if _, ok := ft.LookupFromWireGuard(fwdTuple); ok {
-		t.Errorf("expected not found for wrong direction tuple")
-	}
-
-	// Overwriting forward tuple removes its reverse pair as well.
-	newRevData := FlowData{
-		Tuple: flowtrack.MakeTuple(
-			ipproto.UDP,
-			netip.MustParseAddrPort("9.9.9.9:99"),
-			netip.MustParseAddrPort("8.8.8.8:88"),
-		),
-		Action: func(_ *packet.Parsed) {},
-	}
-	if err := ft.NewFlowFromTunDevice(
-		fwdData,
-		newRevData,
-	); err != nil {
-		t.Fatalf("got non-nil error for new flow from tun device")
-	}
-	if _, ok := ft.LookupFromWireGuard(revTuple); ok {
-		t.Errorf("expected not found for removed reverse tuple")
-	}
-
-	// Overwriting reverse tuple removes its forward pair as well.
-	if err := ft.NewFlowFromTunDevice(
-		FlowData{
-			Tuple: flowtrack.MakeTuple(
-				ipproto.UDP,
-				netip.MustParseAddrPort("8.8.8.8:88"),
-				netip.MustParseAddrPort("9.9.9.9:99"),
-			),
+func mkFlow(fromTun, fromWG flowtrack.Tuple) FlowData {
+	return FlowData{
+		FromTun: TupleAndAction{
+			Tuple:  fromTun,
+			Action: func(_ *packet.Parsed) {},
+		},
+		FromWG: TupleAndAction{
+			Tuple:  fromWG,
 			Action: func(_ *packet.Parsed) {},
 		},
-		newRevData, // This is the same "reverse" data installed in previous test.
-	); err != nil {
-		t.Fatalf("got non-nil error for new flow from tun device")
-	}
-	if _, ok := ft.LookupFromTunDevice(fwdTuple); ok {
-		t.Errorf("expected not found for removed forward tuple")
-	}
-
-	// Nil action returns an error.
-	if err := ft.NewFlowFromTunDevice(
-		FlowData{},
-		FlowData{},
-	); err == nil {
-		t.Errorf("expected non-nil error for nil data")
 	}
 }
+
+func mkFlows(n int) []FlowData {
+	flows := make([]FlowData, n)
+	for i := range n {
+		flows[i] = mkFlow(
+			mkTuple(fmt.Sprintf("1.0.%d.%d:1000", (i>>8)&0xff, i&0xff), "2.0.0.1:80"),
+			mkTuple(fmt.Sprintf("3.0.%d.%d:1000", (i>>8)&0xff, i&0xff), "4.0.0.1:80"),
+		)
+	}
+	return flows
+}
+
+func assertFlowHit(t *testing.T, ft *FlowTable, dir Origin, tuple flowtrack.Tuple) PacketAction {
+	t.Helper()
+	return assertFlowLookup(t, ft, dir, tuple, true)
+}
+
+func assertFlowMiss(t *testing.T, ft *FlowTable, dir Origin, tuple flowtrack.Tuple) {
+	t.Helper()
+	assertFlowLookup(t, ft, dir, tuple, false)
+}
+
+func assertFlowLookup(t *testing.T, ft *FlowTable, dir Origin, tuple flowtrack.Tuple, wantHit bool) PacketAction {
+	t.Helper()
+	var action PacketAction
+	var ok bool
+
+	switch dir {
+	case FromTun:
+		action, ok = ft.LookupFromTunDevice(tuple)
+	case FromWireGuard:
+		action, ok = ft.LookupFromWireGuard(tuple)
+	default:
+		t.Fatalf("invalid direction: %v", dir)
+	}
+
+	if wantHit && !ok {
+		t.Fatalf("expected flow hit for tuple: %v, dir: %v", tuple, dir)
+	}
+	if !wantHit && ok {
+		t.Fatalf("expected flow miss for tuple: %v, dir: %v", tuple, dir)
+	}
+
+	if wantHit {
+		return action
+	}
+	return nil
+}
+
+func TestFlowTable_NewFlow_Lookup(t *testing.T) {
+	ft := NewFlowTable(0)
+
+	// The tuples in both directions are defined by the caller.
+	// The don't have to be mirror images of each other,
+	// to account for intentional modifications, like NAT.
+	fromTunTuple := mkTuple("1.2.3.4:1000", "4.3.2.1:80")
+	fromWGTuple := mkTuple("4.3.2.2:80", "1.2.3.4:1000")
+
+	flow1, tunCount1, wgCount1 := mkFlowWithActions(fromTunTuple, fromWGTuple)
+	ft.NewFlow(flow1)
+
+	// Test basic lookups, and perform actions on packet.
+	assertFlowHit(t, ft, FromTun, fromTunTuple)(nilPacket)
+	assertFlowHit(t, ft, FromWireGuard, fromWGTuple)(nilPacket)
+
+	if *tunCount1 != 1 {
+		t.Fatal("action for from-tun tuple key was not executed")
+	}
+	if *wgCount1 != 1 {
+		t.Fatal("action for from-wg tuple key was not executed")
+	}
+
+	// Test tuple not found.
+	notFoundTuple := mkTuple("1.2.3.4:1000", "4.0.4.4:80")
+	assertFlowMiss(t, ft, FromTun, notFoundTuple)
+
+	// Wrong direction is also not found.
+	assertFlowMiss(t, ft, FromWireGuard, fromTunTuple)
+
+	// Overwriting from-tun tuple removes the from-wg tuple as well.
+	newFromWGTuple := mkTuple("9.9.9.9:99", "8.8.8.8:88")
+	flow2 := mkFlow(fromTunTuple, newFromWGTuple)
+	ft.NewFlow(flow2)
+	assertFlowMiss(t, ft, FromWireGuard, fromWGTuple)
+
+	// Overwriting the from-wg tuple removes the from-tun tuple as well.
+	newFromTunTuple := mkTuple("8.8.8.8:88", "9.9.9.9:99")
+	flow3 := mkFlow(newFromTunTuple, newFromWGTuple)
+	ft.NewFlow(flow3)
+	assertFlowMiss(t, ft, FromTun, fromTunTuple)
+}
+
+// TestFlowTable_OneReplacesTwo targets a specific case
+// in which a single new flow replaces two existing flows
+// because each tuple of the new flow matches one tuple
+// of an existing flow.
+func TestFlowTable_OneReplacesTwo(t *testing.T) {
+	ft := NewFlowTable(0)
+
+	tunTuple1 := mkTuple("1.2.3.4:1000", "4.3.2.1:80")
+	wgTuple1 := mkTuple("4.3.2.2:80", "1.2.3.4:1000")
+	flow1, tunCount1, wgCount1 := mkFlowWithActions(tunTuple1, wgTuple1)
+
+	tunTuple2 := mkTuple("8.8.8.8:88", "9.9.9.9:99")
+	wgTuple2 := mkTuple("9.9.9.9:99", "8.8.8.8:88")
+	flow2, tunCount2, wgCount2 := mkFlowWithActions(tunTuple2, wgTuple2)
+
+	// Install the first two flows.
+	ft.NewFlow(flow1)
+	ft.NewFlow(flow2)
+
+	// Confirm they are properly installed through lookups.
+	assertFlowHit(t, ft, FromTun, tunTuple1)
+	assertFlowHit(t, ft, FromWireGuard, wgTuple1)
+	assertFlowHit(t, ft, FromTun, tunTuple2)
+	assertFlowHit(t, ft, FromWireGuard, wgTuple2)
+
+	// flow3 tuples overlap with flow1 and flow2.
+	flow3, tunCount3, wgCount3 := mkFlowWithActions(tunTuple1, wgTuple2)
+	ft.NewFlow(flow3)
+
+	// flow3 lookups hit on both of their tuples.
+	tunAction3 := assertFlowHit(t, ft, FromTun, tunTuple1)
+	wgAction3 := assertFlowHit(t, ft, FromWireGuard, wgTuple2)
+
+	// The non-overlapping tuples from flow1 and flow2 should now miss.
+	assertFlowMiss(t, ft, FromTun, tunTuple2)
+	assertFlowMiss(t, ft, FromWireGuard, wgTuple1)
+
+	// Perform both actions on a nil packet to bump counters.
+	tunAction3(nilPacket)
+	wgAction3(nilPacket)
+
+	// Only flow3 counters should have been bumped.
+	if *tunCount1 != 0 || *wgCount1 != 0 {
+		t.Fatalf("flow1 counters (tun, wg), want: (0,0), got: (%d,%d)", *tunCount1, *wgCount1)
+	}
+	if *tunCount2 != 0 || *wgCount2 != 0 {
+		t.Fatalf("flow2 counters (tun, wg), want: (0,0), got: (%d,%d)", *tunCount2, *wgCount2)
+	}
+	if *tunCount3 != 1 || *wgCount3 != 1 {
+		t.Fatalf("flow3 counters (tun, wg), want: (1,1), got: (%d,%d)", *tunCount3, *wgCount3)
+	}
+}
+
+func TestFlowTable_Eviction(t *testing.T) {
+	// Table only has two spots.
+	ft := NewFlowTable(2)
+	aTun, aWG := mkTuple("3.0.0.1:1000", "3.0.0.2:80"), mkTuple("3.0.0.2:80", "3.0.0.1:1000")
+	bTun, bWG := mkTuple("3.0.0.3:1000", "3.0.0.4:80"), mkTuple("3.0.0.4:80", "3.0.0.3:1000")
+	cTun, cWG := mkTuple("3.0.0.5:1000", "3.0.0.6:80"), mkTuple("3.0.0.6:80", "3.0.0.5:1000")
+	dTun, dWG := mkTuple("3.0.0.7:1000", "3.0.0.8:80"), mkTuple("3.0.0.8:80", "3.0.0.7:1000")
+
+	a := mkFlow(aTun, aWG)
+	b := mkFlow(bTun, bWG)
+	c := mkFlow(cTun, cWG)
+	d := mkFlow(dTun, dWG)
+
+	// Install a and b.
+	ft.NewFlow(a)
+	ft.NewFlow(b)
+
+	// Move a to the front from tun side, b is ready for eviction.
+	assertFlowHit(t, ft, FromTun, aTun)
+
+	// Install c.
+	ft.NewFlow(c)
+
+	// Check b is out.
+	assertFlowMiss(t, ft, FromTun, bTun)
+	assertFlowMiss(t, ft, FromWireGuard, bWG)
+
+	// Check c is in.
+	assertFlowHit(t, ft, FromTun, cTun)
+	assertFlowHit(t, ft, FromWireGuard, cWG)
+
+	// Move a to the front again, now from WG side.
+	assertFlowHit(t, ft, FromWireGuard, aWG)
+
+	// Install d.
+	ft.NewFlow(d)
+
+	// Check c is out.
+	assertFlowMiss(t, ft, FromTun, cTun)
+	assertFlowMiss(t, ft, FromWireGuard, cWG)
+
+	// Check d is in.
+	assertFlowHit(t, ft, FromTun, dTun)
+	assertFlowHit(t, ft, FromWireGuard, dWG)
+}
+
+func syncSubtest(t *testing.T, name string, f func(*testing.T)) {
+	t.Helper()
+	t.Run(name, func(t *testing.T) {
+		synctest.Test(t, f)
+	})
+}
+
+func TestFlowTable_removeIdle(t *testing.T) {
+	type flowSpec struct {
+		installAt   time.Duration // wall-clock time of install, from test start
+		wantRemoved bool          // do we expect this flow to be removed by the sweep
+	}
+
+	tests := []struct {
+		name               string
+		idleTimeout        time.Duration
+		maxRemovedPerSweep int
+		flowSpecs          []flowSpec
+		removalAt          time.Duration // wall-clock time of sweep, from test start
+	}{
+		{
+			name:        "one-expired-flow",
+			idleTimeout: 1 * time.Minute,
+			flowSpecs: []flowSpec{
+				{installAt: 0, wantRemoved: true}, // age at sweep = 120s
+			},
+			removalAt: 2 * time.Minute,
+		},
+		{
+			name:        "one-not-expired-flow",
+			idleTimeout: 1 * time.Minute,
+			flowSpecs: []flowSpec{
+				{installAt: 0, wantRemoved: false}, // age at sweep = 30s
+			},
+			removalAt: 30 * time.Second,
+		},
+		{
+			name:        "two-flows-one-expired",
+			idleTimeout: 1 * time.Minute,
+			flowSpecs: []flowSpec{
+				{installAt: 0, wantRemoved: true},                 // age at sweep = 75s
+				{installAt: 30 * time.Second, wantRemoved: false}, // age at sweep = 45s
+			},
+			removalAt: 75 * time.Second,
+		},
+		{
+			name:        "two-flows-both-expired",
+			idleTimeout: 1 * time.Minute,
+			flowSpecs: []flowSpec{
+				{installAt: 0, wantRemoved: true},                // age at sweep = 120s
+				{installAt: 30 * time.Second, wantRemoved: true}, // age at sweep = 90s
+			},
+			removalAt: 2 * time.Minute,
+		},
+		{
+			// Both flows are time-expired, but maxRemovedPerSweep=1 caps removal at 1.
+			// Flow 0 is at the back of the LRU (installed first) and is removed; flow 1 stays.
+			name:               "two-flows-both-expired-but-max-count-equal-one",
+			idleTimeout:        1 * time.Minute,
+			maxRemovedPerSweep: 1,
+			flowSpecs: []flowSpec{
+				{installAt: 0, wantRemoved: true},                 // age at sweep = 120s, removed (under cap)
+				{installAt: 30 * time.Second, wantRemoved: false}, // age at sweep = 90s, kept (cap reached)
+			},
+			removalAt: 2 * time.Minute,
+		},
+		{
+			name:        "zero-idle-timeout-means-no-expiration",
+			idleTimeout: 0,
+			flowSpecs: []flowSpec{
+				{installAt: 0, wantRemoved: false},
+				{installAt: 30 * time.Second, wantRemoved: false},
+			},
+			removalAt: 2 * time.Minute,
+		},
+	}
+
+	for _, tt := range tests {
+		syncSubtest(t, tt.name, func(t *testing.T) {
+			ft := NewFlowTable(
+				0, // turn off LRU for these tests
+				WithFlowIdleTimeout(tt.idleTimeout),
+				WithMaxRemovedFlowsPerSweep(tt.maxRemovedPerSweep),
+			)
+
+			start := time.Now()
+			flows := mkFlows(len(tt.flowSpecs))
+			for i, spec := range tt.flowSpecs {
+				time.Sleep(time.Until(start.Add(spec.installAt)))
+				ft.NewFlow(flows[i])
+			}
+
+			var wantRemovedCount int
+			for _, spec := range tt.flowSpecs {
+				if spec.wantRemoved {
+					wantRemovedCount++
+				}
+			}
+
+			time.Sleep(time.Until(start.Add(tt.removalAt)))
+
+			gotRemovedCount := ft.removeIdle(mono.Now())
+			if wantRemovedCount != gotRemovedCount {
+				t.Errorf("unexpected remove idle count: want %d, got %d", wantRemovedCount, gotRemovedCount)
+			}
+
+			for i, spec := range tt.flowSpecs {
+				if spec.wantRemoved {
+					assertFlowMiss(t, ft, FromTun, flows[i].FromTun.Tuple)
+				} else {
+					assertFlowHit(t, ft, FromTun, flows[i].FromTun.Tuple)
+				}
+			}
+		})
+	}
+
+	syncSubtest(t, "lookup-resets-lastseen", func(t *testing.T) {
+		ft := NewFlowTable(0, WithFlowIdleTimeout(time.Minute))
+		flows := mkFlows(2)
+
+		ft.NewFlow(flows[0])                                  // t=0 (flow 0 install)
+		time.Sleep(30 * time.Second)                          //
+		ft.NewFlow(flows[1])                                  // t=30s (flow 1 install)
+		time.Sleep(60 * time.Second)                          //
+		assertFlowHit(t, ft, FromTun, flows[0].FromTun.Tuple) // t=90s (flow 0 looked up, lastSeen bumped)
+		time.Sleep(15 * time.Second)                          //
+
+		if got := ft.removeIdle(mono.Now()); got != 1 {
+			t.Errorf("removeIdle returned %d, want 1", got)
+		}
+		assertFlowHit(t, ft, FromTun, flows[0].FromTun.Tuple)
+		assertFlowMiss(t, ft, FromTun, flows[1].FromTun.Tuple)
+	})
+}
+
+// recordOnRemove returns an OnRemove that increments fired[name] when invoked.
+// Used to verify OnRemove fires for the right flows the right number of times.
+func recordOnRemove(fired map[string]int, name string) func() {
+	return func() { fired[name]++ }
+}
+
+func TestFlowTable_OnRemove(t *testing.T) {
+	tun1 := mkTuple("1.1.1.1:1000", "2.2.2.2:80")
+	wg1 := mkTuple("2.2.2.2:80", "1.1.1.1:1000")
+	tun2 := mkTuple("3.3.3.3:1000", "4.4.4.4:80")
+	wg2 := mkTuple("4.4.4.4:80", "3.3.3.3:1000")
+
+	t.Run("displacement", func(t *testing.T) {
+		// fd2 collides with fd1 on the FromTun tuple; fd1 is displaced and
+		// its OnRemove fires. fd2 stays installed and its OnRemove does not.
+		ft := NewFlowTable(0)
+		fired := map[string]int{}
+
+		fd1 := mkFlow(tun1, wg1)
+		fd1.OnRemove = recordOnRemove(fired, "fd1")
+		ft.NewFlow(fd1)
+
+		fd2 := mkFlow(tun1, wg2)
+		fd2.OnRemove = recordOnRemove(fired, "fd2")
+		ft.NewFlow(fd2)
+
+		if want := (map[string]int{"fd1": 1}); !maps.Equal(fired, want) {
+			t.Errorf("fired = %v, want %v", fired, want)
+		}
+	})
+
+	t.Run("one-replaces-two", func(t *testing.T) {
+		// fd3's FromTun matches fd1's, and fd3's FromWG matches fd2's. Both
+		// fd1 and fd2 should be displaced and both OnRemoves should fire.
+		ft := NewFlowTable(0)
+		fired := map[string]int{}
+
+		fd1 := mkFlow(tun1, wg1)
+		fd1.OnRemove = recordOnRemove(fired, "fd1")
+		ft.NewFlow(fd1)
+
+		fd2 := mkFlow(tun2, wg2)
+		fd2.OnRemove = recordOnRemove(fired, "fd2")
+		ft.NewFlow(fd2)
+
+		fd3 := mkFlow(tun1, wg2)
+		fd3.OnRemove = recordOnRemove(fired, "fd3")
+		ft.NewFlow(fd3)
+
+		if want := (map[string]int{"fd1": 1, "fd2": 1}); !maps.Equal(fired, want) {
+			t.Errorf("fired = %v, want %v", fired, want)
+		}
+	})
+
+	t.Run("reinstall-same-tuples-fires-once", func(t *testing.T) {
+		// Re-installing a flow with identical tuples from both directions
+		// causes removeFlowLocked to be called twice (once from each direction).
+		// Only one OnRemove should be called for the single flow.
+		ft := NewFlowTable(0)
+		fired := map[string]int{}
+
+		fd1 := mkFlow(tun1, wg1)
+		fd1.OnRemove = recordOnRemove(fired, "fd1")
+		ft.NewFlow(fd1)
+
+		fd2 := mkFlow(tun1, wg1) // identical tuples
+		fd2.OnRemove = recordOnRemove(fired, "fd2")
+		ft.NewFlow(fd2)
+
+		if want := (map[string]int{"fd1": 1}); !maps.Equal(fired, want) {
+			t.Errorf("fired = %v, want %v", fired, want)
+		}
+	})
+
+	t.Run("capacity-eviction", func(t *testing.T) {
+		// With capacity 1, installing fd2 evicts fd1 from the back of the
+		// LRU; fd1's OnRemove fires.
+		ft := NewFlowTable(1)
+		fired := map[string]int{}
+
+		fd1 := mkFlow(tun1, wg1)
+		fd1.OnRemove = recordOnRemove(fired, "fd1")
+		ft.NewFlow(fd1)
+
+		fd2 := mkFlow(tun2, wg2)
+		fd2.OnRemove = recordOnRemove(fired, "fd2")
+		ft.NewFlow(fd2)
+
+		if want := (map[string]int{"fd1": 1}); !maps.Equal(fired, want) {
+			t.Errorf("fired = %v, want %v", fired, want)
+		}
+	})
+
+	syncSubtest(t, "remove-idle", func(t *testing.T) {
+		ft := NewFlowTable(0, WithFlowIdleTimeout(time.Minute))
+		fired := map[string]int{}
+
+		fd1 := mkFlow(tun1, wg1)
+		fd1.OnRemove = recordOnRemove(fired, "fd1")
+		ft.NewFlow(fd1)
+
+		time.Sleep(2 * time.Minute) // advance synthetic clock past idleTimeout
+		if got, want := ft.removeIdle(mono.Now()), 1; got != want {
+			t.Errorf("removeIdle returned %d, want %d", got, want)
+		}
+
+		if want := (map[string]int{"fd1": 1}); !maps.Equal(fired, want) {
+			t.Errorf("fired = %v, want %v", fired, want)
+		}
+	})
+
+	t.Run("nil-onremove-no-panic", func(t *testing.T) {
+		ft := NewFlowTable(0)
+
+		ft.NewFlow(mkFlow(tun1, wg1)) // OnRemove unset
+		ft.NewFlow(mkFlow(tun1, wg2)) // displaces the first flow
+	})
+
+	t.Run("runs-outside-table-lock", func(t *testing.T) {
+		ft := NewFlowTable(0)
+
+		var onRemoveRan bool
+		fd1 := mkFlow(tun1, wg1)
+		fd1.OnRemove = func() {
+			// NewFlow is used here because we know it acquires the mutex,
+			// So this will prove OnRemove() is called with the mutex released.
+			ft.NewFlow(mkFlow(tun2, wg2))
+			onRemoveRan = true
+		}
+		ft.NewFlow(fd1)
+
+		// This should cause displacement of the first flow, and OnRemove to fire.
+		ft.NewFlow(mkFlow(tun1, mkTuple("9.9.9.9:99", "8.8.8.8:88")))
+
+		if !onRemoveRan {
+			t.Errorf("OnRemove did not run")
+		}
+		// The new install should be visible.
+		assertFlowHit(t, ft, FromTun, tun2)
+	})
+}
diff --git a/feature/conn25/ippool.go b/feature/conn25/ippool.go
index e50186d88..af2b3f25b 100644
--- a/feature/conn25/ippool.go
+++ b/feature/conn25/ippool.go
@@ -5,20 +5,31 @@ package conn25
 
 import (
 	"errors"
+	"math"
 	"net/netip"
 
 	"go4.org/netipx"
+	"tailscale.com/util/set"
 )
 
 // errPoolExhausted is returned when there are no more addresses to iterate over.
 var errPoolExhausted = errors.New("ip pool exhausted")
 
-// ippool allows for iteration over all the addresses within a netipx.IPSet.
+// errNotOurAddress is returned if a provided address is not from our pool
+var errNotOurAddress = errors.New("not our address")
+
+// errAddrExists is returned if a returned address is already in the returned pool.
+var errAddrExists = errors.New("address already returned")
+
+// errUninitializedIPPool is returned if the pool is used when it's not initialized
+var errUninitializedIPPool = errors.New("uninitialized ippool")
+
+// ipSetIterator allows for round robin iteration over all the addresses within a netipx.IPSet.
 // netipx.IPSet has a Ranges call that returns the "minimum and sorted set of IP ranges that covers [the set]".
 // netipx.IPRange is "an inclusive range of IP addresses from the same address family.". So we can iterate over
 // all the addresses in the set by keeping a track of the last address we returned, calling Next on the last address
-// to get the new one, and if we run off the edge of the current range, starting on the next one.
-type ippool struct {
+// to get the new one, and if we run off the edge of the current range, starting on the next one, or back at the beginning.
+type ipSetIterator struct {
 	// ranges defines the addresses in the pool
 	ranges []netipx.IPRange
 	// last is internal tracking of which the last address provided was.
@@ -27,35 +38,140 @@ type ippool struct {
 	rangeIdx int
 }
 
+// next returns the next address from the set.
+func (ipsi *ipSetIterator) next() (netip.Addr, error) {
+	if len(ipsi.ranges) == 0 {
+		// ipset is empty
+		return netip.Addr{}, errPoolExhausted
+	}
+	if !ipsi.last.IsValid() {
+		// not initialized yet
+		ipsi.last = ipsi.ranges[0].From()
+		return ipsi.last, nil
+	}
+	currRange := ipsi.ranges[ipsi.rangeIdx]
+	if ipsi.last == currRange.To() {
+		// then we need to move to the next range
+		ipsi.rangeIdx++
+		if ipsi.rangeIdx >= len(ipsi.ranges) {
+			// back to the beginning
+			ipsi.rangeIdx = 0
+		}
+		ipsi.last = ipsi.ranges[ipsi.rangeIdx].From()
+		return ipsi.last, nil
+	}
+	ipsi.last = ipsi.last.Next()
+	return ipsi.last, nil
+}
+
 func newIPPool(ipset *netipx.IPSet) *ippool {
 	if ipset == nil {
 		return &ippool{}
 	}
-	return &ippool{ranges: ipset.Ranges()}
+	return &ippool{
+		ipSet:         ipset,
+		ipSetIterator: &ipSetIterator{ranges: ipset.Ranges()},
+		inUse:         &set.Set[netip.Addr]{},
+	}
 }
 
-// next returns the next address from the set, or errPoolExhausted if we have
-// iterated over the whole set.
+type ippool struct {
+	// ipSet defines the addresses within the ippool, it is configured by the user.
+	ipSet *netipx.IPSet
+	// ipSetIterator keeps track of iteration through the ippool.
+	ipSetIterator *ipSetIterator
+	// inUse is a set of addresses that have been handed out and not yet returned.
+	// Addresses in inUse won't be returned from next.
+	// Addresses in inUse may no longer be in the ipSet definition of the pool bounds
+	// if the ippool has been reconfigured.
+	inUse *set.Set[netip.Addr]
+}
+
+// next returns the next available address from within the ippool.
+// next will return errPoolExhausted if there are no more unused addresses.
 func (ipp *ippool) next() (netip.Addr, error) {
-	if ipp.rangeIdx >= len(ipp.ranges) {
-		// ipset is empty or we have iterated off the end
-		return netip.Addr{}, errPoolExhausted
+	if ipp == nil || ipp.ipSetIterator == nil {
+		return netip.Addr{}, errUninitializedIPPool
 	}
-	if !ipp.last.IsValid() {
-		// not initialized yet
-		ipp.last = ipp.ranges[0].From()
-		return ipp.last, nil
+	a, err := ipp.ipSetIterator.next()
+	if err != nil {
+		return netip.Addr{}, err
 	}
-	currRange := ipp.ranges[ipp.rangeIdx]
-	if ipp.last == currRange.To() {
-		// then we need to move to the next range
-		ipp.rangeIdx++
-		if ipp.rangeIdx >= len(ipp.ranges) {
+	startedAt := a
+	for ipp.inUse.Contains(a) {
+		a, err = ipp.ipSetIterator.next()
+		if err != nil {
+			return a, err
+		}
+		if a == startedAt {
 			return netip.Addr{}, errPoolExhausted
 		}
-		ipp.last = ipp.ranges[ipp.rangeIdx].From()
-		return ipp.last, nil
 	}
-	ipp.last = ipp.last.Next()
-	return ipp.last, nil
+	ipp.inUse.Add(a)
+	return a, nil
+}
+
+// returnAddr puts an address back into the ippool, that address will
+// now be available to be handed out when we iterate back around to it.
+// returnAddr will return an error if the provided address is not one
+// that's currently in inUse.
+func (ipp *ippool) returnAddr(a netip.Addr) error {
+	if ipp.inUse.Contains(a) {
+		ipp.inUse.Delete(a)
+		return nil
+	}
+	if !ipp.ipSet.Contains(a) {
+		return errNotOurAddress
+	}
+	return errAddrExists
+}
+
+// reconfig changes the definition of the addresses that are in the ippool
+// while keeping track of the addresses that are currently in inUse.
+func (ipp *ippool) reconfig(ipSet *netipx.IPSet) *ippool {
+	if ipp != nil && ipSet != nil && ipSet.Equal(ipp.ipSet) {
+		// in the common case that the definition has not changed, do nothing.
+		return ipp
+	}
+	newPool := newIPPool(ipSet)
+	if ipp != nil {
+		// even if the definition of which addresses are in the pool has changed
+		// we don't want to lose track of which addresses are currently in use
+		newPool.inUse = ipp.inUse
+	}
+	return newPool
+}
+
+// inUseCount returns the number of addresses currently handed out from the
+// pool. It is safe to call on a nil or uninitialized pool, returning 0.
+func (ipp *ippool) inUseCount() int64 {
+	if ipp == nil || ipp.inUse == nil {
+		return 0
+	}
+	return int64(ipp.inUse.Len())
+}
+
+// capacity returns the total number of addresses defined by the pool's ipSet.
+// It is safe to call on a nil or uninitialized pool, returning 0. The count is
+// clamped to [math.MaxInt64] because an IP pool (particularly IPv6) can define
+// far more addresses than fit in an int64.
+func (ipp *ippool) capacity() int64 {
+	if ipp == nil || ipp.ipSet == nil {
+		return 0
+	}
+	var count int64
+	for _, pfx := range ipp.ipSet.Prefixes() {
+		bits := pfx.Addr().BitLen() - pfx.Bits()
+		// 1<<bits can exceed an int64 (e.g. a /64 IPv6 pool), so clamp.
+		if bits >= 63 {
+			return math.MaxInt64
+		}
+		addend := int64(1) << bits
+		if count > math.MaxInt64-addend {
+			// Summing multiple large prefixes would overflow.
+			return math.MaxInt64
+		}
+		count += addend
+	}
+	return count
 }
diff --git a/feature/conn25/ippool_test.go b/feature/conn25/ippool_test.go
index ccfaad3eb..b12b601cd 100644
--- a/feature/conn25/ippool_test.go
+++ b/feature/conn25/ippool_test.go
@@ -5,6 +5,7 @@ package conn25
 
 import (
 	"errors"
+	"math"
 	"net/netip"
 	"testing"
 
@@ -13,7 +14,7 @@ import (
 )
 
 func TestNext(t *testing.T) {
-	a := ippool{}
+	a := ipSetIterator{}
 	_, err := a.next()
 	if !errors.Is(err, errPoolExhausted) {
 		t.Fatalf("expected errPoolExhausted, got %v", err)
@@ -58,3 +59,224 @@ func TestNext(t *testing.T) {
 		t.Fatalf("expected errPoolExhausted, got %v", err)
 	}
 }
+
+// TestReturnAddr tests that if a pool is exhausted, an address can be returned to the
+// pool, and then that address will be handed out again.
+func TestReturnAddr(t *testing.T) {
+	addrString := "192.168.0.0"
+	// There's an IPPool with one address in it.
+	var isb netipx.IPSetBuilder
+	isb.AddRange(netipx.IPRangeFrom(netip.MustParseAddr(addrString), netip.MustParseAddr(addrString)))
+	ipset := must.Get(isb.IPSet())
+	ipp := newIPPool(ipset)
+	// The first time we call next we get the address.
+	addr, err := ipp.next()
+	if err != nil {
+		t.Fatalf("expected nil error, got: %v", err)
+	}
+	if addr != netip.MustParseAddr(addrString) {
+		t.Fatalf("want %v, got %v", addrString, addr)
+	}
+	// The second time we call next we get errPoolExhausted
+	_, err = ipp.next()
+	if !errors.Is(err, errPoolExhausted) {
+		t.Fatalf("expected errPoolExhausted, got %v", err)
+	}
+	// Return the addr to the pool
+	err = ipp.returnAddr(netip.MustParseAddr(addrString))
+	if err != nil {
+		t.Fatal(err)
+	}
+	// It's not possible to return addresses that are already in the pool.
+	err = ipp.returnAddr(netip.MustParseAddr(addrString))
+	if !errors.Is(err, errAddrExists) {
+		t.Fatalf("want errAddrExists, got: %v", err)
+	}
+	// When we call next we get the returned addr
+	addrAfterReturn, err := ipp.next()
+	if err != nil {
+		t.Fatalf("expected nil error, got: %v", err)
+	}
+	if addrAfterReturn != netip.MustParseAddr(addrString) {
+		t.Fatalf("want %v, got %v", addrString, addrAfterReturn)
+	}
+	// You can't return addresses that aren't from the pool.
+	err = ipp.returnAddr(netip.MustParseAddr("100.100.100.0"))
+	if !errors.Is(err, errNotOurAddress) {
+		t.Fatalf("want errNotOurAddress, got: %v", err)
+	}
+}
+
+func expectAddrNext(t *testing.T, ipp *ippool, addrString string) {
+	t.Helper()
+	got, err := ipp.next()
+	if err != nil {
+		t.Fatalf("expected nil error, got: %v", err)
+	}
+	want := netip.MustParseAddr(addrString)
+	if want != got {
+		t.Fatalf("want %v; got %v", want, got)
+	}
+}
+
+func expectErrPoolExhaustedNext(t *testing.T, ipp *ippool) {
+	t.Helper()
+	_, err := ipp.next()
+	if !errors.Is(err, errPoolExhausted) {
+		t.Fatalf("expected errPoolExhausted; got %v", err)
+	}
+}
+
+// TestGettingReturnedAddresses tests that when addresses are returned to the IP Pool
+// they are then handed out in the order they were returned.
+func TestGettingReturnedAddresses(t *testing.T) {
+	var isb netipx.IPSetBuilder
+	isb.AddRange(netipx.IPRangeFrom(netip.MustParseAddr("192.168.0.0"), netip.MustParseAddr("192.168.0.4")))
+	ipset := must.Get(isb.IPSet())
+	ipp := newIPPool(ipset)
+	expectAddrNext(t, ipp, "192.168.0.0")
+	expectAddrNext(t, ipp, "192.168.0.1")
+	expectAddrNext(t, ipp, "192.168.0.2")
+	expectAddrNext(t, ipp, "192.168.0.3")
+	expectAddrNext(t, ipp, "192.168.0.4")
+	expectErrPoolExhaustedNext(t, ipp)
+	ipp.returnAddr(netip.MustParseAddr("192.168.0.2"))
+	ipp.returnAddr(netip.MustParseAddr("192.168.0.4"))
+	expectAddrNext(t, ipp, "192.168.0.2")
+	expectAddrNext(t, ipp, "192.168.0.4")
+	expectErrPoolExhaustedNext(t, ipp)
+}
+
+func TestIPPoolReconfig(t *testing.T) {
+	var isb netipx.IPSetBuilder
+	isb.AddRange(netipx.IPRangeFrom(netip.MustParseAddr("192.168.0.0"), netip.MustParseAddr("192.168.0.4")))
+	ipsetOne := must.Get(isb.IPSet())
+	ipsetOneClone := must.Get(isb.IPSet())
+	isb = netipx.IPSetBuilder{}
+	isb.AddRange(netipx.IPRangeFrom(netip.MustParseAddr("192.168.0.7"), netip.MustParseAddr("192.168.0.10")))
+	ipsetTwo := must.Get(isb.IPSet())
+
+	var ipp *ippool
+	ipp = ipp.reconfig(ipsetOne)
+	if ipp.ipSet != ipsetOne {
+		t.Fatalf("want %v, got %v", ipsetOne, ipp.ipSet)
+	}
+	expectAddrNext(t, ipp, "192.168.0.0")
+
+	// check that we don't lose iterator state when we reconfig with the same ranges
+	expectAddrNext(t, ipp, "192.168.0.1")
+	ipp.returnAddr(netip.MustParseAddr("192.168.0.1"))
+	ipp = ipp.reconfig(ipsetOneClone)
+	expectAddrNext(t, ipp, "192.168.0.2")
+
+	// when we reconfig with different ranges, we only hand out addresses from the new ranges
+	ipp = ipp.reconfig(ipsetTwo)
+	if ipp.ipSet != ipsetTwo {
+		t.Fatalf("want %v, got %v", ipsetTwo, ipp.ipSet)
+	}
+	expectAddrNext(t, ipp, "192.168.0.7")
+	expectAddrNext(t, ipp, "192.168.0.8")
+	expectAddrNext(t, ipp, "192.168.0.9")
+	expectAddrNext(t, ipp, "192.168.0.10")
+	expectErrPoolExhaustedNext(t, ipp)
+
+	// but we have not lost track of the fact that the old addresses are in use
+	if !ipp.inUse.Contains(netip.MustParseAddr("192.168.0.0")) {
+		t.Fatalf("expected inUse to still have the address")
+	}
+
+	// old addresses can be returned
+	ipp.returnAddr(netip.MustParseAddr("192.168.0.0"))
+
+	// but they are not handed out again
+	expectErrPoolExhaustedNext(t, ipp)
+	if ipp.inUse.Contains(netip.MustParseAddr("192.168.0.0")) {
+		t.Fatalf("expected inUse to no longer have the address")
+	}
+
+	// returning addresses from the new ranges works as normal
+	ipp.returnAddr(netip.MustParseAddr("192.168.0.9"))
+	expectAddrNext(t, ipp, "192.168.0.9")
+}
+
+func TestIPPoolCapacity(t *testing.T) {
+	tests := []struct {
+		name   string
+		prefix string
+		want   int64
+	}{
+		{"ipv4-slash-30", "100.64.0.0/30", 4},
+		{"ipv4-slash-24", "100.64.0.0/24", 256},
+		{"ipv4-single", "100.64.0.1/32", 1},
+		{"ipv6-slash-120", "fd7a::/120", 256},
+		// 2^62 is the largest power of two below math.MaxInt64; not clamped.
+		{"ipv6-slash-66-not-clamped", "fd7a::/66", 1 << 62},
+		// 2^63 overflows int64, so it clamps.
+		{"ipv6-slash-65-clamps", "fd7a::/65", math.MaxInt64},
+		{"ipv6-slash-64-clamps", "fd7a::/64", math.MaxInt64},
+		{"ipv6-default-clamps", "::/0", math.MaxInt64},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ipp := newIPPool(mustIPSetFromPrefix(tt.prefix))
+			if got := ipp.capacity(); got != tt.want {
+				t.Errorf("capacity(%s) = %d, want %d", tt.prefix, got, tt.want)
+			}
+		})
+	}
+
+	t.Run("multi-prefix-sum-overflows-clamps", func(t *testing.T) {
+		b := &netipx.IPSetBuilder{}
+		b.AddPrefix(netip.MustParsePrefix("fd7a::/66"))            // 2^62 +
+		b.AddPrefix(netip.MustParsePrefix("fd7a:0:0:0:8000::/66")) // 2^62 = 2^63 (1 more than MaxInt64)
+		set, err := b.IPSet()
+		if err != nil {
+			t.Fatal(err)
+		}
+		if got := newIPPool(set).capacity(); got != math.MaxInt64 {
+			t.Errorf("capacity() = %d, want %d", got, int64(math.MaxInt64))
+		}
+	})
+
+	t.Run("nil-and-uninitialized", func(t *testing.T) {
+		var nilPool *ippool
+		if got := nilPool.capacity(); got != 0 {
+			t.Errorf("nil pool capacity() = %d, want 0", got)
+		}
+		// newIPPool(nil) returns a non-nil pool with a nil ipSet.
+		if got := newIPPool(nil).capacity(); got != 0 {
+			t.Errorf("uninitialized pool capacity() = %d, want 0", got)
+		}
+	})
+}
+
+func TestIPPoolInUseCount(t *testing.T) {
+	t.Run("counts-handed-out", func(t *testing.T) {
+		ipp := newIPPool(mustIPSetFromPrefix("100.64.0.0/29")) // 8 addresses
+		if got := ipp.inUseCount(); got != 0 {
+			t.Fatalf("fresh pool inUseCount() = %d, want 0", got)
+		}
+		a1 := must.Get(ipp.next())
+		must.Get(ipp.next())
+		if got := ipp.inUseCount(); got != 2 {
+			t.Fatalf("after 2 next() inUseCount() = %d, want 2", got)
+		}
+		if err := ipp.returnAddr(a1); err != nil {
+			t.Fatal(err)
+		}
+		if got := ipp.inUseCount(); got != 1 {
+			t.Fatalf("after returnAddr inUseCount() = %d, want 1", got)
+		}
+	})
+
+	t.Run("nil-and-uninitialized", func(t *testing.T) {
+		var nilPool *ippool
+		if got := nilPool.inUseCount(); got != 0 {
+			t.Errorf("nil pool inUseCount() = %d, want 0", got)
+		}
+		// newIPPool(nil) returns a non-nil pool with a nil inUse set.
+		if got := newIPPool(nil).inUseCount(); got != 0 {
+			t.Errorf("uninitialized pool inUseCount() = %d, want 0", got)
+		}
+	})
+}
diff --git a/feature/debugportmapper/debugportmapper.go b/feature/debugportmapper/debugportmapper.go
index 45f3c2208..1b3bf83f7 100644
--- a/feature/debugportmapper/debugportmapper.go
+++ b/feature/debugportmapper/debugportmapper.go
@@ -11,7 +11,6 @@ import (
 	"net"
 	"net/http"
 	"net/netip"
-	"strconv"
 	"strings"
 	"sync"
 	"time"
@@ -20,6 +19,7 @@ import (
 	"tailscale.com/net/netmon"
 	"tailscale.com/net/portmapper"
 	"tailscale.com/types/logger"
+	"tailscale.com/util/def"
 	"tailscale.com/util/eventbus"
 )
 
@@ -66,7 +66,7 @@ func serveDebugPortmap(h *localapi.Handler, w http.ResponseWriter, r *http.Reque
 		}
 	}
 
-	if defBool(r.FormValue("log_http"), false) {
+	if def.Bool(r.FormValue("log_http"), false) {
 		debugKnobs.LogHTTP = true
 	}
 
@@ -191,14 +191,3 @@ func serveDebugPortmap(h *localapi.Handler, w http.ResponseWriter, r *http.Reque
 		}
 	}
 }
-
-func defBool(a string, def bool) bool {
-	if a == "" {
-		return def
-	}
-	v, err := strconv.ParseBool(a)
-	if err != nil {
-		return def
-	}
-	return v
-}
diff --git a/feature/doctor/doctor.go b/feature/doctor/doctor.go
index db061311b..01897f0a6 100644
--- a/feature/doctor/doctor.go
+++ b/feature/doctor/doctor.go
@@ -63,7 +63,7 @@ func visitDoctor(ctx context.Context, b *ipnlocal.LocalBackend, logf logger.Logf
 	// IPs; this can interfere with our ability to connect to the Tailscale
 	// controlplane.
 	checks = append(checks, doctor.CheckFunc("dns-resolvers", func(_ context.Context, logf logger.Logf) error {
-		nm := b.NetMap()
+		nm := b.NetMapNoPeers()
 		if nm == nil {
 			return nil
 		}
diff --git a/feature/feature.go b/feature/feature.go
index 5bd79db45..305f31a12 100644
--- a/feature/feature.go
+++ b/feature/feature.go
@@ -21,6 +21,14 @@ var in = map[string]bool{}
 // not accessed concurrently with calls to Register.
 func Registered() map[string]bool { return in }
 
+// IsRegistered reports whether the named feature package's init
+// function has run and registered itself via [Register] in this
+// binary. It is distinct from the compile-time [buildfeatures]
+// constants: a feature package can be present in the binary but not
+// imported (e.g. tsnet deliberately does not import many features),
+// in which case its init does not run.
+func IsRegistered(name string) bool { return in[name] }
+
 // Register notes that the named feature is linked into the binary.
 func Register(name string) {
 	if _, ok := in[name]; ok {
diff --git a/feature/featuretags/featuretags.go b/feature/featuretags/featuretags.go
index 4f34acbe8..1348cc15d 100644
--- a/feature/featuretags/featuretags.go
+++ b/feature/featuretags/featuretags.go
@@ -160,6 +160,7 @@ var Features = map[FeatureTag]FeatureMeta{
 	"desktop_sessions": {Sym: "DesktopSessions", Desc: "Desktop sessions support"},
 	"doctor":           {Sym: "Doctor", Desc: "Diagnose possible issues with Tailscale and its host environment"},
 	"drive":            {Sym: "Drive", Desc: "Tailscale Drive (file server) support"},
+	"flashappliance":   {Sym: "FlashAppliance", Desc: "'tailscale configure flash-appliance' and 'pve-appliance' CLI commands for deploying Tailscale appliance images"},
 	"gro": {
 		Sym:  "GRO",
 		Desc: "Generic Receive Offload support (performance)",
@@ -171,7 +172,6 @@ var Features = map[FeatureTag]FeatureMeta{
 	"ipnbus":             {Sym: "IPNBus", Desc: "IPN notification bus (watch-ipn-bus) support, used by GUIs, debugging, and nicer 'tailscale up' support"},
 	"iptables":           {Sym: "IPTables", Desc: "Linux iptables support"},
 	"kube":               {Sym: "Kube", Desc: "Kubernetes integration"},
-	"lazywg":             {Sym: "LazyWG", Desc: "Lazy WireGuard configuration for memory-constrained devices with large netmaps"},
 	"linuxdnsfight":      {Sym: "LinuxDNSFight", Desc: "Linux support for detecting DNS fights (inotify watching of /etc/resolv.conf)"},
 	"linkspeed": {
 		Sym:  "LinkSpeed",
@@ -229,13 +229,27 @@ var Features = map[FeatureTag]FeatureMeta{
 		Desc: "Linux NetworkManager integration",
 		Deps: []FeatureTag{"dbus"},
 	},
-	"qrcodes":     {Sym: "QRCodes", Desc: "QR codes in tailscale CLI"},
-	"relayserver": {Sym: "RelayServer", Desc: "Relay server"},
+	"serviceclientprefs": {Sym: "ServiceClientPrefs", Desc: "Desktop client service launch preferences"},
+	"qrcodes":            {Sym: "QRCodes", Desc: "QR codes in tailscale CLI"},
+	"relayserver":        {Sym: "RelayServer", Desc: "Relay server"},
+	"remoteconfig": {
+		Sym:  "RemoteConfig",
+		Desc: "Full remote configuration of this node by the tailnet admin, opting out of Tailscale's per-feature double opt-in in favor of a single client-side trust decision",
+		Deps: []FeatureTag{"c2n"},
+	},
 	"resolved": {
 		Sym:  "Resolved",
 		Desc: "Linux systemd-resolved integration",
 		Deps: []FeatureTag{"dbus"},
 	},
+	"routecheck": {
+		Sym:  "RouteCheck",
+		Desc: "Support checking the reachability of overlapping routers, for choosing between multiple network paths to the same IP address",
+	},
+	"runtimemetrics": {
+		Sym:  "RuntimeMetrics",
+		Desc: "Support emission of runtime/metrics as clientmetrics",
+	},
 	"sdnotify": {
 		Sym:  "SDNotify",
 		Desc: "systemd notification support",
@@ -254,6 +268,10 @@ var Features = map[FeatureTag]FeatureMeta{
 		Sym:  "Synology",
 		Desc: "Synology NAS integration (applies to Linux builds only)",
 	},
+	"syslog": {
+		Sym:  "Syslog",
+		Desc: "tailscaled --syslog flag support to send logs to the system syslog daemon",
+	},
 	"syspolicy": {Sym: "SystemPolicy", Desc: "System policy configuration (MDM) support"},
 	"systray": {
 		Sym:  "SysTray",
diff --git a/feature/hooks.go b/feature/hooks.go
index 7611499a1..465f645fd 100644
--- a/feature/hooks.go
+++ b/feature/hooks.go
@@ -4,6 +4,7 @@
 package feature
 
 import (
+	"io"
 	"net/http"
 	"net/url"
 	"os"
@@ -13,6 +14,21 @@ import (
 	"tailscale.com/types/persist"
 )
 
+// HookRegisterLogSinkFlags is a hook for the syslog feature to register
+// its flags (such as tailscaled's --syslog) with the process's default
+// flag set. If set, tailscaled calls it before flag parsing.
+var HookRegisterLogSinkFlags Hook[func()]
+
+// HookLogSink is a hook for the syslog feature to redirect the process's
+// logs to an alternate sink. If set, tailscaled calls it once early in
+// main, after flag parsing; on that first call, if the user requested an
+// alternate sink, it points the standard library's default logger at that
+// sink. It returns the sink, or nil if logs are not being redirected.
+// Later callers (such as logpolicy, which otherwise writes its console
+// copy of logs to stderr) use the returned writer to send their logs to
+// the same place.
+var HookLogSink Hook[func() io.Writer]
+
 // HookCanAutoUpdate is a hook for the clientupdate package
 // to conditionally initialize.
 var HookCanAutoUpdate Hook[func() bool]
diff --git a/feature/identityfederation/identityfederation.go b/feature/identityfederation/identityfederation.go
index 51a8018d8..c7eb8960f 100644
--- a/feature/identityfederation/identityfederation.go
+++ b/feature/identityfederation/identityfederation.go
@@ -29,34 +29,38 @@ func init() {
 }
 
 // resolveAuthKey uses OIDC identity federation to exchange the provided ID token and client ID for an authkey.
-func resolveAuthKey(ctx context.Context, baseURL, clientID, idToken, audience string, tags []string) (string, error) {
-	if clientID == "" {
+func resolveAuthKey(ctx context.Context, args tailscale.ResolveAuthKeyWIFArgs) (string, error) {
+	if args.ClientID == "" {
 		return "", nil // Short-circuit, no client ID means not using identity federation
 	}
 
-	if idToken == "" {
-		if audience == "" {
+	if args.IDToken == "" {
+		if args.Audience == "" {
 			return "", errors.New("federated identity requires either an ID token or an audience")
 		}
-		providerIdToken, err := wif.ObtainProviderToken(ctx, audience)
+		providerIdToken, err := wif.ObtainProviderToken(ctx, args.Audience)
 		if err != nil {
 			return "", errors.New("federated identity authkeys require --id-token")
 		}
-		idToken = providerIdToken
+		args.IDToken = providerIdToken
 	}
-	if len(tags) == 0 {
+	if len(args.Tags) == 0 {
 		return "", errors.New("federated identity authkeys require --advertise-tags")
 	}
-	if baseURL == "" {
-		baseURL = ipn.DefaultControlURL
+	if args.BaseURL == "" {
+		args.BaseURL = ipn.DefaultControlURL
 	}
 
-	strippedID, ephemeral, preauth, err := parseOptionalAttributes(clientID)
+	strippedID, ephemeral, preauth, err := parseOptionalAttributes(args.ClientID)
 	if err != nil {
 		return "", fmt.Errorf("failed to parse optional config attributes: %w", err)
 	}
 
-	accessToken, err := exchangeJWTForToken(ctx, baseURL, strippedID, idToken)
+	accessToken, err := exchangeJWTForToken(ctx, tailscale.ExchangeJWTForTokenWIFArgs{
+		BaseURL:  args.BaseURL,
+		ClientID: strippedID,
+		IDToken:  args.IDToken,
+	})
 	if err != nil {
 		return "", fmt.Errorf("failed to exchange JWT for access token: %w", err)
 	}
@@ -66,7 +70,7 @@ func resolveAuthKey(ctx context.Context, baseURL, clientID, idToken, audience st
 
 	tsClient := tailscale.NewClient("-", tailscale.APIKey(accessToken))
 	tsClient.UserAgent = "tailscale-cli-identity-federation"
-	tsClient.BaseURL = baseURL
+	tsClient.BaseURL = args.BaseURL
 
 	authkey, _, err := tsClient.CreateKey(ctx, tailscale.KeyCapabilities{
 		Devices: tailscale.KeyDeviceCapabilities{
@@ -74,7 +78,7 @@ func resolveAuthKey(ctx context.Context, baseURL, clientID, idToken, audience st
 				Reusable:      false,
 				Ephemeral:     ephemeral,
 				Preauthorized: preauth,
-				Tags:          tags,
+				Tags:          args.Tags,
 			},
 		},
 	})
@@ -117,15 +121,15 @@ func parseOptionalAttributes(clientID string) (strippedID string, ephemeral bool
 }
 
 // exchangeJWTForToken exchanges a JWT for a Tailscale access token.
-func exchangeJWTForToken(ctx context.Context, baseURL, clientID, idToken string) (string, error) {
+func exchangeJWTForToken(ctx context.Context, args tailscale.ExchangeJWTForTokenWIFArgs) (string, error) {
 	httpClient := &http.Client{Timeout: 10 * time.Second}
 	ctx = context.WithValue(ctx, oauth2.HTTPClient, httpClient)
 
 	token, err := (&oauth2.Config{
 		Endpoint: oauth2.Endpoint{
-			TokenURL: fmt.Sprintf("%s/api/v2/oauth/token-exchange", baseURL),
+			TokenURL: fmt.Sprintf("%s/api/v2/oauth/token-exchange", args.BaseURL),
 		},
-	}).Exchange(ctx, "", oauth2.SetAuthURLParam("client_id", clientID), oauth2.SetAuthURLParam("jwt", idToken))
+	}).Exchange(ctx, "", oauth2.SetAuthURLParam("client_id", args.ClientID), oauth2.SetAuthURLParam("jwt", args.IDToken))
 	if err != nil {
 		// Try to extract more detailed error message
 		if retrieveErr, ok := errors.AsType[*oauth2.RetrieveError](err); ok {
diff --git a/feature/identityfederation/identityfederation_test.go b/feature/identityfederation/identityfederation_test.go
index 9d9e5f4fd..48b6c7254 100644
--- a/feature/identityfederation/identityfederation_test.go
+++ b/feature/identityfederation/identityfederation_test.go
@@ -9,6 +9,8 @@ import (
 	"net/http/httptest"
 	"strings"
 	"testing"
+
+	"tailscale.com/internal/client/tailscale"
 )
 
 func TestResolveAuthKey(t *testing.T) {
@@ -70,7 +72,13 @@ func TestResolveAuthKey(t *testing.T) {
 			srv := mockedControlServer(t)
 			defer srv.Close()
 
-			authKey, err := resolveAuthKey(context.Background(), srv.URL, tt.clientID, tt.idToken, tt.audience, tt.tags)
+			authKey, err := resolveAuthKey(context.Background(), tailscale.ResolveAuthKeyWIFArgs{
+				BaseURL:  srv.URL,
+				ClientID: tt.clientID,
+				IDToken:  tt.idToken,
+				Audience: tt.audience,
+				Tags:     tt.tags,
+			})
 			if tt.wantErr != "" {
 				if err == nil {
 					t.Errorf("resolveAuthKey() error = nil, want %q", tt.wantErr)
diff --git a/feature/netlog/netlog.go b/feature/netlog/netlog.go
new file mode 100644
index 000000000..2f85d671c
--- /dev/null
+++ b/feature/netlog/netlog.go
@@ -0,0 +1,119 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package netlog registers the network flow logging feature and wires
+// it into the WireGuard engine. The logger implementation itself lives
+// in tailscale.com/wgengine/netlog.
+package netlog
+
+import (
+	"context"
+	"time"
+
+	"tailscale.com/envknob"
+	"tailscale.com/feature"
+	"tailscale.com/types/logid"
+	"tailscale.com/wgengine"
+	"tailscale.com/wgengine/netlog"
+	"tailscale.com/wgengine/router"
+)
+
+func init() {
+	feature.Register("netlog")
+	wgengine.HookNewNetLogger.Set(newNetLogger)
+}
+
+// uploadTimeout is the maximum time to wait when shutting down the
+// network logger as it uploads the final network log messages.
+const uploadTimeout = 5 * time.Second
+
+// netLogger implements [wgengine.NetLogger] on top of [netlog.Logger],
+// tracking the logging identity and running state across engine
+// reconfigurations. One netLogger exists per engine.
+type netLogger struct {
+	deps   wgengine.NetLoggerDeps
+	logger netlog.Logger
+
+	// The fields below are only accessed from Reconfig and
+	// ReconfigDone, which the engine serializes under its internal
+	// lock.
+
+	// nodeID and domainID are the logging IDs from the last Reconfig,
+	// or zero if logging was not enabled then.
+	nodeID, domainID logid.PrivateID
+	// logExitFlows is whether exit node flows were logged as of the
+	// last Reconfig.
+	logExitFlows bool
+	// shouldRun is whether the last Reconfig wanted the logger
+	// running. ReconfigDone consults it to shut down a stopping
+	// logger after the router has been reconfigured.
+	shouldRun bool
+}
+
+func newNetLogger(deps wgengine.NetLoggerDeps) wgengine.NetLogger {
+	return &netLogger{deps: deps}
+}
+
+func (nl *netLogger) Reconfig(routerCfg *router.Config, routerChanged bool) (changed bool) {
+	logf := nl.deps.Logf
+	src := nl.deps.Source()
+
+	var nodeID, domainID logid.PrivateID
+	var logExitFlows bool
+	if src != nil {
+		if nid, did, lef, ok := src.NetLogIDs(); ok {
+			nodeID, domainID, logExitFlows = nid, did, lef
+		}
+	}
+	idsValid := !nodeID.IsZero() && !domainID.IsZero()
+	idsWereValid := !nl.nodeID.IsZero() && !nl.domainID.IsZero()
+	changed = nodeID != nl.nodeID || domainID != nl.domainID || logExitFlows != nl.logExitFlows
+	idsChanged := idsValid && idsWereValid && changed
+	nl.nodeID, nl.domainID, nl.logExitFlows = nodeID, domainID, logExitFlows
+
+	nl.shouldRun = idsValid && !routerCfg.Equal(&router.Config{}) && !envknob.NoLogsNoSupport()
+
+	// Shut down the logger if the IDs changed while it was running,
+	// letting the startup logic below bring it back up with the new
+	// identity.
+	if idsChanged && nl.logger.Running() {
+		logf("wgengine: Reconfig: shutting down network logger")
+		nl.shutdown()
+	}
+
+	// Start the logger before the engine configures the router so
+	// that it captures initial packets.
+	if nl.shouldRun && !nl.logger.Running() {
+		logf("wgengine: Reconfig: starting up network logger (node:%s tailnet:%s)", nodeID.Public(), domainID.Public())
+		if err := nl.logger.Startup(logf, src, nodeID, domainID, nl.deps.Tun, nl.deps.Sock, nl.deps.NetMon, nl.deps.Health, nl.deps.Bus, logExitFlows); err != nil {
+			logf("wgengine: Reconfig: error starting up network logger: %v", err)
+		}
+		nl.logger.ReconfigRoutes(routerCfg)
+	} else if routerChanged && nl.logger.Running() {
+		nl.logger.ReconfigRoutes(routerCfg)
+	}
+	return changed
+}
+
+func (nl *netLogger) ReconfigDone() {
+	// Shut down a stopping logger only now, after the engine has
+	// configured the router, so that it captures final packets.
+	if !nl.shouldRun && nl.logger.Running() {
+		nl.deps.Logf("wgengine: Reconfig: shutting down network logger")
+		nl.shutdown()
+	}
+}
+
+func (nl *netLogger) Shutdown() {
+	nl.shutdown()
+}
+
+// shutdown stops the logger, waiting up to uploadTimeout for it to
+// flush its final messages.
+func (nl *netLogger) shutdown() {
+	ctx, cancel := context.WithTimeout(context.Background(), uploadTimeout)
+	defer cancel()
+	if err := nl.logger.Shutdown(ctx); err != nil {
+		nl.deps.Logf("wgengine: error shutting down network logger: %v", err)
+	}
+}
diff --git a/feature/oauthkey/oauthkey.go b/feature/oauthkey/oauthkey.go
index 532f6ec73..d2e6d050c 100644
--- a/feature/oauthkey/oauthkey.go
+++ b/feature/oauthkey/oauthkey.go
@@ -33,15 +33,15 @@ func init() {
 // false. The "baseURL" defaults to https://api.tailscale.com.
 // The passed in tags are required, and must be non-empty. These will be
 // set on the authkey generated by the OAuth2 dance.
-func resolveAuthKey(ctx context.Context, clientSecret string, tags []string) (string, error) {
-	if !strings.HasPrefix(clientSecret, "tskey-client-") {
-		return clientSecret, nil
+func resolveAuthKey(ctx context.Context, args tailscale.ResolveAuthKeyArgs) (string, error) {
+	if !strings.HasPrefix(args.AuthKey, "tskey-client-") {
+		return args.AuthKey, nil
 	}
-	if len(tags) == 0 {
+	if len(args.Tags) == 0 {
 		return "", errors.New("oauth authkeys require --advertise-tags")
 	}
 
-	strippedSecret, ephemeral, preauth, baseURL, err := parseOptionalAttributes(clientSecret)
+	strippedSecret, ephemeral, preauth, baseURL, err := parseOptionalAttributes(args.AuthKey)
 	if err != nil {
 		return "", err
 	}
@@ -63,7 +63,7 @@ func resolveAuthKey(ctx context.Context, clientSecret string, tags []string) (st
 				Reusable:      false,
 				Ephemeral:     ephemeral,
 				Preauthorized: preauth,
-				Tags:          tags,
+				Tags:          args.Tags,
 			},
 		},
 	}
diff --git a/feature/oauthkey/oauthkey_test.go b/feature/oauthkey/oauthkey_test.go
index bb1de9326..ce94b8249 100644
--- a/feature/oauthkey/oauthkey_test.go
+++ b/feature/oauthkey/oauthkey_test.go
@@ -9,6 +9,8 @@ import (
 	"net/http/httptest"
 	"strings"
 	"testing"
+
+	"tailscale.com/internal/client/tailscale"
 )
 
 func TestResolveAuthKey(t *testing.T) {
@@ -80,7 +82,10 @@ func TestResolveAuthKey(t *testing.T) {
 				}
 			}
 
-			got, err := resolveAuthKey(context.Background(), tt.clientID, tt.tags)
+			got, err := resolveAuthKey(context.Background(), tailscale.ResolveAuthKeyArgs{
+				AuthKey: tt.clientID,
+				Tags:    tt.tags,
+			})
 
 			if tt.wantErr {
 				if err == nil {
diff --git a/feature/posture/posture.go b/feature/posture/posture.go
index d8db1ac19..0c60d38b0 100644
--- a/feature/posture/posture.go
+++ b/feature/posture/posture.go
@@ -8,8 +8,10 @@ package posture
 
 import (
 	"encoding/json"
+	"fmt"
 	"net/http"
 
+	"tailscale.com/health"
 	"tailscale.com/ipn/ipnext"
 	"tailscale.com/ipn/ipnlocal"
 	"tailscale.com/posture"
@@ -25,6 +27,15 @@ func init() {
 	ipnlocal.RegisterC2N("GET /posture/identity", handleC2NPostureIdentityGet)
 }
 
+var postureSerialWarnable = health.Register(&health.Warnable{
+	Code:     "posture-checking-serial-collection-failed",
+	Title:    "Device Posture: serial number collection failed",
+	Severity: health.SeverityMedium,
+	Text: func(args health.Args) string {
+		return fmt.Sprintf("Could not collect device serial numbers for posture checking. (%v)", args[health.ArgError])
+	},
+})
+
 func newExtension(logf logger.Logf, b ipnext.SafeBackend) (ipnext.Extension, error) {
 	e := &extension{
 		logf: logger.WithPrefix(logf, "posture: "),
@@ -73,6 +84,9 @@ func handleC2NPostureIdentityGet(b *ipnlocal.LocalBackend, w http.ResponseWriter
 		res.SerialNumbers, err = posture.GetSerialNumbers(b.PolicyClient(), e.logf)
 		if err != nil {
 			e.logf("c2n: GetSerialNumbers returned error: %v", err)
+			b.HealthTracker().SetUnhealthy(postureSerialWarnable, health.Args{health.ArgError: err.Error()})
+		} else {
+			b.HealthTracker().SetHealthy(postureSerialWarnable)
 		}
 
 		// TODO(tailscale/corp#21371, 2024-07-10): once this has landed in a stable release
diff --git a/feature/relayserver/relayserver.go b/feature/relayserver/relayserver.go
index 4f52a7ca7..2de5654c7 100644
--- a/feature/relayserver/relayserver.go
+++ b/feature/relayserver/relayserver.go
@@ -69,7 +69,7 @@ func servePeerRelayDebugSessions(h *localapi.Handler, w http.ResponseWriter, r *
 func newExtension(logf logger.Logf, sb ipnext.SafeBackend) (ipnext.Extension, error) {
 	e := &extension{
 		newServerFn: func(logf logger.Logf, port uint16, onlyStaticAddrPorts bool) (relayServer, error) {
-			return udprelay.NewServer(logf, port, onlyStaticAddrPorts, sb.Sys().UserMetricsRegistry())
+			return udprelay.NewServer(logf, port, onlyStaticAddrPorts, sb.Sys().UserMetricsRegistry(), sb.Sys().ControlKnobs())
 		},
 		logf: logger.WithPrefix(logf, featureName+": "),
 	}
diff --git a/feature/remoteconfig/integration_test.go b/feature/remoteconfig/integration_test.go
new file mode 100644
index 000000000..871dd951d
--- /dev/null
+++ b/feature/remoteconfig/integration_test.go
@@ -0,0 +1,181 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package remoteconfig_test
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"testing"
+	"time"
+
+	"tailscale.com/ipn"
+	"tailscale.com/tstest"
+	"tailscale.com/tstest/integration"
+)
+
+// TestRemoteConfigIntegration verifies that the /remoteapi/localapi/*
+// c2n proxy handler is gated on Prefs.RemoteConfig and, when enabled,
+// exposes the LocalAPI to the control plane with full permission.
+func TestRemoteConfigIntegration(t *testing.T) {
+	tstest.Parallel(t)
+	env := integration.NewTestEnv(t)
+
+	n := integration.NewTestNode(t, env)
+	d := n.StartDaemon()
+	defer d.MustCleanShutdown(t)
+
+	n.AwaitListening()
+	n.MustUp()
+	n.AwaitRunning()
+
+	ctx, cancel := context.WithTimeout(t.Context(), 30*time.Second)
+	defer cancel()
+
+	nodeKey := n.MustStatus().Self.PublicKey
+	if err := tstest.WaitFor(5*time.Second, func() error {
+		return env.Control.AwaitNodeInMapRequest(ctx, nodeKey)
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	rt := env.Control.NodeRoundTripper(nodeKey)
+
+	// doReq issues a c2n request and retries on error. The testcontrol
+	// serveMap loop can race with the initial MapResponse delivery and
+	// silently drop the first PingRequest, so we retry with a shorter
+	// per-attempt deadline rather than relying on a single 30s call.
+	doReq := func(method, path string, body []byte) *http.Response {
+		t.Helper()
+		var lastErr error
+		for try := range 5 {
+			reqCtx, reqCancel := context.WithTimeout(ctx, 5*time.Second)
+			var r io.Reader
+			if body != nil {
+				r = bytes.NewReader(body)
+			}
+			req, err := http.NewRequestWithContext(reqCtx, method, path, r)
+			if err != nil {
+				reqCancel()
+				t.Fatalf("NewRequest(%s %s): %v", method, path, err)
+			}
+			resp, err := rt.RoundTrip(req)
+			reqCancel()
+			if err == nil {
+				return resp
+			}
+			lastErr = err
+			t.Logf("RoundTrip(%s %s) try %d: %v", method, path, try+1, err)
+		}
+		t.Fatalf("RoundTrip(%s %s) failed after retries: %v", method, path, lastErr)
+		return nil
+	}
+
+	readBody := func(r *http.Response) string {
+		t.Helper()
+		defer r.Body.Close()
+		b, err := io.ReadAll(r.Body)
+		if err != nil {
+			t.Fatalf("read body: %v", err)
+		}
+		return string(b)
+	}
+
+	// Case 1: RemoteConfig is off by default. The proxy must reject with 403.
+	resp := doReq("GET", "/remoteapi/localapi/v0/prefs", nil)
+	if resp.StatusCode != http.StatusForbidden {
+		t.Fatalf("with RemoteConfig=false, GET /remoteapi/localapi/v0/prefs: got %d %q; want 403", resp.StatusCode, readBody(resp))
+	}
+	resp.Body.Close()
+
+	// Enable RemoteConfig locally.
+	c := n.LocalClient()
+	if _, err := c.EditPrefs(ctx, &ipn.MaskedPrefs{
+		RemoteConfigSet: true,
+		Prefs:           ipn.Prefs{RemoteConfig: true},
+	}); err != nil {
+		t.Fatalf("EditPrefs(RemoteConfig=true): %v", err)
+	}
+
+	// Case 2: With RemoteConfig on, the proxy should serve LocalAPI. GET prefs
+	// must return the current prefs including RemoteConfig=true.
+	resp = doReq("GET", "/remoteapi/localapi/v0/prefs", nil)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("with RemoteConfig=true, GET /remoteapi/localapi/v0/prefs: got %d %q; want 200", resp.StatusCode, readBody(resp))
+	}
+	var gotPrefs ipn.Prefs
+	if err := json.NewDecoder(resp.Body).Decode(&gotPrefs); err != nil {
+		t.Fatalf("decode prefs from c2n proxy: %v", err)
+	}
+	resp.Body.Close()
+	if !gotPrefs.RemoteConfig {
+		t.Errorf("c2n GET prefs: RemoteConfig=false; want true")
+	}
+
+	// Case 3: PATCH prefs through the proxy toggling Hostname.
+	const wantHostname = "remoteconfig-integration-test"
+	patch, err := json.Marshal(&ipn.MaskedPrefs{
+		HostnameSet: true,
+		Prefs:       ipn.Prefs{Hostname: wantHostname},
+	})
+	if err != nil {
+		t.Fatalf("marshal patch: %v", err)
+	}
+	resp = doReq("PATCH", "/remoteapi/localapi/v0/prefs", patch)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("PATCH /remoteapi/localapi/v0/prefs: got %d %q; want 200", resp.StatusCode, readBody(resp))
+	}
+	resp.Body.Close()
+
+	if err := tstest.WaitFor(5*time.Second, func() error {
+		cur, err := c.GetPrefs(ctx)
+		if err != nil {
+			return err
+		}
+		if cur.Hostname != wantHostname {
+			return fmt.Errorf("Hostname = %q; want %q", cur.Hostname, wantHostname)
+		}
+		return nil
+	}); err != nil {
+		t.Fatalf("PATCH did not land: %v", err)
+	}
+
+	// Case 4: Turn RemoteConfig off via the c2n proxy itself. Subsequent c2n
+	// calls must be rejected as soon as the pref flips.
+	patch, err = json.Marshal(&ipn.MaskedPrefs{
+		RemoteConfigSet: true,
+		Prefs:           ipn.Prefs{RemoteConfig: false},
+	})
+	if err != nil {
+		t.Fatalf("marshal patch off: %v", err)
+	}
+	resp = doReq("PATCH", "/remoteapi/localapi/v0/prefs", patch)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("PATCH RemoteConfig=false via proxy: got %d %q; want 200", resp.StatusCode, readBody(resp))
+	}
+	resp.Body.Close()
+
+	if err := tstest.WaitFor(5*time.Second, func() error {
+		resp := doReq("GET", "/remoteapi/localapi/v0/prefs", nil)
+		defer resp.Body.Close()
+		if resp.StatusCode == http.StatusForbidden {
+			return nil
+		}
+		return fmt.Errorf("still not 403; got %d", resp.StatusCode)
+	}); err != nil {
+		t.Fatalf("after disabling RemoteConfig, proxy did not start rejecting: %v", err)
+	}
+
+	// Case 5: A path outside the /remoteapi/localapi/ prefix should fall
+	// through the router. The router returns "unknown c2n path" with 400.
+	resp = doReq("GET", "/remoteapi/nope", nil)
+	if resp.StatusCode == http.StatusOK {
+		body := readBody(resp)
+		t.Errorf("unexpected 200 for /remoteapi/nope; body=%q", body)
+	}
+	resp.Body.Close()
+}
diff --git a/feature/remoteconfig/remoteconfig.go b/feature/remoteconfig/remoteconfig.go
new file mode 100644
index 000000000..07baa9c94
--- /dev/null
+++ b/feature/remoteconfig/remoteconfig.go
@@ -0,0 +1,94 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package remoteconfig registers a c2n endpoint that lets the control
+// plane invoke this node's LocalAPI when Prefs.RemoteConfig is true.
+//
+// # Trust model
+//
+// Tailscale's default posture is per-feature double opt-in: the tailnet
+// admin can request something server-side, but the local machine owner
+// still has to consent (via CLI, GUI, or LocalAPI) for each individual
+// setting. RemoteConfig is a different, more permissive posture: a
+// single client-side "I trust the tailnet admin" switch. Once
+// Prefs.RemoteConfig is true, the control plane can invoke any of this
+// node's LocalAPI endpoints (which includes read/write of every pref)
+// with no further local consent.
+//
+// This is appropriate when the tailnet admin owns the machine (e.g. a
+// corporate fleet device) or when the local user has explicitly
+// delegated full control to the tailnet admin. It should NOT be used
+// on personal or BYOD devices where the tailnet admin is not fully
+// trusted.
+package remoteconfig
+
+import (
+	"net/http"
+	"strings"
+
+	"tailscale.com/feature"
+	"tailscale.com/ipn/ipnauth"
+	"tailscale.com/ipn/ipnlocal"
+	"tailscale.com/ipn/localapi"
+)
+
+// c2nPrefix is the c2n URL path prefix under which requests are
+// proxied to this node's LocalAPI at /localapi/*, regardless of the
+// LocalAPI version (v0, v1, ...).
+const c2nPrefix = "/remoteapi/localapi/"
+
+// localAPIStrip is the portion of c2nPrefix that must be stripped from
+// the incoming c2n path to yield the LocalAPI path.
+const localAPIStrip = "/remoteapi"
+
+func init() {
+	feature.Register("remoteconfig")
+	ipnlocal.RegisterC2NPrefix(c2nPrefix, handleC2NRemoteAPI)
+}
+
+// handleC2NRemoteAPI proxies c2n requests under /remoteapi/localapi/*
+// to this node's LocalAPI at /localapi/*, with full read/write
+// permission, when the local machine has opted in via Prefs.RemoteConfig.
+//
+// See the package doc for the trust model this handler represents.
+func handleC2NRemoteAPI(b *ipnlocal.LocalBackend, w http.ResponseWriter, r *http.Request) {
+	prefs := b.Prefs()
+	if !prefs.Valid() || !prefs.RemoteConfig() {
+		http.Error(w, "remote config not enabled by local machine", http.StatusForbidden)
+		return
+	}
+	if !strings.HasPrefix(r.URL.Path, c2nPrefix) {
+		http.Error(w, "unexpected remote-config path", http.StatusBadRequest)
+		return
+	}
+
+	// Rewrite the URL from /remoteapi/localapi/X to /localapi/X on a
+	// shallow clone so we don't mutate the caller's Request.
+	u := *r.URL
+	u.Path = strings.TrimPrefix(r.URL.Path, localAPIStrip)
+	if r.URL.RawPath != "" {
+		u.RawPath = strings.TrimPrefix(r.URL.RawPath, localAPIStrip)
+	}
+	r2 := r.WithContext(r.Context())
+	r2.URL = &u
+	if u.Path == r.URL.Path {
+		// Prefix strip did nothing; refuse rather than looping.
+		http.Error(w, "unexpected remote-config path", http.StatusBadRequest)
+		return
+	}
+	if !strings.HasPrefix(u.Path, "/localapi/") {
+		http.Error(w, "unexpected remote-config path", http.StatusBadRequest)
+		return
+	}
+
+	lah := localapi.NewHandler(localapi.HandlerConfig{
+		Actor:    ipnauth.Self,
+		Backend:  b,
+		Logf:     b.Logger(),
+		LogID:    b.BackendLogID(),
+		EventBus: b.Sys().Bus.Get(),
+	})
+	lah.PermitRead = true
+	lah.PermitWrite = true
+	lah.ServeHTTP(w, r2)
+}
diff --git a/feature/routecheck/ipn.go b/feature/routecheck/ipn.go
new file mode 100644
index 000000000..b1f30454f
--- /dev/null
+++ b/feature/routecheck/ipn.go
@@ -0,0 +1,32 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package routecheck
+
+import (
+	"tailscale.com/ipn/ipnext"
+	"tailscale.com/ipn/ipnlocal"
+	"tailscale.com/net/routecheck"
+)
+
+// ClientFor returns the [routecheck.Client] for a given backend,
+// or nil if route checking is not available for that backend.
+func ClientFor(b *ipnlocal.LocalBackend) *routecheck.Client {
+	e, ok := ipnlocal.GetExt[*Extension](b)
+	if e == nil || !ok {
+		return nil
+	}
+	return e.Client
+}
+
+// Report contains the result of a single routecheck.
+type Report = routecheck.Report
+
+// NodeBackender is a shim between [ipnext.Host] and [routecheck.NodeBackender].
+type nodeBackender struct{ ipnext.Host }
+
+var _ routecheck.NodeBackender = nodeBackender{}
+
+func (nb nodeBackender) NodeBackend() routecheck.NodeBackend {
+	return nb.Host.NodeBackend()
+}
diff --git a/feature/routecheck/localapi.go b/feature/routecheck/localapi.go
new file mode 100644
index 000000000..6f0df7ef6
--- /dev/null
+++ b/feature/routecheck/localapi.go
@@ -0,0 +1,84 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package routecheck
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"time"
+
+	jsonv2 "github.com/go-json-experiment/json"
+	jsonv1 "github.com/go-json-experiment/json/v1"
+
+	"tailscale.com/ipn/ipnlocal"
+	"tailscale.com/ipn/localapi"
+	"tailscale.com/net/routecheck"
+	"tailscale.com/util/def"
+	"tailscale.com/util/httpm"
+)
+
+func init() {
+	localapi.Register("routecheck", serveRouteCheck)
+	localapi.HookRouteCheckRefresh.Set(routeCheckRefresh)
+}
+
+// ServeRouteCheck handles the API endpoint that serves the routecheck Report.
+// If the probe form field is true, then this handler will refresh the Report
+// before serving it.
+// If the timeout form field is a valid duration, the probe will consider a node
+// to be unreachable if it doesn’t respond before the timeout expires.
+func serveRouteCheck(h *localapi.Handler, w http.ResponseWriter, r *http.Request) {
+	rc := ClientFor(h.LocalBackend())
+	if rc == nil {
+		http.Error(w, "routecheck is not enabled", http.StatusServiceUnavailable)
+		return
+	}
+
+	if r.Method != httpm.POST {
+		http.Error(w, "want POST", http.StatusMethodNotAllowed)
+		return
+	}
+
+	report := rc.Report()
+	if def.Bool(r.FormValue("probe"), false) {
+		timeout := def.Duration(r.FormValue("timeout"), routecheck.DefaultTimeout)
+		timeout = clampRouteCheckTimeout(timeout)
+		rp, err := rc.Refresh(r.Context(), timeout)
+		if err != nil {
+			localapi.WriteErrorJSON(w, err)
+			return
+		}
+		report = rp
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	if report == nil {
+		w.WriteHeader(http.StatusNoContent)
+		return
+	}
+
+	// TODO(sfllaw): Since ipn/localapi is still using encoding/json
+	// with its default options, marshal with DefaultOptionsV1.
+	jsonv2.MarshalWrite(w, report, jsonv1.DefaultOptionsV1())
+}
+
+func clampRouteCheckTimeout(timeout time.Duration) time.Duration {
+	if timeout < 0 {
+		timeout = routecheck.DefaultTimeout
+	}
+	return min(max(0, timeout), 60*time.Second) // clamp to [0s, 60s]
+}
+
+// routeCheckRefresh is a localapi hook for refreshing the [routecheck.Client.Report].
+// If the timeout is 0, all probes will timeout immediately.
+// If the timeout is negative, then all probes will use the [DefaultTimeout].
+func routeCheckRefresh(b *ipnlocal.LocalBackend, ctx context.Context, timeout time.Duration) error {
+	rc := ClientFor(b)
+	if rc == nil {
+		return errors.New("routecheck is not enabled")
+	}
+	_, err := rc.Refresh(ctx, clampRouteCheckTimeout(timeout))
+	return err
+}
diff --git a/feature/routecheck/routecheck.go b/feature/routecheck/routecheck.go
new file mode 100644
index 000000000..e4682c0d5
--- /dev/null
+++ b/feature/routecheck/routecheck.go
@@ -0,0 +1,179 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package routecheck registers support for RouteCheck,
+// which checks the reachability of overlapping routers.
+//
+// When there are multiple network paths to an IP address, it is being routed by
+// overlapping routers. The client uses reachability to pick between those
+// paths: either sticking with an active WireGuard session or choosing from the
+// peers that it has determined it can reach. It doesn’t need reachability for
+// IP addresses that have only one network path, since it can naively attempt to
+// establish a WireGuard session.
+package routecheck
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"sync"
+
+	"tailscale.com/ipn/ipnext"
+	"tailscale.com/ipn/ipnlocal"
+	"tailscale.com/net/routecheck"
+	"tailscale.com/tailcfg"
+	"tailscale.com/types/logger"
+	"tailscale.com/util/eventbus"
+)
+
+// FeatureName is the name of the feature implemented by this package.
+// It is also the [extension] name and the log prefix.
+const featureName = "routecheck"
+
+func init() {
+	ipnext.RegisterExtension(featureName, func(logf logger.Logf, b ipnext.SafeBackend) (ipnext.Extension, error) {
+		return &Extension{
+			logf:    logger.WithPrefix(logf, featureName+": "),
+			backend: b,
+		}, nil
+	})
+
+	ipnlocal.HookRouteCheckReport.Set(routeCheckReport)
+}
+
+// Extension implements the [ipnext.Extension] interface.
+type Extension struct {
+	Client *routecheck.Client
+
+	logf    logger.Logf
+	backend ipnext.SafeBackend
+	ec      *eventbus.Client
+	nb      nodeBackender
+	nm      routecheck.NetMapper
+	routers *RouterTracker
+
+	reconcile struct {
+		sync.Mutex
+		args   chan tailcfg.NodeView // pending arguments for StartStopWatcher
+		closed bool
+		done   chan struct{}
+	}
+}
+
+var _ ipnext.Extension = new(Extension)
+
+// Name implements the [ipnext.Extension.Name] interface method.
+func (e *Extension) Name() string {
+	return featureName
+}
+
+// Init implements the [ipnext.Extension.Init] interface method.
+func (e *Extension) Init(h ipnext.Host) error {
+	if routecheck.DebugForceClientSideReachabilityRoutecheck().EqualBool(false) {
+		return ipnext.SkipExtension
+	}
+
+	e.nb = nodeBackender{h}
+
+	nm, ok := e.backend.(routecheck.NetMapper)
+	if !ok {
+		return fmt.Errorf("backend %T does not implement routecheck.NetMapper", e.backend)
+	}
+	e.nm = nm
+
+	ipnbus, ok := e.backend.(ipnext.NotifyWatcher)
+	if !ok {
+		return fmt.Errorf("backend %T does not implement ipnext.NotifyWatcher", e.backend)
+	}
+
+	pinger := e.backend.Sys().Engine.Get()
+
+	c, err := routecheck.NewClient(context.Background(), e.logf, e.nb, e.nm, pinger)
+	if err != nil {
+		return err
+	}
+	e.Client = c
+
+	e.routers = TrackRouters(context.Background(), e.logf, ipnbus)
+	e.routers.OnNetMapAvailable = e.Client.NotifyNetMapAvailable
+	e.routers.OnRoutersChange = e.Client.NeedsIncrRefresh
+
+	bus := e.backend.Sys().Bus.Get()
+	e.ec = bus.Client("routecheck")
+	eventbus.SubscribeFunc(e.ec, e.Client.WatchForNetMonRebind)
+
+	// Watch for changes to the self node that would toggle the routecheck feature.
+	e.reconcile.args = make(chan tailcfg.NodeView, 1)
+	e.reconcile.done = make(chan struct{})
+	go e.reconcileLoop()
+	h.Hooks().OnSelfChange.Add(e.reconcileWatcher)
+
+	// Probe for reachable peers.
+	go e.Client.Start()
+
+	return nil
+}
+
+// Shutdown implements the [ipnext.Extension.Shutdown] interface method.
+func (e *Extension) Shutdown() error {
+	e.reconcile.Lock()
+	e.reconcile.closed = true
+	close(e.reconcile.args) // lock prevents reconcileWatcher from writing to this channel
+	e.reconcile.Unlock()
+
+	e.ec.Close()
+	e.routers.Close() // stop the watcher before waiting for reconcile.done
+	<-e.reconcile.done
+	return e.Client.Close()
+}
+
+// reconcileWatcher is called whenever e.routers should start, stop, or restart its watcher.
+// It may trigger a restart when self indicates that we have switched to a different tailnet or user,
+// in order to reset the internal state of e.routers and start tracking from scratch.
+// This work is performed by [Extension.reconcileLoop].
+//
+// This function must never block, because it’s called from
+// [ipnlocal.LocalBackend.SetControlClientStatus], which locks LocalBackend.mu.
+// This lock is also acquired when unwinding [ipnlocal.LocalBackend.WatchNotificationsAs]
+// which is what [RouterTracker.stopWatcherLocked] is waiting for.
+func (e *Extension) reconcileWatcher(self tailcfg.NodeView) {
+	e.reconcile.Lock()
+	defer e.reconcile.Unlock()
+	if e.reconcile.closed {
+		return
+	}
+	select {
+	case <-e.reconcile.args: // drain stale args so StartStopWatcher is always called with the latest
+	default:
+	}
+	e.reconcile.args <- self
+}
+
+// reconcileLoop starts, stops, or restarts its watcher after calls to [Extension.reconcileWatcher].
+func (e *Extension) reconcileLoop() {
+	defer close(e.reconcile.done)
+	for self := range e.reconcile.args {
+		started, err := e.routers.StartStopWatcher(self)
+		if err != nil {
+			if !errors.Is(err, ErrRouteCheckNotEnabled) {
+				e.logf("error tracking routers: %v", err)
+			}
+			continue // can be started by toggling the nodeattr
+		}
+		if started {
+			e.Client.NeedsRefresh()
+		}
+	}
+}
+
+func routeCheckReport(b *ipnlocal.LocalBackend) ipnlocal.RouteCheckReport {
+	c := ClientFor(b)
+	if c == nil {
+		return nil
+	}
+	r := c.Report()
+	if r == nil {
+		return nil
+	}
+	return r
+}
diff --git a/feature/routecheck/routertracker.go b/feature/routecheck/routertracker.go
new file mode 100644
index 000000000..4f180f1f3
--- /dev/null
+++ b/feature/routecheck/routertracker.go
@@ -0,0 +1,227 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package routecheck
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"sync"
+
+	"tailscale.com/ipn"
+	"tailscale.com/ipn/ipnext"
+	"tailscale.com/net/routecheck"
+	"tailscale.com/syncs"
+	"tailscale.com/tailcfg"
+	"tailscale.com/types/logger"
+	"tailscale.com/util/set"
+)
+
+var ErrRouteCheckNotEnabled = errors.New("routecheck not enabled")
+
+type RouterTracker struct {
+	// OnNetMapAvailable is called when the initial network map is received
+	// or is loaded from its cache.
+	OnNetMapAvailable func()
+
+	// OnRoutersChange is called when one or more peer nodes, which function as routers,
+	// have been added, removed, or change their routes.
+	OnRoutersChange func(added, modified, removed []tailcfg.NodeID)
+
+	ctx    context.Context // root context
+	logf   logger.Logf
+	ipnbus ipnext.NotifyWatcher
+
+	mu     sync.Mutex
+	closed bool
+	self   tailcfg.NodeView   // self node for the IPN bus being watched
+	cancel context.CancelFunc // non-nil iff the watcher is running
+	done   chan struct{}      // closed by the watcher goroutine when it exits
+}
+
+// TrackRouters returns a tracker for keeping track of which nodes are routers
+// by watching the IPN bus for netmap changes.
+func TrackRouters(ctx context.Context, logf logger.Logf, ipnbus ipnext.NotifyWatcher) *RouterTracker {
+	return &RouterTracker{
+		ctx:    ctx,
+		logf:   logf,
+		ipnbus: ipnbus,
+	}
+}
+
+// Close implements the [io.Closer] interface.
+func (rt *RouterTracker) Close() error {
+	if rt == nil {
+		return nil
+	}
+
+	rt.mu.Lock()
+	defer rt.mu.Unlock()
+
+	if rt.closed {
+		return nil
+	}
+	rt.closed = true
+
+	rt.stopWatcherLocked()
+	return nil
+}
+
+// StartStopWatcher starts or stops watching the IPN bus based on
+// the state of the "client-side-reachability-routecheck" node attribute:
+// see [tailcfg.NodeAttrClientSideReachabilityRouteCheck].
+//
+// StartStopWatcher considers stopping and then restarting the watcher goroutine
+// if the self node and user differ from the ones that started the current watcher.
+// It stops or starts the watcher when routecheck is disabled or enabled, respectively.
+//
+// StartStopWatcher reports whether the watcher goroutine was started,
+// either because it was previously stopped or because it needed restarting.
+func (rt *RouterTracker) StartStopWatcher(self tailcfg.NodeView) (started bool, _ error) {
+	rt.mu.Lock()
+	defer rt.mu.Unlock()
+
+	orig := rt.self
+	rt.self = self
+
+	toggled := routecheck.IsEnabled(orig) != routecheck.IsEnabled(self)
+	if toggled || !sameNode(orig, self) {
+		rt.stopWatcherLocked()
+		if err := rt.startWatcherLocked(self); err != nil {
+			return false, err
+		}
+		return true, nil
+	}
+	return false, nil
+}
+
+// sameNode reports whether a and b have the same [tailcfg.NodeView.ID]s.
+func sameNode(a, b tailcfg.NodeView) bool {
+	var aID, bID tailcfg.NodeID
+	if a.Valid() {
+		aID = a.ID()
+	}
+	if b.Valid() {
+		bID = b.ID()
+	}
+	return aID == bID
+}
+
+// startWatcherLocked launches the goroutine that watches the IPN bus.
+// rt.mu must be held and the watcher must not already be running.
+func (rt *RouterTracker) startWatcherLocked(self tailcfg.NodeView) error {
+	syncs.RequiresMutex(&rt.mu)
+	if rt.closed {
+		return fmt.Errorf("cannot start, tracker was closed")
+	}
+	if rt.cancel != nil || rt.done != nil {
+		return fmt.Errorf("cannot start, already watching IPN bus")
+	}
+
+	if !routecheck.IsEnabled(self) {
+		if !self.Valid() {
+			return ErrRouteCheckNotEnabled
+		}
+		return fmt.Errorf("%w for %v on %v", ErrRouteCheckNotEnabled, self.User(), self.ID())
+	}
+	rt.self = self
+
+	ctx, cancel := context.WithCancel(rt.ctx)
+	rt.cancel = cancel
+	rt.done = make(chan struct{})
+
+	go rt.watchIPNBus(ctx, rt.done, self)
+	return nil
+}
+
+// stopWatcherLocked cancels the watcher goroutine and waits for it to exit.
+// rt.mu must be held. It is a no-op when no watcher is running.
+//
+// Blocking while locked is safe because the watcher’s callback never locks rt.mu.
+func (rt *RouterTracker) stopWatcherLocked() {
+	syncs.RequiresMutex(&rt.mu)
+	var stopped bool
+	if rt.cancel != nil {
+		rt.cancel()
+		rt.cancel = nil
+		stopped = true
+	}
+	if rt.done != nil {
+		<-rt.done
+		rt.done = nil
+		stopped = true
+	}
+	rt.self = tailcfg.NodeView{}
+	if stopped {
+		rt.logf("stopped tracking routers")
+	}
+}
+
+// watchIPNBus subscribes to the IPN bus to learn about changes to the peer map,
+// so that it can keep track of which nodes are routers by dead-reckoning.
+// The set of routers is tracked internally to process peer churn without locking.
+//
+// When routers are added, removed, or change their routes,
+// it fires the [RouterTracker.OnRoutersChange] hook.
+// See tailscale/tailscale#12542.
+//
+// When the client gets the initial netmap after connecting to the control plane,
+// it fires the [RouterTracker.OnNetMapAvailable] hook.
+//
+// To avoid stalls, these notifications must be processed promptly
+// because we enabled [ipn.NotifyInProcessNoDisconnect] which blocks the caller.
+func (rt *RouterTracker) watchIPNBus(ctx context.Context, done chan<- struct{}, self tailcfg.NodeView) {
+	defer close(done)
+
+	routers := make(set.Set[tailcfg.NodeID])
+	const mask = ipn.NotifyInProcessNoDisconnect | ipn.NotifyInitialStatus | ipn.NotifyPeerChanges
+	rt.ipnbus.WatchNotifications(ctx, mask, nil, func(n *ipn.Notify) bool {
+		var added, modified, removed []tailcfg.NodeID
+		if s := n.InitialStatus; s != nil {
+			if rt.OnNetMapAvailable != nil {
+				rt.OnNetMapAvailable()
+			}
+			// Bootstrap the router set from the initial Status.
+			// This will trigger the initial probe for all routers.
+			for _, ps := range s.Peer {
+				if ps.IsRouter() {
+					nid := ps.NodeID
+					routers.Add(nid)
+					added = append(added, nid)
+				}
+			}
+		}
+		for _, p := range n.PeersChanged {
+			nid := p.ID
+			wasRouter := routers.Contains(p.ID)
+			isRouter := p.IsRouter()
+			switch {
+			case !wasRouter && isRouter:
+				routers.Add(nid)
+				added = append(added, nid)
+			case wasRouter && isRouter:
+				// TODO(sfllaw): Tune this to ignore changes
+				// that don’t affect this node’s status as a router.
+				modified = append(modified, nid)
+			case wasRouter && !isRouter:
+				routers.Delete(nid)
+				removed = append(removed, nid)
+			}
+		}
+		for _, nid := range n.PeersRemoved {
+			if routers.Contains(nid) {
+				routers.Delete(nid)
+				removed = append(removed, nid)
+			}
+		}
+
+		if added != nil || modified != nil || removed != nil {
+			if rt.OnRoutersChange != nil {
+				rt.OnRoutersChange(added, modified, removed)
+			}
+		}
+		return true
+	})
+	rt.logf("stopped tracking routers")
+}
diff --git a/feature/routecheck/routertracker_test.go b/feature/routecheck/routertracker_test.go
new file mode 100644
index 000000000..753fb6bf4
--- /dev/null
+++ b/feature/routecheck/routertracker_test.go
@@ -0,0 +1,267 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package routecheck_test
+
+import (
+	"context"
+	"fmt"
+	"net/netip"
+	"testing"
+	"testing/synctest"
+
+	gcmp "github.com/google/go-cmp/cmp"
+
+	"tailscale.com/feature/routecheck"
+	"tailscale.com/ipn"
+	"tailscale.com/ipn/ipnstate"
+	netroutecheck "tailscale.com/net/routecheck"
+	"tailscale.com/tailcfg"
+	"tailscale.com/types/opt"
+)
+
+func TestRouterTracker(t *testing.T) {
+	self := makeSelfNodeWithRouteCheckEnabled(t)
+
+	for _, tc := range []struct {
+		name         string
+		bus          ipnBus
+		wantAdded    []tailcfg.NodeID
+		wantModified []tailcfg.NodeID
+		wantRemoved  []tailcfg.NodeID
+	}{
+		{
+			name:         "initial",
+			bus:          ipnBus{},
+			wantAdded:    nil,
+			wantModified: nil,
+			wantRemoved:  nil,
+		},
+		{
+			name: "added",
+			bus: ipnBus{
+				{PeersChanged: []*tailcfg.Node{makeNode(1, withRoutes(netip.MustParsePrefix("192.168.1.0/24")))}},
+			},
+			wantAdded:    []tailcfg.NodeID{1},
+			wantModified: nil,
+			wantRemoved:  nil,
+		},
+		{
+			name: "modified",
+			bus: ipnBus{
+				{PeersChanged: []*tailcfg.Node{makeNode(2, withRoutes(netip.MustParsePrefix("192.168.1.0/24")))}},
+
+				{PeersChanged: []*tailcfg.Node{makeNode(2, withRoutes(netip.MustParsePrefix("192.168.2.0/24")))}},
+			},
+			wantAdded:    nil,
+			wantModified: []tailcfg.NodeID{2},
+			wantRemoved:  nil,
+		},
+		{
+			name: "removed",
+			bus: ipnBus{
+				{PeersChanged: []*tailcfg.Node{makeNode(3, withRoutes(netip.MustParsePrefix("192.168.3.0/24")))}},
+				{PeersRemoved: []tailcfg.NodeID{3}},
+			},
+			wantAdded:    nil,
+			wantModified: nil,
+			wantRemoved:  []tailcfg.NodeID{3},
+		},
+		{
+			name: "removed-already",
+			bus: ipnBus{
+				{PeersRemoved: []tailcfg.NodeID{3}},
+			},
+			wantAdded:    nil,
+			wantModified: nil,
+			wantRemoved:  nil,
+		},
+		{
+			name: "plain-node",
+			bus: ipnBus{
+				{PeersChanged: []*tailcfg.Node{makeNode(4)}},
+
+				{PeersChanged: []*tailcfg.Node{makeNode(4)}},
+			},
+			wantAdded:    nil,
+			wantModified: nil,
+			wantRemoved:  nil,
+		},
+		{
+			name: "authorized",
+			bus: ipnBus{
+				{PeersChanged: []*tailcfg.Node{makeNode(5)}},
+
+				{PeersChanged: []*tailcfg.Node{makeNode(5, withRoutes(netip.MustParsePrefix("192.168.5.0/24")))}},
+			},
+			wantAdded:    []tailcfg.NodeID{5},
+			wantModified: nil,
+			wantRemoved:  nil,
+		},
+		{
+			name: "unauthorized",
+			bus: ipnBus{
+				{PeersChanged: []*tailcfg.Node{makeNode(6, withRoutes(netip.MustParsePrefix("192.168.6.0/24")))}},
+
+				{PeersChanged: []*tailcfg.Node{makeNode(6)}},
+			},
+			wantAdded:    nil,
+			wantModified: nil,
+			wantRemoved:  []tailcfg.NodeID{6},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			synctest.Test(t, func(t *testing.T) {
+				var gotAdded, gotModified, gotRemoved []tailcfg.NodeID
+				rt := routecheck.TrackRouters(t.Context(), t.Logf, &tc.bus)
+				rt.OnRoutersChange = func(added, modified, removed []tailcfg.NodeID) {
+					gotAdded, gotModified, gotRemoved = added, modified, removed
+				}
+				defer rt.Close()
+
+				if started, err := rt.StartStopWatcher(self); err != nil {
+					t.Fatalf("error starting watcher: %v", err)
+				} else if !started {
+					t.Fatalf("failed to start watcher")
+				}
+
+				synctest.Wait()
+				if diff := gcmp.Diff(tc.wantAdded, gotAdded); diff != "" {
+					t.Errorf("mismatched added: -want, +got:\n%s", diff)
+				}
+				if diff := gcmp.Diff(tc.wantModified, gotModified); diff != "" {
+					t.Errorf("mismatched modified: -want, +got:\n%s", diff)
+				}
+				if diff := gcmp.Diff(tc.wantRemoved, gotRemoved); diff != "" {
+					t.Errorf("mismatched removed: -want, +got:\n%s", diff)
+				}
+			})
+		})
+	}
+}
+
+func TestRouterTrackerRaisesOnNetMapAvailable(t *testing.T) {
+	self := makeSelfNodeWithRouteCheckEnabled(t)
+	routers := []*tailcfg.Node{makeNode(1, withRoutes(netip.MustParsePrefix("192.168.1.0/24")))}
+
+	for _, tc := range []struct {
+		name string
+		bus  ipnBus
+		want opt.Bool
+	}{
+		{
+			name: "empty",
+			bus:  ipnBus{},
+			want: opt.ExplicitlyUnset,
+		},
+		{
+			name: "initial-status",
+			bus: ipnBus{
+				{
+					InitialStatus: &ipnstate.Status{},
+					PeersChanged:  routers,
+				},
+			},
+			want: opt.True,
+		},
+		{
+			name: "no-initial-status",
+			bus: ipnBus{
+				{
+					InitialStatus: nil,
+					PeersChanged:  routers,
+				},
+			},
+			want: opt.False,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			synctest.Test(t, func(t *testing.T) {
+				got := opt.ExplicitlyUnset
+				rt := routecheck.TrackRouters(t.Context(), t.Logf, &tc.bus)
+				rt.OnNetMapAvailable = func() {
+					t.Logf("OnNetMapAvailable")
+					got = opt.True
+				}
+				rt.OnRoutersChange = func(_, _, _ []tailcfg.NodeID) {
+					t.Logf("OnRoutersChange")
+					if got == opt.ExplicitlyUnset {
+						got = opt.False
+					}
+				}
+				defer rt.Close()
+
+				if started, err := rt.StartStopWatcher(self); err != nil {
+					t.Fatalf("error starting watcher: %v", err)
+				} else if !started {
+					t.Fatalf("failed to start watcher")
+				}
+
+				synctest.Wait()
+				if got != tc.want {
+					t.Errorf("got %v, want %v", got, tc.want)
+				}
+			})
+		})
+	}
+}
+
+func makeSelfNodeWithRouteCheckEnabled(t *testing.T) tailcfg.NodeView {
+	t.Helper()
+	self := (&tailcfg.Node{
+		CapMap: tailcfg.NodeCapMap{
+			tailcfg.NodeAttrClientSideReachability:           nil,
+			tailcfg.NodeAttrClientSideReachabilityRouteCheck: nil,
+		},
+	}).View()
+	if !netroutecheck.IsEnabled(self) {
+		t.Fatalf("routecheck not enabled for self node: %v", self)
+	}
+	return self
+}
+
+type ipnBus []ipn.Notify
+
+func (b *ipnBus) WatchNotifications(ctx context.Context, mask ipn.NotifyWatchOpt, onWatchAdded func(), fn func(roNotify *ipn.Notify) (keepGoing bool)) {
+	if ctx.Err() != nil {
+		return
+	}
+	if onWatchAdded != nil {
+		onWatchAdded()
+	}
+	for _, n := range *b {
+		if !fn(&n) {
+			return
+		}
+	}
+
+}
+
+type nodeOptFunc func(*tailcfg.Node)
+
+func makeNode(id tailcfg.NodeID, opts ...nodeOptFunc) *tailcfg.Node {
+	addresses := []netip.Prefix{
+		netip.MustParsePrefix(fmt.Sprintf("192.168.0.%d/32", id)),
+		netip.MustParsePrefix(fmt.Sprintf("fd7a:115c:a1e0::%d/128", id)),
+	}
+	node := &tailcfg.Node{
+		ID:                id,
+		StableID:          tailcfg.StableNodeID(fmt.Sprintf("stable%d", id)),
+		Name:              fmt.Sprintf("node%d", id),
+		Online:            new(true),
+		MachineAuthorized: true,
+		HomeDERP:          int(id),
+		Addresses:         addresses,
+		AllowedIPs:        addresses,
+	}
+	for _, opt := range opts {
+		opt(node)
+	}
+	return node
+}
+
+func withRoutes(routes ...netip.Prefix) nodeOptFunc {
+	return func(n *tailcfg.Node) {
+		n.AllowedIPs = append(n.AllowedIPs, routes...)
+	}
+}
diff --git a/feature/runtimemetrics/runtimemetrics.go b/feature/runtimemetrics/runtimemetrics.go
new file mode 100644
index 000000000..fd9b54ee9
--- /dev/null
+++ b/feature/runtimemetrics/runtimemetrics.go
@@ -0,0 +1,132 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package runtimemetrics exports select runtime/metrics as [tailscale.com/util/clientmetric]'s.
+package runtimemetrics
+
+import (
+	"runtime/metrics"
+	"sync"
+	"time"
+
+	"tailscale.com/feature"
+	"tailscale.com/ipn/ipnlocal"
+	"tailscale.com/util/clientmetric"
+)
+
+func init() {
+	feature.Register("runtimemetrics")
+	ipnlocal.HookSetRuntimeMetricsEnabled.Set(setEnabled)
+}
+
+var (
+	setEnabledMu  sync.Mutex // guards runningPoller
+	runningPoller *poller    // non-nil when running, otherwise nil
+)
+
+func setEnabled(enabled bool) {
+	setEnabledMu.Lock()
+	defer setEnabledMu.Unlock()
+	if enabled {
+		if runningPoller != nil {
+			return
+		}
+		runningPoller = newPoller()
+	} else {
+		if runningPoller == nil {
+			return
+		}
+		runningPoller.close()
+		runningPoller = nil
+	}
+}
+
+type poller struct {
+	closeOnce sync.Once
+	closeCh   chan struct{}
+	wg        sync.WaitGroup
+}
+
+func newPoller() *poller {
+	p := &poller{
+		closeCh: make(chan struct{}),
+	}
+	p.wg.Go(p.run)
+	return p
+}
+
+func (p *poller) close() {
+	p.closeOnce.Do(func() {
+		close(p.closeCh)
+		p.wg.Wait()
+	})
+}
+
+const (
+	// pollInterval is how frequently [poller] polls Go runtime metrics. Its
+	// value mirrors [tailscale.com/util/clientmetric.minMetricEncodeInterval],
+	// which is the minimum interval between clientmetrics emissions.
+	pollInterval = 15 * time.Second
+)
+
+type sampleNameClientmetric struct {
+	sampleName       string               // [metrics.Sample.Name]
+	clientmetricName string               // passed to clientmetric.New...
+	metric           *clientmetric.Metric // lazy init on first pollAndEmit
+}
+
+var clientmetrics = []sampleNameClientmetric{
+	{
+		// Memory occupied by live objects and dead objects that have not
+		// yet been marked free by the garbage collector.
+		sampleName:       "/memory/classes/heap/objects:bytes",
+		clientmetricName: "runtimemetrics_memory_heap_objects_bytes",
+	},
+	{
+		// All memory mapped by the Go runtime into the current process
+		// as read-write. Note that this does not include memory mapped
+		// by code called via cgo or via the syscall package. Sum of all
+		// metrics in /memory/classes.
+		sampleName:       "/memory/classes/total:bytes",
+		clientmetricName: "runtimemetrics_memory_total_bytes",
+	},
+}
+
+var registerClientmetricsOnce sync.Once
+
+func exportSamples(samples []metrics.Sample) {
+	registerClientmetricsOnce.Do(func() {
+		for i := range clientmetrics {
+			clientmetrics[i].metric = clientmetric.NewGauge(clientmetrics[i].clientmetricName)
+		}
+	})
+	for i := range samples {
+		if samples[i].Value.Kind() != metrics.KindUint64 {
+			continue
+		}
+		clientmetrics[i].metric.Set(int64(samples[i].Value.Uint64()))
+	}
+}
+
+func (p *poller) pollAndEmit() {
+	samples := make([]metrics.Sample, len(clientmetrics))
+	for i := range clientmetrics {
+		samples[i].Name = clientmetrics[i].sampleName
+	}
+	metrics.Read(samples)
+	exportSamples(samples)
+}
+
+func (p *poller) run() {
+	ticker := time.NewTicker(pollInterval)
+	defer ticker.Stop()
+	p.pollAndEmit() // pollAndEmit immediately
+	for {
+		select {
+		case <-p.closeCh:
+			return
+		case <-ticker.C:
+			p.pollAndEmit()
+		}
+	}
+}
diff --git a/feature/runtimemetrics/runtimemetrics_test.go b/feature/runtimemetrics/runtimemetrics_test.go
new file mode 100644
index 000000000..c53b6db08
--- /dev/null
+++ b/feature/runtimemetrics/runtimemetrics_test.go
@@ -0,0 +1,117 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package runtimemetrics
+
+import (
+	"testing"
+	"testing/synctest"
+	"time"
+)
+
+func TestSetEnabledEndToEnd(t *testing.T) {
+	synctest.Test(t, syncTestSetEnabledEndToEnd)
+}
+
+func syncTestSetEnabledEndToEnd(t *testing.T) {
+	getPoller := func() *poller {
+		setEnabledMu.Lock()
+		defer setEnabledMu.Unlock()
+		return runningPoller
+	}
+
+	if p := getPoller(); p != nil {
+		t.Fatalf("runningPoller not nil at test start: %p", p)
+	}
+	t.Cleanup(func() { setEnabled(false) })
+
+	// disabled -> enabled: starts a poller that immediately polls.
+	setEnabled(true)
+	p1 := getPoller()
+	if p1 == nil {
+		t.Fatal("runningPoller nil after setEnabled(true)")
+	}
+
+	// Wait for the immediate pollAndEmit to finish and the goroutine to
+	// block on the ticker.
+	synctest.Wait()
+
+	// Lazy metric registration must have happened and values must be set
+	// from a real runtime/metrics read. Both currently-tracked metrics
+	// (heap objects + total memory) are always >0 in a running Go process.
+	for i, cm := range clientmetrics {
+		if cm.metric == nil {
+			t.Fatalf("clientmetrics[%d] (%s) metric nil after first poll", i, cm.sampleName)
+		}
+		if got := cm.metric.Value(); got <= 0 {
+			t.Errorf("clientmetrics[%d] (%s) = %d after first poll, want > 0",
+				i, cm.clientmetricName, got)
+		}
+	}
+
+	// setEnabled(true) while enabled is idempotent: same poller instance.
+	setEnabled(true)
+	if p := getPoller(); p != p1 {
+		t.Fatalf("setEnabled(true) replaced poller: got %p, want %p", p, p1)
+	}
+
+	// Overwrite each gauge with a sentinel so we can prove the next tick
+	// re-reads runtime values.
+	const sentinel = int64(-1)
+	for _, cm := range clientmetrics {
+		cm.metric.Set(sentinel)
+	}
+
+	// Advance virtual time one tick. The poller's ticker fires and pollAndEmit
+	// runs again.
+	time.Sleep(pollInterval)
+	synctest.Wait()
+
+	for i, cm := range clientmetrics {
+		if got := cm.metric.Value(); got == sentinel {
+			t.Errorf("clientmetrics[%d] (%s) still sentinel %d after tick; ticker did not fire",
+				i, cm.clientmetricName, got)
+		} else if got <= 0 {
+			t.Errorf("clientmetrics[%d] (%s) = %d after tick, want > 0",
+				i, cm.clientmetricName, got)
+		}
+	}
+
+	// enabled -> disabled: stops the poller; wg.Wait inside close() means
+	// the goroutine has exited by the time setEnabled returns.
+	setEnabled(false)
+	if p := getPoller(); p != nil {
+		t.Fatalf("runningPoller %p still set after setEnabled(false)", p)
+	}
+
+	// After disabling, gauges must remain at their last polled values
+	// indefinitely (no further ticks should overwrite them).
+	for _, cm := range clientmetrics {
+		cm.metric.Set(sentinel)
+	}
+	time.Sleep(10 * pollInterval)
+	synctest.Wait()
+	for i, cm := range clientmetrics {
+		if got := cm.metric.Value(); got != sentinel {
+			t.Errorf("clientmetrics[%d] (%s) = %d after disabling; poller goroutine still running?",
+				i, cm.clientmetricName, got)
+		}
+	}
+
+	// disabled -> disabled: still a no-op.
+	setEnabled(false)
+	if p := getPoller(); p != nil {
+		t.Fatalf("runningPoller %p set after second setEnabled(false)", p)
+	}
+
+	// Re-enable creates a fresh poller, not the closed one.
+	setEnabled(true)
+	synctest.Wait()
+	p2 := getPoller()
+	if p2 == nil {
+		t.Fatal("runningPoller nil on re-enable")
+	}
+	if p2 == p1 {
+		t.Fatal("re-enable returned previously-closed poller")
+	}
+}
diff --git a/feature/serviceclientprefs/local_api.go b/feature/serviceclientprefs/local_api.go
new file mode 100644
index 000000000..b99de295e
--- /dev/null
+++ b/feature/serviceclientprefs/local_api.go
@@ -0,0 +1,68 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package serviceclientprefs
+
+import (
+	"encoding/json"
+	"errors"
+	"net/http"
+
+	"tailscale.com/client/tailscale/apitype"
+	"tailscale.com/feature/serviceclientprefs/serviceclient"
+	"tailscale.com/ipn/ipnlocal"
+	"tailscale.com/ipn/localapi"
+	"tailscale.com/util/httpm"
+)
+
+func init() {
+	localapi.Register("prefs/service-clients", serveServiceClientPrefs)
+}
+
+// serveServiceClientPrefs handles GET and POST /localapi/v0/prefs/service-clients. GET returns all
+// of the current profile's service client prefs. POST merges one [apitype.ServiceClientPrefRequest]
+// into the saved service client prefs and returns the full updated set.
+func serveServiceClientPrefs(h *localapi.Handler, w http.ResponseWriter, r *http.Request) {
+	if !h.PermitRead {
+		http.Error(w, "service-clients access denied", http.StatusForbidden)
+		return
+	}
+	ext, ok := ipnlocal.GetExt[*extension](h.LocalBackend())
+	if !ok {
+		http.Error(w, "misconfigured serviceclientprefs extension", http.StatusInternalServerError)
+		return
+	}
+	var out serviceclient.Prefs
+	switch r.Method {
+	case httpm.GET:
+		var err error
+		if out, err = ext.serviceClientPrefs(); err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+	case httpm.POST:
+		if !h.PermitWrite {
+			http.Error(w, "service-clients write access denied", http.StatusForbidden)
+			return
+		}
+		var req apitype.ServiceClientPrefRequest
+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+			http.Error(w, err.Error(), http.StatusBadRequest)
+			return
+		}
+		var err error
+		if out, err = ext.setServiceClientPref(req); err != nil {
+			status := http.StatusInternalServerError
+			if errors.Is(err, errInvalidServiceClientPref) {
+				status = http.StatusBadRequest
+			}
+			http.Error(w, err.Error(), status)
+			return
+		}
+	default:
+		http.Error(w, "use GET or POST", http.StatusMethodNotAllowed)
+		return
+	}
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(out)
+}
diff --git a/feature/serviceclientprefs/service_client.go b/feature/serviceclientprefs/service_client.go
new file mode 100644
index 000000000..6d1b09fdb
--- /dev/null
+++ b/feature/serviceclientprefs/service_client.go
@@ -0,0 +1,98 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package serviceclientprefs
+
+import (
+	"encoding/json"
+	"errors"
+
+	"tailscale.com/client/tailscale/apitype"
+	"tailscale.com/feature/serviceclientprefs/serviceclient"
+	"tailscale.com/ipn"
+)
+
+// errInvalidServiceClientPref is returned by [extension.setServiceClientPref] for a request that
+// fails validation, such as a missing key. The handler maps it to a 400, unlike backend failures.
+var errInvalidServiceClientPref = errors.New("service client pref key is required")
+
+// serviceClientPrefs returns the saved service client prefs for the current profile. It returns an
+// empty, non-nil map when nothing has been saved yet, or when there's no current profile (a logged
+// out node simply has no service client prefs).
+func (e *extension) serviceClientPrefs() (serviceclient.Prefs, error) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	return e.loadLocked()
+}
+
+// setServiceClientPref merges the non-empty fields from [apitype.ServiceClientPrefRequest] into the
+// saved pref for its key, stamps [serviceclient.Pref.LastUsed] with the current time, and returns
+// the full updated service client prefs for the current profile.
+func (e *extension) setServiceClientPref(req apitype.ServiceClientPrefRequest) (serviceclient.Prefs, error) {
+	if req.Key == "" {
+		return nil, errInvalidServiceClientPref
+	}
+
+	// Hold mu across the whole read, change, and write so two writers can't clobber each other,
+	// since each writes back the full prefs map.
+	e.mu.Lock()
+	defer e.mu.Unlock()
+
+	prefs, err := e.loadLocked()
+	if err != nil {
+		return nil, err
+	}
+	pref := prefs[req.Key]
+	if req.Client != "" {
+		pref.Client = req.Client
+	}
+	if req.Username != "" {
+		pref.Username = req.Username
+	}
+	if req.DatabaseName != "" {
+		pref.DatabaseName = req.DatabaseName
+	}
+	pref.LastUsed = e.sb.Clock().Now()
+	prefs[req.Key] = pref
+
+	if err := e.saveLocked(prefs); err != nil {
+		return nil, err
+	}
+	return prefs, nil
+}
+
+// loadLocked reads the current profile's prefs, returning an empty map when there's no store (no
+// current profile) or nothing saved yet. The caller must hold e.mu.
+func (e *extension) loadLocked() (serviceclient.Prefs, error) {
+	if e.store == nil {
+		return serviceclient.Prefs{}, nil
+	}
+	data, err := e.store.ReadState(storeKey)
+	if errors.Is(err, ipn.ErrStateNotExist) {
+		return serviceclient.Prefs{}, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	var prefs serviceclient.Prefs
+	if err := json.Unmarshal(data, &prefs); err != nil {
+		return nil, err
+	}
+	if prefs == nil {
+		prefs = serviceclient.Prefs{}
+	}
+	return prefs, nil
+}
+
+// saveLocked writes prefs to the current profile's store. It returns an error when there's no
+// store to persist to (no current profile, or the store failed to build). The caller must hold e.mu.
+func (e *extension) saveLocked(prefs serviceclient.Prefs) error {
+	if e.store == nil {
+		return errors.New("no store available to persist service client prefs")
+	}
+	data, err := json.Marshal(prefs)
+	if err != nil {
+		return err
+	}
+	return e.store.WriteState(storeKey, data)
+}
diff --git a/feature/serviceclientprefs/service_client_test.go b/feature/serviceclientprefs/service_client_test.go
new file mode 100644
index 000000000..8fdcd82f7
--- /dev/null
+++ b/feature/serviceclientprefs/service_client_test.go
@@ -0,0 +1,116 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package serviceclientprefs
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"tailscale.com/client/tailscale/apitype"
+	"tailscale.com/feature/serviceclientprefs/serviceclient"
+	"tailscale.com/ipn"
+)
+
+func TestServiceClientPrefsSetAndGet(t *testing.T) {
+	tests := []struct {
+		name     string
+		requests []apitype.ServiceClientPrefRequest
+		want     serviceclient.Prefs
+	}{
+		{
+			name:     "records_a_single_launch",
+			requests: []apitype.ServiceClientPrefRequest{{Key: "ssh:22", Client: "terminal", Username: "rollie"}},
+			want:     serviceclient.Prefs{"ssh:22": {Client: "terminal", Username: "rollie"}},
+		},
+		{
+			name: "partial_update_preserves_existing_fields",
+			requests: []apitype.ServiceClientPrefRequest{
+				{Key: "ssh:22", Client: "terminal", Username: "rollie"},
+				{Key: "ssh:22", Client: "iterm2"},
+			},
+			want: serviceclient.Prefs{"ssh:22": {Client: "iterm2", Username: "rollie"}},
+		},
+		{
+			name: "independent_services_kept_separate",
+			requests: []apitype.ServiceClientPrefRequest{
+				{Key: "ssh:22", Client: "terminal"},
+				{Key: "db:5432", Client: "psql", DatabaseName: "prod"},
+			},
+			want: serviceclient.Prefs{
+				"ssh:22":  {Client: "terminal"},
+				"db:5432": {Client: "psql", DatabaseName: "prod"},
+			},
+		},
+	}
+
+	ignoreLastUsed := cmpopts.IgnoreFields(serviceclient.Pref{}, "LastUsed")
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			e := newTestExtension(t, "pid")
+			for _, req := range tt.requests {
+				if _, err := e.setServiceClientPref(req); err != nil {
+					t.Fatal(err)
+				}
+			}
+			got, err := e.serviceClientPrefs()
+			if err != nil {
+				t.Fatal(err)
+			}
+			if diff := cmp.Diff(tt.want, got, ignoreLastUsed, cmpopts.EquateEmpty()); diff != "" {
+				t.Errorf("(-want +got):\n%s", diff)
+			}
+			for key := range tt.want {
+				if got[key].LastUsed.IsZero() {
+					t.Errorf("%s: LastUsed was not stamped", key)
+				}
+			}
+		})
+	}
+}
+
+func TestServiceClientPrefsEmptyKeyRejected(t *testing.T) {
+	e := newTestExtension(t, "pid")
+	_, err := e.setServiceClientPref(apitype.ServiceClientPrefRequest{Client: "terminal"})
+	if !errors.Is(err, errInvalidServiceClientPref) {
+		t.Errorf("want errInvalidServiceClientPref for empty key, got %v", err)
+	}
+}
+
+func TestServiceClientPrefsNoCurrentProfileReturnsEmpty(t *testing.T) {
+	e := newTestExtension(t, "") // no current profile
+	got, err := e.serviceClientPrefs()
+	if err != nil {
+		t.Fatalf("want nil error for no current profile, got %v", err)
+	}
+	if got == nil || len(got) != 0 {
+		t.Errorf("want empty non-nil map, got %#v", got)
+	}
+}
+
+func TestServiceClientPrefsRepopulatedOnProfileSwitch(t *testing.T) {
+	e := newTestExtension(t, "pid0")
+
+	// Save a pref for pid0.
+	if _, err := e.setServiceClientPref(apitype.ServiceClientPrefRequest{Key: "ssh:22", Client: "terminal"}); err != nil {
+		t.Fatal(err)
+	}
+
+	// Switch to a different profile; it must not see pid0's data.
+	e.onChangeProfile((&ipn.LoginProfile{ID: "pid1"}).View(), ipn.PrefsView{}, false)
+	if got, _ := e.serviceClientPrefs(); len(got) != 0 {
+		t.Fatalf("pid1 unexpectedly saw pid0's prefs: %v", got)
+	}
+
+	// Switch back to pid0; its saved pref should be read back from disk into the cache.
+	e.onChangeProfile((&ipn.LoginProfile{ID: "pid0"}).View(), ipn.PrefsView{}, false)
+	got, err := e.serviceClientPrefs()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got["ssh:22"].Client != "terminal" {
+		t.Errorf("after switching back, got %v, want Client=terminal", got["ssh:22"])
+	}
+}
diff --git a/feature/serviceclientprefs/serviceclient/serviceclient.go b/feature/serviceclientprefs/serviceclient/serviceclient.go
new file mode 100644
index 000000000..ed9a90413
--- /dev/null
+++ b/feature/serviceclientprefs/serviceclient/serviceclient.go
@@ -0,0 +1,35 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package serviceclient holds the types for the desktop clients' saved service launch preferences.
+// They're shared by the serviceclientprefs feature and the LocalAPI client.
+package serviceclient
+
+import (
+	"time"
+)
+
+// Prefs maps a service key to the user's saved preferences for that service.
+// Keys are "<serviceName>:<port>" where serviceName is a [tailcfg.ServiceName]
+// (e.g. key "svc:my-db:5432" for service "svc:my-db" on port 5432).
+type Prefs map[string]Pref
+
+// Pref captures the saved preferences for one service.
+type Pref struct {
+	// Client is the saved client identifier the user picked in the last service launch,
+	// for example, terminal/putty/iterm2/... for SSH, and dbeaver/psql/mycli/... for
+	// database. Empty means no client has been saved for this service.
+	Client string `json:",omitzero"`
+
+	// Username is the saved login name for SSH and future services that require username.
+	// Empty means none saved.
+	Username string `json:",omitzero"`
+
+	// DatabaseName is the saved DB name (database service types). Empty means none saved.
+	DatabaseName string `json:",omitzero"`
+
+	// LastUsed is when this service was last launched. Zero means never.
+	// When the macOS and Windows apps generate a "recently used" list, they sort by
+	// LastUsed descending.
+	LastUsed time.Time `json:",omitzero"`
+}
diff --git a/feature/serviceclientprefs/serviceclientprefs.go b/feature/serviceclientprefs/serviceclientprefs.go
new file mode 100644
index 000000000..88a2d2cfe
--- /dev/null
+++ b/feature/serviceclientprefs/serviceclientprefs.go
@@ -0,0 +1,102 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package serviceclientprefs stores the desktop clients' saved service launch preferences, in a
+// file per login profile.
+package serviceclientprefs
+
+import (
+	"encoding/hex"
+	"path/filepath"
+	"sync"
+
+	"tailscale.com/feature"
+	"tailscale.com/ipn"
+	"tailscale.com/ipn/ipnext"
+	"tailscale.com/ipn/ipnlocal"
+	"tailscale.com/ipn/store"
+	"tailscale.com/ipn/store/mem"
+	"tailscale.com/types/logger"
+)
+
+const featureName = "serviceclientprefs"
+
+// storeKey is the key under which a profile's service client prefs are stored.
+const storeKey = "service-client-prefs"
+
+func init() {
+	feature.Register(featureName)
+	ipnext.RegisterExtension(featureName, newExtension)
+}
+
+// newExtension is the [ipnext.NewExtensionFn] for this feature.
+func newExtension(logf logger.Logf, sb ipnext.SafeBackend) (ipnext.Extension, error) {
+	return &extension{
+		logf: logger.WithPrefix(logf, featureName+": "),
+		sb:   sb,
+	}, nil
+}
+
+// extension stores the service client prefs for the current login profile.
+type extension struct {
+	logf logger.Logf
+	sb   ipnext.SafeBackend
+	host ipnext.Host // from Init
+
+	// mu guards store and curPID, and the read/change/write in setServiceClientPref.
+	mu     sync.Mutex
+	store  ipn.StateStore // for the current profile
+	curPID ipn.ProfileID  // the profile store is built for
+}
+
+// Name implements [ipnext.Extension].
+func (e *extension) Name() string { return featureName }
+
+// Init implements [ipnext.Extension]. It subscribes to profile changes and sets up storage for the
+// current profile.
+func (e *extension) Init(h ipnext.Host) error {
+	e.host = h
+	h.Hooks().ProfileStateChange.Add(e.onChangeProfile)
+	profile, prefs := h.Profiles().CurrentProfileState()
+	e.onChangeProfile(profile, prefs, false)
+	return nil
+}
+
+// Shutdown implements [ipnext.Extension].
+func (e *extension) Shutdown() error { return nil }
+
+// onChangeProfile builds the store for the profile we switched to. The prefs live under
+// profile-data/<id>/, which [ipnlocal.LocalBackend] removes when the profile is deleted.
+func (e *extension) onChangeProfile(profile ipn.LoginProfileView, _ ipn.PrefsView, sameNode bool) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+
+	pid := profile.ID()
+	if sameNode && e.curPID == pid && e.store != nil {
+		// Same profile, just a prefs or metadata update; keep the store we already built.
+		return
+	}
+	e.curPID = pid
+	e.store = nil
+	if pid == "" {
+		return
+	}
+	varRoot := e.sb.TailscaleVarRoot()
+	if varRoot == "" {
+		// No writable storage (ephemeral node, or a non-file [ipn.StateStore] like Kubernetes).
+		// Service client prefs are only used by the desktop clients, so an in-memory store that
+		// doesn't survive restarts is fine here.
+		e.store = new(mem.Store)
+		return
+	}
+	// Store the file under a dir plus a hex-encoded filename with no extension, matching
+	// netmapcache.Store's layout so a shared store could read these files if we consolidate later.
+	hexStoreKey := hex.EncodeToString([]byte(storeKey))
+	path := filepath.Join(varRoot, ipnlocal.ProfileDataDir, string(pid), storeKey, hexStoreKey)
+	st, err := store.NewFileStore(e.logf, path)
+	if err != nil {
+		e.logf("building store for profile %q: %v", pid, err)
+		return
+	}
+	e.store = st
+}
diff --git a/feature/serviceclientprefs/serviceclientprefs_test.go b/feature/serviceclientprefs/serviceclientprefs_test.go
new file mode 100644
index 000000000..ab3fea715
--- /dev/null
+++ b/feature/serviceclientprefs/serviceclientprefs_test.go
@@ -0,0 +1,64 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package serviceclientprefs
+
+import (
+	"testing"
+	"time"
+
+	"tailscale.com/client/tailscale/apitype"
+	"tailscale.com/ipn"
+	"tailscale.com/tsd"
+	"tailscale.com/tstest"
+	"tailscale.com/tstime"
+	"tailscale.com/types/logger"
+)
+
+// fakeBackend is a minimal [ipnext.SafeBackend] for tests. Only Clock and TailscaleVarRoot are
+// used by the extension; Sys is never called.
+type fakeBackend struct {
+	clock   tstime.Clock
+	varRoot string
+}
+
+func (f *fakeBackend) Sys() *tsd.System         { return nil }
+func (f *fakeBackend) Clock() tstime.Clock      { return f.clock }
+func (f *fakeBackend) TailscaleVarRoot() string { return f.varRoot }
+
+// newTestExtension returns an extension backed by a temp var root and a fixed test clock, with its
+// current profile set to pid.
+func newTestExtension(t *testing.T, pid ipn.ProfileID) *extension {
+	t.Helper()
+	e := &extension{
+		logf: logger.Discard,
+		sb: &fakeBackend{
+			clock:   tstest.NewClock(tstest.ClockOpts{Start: time.Now()}),
+			varRoot: t.TempDir(),
+		},
+	}
+	e.onChangeProfile((&ipn.LoginProfile{ID: pid}).View(), ipn.PrefsView{}, false)
+	return e
+}
+
+func TestNoVarRootUsesMemory(t *testing.T) {
+	e := &extension{
+		logf: logger.Discard,
+		sb: &fakeBackend{
+			clock:   tstest.NewClock(tstest.ClockOpts{Start: time.Now()}),
+			varRoot: "", // force the in-memory fallback
+		},
+	}
+	e.onChangeProfile((&ipn.LoginProfile{ID: "pid"}).View(), ipn.PrefsView{}, false)
+
+	if _, err := e.setServiceClientPref(apitype.ServiceClientPrefRequest{Key: "ssh:22", Client: "terminal"}); err != nil {
+		t.Fatal(err)
+	}
+	got, err := e.serviceClientPrefs()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got["ssh:22"].Client != "terminal" {
+		t.Errorf("in-memory store: got %v, want Client=terminal", got["ssh:22"])
+	}
+}
diff --git a/feature/syslog/syslog.go b/feature/syslog/syslog.go
new file mode 100644
index 000000000..b3301beb6
--- /dev/null
+++ b/feature/syslog/syslog.go
@@ -0,0 +1,47 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build unix
+
+// Package syslog provides the tailscaled --syslog flag, which sends the
+// daemon's logs to the system syslog daemon instead of stderr.
+package syslog
+
+import (
+	"flag"
+	"io"
+	"log"
+	"log/syslog"
+	"sync"
+
+	"tailscale.com/feature"
+)
+
+func init() {
+	feature.Register("syslog")
+	feature.HookRegisterLogSinkFlags.Set(registerFlags)
+	feature.HookLogSink.Set(logSink)
+}
+
+var useSyslog bool
+
+func registerFlags() {
+	flag.BoolVar(&useSyslog, "syslog", false, "log to the system syslog daemon instead of stderr")
+}
+
+// logSink returns the writer to which logs should be sent, pointing the
+// standard library's default logger at it on first call. It returns nil if
+// syslog logging was not requested or the syslog daemon is unreachable.
+var logSink = sync.OnceValue(func() io.Writer {
+	if !useSyslog {
+		return nil
+	}
+	w, err := syslog.New(syslog.LOG_DAEMON|syslog.LOG_INFO, "tailscaled")
+	if err != nil {
+		log.Printf("syslog: connecting to syslog daemon failed; continuing to log to stderr: %v", err)
+		return nil
+	}
+	log.SetFlags(0) // syslog records its own timestamps
+	log.SetOutput(w)
+	return w
+})
diff --git a/feature/taildrop/doc.go b/feature/taildrop/doc.go
index c394ebe82..a3243b3c2 100644
--- a/feature/taildrop/doc.go
+++ b/feature/taildrop/doc.go
@@ -1,5 +1,10 @@
 // Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
-// Package taildrop registers the taildrop (file sending) feature.
+// Package taildrop contains the implementation of the Taildrop
+// functionality including sending and retrieving files.
+// This package does not validate permissions, the caller should
+// be responsible for ensuring correct authorization.
+//
+// For related documentation see: http://go/taildrop-how-does-it-work
 package taildrop
diff --git a/feature/taildrop/ext.go b/feature/taildrop/ext.go
index abf574ebc..d0133dfa1 100644
--- a/feature/taildrop/ext.go
+++ b/feature/taildrop/ext.go
@@ -9,7 +9,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"maps"
 	"path/filepath"
 	"runtime"
 	"slices"
@@ -76,6 +75,12 @@ type Extension struct {
 	// This is currently being used for Android to use the Storage Access Framework.
 	fileOps FileOps
 
+	// directFileOps, when true, means that files received via fileOps should be
+	// delivered directly to the caller (DirectFileMode=true). Set by SetFileOps.
+	// SetStagedFileOps leaves this false so that received files are staged for
+	// explicit retrieval via WaitingFiles/OpenFile (used by the WASM JS bridge).
+	directFileOps bool
+
 	nodeBackendForTest ipnext.NodeBackend // if non-nil, pretend we're this node state for tests
 
 	mu             sync.Mutex // Lock order: lb.mu > e.mu
@@ -155,9 +160,10 @@ func (e *Extension) onChangeProfile(profile ipn.LoginProfileView, _ ipn.PrefsVie
 	// Use the provided [FileOps] implementation (typically for SAF access on Android),
 	// or create an [fsFileOps] instance rooted at fileRoot.
 	//
-	// A non-nil [FileOps] also implies that we are in DirectFileMode.
+	// A non-nil [FileOps] with directFileOps=true implies DirectFileMode (Android SAF).
+	// A non-nil [FileOps] with directFileOps=false uses staged mode (WASM JS bridge).
 	fops := e.fileOps
-	isDirectFileMode := fops != nil
+	isDirectFileMode := fops != nil && e.directFileOps
 	if fops == nil {
 		var fileRoot string
 		if fileRoot, isDirectFileMode = e.fileRoot(uid, activeLogin); fileRoot == "" {
@@ -411,14 +417,23 @@ func (e *Extension) taildropTargetStatus(p tailcfg.NodeView, nb ipnext.NodeBacke
 	return ipnstate.TaildropTargetAvailable
 }
 
-// updateOutgoingFiles updates b.outgoingFiles to reflect the given updates and
-// sends an ipn.Notify with the full list of outgoingFiles.
-func (e *Extension) updateOutgoingFiles(updates map[string]*ipn.OutgoingFile) {
+// UpdateOutgoingFiles updates the tracked set of outgoing file transfers and
+// sends an ipn.Notify with the full merged list. The updates map is keyed by
+// OutgoingFile.ID; existing entries not present in updates are preserved.
+func (e *Extension) UpdateOutgoingFiles(updates map[string]ipn.OutgoingFile) {
+	e.updateOutgoingFiles(updates)
+}
+
+// updateOutgoingFiles merges updates into e.outgoingFiles and emits an
+// ipn.Notify.
+func (e *Extension) updateOutgoingFiles(updates map[string]ipn.OutgoingFile) {
 	e.mu.Lock()
 	if e.outgoingFiles == nil {
 		e.outgoingFiles = make(map[string]*ipn.OutgoingFile, len(updates))
 	}
-	maps.Copy(e.outgoingFiles, updates)
+	for id, f := range updates {
+		e.outgoingFiles[id] = &f
+	}
 	outgoingFiles := make([]*ipn.OutgoingFile, 0, len(e.outgoingFiles))
 	for _, file := range e.outgoingFiles {
 		outgoingFiles = append(outgoingFiles, file)
diff --git a/feature/taildrop/fileops_fs.go b/feature/taildrop/fileops_fs.go
index 3ddf95d03..e0e5ab2a2 100644
--- a/feature/taildrop/fileops_fs.go
+++ b/feature/taildrop/fileops_fs.go
@@ -1,6 +1,6 @@
 // Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
-//go:build !android
+//go:build !android && !js
 
 package taildrop
 
diff --git a/feature/taildrop/fileops_js.go b/feature/taildrop/fileops_js.go
new file mode 100644
index 000000000..34cbee8d4
--- /dev/null
+++ b/feature/taildrop/fileops_js.go
@@ -0,0 +1,16 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build js
+
+package taildrop
+
+import "errors"
+
+func init() {
+	// On WASM there is no real filesystem. newFileOps is only reached when
+	// SetFileOps was not called; return a clear error rather than panicking.
+	newFileOps = func(dir string) (FileOps, error) {
+		return nil, errors.New("taildrop: no filesystem on WASM; provide fileOps in the IPN config")
+	}
+}
diff --git a/feature/taildrop/localapi.go b/feature/taildrop/localapi.go
index 2af057ae8..b11482b10 100644
--- a/feature/taildrop/localapi.go
+++ b/feature/taildrop/localapi.go
@@ -17,6 +17,7 @@ import (
 	"net/url"
 	"strconv"
 	"strings"
+	"sync"
 	"time"
 
 	"tailscale.com/client/tailscale/apitype"
@@ -127,27 +128,9 @@ func serveFilePut(h *localapi.Handler, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// Periodically report progress of outgoing files.
-	outgoingFiles := make(map[string]*ipn.OutgoingFile)
-	t := time.NewTicker(1 * time.Second)
-	progressUpdates := make(chan ipn.OutgoingFile)
-	defer close(progressUpdates)
-
-	go func() {
-		defer t.Stop()
-		defer ext.updateOutgoingFiles(outgoingFiles)
-		for {
-			select {
-			case u, ok := <-progressUpdates:
-				if !ok {
-					return
-				}
-				outgoingFiles[u.ID] = &u
-			case <-t.C:
-				ext.updateOutgoingFiles(outgoingFiles)
-			}
-		}
-	}()
+	// Notify any updates buffered at request return.
+	progress := newOutgoingProgress(ext)
+	defer progress.notify()
 
 	switch r.Method {
 	case "PUT":
@@ -157,16 +140,73 @@ func serveFilePut(h *localapi.Handler, w http.ResponseWriter, r *http.Request) {
 			Name:         filenameEscaped,
 			DeclaredSize: r.ContentLength,
 		}
-		singleFilePut(h, r.Context(), progressUpdates, w, r.Body, dstURL, file)
+		singleFilePut(h, r.Context(), progress, w, r.Body, dstURL, file)
 	case "POST":
-		multiFilePost(h, progressUpdates, w, r, peerID, dstURL)
+		multiFilePost(h, progress, w, r, peerID, dstURL)
 	default:
 		http.Error(w, "want PUT to put file", http.StatusBadRequest)
 		return
 	}
 }
 
-func multiFilePost(h *localapi.Handler, progressUpdates chan (ipn.OutgoingFile), w http.ResponseWriter, r *http.Request, peerID tailcfg.StableNodeID, dstURL *url.URL) {
+// outgoingProgress forwards file-put progress to the Taildrop Extension
+// for one localapi request. update coalesces hot-path changes; notify
+// distributes any pending updates to observers immediately, disregarding
+// the coalescing interval. The owner must call notify before returning
+// so buffered updates aren't lost.
+//
+// outgoingProgress is safe for concurrent use.
+type outgoingProgress struct {
+	ext            *Extension
+	notifyInterval time.Duration
+
+	mu      sync.Mutex
+	pending map[string]ipn.OutgoingFile // by OutgoingFile.ID
+	last    time.Time
+}
+
+func newOutgoingProgress(ext *Extension) *outgoingProgress {
+	return &outgoingProgress{
+		ext:            ext,
+		notifyInterval: time.Second,
+	}
+}
+
+// update buffers f. If notifyInterval has elapsed since the last notify,
+// pending updates are also distributed to observers.
+func (p *outgoingProgress) update(f ipn.OutgoingFile) {
+	var updates map[string]ipn.OutgoingFile
+	p.mu.Lock()
+	mak.Set(&p.pending, f.ID, f)
+	if time.Since(p.last) >= p.notifyInterval {
+		updates, p.pending = p.pending, nil
+		p.last = time.Now()
+	}
+	p.mu.Unlock()
+	if updates != nil {
+		p.ext.updateOutgoingFiles(updates)
+	}
+}
+
+// notify distributes any pending updates to observers immediately,
+// disregarding the coalescing interval. Callers should notify
+// explicitly for new files and completion events so observers don't
+// have to wait for the next coalesced send. It is safe to call
+// repeatedly.
+func (p *outgoingProgress) notify() {
+	var updates map[string]ipn.OutgoingFile
+	p.mu.Lock()
+	if len(p.pending) > 0 {
+		updates, p.pending = p.pending, nil
+		p.last = time.Now()
+	}
+	p.mu.Unlock()
+	if updates != nil {
+		p.ext.updateOutgoingFiles(updates)
+	}
+}
+
+func multiFilePost(h *localapi.Handler, progress *outgoingProgress, w http.ResponseWriter, r *http.Request, peerID tailcfg.StableNodeID, dstURL *url.URL) {
 	_, params, err := mime.ParseMediaType(r.Header.Get("Content-Type"))
 	if err != nil {
 		http.Error(w, fmt.Sprintf("invalid Content-Type for multipart POST: %s", err), http.StatusBadRequest)
@@ -209,13 +249,13 @@ func multiFilePost(h *localapi.Handler, progressUpdates chan (ipn.OutgoingFile),
 
 			for _, file := range manifest {
 				outgoingFilesByName[file.Name] = file
-				progressUpdates <- file
+				progress.update(file)
 			}
 
 			continue
 		}
 
-		if !singleFilePut(h, r.Context(), progressUpdates, ww, part, dstURL, outgoingFilesByName[part.FileName()]) {
+		if !singleFilePut(h, r.Context(), progress, ww, part, dstURL, outgoingFilesByName[part.FileName()]) {
 			return
 		}
 
@@ -271,22 +311,25 @@ func (ww *multiFilePostResponseWriter) Flush(w http.ResponseWriter) error {
 func singleFilePut(
 	h *localapi.Handler,
 	ctx context.Context,
-	progressUpdates chan (ipn.OutgoingFile),
+	progress *outgoingProgress,
 	w http.ResponseWriter,
 	body io.Reader,
 	dstURL *url.URL,
 	outgoingFile ipn.OutgoingFile,
 ) bool {
 	outgoingFile.Started = time.Now()
-	body = progresstracking.NewReader(body, 1*time.Second, func(n int, err error) {
+	progress.update(outgoingFile)
+	progress.notify()
+	body = progresstracking.NewReader(body, time.Second, func(n int, err error) {
 		outgoingFile.Sent = int64(n)
-		progressUpdates <- outgoingFile
+		progress.update(outgoingFile)
 	})
 
 	fail := func() {
 		outgoingFile.Finished = true
 		outgoingFile.Succeeded = false
-		progressUpdates <- outgoingFile
+		progress.update(outgoingFile)
+		progress.notify()
 	}
 
 	// Before we PUT a file we check to see if there are any existing partial file and if so,
@@ -351,7 +394,8 @@ func singleFilePut(
 
 	outgoingFile.Finished = true
 	outgoingFile.Succeeded = true
-	progressUpdates <- outgoingFile
+	progress.update(outgoingFile)
+	progress.notify()
 
 	return true
 }
diff --git a/feature/taildrop/paths.go b/feature/taildrop/paths.go
index 76054ef4d..fda03e79e 100644
--- a/feature/taildrop/paths.go
+++ b/feature/taildrop/paths.go
@@ -18,10 +18,21 @@ func (e *Extension) SetDirectFileRoot(root string) {
 	e.directFileRoot = root
 }
 
-// SetFileOps sets the platform specific file operations. This is used
+// SetFileOps sets the platform-specific file operations. This is used
 // to call Android's Storage Access Framework APIs.
+// It implies DirectFileMode, so received files are delivered directly to the
+// caller rather than staged for retrieval via WaitingFiles/OpenFile.
 func (e *Extension) SetFileOps(fileOps FileOps) {
 	e.fileOps = fileOps
+	e.directFileOps = true
+}
+
+// SetStagedFileOps sets the platform-specific file operations without enabling
+// DirectFileMode. Received files are staged for explicit retrieval via
+// WaitingFiles, OpenFile, and DeleteFile. Used by the WASM JS bridge.
+func (e *Extension) SetStagedFileOps(fileOps FileOps) {
+	e.fileOps = fileOps
+	e.directFileOps = false
 }
 
 func (e *Extension) setPlatformDefaultDirectFileRoot() {
diff --git a/feature/taildrop/send.go b/feature/taildrop/send.go
index 668166d44..6b5327f83 100644
--- a/feature/taildrop/send.go
+++ b/feature/taildrop/send.go
@@ -134,8 +134,9 @@ func (m *manager) PutFile(id clientID, baseName string, r io.Reader, offset, len
 		}
 	}
 
-	// Copy the contents of the file to the writer.
-	copyLength, err := io.Copy(wc, r)
+	// Copy via inFile (which wraps wc) so [incomingFile.Write] can track
+	// progress and fire periodic sendFileNotify callbacks.
+	copyLength, err := io.Copy(inFile, r)
 	if err != nil {
 		return 0, m.redactAndLogError("Copy", err)
 	}
diff --git a/feature/taildrop/taildrop.go b/feature/taildrop/taildrop.go
index 7042ca97a..9839b8330 100644
--- a/feature/taildrop/taildrop.go
+++ b/feature/taildrop/taildrop.go
@@ -1,12 +1,6 @@
 // Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
-// Package taildrop contains the implementation of the Taildrop
-// functionality including sending and retrieving files.
-// This package does not validate permissions, the caller should
-// be responsible for ensuring correct authorization.
-//
-// For related documentation see: http://go/taildrop-how-does-it-work
 package taildrop
 
 import (
diff --git a/feature/tailnetlock/tailnetlock.go b/feature/tailnetlock/tailnetlock.go
new file mode 100644
index 000000000..06ed23d4f
--- /dev/null
+++ b/feature/tailnetlock/tailnetlock.go
@@ -0,0 +1,54 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// package tailnetlock registers the tailnet lock debug C2N handler. In the
+// future, all tailnet lock code should move here.
+package tailnetlock
+
+import (
+	"fmt"
+	"net/http"
+	"strconv"
+
+	"tailscale.com/cmd/tailscale/jsonoutput"
+	"tailscale.com/feature"
+	"tailscale.com/feature/buildfeatures"
+	"tailscale.com/ipn/ipnlocal"
+)
+
+func init() {
+	feature.Register("tailnetlock")
+	ipnlocal.RegisterC2N("/debug/tka/log", handleC2NDebugTKALog)
+}
+
+const defaultC2NLogLimit = 50
+const maxC2NLogLimit = 1000
+
+func handleC2NDebugTKALog(b *ipnlocal.LocalBackend, w http.ResponseWriter, r *http.Request) {
+	if !buildfeatures.HasDebug {
+		http.Error(w, feature.ErrUnavailable.Error(), http.StatusNotImplemented)
+		return
+	}
+
+	logf := b.Logger()
+	logf("c2n: %s %s received", r.Method, r.URL)
+
+	limit := defaultC2NLogLimit
+	limitStr := r.URL.Query().Get("limit")
+	if limitStr != "" {
+		if parsed, err := strconv.Atoi(limitStr); err == nil {
+			limit = min(parsed, maxC2NLogLimit)
+		}
+	}
+
+	updates, err := b.TailnetLockLog(limit)
+	if ipnlocal.IsTailnetLockNotActive(err) {
+		http.Error(w, "tailnet lock not active", http.StatusBadRequest)
+		return
+	} else if err != nil {
+		http.Error(w, fmt.Sprintf("failed to get tailnet lock log: %v", err), http.StatusInternalServerError)
+		return
+	}
+	w.Header().Set("Content-Type", "application/json")
+	jsonoutput.PrintTailnetLockLogJSONV1(w, updates)
+}
diff --git a/feature/tailnetlock/tailnetlock_test.go b/feature/tailnetlock/tailnetlock_test.go
new file mode 100644
index 000000000..03afc4fdb
--- /dev/null
+++ b/feature/tailnetlock/tailnetlock_test.go
@@ -0,0 +1,143 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package tailnetlock
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"tailscale.com/ipn/ipnlocal"
+	"tailscale.com/tka"
+	"tailscale.com/types/key"
+	"tailscale.com/util/must"
+)
+
+func TestHandleC2NDebugTKA(t *testing.T) {
+	makeTKA := func(length int) (tka.CompactableChonk, *tka.Authority) {
+		if length == 0 {
+			return nil, nil
+		}
+
+		signerKey := key.NewNLPrivate()
+		key1 := tka.Key{Kind: tka.Key25519, Public: signerKey.Public().Verifier(), Votes: 2}
+		state := tka.CreateStateForTest(key1)
+
+		chonk := tka.ChonkMem()
+		authority, _, err := tka.Create(chonk, state, signerKey)
+		if err != nil {
+			t.Fatalf("tka.Create() failed: %v", err)
+		}
+
+		for range length - 1 {
+			updater := authority.NewUpdater(signerKey)
+			key2 := tka.Key{Kind: tka.Key25519, Public: key.NewNLPrivate().Public().Verifier(), Votes: 2}
+			updater.AddKey(key2)
+			aums := must.Get(updater.Finalize(chonk))
+			must.Do(authority.Inform(chonk, aums))
+		}
+
+		return chonk, authority
+	}
+
+	bodyHead := func(body *bytes.Buffer) string {
+		count := 0
+		var sb strings.Builder
+		for line := range strings.Lines(body.String()) {
+			if count == 10 {
+				sb.WriteString("...")
+				break
+			}
+			sb.WriteString(line)
+			count++
+		}
+		return sb.String()
+	}
+
+	// matches [jsonoutput.PrintTailnetLockLogJSONV1]
+	type response struct {
+		SchemaVersion string
+		Messages      []any
+	}
+
+	t.Run("tailnet-lock-disabled", func(t *testing.T) {
+		b := ipnlocal.LocalBackendWithTKAForTest(nil, nil)
+
+		req := httptest.NewRequest("GET", "/debug/tka/log", nil)
+		rec := httptest.NewRecorder()
+		b.ForTest().HandleC2N(rec, req)
+
+		if rec.Code != 400 {
+			t.Fatalf("got status code: %v, want: 400\nBody: %s", rec.Code, rec.Body)
+		}
+	})
+
+	t.Run("tailnet-lock-enabled", func(t *testing.T) {
+		chonk, authority := makeTKA(2)
+		b := ipnlocal.LocalBackendWithTKAForTest(chonk, authority)
+
+		req := httptest.NewRequest("GET", "/debug/tka/log", nil)
+		rec := httptest.NewRecorder()
+		b.ForTest().HandleC2N(rec, req)
+
+		if rec.Code != 200 {
+			t.Fatalf("got status code: %v, want: 200\nBody: %s", rec.Code, bodyHead(rec.Body))
+		}
+
+		var got response
+		if err := json.Unmarshal(rec.Body.Bytes(), &got); err != nil {
+			t.Fatalf("couldn't parse JSON: %v\nbody: %s", err, bodyHead(rec.Body))
+		}
+
+		if len(got.Messages) != 2 {
+			t.Fatalf("got %d items, want 2", len(got.Messages))
+		}
+	})
+
+	t.Run("default-limit", func(t *testing.T) {
+		chonk, authority := makeTKA(60)
+		b := ipnlocal.LocalBackendWithTKAForTest(chonk, authority)
+
+		req := httptest.NewRequest("GET", "/debug/tka/log", nil)
+		rec := httptest.NewRecorder()
+		b.ForTest().HandleC2N(rec, req)
+
+		if rec.Code != 200 {
+			t.Fatalf("got status code: %v, want: 200\nBody: %s", rec.Code, bodyHead(rec.Body))
+		}
+
+		var got response
+		if err := json.Unmarshal(rec.Body.Bytes(), &got); err != nil {
+			t.Fatalf("couldn't parse JSON: %v\nbody: %s", err, bodyHead(rec.Body))
+		}
+
+		if len(got.Messages) != 50 {
+			t.Fatalf("got %d items, want 50", len(got.Messages))
+		}
+	})
+
+	t.Run("override-limit", func(t *testing.T) {
+		chonk, authority := makeTKA(65)
+		b := ipnlocal.LocalBackendWithTKAForTest(chonk, authority)
+
+		req := httptest.NewRequest("GET", "/debug/tka/log?limit=60", nil)
+		rec := httptest.NewRecorder()
+		b.ForTest().HandleC2N(rec, req)
+
+		if rec.Code != 200 {
+			t.Fatalf("got status code: %v, want: 200\nBody: %s", rec.Code, bodyHead(rec.Body))
+		}
+
+		var got response
+		if err := json.Unmarshal(rec.Body.Bytes(), &got); err != nil {
+			t.Fatalf("couldn't parse JSON: %v\nbody: %s", err, bodyHead(rec.Body))
+		}
+
+		if len(got.Messages) != 60 {
+			t.Fatalf("got %d items, want 60", len(got.Messages))
+		}
+	})
+}
diff --git a/feature/tpm/tpm.go b/feature/tpm/tpm.go
index e257aa7bc..a30bb1134 100644
--- a/feature/tpm/tpm.go
+++ b/feature/tpm/tpm.go
@@ -243,8 +243,11 @@ func (s *tpmStore) WriteState(k ipn.StateKey, bs []byte) error {
 	if bytes.Equal(s.cache[k], bs) {
 		return nil
 	}
-	s.cache[k] = bytes.Clone(bs)
-
+	if bs == nil {
+		delete(s.cache, k)
+	} else {
+		s.cache[k] = bytes.Clone(bs)
+	}
 	return s.writeSealed()
 }
 
diff --git a/flake.nix b/flake.nix
index 5c0fdbb2e..2cfe6c88e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -48,7 +48,8 @@
   }: let
     goVersion = nixpkgs.lib.fileContents ./go.toolchain.version;
     toolChainRev = nixpkgs.lib.fileContents ./go.toolchain.rev;
-    gitHash = nixpkgs.lib.fileContents ./go.toolchain.rev.sri;
+    flakeHashes = builtins.fromJSON (builtins.readFile ./flakehashes.json);
+    gitHash = flakeHashes.toolchain.sri;
     eachSystem = f:
       nixpkgs.lib.genAttrs (import systems) (system:
         f (import nixpkgs {
@@ -103,7 +104,7 @@
         name = "tailscale";
         pname = "tailscale";
         src = ./.;
-        vendorHash = pkgs.lib.fileContents ./go.mod.sri;
+        vendorHash = flakeHashes.vendor.sri;
         nativeBuildInputs = [pkgs.makeWrapper pkgs.installShellFiles];
         ldflags = ["-X tailscale.com/version.gitCommitStamp=${tailscaleRev}"];
         env.CGO_ENABLED = 0;
@@ -158,9 +159,18 @@
           # qemu and e2fsprogs are needed for natlab
           qemu
           e2fsprogs
+
+          # mtools (mcopy) and dtc are needed by the `tsapp-qemu-pi`
+          # Makefile target that boots the Tailscale appliance under qemu.
+          mtools
+          dtc
+
+          # awscli2 is used by gokrazy/build.go to import and register the
+          # Tailscale appliance AMI.
+          awscli2.out
         ];
       };
     });
   };
 }
-# nix-direnv cache busting line: sha256-aZkUnWyQokNw+lxut9Fak3CazmwYE4tXILhzfK4jeK4=
+# nix-direnv cache busting line: sha256-5ClQ5fSyEHUlhPtZI0ir8ddQRXSnqOG5VIJ3KjWtXmw=
diff --git a/flakehashes.json b/flakehashes.json
new file mode 100644
index 000000000..20736d76b
--- /dev/null
+++ b/flakehashes.json
@@ -0,0 +1,10 @@
+{
+  "toolchain": {
+    "rev": "63ae404c8203317fd3c82d972e5dc8f0fcb425cb",
+    "sri": "sha256-TwIaPmGVHO9ZwdaO/jDStgWGQtKa4smS3er1i5aTNTw="
+  },
+  "vendor": {
+    "goModSum": "sha256-eB5NyqpDoiGHKrFlobSbkZLdjfA3lSSqpPoIMhFAurc=",
+    "sri": "sha256-5ClQ5fSyEHUlhPtZI0ir8ddQRXSnqOG5VIJ3KjWtXmw="
+  }
+}
diff --git a/go.mod b/go.mod
index 5c421e167..8cb2f365d 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module tailscale.com
 
-go 1.26.2
+go 1.26.5
 
 require (
 	filippo.io/mkcert v1.4.4
@@ -10,25 +10,30 @@ require (
 	github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa
 	github.com/andybalholm/brotli v1.1.0
 	github.com/atotto/clipboard v0.1.4
-	github.com/aws/aws-sdk-go-v2 v1.41.0
-	github.com/aws/aws-sdk-go-v2/config v1.29.5
+	github.com/aws/aws-sdk-go-v2 v1.42.1
+	github.com/aws/aws-sdk-go-v2/config v1.32.17
 	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.58
+	github.com/aws/aws-sdk-go-v2/service/ec2 v1.316.1
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.75.3
-	github.com/aws/aws-sdk-go-v2/service/ssm v1.44.7
+	github.com/aws/aws-sdk-go-v2/service/ssm v1.45.0
 	github.com/axiomhq/hyperloglog v0.0.0-20240319100328-84253e514e02
-	github.com/bradfitz/go-tool-cache v0.0.0-20260216153636-9e5201344fe5
-	github.com/bradfitz/monogok v0.0.0-20260310223834-65a3d9465088
+	github.com/bradfitz/go-tool-cache v0.0.0-20260723163732-0b25549eea9b
+	github.com/bradfitz/monogok v0.0.0-20260630033929-b1eef977b41f
+	github.com/bradfitz/qemu-guest-kragent v0.0.0-20240513123539-55a43ea02a03
 	github.com/bramvdbogaerde/go-scp v1.4.0
+	github.com/chromedp/cdproto v0.0.0-20260321001828-e3e3800016bc
+	github.com/chromedp/chromedp v0.15.1
 	github.com/cilium/ebpf v0.16.0
-	github.com/coder/websocket v1.8.12
+	github.com/coder/websocket v1.8.14
 	github.com/coreos/go-iptables v0.7.1-0.20240112124308-65c67c9f46e6
 	github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf
-	github.com/creachadair/mds v0.25.9
-	github.com/creachadair/msync v0.7.1
+	github.com/creachadair/mds v0.25.13
+	github.com/creachadair/msync v0.8.1
 	github.com/creachadair/taskgroup v0.13.2
 	github.com/creack/pty v1.1.24
 	github.com/dblohm7/wingoes v0.0.0-20240119213807-a09d6be7affa
 	github.com/digitalocean/go-smbios v0.0.0-20180907143718-390a4f403a8e
+	github.com/diskfs/go-diskfs v1.9.3
 	github.com/distribution/reference v0.6.0
 	github.com/djherbis/times v1.6.0
 	github.com/dsnet/try v0.0.3
@@ -38,19 +43,25 @@ require (
 	github.com/frankban/quicktest v1.14.6
 	github.com/fxamacker/cbor/v2 v2.9.0
 	github.com/gaissmai/bart v0.26.1
-	github.com/go-json-experiment/json v0.0.0-20250813024750-ebf49471dced
+	github.com/go-json-experiment/json v0.0.0-20260214004413-d219187c3433
 	github.com/go-logr/zapr v1.3.0
 	github.com/go-ole/go-ole v1.3.0
+	github.com/go4org/hashtriemap v0.0.0-20251130024219-545ba229f689
 	github.com/go4org/plan9netshell v0.0.0-20250324183649-788daa080737
-	github.com/godbus/dbus/v5 v5.1.1-0.20230522191255-76236955d466
+	github.com/godbus/dbus/v5 v5.2.2
 	github.com/gokrazy/breakglass v0.0.0-20251229072214-9dbc0478d486
-	github.com/gokrazy/gokrazy v0.0.0-20260123094004-294c93fa173c
+	github.com/gokrazy/firmware v0.0.0-20260522070551-527ce0ed43cf
+	github.com/gokrazy/gokrazy v0.0.0-20260418085648-c38c3134b8a7
+	github.com/gokrazy/kernel.amd64 v0.0.0-20260705070735-de680abf072b
+	github.com/gokrazy/kernel.arm64 v0.0.0-20260705071517-37841c4d6ff1
+	github.com/gokrazy/kernel.rpi v0.0.0-20251127164438-9778ec0261de
+	github.com/gokrazy/rpi-eeprom v0.0.0-20260518070910-95f7328a8228
 	github.com/gokrazy/serial-busybox v0.0.0-20250119153030-ac58ba7574e7
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8
 	github.com/golang/snappy v0.0.4
 	github.com/golangci/golangci-lint v1.57.1
 	github.com/google/go-cmp v0.7.0
-	github.com/google/go-containerregistry v0.20.7
+	github.com/google/go-containerregistry v0.21.5
 	github.com/google/go-tpm v0.9.4
 	github.com/google/gopacket v1.1.19
 	github.com/google/nftables v0.2.1-0.20240414091927-5e242ec57806
@@ -63,15 +74,15 @@ require (
 	github.com/huin/goupnp v1.3.0
 	github.com/illarion/gonotify/v3 v3.0.2
 	github.com/inetaf/tcpproxy v0.0.0-20250203165043-ded522cbd03f
-	github.com/insomniacslk/dhcp v0.0.0-20231206064809-8c70d406f6d2
+	github.com/insomniacslk/dhcp v0.0.0-20240129002554-15c9b8791914
 	github.com/jellydator/ttlcache/v3 v3.1.0
-	github.com/jsimonetti/rtnetlink v1.4.0
+	github.com/jsimonetti/rtnetlink v1.4.1
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
 	github.com/kdomanski/iso9660 v0.4.0
-	github.com/klauspost/compress v1.18.2
+	github.com/klauspost/compress v1.19.1
 	github.com/kortschak/wol v0.0.0-20200729010619-da482cc4850a
-	github.com/mattn/go-colorable v0.1.13
-	github.com/mattn/go-isatty v0.0.20
+	github.com/mattn/go-colorable v0.1.15
+	github.com/mattn/go-isatty v0.0.23
 	github.com/mdlayher/genetlink v1.3.2
 	github.com/mdlayher/netlink v1.7.3-0.20250113171957-fbb4dce95f42
 	github.com/mdlayher/sdnotify v1.0.0
@@ -81,27 +92,28 @@ require (
 	github.com/pires/go-proxyproto v0.8.1
 	github.com/pkg/errors v0.9.1
 	github.com/pkg/sftp v1.13.6
-	github.com/prometheus-community/pro-bing v0.4.0
-	github.com/prometheus/client_golang v1.23.0
-	github.com/prometheus/common v0.65.0
+	github.com/prometheus/client_golang v1.23.2
+	github.com/prometheus/common v0.69.0
 	github.com/prometheus/prometheus v0.49.2-0.20240125131847-c3b8ef1694ff
+	github.com/robert-nix/ansihtml v1.0.1
 	github.com/safchain/ethtool v0.3.0
 	github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e
-	github.com/studio-b12/gowebdav v0.9.0
-	github.com/tailscale/certstore v0.1.1-0.20231202035212-d3fa0460f47e
+	github.com/studio-b12/gowebdav v0.13.0
+	github.com/tailscale/certstore v0.1.1-0.20260409135935-3638fb84b77d
 	github.com/tailscale/depaware v0.0.0-20251001183927-9c2ad255ef3f
-	github.com/tailscale/gliderssh v0.3.4-0.20260330083525-c1389c70ff89
+	github.com/tailscale/gliderssh v0.3.4-0.20260716005906-1a0f895faf28
 	github.com/tailscale/goexpect v0.0.0-20210902213824-6e8c725cea41
-	github.com/tailscale/gokrazy-kernel v0.0.0-20240728225134-3d23beabda2e
-	github.com/tailscale/golang-x-crypto v0.0.0-20250404221719-a5573b049869
+	github.com/tailscale/golang-x-crypto v0.0.0-20260720153645-2ba0bf7866ed
 	github.com/tailscale/hujson v0.0.0-20260302212456-ecc657c15afd
 	github.com/tailscale/mkctr v0.0.0-20260107121656-ea857e3e500b
 	github.com/tailscale/netlink v1.1.1-0.20240822203006-4d49adab4de7
 	github.com/tailscale/peercred v0.0.0-20250107143737-35a0c7bd7edc
+	github.com/tailscale/policybottest v0.0.0-20260626205140-6863b672b210
 	github.com/tailscale/setec v0.0.0-20251203133219-2ab774e4129a
+	github.com/tailscale/ts-gokrazy v0.0.0-20260630224145-b83088f2e52e
 	github.com/tailscale/web-client-prebuilt v0.0.0-20250124233751-d4cd19a26976
 	github.com/tailscale/wf v0.0.0-20240214030419-6fbb0a674ee6
-	github.com/tailscale/wireguard-go v0.0.0-20260304043104-4184faf59e56
+	github.com/tailscale/wireguard-go v0.0.0-20260715223240-2e01ba5b00f0
 	github.com/tailscale/xnet v0.0.0-20240729143630-8497ac4dab2e
 	github.com/tc-hib/winres v0.2.1
 	github.com/tcnksm/go-httpstat v0.2.0
@@ -111,17 +123,18 @@ require (
 	go.uber.org/zap v1.27.0
 	go4.org/mem v0.0.0-20240501181205-ae6ca9944745
 	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba
-	golang.org/x/crypto v0.46.0
-	golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b
-	golang.org/x/mod v0.31.0
-	golang.org/x/net v0.48.0
+	golang.org/x/crypto v0.54.0
+	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f
+	golang.org/x/mod v0.37.0
+	golang.org/x/net v0.56.0
 	golang.org/x/oauth2 v0.36.0
-	golang.org/x/sync v0.19.0
-	golang.org/x/sys v0.40.0
-	golang.org/x/term v0.38.0
-	golang.org/x/time v0.12.0
-	golang.org/x/tools v0.40.1-0.20260108161641-ca281cf95054
+	golang.org/x/sync v0.22.0
+	golang.org/x/sys v0.47.0
+	golang.org/x/term v0.45.0
+	golang.org/x/time v0.15.0
+	golang.org/x/tools v0.47.0
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2
+	golang.zx2c4.com/wireguard v0.0.0-20260522210424-ecfc5a8d5446
 	golang.zx2c4.com/wireguard/windows v0.5.3
 	gopkg.in/square/go-jose.v2 v2.6.0
 	gvisor.dev/gvisor v0.0.0-20260224225140-573d5e7127a8
@@ -139,6 +152,16 @@ require (
 	tailscale.com/client/tailscale/v2 v2.9.0
 )
 
+require (
+	github.com/aws/aws-sdk-go-v2/service/signin v1.0.11 // indirect
+	github.com/bmatcuk/doublestar/v4 v4.10.0 // indirect
+	github.com/google/go-github/v82 v82.0.0 // indirect
+	github.com/palantir/policy-bot v1.41.1 // indirect
+	github.com/rs/zerolog v1.34.0 // indirect
+	github.com/shurcooL/githubv4 v0.0.0-20260209031235-2402fdf4a9ed // indirect
+	github.com/shurcooL/graphql v0.0.0-20240915155400-7ee5256398cf // indirect
+)
+
 require (
 	9fans.net/go v0.0.8-0.20250307142834-96bdba94b63f // indirect
 	al.essio.dev/pkg/shellescape v1.5.1 // indirect
@@ -157,6 +180,7 @@ require (
 	github.com/armon/go-metrics v0.4.1 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
 	github.com/beevik/ntp v0.3.0 // indirect
+	github.com/benbjohnson/immutable v0.4.3
 	github.com/blang/semver/v4 v4.0.0 // indirect
 	github.com/boltdb/bolt v1.3.1 // indirect
 	github.com/bombsimon/wsl/v4 v4.2.1 // indirect
@@ -164,6 +188,7 @@ require (
 	github.com/catenacyber/perfsprint v0.7.1 // indirect
 	github.com/ccojocar/zxcvbn-go v1.0.2 // indirect
 	github.com/chai2010/gettext-go v1.0.2 // indirect
+	github.com/chromedp/sysutil v1.1.0 // indirect
 	github.com/ckaznocha/intrange v0.1.0 // indirect
 	github.com/containerd/containerd v1.7.29 // indirect
 	github.com/containerd/errdefs v1.0.0 // indirect
@@ -174,7 +199,7 @@ require (
 	github.com/cyphar/filepath-securejoin v0.6.1 // indirect
 	github.com/deckarep/golang-set/v2 v2.8.0 // indirect
 	github.com/dgryski/go-metro v0.0.0-20180109044635-280f6062b5bc // indirect
-	github.com/docker/go-connections v0.5.0 // indirect
+	github.com/docker/go-connections v0.6.0 // indirect
 	github.com/docker/go-events v0.0.0-20250808211157-605354379745 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/evanphx/json-patch v5.9.11+incompatible // indirect
@@ -186,6 +211,9 @@ require (
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
 	github.com/gobuffalo/flect v1.0.3 // indirect
+	github.com/gobwas/httphead v0.1.0 // indirect
+	github.com/gobwas/pool v0.2.1 // indirect
+	github.com/gobwas/ws v1.4.0 // indirect
 	github.com/goccy/go-yaml v1.12.0 // indirect
 	github.com/gokrazy/gokapi v0.0.0-20250222071133-506fdb322775 // indirect
 	github.com/gokrazy/internal v0.0.0-20251208203110-3c1aa9087c82 // indirect
@@ -193,8 +221,8 @@ require (
 	github.com/golangci/plugin-module-register v0.1.1 // indirect
 	github.com/google/gnostic-models v0.7.0 // indirect
 	github.com/google/go-github/v66 v66.0.0 // indirect
-	github.com/google/go-querystring v1.1.0 // indirect
-	github.com/google/renameio/v2 v2.0.0 // indirect
+	github.com/google/go-querystring v1.2.0 // indirect
+	github.com/google/renameio/v2 v2.0.2 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/gorilla/securecookie v1.1.2 // indirect
 	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
@@ -205,7 +233,7 @@ require (
 	github.com/hashicorp/go-metrics v0.5.4 // indirect
 	github.com/hashicorp/go-msgpack/v2 v2.1.2 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
-	github.com/hashicorp/golang-lru v0.6.0 // indirect
+	github.com/hashicorp/golang-lru v1.0.2 // indirect
 	github.com/jjti/go-spancheck v0.5.3 // indirect
 	github.com/jmoiron/sqlx v1.4.0 // indirect
 	github.com/josharian/native v1.1.0 // indirect
@@ -223,7 +251,9 @@ require (
 	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
 	github.com/moby/buildkit v0.20.2 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
-	github.com/moby/spdystream v0.5.0 // indirect
+	github.com/moby/moby/api v1.54.1 // indirect
+	github.com/moby/moby/client v0.4.0 // indirect
+	github.com/moby/spdystream v0.5.1 // indirect
 	github.com/moby/term v0.5.2 // indirect
 	github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
 	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
@@ -237,7 +267,7 @@ require (
 	github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 // indirect
 	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
 	github.com/stacklok/frizbee v0.1.7 // indirect
-	github.com/vishvananda/netlink v1.3.1-0.20240922070040-084abd93d350 // indirect
+	github.com/vishvananda/netlink v1.3.1 // indirect
 	github.com/xen0n/gosmopolitan v1.2.2 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
 	github.com/ykadowak/zerologlint v0.1.5 // indirect
@@ -250,11 +280,10 @@ require (
 	go.opentelemetry.io/otel/metric v1.39.0 // indirect
 	go.opentelemetry.io/otel/trace v1.39.0 // indirect
 	go.uber.org/automaxprocs v1.5.3 // indirect
-	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	go.yaml.in/yaml/v2 v2.4.4 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/crypto/x509roots/fallback v0.0.0-20260113154411-7d0074ccc6f1 // indirect
-	golang.org/x/telemetry v0.0.0-20251203150158-8fff8a5912fc // indirect
-	golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated // indirect
+	golang.org/x/telemetry v0.0.0-20260625142307-59b4966ccb57 // indirect
 	golang.org/x/xerrors v0.0.0-20240716161551-93cc26a95ae9 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20251213004720-97cd9d5aeac2 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20251222181119-0a764e51fe1b // indirect
@@ -291,20 +320,19 @@ require (
 	github.com/ashanbrown/forbidigo v1.6.0 // indirect
 	github.com/ashanbrown/makezero v1.1.1 // indirect
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.8 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.17.58 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.27
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.16 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.16 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.2 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.31 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.19.16 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.23
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.30 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.30 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.24 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.13 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.5.5 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.16 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.30 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.12 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.24.14 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.13 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.41.5
-	github.com/aws/smithy-go v1.24.0
+	github.com/aws/aws-sdk-go-v2/service/sso v1.30.17 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.21 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.42.1
+	github.com/aws/smithy-go v1.27.3
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bkielbasa/cyclop v1.2.1 // indirect
 	github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb // indirect
@@ -317,14 +345,12 @@ require (
 	github.com/charithe/durationcheck v0.0.10 // indirect
 	github.com/chavacava/garif v0.1.0 // indirect
 	github.com/cloudflare/circl v1.6.3 // indirect
-	github.com/containerd/stargz-snapshotter/estargz v0.18.1 // indirect
+	github.com/containerd/stargz-snapshotter/estargz v0.18.2 // indirect
 	github.com/curioswitch/go-reassign v0.2.0 // indirect
 	github.com/daixiang0/gci v0.12.3 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/denis-tingaikin/go-header v0.5.0 // indirect
-	github.com/docker/cli v29.0.3+incompatible // indirect
-	github.com/docker/distribution v2.8.3+incompatible // indirect
-	github.com/docker/docker v28.5.2+incompatible // indirect
+	github.com/docker/cli v29.4.0+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.9.3 // indirect
 	github.com/emicklei/go-restful/v3 v3.12.2 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
@@ -337,8 +363,8 @@ require (
 	github.com/fzipp/gocyclo v0.6.0 // indirect
 	github.com/go-critic/go-critic v0.11.2 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
-	github.com/go-git/go-billy/v5 v5.6.2 // indirect
-	github.com/go-git/go-git/v5 v5.16.5 // indirect
+	github.com/go-git/go-billy/v5 v5.8.0 // indirect
+	github.com/go-git/go-git/v5 v5.17.1 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-openapi/jsonpointer v0.21.0 // indirect
 	github.com/go-openapi/jsonreference v0.20.4 // indirect
@@ -423,13 +449,13 @@ require (
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/pelletier/go-toml/v2 v2.2.0 // indirect
-	github.com/pierrec/lz4/v4 v4.1.25 // indirect
+	github.com/pierrec/lz4/v4 v4.1.26 // indirect
 	github.com/pjbgf/sha1cd v0.3.2 // indirect
 	github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/polyfloyd/go-errorlint v1.4.8 // indirect
 	github.com/prometheus/client_model v0.6.2
-	github.com/prometheus/procfs v0.16.1 // indirect
+	github.com/prometheus/procfs v0.20.1 // indirect
 	github.com/quasilyte/go-ruleguard v0.4.2 // indirect
 	github.com/quasilyte/gogrep v0.5.0 // indirect
 	github.com/quasilyte/regex/syntax v0.0.0-20210819130434-b3f0c404a727 // indirect
@@ -442,10 +468,10 @@ require (
 	github.com/sashamelentyev/interfacebloat v1.1.0 // indirect
 	github.com/sashamelentyev/usestdlibvars v1.25.0 // indirect
 	github.com/securego/gosec/v2 v2.19.0 // indirect
-	github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
+	github.com/sergi/go-diff v1.4.0 // indirect
 	github.com/shazow/go-diff v0.0.0-20160112020656-b6b7b6733b8c // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
-	github.com/sirupsen/logrus v1.9.3 // indirect
+	github.com/sirupsen/logrus v1.9.4 // indirect
 	github.com/sivchari/containedctx v1.0.3 // indirect
 	github.com/sivchari/tenv v1.7.1 // indirect
 	github.com/skeema/knownhosts v1.3.1 // indirect
@@ -455,7 +481,7 @@ require (
 	github.com/spf13/cast v1.7.0 // indirect
 	github.com/spf13/cobra v1.10.2 // indirect
 	github.com/spf13/jwalterweatherman v1.1.0 // indirect
-	github.com/spf13/pflag v1.0.9 // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/spf13/viper v1.16.0 // indirect
 	github.com/ssgreg/nlreturn/v2 v2.2.1 // indirect
 	github.com/stbenjam/no-sprintf-host-port v0.1.1 // indirect
@@ -484,8 +510,8 @@ require (
 	gitlab.com/digitalxero/go-conventional-commit v1.0.7 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	golang.org/x/exp/typeparams v0.0.0-20240314144324-c7f7c6466f7f // indirect
-	golang.org/x/image v0.27.0 // indirect
-	golang.org/x/text v0.32.0 // indirect
+	golang.org/x/image v0.41.0
+	golang.org/x/text v0.40.0
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
diff --git a/go.mod.sri b/go.mod.sri
deleted file mode 100644
index 6ffc2c3f1..000000000
--- a/go.mod.sri
+++ /dev/null
@@ -1 +0,0 @@
-sha256-aZkUnWyQokNw+lxut9Fak3CazmwYE4tXILhzfK4jeK4=
diff --git a/go.sum b/go.sum
index cc0046798..14850aa4a 100644
--- a/go.sum
+++ b/go.sum
@@ -125,6 +125,8 @@ github.com/alexkohler/prealloc v1.0.0 h1:Hbq0/3fJPQhNkN0dR95AVrr6R7tou91y0uHG5pO
 github.com/alexkohler/prealloc v1.0.0/go.mod h1:VetnK3dIgFBBKmg0YnD9F9x6Icjd+9cvfHR56wJVlKE=
 github.com/alingse/asasalint v0.0.11 h1:SFwnQXJ49Kx/1GghOFz1XGqHYKp21Kq1nHad/0WQRnw=
 github.com/alingse/asasalint v0.0.11/go.mod h1:nCaoMhw7a9kSJObvQyVzNTPBDbNpdocqrSP7t/cW5+I=
+github.com/anchore/go-lzo v0.1.0 h1:NgAacnzqPeGH49Ky19QKLBZEuFRqtTG9cdaucc3Vncs=
+github.com/anchore/go-lzo v0.1.0/go.mod h1:3kLx0bve2oN1iDwgM1U5zGku1Tfbdb0No5qp1eL1fIk=
 github.com/andybalholm/brotli v1.1.0 h1:eLKJA0d02Lf0mVpIDgYnqXcUn0GqVmEFny3VuID1U3M=
 github.com/andybalholm/brotli v1.1.0/go.mod h1:sms7XGricyQI9K10gOSf56VKKWS4oLer58Q+mhRPtnY=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
@@ -142,51 +144,55 @@ github.com/ashanbrown/makezero v1.1.1 h1:iCQ87C0V0vSyO+M9E/FZYbu65auqH0lnsOkf5Fc
 github.com/ashanbrown/makezero v1.1.1/go.mod h1:i1bJLCRSCHOcOa9Y6MyF2FTfMZMFdHvxKHxgO5Z1axI=
 github.com/atotto/clipboard v0.1.4 h1:EH0zSVneZPSuFR11BlR9YppQTVDbh5+16AmcJi4g1z4=
 github.com/atotto/clipboard v0.1.4/go.mod h1:ZY9tmq7sm5xIbd9bOK4onWV4S6X0u6GY7Vn0Yu86PYI=
-github.com/aws/aws-sdk-go-v2 v1.41.0 h1:tNvqh1s+v0vFYdA1xq0aOJH+Y5cRyZ5upu6roPgPKd4=
-github.com/aws/aws-sdk-go-v2 v1.41.0/go.mod h1:MayyLB8y+buD9hZqkCW3kX1AKq07Y5pXxtgB+rRFhz0=
+github.com/aws/aws-sdk-go-v2 v1.42.1 h1:9eOTgu1z/dVtYpNZ3/8/XbbaX0x/BqE3HUzAzs6K0ek=
+github.com/aws/aws-sdk-go-v2 v1.42.1/go.mod h1:5pKeft2eJj+gElQ38Jqg4ibCqh+/AK33/0X3hip7IjM=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.8 h1:zAxi9p3wsZMIaVCdoiQp2uZ9k1LsZvmAnoTBeZPXom0=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.8/go.mod h1:3XkePX5dSaxveLAYY7nsbsZZrKxCyEuE5pM4ziFxyGg=
-github.com/aws/aws-sdk-go-v2/config v1.29.5 h1:4lS2IB+wwkj5J43Tq/AwvnscBerBJtQQ6YS7puzCI1k=
-github.com/aws/aws-sdk-go-v2/config v1.29.5/go.mod h1:SNzldMlDVbN6nWxM7XsUiNXPSa1LWlqiXtvh/1PrJGg=
-github.com/aws/aws-sdk-go-v2/credentials v1.17.58 h1:/d7FUpAPU8Lf2KUdjniQvfNdlMID0Sd9pS23FJ3SS9Y=
-github.com/aws/aws-sdk-go-v2/credentials v1.17.58/go.mod h1:aVYW33Ow10CyMQGFgC0ptMRIqJWvJ4nxZb0sUiuQT/A=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.27 h1:7lOW8NUwE9UZekS1DYoiPdVAqZ6A+LheHWb+mHbNOq8=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.27/go.mod h1:w1BASFIPOPUae7AgaH4SbjNbfdkxuggLyGfNFTn8ITY=
+github.com/aws/aws-sdk-go-v2/config v1.32.17 h1:FpL4/758/diKwqbytU0prpuiu60fgXKUWCpDJtApclU=
+github.com/aws/aws-sdk-go-v2/config v1.32.17/go.mod h1:OXqUMzgXytfoF9JaKkhrOYsyh72t9G+MJH8mMRaexOE=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.16 h1:r3RJBuU7X9ibt8RHbMjWE6y60QbKBiII6wSrXnapxSU=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.16/go.mod h1:6cx7zqDENJDbBIIWX6P8s0h6hqHC8Avbjh9Dseo27ug=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.23 h1:UuSfcORqNSz/ey3VPRS8TcVH2Ikf0/sC+Hdj400QI6U=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.23/go.mod h1:+G/OSGiOFnSOkYloKj/9M35s74LgVAdJBSD5lsFfqKg=
 github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.58 h1:/BsEGAyMai+KdXS+CMHlLhB5miAO19wOqE6tj8azWPM=
 github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.58/go.mod h1:KHM3lfl/sAJBCoLI1Lsg5w4SD2VDYWwQi7vxbKhw7TI=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.16 h1:rgGwPzb82iBYSvHMHXc8h9mRoOUBZIGFgKb9qniaZZc=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.16/go.mod h1:L/UxsGeKpGoIj6DxfhOWHWQ/kGKcd4I1VncE4++IyKA=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.16 h1:1jtGzuV7c82xnqOVfx2F0xmJcOw5374L7N6juGW6x6U=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.16/go.mod h1:M2E5OQf+XLe+SZGmmpaI2yy+J326aFf6/+54PoxSANc=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.2 h1:Pg9URiobXy85kgFev3og2CuOZ8JZUBENF+dcgWBaYNk=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.2/go.mod h1:FbtygfRFze9usAadmnGJNc8KsP346kEe+y2/oyhGAGc=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.31 h1:8IwBjuLdqIO1dGB+dZ9zJEl8wzY3bVYxcs0Xyu/Lsc0=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.31/go.mod h1:8tMBcuVjL4kP/ECEIWTCWtwV2kj6+ouEKl4cqR4iWLw=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4 h1:0ryTNEdJbzUCEWkVXEXoqlXV72J5keC1GvILMOuD00E=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4/go.mod h1:HQ4qwNZh32C3CBeO6iJLQlgtMzqeG17ziAA/3KDJFow=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.30 h1:xM/Is9cKMHa8Jj8zkvWhvrFkZsXJV9E+BB4g0HW0duQ=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.30/go.mod h1:WueJeNDZvK1fMYEWJIkcivBfEzUkTpBhzlrUKKY8EuA=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.30 h1:jn46zC9LdsVR/ZpMIJqMqb8hHv31BlLx3ulVqNspUOk=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.30/go.mod h1:1hTMsAgbdS/AtUi4bw8+gUuh1pceo+eXRLfpSuSQj3M=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.24 h1:OQqn11BtaYv1WLUowvcA30MpzIu8Ti4pcLPIIyoKZrA=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.24/go.mod h1:X5ZJyfwVrWA96GzPmUCWFQaEARPR7gCrpq2E92PJwAE=
+github.com/aws/aws-sdk-go-v2/service/ec2 v1.316.1 h1:x3XE3BMK8aUpGx/m4CwmCmxc1LnN6saZujJ5K6pIFXU=
+github.com/aws/aws-sdk-go-v2/service/ec2 v1.316.1/go.mod h1:eoF0SIRbTgKWnTcTPYckiURPba/7ilfEkvwL4V1iHK4=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.13 h1:mbRIur/BiHK6SKPjoBIXSE/hJ6g6JGRLuxQy1jGjlN4=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.13/go.mod h1:ITg9em2KbJx1s0y4aqRX5OYWG6HBZ5TVR//OdpEZ2CQ=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.5.5 h1:siiQ+jummya9OLPDEyHVb2dLW4aOMe22FGDd0sAfuSw=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.5.5/go.mod h1:iHVx2J9pWzITdP5MJY6qWfG34TfD9EA+Qi3eV6qQCXw=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.16 h1:oHjJHeUy0ImIV0bsrX0X91GkV5nJAyv1l1CC9lnO0TI=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.16/go.mod h1:iRSNGgOYmiYwSCXxXaKb9HfOEj40+oTKn8pTxMlYkRM=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.30 h1:/Z5jmNrKsSD7EmDjzAPsm/3L9IuOkzaynklJZ1qX7S4=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.30/go.mod h1:lEzEZnOosE7zi8Z6royW1cFJTD9fpab4Ul1SBrllewk=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.12 h1:tkVNm99nkJnFo1H9IIQb5QkCiPcvCDn3Pos+IeTbGRA=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.12/go.mod h1:dIVlquSPUMqEJtx2/W17SM2SuESRaVEhEV9alcMqxjw=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.75.3 h1:JBod0SnNqcWQ0+uAyzeRFG1zCHotW8DukumYYyNy0zo=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.75.3/go.mod h1:FHSHmyEUkzRbaFFqqm6bkLAOQHgqhsLmfCahvCBMiyA=
-github.com/aws/aws-sdk-go-v2/service/ssm v1.44.7 h1:a8HvP/+ew3tKwSXqL3BCSjiuicr+XTU2eFYeogV9GJE=
-github.com/aws/aws-sdk-go-v2/service/ssm v1.44.7/go.mod h1:Q7XIWsMo0JcMpI/6TGD6XXcXcV1DbTj6e9BKNntIMIM=
-github.com/aws/aws-sdk-go-v2/service/sso v1.24.14 h1:c5WJ3iHz7rLIgArznb3JCSQT3uUMiz9DLZhIX+1G8ok=
-github.com/aws/aws-sdk-go-v2/service/sso v1.24.14/go.mod h1:+JJQTxB6N4niArC14YNtxcQtwEqzS3o9Z32n7q33Rfs=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.13 h1:f1L/JtUkVODD+k1+IiSJUUv8A++2qVr+Xvb3xWXETMU=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.13/go.mod h1:tvqlFoja8/s0o+UruA1Nrezo/df0PzdunMDDurUfg6U=
-github.com/aws/aws-sdk-go-v2/service/sts v1.41.5 h1:SciGFVNZ4mHdm7gpD1dgZYnCuVdX1s+lFTg4+4DOy70=
-github.com/aws/aws-sdk-go-v2/service/sts v1.41.5/go.mod h1:iW40X4QBmUxdP+fZNOpfmkdMZqsovezbAeO+Ubiv2pk=
-github.com/aws/smithy-go v1.24.0 h1:LpilSUItNPFr1eY85RYgTIg5eIEPtvFbskaFcmmIUnk=
-github.com/aws/smithy-go v1.24.0/go.mod h1:LEj2LM3rBRQJxPZTB4KuzZkaZYnZPnvgIhb4pu07mx0=
+github.com/aws/aws-sdk-go-v2/service/signin v1.0.11 h1:TdJ+HdzOBhU8+iVAOGUTU63VXopcumCOF1paFulHWZc=
+github.com/aws/aws-sdk-go-v2/service/signin v1.0.11/go.mod h1:R82ZRExE/nheo0N+T8zHPcLRTcH8MGsnR3BiVGX0TwI=
+github.com/aws/aws-sdk-go-v2/service/ssm v1.45.0 h1:IOdss+igJDFdic9w3WKwxGCmHqUxydvIhJOm9LJ32Dk=
+github.com/aws/aws-sdk-go-v2/service/ssm v1.45.0/go.mod h1:Q7XIWsMo0JcMpI/6TGD6XXcXcV1DbTj6e9BKNntIMIM=
+github.com/aws/aws-sdk-go-v2/service/sso v1.30.17 h1:7byT8HUWrgoRp6sXjxtZwgOKfhss5fW6SkLBtqzgRoE=
+github.com/aws/aws-sdk-go-v2/service/sso v1.30.17/go.mod h1:xNWknVi4Ezm1vg1QsB/5EWpAJURq22uqd38U8qKvOJc=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.21 h1:+1Kl1zx6bWi4X7cKi3VYh29h8BvsCoHQEQ6ST9X8w7w=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.21/go.mod h1:4vIRDq+CJB2xFAXZ+YgGUTiEft7oAQlhIs71xcSeuVg=
+github.com/aws/aws-sdk-go-v2/service/sts v1.42.1 h1:F/M5Y9I3nwr2IEpshZgh1GeHpOItExNM9L1euNuh/fk=
+github.com/aws/aws-sdk-go-v2/service/sts v1.42.1/go.mod h1:mTNxImtovCOEEuD65mKW7DCsL+2gjEH+RPEAexAzAio=
+github.com/aws/smithy-go v1.27.3 h1:F3Zb497UhhskkfpJmfkXswyo+t0sh9OTBnIHjogWbVY=
+github.com/aws/smithy-go v1.27.3/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
 github.com/axiomhq/hyperloglog v0.0.0-20240319100328-84253e514e02 h1:bXAPYSbdYbS5VTy92NIUbeDI1qyggi+JYh5op9IFlcQ=
 github.com/axiomhq/hyperloglog v0.0.0-20240319100328-84253e514e02/go.mod h1:k08r+Yj1PRAmuayFiRK6MYuR5Ve4IuZtTfxErMIh0+c=
 github.com/beevik/ntp v0.2.0/go.mod h1:hIHWr+l3+/clUnF44zdK+CWW7fO8dR5cIylAQ76NRpg=
 github.com/beevik/ntp v0.3.0 h1:xzVrPrE4ziasFXgBVBZJDP0Wg/KpMwk2KHJ4Ba8GrDw=
 github.com/beevik/ntp v0.3.0/go.mod h1:hIHWr+l3+/clUnF44zdK+CWW7fO8dR5cIylAQ76NRpg=
+github.com/benbjohnson/immutable v0.4.3 h1:GYHcksoJ9K6HyAUpGxwZURrbTkXA0Dh4otXGqbhdrjA=
+github.com/benbjohnson/immutable v0.4.3/go.mod h1:qJIKKSmdqz1tVzNtst1DZzvaqOU1onk1rc03IeM3Owk=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
@@ -199,14 +205,18 @@ github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM
 github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
 github.com/blizzy78/varnamelen v0.8.0 h1:oqSblyuQvFsW1hbBHh1zfwrKe3kcSj0rnXkKzsQ089M=
 github.com/blizzy78/varnamelen v0.8.0/go.mod h1:V9TzQZ4fLJ1DSrjVDfl89H7aMnTvKkApdHeyESmyR7k=
+github.com/bmatcuk/doublestar/v4 v4.10.0 h1:zU9WiOla1YA122oLM6i4EXvGW62DvKZVxIe6TYWexEs=
+github.com/bmatcuk/doublestar/v4 v4.10.0/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/boltdb/bolt v1.3.1 h1:JQmyP4ZBrce+ZQu0dY660FMfatumYDLun9hBCUVIkF4=
 github.com/boltdb/bolt v1.3.1/go.mod h1:clJnj/oiGkjum5o1McbSZDSLxVThjynRyGBgiAx27Ps=
 github.com/bombsimon/wsl/v4 v4.2.1 h1:Cxg6u+XDWff75SIFFmNsqnIOgob+Q9hG6y/ioKbRFiM=
 github.com/bombsimon/wsl/v4 v4.2.1/go.mod h1:Xu/kDxGZTofQcDGCtQe9KCzhHphIe0fDuyWTxER9Feo=
-github.com/bradfitz/go-tool-cache v0.0.0-20260216153636-9e5201344fe5 h1:0sG3c7afYdBNlc3QyhckvZ4bV9iqlfqCQM1i+mWm0eE=
-github.com/bradfitz/go-tool-cache v0.0.0-20260216153636-9e5201344fe5/go.mod h1:78ZLITnBUCDJeU01+wYYJKaPYYgsDzJPRfxeI8qFh5g=
-github.com/bradfitz/monogok v0.0.0-20260310223834-65a3d9465088 h1:dDVY5cJ+7bQQll29aeWGx1Ima4RIGy/f1fXVs+HlIxo=
-github.com/bradfitz/monogok v0.0.0-20260310223834-65a3d9465088/go.mod h1:TG1HbU9fRVDnNgXncVkKz9GdvjIvqquXjH6QZSEVmY4=
+github.com/bradfitz/go-tool-cache v0.0.0-20260723163732-0b25549eea9b h1:XA4KY49pmsDGMUQT1P6mO7Oc5RxUWFo4PvGVZFhN3iU=
+github.com/bradfitz/go-tool-cache v0.0.0-20260723163732-0b25549eea9b/go.mod h1:w9nUVumXlQBRZtGUdvzCzjcMtL7MotWr2mKalwFZXhg=
+github.com/bradfitz/monogok v0.0.0-20260630033929-b1eef977b41f h1:voy0korWbg2e1gsJpBZ8/OBhVL8evXeUwbCZcA1PWv8=
+github.com/bradfitz/monogok v0.0.0-20260630033929-b1eef977b41f/go.mod h1:TG1HbU9fRVDnNgXncVkKz9GdvjIvqquXjH6QZSEVmY4=
+github.com/bradfitz/qemu-guest-kragent v0.0.0-20240513123539-55a43ea02a03 h1:V1gD/xbQZtimHXZ0y19oMgTVBIXQyazG/mG9JIflrIY=
+github.com/bradfitz/qemu-guest-kragent v0.0.0-20240513123539-55a43ea02a03/go.mod h1:DFLM0H5mh/gbb8viqnMwZzZ8TU4o3bbXOa5tyknrOQY=
 github.com/bramvdbogaerde/go-scp v1.4.0 h1:jKMwpwCbcX1KyvDbm/PDJuXcMuNVlLGi0Q0reuzjyKY=
 github.com/bramvdbogaerde/go-scp v1.4.0/go.mod h1:on2aH5AxaFb2G0N5Vsdy6B0Ml7k9HuHSwfo1y0QzAbQ=
 github.com/breml/bidichk v0.2.7 h1:dAkKQPLl/Qrk7hnP6P+E0xOodrq8Us7+U0o4UBOAlQY=
@@ -243,6 +253,12 @@ github.com/charithe/durationcheck v0.0.10 h1:wgw73BiocdBDQPik+zcEoBG/ob8uyBHf2iy
 github.com/charithe/durationcheck v0.0.10/go.mod h1:bCWXb7gYRysD1CU3C+u4ceO49LoGOY1C1L6uouGNreQ=
 github.com/chavacava/garif v0.1.0 h1:2JHa3hbYf5D9dsgseMKAmc/MZ109otzgNFk5s87H9Pc=
 github.com/chavacava/garif v0.1.0/go.mod h1:XMyYCkEL58DF0oyW4qDjjnPWONs2HBqYKI+UIPD+Gww=
+github.com/chromedp/cdproto v0.0.0-20260321001828-e3e3800016bc h1:wkN/LMi5vc60pBRWx6qpbk/aEvq3/ZVNpnMvsw8PVVU=
+github.com/chromedp/cdproto v0.0.0-20260321001828-e3e3800016bc/go.mod h1:cbyjALe67vDvlvdiG9369P8w5U2w6IshwtyD2f2Tvag=
+github.com/chromedp/chromedp v0.15.1 h1:EJWiPm7BNqDqjYy6U0lTSL5wNH+iNt9GjC3a4gfjNyQ=
+github.com/chromedp/chromedp v0.15.1/go.mod h1:CdTHtUqD/dqaFw/cvFWtTydoEQS44wLBuwbMR9EkOY4=
+github.com/chromedp/sysutil v1.1.0 h1:PUFNv5EcprjqXZD9nJb9b/c9ibAbxiYo4exNWZyipwM=
+github.com/chromedp/sysutil v1.1.0/go.mod h1:WiThHUdltqCNKGc4gaU50XgYjwjYIhKWoHGPTUfWTJ8=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
@@ -256,8 +272,8 @@ github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDk
 github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8=
 github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/coder/websocket v1.8.12 h1:5bUXkEPPIbewrnkU8LTCLVaxi4N4J8ahufH2vlo4NAo=
-github.com/coder/websocket v1.8.12/go.mod h1:LNVeNrXQZfe5qhS9ALED3uA+l5pPqvwXg3CKoDBB2gs=
+github.com/coder/websocket v1.8.14 h1:9L0p0iKiNOibykf283eHkKUHHrpG7f65OE3BhhO7v9g=
+github.com/coder/websocket v1.8.14/go.mod h1:NX3SzP+inril6yawo5CQXx8+fk145lPDC6pumgx0mVg=
 github.com/containerd/containerd v1.7.29 h1:90fWABQsaN9mJhGkoVnuzEY+o1XDPbg9BTC9QTAHnuE=
 github.com/containerd/containerd v1.7.29/go.mod h1:azUkWcOvHrWvaiUjSQH0fjzuHIwSPg1WL5PshGP4Szs=
 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
@@ -268,21 +284,22 @@ github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
 github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
 github.com/containerd/platforms v1.0.0-rc.2 h1:0SPgaNZPVWGEi4grZdV8VRYQn78y+nm6acgLGv/QzE4=
 github.com/containerd/platforms v1.0.0-rc.2/go.mod h1:J71L7B+aiM5SdIEqmd9wp6THLVRzJGXfNuWCZCllLA4=
-github.com/containerd/stargz-snapshotter/estargz v0.18.1 h1:cy2/lpgBXDA3cDKSyEfNOFMA/c10O1axL69EU7iirO8=
-github.com/containerd/stargz-snapshotter/estargz v0.18.1/go.mod h1:ALIEqa7B6oVDsrF37GkGN20SuvG/pIMm7FwP7ZmRb0Q=
+github.com/containerd/stargz-snapshotter/estargz v0.18.2 h1:yXkZFYIzz3eoLwlTUZKz2iQ4MrckBxJjkmD16ynUTrw=
+github.com/containerd/stargz-snapshotter/estargz v0.18.2/go.mod h1:XyVU5tcJ3PRpkA9XS2T5us6Eg35yM0214Y+wvrZTBrY=
 github.com/containerd/typeurl/v2 v2.2.3 h1:yNA/94zxWdvYACdYO8zofhrTVuQY73fFU1y++dYSw40=
 github.com/containerd/typeurl/v2 v2.2.3/go.mod h1:95ljDnPfD3bAbDJRugOiShd/DlAAsxGtUBhJxIn7SCk=
 github.com/coreos/go-iptables v0.7.1-0.20240112124308-65c67c9f46e6 h1:8h5+bWd7R6AYUslN6c6iuZWTKsKxUFDlpnmilO6R2n0=
 github.com/coreos/go-iptables v0.7.1-0.20240112124308-65c67c9f46e6/go.mod h1:Qe8Bv2Xik5FyTXwgIbLAnv2sWSBmvWdFETJConOQ//Q=
 github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf h1:iW4rZ826su+pqaw19uhpSCzhj44qo35pNgKFGqzDKkU=
 github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
+github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
 github.com/coreos/go-systemd/v22 v22.6.0 h1:aGVa/v8B7hpb0TKl0MWoAavPDmHvobFe5R5zn0bCJWo=
 github.com/coreos/go-systemd/v22 v22.6.0/go.mod h1:iG+pp635Fo7ZmV/j14KUcmEyWF+0X7Lua8rrTWzYgWU=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
-github.com/creachadair/mds v0.25.9 h1:080Hr8laN2h+l3NeVCGMBpXtIPnl9mz8e4HLraGPqtA=
-github.com/creachadair/mds v0.25.9/go.mod h1:4hatI3hRM+qhzuAmqPRFvaBM8mONkS7nsLxkcuTYUIs=
-github.com/creachadair/msync v0.7.1 h1:SeZmuEBXQPe5GqV/C94ER7QIZPwtvFbeQiykzt/7uho=
-github.com/creachadair/msync v0.7.1/go.mod h1:8CcFlLsSujfHE5wWm19uUBLHIPDAUr6LXDwneVMO008=
+github.com/creachadair/mds v0.25.13 h1:PsSUHV6zsfPd29k4kvm1rMoee1YFia7JyNGeMPmDcPM=
+github.com/creachadair/mds v0.25.13/go.mod h1:4hatI3hRM+qhzuAmqPRFvaBM8mONkS7nsLxkcuTYUIs=
+github.com/creachadair/msync v0.8.1 h1:QRd8si3qZ2Q4TaDL7tS/MG/lFE3YND7U7J9fy42eAFM=
+github.com/creachadair/msync v0.8.1/go.mod h1:dt0bscS09J8Ie3AdccK9JpCb7LfStaDGlAmDLukOlY4=
 github.com/creachadair/taskgroup v0.13.2 h1:3KyqakBuFsm3KkXi/9XIb0QcA8tEzLHLgaoidf0MdVc=
 github.com/creachadair/taskgroup v0.13.2/go.mod h1:i3V1Zx7H8RjwljUEeUWYT30Lmb9poewSb2XI1yTwD0g=
 github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
@@ -311,6 +328,8 @@ github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/r
 github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
 github.com/digitalocean/go-smbios v0.0.0-20180907143718-390a4f403a8e h1:vUmf0yezR0y7jJ5pceLHthLaYf4bA5T14B6q39S4q2Q=
 github.com/digitalocean/go-smbios v0.0.0-20180907143718-390a4f403a8e/go.mod h1:YTIHhz/QFSYnu/EhlF2SpU2Uk+32abacUYA5ZPljz1A=
+github.com/diskfs/go-diskfs v1.9.3 h1:cLciNCeZ4QAXVxyPJDr1ZJ9N9CCG3rQlQ/z/Cs/cNDM=
+github.com/diskfs/go-diskfs v1.9.3/go.mod h1:TePJORO83Adh5pb2SqsxAwaP0fofFxKLkxctiS/9OQc=
 github.com/distribution/distribution/v3 v3.0.0 h1:q4R8wemdRQDClzoNNStftB2ZAfqOiN6UX90KJc4HjyM=
 github.com/distribution/distribution/v3 v3.0.0/go.mod h1:tRNuFoZsUdyRVegq8xGNeds4KLjwLCRin/tTo6i1DhU=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
@@ -319,16 +338,12 @@ github.com/djherbis/times v1.6.0 h1:w2ctJ92J8fBvWPxugmXIv7Nz7Q3iDMKNx9v5ocVH20c=
 github.com/djherbis/times v1.6.0/go.mod h1:gOHeRAz2h+VJNZ5Gmc/o7iD9k4wW7NMVqieYCY99oc0=
 github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI=
 github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
-github.com/docker/cli v29.0.3+incompatible h1:8J+PZIcF2xLd6h5sHPsp5pvvJA+Sr2wGQxHkRl53a1E=
-github.com/docker/cli v29.0.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
-github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker v28.5.2+incompatible h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM=
-github.com/docker/docker v28.5.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/cli v29.4.0+incompatible h1:+IjXULMetlvWJiuSI0Nbor36lcJ5BTcVpUmB21KBoVM=
+github.com/docker/cli v29.4.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8=
 github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo=
-github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
-github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
+github.com/docker/go-connections v0.6.0 h1:LlMG9azAe1TqfR7sO+NJttz1gy6KO7VJBh+pMmjSD94=
+github.com/docker/go-connections v0.6.0/go.mod h1:AahvXYshr6JgfUJGdDCs2b5EZG/vmaMAntpSFH5BFKE=
 github.com/docker/go-events v0.0.0-20250808211157-605354379745 h1:yOn6Ze6IbYI/KAw2lw/83ELYvZh6hvsygTVkD0dzMC4=
 github.com/docker/go-events v0.0.0-20250808211157-605354379745/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
 github.com/docker/go-metrics v0.0.1 h1:AgB/0SvBxihN0X8OR4SjsblXkbMvalQ8cjmtKQ2rQV8=
@@ -341,6 +356,8 @@ github.com/elastic/crd-ref-docs v0.0.12 h1:F3seyncbzUz3rT3d+caeYWhumb5ojYQ6Bl0Z+
 github.com/elastic/crd-ref-docs v0.0.12/go.mod h1:X83mMBdJt05heJUYiS3T0yJ/JkCuliuhSUNav5Gjo/U=
 github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o=
 github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE=
+github.com/elliotwutingfeng/asciiset v0.0.0-20260129054604-cfde2086bc57 h1:x5yxNrq8XffV/OoNUeFPM6hxHVi5OTspSTBxr/9pemg=
+github.com/elliotwutingfeng/asciiset v0.0.0-20260129054604-cfde2086bc57/go.mod h1:GLo/8fDswSAniFG+BFIaiSPcK610jyzgEhWYPQwuQdw=
 github.com/emicklei/go-restful/v3 v3.12.2 h1:DhwDP0vY3k8ZzE0RunuJy8GhNpPL6zqLkDf9B/a0/xU=
 github.com/emicklei/go-restful/v3 v3.12.2/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
@@ -396,19 +413,19 @@ github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxI
 github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
-github.com/go-git/go-billy/v5 v5.6.2 h1:6Q86EsPXMa7c3YZ3aLAQsMA0VlWmy43r6FHqa/UNbRM=
-github.com/go-git/go-billy/v5 v5.6.2/go.mod h1:rcFC2rAsp/erv7CMz9GczHcuD0D32fWzH+MJAU+jaUU=
+github.com/go-git/go-billy/v5 v5.8.0 h1:I8hjc3LbBlXTtVuFNJuwYuMiHvQJDq1AT6u4DwDzZG0=
+github.com/go-git/go-billy/v5 v5.8.0/go.mod h1:RpvI/rw4Vr5QA+Z60c6d6LXH0rYJo0uD5SqfmrrheCY=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
-github.com/go-git/go-git/v5 v5.16.5 h1:mdkuqblwr57kVfXri5TTH+nMFLNUxIj9Z7F5ykFbw5s=
-github.com/go-git/go-git/v5 v5.16.5/go.mod h1:QOMLpNf1qxuSY4StA/ArOdfFR2TrKEjJiye2kel2m+M=
+github.com/go-git/go-git/v5 v5.17.1 h1:WnljyxIzSj9BRRUlnmAU35ohDsjRK0EKmL0evDqi5Jk=
+github.com/go-git/go-git/v5 v5.17.1/go.mod h1:pW/VmeqkanRFqR6AljLcs7EA7FbZaN5MQqO7oZADXpo=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gorp/gorp/v3 v3.1.0 h1:ItKF/Vbuj31dmV4jxA1qblpSwkl9g1typ24xoe70IGs=
 github.com/go-gorp/gorp/v3 v3.1.0/go.mod h1:dLEjIyyRNiXvNZ8PSmzpt1GsWAUK8kjVhEpjH8TixEw=
-github.com/go-json-experiment/json v0.0.0-20250813024750-ebf49471dced h1:Q311OHjMh/u5E2TITc++WlTP5We0xNseRMkHDyvhW7I=
-github.com/go-json-experiment/json v0.0.0-20250813024750-ebf49471dced/go.mod h1:TiCD2a1pcmjd7YnhGH0f/zKNcCD06B029pHhzV23c2M=
+github.com/go-json-experiment/json v0.0.0-20260214004413-d219187c3433 h1:vymEbVwYFP/L05h5TKQxvkXoKxNvTpjxYKdF1Nlwuao=
+github.com/go-json-experiment/json v0.0.0-20260214004413-d219187c3433/go.mod h1:tphK2c80bpPhMOI4v6bIc2xWywPfbqi1Z06+RcrMkDg=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
@@ -444,6 +461,8 @@ github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/me
 github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
+github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
+github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
 github.com/go-toolsmith/astcast v1.1.0 h1:+JN9xZV1A+Re+95pgnMgDboWNVnIMMQXwfBwLRPgSC8=
 github.com/go-toolsmith/astcast v1.1.0/go.mod h1:qdcuFWeGGS2xX5bLM/c3U9lewg7+Zu4mr+xPwZIB4ZU=
 github.com/go-toolsmith/astcopy v1.1.0 h1:YGwBN0WM+ekI/6SS6+52zLDEf8Yvp3n2seZITCUBt5s=
@@ -467,16 +486,25 @@ github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9L
 github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/go-xmlfmt/xmlfmt v1.1.2 h1:Nea7b4icn8s57fTx1M5AI4qQT5HEM3rVUO8MuE6g80U=
 github.com/go-xmlfmt/xmlfmt v1.1.2/go.mod h1:aUCEOzzezBEjDBbFBoSiya/gduyIiWYRP6CnSFIV8AM=
+github.com/go4org/hashtriemap v0.0.0-20251130024219-545ba229f689 h1:0psnKZ+N2IP43/SZC8SKx6OpFJwLmQb9m9QyV9BC2f8=
+github.com/go4org/hashtriemap v0.0.0-20251130024219-545ba229f689/go.mod h1:OGmRfY/9QEK2P5zCRtmqfbCF283xPkU2dvVA4MvbvpI=
 github.com/go4org/plan9netshell v0.0.0-20250324183649-788daa080737 h1:cf60tHxREO3g1nroKr2osU3JWZsJzkfi7rEg+oAB0Lo=
 github.com/go4org/plan9netshell v0.0.0-20250324183649-788daa080737/go.mod h1:MIS0jDzbU/vuM9MC4YnBITCv+RYuTRq8dJzmCrFsK9g=
 github.com/gobuffalo/flect v1.0.3 h1:xeWBM2nui+qnVvNM4S3foBhCAL2XgPU+a7FdpelbTq4=
 github.com/gobuffalo/flect v1.0.3/go.mod h1:A5msMlrHtLqh9umBSnvabjsMrCcCpAyzglnDvkbYKHs=
 github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
 github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
+github.com/gobwas/httphead v0.1.0 h1:exrUm0f4YX0L7EBwZHuCF4GDp8aJfVeBrlLQrs6NqWU=
+github.com/gobwas/httphead v0.1.0/go.mod h1:O/RXo79gxV8G+RqlR/otEwx4Q36zl9rqC5u12GKvMCM=
+github.com/gobwas/pool v0.2.1 h1:xfeeEhW7pwmX8nuLVlqbzVc7udMDrwetjEv+TZIz1og=
+github.com/gobwas/pool v0.2.1/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
+github.com/gobwas/ws v1.4.0 h1:CTaoG1tojrh4ucGPcoJFiAQUAsEWekEWvLy7GsVNqGs=
+github.com/gobwas/ws v1.4.0/go.mod h1:G3gNqMNtPppf5XUz7O4shetPpcZ1VJ7zt18dlUeakrc=
 github.com/goccy/go-yaml v1.12.0 h1:/1WHjnMsI1dlIBQutrvSMGZRQufVO3asrHfTwfACoPM=
 github.com/goccy/go-yaml v1.12.0/go.mod h1:wKnAMd44+9JAAnGQpWVEgBzGt3YuTaQ4uXoHvE4m7WU=
-github.com/godbus/dbus/v5 v5.1.1-0.20230522191255-76236955d466 h1:sQspH8M4niEijh3PFscJRLDnkL547IeP7kpPe3uUhEg=
-github.com/godbus/dbus/v5 v5.1.1-0.20230522191255-76236955d466/go.mod h1:ZiQxhyQ+bbbfxUKVvjfO498oPYvtYhZzycal3G/NHmU=
+github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ=
+github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c=
 github.com/gofrs/flock v0.12.1 h1:MTLVXXHf8ekldpJk3AKicLij9MdwOWkZ+a/jHHZby9E=
 github.com/gofrs/flock v0.12.1/go.mod h1:9zxTsyu5xtJ9DK+1tFZyibEV7y3uwDxPPfbxeeHCoD0=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
@@ -484,14 +512,24 @@ github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/gokrazy/breakglass v0.0.0-20251229072214-9dbc0478d486 h1:QBELQyXGy+eCEcWtvSfslJk3y7nUPZldOwBqIz1tkXc=
 github.com/gokrazy/breakglass v0.0.0-20251229072214-9dbc0478d486/go.mod h1:PFPkRFcazBmCZKo+sBaGjsWouTtfDvg13nCDm0tFOCA=
+github.com/gokrazy/firmware v0.0.0-20260522070551-527ce0ed43cf h1:WRmvIwhtcWJfHnrfpfXWPh3Xq6Lztn0y5l3li+NjaYw=
+github.com/gokrazy/firmware v0.0.0-20260522070551-527ce0ed43cf/go.mod h1:x8Lwd/ZFqJTBWUGW7yt/qwgxO8/AHh5KGFYJ4yfH+FE=
 github.com/gokrazy/gokapi v0.0.0-20250222071133-506fdb322775 h1:f5+2UMRRbr3+e/gdWCBNn48chS/KMMljfbmlSSHfRBA=
 github.com/gokrazy/gokapi v0.0.0-20250222071133-506fdb322775/go.mod h1:q9mIV8al0wqmqFXJhKiO3SOHkL9/7Q4kIMynqUQWhgU=
 github.com/gokrazy/gokrazy v0.0.0-20200501080617-f3445e01a904/go.mod h1:pq6rGHqxMRPSaTXaCMzIZy0wLDusAJyoVNyNo05RLs0=
-github.com/gokrazy/gokrazy v0.0.0-20260123094004-294c93fa173c h1:grjqEMf6dPJzZxf+gdo8rjx6bcyseO5p9hierlVkhXQ=
-github.com/gokrazy/gokrazy v0.0.0-20260123094004-294c93fa173c/go.mod h1:NtMkrFeDGnwldKLi0dLdd2ipNwoVa7TI4HTxsy7lFRg=
+github.com/gokrazy/gokrazy v0.0.0-20260418085648-c38c3134b8a7 h1:Isk3pOiVO5uj4BSrfRlQ16v6YpelnrTgMC618hEkKJ8=
+github.com/gokrazy/gokrazy v0.0.0-20260418085648-c38c3134b8a7/go.mod h1:NtMkrFeDGnwldKLi0dLdd2ipNwoVa7TI4HTxsy7lFRg=
 github.com/gokrazy/internal v0.0.0-20200407075822-660ad467b7c9/go.mod h1:LA5TQy7LcvYGQOy75tkrYkFUhbV2nl5qEBP47PSi2JA=
 github.com/gokrazy/internal v0.0.0-20251208203110-3c1aa9087c82 h1:4ghNfD9NaZLpFrqQiBF6mPVFeMYXJSky38ubVA4ic2E=
 github.com/gokrazy/internal v0.0.0-20251208203110-3c1aa9087c82/go.mod h1:dQY4EMkD4L5ZjYJ0SPtpgYbV7MIUMCxNIXiOfnZ6jP4=
+github.com/gokrazy/kernel.amd64 v0.0.0-20260705070735-de680abf072b h1:H9m4mwDqTyQG0AKVviBQp09T3OrY1X3tHNyrJCbqJfY=
+github.com/gokrazy/kernel.amd64 v0.0.0-20260705070735-de680abf072b/go.mod h1:bcNzFtcy9x+l7l4KUqOkVFyIqrtWn8U92Jo9ZEOckbw=
+github.com/gokrazy/kernel.arm64 v0.0.0-20260705071517-37841c4d6ff1 h1:MYq3OcTlEz46i/DZxG3c6ePjE6Te/024cPW2VHTBVAs=
+github.com/gokrazy/kernel.arm64 v0.0.0-20260705071517-37841c4d6ff1/go.mod h1:WWx72LXHEesuJxbopusRfSoKJQ6ffdwkT0DZditdrLo=
+github.com/gokrazy/kernel.rpi v0.0.0-20251127164438-9778ec0261de h1:RSLWj1Ska9s4cl+n/bC5LY4s8vLr+tZoO2vMm/wGP64=
+github.com/gokrazy/kernel.rpi v0.0.0-20251127164438-9778ec0261de/go.mod h1:p5uBeUWKZVv3KJWWD6s9MpAjPjGJUe2CmKDML+5pm6U=
+github.com/gokrazy/rpi-eeprom v0.0.0-20260518070910-95f7328a8228 h1:sLyorzF3zTdEiTvTUpctCIf14tZQFXTfayWBhn9QPG4=
+github.com/gokrazy/rpi-eeprom v0.0.0-20260518070910-95f7328a8228/go.mod h1:vabxV1M+i6S3rGuWoFieHxCJW3jlob3rqe0KV82j+0o=
 github.com/gokrazy/serial-busybox v0.0.0-20250119153030-ac58ba7574e7 h1:gurTGc4sL7Ik+IKZ29rhGgHNZQTXPtEXLw+aM9E+/HE=
 github.com/gokrazy/serial-busybox v0.0.0-20250119153030-ac58ba7574e7/go.mod h1:OYcG5tSb+QrelmUOO4EZVUFcIHyyZb0QDbEbZFUp1TA=
 github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0 h1:DACJavvAHhabrF08vX0COfcOBJRhZ8lUbR+ZWIs0Y5g=
@@ -562,14 +600,17 @@ github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/go-containerregistry v0.20.7 h1:24VGNpS0IwrOZ2ms2P1QE3Xa5X9p4phx0aUgzYzHW6I=
-github.com/google/go-containerregistry v0.20.7/go.mod h1:Lx5LCZQjLH1QBaMPeGwsME9biPeo1lPx6lbGj/UmzgM=
+github.com/google/go-containerregistry v0.21.5 h1:KTJG9Pn/jC0VdZR6ctV3/jcN+q6/Iqlx0sTVz3ywZlM=
+github.com/google/go-containerregistry v0.21.5/go.mod h1:ySvMuiWg+dOsRW0Hw8GYwfMwBlNRTmpYBFJPlkco5zU=
 github.com/google/go-github/v66 v66.0.0 h1:ADJsaXj9UotwdgK8/iFZtv7MLc8E8WBl62WLd/D/9+M=
 github.com/google/go-github/v66 v66.0.0/go.mod h1:+4SO9Zkuyf8ytMj0csN1NR/5OTR+MfqPp8P8dVlcvY4=
-github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
-github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
+github.com/google/go-github/v82 v82.0.0 h1:OH09ESON2QwKCUVMYmMcVu1IFKFoaZHwqYaUtr/MVfk=
+github.com/google/go-github/v82 v82.0.0/go.mod h1:hQ6Xo0VKfL8RZ7z1hSfB4fvISg0QqHOqe9BP0qo+WvM=
+github.com/google/go-querystring v1.2.0 h1:yhqkPbu2/OH+V9BfpCVPZkNmUXhb2gBxJArfhIxNtP0=
+github.com/google/go-querystring v1.2.0/go.mod h1:8IFJqpSRITyJ8QhQ13bmbeMBDfmeEJZD5A0egEOmkqU=
 github.com/google/go-tpm v0.9.4 h1:awZRf9FwOeTunQmHoDYSHJps3ie6f1UlhS1fOdPEt1I=
 github.com/google/go-tpm v0.9.4/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY=
 github.com/google/go-tpm-tools v0.3.13-0.20230620182252-4639ecce2aba h1:qJEJcuLzH5KDR0gKc0zcktin6KSAwL7+jWKBYceddTc=
@@ -596,8 +637,8 @@ github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hf
 github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db h1:097atOisP2aRj7vFgYQBbFN4U4JNXUNYpxael3UzMyo=
 github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
-github.com/google/renameio/v2 v2.0.0 h1:UifI23ZTGY8Tt29JbYFiuyIU3eX+RNFtUwefq9qAhxg=
-github.com/google/renameio/v2 v2.0.0/go.mod h1:BtmJXm5YlszgC+TD4HOEEUFgkJP3nLxehU6hfe7jRt4=
+github.com/google/renameio/v2 v2.0.2 h1:qKZs+tfn+arruZZhQ7TKC/ergJunuJicWS6gLDt/dGw=
+github.com/google/renameio/v2 v2.0.2/go.mod h1:OX+G6WHHpHq3NVj7cAOleLOwJfcQ1s3uUJQCrr78SWo=
 github.com/google/rpmpack v0.5.0 h1:L16KZ3QvkFGpYhmp23iQip+mx1X39foEsqszjMNBm8A=
 github.com/google/rpmpack v0.5.0/go.mod h1:uqVAUVQLq8UY2hCDfmJ/+rtO3aw7qyhc90rCVEabEfI=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
@@ -672,8 +713,8 @@ github.com/hashicorp/go-version v1.6.0 h1:feTTfFNnjP967rlCxM/I9g701jU+RN74YKx2mO
 github.com/hashicorp/go-version v1.6.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/golang-lru v0.6.0 h1:uL2shRDx7RTrOrTCUZEGP/wJUFiUI8QT6E7z5o8jga4=
-github.com/hashicorp/golang-lru v0.6.0/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
+github.com/hashicorp/golang-lru v1.0.2 h1:dV3g9Z/unq5DpblPpw+Oqcv4dU/1omnb4Ok8iPY6p1c=
+github.com/hashicorp/golang-lru v1.0.2/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
 github.com/hashicorp/golang-lru/arc/v2 v2.0.5 h1:l2zaLDubNhW4XO3LnliVj0GXO3+/CGNJAg1dcN2Fpfw=
 github.com/hashicorp/golang-lru/arc/v2 v2.0.5/go.mod h1:ny6zBSQZi2JxIeYcv7kt2sH2PXJtirBN7RDhRpxPkxU=
 github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
@@ -705,8 +746,8 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/inetaf/tcpproxy v0.0.0-20250203165043-ded522cbd03f h1:hPcDyz0u+Zo14n0fpJggxL9JMAmZIK97TVLcLJLPMDI=
 github.com/inetaf/tcpproxy v0.0.0-20250203165043-ded522cbd03f/go.mod h1:Di7LXRyUcnvAcLicFhtM9/MlZl/TNgRSDHORM2c6CMI=
-github.com/insomniacslk/dhcp v0.0.0-20231206064809-8c70d406f6d2 h1:9K06NfxkBh25x56yVhWWlKFE8YpicaSfHwoV8SFbueA=
-github.com/insomniacslk/dhcp v0.0.0-20231206064809-8c70d406f6d2/go.mod h1:3A9PQ1cunSDF/1rbTq99Ts4pVnycWg+vlPkfeD2NLFI=
+github.com/insomniacslk/dhcp v0.0.0-20240129002554-15c9b8791914 h1:kD8PseueGeYiid/Mmcv17Q0Qqicc4F46jcX22L/e/Hs=
+github.com/insomniacslk/dhcp v0.0.0-20240129002554-15c9b8791914/go.mod h1:3A9PQ1cunSDF/1rbTq99Ts4pVnycWg+vlPkfeD2NLFI=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
 github.com/jellydator/ttlcache/v3 v3.1.0 h1:0gPFG0IHHP6xyUyXq+JaD8fwkDCqgqwohXNJBcYE71g=
@@ -731,8 +772,8 @@ github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFF
 github.com/josharian/native v1.1.0 h1:uuaP0hAbW7Y4l0ZRQ6C9zfb7Mg1mbFKry/xzDAfmtLA=
 github.com/josharian/native v1.1.0/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
 github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
-github.com/jsimonetti/rtnetlink v1.4.0 h1:Z1BF0fRgcETPEa0Kt0MRk3yV5+kF1FWTni6KUFKrq2I=
-github.com/jsimonetti/rtnetlink v1.4.0/go.mod h1:5W1jDvWdnthFJ7fxYX1GMK07BUpI4oskfOqvPteYS6E=
+github.com/jsimonetti/rtnetlink v1.4.1 h1:JfD4jthWBqZMEffc5RjgmlzpYttAVw1sdnmiNaPO3hE=
+github.com/jsimonetti/rtnetlink v1.4.1/go.mod h1:xJjT7t59UIZ62GLZbv6PLLo8VFrostJMPBAheR6OM8w=
 github.com/jsimonetti/rtnetlink/v2 v2.0.1 h1:xda7qaHDSVOsADNouv7ukSuicKZO7GgVUCXxpaIEIlM=
 github.com/jsimonetti/rtnetlink/v2 v2.0.1/go.mod h1:7MoNYNbb3UaDHtF8udiJo/RH6VsTKP1pqKLUTVCvToE=
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
@@ -765,8 +806,8 @@ github.com/kisielk/errcheck v1.7.0/go.mod h1:1kLL+jV4e+CFfueBmI1dSK2ADDyQnlrnrY/
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/kkHAIKE/contextcheck v1.1.4 h1:B6zAaLhOEEcjvUgIYEqystmnFk1Oemn8bvJhbt0GMb8=
 github.com/kkHAIKE/contextcheck v1.1.4/go.mod h1:1+i/gWqokIa+dm31mqGLZhZJ7Uh44DJGZVmr6QRBNJg=
-github.com/klauspost/compress v1.18.2 h1:iiPHWW0YrcFgpBYhsA6D1+fqHssJscY/Tm/y2Uqnapk=
-github.com/klauspost/compress v1.18.2/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
+github.com/klauspost/compress v1.19.1 h1:VsB4HPswih7mmZ8WleSFQ75c/Ui1M4trX5oAsJnhSlk=
+github.com/klauspost/compress v1.19.1/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/pgzip v1.2.6 h1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU=
 github.com/klauspost/pgzip v1.2.6/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
@@ -801,6 +842,8 @@ github.com/ldez/gomoddirectives v0.2.3 h1:y7MBaisZVDYmKvt9/l1mjNCiSA1BVn34U0ObUc
 github.com/ldez/gomoddirectives v0.2.3/go.mod h1:cpgBogWITnCfRq2qGoDkKMEVSaarhdBr6g8G04uz6d0=
 github.com/ldez/tagliatelle v0.5.0 h1:epgfuYt9v0CG3fms0pEgIMNPuFf/LpPIfjk4kyqSioo=
 github.com/ldez/tagliatelle v0.5.0/go.mod h1:rj1HmWiL1MiKQuOONhd09iySTEkUuE/8+5jtPYz9xa4=
+github.com/ledongthuc/pdf v0.0.0-20220302134840-0c2507a12d80 h1:6Yzfa6GP0rIo/kULo2bwGEkFvCePZ3qHDDTC3/J9Swo=
+github.com/ledongthuc/pdf v0.0.0-20220302134840-0c2507a12d80/go.mod h1:imJHygn/1yfhB7XSJJKlFZKl/J+dCPAknuiaGOshXAs=
 github.com/leodido/go-urn v1.2.0 h1:hpXL4XnriNwQ/ABnpepYM/1vCLWNDfUNts8dX3xTG6Y=
 github.com/leodido/go-urn v1.2.0/go.mod h1:+8+nEpDfqqsY+g338gtMEUOtuK+4dEMhiQEgxpxOKII=
 github.com/leonklingele/grouper v1.1.1 h1:suWXRU57D4/Enn6pXR0QVqqWWrnJ9Osrz+5rjt8ivzU=
@@ -827,13 +870,15 @@ github.com/matryer/is v1.4.0 h1:sosSmIWwkYITGrxZ25ULNDeKiMNzFSr4V/eqBQP0PeE=
 github.com/matryer/is v1.4.0/go.mod h1:8I/i5uYgLzgsgEloJE1U6xx5HkBQpAZvepWuujKwMRU=
 github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
-github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
+github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY=
+github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.23 h1:cYwCQTQf3HB6xUC+BtyCLZNr7IzbOmoZbmssVNzSyiQ=
+github.com/mattn/go-isatty v0.0.23/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
 github.com/mattn/go-runewidth v0.0.14 h1:+xnbZSEeDbOIg5/mE6JF0w6n9duR1l3/WmbinWVwUuU=
 github.com/mattn/go-runewidth v0.0.14/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
@@ -873,12 +918,12 @@ github.com/moby/buildkit v0.20.2 h1:qIeR47eQ1tzI1rwz0on3Xx2enRw/1CKjFhoONVcTlMA=
 github.com/moby/buildkit v0.20.2/go.mod h1:DhaF82FjwOElTftl0JUAJpH/SUIUx4UvcFncLeOtlDI=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
-github.com/moby/spdystream v0.5.0 h1:7r0J1Si3QO/kjRitvSLVVFUjxMEb/YLj6S9FF62JBCU=
-github.com/moby/spdystream v0.5.0/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI=
-github.com/moby/sys/atomicwriter v0.1.0 h1:kw5D/EqkBwsBFi0ss9v1VG3wIkVhzGvLklJ+w3A14Sw=
-github.com/moby/sys/atomicwriter v0.1.0/go.mod h1:Ul8oqv2ZMNHOceF643P6FKPXeCmYtlQMvpizfsSoaWs=
-github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU=
-github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko=
+github.com/moby/moby/api v1.54.1 h1:TqVzuJkOLsgLDDwNLmYqACUuTehOHRGKiPhvH8V3Nn4=
+github.com/moby/moby/api v1.54.1/go.mod h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs=
+github.com/moby/moby/client v0.4.0 h1:S+2XegzHQrrvTCvF6s5HFzcrywWQmuVnhOXe2kiWjIw=
+github.com/moby/moby/client v0.4.0/go.mod h1:QWPbvWchQbxBNdaLSpoKpCdf5E+WxFAgNHogCWDoa7g=
+github.com/moby/spdystream v0.5.1 h1:9sNYeYZUcci9R6/w7KDaFWEWeV4LStVG78Mpyq/Zm/Y=
+github.com/moby/spdystream v0.5.1/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI=
 github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ=
 github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFLc=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -893,8 +938,6 @@ github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 h1:n6/
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00/go.mod h1:Pm3mSP3c5uWn86xMLZ5Sa7JB9GsEZySvHYXCTK4E9q4=
 github.com/moricho/tparallel v0.3.1 h1:fQKD4U1wRMAYNngDonW5XupoB/ZGJHdpzrWqgyg9krA=
 github.com/moricho/tparallel v0.3.1/go.mod h1:leENX2cUv7Sv2qDgdi0D0fCftN8fRC67Bcn8pqzeYNI=
-github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
-github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
@@ -925,6 +968,8 @@ github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
 github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
+github.com/orisano/pixelmatch v0.0.0-20220722002657-fb0b55479cde h1:x0TT0RDC7UhAVbbWWBzr41ElhJx5tXPWkIHA2HWPRuw=
+github.com/orisano/pixelmatch v0.0.0-20220722002657-fb0b55479cde/go.mod h1:nZgzbfBr3hhjoZnS66nKrHmduYNpc34ny7RK4z5/HM0=
 github.com/otiai10/copy v1.2.0/go.mod h1:rrF5dJ5F0t/EWSYODDu4j9/vEeYHMkc8jt0zJChqQWw=
 github.com/otiai10/copy v1.14.0 h1:dCI/t1iTdYGtkvCuBG2BgR6KZa83PTclw4U5n2wAllU=
 github.com/otiai10/copy v1.14.0/go.mod h1:ECfuL02W+/FkTWZWgQqXPWZgW9oeKCSQ5qVfSc4qc4w=
@@ -932,6 +977,8 @@ github.com/otiai10/curr v0.0.0-20150429015615-9b4961190c95/go.mod h1:9qAhocn7zKJ
 github.com/otiai10/curr v1.0.0/go.mod h1:LskTG5wDwr8Rs+nNQ+1LlxRjAtTZZjtJW4rMXl6j4vs=
 github.com/otiai10/mint v1.3.0/go.mod h1:F5AjcsTsWUqX+Na9fpHb52P8pcRX2CI6A3ctIT91xUo=
 github.com/otiai10/mint v1.3.1/go.mod h1:/yxELlJQ0ufhjUwhshSj+wFjZ78CnZ48/1wtmBH1OTc=
+github.com/palantir/policy-bot v1.41.1 h1:1v/v+fmXhbSyPWOfxhxF1UWmYWuRCNK+VYKIalj+KRY=
+github.com/palantir/policy-bot v1.41.1/go.mod h1:iGHKNjbH341YjtpYUHMAzQy5SjghL3BXplNg6TRRvt0=
 github.com/pascaldekloe/goe v0.1.0 h1:cBOtyMzM9HTpWjXfbbunk26uA6nG3a8n06Wieeh0MwY=
 github.com/pascaldekloe/goe v0.1.0/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
 github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
@@ -944,8 +991,8 @@ github.com/peterbourgon/ff/v3 v3.4.0 h1:QBvM/rizZM1cB0p0lGMdmR7HxZeI/ZrBWB4DqLkM
 github.com/peterbourgon/ff/v3 v3.4.0/go.mod h1:zjJVUhx+twciwfDl0zBcFzl4dW8axCRyXE/eKY9RztQ=
 github.com/phayes/freeport v0.0.0-20220201140144-74d24b5ae9f5 h1:Ii+DKncOVM8Cu1Hc+ETb5K+23HdAMvESYE3ZJ5b5cMI=
 github.com/phayes/freeport v0.0.0-20220201140144-74d24b5ae9f5/go.mod h1:iIss55rKnNBTvrwdmkUpLnDpZoAHvWaiq5+iMmen4AE=
-github.com/pierrec/lz4/v4 v4.1.25 h1:kocOqRffaIbU5djlIBr7Wh+cx82C0vtFb0fOurZHqD0=
-github.com/pierrec/lz4/v4 v4.1.25/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4=
+github.com/pierrec/lz4/v4 v4.1.26 h1:GrpZw1gZttORinvzBdXPUXATeqlJjqUG/D87TKMnhjY=
+github.com/pierrec/lz4/v4 v4.1.26/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4=
 github.com/pires/go-proxyproto v0.8.1 h1:9KEixbdJfhrbtjpz/ZwCdWDD2Xem0NZ38qMYaASJgp0=
 github.com/pires/go-proxyproto v0.8.1/go.mod h1:ZKAAyp3cgy5Y5Mo4n9AlScrkCZwUy0g3Jf+slqQVcuU=
 github.com/pjbgf/sha1cd v0.3.2 h1:a9wb0bp1oC2TGwStyn0Umc/IGKQnEgF0vVaZ8QF8eo4=
@@ -959,6 +1006,8 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.6 h1:JFZT4XbOU7l77xGSpOdW+pwIMqP044IyjXX6FGyEKFo=
 github.com/pkg/sftp v1.13.6/go.mod h1:tz1ryNURKu77RL+GuCzmoJYxQczL3wLNNpPWagdg4Qk=
+github.com/pkg/xattr v0.4.12 h1:rRTkSyFNTRElv6pkA3zpjHpQ90p/OdHQC1GmGh1aTjM=
+github.com/pkg/xattr v0.4.12/go.mod h1:di8WF84zAKk8jzR1UBTEWh9AUlIZZ7M/JNt8e9B6ktU=
 github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 h1:GFCKgmp0tecUJ0sJuv4pzYCqS9+RGSn52M3FUwPs+uo=
 github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
@@ -970,8 +1019,6 @@ github.com/poy/onpar v1.1.2 h1:QaNrNiZx0+Nar5dLgTVp5mXkyoVFIbepjyEoGSnhbAY=
 github.com/poy/onpar v1.1.2/go.mod h1:6X8FLNoxyr9kkmnlqpK6LSoiOtrO6MICtWwEuWkLjzg=
 github.com/prashantv/gostub v1.1.0 h1:BTyx3RfQjRHnUWaGF9oQos79AlQ5k8WNktv7VGvVH4g=
 github.com/prashantv/gostub v1.1.0/go.mod h1:A5zLQHz7ieHGG7is6LLXLz7I8+3LZzsrV0P1IAHhP5U=
-github.com/prometheus-community/pro-bing v0.4.0 h1:YMbv+i08gQz97OZZBwLyvmmQEEzyfyrrjEaAchdy3R4=
-github.com/prometheus-community/pro-bing v0.4.0/go.mod h1:b7wRYZtCcPmt4Sz319BykUU241rWLe1VFXyiyWK/dH4=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
 github.com/prometheus/client_golang v1.4.0/go.mod h1:e9GMxYsXl05ICDXkRhurwBS4Q3OK1iX/F2sw+iXX5zU=
@@ -979,8 +1026,8 @@ github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP
 github.com/prometheus/client_golang v1.11.0/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0=
 github.com/prometheus/client_golang v1.11.1/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0=
 github.com/prometheus/client_golang v1.12.1/go.mod h1:3Z9XVyYiZYEO+YQWt3RD2R3jrbd179Rt297l4aS6nDY=
-github.com/prometheus/client_golang v1.23.0 h1:ust4zpdl9r4trLY/gSjlm07PuiBq2ynaXXlptpfy8Uc=
-github.com/prometheus/client_golang v1.23.0/go.mod h1:i/o0R9ByOnHX0McrTMTyhYvKE4haaf2mW08I+jGAjEE=
+github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
+github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
@@ -992,16 +1039,16 @@ github.com/prometheus/common v0.9.1/go.mod h1:yhUN8i9wzaXS3w1O07YhxHEBxD+W35wd8b
 github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo=
 github.com/prometheus/common v0.26.0/go.mod h1:M7rCNAaPfAosfx8veZJCuw84e35h3Cfd9VFqTh1DIvc=
 github.com/prometheus/common v0.32.1/go.mod h1:vu+V0TpY+O6vW9J44gczi3Ap/oXXR10b+M/gUGO4Hls=
-github.com/prometheus/common v0.65.0 h1:QDwzd+G1twt//Kwj/Ww6E9FQq1iVMmODnILtW1t2VzE=
-github.com/prometheus/common v0.65.0/go.mod h1:0gZns+BLRQ3V6NdaerOhMbwwRbNh9hkGINtQAsP5GS8=
+github.com/prometheus/common v0.69.0 h1:OA85nJQS/T/MaYh/Q2CcgDKSGWqNIgrBDvDH85CuiNk=
+github.com/prometheus/common v0.69.0/go.mod h1:ZzL3f6u94qUxh9p+tJTrF+FvBS1XXbbRAZCQkytAL0Y=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
 github.com/prometheus/procfs v0.0.8/go.mod h1:7Qr8sr6344vo1JqZ6HhLceV9o3AJ1Ff+GxbHq6oeK9A=
 github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
 github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
 github.com/prometheus/procfs v0.7.3/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
-github.com/prometheus/procfs v0.16.1 h1:hZ15bTNuirocR6u0JZ6BAHHmwS1p8B4P6MRqxtzMyRg=
-github.com/prometheus/procfs v0.16.1/go.mod h1:teAbpZRB1iIAJYREa1LsoWUXykVXA1KlTmWl8x/U+Is=
+github.com/prometheus/procfs v0.20.1 h1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc=
+github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4UlK79eF5TGGo=
 github.com/prometheus/prometheus v0.49.2-0.20240125131847-c3b8ef1694ff h1:X1Tly81aZ22DA1fxBdfvR3iw8+yFoUBUHMEd+AX/ZXI=
 github.com/prometheus/prometheus v0.49.2-0.20240125131847-c3b8ef1694ff/go.mod h1:FvE8dtQ1Ww63IlyKBn1V4s+zMwF9kHkVNkQBR1pM4CU=
 github.com/puzpuzpuz/xsync v1.5.2 h1:yRAP4wqSOZG+/4pxJ08fPTwrfL0IzE/LKQ/cw509qGY=
@@ -1023,10 +1070,15 @@ github.com/redis/go-redis/v9 v9.7.3/go.mod h1:bGUrSggJ9X9GUmZpZNEOQKaANxSGgOEBRl
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis=
 github.com/rivo/uniseg v0.4.4/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
+github.com/robert-nix/ansihtml v1.0.1 h1:VTiyQ6/+AxSJoSSLsMecnkh8i0ZqOEdiRl/odOc64fc=
+github.com/robert-nix/ansihtml v1.0.1/go.mod h1:CJwclxYaTPc2RfcxtanEACsYuTksh4yDXcNeHHKZINE=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
 github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0=
+github.com/rs/zerolog v1.34.0 h1:k43nTLIwcTVQAncfCw4KZ2VY6ukYoZaBPNOE8txlOeY=
+github.com/rs/zerolog v1.34.0/go.mod h1:bJsvje4Z08ROH4Nhs5iH600c3IkWhwp44iRc54W6wYQ=
 github.com/rtr7/dhcp4 v0.0.0-20181120124042-778e8c2e24a5/go.mod h1:FwstIpm6vX98QgtR8KEwZcVjiRn2WP76LjXAHj84fK0=
 github.com/rtr7/dhcp4 v0.0.0-20220302171438-18c84d089b46 h1:3psQveH4RUiv5yc3p7kRySilf1nSXLQhAvJFwg4fgnE=
 github.com/rtr7/dhcp4 v0.0.0-20220302171438-18c84d089b46/go.mod h1:Ng1F/s+z0zCMsbEFEneh+30LJa9DrTfmA+REbEqcTPk=
@@ -1053,20 +1105,24 @@ github.com/sashamelentyev/usestdlibvars v1.25.0/go.mod h1:9nl0jgOfHKWNFS43Ojw0i7
 github.com/securego/gosec/v2 v2.19.0 h1:gl5xMkOI0/E6Hxx0XCY2XujA3V7SNSefA8sC+3f1gnk=
 github.com/securego/gosec/v2 v2.19.0/go.mod h1:hOkDcHz9J/XIgIlPDXalxjeVYsHxoWUc5zJSHxcB8YM=
 github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
-github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8=
-github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
+github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
+github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
 github.com/shazow/go-diff v0.0.0-20160112020656-b6b7b6733b8c h1:W65qqJCIOVP4jpqPQ0YvHYKwcMEMVWIzWC5iNQQfBTU=
 github.com/shazow/go-diff v0.0.0-20160112020656-b6b7b6733b8c/go.mod h1:/PevMnwAxekIXwN8qQyfc5gl2NlkB3CQlkizAbOkeBs=
 github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k=
 github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME=
+github.com/shurcooL/githubv4 v0.0.0-20260209031235-2402fdf4a9ed h1:KT7hI8vYXgU0s2qaMkrfq9tCA1w/iEPgfredVP+4Tzw=
+github.com/shurcooL/githubv4 v0.0.0-20260209031235-2402fdf4a9ed/go.mod h1:zqMwyHmnN/eDOZOdiTohqIUKUrTFX62PNlu7IJdu0q8=
 github.com/shurcooL/go v0.0.0-20180423040247-9e1955d9fb6e/go.mod h1:TDJrrUr11Vxrven61rcy3hJMUqaf/CLWYhHNPmT14Lk=
 github.com/shurcooL/go-goon v0.0.0-20170922171312-37c2f522c041/go.mod h1:N5mDOmsrJOB+vfqUK+7DmDyjhSLIIBnXo9lvZJj3MWQ=
+github.com/shurcooL/graphql v0.0.0-20240915155400-7ee5256398cf h1:o1uxfymjZ7jZ4MsgCErcwWGtVKSiNAXtS59Lhs6uI/g=
+github.com/shurcooL/graphql v0.0.0-20240915155400-7ee5256398cf/go.mod h1:9dIRpgIY7hVhoqfe0/FcYp0bpInZaT7dc3BYOprrIUE=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
 github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
-github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
-github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
+github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
 github.com/sivchari/containedctx v1.0.3 h1:x+etemjbsh2fB5ewm5FeLNi5bUjK0V8n0RB+Wwfd0XE=
 github.com/sivchari/containedctx v1.0.3/go.mod h1:c1RDvCbnJLtH4lLcYD/GqwiBSSf4F5Qk0xld2rBqzJ4=
 github.com/sivchari/tenv v1.7.1 h1:PSpuD4bu6fSmtWMxSGWcvqUUgIn7k3yOJhOIzVWn8Ak=
@@ -1092,8 +1148,9 @@ github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiT
 github.com/spf13/jwalterweatherman v1.1.0 h1:ue6voC5bR5F8YxI5S67j9i582FU4Qvo2bmqnqMYADFk=
 github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
 github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/viper v1.16.0 h1:rGGH0XDZhdUOryiDWjmIvUSWpbNqisK8Wk0Vyefw8hc=
 github.com/spf13/viper v1.16.0/go.mod h1:yg78JgCJcbrQOvV9YLXgkLaZqUidkY9K+Dd1FofRzQg=
 github.com/ssgreg/nlreturn/v2 v2.2.1 h1:X4XDI7jstt3ySqGU86YGAURbxw3oTDPK9sPEi6YEwQ0=
@@ -1122,26 +1179,24 @@ github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXl
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/studio-b12/gowebdav v0.9.0 h1:1j1sc9gQnNxbXXM4M/CebPOX4aXYtr7MojAVcN4dHjU=
-github.com/studio-b12/gowebdav v0.9.0/go.mod h1:bHA7t77X/QFExdeAnDzK6vKM34kEZAcE1OX4MfiwjkE=
+github.com/studio-b12/gowebdav v0.13.0 h1:OcwSg6IQHOFNdYHn3bPOHwSE8looG8N56Y5xTT1asqQ=
+github.com/studio-b12/gowebdav v0.13.0/go.mod h1:bHA7t77X/QFExdeAnDzK6vKM34kEZAcE1OX4MfiwjkE=
 github.com/subosito/gotenv v1.4.2 h1:X1TuBLAMDFbaTAChgCBLu3DU3UPyELpnF2jjJ2cz/S8=
 github.com/subosito/gotenv v1.4.2/go.mod h1:ayKnFf/c6rvx/2iiLrJUk1e6plDbT3edrFNGqEflhK0=
 github.com/t-yuki/gocover-cobertura v0.0.0-20180217150009-aaee18c8195c h1:+aPplBwWcHBo6q9xrfWdMrT9o4kltkmmvpemgIjep/8=
 github.com/t-yuki/gocover-cobertura v0.0.0-20180217150009-aaee18c8195c/go.mod h1:SbErYREK7xXdsRiigaQiQkI9McGRzYMvlKYaP3Nimdk=
-github.com/tailscale/certstore v0.1.1-0.20231202035212-d3fa0460f47e h1:PtWT87weP5LWHEY//SWsYkSO3RWRZo4OSWagh3YD2vQ=
-github.com/tailscale/certstore v0.1.1-0.20231202035212-d3fa0460f47e/go.mod h1:XrBNfAFN+pwoWuksbFS9Ccxnopa15zJGgXRFN90l3K4=
+github.com/tailscale/certstore v0.1.1-0.20260409135935-3638fb84b77d h1:JcGKBZAL7ePLwOhUdN8qGQZlP5GueEiIZwY7R62pejE=
+github.com/tailscale/certstore v0.1.1-0.20260409135935-3638fb84b77d/go.mod h1:XrBNfAFN+pwoWuksbFS9Ccxnopa15zJGgXRFN90l3K4=
 github.com/tailscale/depaware v0.0.0-20251001183927-9c2ad255ef3f h1:PDPGJtm9PFBLNudHGwkfUGp/FWvP+kXXJ0D1pB35F40=
 github.com/tailscale/depaware v0.0.0-20251001183927-9c2ad255ef3f/go.mod h1:p9lPsd+cx33L3H9nNoecRRxPssFKUwwI50I3pZ0yT+8=
-github.com/tailscale/gliderssh v0.3.4-0.20260330083525-c1389c70ff89 h1:glgVc1ZYMjwN1Q/ITWeuSQyl029uayagaR2sjsifehc=
-github.com/tailscale/gliderssh v0.3.4-0.20260330083525-c1389c70ff89/go.mod h1:wn16Km1EZOX4UEAyaZa3dBwfFGOJ7neck40NcwosJUw=
+github.com/tailscale/gliderssh v0.3.4-0.20260716005906-1a0f895faf28 h1:Azz5ILxxVsHN/KjIu3wkJPAmmtiijucZw4Ax5Ye8n+s=
+github.com/tailscale/gliderssh v0.3.4-0.20260716005906-1a0f895faf28/go.mod h1:wn16Km1EZOX4UEAyaZa3dBwfFGOJ7neck40NcwosJUw=
 github.com/tailscale/go-winio v0.0.0-20231025203758-c4f33415bf55 h1:Gzfnfk2TWrk8Jj4P4c1a3CtQyMaTVCznlkLZI++hok4=
 github.com/tailscale/go-winio v0.0.0-20231025203758-c4f33415bf55/go.mod h1:4k4QO+dQ3R5FofL+SanAUZe+/QfeK0+OIuwDIRu2vSg=
 github.com/tailscale/goexpect v0.0.0-20210902213824-6e8c725cea41 h1:/V2rCMMWcsjYaYO2MeovLw+ClP63OtXgCF2Y1eb8+Ns=
 github.com/tailscale/goexpect v0.0.0-20210902213824-6e8c725cea41/go.mod h1:/roCdA6gg6lQyw/Oz6gIIGu3ggJKYhF+WC/AQReE5XQ=
-github.com/tailscale/gokrazy-kernel v0.0.0-20240728225134-3d23beabda2e h1:tyUUgeRPGHjCZWycRnhdx8Lx9DRkjl3WsVUxYMrVBOw=
-github.com/tailscale/gokrazy-kernel v0.0.0-20240728225134-3d23beabda2e/go.mod h1:7Mth+m9bq2IHusSsexMNyupHWPL8RxwOuSvBlSGtgDY=
-github.com/tailscale/golang-x-crypto v0.0.0-20250404221719-a5573b049869 h1:SRL6irQkKGQKKLzvQP/ke/2ZuB7Py5+XuqtOgSj+iMM=
-github.com/tailscale/golang-x-crypto v0.0.0-20250404221719-a5573b049869/go.mod h1:ikbF+YT089eInTp9f2vmvy4+ZVnW5hzX1q2WknxSprQ=
+github.com/tailscale/golang-x-crypto v0.0.0-20260720153645-2ba0bf7866ed h1:uyvHhX1FQada0vVk8CSHa4tJT96EEAkTypaYz8Tq5Nc=
+github.com/tailscale/golang-x-crypto v0.0.0-20260720153645-2ba0bf7866ed/go.mod h1:NC3xRCu4UR+m4n6ix8b6oLLbHa820Y0StbOQEdWTDo0=
 github.com/tailscale/hujson v0.0.0-20260302212456-ecc657c15afd h1:Rf9uhF1+VJ7ZHqxrG8pJ6YacmHvVCmByDmGbAWCc/gA=
 github.com/tailscale/hujson v0.0.0-20260302212456-ecc657c15afd/go.mod h1:EbW0wDK/qEUYI0A5bqq0C2kF8JTQwWONmGDBbzsxxHo=
 github.com/tailscale/mkctr v0.0.0-20260107121656-ea857e3e500b h1:QKqCnmp0qHWUHySySKjpuhZANzRn7XrTVZWUuUgJ3lQ=
@@ -1150,14 +1205,18 @@ github.com/tailscale/netlink v1.1.1-0.20240822203006-4d49adab4de7 h1:uFsXVBE9Qr4
 github.com/tailscale/netlink v1.1.1-0.20240822203006-4d49adab4de7/go.mod h1:NzVQi3Mleb+qzq8VmcWpSkcSYxXIg0DkI6XDzpVkhJ0=
 github.com/tailscale/peercred v0.0.0-20250107143737-35a0c7bd7edc h1:24heQPtnFR+yfntqhI3oAu9i27nEojcQ4NuBQOo5ZFA=
 github.com/tailscale/peercred v0.0.0-20250107143737-35a0c7bd7edc/go.mod h1:f93CXfllFsO9ZQVq+Zocb1Gp4G5Fz0b0rXHLOzt/Djc=
+github.com/tailscale/policybottest v0.0.0-20260626205140-6863b672b210 h1:gSw3mUo7PJwwnBBIsIihszeFxJ/8ehM1xu0A0Jg1iAs=
+github.com/tailscale/policybottest v0.0.0-20260626205140-6863b672b210/go.mod h1:vxp6PAfQH5JOeS5GsrHHbsALlo+1ZIELanBwaP89wrc=
 github.com/tailscale/setec v0.0.0-20251203133219-2ab774e4129a h1:TApskGPim53XY5WRt5hX4DnO8V6CmVoimSklryIoGMM=
 github.com/tailscale/setec v0.0.0-20251203133219-2ab774e4129a/go.mod h1:+6WyG6kub5/5uPsMdYQuSti8i6F5WuKpFWLQnZt/Mms=
+github.com/tailscale/ts-gokrazy v0.0.0-20260630224145-b83088f2e52e h1:+ot1gXs22BhqoStjwo2YSoZppGl/xovy31V29trAPeE=
+github.com/tailscale/ts-gokrazy v0.0.0-20260630224145-b83088f2e52e/go.mod h1:mu0sethAvP7xItcfBAxMJWiXZ3ZQ5qbKmjPYizOkSHE=
 github.com/tailscale/web-client-prebuilt v0.0.0-20250124233751-d4cd19a26976 h1:UBPHPtv8+nEAy2PD8RyAhOYvau1ek0HDJqLS/Pysi14=
 github.com/tailscale/web-client-prebuilt v0.0.0-20250124233751-d4cd19a26976/go.mod h1:agQPE6y6ldqCOui2gkIh7ZMztTkIQKH049tv8siLuNQ=
 github.com/tailscale/wf v0.0.0-20240214030419-6fbb0a674ee6 h1:l10Gi6w9jxvinoiq15g8OToDdASBni4CyJOdHY1Hr8M=
 github.com/tailscale/wf v0.0.0-20240214030419-6fbb0a674ee6/go.mod h1:ZXRML051h7o4OcI0d3AaILDIad/Xw0IkXaHM17dic1Y=
-github.com/tailscale/wireguard-go v0.0.0-20260304043104-4184faf59e56 h1:/R1vu+eNhg1eKstmVPEKvsJgkh4TUyb+J+Eadwv+d/I=
-github.com/tailscale/wireguard-go v0.0.0-20260304043104-4184faf59e56/go.mod h1:zvaAPQrjUBWufXgqpSQ1/BYu9ZFOKnsNWLFQe+E78cM=
+github.com/tailscale/wireguard-go v0.0.0-20260715223240-2e01ba5b00f0 h1:CnIEL2n7Xql6Ux1k+Vu5S5ubDHCT/kxFgkKCY8FjefU=
+github.com/tailscale/wireguard-go v0.0.0-20260715223240-2e01ba5b00f0/go.mod h1:6SerzcvHWQchKO2BfNdmquA77CHSECZuFl+D9fp4RnI=
 github.com/tailscale/xnet v0.0.0-20240729143630-8497ac4dab2e h1:zOGKqN5D5hHhiYUp091JqK7DPCqSARyUfduhGUY8Bek=
 github.com/tailscale/xnet v0.0.0-20240729143630-8497ac4dab2e/go.mod h1:orPd6JZXXRyuDusYilywte7k094d7dycXXU5YnWsrwg=
 github.com/tc-hib/winres v0.2.1 h1:YDE0FiP0VmtRaDn7+aaChp1KiF4owBiJa5l964l5ujA=
@@ -1201,10 +1260,11 @@ github.com/uudashr/gocognit v1.1.2 h1:l6BAEKJqQH2UpKAPKdMfZf5kE4W/2xk8pfU1OVLvni
 github.com/uudashr/gocognit v1.1.2/go.mod h1:aAVdLURqcanke8h3vg35BC++eseDm66Z7KmchI5et4k=
 github.com/vbatts/tar-split v0.12.2 h1:w/Y6tjxpeiFMR47yzZPlPj/FcPLpXbTUi/9H7d3CPa4=
 github.com/vbatts/tar-split v0.12.2/go.mod h1:eF6B6i6ftWQcDqEn3/iGFRFRo8cBIMSJVOpnNdfTMFA=
-github.com/vishvananda/netlink v1.3.1-0.20240922070040-084abd93d350 h1:w5OI+kArIBVksl8UGn6ARQshtPCQvDsbuA9NQie3GIg=
-github.com/vishvananda/netlink v1.3.1-0.20240922070040-084abd93d350/go.mod h1:i6NetklAujEcC6fK0JPjT8qSwWyO0HLn4UKG+hGqeJs=
+github.com/vektah/gqlparser v1.3.1 h1:8b0IcD3qZKWJQHSzynbDlrtP3IxVydZ2DZepCGofqfU=
+github.com/vektah/gqlparser v1.3.1/go.mod h1:bkVf0FX+Stjg/MHnm8mEyubuaArhNEqfQhF+OTiAL74=
+github.com/vishvananda/netlink v1.3.1 h1:3AEMt62VKqz90r0tmNhog0r/PpWKmrEShJU0wJW6bV0=
+github.com/vishvananda/netlink v1.3.1/go.mod h1:ARtKouGSTGchR8aMwmkzC0qiNPrrWO5JS/XMVl45+b4=
 github.com/vishvananda/netns v0.0.0-20200728191858-db3c7e526aae/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=
-github.com/vishvananda/netns v0.0.4/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
 github.com/vishvananda/netns v0.0.5 h1:DfiHV+j8bA32MFM7bfEunvT8IAqQ/NzSJHtcmW5zdEY=
 github.com/vishvananda/netns v0.0.5/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
@@ -1269,8 +1329,8 @@ go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0 h1:OeNbIYk/2C15ckl7glB
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0/go.mod h1:7Bept48yIeqxP2OZ9/AqIpYS94h2or0aB4FypJTc8ZM=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0 h1:tgJ0uaNS4c98WRNUEx5U3aDlrDOI5Rs+1Vifcw4DJ8U=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0/go.mod h1:U7HYyW0zt/a9x5J1Kjs+r1f/d4ZHnYFclhYY2+YbeoE=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.33.0 h1:wpMfgF8E1rkrT1Z6meFh1NDtownE9Ii3n3X2GJYjsaU=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.33.0/go.mod h1:wAy0T/dUbs468uOlkT31xjvqQgEVXv58BRFWEgn5v/0=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.32.0 h1:cMyu9O88joYEaI47CnQkxO1XZdpoTF9fEnW2duIddhw=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.32.0/go.mod h1:6Am3rn7P9TVVeXYG+wtcGE7IE1tsQ+bP3AuWcKt/gOI=
 go.opentelemetry.io/otel/exporters/prometheus v0.54.0 h1:rFwzp68QMgtzu9PgP3jm9XaMICI6TsofWWPcBDKwlsU=
 go.opentelemetry.io/otel/exporters/prometheus v0.54.0/go.mod h1:QyjcV9qDP6VeK5qPyKETvNjmaaEc7+gqjh4SS0ZYzDU=
 go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.8.0 h1:CHXNXwfKWfzS65yrlB2PVds1IBZcdsX8Vepy9of0iRU=
@@ -1301,8 +1361,8 @@ go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
 go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
 go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
-go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
-go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
+go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
+go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 go4.org/mem v0.0.0-20240501181205-ae6ca9944745 h1:Tl++JLUCe4sxGu8cTpDzRLd3tN7US4hOxG5YpKCzkek=
@@ -1319,8 +1379,8 @@ golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw=
-golang.org/x/crypto v0.46.0 h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU=
-golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0=
+golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
+golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
 golang.org/x/crypto/x509roots/fallback v0.0.0-20260113154411-7d0074ccc6f1 h1:EBHQuS9qI8xJ96+YRgVV2ahFLUYbWpt1rf3wPfXN2wQ=
 golang.org/x/crypto/x509roots/fallback v0.0.0-20260113154411-7d0074ccc6f1/go.mod h1:MEIPiCnxvQEjA4astfaKItNwEVZA5Ki+3+nyGbJ5N18=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -1333,16 +1393,16 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b h1:M2rDM6z3Fhozi9O7NWsxAkg/yqS/lQJ6PmkyIV3YP+o=
-golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b/go.mod h1:3//PLf8L/X+8b4vuAfHzxeRUl04Adcb341+IGKfnqS8=
+golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
+golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
 golang.org/x/exp/typeparams v0.0.0-20220428152302-39d4317da171/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk=
 golang.org/x/exp/typeparams v0.0.0-20230203172020-98cc5a0785f9/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk=
 golang.org/x/exp/typeparams v0.0.0-20240314144324-c7f7c6466f7f h1:phY1HzDcf18Aq9A8KkmRtY9WvOFIxN8wgfvy6Zm1DV8=
 golang.org/x/exp/typeparams v0.0.0-20240314144324-c7f7c6466f7f/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.27.0 h1:C8gA4oWU/tKkdCfYT6T2u4faJu3MeNS5O8UPWlPF61w=
-golang.org/x/image v0.27.0/go.mod h1:xbdrClrAUway1MUTEZDq9mz/UpRwYAkFFNUslZtcB+g=
+golang.org/x/image v0.41.0 h1:8wS72eGJMJaBxK6okTzd4WaXumUlTVlb753MlsSvTCo=
+golang.org/x/image v0.41.0/go.mod h1:uIc348UZMSvS5Z65CVZ7iDPaNobNFEPeJ4kbqTOszmA=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -1370,8 +1430,8 @@ golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91
 golang.org/x/mod v0.6.0/go.mod h1:4mET923SAdbXp2ki8ey+zGs1SLqsuM2Y0uvdZR/fUNI=
 golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.31.0 h1:HaW9xtz0+kOcWKwli0ZXy79Ix+UW/vOfmWI5QVd2tgI=
-golang.org/x/mod v0.31.0/go.mod h1:43JraMp9cGx1Rx3AqioxrbrhNsLl2l/iNAvuBkrezpg=
+golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
+golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -1411,8 +1471,8 @@ golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
 golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
 golang.org/x/net v0.5.0/go.mod h1:DivGGAXEgPSlEBzxGzZI+ZLohi+xUj054jfeKui00ws=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU=
-golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY=
+golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
+golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -1434,8 +1494,8 @@ golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
-golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1494,25 +1554,25 @@ golang.org/x/sys v0.0.0-20220702020025-31831981b65f/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220817070843-5a390386f1f2/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ=
-golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/telemetry v0.0.0-20251203150158-8fff8a5912fc h1:bH6xUXay0AIFMElXG2rQ4uiE+7ncwtiOdPfYK1NK2XA=
-golang.org/x/telemetry v0.0.0-20251203150158-8fff8a5912fc/go.mod h1:hKdjCMrbv9skySur+Nek8Hd0uJ0GuxJIoIX2payrIdQ=
+golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/telemetry v0.0.0-20260625142307-59b4966ccb57 h1:nwGZBCt+FnXUrGsj5vjzAsEmkcaFvd82BbOjECiFYZc=
+golang.org/x/telemetry v0.0.0-20260625142307-59b4966ccb57/go.mod h1:3AWMyWHS+caVoiEXpiq6+tzKA40J4vQT3MYr80ZtQpc=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
 golang.org/x/term v0.4.0/go.mod h1:9P2UbLfCdcvo3p/nzKvsmas4TnlujnuoV9hGgYzW1lQ=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.38.0 h1:PQ5pkm/rLO6HnxFR7N2lJHOZX6Kez5Y1gDSJla6jo7Q=
-golang.org/x/term v0.38.0/go.mod h1:bSEAKrOT1W+VSu9TSCMtoGEOUcKxOKgl3LE5QEF/xVg=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1523,13 +1583,13 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.6.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU=
-golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY=
+golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
+golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
-golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
+golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
+golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
@@ -1594,8 +1654,8 @@ golang.org/x/tools v0.2.0/go.mod h1:y4OqIKeOV/fWJetJ8bXPU1sEVniLMIyDAZWeHdV+NTA=
 golang.org/x/tools v0.3.0/go.mod h1:/rWhSS2+zyEVwoJf8YAX6L2f0ntZ7Kn/mGgAWcipA5k=
 golang.org/x/tools v0.5.0/go.mod h1:N+Kgy78s5I24c24dU8OfWNEotWjutIs8SnJvn5IDq+k=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.40.1-0.20260108161641-ca281cf95054 h1:CHVDrNHx9ZoOrNN9kKWYIbT5Rj+WF2rlwPkhbQQ5V4U=
-golang.org/x/tools v0.40.1-0.20260108161641-ca281cf95054/go.mod h1:Ik/tzLRlbscWpqqMRjyWYDisX8bG13FrdXp3o4Sr9lc=
+golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
+golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
 golang.org/x/tools/go/expect v0.1.1-deprecated h1:jpBZDwmgPhXsKZC6WhL20P4b/wmnpsEAGHaNy0n/rJM=
 golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY=
 golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM=
@@ -1608,6 +1668,8 @@ golang.org/x/xerrors v0.0.0-20240716161551-93cc26a95ae9 h1:LLhsEBxRTBLuKlQxFBYUO
 golang.org/x/xerrors v0.0.0-20240716161551-93cc26a95ae9/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 h1:B82qJJgjvYKsXS9jeunTOisW56dUokqW/FOteYJJ/yg=
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2/go.mod h1:deeaetjYA+DHMHg+sMSMI58GrEteJUUzzw7en6TJQcI=
+golang.zx2c4.com/wireguard v0.0.0-20260522210424-ecfc5a8d5446 h1:cqHQ3AycTHvM2R7ikgyX57D+XvtcSnGylsLkOVhta/w=
+golang.zx2c4.com/wireguard v0.0.0-20260522210424-ecfc5a8d5446/go.mod h1:rpwXGsirqLqN2L0JDJQlwOboGHmptD5ZD6T2VmcqhTw=
 golang.zx2c4.com/wireguard/windows v0.5.3 h1:On6j2Rpn3OEMXqBq00QEDC7bWSZrPIHKIus8eIuExIE=
 golang.zx2c4.com/wireguard/windows v0.5.3/go.mod h1:9TEe8TJmtwyQebdFwAkEWOPr3prrtqm+REGFifP60hI=
 gomodules.xyz/jsonpatch/v2 v2.4.0 h1:Ci3iUJyx9UeRx7CeFN8ARgGbkESwJK+KB9lLcWxY/Zw=
@@ -1728,8 +1790,8 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gotest.tools/v3 v3.4.0 h1:ZazjZUfuVeZGLAmlKKuyv3IKP5orXcwtOwDQH6YVr6o=
-gotest.tools/v3 v3.4.0/go.mod h1:CtbdzLSsqVhDgMtKsx03ird5YTGB3ar27v0u/yKBW5g=
+gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
+gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
 gvisor.dev/gvisor v0.0.0-20260224225140-573d5e7127a8 h1:Zy8IV/+FMLxy6j6p87vk/vQGKcdnbprwjTxc8UiUtsA=
 gvisor.dev/gvisor v0.0.0-20260224225140-573d5e7127a8/go.mod h1:QkHjoMIBaYtpVufgwv3keYAbln78mBoCuShZrPrer1Q=
 helm.sh/helm/v3 v3.19.0 h1:krVyCGa8fa/wzTZgqw0DUiXuRT5BPdeqE/sQXujQ22k=
@@ -1773,6 +1835,8 @@ mvdan.cc/unparam v0.0.0-20240104100049-c549a3470d14 h1:zCr3iRRgdk5eIikZNDphGcM6K
 mvdan.cc/unparam v0.0.0-20240104100049-c549a3470d14/go.mod h1:ZzZjEpJDOmx8TdVU6umamY3Xy0UAQUI2DHbf05USVbI=
 oras.land/oras-go/v2 v2.6.0 h1:X4ELRsiGkrbeox69+9tzTu492FMUu7zJQW6eJU+I2oc=
 oras.land/oras-go/v2 v2.6.0/go.mod h1:magiQDfG6H1O9APp+rOsvCPcW1GD2MM7vgnKY0Y+u1o=
+pgregory.net/rapid v1.2.0 h1:keKAYRcjm+e1F0oAuU5F5+YPAWcyxNNRK2wud503Gnk=
+pgregory.net/rapid v1.2.0/go.mod h1:PY5XlDGj0+V1FCq0o192FdRhpKHGTRIWBgqjDBTrq04=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
diff --git a/go.toolchain.next.rev b/go.toolchain.next.rev
index dbcbdd5e1..4aaa98687 100644
--- a/go.toolchain.next.rev
+++ b/go.toolchain.next.rev
@@ -1 +1 @@
-dfe2a5fd8ee2e68b08ce5ff259269f50ecadf2f4
+63ae404c8203317fd3c82d972e5dc8f0fcb425cb
diff --git a/go.toolchain.rev b/go.toolchain.rev
index dbcbdd5e1..4aaa98687 100644
--- a/go.toolchain.rev
+++ b/go.toolchain.rev
@@ -1 +1 @@
-dfe2a5fd8ee2e68b08ce5ff259269f50ecadf2f4
+63ae404c8203317fd3c82d972e5dc8f0fcb425cb
diff --git a/go.toolchain.rev.sri b/go.toolchain.rev.sri
deleted file mode 100644
index 00025af58..000000000
--- a/go.toolchain.rev.sri
+++ /dev/null
@@ -1 +0,0 @@
-sha256-pCvFNTFuvhSBb5O+PPuilaowP4tXcCOP1NgYUDJTcJU=
diff --git a/go.toolchain.version b/go.toolchain.version
index c7c3f3333..8fe00a57f 100644
--- a/go.toolchain.version
+++ b/go.toolchain.version
@@ -1 +1 @@
-1.26.2
+1.26.5
diff --git a/gokrazy/Makefile b/gokrazy/Makefile
index bc55f2a52..9071e7e9e 100644
--- a/gokrazy/Makefile
+++ b/gokrazy/Makefile
@@ -4,6 +4,9 @@ help:
 image:
 	go run build.go --build
 
+gaf:
+	go run build.go --gaf
+
 qemu: image
 	qemu-system-x86_64 -m 1G -drive file=tsapp.img,format=raw -boot d -netdev user,id=user.0 -device virtio-net-pci,netdev=user.0 -serial mon:stdio -audio none
 
@@ -11,3 +14,8 @@ qemu: image
 natlab:
 	go run build.go --build --app=natlabapp
 	qemu-img convert -O qcow2 natlabapp.img natlabapp.qcow2
+
+# For natlab integration tests on macOS arm64:
+natlab-arm64:
+	go run build.go --build --app=natlabapp.arm64
+	qemu-img convert -O qcow2 natlabapp.arm64.img natlabapp.arm64.qcow2
diff --git a/gokrazy/README.md b/gokrazy/README.md
index af41ad62a..5ceb91a14 100644
--- a/gokrazy/README.md
+++ b/gokrazy/README.md
@@ -51,8 +51,14 @@ For UTM, see the [UTM instructions](UTM.md).
 
 ### Build an AMI
 
-`go run build.go --bucket=your-S3-temp-bucket` to build an AMI. Make
-sure your "aws" command is in your path and has access.
+`go run build.go --bucket=your-S3-temp-bucket` to build an AMI.
+
+Credentials come from the AWS SDK's default chain, so authenticate any way it
+recognizes: `aws sso login`, `aws configure`, an `AWS_PROFILE`,
+`AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY` env vars, or
+`aws-vault exec <profile> -- go run build.go --bucket=...` (aws-vault injects
+temporary credentials as env vars). If no credentials are found the build stops
+with a message telling you how to log in.
 
 ### Creating an instance
 
@@ -74,3 +80,32 @@ $ aws ec2-instance-connect send-serial-console-ssh-public-key --instance-id i-0b
 }
 $ ssh i-0b4a0eabc43629f13.port0@serial-console.ec2-instance-connect.us-west-2.aws 
 ```
+
+### Configuring the appliance
+
+The appliance's `tailscaled` runs with `-config=optional:vm:user-data`, so a
+single AMI supports two ways of joining a tailnet:
+
+- **Declarative (user-data):** put a Tailscale config (the `alpha0` HuJSON
+  format) in the instance's user-data and the node configures itself on first
+  boot. The minimal config is just an auth key:
+
+  ```json
+  {
+    "Version": "alpha0",
+    "AuthKey": "tskey-auth-..."
+  }
+  ```
+
+  A config present in user-data locks the CLI (`tailscale set`/`up` are
+  rejected) unless it sets `"Locked": false`. Add `"RemoteConfig": true` to
+  hand full remote management of the node to the tailnet admin (see
+  `Prefs.RemoteConfig`) — appropriate for admin-owned fleet devices.
+
+- **Interactive (serial console):** launch the AMI with *no* user-data. The
+  `optional:` prefix means the missing config is not an error, so `tailscaled`
+  boots unconfigured and you can enroll it over the serial console (connect as
+  above, then run `tailscale up` and open the printed login URL).
+
+To require config instead (fail to boot if none is present), build an image
+whose `tailscaled` uses `-config=vm:user-data` without the `optional:` prefix.
diff --git a/gokrazy/build.go b/gokrazy/build.go
index f92edb1a3..612b484c1 100644
--- a/gokrazy/build.go
+++ b/gokrazy/build.go
@@ -6,315 +6,69 @@
 // As of 2024-06-02 this is a exploratory work in progress and is
 // not intended for serious use.
 //
+// The build logic lives in tailscale.com/gokrazy/build; this is a thin
+// CLI wrapper around it.
+//
 // Tracking issue is https://github.com/tailscale/tailscale/issues/1866
 package main
 
 import (
-	"bytes"
+	"context"
 	"encoding/json"
-	"errors"
 	"flag"
-	"fmt"
-	"io"
 	"log"
 	"os"
-	"os/exec"
-	"path/filepath"
-	"regexp"
-	"runtime"
-	"strings"
-	"time"
+
+	"tailscale.com/gokrazy/build"
 )
 
 var (
-	app    = flag.String("app", "tsapp", "appliance name; one of the subdirectories of gokrazy/")
-	bucket = flag.String("bucket", "tskrazy-import", "S3 bucket to upload disk image to while making AMI")
-	build  = flag.Bool("build", false, "if true, just build locally and stop, without uploading")
+	app        = flag.String("app", "tsapp", "appliance name; one of the subdirectories of gokrazy/")
+	bucket     = flag.String("bucket", "tskrazy-import", "S3 bucket to upload disk image to while making AMI")
+	buildLocal = flag.Bool("build", false, "if true, just build locally and stop, without uploading")
+	gaf        = flag.Bool("gaf", false, "if true, build a gokrazy archive format file instead of a full disk image")
+	jsonOut    = flag.Bool("json", false, "emit one machine-readable JSON result line to stdout")
+	region     = flag.String("region", "", "AWS region for import+register; default us-east-1 (honors $AWS_REGION)")
 )
 
-func findMkfsExt4() (string, error) {
-	tries := []string{
-		"/opt/homebrew/opt/e2fsprogs/sbin/mkfs.ext4",
-		"/sbin/mkfs.ext4",
-	}
-	for _, p := range tries {
-		if _, err := os.Stat(p); err == nil {
-			return p, nil
-		}
-	}
-	p, err := exec.LookPath("mkfs.ext4")
-	if err == nil {
-		return p, nil
-	}
-	if runtime.GOOS == "darwin" {
-		return "", errors.New("no mkfs.ext4 found; run `brew install e2fsprogs`")
-	}
-	return "", errors.New("No mkfs.ext4 found on system")
-}
-
-var conf gokrazyConfig
-
-// gokrazyConfig is the subset of gokrazy/internal/config.Struct
-// that we care about.
-type gokrazyConfig struct {
-	// Environment is os.Environment pairs to use when
-	// building userspace.
-	// See https://gokrazy.org/userguide/instance-config/#environment
-	Environment []string
-}
-
-func (c *gokrazyConfig) GOARCH() string {
-	for _, e := range c.Environment {
-		if v, ok := strings.CutPrefix(e, "GOARCH="); ok {
-			return v
-		}
-	}
-	return ""
-}
-
 func main() {
 	flag.Parse()
 
-	if *app == "" || strings.Contains(*app, "/") {
-		log.Fatalf("--app must be non-empty name such as 'tsapp' or 'natlabapp'")
+	res, err := run(context.Background())
+
+	// With --json, print one machine-readable result line to stdout,
+	// including any error, so consumers see the outcome on stdout rather
+	// than only via the exit code. All logs/progress go to stderr.
+	if *jsonOut {
+		if encErr := json.NewEncoder(os.Stdout).Encode(&res); encErr != nil {
+			log.Fatalf("encoding json result: %v", encErr)
+		}
+	}
+	if err != nil {
+		log.Fatalf("%v", err)
+	}
+}
+
+// run builds the appliance and returns the machine-readable result. The
+// artifact is a CLI choice mapped to the matching Builder method: --gaf →
+// GAF, --build → local image only, otherwise the full AMI pipeline.
+func run(ctx context.Context) (build.Result, error) {
+	b, err := build.New(build.Config{
+		App:    *app,
+		Bucket: *bucket,
+		Region: build.ResolveRegion(*region, os.Getenv("AWS_REGION")),
+	})
+	if err != nil {
+		return build.Result{App: *app, Error: err.Error()}, err
 	}
 
-	confJSON, err := os.ReadFile(filepath.Join(*app, "config.json"))
-	if err != nil {
-		log.Fatalf("reading config.json: %v", err)
-	}
-	if err := json.Unmarshal(confJSON, &conf); err != nil {
-		log.Fatalf("unmarshaling config.json: %v", err)
-	}
-	switch conf.GOARCH() {
-	case "amd64", "arm64":
+	switch {
+	case *gaf:
+		_, err = b.BuildGAF(ctx)
+	case *buildLocal:
+		_, err = b.BuildImage(ctx)
 	default:
-		log.Fatalf("config.json GOARCH %q must be amd64 or arm64", conf.GOARCH())
+		_, err = b.BuildAndImportAMI(ctx)
 	}
-
-	if err := buildImage(); err != nil {
-		log.Fatalf("build image: %v", err)
-	}
-	if *build {
-		log.Printf("built. stopping.")
-		return
-	}
-
-	if err := copyToS3(); err != nil {
-		log.Fatalf("copy to S3: %v", err)
-	}
-
-	importTask, err := startImportSnapshot()
-	if err != nil {
-		log.Fatalf("start import snapshot: %v", err)
-	}
-	snapID, err := waitForImportSnapshot(importTask)
-	if err != nil {
-		log.Fatalf("waitForImportSnapshot(%v): %v", importTask, err)
-	}
-	log.Printf("snap ID: %v", snapID)
-
-	ami, err := makeAMI(fmt.Sprintf(*app+"-%d", time.Now().Unix()), snapID)
-	if err != nil {
-		log.Fatalf("makeAMI: %v", err)
-	}
-	log.Printf("made AMI: %v", ami)
-}
-
-func buildImage() error {
-	mkfs, err := findMkfsExt4()
-	if err != nil {
-		return err
-	}
-
-	dir, err := os.Getwd()
-	if err != nil {
-		return err
-	}
-	if fi, err := os.Stat(filepath.Join(dir, *app)); err != nil || !fi.IsDir() {
-		return fmt.Errorf("in wrong directory %v; no %q subdirectory found", dir, *app)
-	}
-	// Build the tsapp.img
-	var buf bytes.Buffer
-	cmd := exec.Command("go", "run",
-		"github.com/bradfitz/monogok/cmd/monogok",
-		"overwrite",
-		"--full", filepath.Join(dir, *app+".img"),
-		"--target_storage_bytes=1258299392")
-	cmd.Dir = filepath.Join(dir, *app)
-	cmd.Stdout = io.MultiWriter(os.Stdout, &buf)
-	cmd.Stderr = os.Stderr
-	if err := cmd.Run(); err != nil {
-		return err
-	}
-
-	// monogok overwrite emits a line of text saying how to run mkfs.ext4
-	// to create the ext4 /perm filesystem. Parse that and run it.
-	// The regexp is tight to avoid matching if the command changes,
-	// to force us to check it's still correct/safe. But it shouldn't
-	// change on its own because we pin the monogok version in our go.mod.
-	//
-	// TODO(bradfitz): emit this in a machine-readable way from monogok.
-	rx := regexp.MustCompile(`(?m)/mkfs.ext4 (-F) (-E) (offset=\d+) (\S+) (\d+)\s*?$`)
-	m := rx.FindStringSubmatch(buf.String())
-	if m == nil {
-		return fmt.Errorf("found no ext4 instructions in output")
-	}
-
-	log.Printf("Running %s %q ...", mkfs, m[1:])
-	out, err := exec.Command(mkfs, m[1:]...).CombinedOutput()
-	if err != nil {
-		return fmt.Errorf("error running %v: %v, %s", mkfs, err, out)
-	}
-	log.Printf("Success.")
-
-	return nil
-}
-
-func copyToS3() error {
-	cmd := exec.Command("aws", "s3", "cp", *app+".img", "s3://"+*bucket+"/")
-	cmd.Stdout = os.Stdout
-	cmd.Stderr = os.Stderr
-	return cmd.Run()
-}
-
-func startImportSnapshot() (importTaskID string, err error) {
-	out, err := exec.Command("aws", "ec2", "import-snapshot", "--disk-container", "Url=s3://"+*bucket+"/"+*app+".img").CombinedOutput()
-	if err != nil {
-		return "", fmt.Errorf("import snapshot: %v: %s", err, out)
-	}
-	var resp struct {
-		ImportTaskID string `json:"ImportTaskId"`
-	}
-	/*
-		{
-			"ImportTaskId": "import-snap-0d2d72622b4359567",
-			"SnapshotTaskDetail": {
-				"DiskImageSize": 0.0,
-				"Progress": "0",
-				"Status": "active",
-				"StatusMessage": "pending",
-				"Url": "s3://tskrazy-import/tskrazy.img"
-			},
-			"Tags": []
-		}
-	*/
-	if err := json.Unmarshal(out, &resp); err != nil {
-		return "", fmt.Errorf("unmarshal response: %v: %s", err, out)
-	}
-	return resp.ImportTaskID, nil
-}
-
-/*
-% aws ec2 describe-import-snapshot-tasks --import-task-ids import-snap-0d2d72622b4359567
-{
-    "ImportSnapshotTasks": [
-        {
-            "ImportTaskId": "import-snap-0d2d72622b4359567",
-            "SnapshotTaskDetail": {
-                "DiskImageSize": 1258299392.0,
-                "Format": "RAW",
-                "SnapshotId": "snap-053efd3539d787927",
-                "Status": "completed",
-                "Url": "s3://tskrazy-import/tskrazy.img",
-                "UserBucket": {
-                    "S3Bucket": "tskrazy-import",
-                    "S3Key": "tskrazy.img"
-                }
-            },
-            "Tags": []
-        }
-    ]
-}
-*/
-
-func waitForImportSnapshot(importTaskID string) (snapID string, err error) {
-	for {
-		out, err := exec.Command("aws", "ec2", "describe-import-snapshot-tasks", "--import-task-ids", importTaskID).CombinedOutput()
-		if err != nil {
-			return "", fmt.Errorf("describe import snapshot tasks: %v: %s", err, out)
-		}
-
-		var resp struct {
-			ImportSnapshotTasks []struct {
-				SnapshotTaskDetail struct {
-					SnapshotID string `json:"SnapshotId"`
-					Status     string `json:"Status"`
-				} `json:"SnapshotTaskDetail"`
-			} `json:"ImportSnapshotTasks"`
-		}
-		if err := json.Unmarshal(out, &resp); err != nil {
-			return "", fmt.Errorf("unmarshal response: %v: %s", err, out)
-		}
-		if len(resp.ImportSnapshotTasks) > 0 {
-			first := &resp.ImportSnapshotTasks[0]
-			if first.SnapshotTaskDetail.Status == "completed" {
-				return first.SnapshotTaskDetail.SnapshotID, nil
-			}
-		}
-		log.Printf("Still waiting; got: %s", out)
-		time.Sleep(5 * time.Second)
-
-		// TODO(bradfitz): percentage bar?
-		// Looks like:
-		/* 2024/05/14 13:03:21 Still waiting; got: {
-		    "ImportSnapshotTasks": [
-		        {
-		            "ImportTaskId": "import-snap-0232251d0fbcb33fd",
-		            "SnapshotTaskDetail": {
-		                "DiskImageSize": 1258299392.0,
-		                "Format": "RAW",
-		                "Progress": "32",
-		                "Status": "active",
-		                "StatusMessage": "validated",
-		                "Url": "s3://tskrazy-import/tskrazy.img",
-		                "UserBucket": {
-		                    "S3Bucket": "tskrazy-import",
-		                    "S3Key": "tskrazy.img"
-		                }
-		            },
-		            "Tags": []
-		        }
-		    ]
-		}*/
-	}
-}
-
-func makeAMI(name, ebsSnapID string) (ami string, err error) {
-	var arch string
-	switch conf.GOARCH() {
-	case "arm64":
-		arch = "arm64"
-	case "amd64":
-		arch = "x86_64"
-	default:
-		return "", fmt.Errorf("unknown arch %q", conf.GOARCH())
-	}
-	out, err := exec.Command("aws", "ec2", "register-image",
-		"--name", name,
-		"--architecture", arch,
-		"--root-device-name", "/dev/sda",
-		"--ena-support",
-		"--imds-support", "v2.0",
-		"--boot-mode", "uefi-preferred",
-		"--block-device-mappings", "DeviceName=/dev/sda,Ebs={SnapshotId="+ebsSnapID+"}").CombinedOutput()
-	if err != nil {
-		return "", fmt.Errorf("register image: %v: %s", err, out)
-	}
-	/*
-		On success:
-		{
-		    "ImageId": "ami-052e1538166886ad2"
-		}
-	*/
-	var resp struct {
-		ImageID string `json:"ImageId"`
-	}
-	if err := json.Unmarshal(out, &resp); err != nil {
-		return "", fmt.Errorf("unmarshal response: %v: %s", err, out)
-	}
-	if resp.ImageID == "" {
-		return "", fmt.Errorf("empty image ID in response: %s", out)
-	}
-	return resp.ImageID, nil
+	return b.Result(), err
 }
diff --git a/gokrazy/build/build.go b/gokrazy/build/build.go
new file mode 100644
index 000000000..0334a0721
--- /dev/null
+++ b/gokrazy/build/build.go
@@ -0,0 +1,789 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package build builds the Tailscale Appliance Gokrazy image and,
+// optionally, an AWS AMI from it.
+//
+// It is the reusable core behind the gokrazy/build.go command: a
+// [Builder] runs monogok to produce a disk image (or GAF), formats the
+// ext4 /perm filesystem via gokrazy/mkfs, and can then upload the image
+// to S3 and register an AMI using the AWS SDK for Go v2. Credentials are
+// resolved via the SDK's default chain (the same sources the "aws" CLI
+// uses: env vars, ~/.aws, SSO cache, IMDS). Callers that only want the
+// image (e.g. flash-appliance tooling) can call [Builder.BuildImage]
+// alone.
+//
+// Tracking issue is https://github.com/tailscale/tailscale/issues/1866
+package build
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/feature/s3/manager"
+	"github.com/aws/aws-sdk-go-v2/service/ec2"
+	ec2types "github.com/aws/aws-sdk-go-v2/service/ec2/types"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/sts"
+	"github.com/mattn/go-isatty"
+	"tailscale.com/gokrazy/mkfs"
+	tsrate "tailscale.com/tstime/rate"
+	"tailscale.com/types/logger"
+)
+
+// Result is the machine-readable outcome of a build. Fields are
+// populated as the run progresses; per docs/cli.md, existing fields
+// keep their meaning and consumers must tolerate new ones.
+type Result struct {
+	App      string `json:"app"`
+	Arch     string `json:"arch"`
+	Name     string `json:"name,omitempty"`
+	Image    string `json:"image,omitempty"`
+	GAF      string `json:"gaf,omitempty"`
+	S3       string `json:"s3,omitempty"` // s3:// URI of the uploaded image
+	Region   string `json:"region,omitempty"`
+	Snapshot string `json:"snapshot,omitempty"`
+	AMI      string `json:"ami,omitempty"`
+	// Error is the error that ended the build, if any. It lets --json
+	// consumers see why a run failed rather than only its exit code.
+	Error string `json:"error,omitempty"`
+}
+
+// Config configures a [Builder]. Only App is required; New fills in the
+// rest with defaults. It holds build inputs only; what to produce is
+// chosen by which build method you call ([Builder.BuildImage],
+// [Builder.BuildGAF], or [Builder.BuildAndImportAMI]).
+type Config struct {
+	// App is the appliance name, e.g. "tsapp". It must be a
+	// subdirectory of Dir containing a config.json.
+	App string
+	// Dir is the directory holding the appliance subdirectories.
+	// Empty means the current working directory.
+	Dir string
+	// Bucket is the S3 bucket that BuildAndImportAMI uploads the disk
+	// image to while registering the AMI. Unused by BuildImage and
+	// BuildGAF.
+	Bucket string
+	// Region is the AWS region BuildAndImportAMI imports and registers
+	// in. Empty means ResolveRegion("", $AWS_REGION).
+	Region string
+
+	// Logf receives human-readable progress. If nil, log.Printf is used.
+	Logf logger.Logf
+	// Stderr receives the output of subprocesses (monogok). If nil,
+	// os.Stderr is used. Keeping this off stdout lets callers reserve
+	// stdout for machine-readable output.
+	Stderr io.Writer
+}
+
+// Builder builds one appliance image, GAF, or AMI per its Config.
+// Create one with [New]; it is not safe for concurrent use.
+//
+// The build steps are stateful and ordered: each records its output into
+// the Result (read with [Builder.Result]) and the AWS steps verify their
+// predecessor ran — by checking the Result field it populated — erroring
+// clearly if called out of order. The order is BuildImage → UploadToS3 →
+// ImportSnapshot → RegisterAMI.
+type Builder struct {
+	Config
+
+	conf gokrazyConfig // parsed <Dir>/<App>/config.json
+	res  Result
+
+	// s3c and ec2c are lazily created by awsClients on first use and
+	// cached; they're nil until then.
+	s3c  *s3.Client
+	ec2c *ec2.Client
+}
+
+// baseImageSizeBytes is the size of the disk image we ask monogok to
+// produce (and that the AWS AMI import expects). It has to be large
+// enough to fit gokrazy's standard partition layout (see
+// github.com/bradfitz/monogok/disklayout):
+//
+//	  4 MiB gap before the first partition
+//	100 MiB boot      (FAT)
+//	500 MiB root A    (squashfs; the partition OTA updates write into)
+//	500 MiB root B    (squashfs)
+//	 ~96 MiB /perm    (ext4; rest of the disk minus the secondary GPT)
+//
+// Bump this to give /perm more room (and to make the produced .img
+// file larger). The same value is passed to monogok via
+// --target_storage_bytes and to mkfs.Perm so the GPT and the ext4
+// inside it agree on the disk's size.
+//
+// imageSizeBytesFor may round this up; callers should use that helper
+// instead of this constant.
+const baseImageSizeBytes = 1258299392
+
+// gokrazyConfig is the subset of gokrazy/internal/config.Struct
+// that we care about.
+type gokrazyConfig struct {
+	// Environment is os.Environment pairs to use when
+	// building userspace.
+	// See https://gokrazy.org/userguide/instance-config/#environment
+	Environment []string
+}
+
+func (c *gokrazyConfig) GOARCH() string {
+	for _, e := range c.Environment {
+		if v, ok := strings.CutPrefix(e, "GOARCH="); ok {
+			return v
+		}
+	}
+	return ""
+}
+
+// New validates cfg, applies defaults, and loads <Dir>/<App>/config.json.
+func New(cfg Config) (*Builder, error) {
+	if cfg.App == "" || strings.Contains(cfg.App, "/") {
+		return nil, fmt.Errorf("App must be a non-empty name such as 'tsapp' or 'natlabapp'; got %q", cfg.App)
+	}
+	if cfg.Dir == "" {
+		wd, err := os.Getwd()
+		if err != nil {
+			return nil, err
+		}
+		cfg.Dir = wd
+	}
+	if cfg.Region == "" {
+		cfg.Region = ResolveRegion("", os.Getenv("AWS_REGION"))
+	}
+	if cfg.Stderr == nil {
+		cfg.Stderr = os.Stderr
+	}
+
+	b := &Builder{Config: cfg}
+
+	confJSON, err := os.ReadFile(filepath.Join(cfg.Dir, cfg.App, "config.json"))
+	if err != nil {
+		return nil, fmt.Errorf("reading config.json: %w", err)
+	}
+	if err := json.Unmarshal(confJSON, &b.conf); err != nil {
+		return nil, fmt.Errorf("unmarshaling config.json: %w", err)
+	}
+	switch b.conf.GOARCH() {
+	case "amd64", "arm64":
+	default:
+		return nil, fmt.Errorf("config.json GOARCH %q must be amd64 or arm64", b.conf.GOARCH())
+	}
+
+	b.res.App = cfg.App
+	b.res.Arch = awsArch(b.conf.GOARCH())
+	return b, nil
+}
+
+// Result returns the result so far: each step fills its fields as it
+// runs, and Result.Error holds the error that ended a failed run.
+func (b *Builder) Result() Result { return b.res }
+
+// fail records err in Result.Error so a caller reading Result() after a
+// failed step (e.g. to emit --json) still sees why it failed.
+func (b *Builder) fail(err error) error {
+	b.res.Error = err.Error()
+	return err
+}
+
+// logf logs progress via b.Logf, or log.Printf if unset.
+func (b *Builder) logf(format string, args ...any) {
+	if b.Logf != nil {
+		b.Logf(format, args...)
+		return
+	}
+	log.Printf(format, args...)
+}
+
+// BuildImage runs monogok to produce a full disk image (.img) with a
+// formatted ext4 /perm, returning its path (also in Result.Image). It's
+// the artifact BuildAndImportAMI publishes and flash-appliance flashes.
+func (b *Builder) BuildImage(ctx context.Context) (imagePath string, err error) {
+	if err := b.buildImage(ctx, false); err != nil {
+		return "", b.fail(fmt.Errorf("build image: %w", err))
+	}
+	return b.res.Image, nil
+}
+
+// BuildGAF runs monogok to produce a GAF (gokrazy archive format) OTA
+// update file, returning its path (also in Result.GAF). A GAF is an
+// update archive, not a full disk, so it can't be turned into an AMI.
+func (b *Builder) BuildGAF(ctx context.Context) (gafPath string, err error) {
+	if err := b.buildImage(ctx, true); err != nil {
+		return "", b.fail(fmt.Errorf("build GAF: %w", err))
+	}
+	return b.res.GAF, nil
+}
+
+// BuildAndImportAMI runs the whole pipeline (build image, upload, import
+// snapshot, register AMI) and returns the populated Result.
+//
+// It's a convenience orchestrator over the public steps; a caller that
+// needs to interleave its own work (Marketplace publishing, multi-region
+// registration) can call [Builder.CheckAWSAuth], [Builder.BuildImage],
+// [Builder.UploadToS3], [Builder.ImportSnapshot], and [Builder.RegisterAMI]
+// directly in that order.
+func (b *Builder) BuildAndImportAMI(ctx context.Context) (Result, error) {
+	// Preflight auth before the slow image build so a logged-out user
+	// fails in seconds, not minutes.
+	if err := b.CheckAWSAuth(ctx); err != nil {
+		return b.res, b.fail(err)
+	}
+
+	b.logf("[1/4] building image (%s)", b.App)
+	if _, err := b.BuildImage(ctx); err != nil {
+		return b.res, err // BuildImage already wrapped+recorded it
+	}
+
+	b.logf("[2/4] uploading to s3://%s/%s.img", b.Bucket, b.App)
+	if _, err := b.UploadToS3(ctx); err != nil {
+		return b.res, b.fail(fmt.Errorf("copy to S3: %w", err))
+	}
+
+	b.logf("[3/4] importing EBS snapshot")
+	if _, err := b.ImportSnapshot(ctx); err != nil {
+		return b.res, b.fail(fmt.Errorf("import snapshot: %w", err))
+	}
+	b.logf("snap ID: %v", b.res.Snapshot)
+
+	b.logf("[4/4] registering AMI")
+	if _, err := b.RegisterAMI(ctx); err != nil {
+		return b.res, b.fail(fmt.Errorf("register AMI: %w", err))
+	}
+	b.logf("made AMI: %v", b.res.AMI)
+	return b.res, nil
+}
+
+// awsClients lazily builds and caches the S3 and EC2 clients from the
+// SDK default credential chain and resolved region.
+func (b *Builder) awsClients(ctx context.Context) (*s3.Client, *ec2.Client, error) {
+	if b.s3c != nil && b.ec2c != nil {
+		return b.s3c, b.ec2c, nil
+	}
+	cfg, err := config.LoadDefaultConfig(ctx, config.WithRegion(b.Region))
+	if err != nil {
+		return nil, nil, fmt.Errorf("loading AWS config (check AWS_PROFILE / ~/.aws, or run `aws sso login`): %w", err)
+	}
+	b.s3c = s3.NewFromConfig(cfg)
+	b.ec2c = ec2.NewFromConfig(cfg)
+	return b.s3c, b.ec2c, nil
+}
+
+// CheckAWSAuth verifies usable AWS credentials via sts:GetCallerIdentity.
+// BuildAndImportAMI runs it as a preflight so a missing or expired login
+// fails early and actionably instead of deep in the pipeline; it also logs
+// the account so the user can confirm they're publishing to the right one.
+func (b *Builder) CheckAWSAuth(ctx context.Context) error {
+	cfg, err := config.LoadDefaultConfig(ctx, config.WithRegion(b.Region))
+	if err != nil {
+		return fmt.Errorf("loading AWS config (check AWS_PROFILE / ~/.aws, or run `aws sso login`): %w", err)
+	}
+	out, err := sts.NewFromConfig(cfg).GetCallerIdentity(ctx, &sts.GetCallerIdentityInput{})
+	if err != nil {
+		return fmt.Errorf("AWS credentials invalid or expired — run `aws sso login` or `aws configure`, or set AWS_PROFILE / AWS_ACCESS_KEY_ID: %w", err)
+	}
+	b.logf("AWS account %s (%s), region %s", aws.ToString(out.Account), aws.ToString(out.Arn), b.Region)
+	return nil
+}
+
+// buildImage runs monogok to produce the disk image (or GAF when gaf is
+// set) and, for a full image, formats the ext4 /perm filesystem. It sets
+// res.Image or res.GAF.
+func (b *Builder) buildImage(ctx context.Context, gaf bool) error {
+	appDir := filepath.Join(b.Dir, b.App)
+	if fi, err := os.Stat(appDir); err != nil || !fi.IsDir() {
+		return fmt.Errorf("in wrong directory %v; no %q subdirectory found", b.Dir, b.App)
+	}
+
+	args := []string{"run", "github.com/bradfitz/monogok/cmd/monogok"}
+	if gaf {
+		args = append(args,
+			"overwrite",
+			"--gaf", filepath.Join(b.Dir, b.App+".gaf"),
+		)
+	} else {
+		args = append(args,
+			"overwrite",
+			"--full", filepath.Join(b.Dir, b.App+".img"),
+			fmt.Sprintf("--target_storage_bytes=%d", imageSizeBytesFor(b.App)),
+		)
+	}
+
+	cmd := exec.CommandContext(ctx, "go", args...)
+	cmd.Dir = appDir
+	cmd.Stdout = b.Stderr
+	cmd.Stderr = b.Stderr
+	if err := cmd.Run(); err != nil {
+		return err
+	}
+	if gaf {
+		b.res.GAF = filepath.Join(b.Dir, b.App+".gaf")
+		return nil
+	}
+
+	imgPath := filepath.Join(b.Dir, b.App+".img")
+	f, err := os.OpenFile(imgPath, os.O_RDWR, 0)
+	if err != nil {
+		return fmt.Errorf("open %s: %w", imgPath, err)
+	}
+	defer f.Close()
+	if err := mkfs.Perm(f, imageSizeBytesFor(b.App)); err != nil {
+		return fmt.Errorf("formatting /perm in %s: %v", imgPath, err)
+	}
+	b.logf("Wrote ext4 /perm filesystem to %s.", imgPath)
+	b.res.Image = imgPath
+	return nil
+}
+
+// UploadToS3 uploads the built image to s3://<Bucket>/<App>.img (a
+// concurrent multipart upload, progress on b.Stderr) and returns the URI
+// (also in Result.S3). Requires BuildImage first.
+func (b *Builder) UploadToS3(ctx context.Context) (s3URI string, err error) {
+	if b.res.Image == "" {
+		return "", fmt.Errorf("UploadToS3: no image built yet; call BuildImage first")
+	}
+	s3c, _, err := b.awsClients(ctx)
+	if err != nil {
+		return "", err
+	}
+	imgPath := filepath.Join(b.Dir, b.App+".img")
+	f, err := os.Open(imgPath)
+	if err != nil {
+		return "", fmt.Errorf("open %s: %w", imgPath, err)
+	}
+	defer f.Close()
+
+	var size int64 = -1
+	if fi, err := f.Stat(); err == nil {
+		size = fi.Size()
+	}
+
+	pr := b.newProgressReader(f, "uploading", size)
+	defer pr.done()
+
+	up := manager.NewUploader(s3c, func(u *manager.Uploader) {
+		u.PartSize = 16 * 1024 * 1024 // 16 MiB parts
+		u.Concurrency = 8             // upload up to 8 parts at once
+	})
+	_, err = up.Upload(ctx, &s3.PutObjectInput{
+		Bucket: aws.String(b.Bucket),
+		Key:    aws.String(b.App + ".img"),
+		Body:   pr,
+	})
+	if err != nil {
+		return "", fmt.Errorf("uploading %s: %w", imgPath, err)
+	}
+	b.res.S3 = "s3://" + b.Bucket + "/" + b.App + ".img"
+	return b.res.S3, nil
+}
+
+// ImportSnapshot imports the uploaded image as an EBS snapshot, waiting
+// for completion, and returns the snapshot ID (also in Result.Snapshot,
+// region in Result.Region). Requires UploadToS3 first.
+func (b *Builder) ImportSnapshot(ctx context.Context) (snapshotID string, err error) {
+	if b.res.S3 == "" {
+		return "", fmt.Errorf("ImportSnapshot: image not uploaded yet; call UploadToS3 first")
+	}
+	taskID, err := b.startImportSnapshot(ctx)
+	if err != nil {
+		return "", err
+	}
+	snapID, err := b.waitForImportSnapshot(ctx, taskID)
+	if err != nil {
+		return "", fmt.Errorf("waitForImportSnapshot(%v): %w", taskID, err)
+	}
+	b.res.Snapshot = snapID
+	b.res.Region = b.Region
+	return snapID, nil
+}
+
+func (b *Builder) startImportSnapshot(ctx context.Context) (importTaskID string, err error) {
+	_, ec2c, err := b.awsClients(ctx)
+	if err != nil {
+		return "", err
+	}
+	out, err := ec2c.ImportSnapshot(ctx, &ec2.ImportSnapshotInput{
+		DiskContainer: &ec2types.SnapshotDiskContainer{
+			Url: aws.String("s3://" + b.Bucket + "/" + b.App + ".img"),
+		},
+	})
+	if err != nil {
+		return "", fmt.Errorf("import snapshot: %w", err)
+	}
+	if out.ImportTaskId == nil {
+		return "", fmt.Errorf("import snapshot: empty ImportTaskId in response")
+	}
+	return *out.ImportTaskId, nil
+}
+
+/*
+% aws ec2 describe-import-snapshot-tasks --import-task-ids import-snap-0d2d72622b4359567
+{
+    "ImportSnapshotTasks": [
+        {
+            "ImportTaskId": "import-snap-0d2d72622b4359567",
+            "SnapshotTaskDetail": {
+                "DiskImageSize": 1258299392.0,
+                "Format": "RAW",
+                "SnapshotId": "snap-053efd3539d787927",
+                "Status": "completed",
+                "Url": "s3://tskrazy-import/tskrazy.img",
+                "UserBucket": {
+                    "S3Bucket": "tskrazy-import",
+                    "S3Key": "tskrazy.img"
+                }
+            },
+            "Tags": []
+        }
+    ]
+}
+*/
+
+func (b *Builder) waitForImportSnapshot(ctx context.Context, importTaskID string) (snapID string, err error) {
+	_, ec2c, err := b.awsClients(ctx)
+	if err != nil {
+		return "", err
+	}
+	interactive := isTerminal(b.Stderr)
+	var lastPhase string // last (status/message) reported in non-interactive mode
+	for {
+		out, err := ec2c.DescribeImportSnapshotTasks(ctx, &ec2.DescribeImportSnapshotTasksInput{
+			ImportTaskIds: []string{importTaskID},
+		})
+		if err != nil {
+			return "", fmt.Errorf("describe import snapshot tasks: %w", err)
+		}
+
+		var status, statusMessage, progress string
+		if len(out.ImportSnapshotTasks) > 0 {
+			if d := out.ImportSnapshotTasks[0].SnapshotTaskDetail; d != nil {
+				snapID = aws.ToString(d.SnapshotId)
+				status = aws.ToString(d.Status)
+				statusMessage = aws.ToString(d.StatusMessage)
+				progress = aws.ToString(d.Progress)
+			}
+		}
+		if status == "completed" {
+			if interactive {
+				fmt.Fprintln(b.Stderr) // move off the live progress line
+			}
+			return snapID, nil
+		}
+		// A failed import stays out of "completed" forever; stop instead of
+		// polling until the context is cancelled.
+		if importFailed(status) {
+			if interactive {
+				fmt.Fprintln(b.Stderr)
+			}
+			msg := statusMessage
+			if msg == "" {
+				msg = status
+			}
+			return "", fmt.Errorf("import snapshot task %s failed: %s", importTaskID, msg)
+		}
+
+		if interactive {
+			// Repaint one line in place each poll.
+			fmt.Fprintf(b.Stderr, "\r\x1b[K%s", importProgressLine(status, statusMessage, progress))
+		} else if phase := status + "/" + statusMessage; phase != lastPhase {
+			// Non-interactive (pipe/redirect): one line per phase change
+			// only, not a fresh line every poll.
+			lastPhase = phase
+			b.logf("%s", importProgressLine(status, statusMessage, progress))
+		}
+
+		select {
+		case <-ctx.Done():
+			if interactive {
+				fmt.Fprintln(b.Stderr)
+			}
+			return "", ctx.Err()
+		case <-time.After(5 * time.Second):
+		}
+	}
+}
+
+// importFailed reports whether an import-snapshot task Status is a
+// terminal failure state (as opposed to "active"/"completed"). AWS uses
+// "deleting"/"deleted" when an import is cancelled or fails, and may
+// report "error"; treat any status mentioning "error" as failed too.
+func importFailed(status string) bool {
+	switch status {
+	case "deleting", "deleted", "error":
+		return true
+	}
+	return strings.Contains(strings.ToLower(status), "error")
+}
+
+// RegisterAMI registers an AMI from the imported snapshot, naming it via
+// AMIName, and returns the AMI ID (also in Result.AMI, name in
+// Result.Name). Requires ImportSnapshot first.
+func (b *Builder) RegisterAMI(ctx context.Context) (amiID string, err error) {
+	if b.res.Snapshot == "" {
+		return "", fmt.Errorf("RegisterAMI: no snapshot imported yet; call ImportSnapshot first")
+	}
+	b.res.Name = AMIName(b.App, b.Dir)
+
+	var arch, bootMode string
+	switch b.conf.GOARCH() {
+	case "arm64":
+		// arm64 instances boot UEFI-only; "uefi-preferred" is rejected.
+		arch, bootMode = "arm64", "uefi"
+	case "amd64":
+		arch, bootMode = "x86_64", "uefi-preferred"
+	default:
+		return "", fmt.Errorf("unknown arch %q", b.conf.GOARCH())
+	}
+	_, ec2c, err := b.awsClients(ctx)
+	if err != nil {
+		return "", err
+	}
+	out, err := ec2c.RegisterImage(ctx, &ec2.RegisterImageInput{
+		Name:         aws.String(b.res.Name),
+		Architecture: ec2types.ArchitectureValues(arch),
+		// register-image defaults to paravirtual; arm64 rejects that
+		// ("supports HVM AMIs only") and amd64 would produce an image that
+		// won't boot on Nitro. Both need HVM.
+		VirtualizationType: aws.String("hvm"),
+		RootDeviceName:     aws.String("/dev/sda1"),
+		EnaSupport:         aws.Bool(true),
+		ImdsSupport:        ec2types.ImdsSupportValuesV20,
+		BootMode:           ec2types.BootModeValues(bootMode),
+		BlockDeviceMappings: []ec2types.BlockDeviceMapping{{
+			DeviceName: aws.String("/dev/sda1"),
+			Ebs:        &ec2types.EbsBlockDevice{SnapshotId: aws.String(b.res.Snapshot)},
+		}},
+	})
+	if err != nil {
+		return "", fmt.Errorf("register image: %w", err)
+	}
+	if aws.ToString(out.ImageId) == "" {
+		return "", fmt.Errorf("empty image ID in register-image response")
+	}
+	b.res.AMI = *out.ImageId
+	return b.res.AMI, nil
+}
+
+// imageSizeBytesFor returns the disk image size to use for app. For Raspberry
+// Pi appliances the size is rounded up to the next power of two because
+// qemu-system-aarch64's raspi3b machine rejects SD card images whose size
+// isn't a power of two.
+func imageSizeBytesFor(app string) int64 {
+	if !strings.HasPrefix(app, "tsapp-pi.") {
+		return baseImageSizeBytes
+	}
+	n := int64(1)
+	for n < baseImageSizeBytes {
+		n <<= 1
+	}
+	return n
+}
+
+// importProgressLine formats a one-line status for an in-progress EC2
+// import-snapshot task from its Status, StatusMessage, and Progress (a
+// percentage string like "32") fields, any of which may be empty early on.
+func importProgressLine(status, statusMessage, progress string) string {
+	msg := statusMessage
+	if msg == "" {
+		msg = status
+	}
+	if msg == "" {
+		msg = "pending"
+	}
+	if progress == "" {
+		return "importing snapshot: " + msg
+	}
+	return fmt.Sprintf("importing snapshot: %s%% (%s)", progress, msg)
+}
+
+// isTerminal reports whether w writes to an interactive terminal, so
+// callers can show a live-updating progress line instead of a stream of
+// separate log lines.
+func isTerminal(w io.Writer) bool {
+	f, ok := w.(*os.File)
+	return ok && isatty.IsTerminal(f.Fd())
+}
+
+// progressReader reports read progress against total (-1 if unknown): a
+// live repainted line on a terminal, else a log line per 10%. It exists
+// because the S3 uploader gives no progress callback of its own, so we
+// count bytes as they pass through Read.
+type progressReader struct {
+	r     io.Reader
+	b     *Builder
+	verb  string // e.g. "uploading"
+	total int64  // -1 if unknown
+
+	read atomic.Int64 // cumulative bytes read so far
+
+	interactive bool
+	stop        chan struct{}
+	wg          sync.WaitGroup
+}
+
+// newProgressReader wraps r and starts a goroutine displaying progress;
+// total is the expected size in bytes, or -1 if unknown. Call done().
+func (b *Builder) newProgressReader(r io.Reader, verb string, total int64) *progressReader {
+	pr := &progressReader{
+		r:           r,
+		b:           b,
+		verb:        verb,
+		total:       total,
+		interactive: isTerminal(b.Stderr),
+		stop:        make(chan struct{}),
+	}
+	pr.wg.Add(1)
+	go pr.run()
+	return pr
+}
+
+func (pr *progressReader) Read(p []byte) (int, error) {
+	n, err := pr.r.Read(p)
+	pr.read.Add(int64(n))
+	return n, err
+}
+
+func (pr *progressReader) run() {
+	defer pr.wg.Done()
+	var rate tsrate.Value
+	rate.HalfLife = 5 * time.Second
+	var prev int64
+	interval := time.Second
+	if !pr.interactive {
+		interval = 2 * time.Second
+	}
+	tc := time.NewTicker(interval)
+	defer tc.Stop()
+
+	lastBucket := -1 // last 10%-bucket logged in non-interactive mode
+	for {
+		select {
+		case <-pr.stop:
+			return
+		case <-tc.C:
+			cur := pr.read.Load()
+			rate.Add(float64(max(cur-prev, 0)))
+			prev = cur
+			if pr.interactive {
+				fmt.Fprintf(pr.b.Stderr, "\r\x1b[K%s", progressLine(pr.verb, cur, pr.total, rate.Rate()))
+			} else if pr.total > 0 {
+				if bucket := int(cur * 10 / pr.total); bucket > lastBucket {
+					lastBucket = bucket
+					pr.b.logf("%s", progressLine(pr.verb, cur, pr.total, rate.Rate()))
+				}
+			}
+		}
+	}
+}
+
+// done stops the background display and prints a final line.
+func (pr *progressReader) done() {
+	close(pr.stop)
+	pr.wg.Wait()
+	cur := pr.read.Load()
+	if pr.interactive {
+		fmt.Fprintf(pr.b.Stderr, "\r\x1b[K%s\n", progressLine(pr.verb, cur, pr.total, 0))
+	} else {
+		pr.b.logf("%s: done (%s)", pr.verb, humanBytes(float64(cur)))
+	}
+}
+
+// progressLine formats a one-line byte-progress status. rate is bytes/sec
+// (0 to omit). total may be -1 (unknown), in which case percent is omitted.
+func progressLine(verb string, cur, total int64, rate float64) string {
+	if total > 0 {
+		pct := 100 * float64(cur) / float64(total)
+		s := fmt.Sprintf("%s: %.1f%% (%s / %s)", verb, pct, humanBytes(float64(cur)), humanBytes(float64(total)))
+		if rate > 0 {
+			s += fmt.Sprintf(" %s/s", humanBytes(rate))
+		}
+		return s
+	}
+	s := fmt.Sprintf("%s: %s", verb, humanBytes(float64(cur)))
+	if rate > 0 {
+		s += fmt.Sprintf(" %s/s", humanBytes(rate))
+	}
+	return s
+}
+
+// humanBytes formats n bytes with an IEC (binary) unit.
+func humanBytes(n float64) string {
+	switch {
+	case n < 1<<10:
+		return fmt.Sprintf("%.0fB", n)
+	case n < 1<<20:
+		return fmt.Sprintf("%.2fKiB", n/(1<<10))
+	case n < 1<<30:
+		return fmt.Sprintf("%.2fMiB", n/(1<<20))
+	case n < 1<<40:
+		return fmt.Sprintf("%.2fGiB", n/(1<<30))
+	default:
+		return fmt.Sprintf("%.2fTiB", n/(1<<40))
+	}
+}
+
+// awsArch maps a Go GOARCH to the AWS EC2 --architecture value.
+func awsArch(goarch string) string {
+	switch goarch {
+	case "arm64":
+		return "arm64"
+	case "amd64":
+		return "x86_64"
+	}
+	return ""
+}
+
+// ResolveRegion picks the AWS region: an explicit flagVal wins, then
+// env ($AWS_REGION), then us-east-1 (where the Marketplace Catalog API
+// and its source AMI live).
+func ResolveRegion(flagVal, env string) string {
+	if flagVal != "" {
+		return flagVal
+	}
+	if env != "" {
+		return env
+	}
+	return "us-east-1"
+}
+
+// AMIName derives a deterministic AMI name from git in dir: <app>-<tag>
+// on a tagged commit (releases), else a unixtime-suffixed ad-hoc name so
+// repeated dev builds don't collide.
+func AMIName(app, dir string) string {
+	exact, _ := gitOutput(dir, "describe", "--exact-match", "--tags", "HEAD")
+	describe, _ := gitOutput(dir, "describe", "--tags", "--always", "--dirty")
+	return amiNameFrom(app, exact, describe, time.Now().Unix())
+}
+
+// amiNameFrom is the pure decision behind AMIName, split out for testing.
+func amiNameFrom(app, exactTag, describe string, now int64) string {
+	if exactTag != "" {
+		return app + "-" + exactTag
+	}
+	if describe != "" {
+		return fmt.Sprintf("%s-%s-%d", app, describe, now)
+	}
+	return fmt.Sprintf("%s-%d", app, now)
+}
+
+// gitOutput runs git with args in dir and returns trimmed stdout, or an
+// error (e.g. no git, not a repo, or the ref doesn't match).
+func gitOutput(dir string, args ...string) (string, error) {
+	cmd := exec.Command("git", args...)
+	cmd.Dir = dir
+	out, err := cmd.Output()
+	if err != nil {
+		return "", err
+	}
+	return strings.TrimSpace(string(out)), nil
+}
diff --git a/gokrazy/build/build_test.go b/gokrazy/build/build_test.go
new file mode 100644
index 000000000..9435b4be1
--- /dev/null
+++ b/gokrazy/build/build_test.go
@@ -0,0 +1,200 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package build
+
+import (
+	"context"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestResolveRegion(t *testing.T) {
+	tests := []struct {
+		name, flag, env, want string
+	}{
+		{"default", "", "", "us-east-1"},
+		{"env", "", "eu-west-1", "eu-west-1"},
+		{"flag", "ap-south-1", "", "ap-south-1"},
+		{"flag-beats-env", "ap-south-1", "eu-west-1", "ap-south-1"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := ResolveRegion(tt.flag, tt.env); got != tt.want {
+				t.Errorf("ResolveRegion(%q, %q) = %q; want %q", tt.flag, tt.env, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestBuildCapturesError(t *testing.T) {
+	// An app dir with a config.json but no real appliance: the monogok
+	// build fails, and the build method must record the error in the
+	// Result for --json consumers.
+	dir := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(dir, "badapp"), 0700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "badapp", "config.json"),
+		[]byte(`{"Environment":["GOARCH=amd64"]}`), 0600); err != nil {
+		t.Fatal(err)
+	}
+
+	b, err := New(Config{App: "badapp", Dir: dir, Stderr: io.Discard})
+	if err != nil {
+		t.Fatalf("New: %v", err)
+	}
+	if _, err := b.BuildGAF(context.Background()); err == nil {
+		t.Fatal("BuildGAF succeeded; want failure")
+	}
+	if b.Result().Error == "" {
+		t.Error("Result.Error is empty; want the failure reason")
+	}
+}
+
+// TestStepOrderingGuards checks the AWS steps refuse to run before their
+// predecessor and say which step to call first. The guards fire before
+// any AWS client is constructed, so this needs no credentials.
+func TestStepOrderingGuards(t *testing.T) {
+	dir := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(dir, "app"), 0700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "app", "config.json"),
+		[]byte(`{"Environment":["GOARCH=amd64"]}`), 0600); err != nil {
+		t.Fatal(err)
+	}
+	newB := func() *Builder {
+		b, err := New(Config{App: "app", Dir: dir, Bucket: "b", Region: "us-east-1", Stderr: io.Discard})
+		if err != nil {
+			t.Fatal(err)
+		}
+		return b
+	}
+	ctx := context.Background()
+
+	tests := []struct {
+		name    string
+		call    func(*Builder) error
+		wantSub string
+	}{
+		{"upload-before-build", func(b *Builder) error { _, err := b.UploadToS3(ctx); return err }, "BuildImage first"},
+		{"import-before-upload", func(b *Builder) error { _, err := b.ImportSnapshot(ctx); return err }, "UploadToS3 first"},
+		{"register-before-import", func(b *Builder) error { _, err := b.RegisterAMI(ctx); return err }, "ImportSnapshot first"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := tt.call(newB())
+			if err == nil {
+				t.Fatal("out-of-order call succeeded; want error")
+			}
+			if !strings.Contains(err.Error(), tt.wantSub) {
+				t.Errorf("error = %q; want it to mention %q", err, tt.wantSub)
+			}
+		})
+	}
+}
+
+func TestImportProgressLine(t *testing.T) {
+	tests := []struct {
+		name, status, statusMessage, progress, want string
+	}{
+		{"early-empty", "", "", "", "importing snapshot: pending"},
+		{"status-only", "active", "", "", "importing snapshot: active"},
+		{"message-no-progress", "active", "pending", "", "importing snapshot: pending"},
+		{"full", "active", "validated", "32", "importing snapshot: 32% (validated)"},
+		{"message-beats-status", "active", "converting", "80", "importing snapshot: 80% (converting)"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := importProgressLine(tt.status, tt.statusMessage, tt.progress); got != tt.want {
+				t.Errorf("importProgressLine(%q, %q, %q) = %q; want %q",
+					tt.status, tt.statusMessage, tt.progress, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestAMINameFrom(t *testing.T) {
+	const now = 1720000000
+	tests := []struct {
+		name, exactTag, describe, want string
+	}{
+		{"tagged-release", "v1.2.3", "v1.2.3", "tsapp-v1.2.3"},
+		{"adhoc-describe", "", "v1.2.3-4-gabc1234", "tsapp-v1.2.3-4-gabc1234-1720000000"},
+		{"adhoc-dirty", "", "v1.2.3-dirty", "tsapp-v1.2.3-dirty-1720000000"},
+		{"no-git", "", "", "tsapp-1720000000"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := amiNameFrom("tsapp", tt.exactTag, tt.describe, now); got != tt.want {
+				t.Errorf("amiNameFrom = %q; want %q", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestImportFailed(t *testing.T) {
+	tests := []struct {
+		status string
+		want   bool
+	}{
+		{"active", false},
+		{"completed", false},
+		{"", false},
+		{"deleting", true},
+		{"deleted", true},
+		{"error", true},
+		{"some-error-state", true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.status, func(t *testing.T) {
+			if got := importFailed(tt.status); got != tt.want {
+				t.Errorf("importFailed(%q) = %v; want %v", tt.status, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestProgressLine(t *testing.T) {
+	tests := []struct {
+		name       string
+		verb       string
+		cur, total int64
+		rate       float64
+		want       string
+	}{
+		{"known-with-rate", "uploading", 512 << 20, 1 << 30, 64 << 20, "uploading: 50.0% (512.00MiB / 1.00GiB) 64.00MiB/s"},
+		{"known-no-rate", "uploading", 1 << 20, 4 << 20, 0, "uploading: 25.0% (1.00MiB / 4.00MiB)"},
+		{"unknown-total", "uploading", 3 << 20, -1, 1 << 20, "uploading: 3.00MiB 1.00MiB/s"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := progressLine(tt.verb, tt.cur, tt.total, tt.rate); got != tt.want {
+				t.Errorf("progressLine = %q; want %q", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestHumanBytes(t *testing.T) {
+	tests := []struct {
+		n    float64
+		want string
+	}{
+		{512, "512B"},
+		{1 << 10, "1.00KiB"},
+		{1 << 20, "1.00MiB"},
+		{1536 << 20, "1.50GiB"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.want, func(t *testing.T) {
+			if got := humanBytes(tt.n); got != tt.want {
+				t.Errorf("humanBytes(%v) = %q; want %q", tt.n, got, tt.want)
+			}
+		})
+	}
+}
diff --git a/gokrazy/gafpush/gafpush.go b/gokrazy/gafpush/gafpush.go
new file mode 100644
index 000000000..f51424e91
--- /dev/null
+++ b/gokrazy/gafpush/gafpush.go
@@ -0,0 +1,135 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// gafpush pushes a Gokrazy Archive Format (GAF) file to a running
+// Tailscale appliance over the network without moving the SD card.
+//
+// The flow:
+//  1. scp the GAF to /perm/gafpush.tmp on the appliance (via
+//     breakglass's SFTP subsystem).
+//  2. SSH into the appliance and run
+//     tailscale update -- --gokrazy-update-from-url=file:///perm/gafpush.tmp --unsigned
+//     which copies the file into a tmp GAF, writes partitions, switches
+//     root, and reboots.
+//  3. Wait for the appliance to come back on SSH; then remove
+//     /perm/gafpush.tmp.
+//
+// This flow is purely one-directional (developer → appliance), so
+// gafpush works from behind NAT, laptop firewalls (e.g. NixOS's default
+// deny-inbound), or when the appliance is on a different subnet.
+//
+// Usage:
+//
+//	gafpush --gaf=path/to/file.gaf --host=<ip-or-name>
+//
+// Or via the Makefile:
+//
+//	make tsapp-push-pi PI=<ip>
+package main
+
+import (
+	"flag"
+	"log"
+	"net"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"time"
+)
+
+var (
+	gafPath    = flag.String("gaf", "", "path to the GAF file to push")
+	host       = flag.String("host", "", "target hostname or IP (SSH as root)")
+	piAddr     = flag.String("pi", "", "alias for --host, kept for backwards compatibility with the Makefile")
+	remotePath = flag.String("remote-path", "/perm/gafpush.tmp", "where on the appliance to stage the GAF before the update")
+)
+
+func main() {
+	flag.Parse()
+	target := *host
+	if target == "" {
+		target = *piAddr
+	}
+	if *gafPath == "" || target == "" {
+		flag.Usage()
+		os.Exit(1)
+	}
+
+	fi, err := os.Stat(*gafPath)
+	if err != nil {
+		log.Fatalf("GAF file: %v", err)
+	}
+	absGAF, _ := filepath.Abs(*gafPath)
+	log.Printf("GAF: %s (%.1f MB)", absGAF, float64(fi.Size())/(1<<20))
+
+	log.Printf("scp'ing GAF to %s:%s ...", target, *remotePath)
+	scp := exec.Command("scp",
+		"-o", "StrictHostKeyChecking=no",
+		"-o", "UserKnownHostsFile=/dev/null",
+		"-o", "ConnectTimeout=10",
+		absGAF, "root@"+target+":"+*remotePath,
+	)
+	scp.Stdout = os.Stdout
+	scp.Stderr = os.Stderr
+	if err := scp.Run(); err != nil {
+		log.Fatalf("scp: %v", err)
+	}
+
+	log.Printf("SSHing into %s to trigger update...", target)
+	fileURL := "file://" + *remotePath
+	sshUpdate := exec.Command("ssh",
+		"-o", "StrictHostKeyChecking=no",
+		"-o", "UserKnownHostsFile=/dev/null",
+		"-o", "ConnectTimeout=10",
+		"root@"+target,
+		"tailscale", "update", "--",
+		"--gokrazy-update-from-url="+fileURL,
+		"--unsigned",
+	)
+	sshUpdate.Stdout = os.Stdout
+	sshUpdate.Stderr = os.Stderr
+	if err := sshUpdate.Run(); err != nil {
+		// SSH will drop when the appliance reboots, which is expected.
+		if exitErr, ok := err.(*exec.ExitError); ok && exitErr.ExitCode() == 255 {
+			log.Printf("SSH connection closed (appliance is rebooting)")
+		} else {
+			log.Fatalf("ssh: %v", err)
+		}
+	}
+
+	log.Printf("update pushed; waiting for %s to come back...", target)
+	if !waitForHost(target) {
+		log.Printf("timed out waiting for appliance to come back (may have gotten a new IP); leaving %s in place", *remotePath)
+		return
+	}
+
+	log.Printf("cleaning up staged GAF on %s ...", target)
+	sshRm := exec.Command("ssh",
+		"-o", "StrictHostKeyChecking=no",
+		"-o", "UserKnownHostsFile=/dev/null",
+		"-o", "ConnectTimeout=10",
+		"root@"+target,
+		"rm", "-f", *remotePath,
+	)
+	sshRm.Stdout = os.Stdout
+	sshRm.Stderr = os.Stderr
+	if err := sshRm.Run(); err != nil {
+		log.Printf("cleanup: %v (staged GAF still at %s)", err, *remotePath)
+	}
+}
+
+// waitForHost polls the appliance's SSH port until it comes back up.
+// Returns true if it comes back within the deadline.
+func waitForHost(addr string) bool {
+	deadline := time.Now().Add(90 * time.Second)
+	for time.Now().Before(deadline) {
+		conn, err := net.DialTimeout("tcp", net.JoinHostPort(addr, "22"), 2*time.Second)
+		if err == nil {
+			conn.Close()
+			log.Printf("appliance is back at %s:22", addr)
+			return true
+		}
+		time.Sleep(2 * time.Second)
+	}
+	return false
+}
diff --git a/gokrazy/gokrazy_test.go b/gokrazy/gokrazy_test.go
index 76398d49b..266c1309d 100644
--- a/gokrazy/gokrazy_test.go
+++ b/gokrazy/gokrazy_test.go
@@ -13,6 +13,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"slices"
 	"strings"
 	"sync"
 	"testing"
@@ -23,6 +24,83 @@ import (
 
 var runVMTests = flag.Bool("run-vm-tests", false, "run tests that require a VM")
 
+func TestTsappConfigs(t *testing.T) {
+	tests := []struct {
+		name     string
+		app      string
+		goarch   string
+		kernel   string
+		firmware string
+		eeprom   string
+	}{
+		{
+			name:     "tsapp",
+			app:      "tsapp",
+			goarch:   "amd64",
+			kernel:   "github.com/gokrazy/kernel.amd64",
+			firmware: "github.com/gokrazy/kernel.amd64",
+		},
+		{
+			name:     "tsapp-vm-arm64",
+			app:      "tsapp-vm.arm64",
+			goarch:   "arm64",
+			kernel:   "github.com/gokrazy/kernel.arm64",
+			firmware: "github.com/gokrazy/kernel.arm64",
+			eeprom:   "",
+		},
+		{
+			name:     "tsapp-pi-arm64",
+			app:      "tsapp-pi.arm64",
+			goarch:   "arm64",
+			kernel:   "github.com/gokrazy/kernel.rpi",
+			firmware: "github.com/gokrazy/firmware",
+			eeprom:   "github.com/gokrazy/rpi-eeprom",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cfgBytes, err := os.ReadFile(filepath.Join(tt.app, "config.json"))
+			if err != nil {
+				t.Fatalf("reading config.json: %v", err)
+			}
+			var cfg struct {
+				Environment     []string
+				KernelPackage   string
+				FirmwarePackage string
+				EEPROMPackage   *string
+			}
+			if err := json.Unmarshal(cfgBytes, &cfg); err != nil {
+				t.Fatalf("unmarshaling config.json: %v", err)
+			}
+			var raw map[string]json.RawMessage
+			if err := json.Unmarshal(cfgBytes, &raw); err != nil {
+				t.Fatalf("unmarshaling config.json as map: %v", err)
+			}
+			var goarch string
+			for _, e := range cfg.Environment {
+				if v, ok := strings.CutPrefix(e, "GOARCH="); ok {
+					goarch = v
+				}
+			}
+			if goarch != tt.goarch {
+				t.Errorf("GOARCH = %q; want %q", goarch, tt.goarch)
+			}
+			if cfg.KernelPackage != tt.kernel {
+				t.Errorf("KernelPackage = %q; want %q", cfg.KernelPackage, tt.kernel)
+			}
+			if cfg.FirmwarePackage != tt.firmware {
+				t.Errorf("FirmwarePackage = %q; want %q", cfg.FirmwarePackage, tt.firmware)
+			}
+			if _, ok := raw["EEPROMPackage"]; tt.goarch == "arm64" && !ok {
+				t.Error("EEPROMPackage is missing")
+			}
+			if cfg.EEPROMPackage != nil && *cfg.EEPROMPackage != tt.eeprom {
+				t.Errorf("EEPROMPackage = %q; want %q", *cfg.EEPROMPackage, tt.eeprom)
+			}
+		})
+	}
+}
+
 func findKernelPath(t *testing.T) string {
 	t.Helper()
 	goModPath := filepath.Join("..", "go.mod")
@@ -39,11 +117,11 @@ func findKernelPath(t *testing.T) string {
 		t.Fatalf("go env GOMODCACHE: %v", err)
 	}
 	for _, r := range mf.Require {
-		if r.Mod.Path == "github.com/tailscale/gokrazy-kernel" {
+		if r.Mod.Path == "github.com/gokrazy/kernel.amd64" {
 			return strings.TrimSpace(string(goModB)) + "/" + r.Mod.String() + "/vmlinuz"
 		}
 	}
-	t.Fatal("failed to find gokrazy-kernel in go.mod")
+	t.Fatal("failed to find kernel.amd64 in go.mod")
 	return ""
 }
 
@@ -109,12 +187,7 @@ func (sl *serialLog) lastN(n int) []string {
 func (sl *serialLog) findLine(pred func(string) bool) bool {
 	sl.mu.Lock()
 	defer sl.mu.Unlock()
-	for _, line := range sl.lines {
-		if pred(line) {
-			return true
-		}
-	}
-	return false
+	return slices.ContainsFunc(sl.lines, pred)
 }
 
 // TestBusyboxInTsapp boots the tsapp image in QEMU and verifies that
diff --git a/gokrazy/mkfs/mkfs.go b/gokrazy/mkfs/mkfs.go
new file mode 100644
index 000000000..cd08b9e9a
--- /dev/null
+++ b/gokrazy/mkfs/mkfs.go
@@ -0,0 +1,332 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package mkfs creates the writable ext4 /perm filesystem inside a
+// gokrazy disk image or block device, at the offset and length
+// determined by the gokrazy partition layout.
+//
+// Used by gokrazy/build.go when producing a "--full" disk image and by
+// "tailscale configure flash-appliance" when flashing an image to an
+// SD card, so the appliance has a working /perm on first boot without
+// requiring users to install mkfs.ext4 (e.g. e2fsprogs on macOS).
+package mkfs
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"io/fs"
+	"os"
+	"slices"
+	"sync/atomic"
+	"time"
+
+	"github.com/bradfitz/monogok/disklayout"
+	"github.com/diskfs/go-diskfs/backend"
+	"github.com/diskfs/go-diskfs/filesystem/ext4"
+	"tailscale.com/util/progresstracking"
+)
+
+// gptSecondaryReservedSectors is the number of 512-byte sectors that
+// monogok's GPT writer reserves at the end of the disk for the
+// secondary GPT (1 header sector + 32 partition-entry sectors). The
+// perm partition entry written by disklayout.WriteGPT is this many
+// sectors shorter than [disklayout.PermSize], so the ext4 filesystem
+// we create must shrink by the same amount to fit within the partition
+// the kernel sees.
+const gptSecondaryReservedSectors = 34
+
+const sectorSize = 512
+
+// PermFile is a file to include in the /perm partition.
+type PermFile struct {
+	Path    string // path within the filesystem, e.g. "breakglass.authorized_keys"
+	Content []byte
+}
+
+// Perm creates an ext4 filesystem with volume label "PERM" inside the
+// gokrazy /perm partition of f. devsizeBytes is the total disk size
+// that the gokrazy GPT in f was written for; the partition layout is
+// derived from it via [disklayout].
+//
+// If files is non-empty, the listed files are written into the
+// filesystem before flushing to disk.
+//
+// To avoid issuing ext4.Create's hundreds of small scattered writes
+// against slow storage one syscall at a time, the filesystem is first
+// built in an in-memory sparse buffer and then only the genuinely
+// non-zero metadata pages are flushed to f, coalesced into the
+// fewest possible contiguous writes. ext4's initial superblock,
+// group descriptors, bitmaps, root inode, etc. land at the same
+// per-group byte offsets whether the destination had old ext4
+// metadata or zeros there, so a fresh ext4 always overwrites stale
+// metadata in place; data-area bytes that were never written are
+// not read by the kernel until they're allocated.
+//
+// f must be open read/write, and on macOS should be the buffered
+// /dev/diskN device rather than the raw /dev/rdiskN alias.
+func Perm(f *os.File, devsizeBytes int64, files ...PermFile) error {
+	permStart := int64(disklayout.PermStartLBA(disklayout.DefaultBootPartitionStartLBA)) * sectorSize
+	permSize := int64(disklayout.PermSize(disklayout.DefaultBootPartitionStartLBA, uint64(devsizeBytes))-gptSecondaryReservedSectors) * sectorSize
+
+	fmt.Fprintf(os.Stderr, "Formatting /perm as ext4 (PERM): %s filesystem\n", humanBytes(permSize))
+
+	mem := newMemBackend(permSize)
+	fsys, err := ext4.Create(mem, permSize, 0, sectorSize, &ext4.Params{
+		VolumeName: "PERM",
+		// Force 4 KiB blocks. go-diskfs v1.9.3 otherwise defaults to 1
+		// KiB blocks regardless of filesystem size, which makes a 128
+		// MiB journal need ~131k blocks — past the 65535-blocks-per-
+		// extent limit. 4 KiB blocks keep a typical journal in a
+		// single extent. (Fixed upstream after v1.9.3.)
+		SectorsPerBlock: 8,
+		// Disable resize_inode. go-diskfs v1.9.3 only implements it
+		// for 1 KiB block filesystems; for our 4 KiB blocks +
+		// ~96 MiB perm, initResizeInode fails with "no backup groups
+		// available". Matches go-diskfs's own tests for non-1 KiB
+		// block sizes.
+		Features: []ext4.FeatureOpt{
+			ext4.WithFeatureReservedGDTBlocksForExpansion(false),
+		},
+	})
+	if err != nil {
+		return fmt.Errorf("ext4.Create: %w", err)
+	}
+	for _, pf := range files {
+		w, err := fsys.OpenFile("/"+pf.Path, os.O_CREATE|os.O_RDWR)
+		if err != nil {
+			return fmt.Errorf("create %s in /perm: %w", pf.Path, err)
+		}
+		if _, err := w.Write(pf.Content); err != nil {
+			return fmt.Errorf("write %s in /perm: %w", pf.Path, err)
+		}
+	}
+	return mem.flushTo(f, permStart)
+}
+
+// memPageSize is the granularity of memBackend's sparse allocation.
+// 4 KiB matches the ext4 block size we use, so most of ext4.Create's
+// writes touch exactly one page.
+const memPageSize = 4096
+
+// memBackend is a sparse in-memory implementation of go-diskfs's
+// [backend.Storage]. It only allocates a [memPageSize]-byte chunk for
+// each page that ext4.Create actually touches; unwritten regions cost
+// only a map entry's worth of overhead and read back as zeros. The
+// caller flushes the allocated pages to the destination in contiguous
+// runs via [memBackend.flushTo].
+type memBackend struct {
+	size  int64            // logical size of the virtual device
+	pages map[int64][]byte // page index → memPageSize bytes
+	off   int64            // current offset for io.Reader / io.Seeker compatibility
+}
+
+func newMemBackend(size int64) *memBackend {
+	return &memBackend{
+		size:  size,
+		pages: make(map[int64][]byte),
+	}
+}
+
+// ReadAt implements [io.ReaderAt]. Bytes within pages that were never
+// written read as zero.
+func (m *memBackend) ReadAt(p []byte, off int64) (int, error) {
+	if off < 0 || off >= m.size {
+		return 0, io.EOF
+	}
+	if max := m.size - off; int64(len(p)) > max {
+		p = p[:max]
+	}
+	// Default everything to zero; allocated pages overwrite below.
+	clear(p)
+	total := 0
+	for total < len(p) {
+		absOff := off + int64(total)
+		page := absOff / memPageSize
+		within := int(absOff % memPageSize)
+		room := min(memPageSize-within, len(p)-total)
+		if chunk, ok := m.pages[page]; ok {
+			copy(p[total:total+room], chunk[within:within+room])
+		}
+		total += room
+	}
+	if int64(total) < int64(len(p)) {
+		return total, io.EOF
+	}
+	return total, nil
+}
+
+// WriteAt implements [io.WriterAt]. Pages are allocated on first
+// touch, except that writes whose data is entirely zero do NOT
+// allocate (or modify) any page: the caller's destination is assumed
+// to already have zeros where we never write. ext4.Create writes
+// tens-to-hundreds of MiB of zeros to initialize the inode table and
+// journal; suppressing those allocations is what keeps memory and SD
+// card writes proportional to the *real* metadata rather than the
+// filesystem size.
+//
+// CAVEAT: if the destination has stale non-zero data in those regions
+// (e.g. an SD card previously formatted with a different filesystem),
+// that data is left in place. For a fresh card this is fine; for
+// re-flashed cards the perm region's old data could confuse ext4's
+// recovery on first mount. Callers that re-flash should discard the
+// perm region first; we don't do that here.
+func (m *memBackend) WriteAt(p []byte, off int64) (int, error) {
+	if off < 0 || off+int64(len(p)) > m.size {
+		return 0, fmt.Errorf("write past buffer end: off=%d len=%d size=%d", off, len(p), m.size)
+	}
+	total := 0
+	for total < len(p) {
+		absOff := off + int64(total)
+		page := absOff / memPageSize
+		within := int(absOff % memPageSize)
+		room := min(memPageSize-within, len(p)-total)
+		chunk, ok := m.pages[page]
+		if !ok && isAllZero(p[total:total+room]) {
+			// Don't allocate a fresh zero page.
+			total += room
+			continue
+		}
+		if !ok {
+			chunk = make([]byte, memPageSize)
+			m.pages[page] = chunk
+		}
+		copy(chunk[within:within+room], p[total:total+room])
+		total += room
+	}
+	return total, nil
+}
+
+// isAllZero reports whether p is entirely 0x00.
+func isAllZero(p []byte) bool {
+	for _, b := range p {
+		if b != 0 {
+			return false
+		}
+	}
+	return true
+}
+
+// Read implements [io.Reader].
+func (m *memBackend) Read(p []byte) (int, error) {
+	n, err := m.ReadAt(p, m.off)
+	m.off += int64(n)
+	return n, err
+}
+
+// Seek implements [io.Seeker].
+func (m *memBackend) Seek(off int64, whence int) (int64, error) {
+	switch whence {
+	case io.SeekStart:
+		m.off = off
+	case io.SeekCurrent:
+		m.off += off
+	case io.SeekEnd:
+		m.off = m.size + off
+	default:
+		return 0, fmt.Errorf("invalid whence %d", whence)
+	}
+	return m.off, nil
+}
+
+// Close implements [io.Closer].
+func (m *memBackend) Close() error { return nil }
+
+// Stat implements [fs.File].
+func (m *memBackend) Stat() (fs.FileInfo, error) {
+	return memFileInfo{size: m.size}, nil
+}
+
+// Sys implements [backend.Storage]; it returns ErrNotSuitable so
+// ext4.Create's optional fsync (ext4.go:730) is gracefully skipped.
+func (m *memBackend) Sys() (*os.File, error) { return nil, backend.ErrNotSuitable }
+
+// Writable implements [backend.Storage].
+func (m *memBackend) Writable() (backend.WritableFile, error) { return m, nil }
+
+// Path implements [backend.Storage].
+func (m *memBackend) Path() string { return "" }
+
+type memFileInfo struct{ size int64 }
+
+func (fi memFileInfo) Name() string       { return "mkfs-buffer" }
+func (fi memFileInfo) Size() int64        { return fi.size }
+func (fi memFileInfo) Mode() fs.FileMode  { return 0o600 }
+func (fi memFileInfo) ModTime() time.Time { return time.Time{} }
+func (fi memFileInfo) IsDir() bool        { return false }
+func (fi memFileInfo) Sys() any           { return nil }
+
+// flushTo writes the allocated (non-zero) pages of m to f at
+// baseOffset+pageIndex*memPageSize, coalescing consecutive page
+// indices into a single WriteAt so the destination sees the fewest
+// possible writes. Pages that ext4.Create only ever wrote zeros into
+// were never allocated by WriteAt and are not written here either; the
+// destination is assumed to have zeros (or a previous ext4 install's
+// metadata in the same locations, which is functionally equivalent
+// since fresh ext4 metadata overwrites it in place).
+//
+// Progress is printed to os.Stderr roughly once per second.
+func (m *memBackend) flushTo(f io.WriterAt, baseOffset int64) error {
+	if len(m.pages) == 0 {
+		return errors.New("BUG: ext4.Create allocated no pages")
+	}
+
+	keys := make([]int64, 0, len(m.pages))
+	for k := range m.pages {
+		keys = append(keys, k)
+	}
+	slices.Sort(keys)
+
+	totalBytes := int64(len(m.pages)) * memPageSize
+	var written atomic.Int64
+	stop := startExt4FlushProgress(&written, totalBytes)
+	defer stop()
+
+	for i := 0; i < len(keys); {
+		runStart := keys[i]
+		j := i
+		for j < len(keys) && keys[j] == runStart+int64(j-i) {
+			j++
+		}
+		runPages := keys[i:j]
+		buf := make([]byte, len(runPages)*memPageSize)
+		for k, page := range runPages {
+			copy(buf[k*memPageSize:], m.pages[page])
+		}
+		if _, err := f.WriteAt(buf, baseOffset+runStart*memPageSize); err != nil {
+			return fmt.Errorf("flushing perm metadata: %w", err)
+		}
+		written.Add(int64(len(buf)))
+		i = j
+	}
+	return nil
+}
+
+func startExt4FlushProgress(done *atomic.Int64, total int64) func() {
+	return progresstracking.Ticker(done.Load, total, func(d, t int64) {
+		pct := 0.0
+		if t > 0 {
+			pct = float64(d) * 100 / float64(t)
+		}
+		fmt.Fprintf(os.Stderr, "  ext4 perm: %s / %s (%.1f%%)\n",
+			humanBytes(d), humanBytes(t), pct)
+	})
+}
+
+func humanBytes(n int64) string {
+	const (
+		gb = 1 << 30
+		mb = 1 << 20
+		kb = 1 << 10
+	)
+	switch {
+	case n >= gb:
+		return fmt.Sprintf("%.1f GB", float64(n)/float64(gb))
+	case n >= mb:
+		return fmt.Sprintf("%.1f MB", float64(n)/float64(mb))
+	case n >= kb:
+		return fmt.Sprintf("%.1f KB", float64(n)/float64(kb))
+	default:
+		return fmt.Sprintf("%d B", n)
+	}
+}
diff --git a/gokrazy/mkfs/mkfs_test.go b/gokrazy/mkfs/mkfs_test.go
new file mode 100644
index 000000000..4cb73078d
--- /dev/null
+++ b/gokrazy/mkfs/mkfs_test.go
@@ -0,0 +1,183 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package mkfs
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/diskfs/go-diskfs/filesystem/ext4"
+)
+
+// fakeWriterAt records every WriteAt to a single contiguous backing
+// buffer (so tests can inspect what flushTo produced) and counts the
+// calls so we can assert the chunked flush issues a predictable
+// handful of big sequential writes.
+type fakeWriterAt struct {
+	buf   []byte
+	calls int
+	sizes []int
+}
+
+func (w *fakeWriterAt) WriteAt(p []byte, off int64) (int, error) {
+	w.calls++
+	w.sizes = append(w.sizes, len(p))
+	if int(off)+len(p) > len(w.buf) {
+		w.buf = append(w.buf, make([]byte, int(off)+len(p)-len(w.buf))...)
+	}
+	return copy(w.buf[off:], p), nil
+}
+
+// TestMemBackendSparseAlloc exercises ext4.Create against an in-memory
+// memBackend sized like a typical /perm partition and confirms that
+// the page allocator stays small. ext4.Create issues writes for tens
+// to hundreds of MiB of zero-initialized inode table and journal; we
+// rely on memBackend.WriteAt suppressing those zero writes so that
+// the eventual flush to the (slow) SD card stays under a few MiB.
+//
+// The assertion is intentionally loose — we only catch regressions
+// that bloat by an order of magnitude, not bookkeeping changes.
+func TestMemBackendSparseAlloc(t *testing.T) {
+	for _, tc := range []struct {
+		name        string
+		sizeBytes   int64
+		maxPagesKiB int64
+	}{
+		// ~96 MiB matches our tsapp pi/vm builds with
+		// target_storage_bytes=1258299392.
+		{"96MiB", 96 * 1024 * 1024, 256},
+		// 2 GiB is the size the user complained about in the
+		// flash-appliance progress meter: ext4.Create wrote ~131
+		// MiB before suppression.
+		{"2GiB", 2 * 1024 * 1024 * 1024, 1024},
+		// 32 GiB simulates a full-size SD card. ext4.Create would
+		// write a few hundred MiB of zeros for the inode table; we
+		// must still stay tiny.
+		{"32GiB", 32 * 1024 * 1024 * 1024, 2048},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			mem := newMemBackend(tc.sizeBytes)
+			_, err := ext4.Create(mem, tc.sizeBytes, 0, sectorSize, &ext4.Params{
+				VolumeName:      "PERM",
+				SectorsPerBlock: 8,
+				Features: []ext4.FeatureOpt{
+					ext4.WithFeatureReservedGDTBlocksForExpansion(false),
+				},
+			})
+			if err != nil {
+				t.Fatalf("ext4.Create: %v", err)
+			}
+			pageBytes := int64(len(mem.pages)) * memPageSize
+			t.Logf("%s filesystem: %d allocated pages (%d KiB)",
+				tc.name, len(mem.pages), pageBytes/1024)
+			if pageBytes/1024 > tc.maxPagesKiB {
+				t.Errorf("allocated %d KiB; want < %d KiB", pageBytes/1024, tc.maxPagesKiB)
+			}
+		})
+	}
+}
+
+// TestFlushToDirtyOnly exercises memBackend.flushTo against a fake
+// io.WriterAt: it must issue only one WriteAt per maximal run of
+// allocated (non-zero) pages — never anything for the gaps in between
+// — and the bytes at each destination offset must match what was
+// originally written.
+func TestFlushToDirtyOnly(t *testing.T) {
+	const size = 40 * 1024 * 1024
+	m := newMemBackend(size)
+
+	// Two contiguous runs separated by a large all-zero gap. The
+	// flush should issue exactly two WriteAt calls (one per run),
+	// and never touch the gap between them.
+	page := func(b byte) []byte {
+		p := make([]byte, memPageSize)
+		p[0] = b
+		return p
+	}
+	// Run 1: 2 consecutive pages at offset 0.
+	if _, err := m.WriteAt(page(0x11), 0); err != nil {
+		t.Fatalf("WriteAt: %v", err)
+	}
+	if _, err := m.WriteAt(page(0x22), memPageSize); err != nil {
+		t.Fatalf("WriteAt: %v", err)
+	}
+	// Run 2: 1 page at the end of the region.
+	if _, err := m.WriteAt(page(0x33), size-memPageSize); err != nil {
+		t.Fatalf("WriteAt: %v", err)
+	}
+
+	const baseOffset int64 = 1 << 20
+	fw := &fakeWriterAt{}
+	if err := m.flushTo(fw, baseOffset); err != nil {
+		t.Fatalf("flushTo: %v", err)
+	}
+
+	if fw.calls != 2 {
+		t.Errorf("WriteAt calls=%d; want 2 (one per dirty run), sizes=%v", fw.calls, fw.sizes)
+	}
+	if got, want := fw.sizes[0], 2*memPageSize; got != want {
+		t.Errorf("first run size=%d; want %d (2 contiguous pages)", got, want)
+	}
+	if got, want := fw.sizes[1], memPageSize; got != want {
+		t.Errorf("second run size=%d; want %d (1 page)", got, want)
+	}
+
+	// Page contents at the right absolute offsets.
+	if fw.buf[baseOffset+0] != 0x11 {
+		t.Errorf("page 0 marker = %#x; want 0x11", fw.buf[baseOffset+0])
+	}
+	if fw.buf[baseOffset+memPageSize] != 0x22 {
+		t.Errorf("page 1 marker = %#x; want 0x22", fw.buf[baseOffset+memPageSize])
+	}
+	if fw.buf[baseOffset+size-memPageSize] != 0x33 {
+		t.Errorf("last page marker = %#x; want 0x33", fw.buf[baseOffset+size-memPageSize])
+	}
+	// The gap pages between run 1 and run 2 must not have been touched
+	// at all in the fake's backing buffer (it lazily grows on WriteAt;
+	// untouched bytes stay zero).
+	for _, off := range []int64{2 * memPageSize, 8 * 1024 * 1024, 20 * 1024 * 1024} {
+		if !bytes.Equal(fw.buf[baseOffset+off:baseOffset+off+memPageSize], make([]byte, memPageSize)) {
+			t.Errorf("flushTo touched an unallocated gap at offset %d", off)
+		}
+	}
+}
+
+// TestMemBackendZeroSuppressed asserts that a write whose data is all
+// zero does not allocate a page when the destination page is absent —
+// the core invariant that makes TestMemBackendSparseAlloc pass — and
+// that writes touching multiple pages allocate per-page based on
+// whether each page's slice has any non-zero byte.
+func TestMemBackendZeroSuppressed(t *testing.T) {
+	m := newMemBackend(1 << 20)
+
+	// All-zero write spanning 2 pages: nothing allocated.
+	zero := make([]byte, 8192)
+	if _, err := m.WriteAt(zero, 4096); err != nil {
+		t.Fatalf("WriteAt zero: %v", err)
+	}
+	if got := len(m.pages); got != 0 {
+		t.Errorf("after %d-byte zero write: %d pages, want 0", len(zero), got)
+	}
+
+	// Non-zero byte in page 0 only: page 0 allocated; page 1 stays
+	// zero-suppressed.
+	mixed := make([]byte, 8192)
+	mixed[100] = 1
+	if _, err := m.WriteAt(mixed, 0); err != nil {
+		t.Fatalf("WriteAt mixed: %v", err)
+	}
+	if got := len(m.pages); got != 1 {
+		t.Errorf("after write with non-zero only in page 0: %d pages, want 1", got)
+	}
+
+	// Non-zero bytes in both pages: both allocated.
+	m = newMemBackend(1 << 20)
+	mixed[5000] = 1 // also non-zero in page 1
+	if _, err := m.WriteAt(mixed, 0); err != nil {
+		t.Fatalf("WriteAt mixed-both: %v", err)
+	}
+	if got := len(m.pages); got != 2 {
+		t.Errorf("after write with non-zero in pages 0 and 1: %d pages, want 2", got)
+	}
+}
diff --git a/gokrazy/natlabapp.arm64/config.json b/gokrazy/natlabapp.arm64/config.json
index 2ba9a20f9..8283dc053 100644
--- a/gokrazy/natlabapp.arm64/config.json
+++ b/gokrazy/natlabapp.arm64/config.json
@@ -27,5 +27,7 @@
     "KernelPackage": "github.com/gokrazy/kernel.arm64",
     "FirmwarePackage": "github.com/gokrazy/kernel.arm64",
     "EEPROMPackage": "",
-    "InternalCompatibilityFlags": {}
+    "InternalCompatibilityFlags": {
+        "InitImportPath": "github.com/tailscale/ts-gokrazy/gokrazyinit"
+    }
 }
diff --git a/gokrazy/natlabapp.arm64/gokrazydeps.go b/gokrazy/natlabapp.arm64/gokrazydeps.go
new file mode 100644
index 000000000..001ab89b8
--- /dev/null
+++ b/gokrazy/natlabapp.arm64/gokrazydeps.go
@@ -0,0 +1,16 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build for_go_mod_tidy_only
+
+package gokrazydeps
+
+import (
+	_ "github.com/gokrazy/gokrazy/cmd/dhcp"
+	_ "github.com/gokrazy/kernel.arm64"
+	_ "github.com/gokrazy/serial-busybox"
+	_ "github.com/tailscale/ts-gokrazy/gokrazyinit"
+	_ "tailscale.com/cmd/tailscale"
+	_ "tailscale.com/cmd/tailscaled"
+	_ "tailscale.com/cmd/tta"
+)
diff --git a/gokrazy/natlabapp/config.json b/gokrazy/natlabapp/config.json
index 1968b2aac..561d03585 100644
--- a/gokrazy/natlabapp/config.json
+++ b/gokrazy/natlabapp/config.json
@@ -24,8 +24,10 @@
         "GOOS=linux",
         "GOARCH=amd64"
     ],
-    "KernelPackage": "github.com/tailscale/gokrazy-kernel",
+    "KernelPackage": "github.com/gokrazy/kernel.amd64",
     "FirmwarePackage": "",
     "EEPROMPackage": "",
-    "InternalCompatibilityFlags": {}
+    "InternalCompatibilityFlags": {
+        "InitImportPath": "github.com/tailscale/ts-gokrazy/gokrazyinit"
+    }
 }
diff --git a/gokrazy/natlabapp/gokrazydeps.go b/gokrazy/natlabapp/gokrazydeps.go
index c5d2b32a3..9939149ca 100644
--- a/gokrazy/natlabapp/gokrazydeps.go
+++ b/gokrazy/natlabapp/gokrazydeps.go
@@ -6,10 +6,10 @@
 package gokrazydeps
 
 import (
-	_ "github.com/gokrazy/gokrazy"
 	_ "github.com/gokrazy/gokrazy/cmd/dhcp"
+	_ "github.com/gokrazy/kernel.amd64"
 	_ "github.com/gokrazy/serial-busybox"
-	_ "github.com/tailscale/gokrazy-kernel"
+	_ "github.com/tailscale/ts-gokrazy/gokrazyinit"
 	_ "tailscale.com/cmd/tailscale"
 	_ "tailscale.com/cmd/tailscaled"
 	_ "tailscale.com/cmd/tta"
diff --git a/gokrazy/tsapp-pi.arm64/README.md b/gokrazy/tsapp-pi.arm64/README.md
new file mode 100644
index 000000000..68d4f8cda
--- /dev/null
+++ b/gokrazy/tsapp-pi.arm64/README.md
@@ -0,0 +1,4 @@
+# Tailscale Appliance Raspberry Pi arm64
+
+This is the Raspberry Pi arm64 variant of the Gokrazy Tailscale Appliance image.
+See ../tsapp/README.md for more info.
diff --git a/gokrazy/tsapp-pi.arm64/config.json b/gokrazy/tsapp-pi.arm64/config.json
new file mode 100644
index 000000000..83af0c190
--- /dev/null
+++ b/gokrazy/tsapp-pi.arm64/config.json
@@ -0,0 +1,49 @@
+{
+    "Hostname": "tsapp",
+    "Update": {
+        "NoPassword": true
+    },
+    "SerialConsole": "serial0,115200",
+    "GokrazyPackages": [
+        "github.com/gokrazy/gokrazy/cmd/dhcp",
+        "github.com/gokrazy/gokrazy/cmd/randomd",
+        "github.com/gokrazy/gokrazy/cmd/ntp"
+    ],
+    "Packages": [
+        "github.com/gokrazy/serial-busybox",
+        "github.com/gokrazy/breakglass",
+        "tailscale.com/cmd/fbstatus",
+        "tailscale.com/cmd/tailscale",
+        "tailscale.com/cmd/tailscaled"
+    ],
+    "PackageConfig": {
+        "github.com/gokrazy/breakglass": {
+            "CommandLineFlags": [
+                "-authorized_keys=/perm/breakglass.authorized_keys"
+            ]
+        },
+        "tailscale.com/cmd/tailscale": {
+            "ExtraFilePaths": {
+                "/usr": "usr-dir"
+            },
+            "GoBuildTags": [
+                "ts_appliance"
+            ]
+        },
+        "tailscale.com/cmd/tailscaled": {
+            "GoBuildTags": [
+                "ts_appliance"
+            ]
+        }
+    },
+    "Environment": [
+        "GOOS=linux",
+        "GOARCH=arm64"
+    ],
+    "KernelPackage": "github.com/gokrazy/kernel.rpi",
+    "FirmwarePackage": "github.com/gokrazy/firmware",
+    "EEPROMPackage": "github.com/gokrazy/rpi-eeprom",
+    "InternalCompatibilityFlags": {
+        "InitImportPath": "github.com/tailscale/ts-gokrazy/gokrazyinit"
+    }
+}
diff --git a/gokrazy/tsapp-pi.arm64/gokrazydeps.go b/gokrazy/tsapp-pi.arm64/gokrazydeps.go
new file mode 100644
index 000000000..c548629bb
--- /dev/null
+++ b/gokrazy/tsapp-pi.arm64/gokrazydeps.go
@@ -0,0 +1,20 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build for_go_mod_tidy_only
+
+package gokrazydeps
+
+import (
+	_ "github.com/gokrazy/breakglass"
+	_ "github.com/gokrazy/firmware"
+	_ "github.com/gokrazy/gokrazy/cmd/dhcp"
+	_ "github.com/gokrazy/gokrazy/cmd/ntp"
+	_ "github.com/gokrazy/gokrazy/cmd/randomd"
+	_ "github.com/gokrazy/kernel.rpi"
+	_ "github.com/gokrazy/rpi-eeprom"
+	_ "github.com/gokrazy/serial-busybox"
+	_ "github.com/tailscale/ts-gokrazy/gokrazyinit"
+	_ "tailscale.com/cmd/tailscale"
+	_ "tailscale.com/cmd/tailscaled"
+)
diff --git a/gokrazy/tsapp-pi.arm64/usr-dir.tar b/gokrazy/tsapp-pi.arm64/usr-dir.tar
new file mode 100644
index 000000000..6ef6cfbfd
Binary files /dev/null and b/gokrazy/tsapp-pi.arm64/usr-dir.tar differ
diff --git a/gokrazy/tsapp-vm.arm64/README.md b/gokrazy/tsapp-vm.arm64/README.md
new file mode 100644
index 000000000..ca33a8a52
--- /dev/null
+++ b/gokrazy/tsapp-vm.arm64/README.md
@@ -0,0 +1,4 @@
+# Tailscale Appliance VM arm64
+
+This is the arm64 VM variant of the Gokrazy Tailscale Appliance image.
+See ../tsapp/README.md for more info.
diff --git a/gokrazy/tsapp-vm.arm64/config.json b/gokrazy/tsapp-vm.arm64/config.json
new file mode 100644
index 000000000..94993729f
--- /dev/null
+++ b/gokrazy/tsapp-vm.arm64/config.json
@@ -0,0 +1,53 @@
+{
+    "Hostname": "tsapp",
+    "Update": {
+        "NoPassword": true
+    },
+    "SerialConsole": "ttyS0,115200",
+    "GokrazyPackages": [
+        "github.com/gokrazy/gokrazy/cmd/dhcp",
+        "github.com/gokrazy/gokrazy/cmd/randomd",
+        "github.com/gokrazy/gokrazy/cmd/ntp"
+    ],
+    "Packages": [
+        "github.com/gokrazy/serial-busybox",
+        "github.com/gokrazy/breakglass",
+        "github.com/bradfitz/qemu-guest-kragent",
+        "tailscale.com/cmd/fbstatus",
+        "tailscale.com/cmd/tailscale",
+        "tailscale.com/cmd/tailscaled"
+    ],
+    "PackageConfig": {
+        "github.com/gokrazy/breakglass": {
+            "CommandLineFlags": [
+                "-authorized_keys=ec2"
+            ]
+        },
+        "tailscale.com/cmd/tailscale": {
+            "ExtraFilePaths": {
+                "/usr": "usr-dir"
+            },
+            "GoBuildTags": [
+                "ts_appliance"
+            ]
+        },
+        "tailscale.com/cmd/tailscaled": {
+            "CommandLineFlags": [
+                "-config=optional:vm:user-data"
+            ],
+            "GoBuildTags": [
+                "ts_appliance"
+            ]
+        }
+    },
+    "Environment": [
+        "GOOS=linux",
+        "GOARCH=arm64"
+    ],
+    "KernelPackage": "github.com/gokrazy/kernel.arm64",
+    "FirmwarePackage": "github.com/gokrazy/kernel.arm64",
+    "EEPROMPackage": "",
+    "InternalCompatibilityFlags": {
+        "InitImportPath": "github.com/tailscale/ts-gokrazy/gokrazyinit"
+    }
+}
diff --git a/gokrazy/tsapp-vm.arm64/gokrazydeps.go b/gokrazy/tsapp-vm.arm64/gokrazydeps.go
new file mode 100644
index 000000000..ed3fc3df2
--- /dev/null
+++ b/gokrazy/tsapp-vm.arm64/gokrazydeps.go
@@ -0,0 +1,19 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build for_go_mod_tidy_only
+
+package gokrazydeps
+
+import (
+	_ "github.com/bradfitz/qemu-guest-kragent"
+	_ "github.com/gokrazy/breakglass"
+	_ "github.com/gokrazy/gokrazy/cmd/dhcp"
+	_ "github.com/gokrazy/gokrazy/cmd/ntp"
+	_ "github.com/gokrazy/gokrazy/cmd/randomd"
+	_ "github.com/gokrazy/kernel.arm64"
+	_ "github.com/gokrazy/serial-busybox"
+	_ "github.com/tailscale/ts-gokrazy/gokrazyinit"
+	_ "tailscale.com/cmd/tailscale"
+	_ "tailscale.com/cmd/tailscaled"
+)
diff --git a/gokrazy/tsapp-vm.arm64/usr-dir.tar b/gokrazy/tsapp-vm.arm64/usr-dir.tar
new file mode 100644
index 000000000..6ef6cfbfd
Binary files /dev/null and b/gokrazy/tsapp-vm.arm64/usr-dir.tar differ
diff --git a/gokrazy/tsapp/config.json b/gokrazy/tsapp/config.json
index b88be53a4..10825b3c5 100644
--- a/gokrazy/tsapp/config.json
+++ b/gokrazy/tsapp/config.json
@@ -12,26 +12,41 @@
     "Packages": [
         "github.com/gokrazy/serial-busybox",
         "github.com/gokrazy/breakglass",
+        "github.com/bradfitz/qemu-guest-kragent",
+        "tailscale.com/cmd/fbstatus",
         "tailscale.com/cmd/tailscale",
         "tailscale.com/cmd/tailscaled"
     ],
     "PackageConfig": {
         "github.com/gokrazy/breakglass": {
             "CommandLineFlags": [
-                "-authorized_keys=ec2"
+                "-authorized_keys=/perm/breakglass.authorized_keys"
             ]
         },
         "tailscale.com/cmd/tailscale": {
             "ExtraFilePaths": {
                 "/usr": "usr-dir"
-            }
+            },
+            "GoBuildTags": [
+                "ts_appliance"
+            ]
+        },
+        "tailscale.com/cmd/tailscaled": {
+            "CommandLineFlags": [
+                "-config=optional:vm:user-data"
+            ],
+            "GoBuildTags": [
+                "ts_appliance"
+            ]
         }
     },
     "Environment": [
         "GOOS=linux",
         "GOARCH=amd64"
     ],
-    "KernelPackage": "github.com/tailscale/gokrazy-kernel",
-    "FirmwarePackage": "github.com/tailscale/gokrazy-kernel",
-    "InternalCompatibilityFlags": {}
+    "KernelPackage": "github.com/gokrazy/kernel.amd64",
+    "FirmwarePackage": "github.com/gokrazy/kernel.amd64",
+    "InternalCompatibilityFlags": {
+        "InitImportPath": "github.com/tailscale/ts-gokrazy/gokrazyinit"
+    }
 }
diff --git a/gokrazy/tsapp/gokrazydeps.go b/gokrazy/tsapp/gokrazydeps.go
index 931080647..60935b24f 100644
--- a/gokrazy/tsapp/gokrazydeps.go
+++ b/gokrazy/tsapp/gokrazydeps.go
@@ -6,13 +6,14 @@
 package gokrazydeps
 
 import (
+	_ "github.com/bradfitz/qemu-guest-kragent"
 	_ "github.com/gokrazy/breakglass"
-	_ "github.com/gokrazy/gokrazy"
 	_ "github.com/gokrazy/gokrazy/cmd/dhcp"
 	_ "github.com/gokrazy/gokrazy/cmd/ntp"
 	_ "github.com/gokrazy/gokrazy/cmd/randomd"
+	_ "github.com/gokrazy/kernel.amd64"
 	_ "github.com/gokrazy/serial-busybox"
-	_ "github.com/tailscale/gokrazy-kernel"
+	_ "github.com/tailscale/ts-gokrazy/gokrazyinit"
 	_ "tailscale.com/cmd/tailscale"
 	_ "tailscale.com/cmd/tailscaled"
 )
diff --git a/health/args.go b/health/args.go
index e89f7676f..5f606bdf4 100644
--- a/health/args.go
+++ b/health/args.go
@@ -36,4 +36,8 @@ const (
 	// ArgServerName provides a Warnable with comma delimited list of the hostname of the servers involved in the unhealthy state.
 	// If no nameservers were available to query, this will be an empty string.
 	ArgDNSServers Arg = "dns-servers"
+
+	// ArgDomains provides a Warnable with a comma-delimited list of domain
+	// names involved in the unhealthy state.
+	ArgDomains Arg = "domains"
 )
diff --git a/health/health.go b/health/health.go
index 1829bd482..00dbe9979 100644
--- a/health/health.go
+++ b/health/health.go
@@ -353,6 +353,15 @@ func (t *Tracker) nil() bool {
 	return true
 }
 
+// ProbeLocks acquires and releases the tracker's internal mutex.
+func (t *Tracker) ProbeLocks() {
+	if t.nil() {
+		return
+	}
+	t.mu.Lock()
+	t.mu.Unlock()
+}
+
 // Severity represents how serious an error is. Each GUI interprets this severity value in different ways,
 // to surface the error in a more or less visible way. For instance, the macOS GUI could change its menubar
 // icon to display an exclamation mark and present a modal notification for SeverityHigh warnings, but not
@@ -492,7 +501,12 @@ func (t *Tracker) SetHealthy(w *Warnable) {
 }
 
 func (t *Tracker) setHealthyLocked(w *Warnable) {
-	if !buildfeatures.HasHealth || t.warnableVal[w] == nil {
+	if !buildfeatures.HasHealth {
+		return
+	}
+
+	ws := t.warnableVal[w]
+	if ws == nil {
 		// Nothing to remove
 		return
 	}
@@ -501,15 +515,28 @@ func (t *Tracker) setHealthyLocked(w *Warnable) {
 
 	// Stop any pending visiblity timers for this Warnable
 	if canc, ok := t.pendingVisibleTimers[w]; ok {
+		// We removed the warningState for this Warnable,
+		// and we hold the lock, so even if the timer callback
+		// has already started, it won't find a warningState
+		// for this Warnable and won't publish any changes.
 		canc.Stop()
 		delete(t.pendingVisibleTimers, w)
 	}
 
-	change := Change{
-		WarnableChanged: true,
-		Warnable:        w,
+	// Only publish a change if the Warnable was unhealthy long
+	// enough to become visible to the user. Otherwise, it would
+	// not have been published as unhealthy, so there is no need
+	// to publish it as healthy. This prevents eventbus (and by
+	// extension the IPN bus) churn for Warnables that are marked
+	// unhealthy and then healthy again. Notably, this includes
+	// warnables touched by [Tracker.updateBuiltinWarnablesLocked].
+	if w.IsVisible(ws, t.now) {
+		change := Change{
+			WarnableChanged: true,
+			Warnable:        w,
+		}
+		t.changePub.Publish(change)
 	}
-	t.changePub.Publish(change)
 }
 
 // notifyWatchersControlChangedLocked calls each watcher to signal that control
diff --git a/health/health_test.go b/health/health_test.go
index ccd49b19a..f6e877f18 100644
--- a/health/health_test.go
+++ b/health/health_test.go
@@ -271,47 +271,91 @@ func TestSetUnhealthyWithTimeToVisible(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(*testing.T) {
-			bus := eventbustest.NewBus(t)
-			ht := NewTracker(bus)
-			mw := Register(&Warnable{
-				Code:                "test-warnable-3-secs-to-visible",
-				Title:               "Test Warnable with 3 seconds to visible",
-				Text:                StaticMessage("Hello world"),
-				TimeToVisible:       2 * time.Second,
-				ImpactsConnectivity: true,
+			synctest.Test(t, func(t *testing.T) {
+				clock := tstest.NewClock(tstest.ClockOpts{
+					Start:          time.Unix(123, 0),
+					FollowRealTime: false,
+				})
+				bus := eventbustest.NewBus(t)
+				ht := NewTracker(bus)
+				ht.testClock = clock
+				mw := Register(&Warnable{
+					Code:                "test-warnable-3-secs-to-visible",
+					Title:               "Test Warnable with 3 seconds to visible",
+					Text:                StaticMessage("Hello world"),
+					TimeToVisible:       2 * time.Second,
+					ImpactsConnectivity: true,
+				})
+				defer unregister(mw)
+
+				becameUnhealthy := make(chan struct{})
+				becameHealthy := make(chan struct{})
+
+				watchFunc := func(c Change) {
+					w := c.Warnable
+					us := c.UnhealthyState
+					if w != mw {
+						t.Fatalf("watcherFunc was called, but with an unexpected Warnable: %v, want: %v", w, w)
+					}
+
+					if us != nil {
+						becameUnhealthy <- struct{}{}
+					} else {
+						becameHealthy <- struct{}{}
+					}
+				}
+
+				tt.preFunc(t, ht, bus, watchFunc)
+				ht.SetUnhealthy(mw, Args{ArgError: "Hello world"})
+
+				// Advance time by half of the TimeToVisible duration.
+				clock.Advance(mw.TimeToVisible / 2)
+
+				select {
+				case <-becameUnhealthy:
+					// Test failed because the watcher got notified of an unhealthy state
+					t.Fatalf("watcherFunc was called with an unhealthy state")
+				case <-becameHealthy:
+					// Test failed because the watcher got of a healthy state
+					t.Fatalf("watcherFunc was called with a healthy state")
+				default:
+					// As expected, watcherFunc still had not been called
+					// after mw.TimeToVisible / 2.
+				}
+
+				// Advance time to get past the TimeToVisible duration.
+				// The watcher should be notified of the unhealthy state.
+				clock.Advance(mw.TimeToVisible/2 + 1)
+				<-becameUnhealthy
+
+				// Reset the warnable to neutral / healthy state before
+				// the next part of the test.
+				ht.SetHealthy(mw)
+				<-becameHealthy
+
+				// Mark the warnable unhealthy and then immediately healthy
+				// before the TimeToVisible duration elapses.
+				// The watcher should not be notified of either change
+				// because the warnable never became visible.
+				ht.SetUnhealthy(mw, Args{ArgError: "Hello world"})
+				ht.SetHealthy(mw)
+
+				// Advance to get past the TimeToVisible delay.
+				clock.Advance(mw.TimeToVisible * 2)
+				synctest.Wait()
+
+				select {
+				case <-becameUnhealthy:
+					// Test failed because the watcher got notified of an unhealthy state
+					t.Fatalf("watcherFunc was called with an unhealthy state")
+				case <-becameHealthy:
+					// Test failed because the watcher got of a healthy state
+					t.Fatalf("watcherFunc was called with a healthy state")
+				default:
+					// As expected, watcherFunc was not called after marking
+					// the warnable healthy again as it never became visible.
+				}
 			})
-
-			becameUnhealthy := make(chan struct{})
-			becameHealthy := make(chan struct{})
-
-			watchFunc := func(c Change) {
-				w := c.Warnable
-				us := c.UnhealthyState
-				if w != mw {
-					t.Fatalf("watcherFunc was called, but with an unexpected Warnable: %v, want: %v", w, w)
-				}
-
-				if us != nil {
-					becameUnhealthy <- struct{}{}
-				} else {
-					becameHealthy <- struct{}{}
-				}
-			}
-
-			tt.preFunc(t, ht, bus, watchFunc)
-			ht.SetUnhealthy(mw, Args{ArgError: "Hello world"})
-
-			select {
-			case <-becameUnhealthy:
-				// Test failed because the watcher got notified of an unhealthy state
-				t.Fatalf("watcherFunc was called with an unhealthy state")
-			case <-becameHealthy:
-				// Test failed because the watcher got of a healthy state
-				t.Fatalf("watcherFunc was called with a healthy state")
-			case <-time.After(1 * time.Second):
-				// As expected, watcherFunc still had not been called after 1 second
-			}
-			unregister(mw)
 		})
 	}
 }
@@ -533,7 +577,7 @@ func TestNoDERPHomeWarnable(t *testing.T) {
 	clock.Advance(30 * time.Second)
 	ht.updateBuiltinWarnablesLocked()
 
-	// Advance to get past the the TimeToVisible delay.
+	// Advance to get past the TimeToVisible delay.
 	clock.Advance(noDERPHomeWarnable.TimeToVisible * 2)
 
 	ht.updateBuiltinWarnablesLocked()
@@ -739,12 +783,11 @@ func TestControlHealthNotifies(t *testing.T) {
 				ht.SetIPNState("NeedsLogin", true)
 				ht.GotStreamedMapResponse()
 
-				// Expect events at starup, before doing anything else, skip unstable
-				// event and no warning event as they show up at different times.
+				// Expect events at starup, before doing anything else, skip
+				// the warming up events.
 				synctest.Wait()
 				if err := eventbustest.Expect(tw,
 					CompareWarnableCode(t, tsconst.HealthWarnableWarmingUp),
-					CompareWarnableCode(t, tsconst.HealthWarnableNotInMapPoll),
 					CompareWarnableCode(t, tsconst.HealthWarnableWarmingUp),
 				); err != nil {
 					t.Errorf("startup error: %v", err)
diff --git a/hostinfo/packagetype_appliance.go b/hostinfo/packagetype_appliance.go
new file mode 100644
index 000000000..997a064ec
--- /dev/null
+++ b/hostinfo/packagetype_appliance.go
@@ -0,0 +1,10 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build linux && ts_appliance
+
+package hostinfo
+
+func init() {
+	linuxBuildTagPackageType = "tsapp"
+}
diff --git a/internal/client/tailscale/identityfederation.go b/internal/client/tailscale/identityfederation.go
index 8c60c1c3c..42f02cc9a 100644
--- a/internal/client/tailscale/identityfederation.go
+++ b/internal/client/tailscale/identityfederation.go
@@ -9,21 +9,32 @@ import (
 	"tailscale.com/feature"
 )
 
+type ResolveAuthKeyWIFArgs struct {
+	// BaseURL is the URL of the control server used for token exchange and authkey generation.
+	BaseURL string
+	// ClientID is the federated client ID used for token exchange.
+	ClientID string
+	// IDToken is the Identity token from the identity provider.
+	IDToken string
+	// Audience is the federated audience acquired by configuring the trust credential in the admin UI.
+	Audience string
+	// Tags is the list of tags to be associated with the auth key.
+	Tags []string
+}
+
+type ExchangeJWTForTokenWIFArgs struct {
+	// BaseURL is the URL of the control server used for token exchange.
+	BaseURL string
+	// ClientID is the federated client ID used for token exchange.
+	ClientID string
+	// IDToken is a JWT identity token to use in the token exchange operation.
+	IDToken string
+}
+
 // HookResolveAuthKeyViaWIF resolves to [identityfederation.resolveAuthKey] when the
 // corresponding feature tag is enabled in the build process.
-//
-// baseURL is the URL of the control server used for token exchange and authkey generation.
-// clientID is the federated client ID used for token exchange
-// idToken is the Identity token from the identity provider
-// tags is the list of tags to be associated with the auth key
-// audience is the federated audience acquired by configuring
-// the trusted credential in the admin UI
-var HookResolveAuthKeyViaWIF feature.Hook[func(ctx context.Context, baseURL, clientID, idToken, audience string, tags []string) (string, error)]
+var HookResolveAuthKeyViaWIF feature.Hook[func(ctx context.Context, args ResolveAuthKeyWIFArgs) (string, error)]
 
 // HookExchangeJWTForTokenViaWIF resolves to [identityfederation.exchangeJWTForToken] when the
 // corresponding feature tag is enabled in the build process.
-//
-// baseURL is the URL of the control server used for token exchange
-// clientID is the federated client ID used for token exchange
-// idToken is the Identity token from the identity provider
-var HookExchangeJWTForTokenViaWIF feature.Hook[func(ctx context.Context, baseURL, clientID, idToken string) (string, error)]
+var HookExchangeJWTForTokenViaWIF feature.Hook[func(ctx context.Context, arg ExchangeJWTForTokenWIFArgs) (string, error)]
diff --git a/internal/client/tailscale/oauthkeys.go b/internal/client/tailscale/oauthkeys.go
index 43d5b0744..8e3c78375 100644
--- a/internal/client/tailscale/oauthkeys.go
+++ b/internal/client/tailscale/oauthkeys.go
@@ -9,12 +9,15 @@ import (
 	"tailscale.com/feature"
 )
 
+type ResolveAuthKeyArgs struct {
+	// Authkey is a standard device auth key or an OAuth client secret to resolve into an auth key.
+	AuthKey string
+	// Tags is the list of tags being advertised by the client (required to be provided for the
+	// OAuth secret case, and required to be the same as the list of tags for which the OAuth
+	// secret is allowed to issue auth keys).
+	Tags []string
+}
+
 // HookResolveAuthKey resolves to [oauthkey.ResolveAuthKey] when the
 // corresponding feature tag is enabled in the build process.
-//
-// authKey is a standard device auth key or an OAuth client secret to
-// resolve into an auth key.
-// tags is the list of tags being advertised by the client (required to be
-// provided for the OAuth secret case, and required to be the same as the
-// list of tags for which the OAuth secret is allowed to issue auth keys).
-var HookResolveAuthKey feature.Hook[func(ctx context.Context, authKey string, tags []string) (string, error)]
+var HookResolveAuthKey feature.Hook[func(ctx context.Context, args ResolveAuthKeyArgs) (string, error)]
diff --git a/internal/tooldeps/tooldeps.go b/internal/tooldeps/tooldeps.go
index 4ea1cf508..1acb9d8a6 100644
--- a/internal/tooldeps/tooldeps.go
+++ b/internal/tooldeps/tooldeps.go
@@ -10,5 +10,6 @@ package tooldeps
 import (
 	_ "github.com/golangci/golangci-lint/cmd/golangci-lint"
 	_ "github.com/tailscale/depaware/depaware"
+	_ "github.com/tailscale/policybottest"
 	_ "golang.org/x/tools/cmd/goimports"
 )
diff --git a/ipn/backend.go b/ipn/backend.go
index 7ea7c92b4..b02ee4679 100644
--- a/ipn/backend.go
+++ b/ipn/backend.go
@@ -5,6 +5,8 @@ package ipn
 
 import (
 	"fmt"
+	"slices"
+	"strconv"
 	"strings"
 	"time"
 
@@ -17,6 +19,7 @@ import (
 	"tailscale.com/types/netmap"
 	"tailscale.com/types/structs"
 	"tailscale.com/types/views"
+	"tailscale.com/util/syspolicy/policyclient"
 )
 
 type State int
@@ -35,15 +38,27 @@ const (
 // ID tokens used by the Android client.
 const GoogleIDTokenType = "ts_android_google_login"
 
+var stateStrings = [...]string{
+	"NoState",
+	"InUseOtherUser",
+	"NeedsLogin",
+	"NeedsMachineAuth",
+	"Stopped",
+	"Starting",
+	"Running",
+}
+
 func (s State) String() string {
-	return [...]string{
-		"NoState",
-		"InUseOtherUser",
-		"NeedsLogin",
-		"NeedsMachineAuth",
-		"Stopped",
-		"Starting",
-		"Running"}[s]
+	return stateStrings[s]
+}
+
+// StateFromString parses s as a State string value.
+func StateFromString(s string) (_ State, ok bool) {
+	i := slices.Index(stateStrings[:], s)
+	if i == -1 {
+		return NoState, false
+	}
+	return State(i), true
 }
 
 // EngineStatus contains WireGuard engine stats.
@@ -88,17 +103,200 @@ const (
 
 	NotifyInitialClientVersion NotifyWatchOpt = 1 << 11 // if set, the first Notify message (sent immediately) will contain the current ClientVersion if available and if update checks are enabled
 
-	// NotifyPeerChanges, if set, causes netmap delta updates to be sent as [tailcfg.PeerChange] rather than a full NetMap.
-	// Full netmap responses from the control plane are still sent as a full NetMap.  PeerChanges are only sent to sessions
-	// that have opted in to this mode.
+	// NotifyPeerChanges, if set, opts the watcher into peer-set delta
+	// notifications: [Notify.PeersChanged] (peer added or full-Node
+	// replaced) and [Notify.PeersRemoved] (peer removed by NodeID).
+	//
+	// Without this bit, peer adds/removes/replacements are not delivered
+	// over the bus at all (consumers fall back to fetching the netmap on
+	// demand or, on legacy-emit platforms, to watching [Notify.NetMap]).
+	//
+	// Watchers that want narrower per-field updates as well (Online,
+	// LastSeen, DERPHome, Endpoints) should additionally set
+	// [NotifyPeerPatches]. Without [NotifyPeerPatches], any per-field
+	// patch tailscaled would have emitted as a [tailcfg.PeerChange] is
+	// promoted into a full-Node entry in [Notify.PeersChanged] for this
+	// watcher, so a watcher that opts only into [NotifyPeerChanges] still
+	// observes every per-peer mutation; it just receives them as full
+	// Nodes rather than narrow patches. The cost is bus bandwidth.
+	//
+	// On platforms where the legacy [Notify.NetMap] is still emitted
+	// (Windows, macOS, iOS, Android), it is permitted to combine this
+	// with [NotifyInitialNetMap] for backwards compatibility. New code
+	// should pair this with [NotifyInitialStatus] instead.
 	NotifyPeerChanges NotifyWatchOpt = 1 << 12
+
+	// NotifyNoNetMap, if set, suppresses the legacy [Notify.NetMap] field on
+	// runtime (non-initial) Notify messages delivered to this watcher. It
+	// only matters on platforms where tailscaled still emits NetMap on the
+	// bus by default — Windows, macOS, and iOS — and is intended for GUI
+	// clients on those platforms that have migrated to read peers via
+	// [Notify.PeersChanged] / [LocalClient.NetMap]. The initial-state NetMap
+	// (sent when [NotifyInitialNetMap] is set) is unaffected.
+	NotifyNoNetMap NotifyWatchOpt = 1 << 13
+
+	// NotifyInitialStatus, if set, causes the first Notify message (sent
+	// immediately) to contain the current [ipnstate.Status] in
+	// [Notify.InitialStatus]. Together with [Notify.SelfChange] and
+	// [Notify.PeersChanged] on subsequent messages, it lets a watcher
+	// stitch together a continuous view of the local node's state without
+	// fetching the netmap directly. Prefer this over [LocalClient.NetMap]
+	// for new code that wants a stable, client-facing snapshot type.
+	NotifyInitialStatus NotifyWatchOpt = 1 << 14
+
+	// NotifyPeerPatches, if set, opts the watcher into narrow per-field
+	// peer patches via [Notify.PeerChangedPatch]. It implies
+	// [NotifyPeerChanges]: a watcher with [NotifyPeerPatches] also
+	// receives [Notify.PeersChanged] and [Notify.PeersRemoved].
+	//
+	// This is the lower-bandwidth mode: changes to fields that fit in a
+	// [tailcfg.PeerChange] (currently Online, LastSeen, DERPHome,
+	// Endpoints) ride as patches; only changes that don't fit ride as
+	// full Nodes in [Notify.PeersChanged].
+	//
+	// Without this bit but with [NotifyPeerChanges], the producer
+	// promotes any patch into a full-Node entry in [Notify.PeersChanged]
+	// for this session, at the cost of bandwidth.
+	NotifyPeerPatches NotifyWatchOpt = 1 << 15
+
+	// NotifyInProcessNoDisconnect, if set, marks this watcher as an
+	// in-process subscriber that must not be disconnected for falling behind
+	// on its notification queue. Instead, if its queue fills, Notify
+	// production blocks until the watcher catches up.
+	//
+	// Callers using this bit must receive and process notifications promptly.
+	// Their callbacks must not call back into LocalBackend or wait on work that
+	// might call back into LocalBackend, because the producer might be holding
+	// LocalBackend's mutex while waiting for the watcher to catch up.
+	//
+	// This bit is only valid for in-process callers of
+	// LocalBackend.WatchNotificationsAs. LocalAPI WatchIPNBus clients must
+	// not request it.
+	NotifyInProcessNoDisconnect NotifyWatchOpt = 1 << 16
+
+	// NotifySysPolicyChanges, if set, causes the first Notify message, which is sent
+	// immediately, to contain the current effective [setting.Snapshot] in
+	// [Notify.Policy]. [Notify.Policy] is included in subsequent messages whenever
+	// the effective policy changes.
+	//
+	// The snapshot is scoped to the connected user's identity (on Windows,
+	// derived from the named-pipe token's SID).
+	//
+	// The [setting.Snapshot] that is delivered is a full snapshot on every
+	// change.
+	NotifySysPolicyChanges NotifyWatchOpt = 1 << 17
+
+	// NotifyPeerWireGuardState, if set, opts the watcher into
+	// WireGuard session state notifications via [Notify.PeerState].
+	// The first Notify sent to the watcher includes a dump of current
+	// non-zero peer states, and subsequent Notifies include per-peer
+	// state changes.
+	NotifyPeerWireGuardState NotifyWatchOpt = 1 << 18
 )
 
+// String implements the [fmt.Stringer] interface.
+// Returns the string representation of all the bits joined by the bitwise-or "|" operator.
+func (o NotifyWatchOpt) String() string {
+	if o == NotifyWatchOpt(0) {
+		return fmt.Sprintf("%T(%#x)", o, uint64(o))
+	}
+
+	pkg, _, found := strings.Cut(fmt.Sprintf("%T", o), ".")
+
+	var bits []string
+	var mask NotifyWatchOpt
+	try := func(bit NotifyWatchOpt, s string) {
+		if o&bit == 0 {
+			return
+		}
+		if found {
+			bits = append(bits, pkg+"."+s)
+		} else {
+			bits = append(bits, s)
+		}
+		mask |= bit
+	}
+	try(NotifyWatchEngineUpdates, "NotifyWatchEngineUpdates")
+	try(NotifyInitialState, "NotifyInitialState")
+	try(NotifyInitialPrefs, "NotifyInitialPrefs")
+	try(NotifyInitialNetMap, "NotifyInitialNetMap")
+	try(NotifyNoPrivateKeys, "NotifyNoPrivateKeys")
+	try(NotifyInitialDriveShares, "NotifyInitialDriveShares")
+	try(NotifyInitialOutgoingFiles, "NotifyInitialOutgoingFiles")
+	try(NotifyInitialHealthState, "NotifyInitialHealthState")
+	try(NotifyRateLimit, "NotifyRateLimit")
+	try(NotifyHealthActions, "NotifyHealthActions")
+	try(NotifyInitialSuggestedExitNode, "NotifyInitialSuggestedExitNode")
+	try(NotifyInitialClientVersion, "NotifyInitialClientVersion")
+	try(NotifyPeerChanges, "NotifyPeerChanges")
+	try(NotifyNoNetMap, "NotifyNoNetMap")
+	try(NotifyInitialStatus, "NotifyInitialStatus")
+	try(NotifyPeerPatches, "NotifyPeerPatches")
+	try(NotifyInProcessNoDisconnect, "NotifyInProcessNoDisconnect")
+	try(NotifySysPolicyChanges, "NotifySysPolicyChanges")
+	try(NotifyPeerWireGuardState, "NotifyPeerWireGuardState")
+
+	if mask != o {
+		bits = append(bits, fmt.Sprintf("%T(%#x)", o, uint64(o^mask))) // unknown
+	}
+
+	if len(bits) == 1 {
+		return bits[0]
+	}
+	// Multiple values, so we need to wrap with parentheses.
+	return "(" + strings.Join(bits, " | ") + ")"
+}
+
+// AppendText implements the [encoding.TextAppender] interface
+// by encoding its textual representation.
+func (o NotifyWatchOpt) AppendText(b []byte) ([]byte, error) {
+	return strconv.AppendUint(b, uint64(o), 10), nil
+}
+
+// MarshalText implements the [encoding.TextMarshaler] interface
+// by encoding its textual representation.
+func (o NotifyWatchOpt) MarshalText() (text []byte, err error) {
+	return o.AppendText(nil)
+}
+
+// UnmarshalText implements the [encoding.TextUnmarshaler] interface
+// by decoding its textual representation.
+func (o *NotifyWatchOpt) UnmarshalText(text []byte) error {
+	v, err := strconv.ParseUint(string(text), 10, 64)
+	if err != nil {
+		return err
+	}
+	*o = NotifyWatchOpt(v)
+	return nil
+}
+
+// NotifyRateLimitIncompatibleBits is the set of new-style IPN bus
+// subscription bits that cannot be combined with [NotifyRateLimit].
+//
+// Those bits describe stateful delta streams. Randomly delaying or merging
+// messages in those streams would break the consumer's ability to maintain a
+// coherent local view.
+const NotifyRateLimitIncompatibleBits = NotifyPeerChanges | NotifyNoNetMap | NotifyInitialStatus | NotifyPeerPatches
+
+// ValidateNotifyWatchOpt reports whether mask is a valid WatchIPNBus
+// subscription mask.
+func ValidateNotifyWatchOpt(mask NotifyWatchOpt) error {
+	if mask&NotifyRateLimit != 0 {
+		if bad := mask & NotifyRateLimitIncompatibleBits; bad != 0 {
+			return fmt.Errorf("NotifyRateLimit is incompatible with new-style IPN bus subscription bits %v", bad)
+		}
+	}
+	return nil
+}
+
 // Notify is a communication from a backend (e.g. tailscaled) to a frontend
 // (cmd/tailscale, iOS, macOS, Win Tasktray).
 // In any given notification, any or all of these may be nil, meaning
 // that they have not changed.
 // They are JSON-encoded on the wire, despite the lack of struct tags.
+//
+// API maturity: this type is not considered a stable API and is
+// subject to change between releases.
 type Notify struct {
 	_       structs.Incomparable
 	Version string // version number of IPN backend
@@ -113,16 +311,113 @@ type Notify struct {
 	// For State InUseOtherUser, ErrMessage is not critical and just contains the details.
 	ErrMessage *string
 
-	LoginFinished *empty.Message     // non-nil when/if the login process succeeded
-	State         *State             // if non-nil, the new or current IPN state
-	Prefs         *PrefsView         // if non-nil && Valid, the new or current preferences
-	NetMap        *netmap.NetworkMap // if non-nil, the new or current netmap
+	LoginFinished *empty.Message // non-nil when/if the login process succeeded
+	State         *State         // if non-nil, the new or current IPN state
+	Prefs         *PrefsView     // if non-nil && Valid, the new or current preferences
 
-	// PeerChanges, if non-nil, is a list of [tailcfg.PeerChange] that have occurred since the last
-	// full netmap update. This is sent in lieu of a full NetMap when [NotifyPeerChanges] is set in
-	// the session's mask and a netmap update is derived from an incremental MapResponse.
-	// Full MapResponse updates from the control plane are sent as a full NetMap.
-	PeerChanges []*tailcfg.PeerChange `json:",omitzero"`
+	// SelfChange, if non-nil, indicates that this node's own [tailcfg.Node]
+	// has changed: addresses, name, key expiry, capabilities, etc. It carries
+	// the new self node so reactive consumers (containerboot, kube agents,
+	// sniproxy, etc.) can read the current self state without watching the
+	// full netmap.
+	//
+	// Consumers that need additional state (peers, DNS config, packet
+	// filter) should react to SelfChange by fetching the full netmap on
+	// demand via [LocalClient.NetMap].
+	SelfChange *tailcfg.Node `json:",omitzero"`
+
+	// InitialStatus, if non-nil, is the current [ipnstate.Status]. It is
+	// only set in the first Notify of a session when the watcher requested
+	// [NotifyInitialStatus]. Together with subsequent [Notify.SelfChange]
+	// and [Notify.PeerChanges] messages, it lets a watcher stitch together
+	// a continuous view of node state without fetching the netmap.
+	InitialStatus *ipnstate.Status `json:",omitzero"`
+
+	// NetMap, if non-nil, is the full network map. New consumers should prefer
+	// [LocalClient.NetMap] for one-shot fetches and [Notify.SelfChange] /
+	// [Notify.PeerChanges] for incremental reactive updates; NetMap on the bus
+	// is the legacy path retained for hosts whose GUIs have not yet finished
+	// migrating. It is delivered:
+	//
+	//   - On the initial Notify if the watcher requested
+	//     [NotifyInitialNetMap] (any platform).
+	//   - On subsequent Notify messages, only when tailscaled is running
+	//     on Windows. On all other platforms it is always nil after the
+	//     initial notify.
+	//
+	// Deprecated: this field is only populated on Windows and
+	// is slated for removal in favor of [Notify.InitialStatus] +
+	// [Notify.SelfChange] / [Notify.PeerChanges], etc, as this field
+	// doesn't scale.
+	NetMap *netmap.NetworkMap
+
+	// PeerChangedPatch, if non-empty, lists narrow per-field peer patches
+	// since the last Notify (currently Online, LastSeen, DERPHome,
+	// Endpoints). It mirrors [tailcfg.MapResponse.PeersChangedPatch].
+	//
+	// Peer additions and any peer change that can't be expressed as a
+	// [tailcfg.PeerChange] travel in [Notify.PeersChanged]; peer removals
+	// in [Notify.PeersRemoved].
+	//
+	// Watchers must opt in to receive this field by setting
+	// [NotifyPeerPatches]; without that bit (but with [NotifyPeerChanges])
+	// the producer promotes each patch into a full-Node entry in
+	// [Notify.PeersChanged] instead.
+	//
+	// The [tailcfg.PeerChange] type may grow more fields over time;
+	// consumers that see a [tailcfg.PeerChange] with a field they don't
+	// recognize should re-fetch the affected node by NodeID via
+	// [LocalClient.PeerByID] (an O(1) lookup) to learn its current value
+	// rather than ignoring the change.
+	PeerChangedPatch []*tailcfg.PeerChange `json:",omitzero"`
+
+	// PeersChanged, if non-empty, lists peers whose full [tailcfg.Node]
+	// has been added or replaced since the last Notify. A node ID may
+	// appear here either because it is a brand-new peer or because the
+	// control plane sent a fresh full Node for an existing peer when the
+	// change wasn't expressible as a [tailcfg.PeerChange] patch (e.g. a
+	// CapMap, Addresses, Hostinfo, or Tags change). Consumers should
+	// upsert by NodeID.
+	//
+	// This mirrors [tailcfg.MapResponse.PeersChanged] semantics; peer
+	// removals travel in [Notify.PeersRemoved] and narrow per-field
+	// patches in [Notify.PeerChanges].
+	PeersChanged []*tailcfg.Node `json:",omitzero"`
+
+	// PeersRemoved, if non-empty, lists [tailcfg.NodeID]s that have been
+	// removed from the netmap since the last Notify. See
+	// [Notify.PeersChanged]. This mirrors
+	// [tailcfg.MapResponse.PeersRemoved].
+	PeersRemoved []tailcfg.NodeID `json:",omitzero"`
+
+	// UserProfiles, if non-empty, carries [tailcfg.UserProfileView]
+	// entries that have been added or updated since the last Notify on
+	// this session. Watchers must opt in via [NotifyPeerChanges] or
+	// [NotifyPeerPatches]; this field is gated on the same bits as
+	// [Notify.PeersChanged] / [Notify.PeerChangedPatch] because its
+	// only purpose is to let those consumers resolve the [tailcfg.UserID]
+	// referenced by a peer Node.
+	//
+	// The producer guarantees that any UserID referenced by a peer in
+	// a [Notify.PeersChanged] / [Notify.PeerChangedPatch] entry will
+	// have its profile delivered either earlier on this same session
+	// (e.g. via the initial NetMap or via an earlier Notify carrying
+	// UserProfiles) or in this same Notify. A consumer that sees a
+	// UserID it doesn't recognize on a session that opted in to
+	// peer-change notifications can treat it as a bug; the
+	// [LocalClient.UserProfile] LocalAPI fallback exists for sessions
+	// that didn't subscribe with the peer-change bits or that need to
+	// look up a UserID for any other reason.
+	//
+	// The values are [tailcfg.UserProfileView] so they share backing
+	// memory with the producer's tracking maps; consumers should treat
+	// them as read-only and use [tailcfg.UserProfileView.AsStruct] or
+	// the per-field accessors to read them.
+	UserProfiles map[tailcfg.UserID]tailcfg.UserProfileView `json:",omitzero"`
+
+	// PeerState, if non-empty, carries WireGuard session states keyed by stable
+	// node ID. Watchers must opt in via [NotifyPeerWireGuardState].
+	PeerState map[tailcfg.StableNodeID]PeerState `json:",omitzero"`
 
 	Engine      *EngineStatus // if non-nil, the new or current wireguard stats
 	BrowseToURL *string       // if non-nil, UI should open a browser right now
@@ -175,9 +470,81 @@ type Notify struct {
 	// be the best exit node for the current network conditions.
 	SuggestedExitNode *tailcfg.StableNodeID `json:",omitzero"`
 
+	// Policy, if non-nil, is the effective policy snapshot for the
+	// connected user. It is scoped per-user: per-user policy settings
+	// are merged with device-wide settings, with device-wide taking
+	// precedence. Sent initially when [NotifySysPolicyChanges] is set,
+	// and on change thereafter.
+	Policy *policyclient.PolicySnapshot `json:",omitzero"`
+
 	// type is mirrored in xcode/IPN/Core/LocalAPI/Model/LocalAPIModel.swift
 }
 
+// PeerWireGuardState is the WireGuard session state for a peer.
+//
+// It JSON-marshals as a lowercase string (e.g. "handshake", "established")
+// rather than its integer value, so the wire format does not depend on the
+// numeric constants below.
+type PeerWireGuardState uint8
+
+const (
+	PeerWireGuardStateNone        PeerWireGuardState = 0
+	PeerWireGuardStateHandshake   PeerWireGuardState = 1
+	PeerWireGuardStateEstablished PeerWireGuardState = 2
+	PeerWireGuardStateExpired     PeerWireGuardState = 3
+)
+
+// String returns the lowercase string form of s used by [PeerWireGuardState.MarshalText].
+func (s PeerWireGuardState) String() string {
+	switch s {
+	case PeerWireGuardStateNone:
+		return "none"
+	case PeerWireGuardStateHandshake:
+		return "handshake"
+	case PeerWireGuardStateEstablished:
+		return "established"
+	case PeerWireGuardStateExpired:
+		return "expired"
+	}
+	return fmt.Sprintf("PeerWireGuardState(%d)", uint8(s))
+}
+
+// MarshalText implements [encoding.TextMarshaler].
+func (s PeerWireGuardState) MarshalText() ([]byte, error) {
+	return []byte(s.String()), nil
+}
+
+// UnmarshalText implements [encoding.TextUnmarshaler].
+func (s *PeerWireGuardState) UnmarshalText(b []byte) error {
+	switch string(b) {
+	case "none":
+		*s = PeerWireGuardStateNone
+	case "handshake":
+		*s = PeerWireGuardStateHandshake
+	case "established":
+		*s = PeerWireGuardStateEstablished
+	case "expired":
+		*s = PeerWireGuardStateExpired
+	default:
+		return fmt.Errorf("unknown PeerWireGuardState %q", b)
+	}
+	return nil
+}
+
+// PeerState is the per-peer WireGuard session state delivered in
+// [Notify.PeerState].
+type PeerState struct {
+	// PeerWireGuardState is the current WireGuard session state for the peer.
+	PeerWireGuardState PeerWireGuardState
+
+	// PeerWireGuardStateAt is the wall-clock time at which the peer entered
+	// [PeerState.PeerWireGuardState], as observed by tailscaled.
+	// It is tracked by [LocalBackend] even when no watchers are subscribed,
+	// so a later subscriber's initial snapshot reflects the true transition
+	// time rather than the subscription time.
+	PeerWireGuardStateAt time.Time
+}
+
 func (n Notify) String() string {
 	var sb strings.Builder
 	sb.WriteString("Notify{")
@@ -193,11 +560,14 @@ func (n Notify) String() string {
 	if n.Prefs != nil && n.Prefs.Valid() {
 		fmt.Fprintf(&sb, "%v ", n.Prefs.Pretty())
 	}
-	if n.NetMap != nil {
-		sb.WriteString("NetMap{...} ")
+	if n.SelfChange != nil {
+		fmt.Fprintf(&sb, "SelfChange(%v) ", n.SelfChange.StableID)
 	}
-	if n.PeerChanges != nil {
-		fmt.Fprintf(&sb, "PeerChanges(%d) ", len(n.PeerChanges))
+	if n.PeerChangedPatch != nil {
+		fmt.Fprintf(&sb, "PeerChangedPatch(%d) ", len(n.PeerChangedPatch))
+	}
+	if len(n.PeerState) > 0 {
+		fmt.Fprintf(&sb, "PeerState(%d) ", len(n.PeerState))
 	}
 	if n.Engine != nil {
 		fmt.Fprintf(&sb, "wg=%v ", *n.Engine)
diff --git a/ipn/backend_test.go b/ipn/backend_test.go
index bfb6d6bc4..199901fca 100644
--- a/ipn/backend_test.go
+++ b/ipn/backend_test.go
@@ -4,10 +4,20 @@
 package ipn
 
 import (
+	"encoding/json"
+	"go/types"
+	"maps"
+	"math/bits"
+	"slices"
+	"strconv"
+	"strings"
 	"testing"
 
+	"golang.org/x/tools/go/packages"
+
 	"tailscale.com/health"
 	"tailscale.com/types/empty"
+	"tailscale.com/util/mak"
 )
 
 func TestNotifyString(t *testing.T) {
@@ -40,3 +50,218 @@ func TestNotifyString(t *testing.T) {
 		})
 	}
 }
+
+func TestPeerWireGuardStateJSON(t *testing.T) {
+	tests := []struct {
+		state PeerWireGuardState
+		json  string
+	}{
+		{PeerWireGuardStateNone, `"none"`},
+		{PeerWireGuardStateHandshake, `"handshake"`},
+		{PeerWireGuardStateEstablished, `"established"`},
+		{PeerWireGuardStateExpired, `"expired"`},
+	}
+	for _, tt := range tests {
+		t.Run(tt.state.String(), func(t *testing.T) {
+			got, err := json.Marshal(tt.state)
+			if err != nil {
+				t.Fatalf("Marshal: %v", err)
+			}
+			if string(got) != tt.json {
+				t.Errorf("Marshal(%v) = %s; want %s", tt.state, got, tt.json)
+			}
+			var back PeerWireGuardState
+			if err := json.Unmarshal(got, &back); err != nil {
+				t.Fatalf("Unmarshal: %v", err)
+			}
+			if back != tt.state {
+				t.Errorf("round-trip = %v; want %v", back, tt.state)
+			}
+		})
+	}
+
+	var bad PeerWireGuardState
+	if err := json.Unmarshal([]byte(`"bogus"`), &bad); err == nil {
+		t.Errorf("Unmarshal of bogus value did not return an error")
+	}
+}
+
+func TestValidateNotifyWatchOpt(t *testing.T) {
+	tests := []struct {
+		name    string
+		mask    NotifyWatchOpt
+		wantErr bool
+	}{
+		{
+			name: "legacy-rate-limit-only",
+			mask: NotifyRateLimit,
+		},
+		{
+			name: "peer-changes-without-rate-limit",
+			mask: NotifyPeerChanges | NotifyPeerPatches | NotifyNoNetMap | NotifyInitialStatus,
+		},
+		{
+			name: "in-process-no-disconnect",
+			mask: NotifyInProcessNoDisconnect | NotifyPeerChanges,
+		},
+		{
+			name:    "rate-limit-with-peer-changes",
+			mask:    NotifyRateLimit | NotifyPeerChanges,
+			wantErr: true,
+		},
+		{
+			name:    "rate-limit-with-peer-patches",
+			mask:    NotifyRateLimit | NotifyPeerPatches,
+			wantErr: true,
+		},
+		{
+			name:    "rate-limit-with-no-netmap",
+			mask:    NotifyRateLimit | NotifyNoNetMap,
+			wantErr: true,
+		},
+		{
+			name:    "rate-limit-with-initial-status",
+			mask:    NotifyRateLimit | NotifyInitialStatus,
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := ValidateNotifyWatchOpt(tt.mask)
+			if gotErr := err != nil; gotErr != tt.wantErr {
+				t.Fatalf("ValidateNotifyWatchOpt(%v) error = %v; wantErr %v", tt.mask, err, tt.wantErr)
+			}
+		})
+	}
+}
+
+func TestNotifyWatchOptString(t *testing.T) {
+	consts := findNotifyWatchOptConstants(t)
+	t.Logf("consts = %#v", consts)
+
+	t.Run("zero", func(t *testing.T) {
+		var zero NotifyWatchOpt
+		want := "ipn.NotifyWatchOpt(0x0)"
+		if got := zero.String(); got != want {
+			t.Errorf("NotifyWatchOpt(%#v).String() = %q, want %q", zero, got, want)
+		}
+	})
+
+	t.Run("unknown", func(t *testing.T) {
+		msb := NotifyWatchOpt(1 << 63)
+		want := "ipn.NotifyWatchOpt(0x8000000000000000)"
+		if got := msb.String(); got != want {
+			t.Errorf("NotifyWatchOpt(%#v).String() = %q, want %q", msb, got, want)
+		}
+	})
+
+	t.Run("simple", func(t *testing.T) {
+		for _, c := range slices.Sorted(maps.Keys(consts)) {
+			if bits.OnesCount64(uint64(c)) > 1 {
+				continue // multiple bits comes later
+			}
+			want := "ipn." + consts[c]
+			if got := c.String(); got != want {
+				t.Errorf("NotifyWatchOpt(%#v).String() = %q, want %q", c, got, want)
+			}
+		}
+	})
+
+	t.Run("composite", func(t *testing.T) {
+		for _, tc := range []struct {
+			name  string
+			value NotifyWatchOpt
+			want  string
+		}{
+			{
+				name:  "single",
+				value: NotifyWatchEngineUpdates,
+				want:  "ipn.NotifyWatchEngineUpdates",
+			},
+			{
+				name:  "double",
+				value: NotifyWatchEngineUpdates | NotifyInitialState,
+				want:  "(ipn.NotifyWatchEngineUpdates | ipn.NotifyInitialState)",
+			},
+			{
+				name:  "triple",
+				value: NotifyWatchEngineUpdates | NotifyInitialState | NotifyInitialPrefs,
+				want:  "(ipn.NotifyWatchEngineUpdates | ipn.NotifyInitialState | ipn.NotifyInitialPrefs)",
+			},
+			{
+				name:  "unknown",
+				value: NotifyWatchEngineUpdates | NotifyWatchOpt(1<<63),
+				want:  "(ipn.NotifyWatchEngineUpdates | ipn.NotifyWatchOpt(0x8000000000000000))",
+			},
+		} {
+			t.Run(tc.name, func(t *testing.T) {
+				if got := tc.value.String(); got != tc.want {
+					t.Errorf("NotifyWatchOpt(%#v).String() = %q, want %q", tc.value, got, tc.want)
+				}
+			})
+		}
+	})
+
+	// Check that every named NotifyWatchOpt value is mapped inside [NotifyWatchOpt.String].
+	t.Run("all", func(t *testing.T) {
+		var all NotifyWatchOpt
+		var names []string // names are sorted and only contain simple consts
+		for _, c := range slices.Sorted(maps.Keys(consts)) {
+			all |= c
+			if bits.OnesCount64(uint64(c)) == 1 {
+				names = append(names, "ipn."+consts[c])
+			}
+		}
+		want := "(" + strings.Join(names, " | ") + ")"
+		if got := all.String(); got != want {
+			t.Errorf("all.String() = %q, want %q", got, want)
+		}
+	})
+}
+
+func findNotifyWatchOptConstants(t *testing.T) map[NotifyWatchOpt]string {
+	t.Helper()
+
+	// Load the current package.
+	cfg := &packages.Config{
+		Mode: packages.NeedTypes,
+	}
+	pkgs, err := packages.Load(cfg, ".")
+	if err != nil {
+		t.Fatalf("failed to load packages: %v", err)
+	}
+
+	// Find all the [NotifyWatchOpt] constants that represent this enum.
+	var found map[NotifyWatchOpt]string
+	for _, pkg := range pkgs {
+		if len(pkg.Errors) > 0 {
+			t.Fatalf("package %s has errors: %v", pkg.Name, pkg.Errors)
+		}
+
+		wantType := pkg.Types.Path() + ".NotifyWatchOpt"
+		scope := pkg.Types.Scope()
+		for _, name := range scope.Names() {
+			obj := scope.Lookup(name)
+			if obj == nil || obj.Type().String() != wantType {
+				continue
+			}
+			c, ok := obj.(*types.Const)
+			if !ok {
+				continue
+			}
+			s := c.Val().ExactString()
+			val, err := strconv.ParseUint(s, 10, 64)
+			if err != nil {
+				t.Fatalf("cannot parse %q: %v", s, err)
+			}
+			mak.Set(&found, NotifyWatchOpt(val), name)
+		}
+	}
+
+	if len(found) == 0 {
+		t.Fatal("could not find NotifyWatchOpt constants")
+	}
+
+	return found
+}
diff --git a/ipn/conf.go b/ipn/conf.go
index de127a28a..df663766b 100644
--- a/ipn/conf.go
+++ b/ipn/conf.go
@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"net/netip"
 
+	"tailscale.com/net/tsaddr"
 	"tailscale.com/tailcfg"
 	"tailscale.com/types/opt"
 	"tailscale.com/types/preftype"
@@ -31,8 +32,9 @@ type ConfigVAlpha struct {
 	ExitNode                   *string  `json:"exitNode,omitempty"` // IP, StableID, or MagicDNS base name
 	AllowLANWhileUsingExitNode opt.Bool `json:"allowLANWhileUsingExitNode,omitempty"`
 
-	AdvertiseRoutes []netip.Prefix `json:",omitempty"`
-	DisableSNAT     opt.Bool       `json:",omitempty"`
+	AdvertiseRoutes   []netip.Prefix `json:",omitempty"`
+	AdvertiseExitNode opt.Bool       `json:",omitzero"`
+	DisableSNAT       opt.Bool       `json:",omitzero"`
 
 	AdvertiseServices []string `json:",omitempty"`
 
@@ -45,6 +47,7 @@ type ConfigVAlpha struct {
 	RunSSHServer    opt.Bool         `json:",omitempty"` // Tailscale SSH
 	RunWebClient    opt.Bool         `json:",omitempty"`
 	ShieldsUp       opt.Bool         `json:",omitempty"`
+	RemoteConfig    opt.Bool         `json:",omitzero"` // delegate full remote control to the tailnet admin; see Prefs.RemoteConfig
 	AutoUpdate      *AutoUpdatePrefs `json:",omitempty"`
 	ServeConfigTemp *ServeConfig     `json:",omitempty"` // TODO(bradfitz,maisem): make separate stable type for this
 
@@ -52,6 +55,15 @@ type ConfigVAlpha struct {
 	// should advertise amongst its wireguard endpoints.
 	StaticEndpoints []netip.AddrPort `json:",omitempty"`
 
+	// RelayServerPort is the UDP port for the relay server to bind to.
+	// A value of 0 will pick a random unused port. Nil disables relay server.
+	RelayServerPort *uint16 `json:",omitzero"`
+
+	// RelayServerStaticEndpoints are static IP:port endpoints to advertise
+	// as candidates for relay connections. Only relevant when RelayServerPort
+	// is non-nil.
+	RelayServerStaticEndpoints []netip.AddrPort `json:",omitempty"`
+
 	// TODO(bradfitz,maisem): future something like:
 	// Profile map[string]*Config // keyed by alice@gmail.com, corp.com (TailnetSID)
 }
@@ -115,6 +127,14 @@ func (c *ConfigVAlpha) ToPrefs() (MaskedPrefs, error) {
 		mp.AdvertiseRoutes = c.AdvertiseRoutes
 		mp.AdvertiseRoutesSet = true
 	}
+	if c.AdvertiseExitNode.EqualBool(true) {
+		if mp.AdvertiseRoutesSet {
+			mp.AdvertiseRoutes = append(mp.AdvertiseRoutes, tsaddr.AllIPv4(), tsaddr.AllIPv6())
+		} else {
+			mp.AdvertiseRoutes = tsaddr.ExitRoutes()
+			mp.AdvertiseRoutesSet = true
+		}
+	}
 	if c.DisableSNAT != "" {
 		mp.NoSNAT = c.DisableSNAT.EqualBool(true)
 		mp.NoSNATSet = true
@@ -148,6 +168,10 @@ func (c *ConfigVAlpha) ToPrefs() (MaskedPrefs, error) {
 		mp.ShieldsUp = c.ShieldsUp.EqualBool(true)
 		mp.ShieldsUpSet = true
 	}
+	if c.RemoteConfig != "" {
+		mp.RemoteConfig = c.RemoteConfig.EqualBool(true)
+		mp.RemoteConfigSet = true
+	}
 	if c.AutoUpdate != nil {
 		mp.AutoUpdate = *c.AutoUpdate
 		mp.AutoUpdateSet = AutoUpdatePrefsMask{ApplySet: true, CheckSet: true}
@@ -166,5 +190,13 @@ func (c *ConfigVAlpha) ToPrefs() (MaskedPrefs, error) {
 	if c.AdvertiseServices != nil {
 		mp.AdvertiseServices = c.AdvertiseServices
 	}
+	mp.RelayServerPortSet = true
+	mp.RelayServerStaticEndpointsSet = true
+	if c.RelayServerPort != nil {
+		mp.RelayServerPort = c.RelayServerPort
+	}
+	if c.RelayServerStaticEndpoints != nil {
+		mp.RelayServerStaticEndpoints = c.RelayServerStaticEndpoints
+	}
 	return mp, nil
 }
diff --git a/ipn/conf_test.go b/ipn/conf_test.go
index 41b5c4506..b394e438e 100644
--- a/ipn/conf_test.go
+++ b/ipn/conf_test.go
@@ -5,6 +5,8 @@ package ipn
 
 import (
 	"net/netip"
+	"reflect"
+	"slices"
 	"testing"
 )
 
@@ -64,3 +66,148 @@ func TestConfigVAlpha_ToPrefs_AdvertiseRoutes(t *testing.T) {
 		})
 	}
 }
+
+func TestConfigVAlphaToPrefs(t *testing.T) {
+	aps := func(t *testing.T, strs ...string) (ret []netip.AddrPort) {
+		t.Helper()
+		for _, s := range strs {
+			n, err := netip.ParseAddrPort(s)
+			if err != nil {
+				t.Fatalf("parse AddrPort %q: %v", s, err)
+			}
+			ret = append(ret, n)
+		}
+		return ret
+	}
+
+	tests := []struct {
+		name string
+		cfg  *ConfigVAlpha
+		want MaskedPrefs
+	}{
+		{
+			name: "nil_config",
+			cfg:  nil,
+			want: MaskedPrefs{},
+		},
+		{
+			name: "relay_server_port_and_static_endpoints",
+			cfg: &ConfigVAlpha{
+				RelayServerPort:            new(uint16(12345)),
+				RelayServerStaticEndpoints: aps(t, "[2001:db8::1]:40000", "192.0.2.1:40000"),
+			},
+			want: MaskedPrefs{
+				Prefs: Prefs{
+					RelayServerPort:            new(uint16(12345)),
+					RelayServerStaticEndpoints: aps(t, "[2001:db8::1]:40000", "192.0.2.1:40000"),
+				},
+				RelayServerPortSet:            true,
+				RelayServerStaticEndpointsSet: true,
+			},
+		},
+		{
+			// Port 0 means "pick a random unused port"; it is
+			// distinct from a nil port which disables the relay
+			// server. The zero value must be propagated.
+			name: "relay_server_port_zero_is_random_not_disabled",
+			cfg: &ConfigVAlpha{
+				RelayServerPort: new(uint16(0)),
+			},
+			want: MaskedPrefs{
+				Prefs: Prefs{
+					RelayServerPort: new(uint16(0)),
+				},
+				RelayServerPortSet:            true,
+				RelayServerStaticEndpointsSet: true,
+			},
+		},
+		{
+			name: "only_static_endpoints_set",
+			cfg: &ConfigVAlpha{
+				RelayServerStaticEndpoints: aps(t, "192.0.2.1:40000"),
+			},
+			want: MaskedPrefs{
+				Prefs: Prefs{
+					RelayServerStaticEndpoints: aps(t, "192.0.2.1:40000"),
+				},
+				RelayServerPortSet:            true,
+				RelayServerStaticEndpointsSet: true,
+			},
+		},
+		{
+			// Both fields nil but masks set: the config file is the
+			// source of truth, so this disables any previously
+			// configured relay server.
+			name: "both_nil_disables_relay_server",
+			cfg:  &ConfigVAlpha{},
+			want: MaskedPrefs{
+				RelayServerPortSet:            true,
+				RelayServerStaticEndpointsSet: true,
+			},
+		},
+		{
+			// An empty (non-nil) static endpoints slice is treated as
+			// "advertise no static endpoints", disabling them.
+			name: "empty_static_endpoints_disables",
+			cfg: &ConfigVAlpha{
+				RelayServerStaticEndpoints: []netip.AddrPort{},
+			},
+			want: MaskedPrefs{
+				Prefs: Prefs{
+					RelayServerStaticEndpoints: []netip.AddrPort{},
+				},
+				RelayServerPortSet:            true,
+				RelayServerStaticEndpointsSet: true,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := tt.cfg.ToPrefs()
+			if err != nil {
+				t.Fatalf("ToPrefs() unexpected error: %v", err)
+			}
+			// Compare only the relay-server-related fields rather than
+			// the whole MaskedPrefs, since ToPrefs populates many
+			// unrelated default fields (e.g. WantRunning).
+			if got.RelayServerPortSet != tt.want.RelayServerPortSet {
+				t.Errorf("RelayServerPortSet = %v; want %v", got.RelayServerPortSet, tt.want.RelayServerPortSet)
+			}
+			if got.RelayServerStaticEndpointsSet != tt.want.RelayServerStaticEndpointsSet {
+				t.Errorf("RelayServerStaticEndpointsSet = %v; want %v", got.RelayServerStaticEndpointsSet, tt.want.RelayServerStaticEndpointsSet)
+			}
+			if !reflect.DeepEqual(got.RelayServerPort, tt.want.RelayServerPort) {
+				t.Errorf("RelayServerPort = %v; want %v", got.RelayServerPort, tt.want.RelayServerPort)
+			}
+			if !slices.Equal(got.RelayServerStaticEndpoints, tt.want.RelayServerStaticEndpoints) {
+				t.Errorf("RelayServerStaticEndpoints = %v; want %v", got.RelayServerStaticEndpoints, tt.want.RelayServerStaticEndpoints)
+			}
+		})
+	}
+}
+
+func TestConfigVAlphaToPrefsRemoteConfig(t *testing.T) {
+	for name, tt := range map[string]struct {
+		cfg     ConfigVAlpha
+		wantSet bool
+		wantVal bool
+	}{
+		"absent": {ConfigVAlpha{Version: "alpha0"}, false, false},
+		"true":   {ConfigVAlpha{Version: "alpha0", RemoteConfig: "true"}, true, true},
+		"false":  {ConfigVAlpha{Version: "alpha0", RemoteConfig: "false"}, true, false},
+	} {
+		t.Run(name, func(t *testing.T) {
+			mp, err := tt.cfg.ToPrefs()
+			if err != nil {
+				t.Fatal(err)
+			}
+			if mp.RemoteConfigSet != tt.wantSet {
+				t.Errorf("RemoteConfigSet = %v; want %v", mp.RemoteConfigSet, tt.wantSet)
+			}
+			if mp.RemoteConfig != tt.wantVal {
+				t.Errorf("RemoteConfig = %v; want %v", mp.RemoteConfig, tt.wantVal)
+			}
+		})
+	}
+}
diff --git a/ipn/conffile/conffile.go b/ipn/conffile/conffile.go
index c221a3d8c..8586c574e 100644
--- a/ipn/conffile/conffile.go
+++ b/ipn/conffile/conffile.go
@@ -8,6 +8,7 @@ package conffile
 import (
 	"bytes"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"os"
 	"runtime"
@@ -40,6 +41,15 @@ func (c *Config) WantRunning() bool {
 // from the VM's metadata service's user-data field.
 const VMUserDataPath = "vm:user-data"
 
+// ErrNoConfig is returned (wrapped) by Load when the config source is absent or
+// unreadable: a missing file, an EC2 instance with no user-data, an unreachable
+// metadata service, or a build without the relevant cloud support. It reports
+// "no config was provided", as distinct from "a config was provided but is
+// invalid" (which Load returns as an unwrapped parse/validate error). Callers
+// that want to boot unconfigured when no config is present (e.g. tailscaled's
+// "optional:" -config prefix) can check for it with errors.Is.
+var ErrNoConfig = errors.New("no config present")
+
 // hujsonStandardize is set to hujson.Standardize by conffile_hujson.go on
 // platforms that support config files.
 var hujsonStandardize func([]byte) ([]byte, error)
@@ -62,7 +72,10 @@ func Load(path string) (*Config, error) {
 		c.Raw, err = os.ReadFile(path)
 	}
 	if err != nil {
-		return nil, err
+		// Read-phase failure: the config source is absent or unreadable.
+		// Wrap ErrNoConfig so callers can distinguish this from a config
+		// that was read but failed to parse below.
+		return nil, fmt.Errorf("%w: %v", ErrNoConfig, err)
 	}
 	if buildfeatures.HasHuJSONConf && hujsonStandardize != nil {
 		c.Std, err = hujsonStandardize(c.Raw)
diff --git a/ipn/conffile/conffile_test.go b/ipn/conffile/conffile_test.go
new file mode 100644
index 000000000..4a233a0c5
--- /dev/null
+++ b/ipn/conffile/conffile_test.go
@@ -0,0 +1,60 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package conffile
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// TestLoadAbsentIsErrNoConfig verifies that an absent config source (here a
+// missing file, the same read-phase seam the "vm:user-data" 404 goes through)
+// is reported as ErrNoConfig, so callers using tailscaled's "optional:" prefix
+// can boot unconfigured instead of failing.
+func TestLoadAbsentIsErrNoConfig(t *testing.T) {
+	_, err := Load(filepath.Join(t.TempDir(), "does-not-exist.json"))
+	if !errors.Is(err, ErrNoConfig) {
+		t.Fatalf("Load(missing) error = %v; want it to wrap ErrNoConfig", err)
+	}
+}
+
+// TestLoadInvalidIsNotErrNoConfig verifies that a config that is present but
+// invalid is NOT ErrNoConfig, so it stays fatal even in optional mode.
+func TestLoadInvalidIsNotErrNoConfig(t *testing.T) {
+	for name, data := range map[string]string{
+		"malformed":       `{"Version": "alpha0"`, // truncated JSON
+		"unknown-version": `{"Version": "bogus9"}`,
+		"unknown-field":   `{"Version": "alpha0", "Bogus": true}`,
+	} {
+		t.Run(name, func(t *testing.T) {
+			p := filepath.Join(t.TempDir(), "bad.json")
+			if err := os.WriteFile(p, []byte(data), 0600); err != nil {
+				t.Fatal(err)
+			}
+			_, err := Load(p)
+			if err == nil {
+				t.Fatalf("Load(%q) succeeded; want an error", data)
+			}
+			if errors.Is(err, ErrNoConfig) {
+				t.Fatalf("Load(%q) error = %v; want a parse error, not ErrNoConfig", data, err)
+			}
+		})
+	}
+}
+
+func TestLoadValid(t *testing.T) {
+	p := filepath.Join(t.TempDir(), "ok.json")
+	if err := os.WriteFile(p, []byte(`{"Version": "alpha0"}`), 0600); err != nil {
+		t.Fatal(err)
+	}
+	c, err := Load(p)
+	if err != nil {
+		t.Fatalf("Load(valid) error = %v; want nil", err)
+	}
+	if c.Version != "alpha0" {
+		t.Fatalf("Version = %q; want alpha0", c.Version)
+	}
+}
diff --git a/ipn/conffile/serveconf.go b/ipn/conffile/serveconf.go
index 0d3360292..cff47d303 100644
--- a/ipn/conffile/serveconf.go
+++ b/ipn/conffile/serveconf.go
@@ -15,17 +15,34 @@ import (
 
 	jsonv2 "github.com/go-json-experiment/json"
 	"github.com/go-json-experiment/json/jsontext"
+	"tailscale.com/ipn"
 	"tailscale.com/tailcfg"
 	"tailscale.com/types/opt"
 	"tailscale.com/util/mak"
 )
 
+// LegacyVersion is the sentinel [ServicesConfigFile.Version] used to mark a
+// config that was loaded from the legacy raw [ipn.ServeConfig] format (a
+// version-less file, such as "tailscale serve status --json" output). When
+// Version is LegacyVersion, [ServicesConfigFile.Legacy] is set and Services is
+// nil. It is never written to disk; the on-disk format always uses "0.0.1".
+const LegacyVersion = "0.0.0"
+
 // ServicesConfigFile is the config file format for services configuration.
 type ServicesConfigFile struct {
-	// Version is always "0.0.1" and always present.
+	// Version is "0.0.1" for the declarative services configuration file
+	// format, or [LegacyVersion] ("0.0.0") when this value was produced by
+	// [LoadServicesConfig] from a legacy raw ipn.ServeConfig file (in which
+	// case Legacy is set instead of Services).
 	Version string `json:"version"`
 
 	Services map[tailcfg.ServiceName]*ServiceDetailsFile `json:"services,omitzero"`
+
+	// Legacy holds a raw ipn.ServeConfig parsed from a version-less file (e.g.
+	// "tailscale serve status --json" output). It is non-nil only when Version
+	// is [LegacyVersion]. It is an in-memory loading artifact and is never
+	// serialized.
+	Legacy *ipn.ServeConfig `json:"-"`
 }
 
 // ServiceDetailsFile is the config syntax for an individual Tailscale Service.
@@ -75,11 +92,16 @@ type Target struct {
 
 	// If Protocol is ProtoFile, then Destination is a file path.
 	// If Protocol is ProtoTUN, then Destination is empty.
+	// If Protocol is ProtoHTTP, ProtoHTTPS, ProtoHTTPSInsecure, ProtoTCP, or
+	// ProtoTLSTerminatedTCP and Destination starts with "unix:", it is a Unix
+	// socket path (e.g. "unix:/var/run/app.sock" or "unix:relative.sock").
 	// Otherwise, it is a host.
 	Destination string
 
 	// If Protocol is not ProtoFile or ProtoTUN, then DestinationPorts is the
 	// set of ports on which to connect to the host referred to by Destination.
+	// For unix socket targets (Destination starting with "unix:"),
+	// DestinationPorts is unused and left at the zero value.
 	DestinationPorts tailcfg.PortRange
 }
 
@@ -116,13 +138,22 @@ func (t *Target) UnmarshalJSONFrom(dec *jsontext.Decoder) error {
 		t.Destination = target
 		t.DestinationPorts = tailcfg.PortRange{}
 	case ProtoHTTP, ProtoHTTPS, ProtoHTTPSInsecure, ProtoTCP, ProtoTLSTerminatedTCP:
-		host, portRange, err := tailcfg.ParseHostPortRange(rest)
-		if err != nil {
-			return err
+		if unixPath, ok := strings.CutPrefix(rest, "unix:"); ok {
+			if unixPath == "" {
+				return errors.New("unix socket path cannot be empty")
+			}
+			t.Protocol = ServiceProtocol(proto)
+			t.Destination = rest
+			t.DestinationPorts = tailcfg.PortRange{}
+		} else {
+			host, portRange, err := tailcfg.ParseHostPortRange(rest)
+			if err != nil {
+				return err
+			}
+			t.Protocol = ServiceProtocol(proto)
+			t.Destination = host
+			t.DestinationPorts = portRange
 		}
-		t.Protocol = ServiceProtocol(proto)
-		t.Destination = host
-		t.DestinationPorts = portRange
 	default:
 		return errors.New("unsupported protocol")
 	}
@@ -138,13 +169,27 @@ func (t *Target) MarshalText() ([]byte, error) {
 	case ProtoTUN:
 		out = "TUN"
 	case ProtoHTTP, ProtoHTTPS, ProtoHTTPSInsecure, ProtoTCP, ProtoTLSTerminatedTCP:
-		out = fmt.Sprintf("%s://%s", t.Protocol, net.JoinHostPort(t.Destination, t.DestinationPorts.String()))
+		if strings.HasPrefix(t.Destination, "unix:") {
+			// Unix socket: serialize as e.g. "tcp://unix:/path/to/sock"
+			out = fmt.Sprintf("%s://%s", t.Protocol, t.Destination)
+		} else {
+			out = fmt.Sprintf("%s://%s", t.Protocol, net.JoinHostPort(t.Destination, t.DestinationPorts.String()))
+		}
 	default:
 		return nil, errors.New("unsupported protocol")
 	}
 	return []byte(out), nil
 }
 
+// LoadServicesConfig loads a serve config file as a [ServicesConfigFile].
+//
+// If the file has a top-level "version" field it is parsed as that versioned
+// declarative format. Otherwise it is treated as a legacy raw [ipn.ServeConfig]
+// (such as "tailscale serve status --json" emits): the returned
+// ServicesConfigFile has Version [LegacyVersion] and its Legacy field set to the
+// parsed raw config, with Services left nil.
+//
+// forService is used only for the versioned Services configuration file format.
 func LoadServicesConfig(filename string, forService string) (*ServicesConfigFile, error) {
 	data, err := os.ReadFile(filename)
 	if err != nil {
@@ -165,13 +210,38 @@ func LoadServicesConfig(filename string, forService string) (*ServicesConfigFile
 	if err = jsonv2.Unmarshal(json, &ver); err != nil {
 		return nil, fmt.Errorf("could not parse config file version: %w", err)
 	}
-	switch ver.Version {
-	case "":
-		return nil, errors.New("config file must have \"version\" field")
-	case "0.0.1":
-		return loadConfigV0(json, forService)
+	if ver.Version == "" {
+		// No "version" field. This is either the legacy raw ipn.ServeConfig
+		// (e.g. "tailscale serve status --json" output, which set-config still
+		// accepts) or a Services configuration file whose required "version"
+		// field was omitted. Distinguish them by the Services config format's
+		// lowercase "services"/"endpoints" keys, which never appear in a raw
+		// ServeConfig: it uses capitalized "Services" and has no "endpoints"
+		// key, and jsonv2 matches case-sensitively. Without this check a
+		// version-less Services config file would parse as an empty
+		// ServeConfig and silently wipe the existing config.
+		var probe struct {
+			Services  jsontext.Value `json:"services"`
+			Endpoints jsontext.Value `json:"endpoints"`
+		}
+		if err := jsonv2.Unmarshal(json, &probe); err == nil &&
+			(len(probe.Services) > 0 || len(probe.Endpoints) > 0) {
+			return nil, errors.New(`config file looks like a Services configuration file but is missing the required "version" field`)
+		}
+		// Legacy raw ipn.ServeConfig: parse leniently (like set-raw and
+		// TS_SERVE_CONFIG) so "serve status --json" round-trips keep working.
+		// It is returned wrapped in a ServicesConfigFile with the LegacyVersion
+		// sentinel so the public function signature stays stable.
+		legacy := new(ipn.ServeConfig)
+		if err := jsonv2.Unmarshal(json, legacy); err != nil {
+			return nil, fmt.Errorf("could not parse serve config: %w", err)
+		}
+		return &ServicesConfigFile{Version: LegacyVersion, Legacy: legacy}, nil
 	}
-	return nil, fmt.Errorf("unsupported config file version %q", ver.Version)
+	if ver.Version != "0.0.1" {
+		return nil, fmt.Errorf("unsupported config file version %q", ver.Version)
+	}
+	return loadConfigV0(json, forService)
 }
 
 func loadConfigV0(json []byte, forService string) (*ServicesConfigFile, error) {
@@ -210,8 +280,19 @@ func loadConfigV0(json []byte, forService string) (*ServicesConfigFile, error) {
 				}
 				foundTUN = true
 			} else {
-				if ppr.Ports.Last-ppr.Ports.First != target.DestinationPorts.Last-target.DestinationPorts.First {
-					return nil, fmt.Errorf("service %q: source and destination port ranges must be of equal size", svcName.String())
+				// Unix socket targets (Destination starting with "unix:" on an
+				// HTTP/HTTPS/HTTPSInsecure/TCP/TLSTerminatedTCP inbound protocol)
+				// don't have a destination port range; skip the equality check.
+				isUnixSocket := strings.HasPrefix(target.Destination, "unix:") &&
+					(target.Protocol == ProtoHTTP ||
+						target.Protocol == ProtoHTTPS ||
+						target.Protocol == ProtoHTTPSInsecure ||
+						target.Protocol == ProtoTCP ||
+						target.Protocol == ProtoTLSTerminatedTCP)
+				if !isUnixSocket {
+					if ppr.Ports.Last-ppr.Ports.First != target.DestinationPorts.Last-target.DestinationPorts.First {
+						return nil, fmt.Errorf("service %q: source and destination port ranges must be of equal size", svcName.String())
+					}
 				}
 				foundNonTUN = true
 			}
diff --git a/ipn/conffile/serveconf_test.go b/ipn/conffile/serveconf_test.go
new file mode 100644
index 000000000..6b1cc2b77
--- /dev/null
+++ b/ipn/conffile/serveconf_test.go
@@ -0,0 +1,108 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !ts_omit_serve
+
+package conffile
+
+import (
+	"testing"
+
+	"tailscale.com/tailcfg"
+)
+
+func TestTargetUnixSocketRoundtrip(t *testing.T) {
+	tests := []struct {
+		name       string
+		serialized string
+		want       Target
+	}{
+		{
+			name:       "tcp_unix_socket",
+			serialized: "tcp://unix:/var/run/app.sock",
+			want: Target{
+				Protocol:    ProtoTCP,
+				Destination: "unix:/var/run/app.sock",
+			},
+		},
+		{
+			name:       "tls_terminated_tcp_unix_socket",
+			serialized: "tls-terminated-tcp://unix:/var/run/app.sock",
+			want: Target{
+				Protocol:    ProtoTLSTerminatedTCP,
+				Destination: "unix:/var/run/app.sock",
+			},
+		},
+		{
+			name:       "tcp_unix_socket_relative",
+			serialized: "tcp://unix:relative.sock",
+			want: Target{
+				Protocol:    ProtoTCP,
+				Destination: "unix:relative.sock",
+			},
+		},
+		{
+			name:       "http_unix_socket",
+			serialized: "http://unix:/var/run/app.sock",
+			want: Target{
+				Protocol:    ProtoHTTP,
+				Destination: "unix:/var/run/app.sock",
+			},
+		},
+		{
+			name:       "https_unix_socket",
+			serialized: "https://unix:/var/run/app.sock",
+			want: Target{
+				Protocol:    ProtoHTTPS,
+				Destination: "unix:/var/run/app.sock",
+			},
+		},
+		{
+			name:       "https_insecure_unix_socket",
+			serialized: "https+insecure://unix:/var/run/app.sock",
+			want: Target{
+				Protocol:    ProtoHTTPSInsecure,
+				Destination: "unix:/var/run/app.sock",
+			},
+		},
+		{
+			name:       "http_unix_socket_relative",
+			serialized: "http://unix:relative.sock",
+			want: Target{
+				Protocol:    ProtoHTTP,
+				Destination: "unix:relative.sock",
+			},
+		},
+		{
+			name:       "tcp_host_port",
+			serialized: "tcp://localhost:5432",
+			want: Target{
+				Protocol:         ProtoTCP,
+				Destination:      "localhost",
+				DestinationPorts: tailcfg.PortRange{First: 5432, Last: 5432},
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Test unmarshal
+			var got Target
+			if err := got.UnmarshalJSON([]byte(`"` + tt.serialized + `"`)); err != nil {
+				t.Fatalf("UnmarshalJSON(%q) failed: %v", tt.serialized, err)
+			}
+			if got != tt.want {
+				t.Errorf("UnmarshalJSON(%q) = %+v, want %+v", tt.serialized, got, tt.want)
+			}
+
+			// Test marshal roundtrip
+			marshaled, err := tt.want.MarshalText()
+			if err != nil {
+				t.Fatalf("MarshalText() failed: %v", err)
+			}
+			if string(marshaled) != tt.serialized {
+				t.Errorf("MarshalText() = %q, want %q", marshaled, tt.serialized)
+			}
+		})
+	}
+}
diff --git a/ipn/desktop/extension.go b/ipn/desktop/extension.go
index 3e96a9c4c..23e265401 100644
--- a/ipn/desktop/extension.go
+++ b/ipn/desktop/extension.go
@@ -23,7 +23,7 @@ import (
 )
 
 // featureName is the name of the feature implemented by this package.
-// It is also the the [desktopSessionsExt] name and the log prefix.
+// It is also the [desktopSessionsExt] name and the log prefix.
 const featureName = "desktop-sessions"
 
 func init() {
diff --git a/ipn/ipn_clone.go b/ipn/ipn_clone.go
index e179438cd..4b1f84e1e 100644
--- a/ipn/ipn_clone.go
+++ b/ipn/ipn_clone.go
@@ -8,6 +8,7 @@ package ipn
 import (
 	"maps"
 	"net/netip"
+	"time"
 
 	"tailscale.com/drive"
 	"tailscale.com/tailcfg"
@@ -38,6 +39,7 @@ var _LoginProfileCloneNeedsRegeneration = LoginProfile(struct {
 	NodeID         tailcfg.StableNodeID
 	LocalUserID    WindowsUserID
 	ControlURL     string
+	Created        time.Time
 }{})
 
 // Clone makes a deep copy of Prefs.
@@ -101,10 +103,10 @@ var _PrefsCloneNeedsRegeneration = Prefs(struct {
 	AppConnector               AppConnectorPrefs
 	PostureChecking            bool
 	NetfilterKind              string
+	RemoteConfig               bool
 	DriveShares                []*drive.Share
 	RelayServerPort            *uint16
 	RelayServerStaticEndpoints []netip.AddrPort
-	AllowSingleHosts           marshalAsTrueInJSON
 	Persist                    *persist.Persist
 }{})
 
diff --git a/ipn/ipn_view.go b/ipn/ipn_view.go
index 4e9d46bda..67ff02f6b 100644
--- a/ipn/ipn_view.go
+++ b/ipn/ipn_view.go
@@ -9,6 +9,7 @@ import (
 	jsonv1 "encoding/json"
 	"errors"
 	"net/netip"
+	"time"
 
 	jsonv2 "github.com/go-json-experiment/json"
 	"github.com/go-json-experiment/json/jsontext"
@@ -131,6 +132,12 @@ func (v LoginProfileView) LocalUserID() WindowsUserID { return v.ж.LocalUserID
 // into.
 func (v LoginProfileView) ControlURL() string { return v.ж.ControlURL }
 
+// Created is when this profile was first added to this client. It is
+// stamped once at profile creation and never changes. It is used to sort
+// the profile list with newest first; profiles created before this field
+// existed have a zero value and sort after all stamped profiles.
+func (v LoginProfileView) Created() time.Time { return v.ж.Created }
+
 // A compilation failure here means this code must be regenerated, with the command at the top of this file.
 var _LoginProfileViewNeedsRegeneration = LoginProfile(struct {
 	ID             ProfileID
@@ -141,6 +148,7 @@ var _LoginProfileViewNeedsRegeneration = LoginProfile(struct {
 	NodeID         tailcfg.StableNodeID
 	LocalUserID    WindowsUserID
 	ControlURL     string
+	Created        time.Time
 }{})
 
 // View returns a read-only view of Prefs.
@@ -283,7 +291,8 @@ func (v PrefsView) InternalExitNodePrior() tailcfg.StableNodeID { return v.ж.In
 func (v PrefsView) ExitNodeAllowLANAccess() bool { return v.ж.ExitNodeAllowLANAccess }
 
 // CorpDNS specifies whether to install the Tailscale network's
-// DNS configuration, if it exists.
+// DNS configuration, if it exists. It is the internal name for
+// the "tailscale set --accept-dns=" flag.
 func (v PrefsView) CorpDNS() bool { return v.ж.CorpDNS }
 
 // RunSSH bool is whether this node should run an SSH
@@ -432,6 +441,24 @@ func (v PrefsView) PostureChecking() bool { return v.ж.PostureChecking }
 // Linux-only.
 func (v PrefsView) NetfilterKind() string { return v.ж.NetfilterKind }
 
+// RemoteConfig, if true, delegates full remote control of this node's
+// prefs and LocalAPI to the tailnet admin via the control plane. When
+// enabled, the control server can read and edit any of this node's
+// prefs at any time, and invoke any LocalAPI endpoint on this node,
+// without any further local consent (no CLI or GUI confirmation).
+//
+// This is an alternative to Tailscale's default per-feature double
+// opt-in model, in which both the tailnet admin and the local machine
+// owner must agree to each individual setting change. RemoteConfig is
+// a single client-side "I trust the tailnet admin" switch that hands
+// over full remote management of this node.
+//
+// Only enable this when the tailnet admin owns the machine (e.g. a
+// corporate fleet device) or the local user has explicitly delegated
+// full control to the tailnet admin. Do NOT enable this on personal
+// or BYOD devices where the tailnet admin is not fully trusted.
+func (v PrefsView) RemoteConfig() bool { return v.ж.RemoteConfig }
+
 // DriveShares are the configured DriveShares, stored in increasing order
 // by name.
 func (v PrefsView) DriveShares() views.SliceView[*drive.Share, drive.ShareView] {
@@ -453,16 +480,6 @@ func (v PrefsView) RelayServerStaticEndpoints() views.Slice[netip.AddrPort] {
 	return views.SliceOf(v.ж.RelayServerStaticEndpoints)
 }
 
-// AllowSingleHosts was a legacy field that was always true
-// for the past 4.5 years. It controlled whether Tailscale
-// peers got /32 or /128 routes for each other.
-// As of 2024-05-17 we're starting to ignore it, but to let
-// people still downgrade Tailscale versions and not break
-// all peer-to-peer networking we still write it to disk (as JSON)
-// so it can be loaded back by old versions.
-// TODO(bradfitz): delete this in 2025 sometime. See #12058.
-func (v PrefsView) AllowSingleHosts() marshalAsTrueInJSON { return v.ж.AllowSingleHosts }
-
 // The Persist field is named 'Config' in the file for backward
 // compatibility with earlier versions.
 // TODO(apenwarr): We should move this out of here, it's not a pref.
@@ -503,10 +520,10 @@ var _PrefsViewNeedsRegeneration = Prefs(struct {
 	AppConnector               AppConnectorPrefs
 	PostureChecking            bool
 	NetfilterKind              string
+	RemoteConfig               bool
 	DriveShares                []*drive.Share
 	RelayServerPort            *uint16
 	RelayServerStaticEndpoints []netip.AddrPort
-	AllowSingleHosts           marshalAsTrueInJSON
 	Persist                    *persist.Persist
 }{})
 
@@ -807,7 +824,10 @@ func (v TCPPortHandlerView) HTTPS() bool { return v.ж.HTTPS }
 // It is mutually exclusive with TCPForward.
 func (v TCPPortHandlerView) HTTP() bool { return v.ж.HTTP }
 
-// TCPForward is the IP:port to forward TCP connections to.
+// TCPForward is the address to forward TCP connections to.
+// It is either a host:port (e.g. "127.0.0.1:3128", "localhost:5432")
+// or a Unix socket path prefixed with "unix:"
+// (e.g. "unix:/var/run/app.sock" or "unix:relative.sock").
 // Whether or not TLS is terminated by tailscaled depends on
 // TerminateTLS.
 //
diff --git a/ipn/ipnext/ipnext.go b/ipn/ipnext/ipnext.go
index 5ca50498a..261428721 100644
--- a/ipn/ipnext/ipnext.go
+++ b/ipn/ipnext/ipnext.go
@@ -6,6 +6,7 @@
 package ipnext
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"iter"
@@ -22,6 +23,7 @@ import (
 	"tailscale.com/types/key"
 	"tailscale.com/types/logger"
 	"tailscale.com/types/mapx"
+	"tailscale.com/types/netmap"
 	"tailscale.com/types/views"
 	"tailscale.com/wgengine/filter"
 )
@@ -225,6 +227,33 @@ type SafeBackend interface {
 	TailscaleVarRoot() string
 }
 
+// NotifyWatcher is a subset of [tailscale.com/ipn/ipnlocal.LocalBackend]
+// for extensions that subscribe to the IPN notification bus from within tailscaled.
+//
+// Unlike [SafeBackend], its methods acquire LocalBackend’s internal mutex
+// and must not be called from extension hooks,
+// instead call them from a goroutine started by [Extension.Init].
+type NotifyWatcher interface {
+	// WatchNotifications subscribes to the ipn.Notify message bus notification
+	// messages.
+	//
+	// WatchNotifications blocks until ctx is done.
+	//
+	// The provided onWatchAdded, if non-nil, will be called once the watcher
+	// is installed.
+	//
+	// The provided fn will be called for each notification. It will only be
+	// called with non-nil pointers. The caller must not modify roNotify. If
+	// fn returns false, the watch also stops.
+	//
+	// Failure to consume many notifications in a row will result in one final
+	// notification with ErrMessage set, followed by the watch closing, unless mask
+	// includes ipn.NotifyInProcessNoDisconnect. Watchers using
+	// NotifyInProcessNoDisconnect must not call back into LocalBackend from fn or
+	// wait on work that might call back into LocalBackend.
+	WatchNotifications(ctx context.Context, mask ipn.NotifyWatchOpt, onWatchAdded func(), fn func(roNotify *ipn.Notify) (keepGoing bool))
+}
+
 // ExtensionServices provides access to the [Host]'s extension management services,
 // such as fetching active extensions.
 type ExtensionServices interface {
@@ -375,6 +404,12 @@ type Hooks struct {
 	// is created. It is called with the LocalBackend locked.
 	NewControlClient feature.Hooks[NewControlClientCallback]
 
+	// OnNetMapToggle is called (with LocalBackend.mu held) when the network map
+	// is toggled from nil to non-nil, or non-nil to nil. This usually happens
+	// when the client connects to the control plane and receives the initial MapResponse,
+	// or when the client disconnects and the network map is cleared.
+	OnNetMapToggle feature.Hooks[func(*netmap.NetworkMap)]
+
 	// OnSelfChange is called (with LocalBackend.mu held) when the self node
 	// changes, including changing to nothing (an invalid view).
 	OnSelfChange feature.Hooks[func(tailcfg.NodeView)]
@@ -395,29 +430,41 @@ type Hooks struct {
 	// See [filter.Filter] for details on how these hooks are invoked.
 	Filter FilterHooks
 
-	// ExtraWireGuardAllowedIPs is called with each peer's public key
-	// from the initial [wgcfg.Config], and returns a view of prefixes to
-	// append to each peer's AllowedIPs.
+	// ExtraWireGuardAllowedIPs is called with a sequence of peers whose
+	// extra AllowedIPs the caller wants (re)computed, and returns
+	// prefixes to append to those peers' AllowedIPs, keyed by node ID.
 	//
-	// The extra AllowedIPs are added after the [router.Config] is generated, but
-	// before the WireGuard config is sent to the engine, so the extra IPs are
-	// given to WireGuard, but not the OS routing table.
+	// The sequence is not necessarily all peers: callers may pass any
+	// subset (such as only the peers changed by a netmap delta), and
+	// the returned map's meaning is scoped to the peers presented. A
+	// peer absent from the returned map has no extra AllowedIPs. As of
+	// 2026-07-15 the only caller passes all current peers on each
+	// reconfig, but extensions must not rely on that.
 	//
-	// The prefixes returned from the hook should not contain duplicates, either
-	// internally, or with netmap peer prefixes. Returned prefixes should only
+	// An extension with nothing to add should return nil without
+	// iterating peers; that keeps steady-state netmap deltas free of
+	// per-peer work when the extension is idle. The peers sequence is
+	// only valid during the call.
+	//
+	// The extra AllowedIPs are given to WireGuard, but not the OS
+	// routing table.
+	//
+	// The returned prefixes should not contain duplicates, either
+	// internally, or with netmap peer prefixes. They should only
 	// contain host routes, and not contain default or subnet routes.
-	// Subsequent calls that return an unchanged set of prefixes for a given peer,
-	// should return the prefixes in the same order for that peer,
-	// to prevent configuration churn.
+	// Subsequent calls that return an unchanged set of prefixes for a
+	// given peer should return the prefixes in the same order for that
+	// peer, to prevent configuration churn.
 	//
-	// The returned slice should not be mutated by the extension after it is returned.
+	// The returned map and slices should not be mutated by the
+	// extension after they are returned.
 	//
 	// The hook is called with LocalBackend's mutex locked.
 	//
 	// TODO(#17858): This hook may not be needed and can possibly be replaced by
 	// new hooks that fit into the new architecture that make use of new
 	// WireGuard APIs.
-	ExtraWireGuardAllowedIPs feature.Hook[func(key.NodePublic) views.Slice[netip.Prefix]]
+	ExtraWireGuardAllowedIPs feature.Hook[func(peers iter.Seq2[tailcfg.NodeID, key.NodePublic]) map[tailcfg.NodeID][]netip.Prefix]
 
 	// ExtraRouterConfigRoutes returns a view of prefixes to append to [router.Config.Routes].
 	//
@@ -465,10 +512,16 @@ type FilterHooks struct {
 //
 // It is not a snapshot in time but is locked to a particular node.
 type NodeBackend interface {
+	// Self returns the current node.
+	Self() tailcfg.NodeView
+
 	// AppendMatchingPeers appends all peers that match the predicate
 	// to the base slice and returns it.
 	AppendMatchingPeers(base []tailcfg.NodeView, pred func(tailcfg.NodeView) bool) []tailcfg.NodeView
 
+	// Peers returns all the current peers.
+	Peers() []tailcfg.NodeView
+
 	// PeerCaps returns the capabilities that src has to this node.
 	PeerCaps(src netip.Addr) tailcfg.PeerCapMap
 
@@ -490,4 +543,8 @@ type NodeBackend interface {
 	// node that the portlist service collection is desirable, should it
 	// choose to report them.
 	CollectServices() bool
+
+	// DERPMap returns the current DERP map from the current netmap,
+	// or nil if there is no netmap.
+	DERPMap() *tailcfg.DERPMap
 }
diff --git a/ipn/ipnlocal/breaktcp_darwin.go b/ipn/ipnlocal/breaktcp_darwin.go
index 732c375f7..a97f43eb1 100644
--- a/ipn/ipnlocal/breaktcp_darwin.go
+++ b/ipn/ipnlocal/breaktcp_darwin.go
@@ -15,7 +15,7 @@ func init() {
 
 func breakTCPConnsDarwin() error {
 	var matched int
-	for fd := 0; fd < 1000; fd++ {
+	for fd := range 1000 {
 		_, err := unix.GetsockoptTCPConnectionInfo(fd, unix.IPPROTO_TCP, unix.TCP_CONNECTION_INFO)
 		if err == nil {
 			matched++
diff --git a/ipn/ipnlocal/bus.go b/ipn/ipnlocal/bus.go
index de04fd09a..45b0388c6 100644
--- a/ipn/ipnlocal/bus.go
+++ b/ipn/ipnlocal/bus.go
@@ -5,13 +5,27 @@ package ipnlocal
 
 import (
 	"context"
+	"runtime"
 	"time"
 
 	"tailscale.com/ipn"
 	"tailscale.com/tailcfg"
 	"tailscale.com/tstime"
+	"tailscale.com/util/mak"
 )
 
+// goosGetsLegacyNetmapNotify reports whether tailscaled, when running on the
+// current GOOS, still emits the legacy [ipn.Notify.NetMap] field on runtime
+// (non-initial) bus messages. It is true on platforms whose host GUIs have
+// not yet finished migrating to the narrower bus signals
+// ([ipn.Notify.SelfChange] / [ipn.Notify.PeerChanges]) and the on-demand
+// [LocalClient.NetMap] fetch.
+//
+// runtime.GOOS is a compile-time constant, so the producer-side code that
+// builds and ships NetMap on the bus is dead-code-eliminated on Linux and
+// other geese where this is false.
+const goosGetsLegacyNetmapNotify = runtime.GOOS == "windows"
+
 type rateLimitingBusSender struct {
 	fn              func(*ipn.Notify) (keepGoing bool)
 	lastFlush       time.Time           // last call to fn, or zero value if none
@@ -126,11 +140,21 @@ func mergeBoringNotifies(dst, src *ipn.Notify) *ipn.Notify {
 	if dst == nil {
 		dst = &ipn.Notify{Version: src.Version}
 	}
-	if src.NetMap != nil {
+	if goosGetsLegacyNetmapNotify && src.NetMap != nil {
+		// Full netmap supersedes any accumulated peer-change deltas.
 		dst.NetMap = src.NetMap
-		dst.PeerChanges = nil // full netmap supersedes any accumulated deltas
-	} else if src.PeerChanges != nil {
-		dst.PeerChanges = mergePeerChanges(dst.PeerChanges, src.PeerChanges)
+		dst.PeerChangedPatch = nil
+	} else if src.PeerChangedPatch != nil {
+		dst.PeerChangedPatch = mergePeerChangedPatch(dst.PeerChangedPatch, src.PeerChangedPatch)
+	}
+	if len(src.PeersChanged) > 0 {
+		dst.PeersChanged = append(dst.PeersChanged, src.PeersChanged...)
+	}
+	if len(src.PeersRemoved) > 0 {
+		dst.PeersRemoved = append(dst.PeersRemoved, src.PeersRemoved...)
+	}
+	for id, up := range src.UserProfiles {
+		mak.Set(&dst.UserProfiles, id, up)
 	}
 	if src.Engine != nil {
 		dst.Engine = src.Engine
@@ -138,10 +162,10 @@ func mergeBoringNotifies(dst, src *ipn.Notify) *ipn.Notify {
 	return dst
 }
 
-// mergePeerChanges merges new peer changes from src into dst, either
-// mutating dst or allocating a new slice if dst is nil, returning the merged result.
-// Values in src override those in dst for the same NodeID.
-func mergePeerChanges(dst, src []*tailcfg.PeerChange) []*tailcfg.PeerChange {
+// mergePeerChangedPatch merges new peer-changed patches from src into dst,
+// either mutating dst or allocating a new slice if dst is nil, returning the
+// merged result. Values in src override those in dst for the same NodeID.
+func mergePeerChangedPatch(dst, src []*tailcfg.PeerChange) []*tailcfg.PeerChange {
 	idxByNode := make(map[tailcfg.NodeID]int, len(dst))
 	for i, d := range dst {
 		idxByNode[d.NodeID] = i
@@ -191,8 +215,11 @@ func mergePeerChangeForIpnBus(old, new *tailcfg.PeerChange) *tailcfg.PeerChange
 // should be sent on the IPN bus immediately (e.g. to GUIs) without
 // rate limiting it for a few seconds.
 //
-// It effectively reports whether n contains any field set that's
-// not NetMap or Engine.
+// This is only used for legacy [ipn.NotifyRateLimit] subscribers. New-style
+// subscriptions that receive delta streams are rejected by
+// [ipn.ValidateNotifyWatchOpt] when combined with NotifyRateLimit.
+//
+// Legacy NetMap and Engine are the only "boring" (rate-limitable) fields.
 func isNotableNotify(n *ipn.Notify) bool {
 	if n == nil {
 		return false
@@ -205,10 +232,18 @@ func isNotableNotify(n *ipn.Notify) bool {
 		n.Prefs != nil ||
 		n.ErrMessage != nil ||
 		n.LoginFinished != nil ||
+		n.SelfChange != nil ||
+		n.InitialStatus != nil ||
+		len(n.PeerChangedPatch) > 0 ||
+		len(n.PeersChanged) > 0 ||
+		len(n.PeersRemoved) > 0 ||
+		len(n.UserProfiles) > 0 ||
+		len(n.PeerState) > 0 ||
 		!n.DriveShares.IsNil() ||
 		n.Health != nil ||
 		len(n.IncomingFiles) > 0 ||
 		len(n.OutgoingFiles) > 0 ||
 		n.FilesWaiting != nil ||
-		n.SuggestedExitNode != nil
+		n.SuggestedExitNode != nil ||
+		n.Policy != nil
 }
diff --git a/ipn/ipnlocal/bus_test.go b/ipn/ipnlocal/bus_test.go
index 8e4d3ede8..47004a58a 100644
--- a/ipn/ipnlocal/bus_test.go
+++ b/ipn/ipnlocal/bus_test.go
@@ -30,8 +30,13 @@ func TestIsNotableNotify(t *testing.T) {
 		{"empty", &ipn.Notify{}, false},
 		{"version", &ipn.Notify{Version: "foo"}, false},
 		{"netmap", &ipn.Notify{NetMap: new(netmap.NetworkMap)}, false},
-		{"peerchanges", &ipn.Notify{PeerChanges: []*tailcfg.PeerChange{{}}}, false},
+		{"peerchanges", &ipn.Notify{PeerChangedPatch: []*tailcfg.PeerChange{{}}}, true},
+		{"peerschanged", &ipn.Notify{PeersChanged: []*tailcfg.Node{{}}}, true},
+		{"peersremoved", &ipn.Notify{PeersRemoved: []tailcfg.NodeID{1}}, true},
+		{"userprofiles", &ipn.Notify{UserProfiles: map[tailcfg.UserID]tailcfg.UserProfileView{1: (&tailcfg.UserProfile{}).View()}}, true},
 		{"engine", &ipn.Notify{Engine: new(ipn.EngineStatus)}, false},
+		{"peerstate", &ipn.Notify{PeerState: map[tailcfg.StableNodeID]ipn.PeerState{"a": {PeerWireGuardState: ipn.PeerWireGuardStateHandshake}}}, true},
+		{"selfchange", &ipn.Notify{SelfChange: &tailcfg.Node{}}, true},
 	}
 
 	// Then for all other fields, assume they're notable.
@@ -41,7 +46,7 @@ func TestIsNotableNotify(t *testing.T) {
 	for sf := range rt.Fields() {
 		n := &ipn.Notify{}
 		switch sf.Name {
-		case "_", "NetMap", "PeerChanges", "Engine", "Version":
+		case "_", "NetMap", "PeerChangedPatch", "SelfChange", "PeersChanged", "PeersRemoved", "UserProfiles", "Engine", "PeerState", "Version":
 			// Already covered above or not applicable.
 			continue
 		case "DriveShares":
@@ -122,18 +127,18 @@ func (st *rateLimitingBusSenderTester) advance(d time.Duration) {
 }
 
 func TestRateLimitingBusSender(t *testing.T) {
-	nm1 := &ipn.Notify{NetMap: new(netmap.NetworkMap)}
-	nm2 := &ipn.Notify{NetMap: new(netmap.NetworkMap)}
+	ver1 := &ipn.Notify{Version: "1"}
+	ver2 := &ipn.Notify{Version: "2"}
 	eng1 := &ipn.Notify{Engine: new(ipn.EngineStatus)}
 	eng2 := &ipn.Notify{Engine: new(ipn.EngineStatus)}
 
 	t.Run("unbuffered", func(t *testing.T) {
 		st := &rateLimitingBusSenderTester{tb: t}
-		st.send(nm1)
-		st.send(nm2)
+		st.send(ver1)
+		st.send(ver2)
 		st.send(eng1)
 		st.send(eng2)
-		if !slices.Equal(st.got, []*ipn.Notify{nm1, nm2, eng1, eng2}) {
+		if !slices.Equal(st.got, []*ipn.Notify{ver1, ver2, eng1, eng2}) {
 			t.Errorf("got %d items; want 4 specific ones, unmodified", len(st.got))
 		}
 	})
@@ -146,8 +151,8 @@ func TestRateLimitingBusSender(t *testing.T) {
 		if len(st.got) != 1 {
 			t.Fatalf("got %d items; expected 1 (first to flush immediately)", len(st.got))
 		}
-		st.send(nm1)
-		st.send(nm2)
+		st.send(ver1)
+		st.send(ver2)
 		st.send(eng1)
 		st.send(eng2)
 		if len(st.got) != 1 {
@@ -162,8 +167,8 @@ func TestRateLimitingBusSender(t *testing.T) {
 			t.Fatalf("got %d items; want 2", len(st.got))
 		}
 		gotn := st.got[1]
-		if gotn.NetMap != nm2.NetMap {
-			t.Errorf("got wrong NetMap; got %p", gotn.NetMap)
+		if gotn.Version != ver1.Version {
+			t.Errorf("got wrong Version; got %q want %q", gotn.Version, ver1.Version)
 		}
 		if gotn.Engine != eng2.Engine {
 			t.Errorf("got wrong Engine; got %p", gotn.Engine)
@@ -200,15 +205,18 @@ func TestRateLimitingBusSender(t *testing.T) {
 
 		incoming := make(chan *ipn.Notify, 2)
 		go func() {
-			incoming <- nm1
+			incoming <- ver1
 			waitSend()
-			incoming <- nm2
+			incoming <- eng2
 			waitSend()
 			st.advance(5 * time.Second)
 			select {
 			case n := <-flushc:
-				if n.NetMap != nm2.NetMap {
-					t.Errorf("got wrong NetMap; got %p", n.NetMap)
+				if n.Version != ver1.Version {
+					t.Errorf("got wrong Version; got %q want %q", n.Version, ver1.Version)
+				}
+				if n.Engine != eng2.Engine {
+					t.Errorf("got wrong Engine; got %p", n.Engine)
 				}
 			case <-time.After(10 * time.Second):
 				t.Error("timeout")
@@ -220,7 +228,7 @@ func TestRateLimitingBusSender(t *testing.T) {
 	})
 }
 
-func TestMergePeerChanges(t *testing.T) {
+func TestMergePeerChangedPatch(t *testing.T) {
 	online := true
 	offline := false
 
@@ -231,7 +239,7 @@ func TestMergePeerChanges(t *testing.T) {
 		new := []*tailcfg.PeerChange{
 			{NodeID: 2, DERPRegion: 2},
 		}
-		got := mergePeerChanges(old, new)
+		got := mergePeerChangedPatch(old, new)
 		if len(got) != 2 {
 			t.Fatalf("len = %d; want 2", len(got))
 		}
@@ -248,7 +256,7 @@ func TestMergePeerChanges(t *testing.T) {
 		new := []*tailcfg.PeerChange{
 			{NodeID: 1, DERPRegion: 5, Online: &offline},
 		}
-		got := mergePeerChanges(old, new)
+		got := mergePeerChangedPatch(old, new)
 		if len(got) != 2 {
 			t.Fatalf("len = %d; want 2 (merged, not appended)", len(got))
 		}
@@ -272,7 +280,7 @@ func TestMergePeerChanges(t *testing.T) {
 			{NodeID: 1, DERPRegion: 2},
 			{NodeID: 3, DERPRegion: 30},
 		}
-		got := mergePeerChanges(old, new)
+		got := mergePeerChangedPatch(old, new)
 		if len(got) != 2 {
 			t.Fatalf("len = %d; want 2", len(got))
 		}
@@ -291,7 +299,7 @@ func TestMergePeerChanges(t *testing.T) {
 		new := []*tailcfg.PeerChange{
 			{NodeID: 1, Online: &offline},
 		}
-		got := mergePeerChanges(old, new)
+		got := mergePeerChangedPatch(old, new)
 		if len(got) != 1 {
 			t.Fatalf("len = %d; want 1", len(got))
 		}
@@ -310,7 +318,7 @@ func TestMergePeerChanges(t *testing.T) {
 		new := []*tailcfg.PeerChange{
 			{NodeID: 1, DERPRegion: 1},
 		}
-		got := mergePeerChanges(nil, new)
+		got := mergePeerChangedPatch(nil, new)
 		if len(got) != 1 {
 			t.Fatalf("len = %d; want 1", len(got))
 		}
diff --git a/ipn/ipnlocal/c2n.go b/ipn/ipnlocal/c2n.go
index 8284872b9..0a1fb685e 100644
--- a/ipn/ipnlocal/c2n.go
+++ b/ipn/ipnlocal/c2n.go
@@ -83,6 +83,29 @@ func RegisterC2N(pattern string, h func(*LocalBackend, http.ResponseWriter, *htt
 	c2nHandlers[k] = h
 }
 
+// RegisterC2NPrefix registers h as the c2n handler for all paths starting
+// with prefix. prefix must end in "/". Prefix matches are tried after all
+// exact-path handlers registered via [RegisterC2N] fail to match.
+func RegisterC2NPrefix(prefix string, h func(*LocalBackend, http.ResponseWriter, *http.Request)) {
+	if !buildfeatures.HasC2N {
+		return
+	}
+	if prefix == "" || !strings.HasSuffix(prefix, "/") {
+		panic(fmt.Sprintf("c2n: prefix %q must be non-empty and end with /", prefix))
+	}
+	c2nPrefixHandlers = append(c2nPrefixHandlers, c2nPrefixHandler{prefix, h})
+}
+
+// c2nPrefixHandler is a c2n handler that matches all paths starting with prefix.
+type c2nPrefixHandler struct {
+	prefix string
+	h      c2nHandler
+}
+
+// c2nPrefixHandlers are c2n handlers matched by URL path prefix rather than
+// exact path. See [RegisterC2NPrefix].
+var c2nPrefixHandlers []c2nPrefixHandler
+
 type c2nHandler func(*LocalBackend, http.ResponseWriter, *http.Request)
 
 type methodAndPath struct {
@@ -118,6 +141,13 @@ func (b *LocalBackend) handleC2N(w http.ResponseWriter, r *http.Request) {
 		h(b, w, r)
 		return
 	}
+	// Then try prefix matches.
+	for _, ph := range c2nPrefixHandlers {
+		if strings.HasPrefix(r.URL.Path, ph.prefix) {
+			ph.h(b, w, r)
+			return
+		}
+	}
 	if c2nHandlerPaths.Contains(r.URL.Path) {
 		http.Error(w, "bad method", http.StatusMethodNotAllowed)
 	} else {
diff --git a/ipn/ipnlocal/c2n_test.go b/ipn/ipnlocal/c2n_test.go
index e5b15e79a..8c5d24461 100644
--- a/ipn/ipnlocal/c2n_test.go
+++ b/ipn/ipnlocal/c2n_test.go
@@ -5,144 +5,19 @@ package ipnlocal
 
 import (
 	"bytes"
-	"cmp"
-	"crypto/x509"
 	"encoding/json"
 	"net/http/httptest"
-	"net/url"
-	"os"
-	"path/filepath"
-	"reflect"
 	"testing"
-	"time"
 
-	"tailscale.com/health"
-	"tailscale.com/ipn/store/mem"
 	"tailscale.com/tailcfg"
-	"tailscale.com/tstest"
 	"tailscale.com/types/key"
-	"tailscale.com/types/logger"
 	"tailscale.com/types/netmap"
 	"tailscale.com/types/views"
-	"tailscale.com/util/eventbus/eventbustest"
-	"tailscale.com/util/must"
 
 	gcmp "github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
 )
 
-func TestHandleC2NTLSCertStatus(t *testing.T) {
-	b := &LocalBackend{
-		store:   &mem.Store{},
-		varRoot: t.TempDir(),
-		health:  health.NewTracker(eventbustest.NewBus(t)),
-	}
-	certDir, err := b.certDir()
-	if err != nil {
-		t.Fatalf("certDir error: %v", err)
-	}
-	if _, err := b.getCertStore(); err != nil {
-		t.Fatalf("getCertStore error: %v", err)
-	}
-
-	testRoot, err := certTestFS.ReadFile("testdata/rootCA.pem")
-	if err != nil {
-		t.Fatal(err)
-	}
-	roots := x509.NewCertPool()
-	if !roots.AppendCertsFromPEM(testRoot) {
-		t.Fatal("Unable to add test CA to the cert pool")
-	}
-	testX509Roots = roots
-	defer func() { testX509Roots = nil }()
-
-	tests := []struct {
-		name       string
-		domain     string
-		copyFile   bool   // copy testdata/example.com.pem to the certDir
-		wantStatus int    // 0 means 200
-		wantError  string // wanted non-JSON non-200 error
-		now        time.Time
-		want       *tailcfg.C2NTLSCertInfo
-	}{
-		{
-			name:       "no-domain",
-			wantStatus: 400,
-			wantError:  "no 'domain'\n",
-		},
-		{
-			name:   "missing",
-			domain: "example.com",
-			want: &tailcfg.C2NTLSCertInfo{
-				Error:   "no certificate",
-				Missing: true,
-			},
-		},
-		{
-			name:     "valid",
-			domain:   "example.com",
-			now:      time.Date(2023, time.February, 20, 0, 0, 0, 0, time.UTC),
-			copyFile: true,
-			want: &tailcfg.C2NTLSCertInfo{
-				Valid:     true,
-				NotBefore: "2023-02-07T20:34:18Z",
-				NotAfter:  "2025-05-07T19:34:18Z",
-			},
-		},
-		{
-			name:     "expired",
-			domain:   "example.com",
-			now:      time.Date(2030, time.February, 20, 0, 0, 0, 0, time.UTC),
-			copyFile: true,
-			want: &tailcfg.C2NTLSCertInfo{
-				Error:   "cert expired",
-				Expired: true,
-			},
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			os.RemoveAll(certDir) // reset per test
-			if tt.copyFile {
-				os.MkdirAll(certDir, 0755)
-				if err := os.WriteFile(filepath.Join(certDir, "example.com.crt"),
-					must.Get(os.ReadFile("testdata/example.com.pem")), 0644); err != nil {
-					t.Fatal(err)
-				}
-				if err := os.WriteFile(filepath.Join(certDir, "example.com.key"),
-					must.Get(os.ReadFile("testdata/example.com-key.pem")), 0644); err != nil {
-					t.Fatal(err)
-				}
-			}
-			b.clock = tstest.NewClock(tstest.ClockOpts{
-				Start: tt.now,
-			})
-
-			rec := httptest.NewRecorder()
-			handleC2NTLSCertStatus(b, rec, httptest.NewRequest("GET", "/tls-cert-status?domain="+url.QueryEscape(tt.domain), nil))
-			res := rec.Result()
-			wantStatus := cmp.Or(tt.wantStatus, 200)
-			if res.StatusCode != wantStatus {
-				t.Fatalf("status code = %v; want %v. Body: %s", res.Status, wantStatus, rec.Body.Bytes())
-			}
-			if wantStatus == 200 {
-				var got tailcfg.C2NTLSCertInfo
-				if err := json.Unmarshal(rec.Body.Bytes(), &got); err != nil {
-					t.Fatalf("bad JSON: %v", err)
-				}
-				if !reflect.DeepEqual(&got, tt.want) {
-					t.Errorf("got %v; want %v", logger.AsJSON(got), logger.AsJSON(tt.want))
-				}
-			} else if tt.wantError != "" {
-				if got := rec.Body.String(); got != tt.wantError {
-					t.Errorf("body = %q; want %q", got, tt.wantError)
-				}
-			}
-		})
-	}
-
-}
-
 func TestHandleC2NDebugNetmap(t *testing.T) {
 	nm := &netmap.NetworkMap{
 		SelfNode: (&tailcfg.Node{
diff --git a/ipn/ipnlocal/captiveportal.go b/ipn/ipnlocal/captiveportal.go
deleted file mode 100644
index ae310c7cc..000000000
--- a/ipn/ipnlocal/captiveportal.go
+++ /dev/null
@@ -1,186 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-//go:build !ts_omit_captiveportal
-
-package ipnlocal
-
-import (
-	"context"
-	"time"
-
-	"tailscale.com/health"
-	"tailscale.com/net/captivedetection"
-	"tailscale.com/util/clientmetric"
-)
-
-func init() {
-	hookCaptivePortalHealthChange.Set(captivePortalHealthChange)
-	hookCheckCaptivePortalLoop.Set(checkCaptivePortalLoop)
-}
-
-var metricCaptivePortalDetected = clientmetric.NewCounter("captiveportal_detected")
-
-// captivePortalDetectionInterval is the duration to wait in an unhealthy state with connectivity broken
-// before running captive portal detection.
-const captivePortalDetectionInterval = 2 * time.Second
-
-func captivePortalHealthChange(b *LocalBackend, state *health.State) {
-	isConnectivityImpacted := false
-	for _, w := range state.Warnings {
-		// Ignore the captive portal warnable itself.
-		if w.ImpactsConnectivity && w.WarnableCode != captivePortalWarnable.Code {
-			isConnectivityImpacted = true
-			break
-		}
-	}
-
-	// captiveCtx can be changed, and is protected with 'mu'; grab that
-	// before we start our select, below.
-	//
-	// It is guaranteed to be non-nil.
-	b.mu.Lock()
-	ctx := b.captiveCtx
-	b.mu.Unlock()
-
-	// If the context is canceled, we don't need to do anything.
-	if ctx.Err() != nil {
-		return
-	}
-
-	if isConnectivityImpacted {
-		b.logf("health: connectivity impacted; triggering captive portal detection")
-
-		// Ensure that we select on captiveCtx so that we can time out
-		// triggering captive portal detection if the backend is shutdown.
-		select {
-		case b.needsCaptiveDetection <- true:
-		case <-ctx.Done():
-		}
-	} else {
-		// If connectivity is not impacted, we know for sure we're not behind a captive portal,
-		// so drop any warning, and signal that we don't need captive portal detection.
-		b.health.SetHealthy(captivePortalWarnable)
-		select {
-		case b.needsCaptiveDetection <- false:
-		case <-ctx.Done():
-		}
-	}
-}
-
-// captivePortalWarnable is a Warnable which is set to an unhealthy state when a captive portal is detected.
-var captivePortalWarnable = health.Register(&health.Warnable{
-	Code:  "captive-portal-detected",
-	Title: "Captive portal detected",
-	// High severity, because captive portals block all traffic and require user intervention.
-	Severity:            health.SeverityHigh,
-	Text:                health.StaticMessage("This network requires you to log in using your web browser."),
-	ImpactsConnectivity: true,
-})
-
-func checkCaptivePortalLoop(b *LocalBackend, ctx context.Context) {
-	var tmr *time.Timer
-
-	maybeStartTimer := func() {
-		// If there's an existing timer, nothing to do; just continue
-		// waiting for it to expire. Otherwise, create a new timer.
-		if tmr == nil {
-			tmr = time.NewTimer(captivePortalDetectionInterval)
-		}
-	}
-	maybeStopTimer := func() {
-		if tmr == nil {
-			return
-		}
-		if !tmr.Stop() {
-			<-tmr.C
-		}
-		tmr = nil
-	}
-
-	for {
-		if ctx.Err() != nil {
-			maybeStopTimer()
-			return
-		}
-
-		// First, see if we have a signal on our "healthy" channel, which
-		// takes priority over an existing timer. Because a select is
-		// nondeterministic, we explicitly check this channel before
-		// entering the main select below, so that we're guaranteed to
-		// stop the timer before starting captive portal detection.
-		select {
-		case needsCaptiveDetection := <-b.needsCaptiveDetection:
-			if needsCaptiveDetection {
-				maybeStartTimer()
-			} else {
-				maybeStopTimer()
-			}
-		default:
-		}
-
-		var timerChan <-chan time.Time
-		if tmr != nil {
-			timerChan = tmr.C
-		}
-		select {
-		case <-ctx.Done():
-			// All done; stop the timer and then exit.
-			maybeStopTimer()
-			return
-		case <-timerChan:
-			// Kick off captive portal check
-			b.performCaptiveDetection()
-			// nil out timer to force recreation
-			tmr = nil
-		case needsCaptiveDetection := <-b.needsCaptiveDetection:
-			if needsCaptiveDetection {
-				maybeStartTimer()
-			} else {
-				// Healthy; cancel any existing timer
-				maybeStopTimer()
-			}
-		}
-	}
-}
-
-// shouldRunCaptivePortalDetection reports whether captive portal detection
-// should be run. It is enabled by default, but can be disabled via a control
-// knob. It is also only run when the user explicitly wants the backend to be
-// running.
-func (b *LocalBackend) shouldRunCaptivePortalDetection() bool {
-	b.mu.Lock()
-	defer b.mu.Unlock()
-	return !b.ControlKnobs().DisableCaptivePortalDetection.Load() && b.pm.prefs.WantRunning()
-}
-
-// performCaptiveDetection checks if captive portal detection is enabled via controlknob. If so, it runs
-// the detection and updates the Warnable accordingly.
-func (b *LocalBackend) performCaptiveDetection() {
-	if !b.shouldRunCaptivePortalDetection() {
-		return
-	}
-
-	d := captivedetection.NewDetector(b.logf)
-	b.mu.Lock() // for b.hostinfo
-	cn := b.currentNode()
-	dm := cn.DERPMap()
-	preferredDERP := 0
-	if b.hostinfo != nil {
-		if b.hostinfo.NetInfo != nil {
-			preferredDERP = b.hostinfo.NetInfo.PreferredDERP
-		}
-	}
-	ctx := b.ctx
-	netMon := b.NetMon()
-	b.mu.Unlock()
-	found := d.Detect(ctx, netMon, dm, preferredDERP)
-	if found {
-		if !b.health.IsUnhealthy(captivePortalWarnable) {
-			metricCaptivePortalDetected.Add(1)
-		}
-		b.health.SetUnhealthy(captivePortalWarnable, health.Args{})
-	} else {
-		b.health.SetHealthy(captivePortalWarnable)
-	}
-}
diff --git a/ipn/ipnlocal/cert.go b/ipn/ipnlocal/cert.go
index efab9db7a..ad36957a8 100644
--- a/ipn/ipnlocal/cert.go
+++ b/ipn/ipnlocal/cert.go
@@ -1,989 +1,148 @@
 // Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
-//go:build !js && !ts_omit_acme
-
 package ipnlocal
 
 import (
-	"bytes"
 	"context"
-	"crypto"
-	"crypto/ecdsa"
-	"crypto/elliptic"
-	"crypto/rand"
-	"crypto/rsa"
 	"crypto/tls"
-	"crypto/x509"
-	"crypto/x509/pkix"
-	"encoding/json"
-	"encoding/pem"
 	"errors"
-	"fmt"
 	"io"
-	"log"
-	randv2 "math/rand/v2"
-	"net"
 	"net/http"
-	"os"
-	"path/filepath"
-	"runtime"
-	"slices"
-	"strings"
 	"time"
 
-	"tailscale.com/atomicfile"
-	"tailscale.com/envknob"
-	"tailscale.com/feature/buildfeatures"
-	"tailscale.com/hostinfo"
+	"tailscale.com/feature"
 	"tailscale.com/ipn"
-	"tailscale.com/ipn/store"
-	"tailscale.com/ipn/store/mem"
-	"tailscale.com/net/bakedroots"
-	"tailscale.com/syncs"
-	"tailscale.com/tailcfg"
-	"tailscale.com/tempfork/acme"
-	"tailscale.com/types/logger"
-	"tailscale.com/util/testenv"
-	"tailscale.com/version"
-	"tailscale.com/version/distro"
 )
 
-func init() {
-	RegisterC2N("GET /tls-cert-status", handleC2NTLSCertStatus)
-}
-
-// Process-wide cache. (A new *Handler is created per connection,
-// effectively per request)
-var (
-	// acmeMu guards all ACME operations, so concurrent requests
-	// for certs don't slam ACME. The first will go through and
-	// populate the on-disk cache and the rest should use that.
-	acmeMu syncs.Mutex
-
-	renewMu     syncs.Mutex // lock order: acmeMu before renewMu
-	renewCertAt = map[string]time.Time{}
-)
-
-// certDir returns (creating if needed) the directory in which cached
-// cert keypairs are stored.
-func (b *LocalBackend) certDir() (string, error) {
-	d := b.TailscaleVarRoot()
-
-	// As a workaround for Synology DSM6 not having a "var" directory, use the
-	// app's "etc" directory (on a small partition) to hold certs at least.
-	// See https://github.com/tailscale/tailscale/issues/4060#issuecomment-1186592251
-	if buildfeatures.HasSynology && d == "" && runtime.GOOS == "linux" && distro.Get() == distro.Synology && distro.DSMVersion() == 6 {
-		d = "/var/packages/Tailscale/etc" // base; we append "certs" below
-	}
-	if d == "" {
-		return "", errors.New("no TailscaleVarRoot")
-	}
-	full := filepath.Join(d, "certs")
-	if err := os.MkdirAll(full, 0700); err != nil {
-		return "", err
-	}
-	return full, nil
-}
-
-var acmeDebug = envknob.RegisterBool("TS_DEBUG_ACME")
-
-// GetCertPEM gets the TLSCertKeyPair for domain, either from cache or via the
-// ACME process. ACME process is used for new domain certs, existing expired
-// certs or existing certs that should get renewed due to upcoming expiry.
-//
-// If a cert is expired, it will be renewed synchronously otherwise it will be
-// renewed asynchronously.
-func (b *LocalBackend) GetCertPEM(ctx context.Context, domain string) (*TLSCertKeyPair, error) {
-	return b.GetCertPEMWithValidity(ctx, domain, 0)
-}
-
-// GetCertPEMWithValidity gets the TLSCertKeyPair for domain, either from cache
-// or via the ACME process. ACME process is used for new domain certs, existing
-// expired certs or existing certs that should get renewed sooner than
-// minValidity.
-//
-// If a cert is expired, or expires sooner than minValidity, it will be renewed
-// synchronously. Otherwise it will be renewed asynchronously.
-//
-// The domain must be one of:
-//
-//   - An exact CertDomain (e.g., "node.ts.net")
-//   - A wildcard domain (e.g., "*.node.ts.net")
-//
-// The wildcard format requires the NodeAttrDNSSubdomainResolve capability.
-func (b *LocalBackend) GetCertPEMWithValidity(ctx context.Context, domain string, minValidity time.Duration) (*TLSCertKeyPair, error) {
-	b.mu.Lock()
-	getCertForTest := b.getCertForTest
-	b.mu.Unlock()
-
-	if getCertForTest != nil {
-		testenv.AssertInTest()
-		return getCertForTest(domain)
-	}
-
-	if !validLookingCertDomain(domain) {
-		return nil, errors.New("invalid domain")
-	}
-
-	certDomain, err := b.resolveCertDomain(domain)
-	if err != nil {
-		return nil, err
-	}
-	logf := logger.WithPrefix(b.logf, fmt.Sprintf("cert(%q): ", domain))
-	now := b.clock.Now()
-	traceACME := func(v any) {
-		if !acmeDebug() {
-			return
-		}
-		j, _ := json.MarshalIndent(v, "", "\t")
-		log.Printf("acme %T: %s", v, j)
-	}
-
-	cs, err := b.getCertStore()
-	if err != nil {
-		return nil, err
-	}
-
-	if pair, err := getCertPEMCached(cs, certDomain, now); err == nil {
-		if envknob.IsCertShareReadOnlyMode() {
-			return pair, nil
-		}
-		// If we got here, we have a valid unexpired cert.
-		// Check whether we should start an async renewal.
-		shouldRenew, err := b.shouldStartDomainRenewal(cs, certDomain, now, pair, minValidity)
-		if err != nil {
-			logf("error checking for certificate renewal: %v", err)
-			// Renewal check failed, but the current cert is valid and not
-			// expired, so it's safe to return.
-			return pair, nil
-		}
-		if !shouldRenew {
-			return pair, nil
-		}
-		if minValidity == 0 {
-			logf("starting async renewal")
-			// Start renewal in the background, return current valid cert.
-			b.goTracker.Go(func() {
-				if _, err := getCertPEM(context.Background(), b, cs, logf, traceACME, certDomain, now, minValidity); err != nil {
-					logf("async renewal failed: getCertPem: %v", err)
-				}
-			})
-			return pair, nil
-		}
-		// If the caller requested a specific validity duration, fall through
-		// to synchronous renewal to fulfill that.
-		logf("starting sync renewal")
-	}
-
-	if envknob.IsCertShareReadOnlyMode() {
-		return nil, fmt.Errorf("retrieving cached TLS certificate failed and cert store is configured in read-only mode, not attempting to issue a new certificate: %w", err)
-	}
-
-	pair, err := getCertPEM(ctx, b, cs, logf, traceACME, certDomain, now, minValidity)
-	if err != nil {
-		logf("getCertPEM: %v", err)
-		return nil, err
-	}
-	return pair, nil
-}
-
-// shouldStartDomainRenewal reports whether the domain's cert should be renewed
-// based on the current time, the cert's expiry, and the ARI check.
-func (b *LocalBackend) shouldStartDomainRenewal(cs certStore, domain string, now time.Time, pair *TLSCertKeyPair, minValidity time.Duration) (bool, error) {
-	if minValidity != 0 {
-		cert, err := pair.parseCertificate()
-		if err != nil {
-			return false, fmt.Errorf("parsing certificate: %w", err)
-		}
-		return cert.NotAfter.Sub(now) < minValidity, nil
-	}
-	renewMu.Lock()
-	defer renewMu.Unlock()
-	if renewAt, ok := renewCertAt[domain]; ok {
-		return now.After(renewAt), nil
-	}
-
-	renewTime, err := b.domainRenewalTimeByARI(cs, pair)
-	if err != nil {
-		// Log any ARI failure and fall back to checking for renewal by expiry.
-		b.logf("acme: ARI check failed: %v; falling back to expiry-based check", err)
-		renewTime, err = b.domainRenewalTimeByExpiry(pair)
-		if err != nil {
-			return false, err
-		}
-	}
-
-	renewCertAt[domain] = renewTime
-	return now.After(renewTime), nil
-}
-
-func (b *LocalBackend) domainRenewed(domain string) {
-	renewMu.Lock()
-	defer renewMu.Unlock()
-	delete(renewCertAt, domain)
-}
-
-func (b *LocalBackend) domainRenewalTimeByExpiry(pair *TLSCertKeyPair) (time.Time, error) {
-	cert, err := pair.parseCertificate()
-	if err != nil {
-		return time.Time{}, fmt.Errorf("parsing certificate: %w", err)
-	}
-
-	certLifetime := cert.NotAfter.Sub(cert.NotBefore)
-	if certLifetime < 0 {
-		return time.Time{}, fmt.Errorf("negative certificate lifetime %v", certLifetime)
-	}
-
-	// Per https://github.com/tailscale/tailscale/issues/8204, check
-	// whether we're more than 2/3 of the way through the certificate's
-	// lifetime, which is the officially-recommended best practice by Let's
-	// Encrypt.
-	renewalDuration := certLifetime * 2 / 3
-	renewAt := cert.NotBefore.Add(renewalDuration)
-	return renewAt, nil
-}
-
-func (b *LocalBackend) domainRenewalTimeByARI(cs certStore, pair *TLSCertKeyPair) (time.Time, error) {
-	var blocks []*pem.Block
-	rest := pair.CertPEM
-	for len(rest) > 0 {
-		var block *pem.Block
-		block, rest = pem.Decode(rest)
-		if block == nil {
-			return time.Time{}, fmt.Errorf("parsing certificate PEM")
-		}
-		blocks = append(blocks, block)
-	}
-	if len(blocks) < 1 {
-		return time.Time{}, fmt.Errorf("could not parse certificate chain from certStore, got %d PEM block(s)", len(blocks))
-	}
-	ac, err := acmeClient(cs)
-	if err != nil {
-		return time.Time{}, err
-	}
-	ctx, cancel := context.WithTimeout(b.ctx, 5*time.Second)
-	defer cancel()
-	ri, err := ac.FetchRenewalInfo(ctx, blocks[0].Bytes)
-	if err != nil {
-		return time.Time{}, fmt.Errorf("failed to fetch renewal info from ACME server: %w", err)
-	}
-	if acmeDebug() {
-		b.logf("acme: ARI response: %+v", ri)
-	}
-
-	// Select a random time in the suggested window and renew if that time has
-	// passed. Time is randomized per recommendation in
-	// https://datatracker.ietf.org/doc/draft-ietf-acme-ari/
-	start, end := ri.SuggestedWindow.Start, ri.SuggestedWindow.End
-	renewTime := start.Add(randv2.N(end.Sub(start)))
-	return renewTime, nil
-}
-
-// certStore provides a way to perist and retrieve TLS certificates.
-// As of 2023-02-01, we use store certs in directories on disk everywhere
-// except on Kubernetes, where we use the state store.
-type certStore interface {
-	// Read returns the cert and key for domain, if they exist and are valid
-	// for now. If they're expired, it returns errCertExpired.
-	// If they don't exist, it returns ipn.ErrStateNotExist.
-	Read(domain string, now time.Time) (*TLSCertKeyPair, error)
-	// ACMEKey returns the value previously stored via WriteACMEKey.
-	// It is a PEM encoded ECDSA key.
-	ACMEKey() ([]byte, error)
-	// WriteACMEKey stores the provided PEM encoded ECDSA key.
-	WriteACMEKey([]byte) error
-	// WriteTLSCertAndKey writes the cert and key for domain.
-	WriteTLSCertAndKey(domain string, cert, key []byte) error
-}
-
-var errCertExpired = errors.New("cert expired")
-
-var testX509Roots *x509.CertPool // set non-nil by tests
-
-func (b *LocalBackend) getCertStore() (certStore, error) {
-	switch b.store.(type) {
-	case *store.FileStore:
-	case *mem.Store:
-	default:
-		if hostinfo.GetEnvType() == hostinfo.Kubernetes {
-			// We're running in Kubernetes with a custom StateStore,
-			// use that instead of the cert directory.
-			// TODO(maisem): expand this to other environments?
-			return certStateStore{StateStore: b.store}, nil
-		}
-	}
-	dir, err := b.certDir()
-	if err != nil {
-		return nil, err
-	}
-	if testX509Roots != nil && !testenv.InTest() {
-		panic("use of test hook outside of tests")
-	}
-	return certFileStore{dir: dir, testRoots: testX509Roots}, nil
-}
-
-// ConfigureCertsForTest sets a certificate retrieval function to be used by
-// this local backend, skipping the usual ACME certificate registration. Should
-// only be used in tests.
-func (b *LocalBackend) ConfigureCertsForTest(getCert func(hostname string) (*TLSCertKeyPair, error)) {
-	testenv.AssertInTest()
-	b.mu.Lock()
-	b.getCertForTest = getCert
-	b.mu.Unlock()
-}
-
-// certFileStore implements certStore by storing the cert & key files in the named directory.
-type certFileStore struct {
-	dir string
-
-	// This field allows a test to override the CA root(s) for certificate
-	// verification. If nil the default system pool is used.
-	testRoots *x509.CertPool
-}
-
-const acmePEMName = "acme-account.key.pem"
-
-func (f certFileStore) ACMEKey() ([]byte, error) {
-	pemName := filepath.Join(f.dir, acmePEMName)
-	v, err := os.ReadFile(pemName)
-	if err != nil {
-		if os.IsNotExist(err) {
-			return nil, ipn.ErrStateNotExist
-		}
-		return nil, err
-	}
-	return v, nil
-}
-
-func (f certFileStore) WriteACMEKey(b []byte) error {
-	pemName := filepath.Join(f.dir, acmePEMName)
-	return atomicfile.WriteFile(pemName, b, 0600)
-}
-
-func (f certFileStore) Read(domain string, now time.Time) (*TLSCertKeyPair, error) {
-	certPEM, err := os.ReadFile(certFile(f.dir, domain))
-	if err != nil {
-		if os.IsNotExist(err) {
-			return nil, ipn.ErrStateNotExist
-		}
-		return nil, err
-	}
-	keyPEM, err := os.ReadFile(keyFile(f.dir, domain))
-	if err != nil {
-		if os.IsNotExist(err) {
-			return nil, ipn.ErrStateNotExist
-		}
-		return nil, err
-	}
-	if !validCertPEM(domain, keyPEM, certPEM, f.testRoots, now) {
-		return nil, errCertExpired
-	}
-	return &TLSCertKeyPair{CertPEM: certPEM, KeyPEM: keyPEM, Cached: true}, nil
-}
-
-func (f certFileStore) WriteCert(domain string, cert []byte) error {
-	return atomicfile.WriteFile(certFile(f.dir, domain), cert, 0644)
-}
-
-func (f certFileStore) WriteKey(domain string, key []byte) error {
-	return atomicfile.WriteFile(keyFile(f.dir, domain), key, 0600)
-}
-
-func (f certFileStore) WriteTLSCertAndKey(domain string, cert, key []byte) error {
-	if err := f.WriteKey(domain, key); err != nil {
-		return err
-	}
-	return f.WriteCert(domain, cert)
-}
-
-// certStateStore implements certStore by storing the cert & key files in an ipn.StateStore.
-type certStateStore struct {
-	ipn.StateStore
-
-	// This field allows a test to override the CA root(s) for certificate
-	// verification. If nil the default system pool is used.
-	testRoots *x509.CertPool
-}
-
-// TLSCertKeyReader is an interface implemented by state stores where it makes
-// sense to read the TLS cert and key in a single operation that can be
-// distinguished from generic state value reads. Currently this is only implemented
-// by the kubestore.Store, which, in some cases, need to read cert and key from a
-// non-cached TLS Secret.
-type TLSCertKeyReader interface {
-	ReadTLSCertAndKey(domain string) ([]byte, []byte, error)
-}
-
-func (s certStateStore) Read(domain string, now time.Time) (*TLSCertKeyPair, error) {
-	// If we're using a store that supports atomic reads, use that
-	if kr, ok := s.StateStore.(TLSCertKeyReader); ok {
-		cert, key, err := kr.ReadTLSCertAndKey(domain)
-		if err != nil {
-			return nil, err
-		}
-		if !validCertPEM(domain, key, cert, s.testRoots, now) {
-			return nil, errCertExpired
-		}
-		return &TLSCertKeyPair{CertPEM: cert, KeyPEM: key, Cached: true}, nil
-	}
-
-	// Otherwise fall back to separate reads
-	certPEM, err := s.ReadState(ipn.StateKey(domain + ".crt"))
-	if err != nil {
-		return nil, err
-	}
-	keyPEM, err := s.ReadState(ipn.StateKey(domain + ".key"))
-	if err != nil {
-		return nil, err
-	}
-	if !validCertPEM(domain, keyPEM, certPEM, s.testRoots, now) {
-		return nil, errCertExpired
-	}
-	return &TLSCertKeyPair{CertPEM: certPEM, KeyPEM: keyPEM, Cached: true}, nil
-}
-
-func (s certStateStore) WriteCert(domain string, cert []byte) error {
-	return ipn.WriteState(s.StateStore, ipn.StateKey(domain+".crt"), cert)
-}
-
-func (s certStateStore) WriteKey(domain string, key []byte) error {
-	return ipn.WriteState(s.StateStore, ipn.StateKey(domain+".key"), key)
-}
-
-func (s certStateStore) ACMEKey() ([]byte, error) {
-	return s.ReadState(ipn.StateKey(acmePEMName))
-}
-
-func (s certStateStore) WriteACMEKey(key []byte) error {
-	return ipn.WriteState(s.StateStore, ipn.StateKey(acmePEMName), key)
-}
-
-// TLSCertKeyWriter is an interface implemented by state stores that can write the TLS
-// cert and key in a single atomic operation. Currently this is only implemented
-// by the kubestore.StoreKube.
-type TLSCertKeyWriter interface {
-	WriteTLSCertAndKey(domain string, cert, key []byte) error
-}
-
-// WriteTLSCertAndKey writes the TLS cert and key for domain to the current
-// LocalBackend's StateStore.
-func (s certStateStore) WriteTLSCertAndKey(domain string, cert, key []byte) error {
-	// If we're using a store that supports atomic writes, use that.
-	if aw, ok := s.StateStore.(TLSCertKeyWriter); ok {
-		return aw.WriteTLSCertAndKey(domain, cert, key)
-	}
-	// Otherwise fall back to separate writes for cert and key.
-	if err := s.WriteKey(domain, key); err != nil {
-		return err
-	}
-	return s.WriteCert(domain, cert)
-}
-
-// TLSCertKeyPair is a TLS public and private key, and whether they were obtained
-// from cache or freshly obtained.
+// TLSCertKeyPair is a TLS public and private key, and whether they were
+// obtained from cache or freshly obtained.
 type TLSCertKeyPair struct {
 	CertPEM []byte // public key, in PEM form
 	KeyPEM  []byte // private key, in PEM form
 	Cached  bool   // whether result came from cache
 }
 
-func (kp TLSCertKeyPair) parseCertificate() (*x509.Certificate, error) {
-	block, _ := pem.Decode(kp.CertPEM)
-	if block == nil {
-		return nil, fmt.Errorf("error parsing certificate PEM")
-	}
-	if block.Type != "CERTIFICATE" {
-		return nil, fmt.Errorf("PEM block is %q, not a CERTIFICATE", block.Type)
-	}
-	return x509.ParseCertificate(block.Bytes)
-}
+// errNoCerts is returned by the wrapper methods below when ACME/cert
+// support is not compiled into this build.
+var errNoCerts = errors.New("cert support not compiled in this build")
 
-func keyFile(dir, domain string) string {
-	return filepath.Join(dir, strings.Replace(domain, "*.", "wildcard_.", 1)+".key")
-}
-func certFile(dir, domain string) string {
-	return filepath.Join(dir, strings.Replace(domain, "*.", "wildcard_.", 1)+".crt")
-}
+// Hooks installed by the feature/acme package at init time. In builds
+// without ACME support (js or ts_omit_acme), feature/acme is not linked
+// in and these hooks remain unset; the wrapper methods below then
+// behave as no-ops or return errNoCerts.
+var (
+	// HookGetCertPEM implements [LocalBackend.GetCertPEMWithValidity].
+	HookGetCertPEM feature.Hook[func(ctx context.Context, b *LocalBackend, domain string, minValidity time.Duration) (*TLSCertKeyPair, error)]
 
-// getCertPEMCached returns a non-nil keyPair if a cached keypair for domain
-// exists on disk in dir that is valid at the provided now time.
-//
-// If the keypair is expired, it returns errCertExpired.
-// If the keypair doesn't exist, it returns ipn.ErrStateNotExist.
-func getCertPEMCached(cs certStore, domain string, now time.Time) (p *TLSCertKeyPair, err error) {
-	if !validLookingCertDomain(domain) {
-		// Before we read files from disk using it, validate it's halfway
-		// reasonable looking.
-		return nil, fmt.Errorf("invalid domain %q", domain)
-	}
-	return cs.Read(domain, now)
-}
+	// HookGetACMETLSALPNCert returns the ACME tls-alpn-01 challenge
+	// certificate for hi, if any.
+	HookGetACMETLSALPNCert feature.Hook[func(b *LocalBackend, hi *tls.ClientHelloInfo) (*tls.Certificate, bool)]
 
-// getCertPem checks if a cert needs to be renewed and if so, renews it.
-// domain is the resolved cert domain (e.g., "*.node.ts.net" for wildcards).
-// It can be overridden in tests.
-var getCertPEM = func(ctx context.Context, b *LocalBackend, cs certStore, logf logger.Logf, traceACME func(any), domain string, now time.Time, minValidity time.Duration) (*TLSCertKeyPair, error) {
-	acmeMu.Lock()
-	defer acmeMu.Unlock()
+	// HookGetACMETLSALPNProto reports whether the ACME ALPN protocol
+	// should be advertised for hi.
+	HookGetACMETLSALPNProto feature.Hook[func(b *LocalBackend, hi *tls.ClientHelloInfo) (string, bool)]
 
-	baseDomain, isWildcard := strings.CutPrefix(domain, "*.")
+	// HookUpdateCertRefreshLoop is called when [LocalBackend]'s state
+	// or serve config changes, so the cert refresh loop can be
+	// (re)started or stopped. It is invoked with b.mu held.
+	HookUpdateCertRefreshLoop feature.Hook[func(b *LocalBackend, state ipn.State, sc ipn.ServeConfigView)]
 
-	// In case this method was triggered multiple times in parallel (when
-	// serving incoming requests), check whether one of the other goroutines
-	// already renewed the cert before us.
-	previous, err := getCertPEMCached(cs, domain, now)
-	if err == nil {
-		// shouldStartDomainRenewal caches its result so it's OK to call this
-		// frequently.
-		shouldRenew, err := b.shouldStartDomainRenewal(cs, domain, now, previous, minValidity)
-		if err != nil {
-			logf("error checking for certificate renewal: %v", err)
-		} else if !shouldRenew {
-			return previous, nil
+	// HookShutdownCertRefreshLoop is called from
+	// [LocalBackend.Shutdown] to cancel the cert refresh loop.
+	HookShutdownCertRefreshLoop feature.Hook[func(b *LocalBackend)]
+
+	// HookConfigureCertsForTest implements
+	// [LocalBackend.ConfigureCertsForTest].
+	HookConfigureCertsForTest feature.Hook[func(b *LocalBackend, getCert func(string) (*TLSCertKeyPair, error))]
+
+	// HookHandleC2NTLSCertStatus handles the GET /tls-cert-status
+	// control-to-node request.
+	HookHandleC2NTLSCertStatus feature.Hook[func(b *LocalBackend, w http.ResponseWriter, r *http.Request)]
+)
+
+func init() {
+	RegisterC2N("GET /tls-cert-status", func(b *LocalBackend, w http.ResponseWriter, r *http.Request) {
+		if f, ok := HookHandleC2NTLSCertStatus.GetOk(); ok {
+			f(b, w, r)
+			return
 		}
-	} else if !errors.Is(err, ipn.ErrStateNotExist) && !errors.Is(err, errCertExpired) {
-		return nil, err
-	}
-
-	ac, err := acmeClient(cs)
-	if err != nil {
-		return nil, err
-	}
-
-	if !isDefaultDirectoryURL(ac.DirectoryURL) {
-		logf("acme: using Directory URL %q", ac.DirectoryURL)
-	}
-
-	a, err := ac.GetReg(ctx, "" /* pre-RFC param */)
-	switch {
-	case err == nil:
-		// Great, already registered.
-		logf("already had ACME account.")
-	case err == acme.ErrNoAccount:
-		a, err = ac.Register(ctx, new(acme.Account), acme.AcceptTOS)
-		if err == acme.ErrAccountAlreadyExists {
-			// Potential race. Double check.
-			a, err = ac.GetReg(ctx, "" /* pre-RFC param */)
-		}
-		if err != nil {
-			return nil, fmt.Errorf("acme.Register: %w", err)
-		}
-		logf("registered ACME account.")
-		traceACME(a)
-	default:
-		return nil, fmt.Errorf("acme.GetReg: %w", err)
-
-	}
-	if a.Status != acme.StatusValid {
-		return nil, fmt.Errorf("unexpected ACME account status %q", a.Status)
-	}
-
-	// If we have a previous cert, include it in the order. Assuming we're
-	// within the ARI renewal window this should exclude us from LE rate
-	// limits.
-	// Note that this order extension will fail renewals if the ACME account key has changed
-	// since the last issuance, see
-	// https://github.com/tailscale/tailscale/issues/18251
-	var opts []acme.OrderOption
-	if previous != nil && !envknob.Bool("TS_DEBUG_ACME_FORCE_RENEWAL") {
-		prevCrt, err := previous.parseCertificate()
-		if err == nil {
-			opts = append(opts, acme.WithOrderReplacesCert(prevCrt))
-		}
-	}
-
-	// For wildcards, we need to authorize both the wildcard and base domain.
-	var authzIDs []acme.AuthzID
-	if isWildcard {
-		authzIDs = []acme.AuthzID{
-			{Type: "dns", Value: domain},
-			{Type: "dns", Value: baseDomain},
-		}
-	} else {
-		authzIDs = []acme.AuthzID{{Type: "dns", Value: domain}}
-	}
-	order, err := ac.AuthorizeOrder(ctx, authzIDs, opts...)
-	if err != nil {
-		return nil, err
-	}
-	traceACME(order)
-
-	for _, aurl := range order.AuthzURLs {
-		az, err := ac.GetAuthorization(ctx, aurl)
-		if err != nil {
-			return nil, err
-		}
-		traceACME(az)
-		for _, ch := range az.Challenges {
-			if ch.Type == "dns-01" {
-				rec, err := ac.DNS01ChallengeRecord(ch.Token)
-				if err != nil {
-					return nil, err
-				}
-				// For wildcards, the challenge is on the base domain.
-				// e.g., "*.node.ts.net" -> "_acme-challenge.node.ts.net"
-				key := "_acme-challenge." + strings.TrimPrefix(az.Identifier.Value, "*.")
-
-				// Do a best-effort lookup to see if we've already created this DNS name
-				// in a previous attempt. Don't burn too much time on it, though. Worst
-				// case we ask the server to create something that already exists.
-				var resolver net.Resolver
-				lookupCtx, lookupCancel := context.WithTimeout(ctx, 500*time.Millisecond)
-				txts, _ := resolver.LookupTXT(lookupCtx, key)
-				lookupCancel()
-				if slices.Contains(txts, rec) {
-					logf("TXT record already existed for %s", key)
-				} else {
-					logf("starting SetDNS call for %s...", key)
-					err = b.SetDNS(ctx, key, rec)
-					if err != nil {
-						return nil, fmt.Errorf("SetDNS %q => %q: %w", key, rec, err)
-					}
-					logf("did SetDNS for %s", key)
-				}
-
-				chal, err := ac.Accept(ctx, ch)
-				if err != nil {
-					return nil, fmt.Errorf("Accept: %v", err)
-				}
-				traceACME(chal)
-				break
-			}
-		}
-	}
-
-	orderURI := order.URI
-	order, err = ac.WaitOrder(ctx, orderURI)
-	if err != nil {
-		if ctx.Err() != nil {
-			return nil, ctx.Err()
-		}
-		if oe, ok := err.(*acme.OrderError); ok {
-			logf("acme: WaitOrder: OrderError status %q", oe.Status)
-		} else {
-			logf("acme: WaitOrder error: %v", err)
-		}
-		return nil, err
-	}
-	traceACME(order)
-
-	certPrivKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
-	if err != nil {
-		return nil, err
-	}
-	var privPEM bytes.Buffer
-	if err := encodeECDSAKey(&privPEM, certPrivKey); err != nil {
-		return nil, err
-	}
-
-	csr, err := certRequest(certPrivKey, domain, nil)
-	if err != nil {
-		return nil, err
-	}
-
-	logf("requesting cert...")
-	traceACME(csr)
-	der, _, err := ac.CreateOrderCert(ctx, order.FinalizeURL, csr, true)
-	if err != nil {
-		return nil, fmt.Errorf("CreateOrder: %v", err)
-	}
-	logf("got cert")
-
-	var certPEM bytes.Buffer
-	for _, b := range der {
-		pb := &pem.Block{Type: "CERTIFICATE", Bytes: b}
-		if err := pem.Encode(&certPEM, pb); err != nil {
-			return nil, err
-		}
-	}
-	if err := cs.WriteTLSCertAndKey(domain, certPEM.Bytes(), privPEM.Bytes()); err != nil {
-		return nil, err
-	}
-	b.domainRenewed(domain)
-
-	return &TLSCertKeyPair{CertPEM: certPEM.Bytes(), KeyPEM: privPEM.Bytes()}, nil
-}
-
-// certRequest generates a CSR for the given domain and optional SANs.
-func certRequest(key crypto.Signer, domain string, ext []pkix.Extension) ([]byte, error) {
-	dnsNames := []string{domain}
-	if base, ok := strings.CutPrefix(domain, "*."); ok {
-		// Wildcard cert must also include the base domain as a SAN.
-		// This is load-bearing: getCertPEMCached validates certs using
-		// the storage key (base domain), which only passes x509 verification
-		// if the base domain is in DNSNames.
-		dnsNames = append(dnsNames, base)
-	}
-	req := &x509.CertificateRequest{
-		Subject:         pkix.Name{CommonName: domain},
-		DNSNames:        dnsNames,
-		ExtraExtensions: ext,
-	}
-	return x509.CreateCertificateRequest(rand.Reader, req, key)
-}
-
-func encodeECDSAKey(w io.Writer, key *ecdsa.PrivateKey) error {
-	b, err := x509.MarshalECPrivateKey(key)
-	if err != nil {
-		return err
-	}
-	pb := &pem.Block{Type: "EC PRIVATE KEY", Bytes: b}
-	return pem.Encode(w, pb)
-}
-
-// parsePrivateKey is a copy of x/crypto/acme's parsePrivateKey.
-//
-// Attempt to parse the given private key DER block. OpenSSL 0.9.8 generates
-// PKCS#1 private keys by default, while OpenSSL 1.0.0 generates PKCS#8 keys.
-// OpenSSL ecparam generates SEC1 EC private keys for ECDSA. We try all three.
-//
-// Inspired by parsePrivateKey in crypto/tls/tls.go.
-func parsePrivateKey(der []byte) (crypto.Signer, error) {
-	if key, err := x509.ParsePKCS1PrivateKey(der); err == nil {
-		return key, nil
-	}
-	if key, err := x509.ParsePKCS8PrivateKey(der); err == nil {
-		switch key := key.(type) {
-		case *rsa.PrivateKey:
-			return key, nil
-		case *ecdsa.PrivateKey:
-			return key, nil
-		default:
-			return nil, errors.New("acme/autocert: unknown private key type in PKCS#8 wrapping")
-		}
-	}
-	if key, err := x509.ParseECPrivateKey(der); err == nil {
-		return key, nil
-	}
-
-	return nil, errors.New("acme/autocert: failed to parse private key")
-}
-
-func acmeKey(cs certStore) (crypto.Signer, error) {
-	if v, err := cs.ACMEKey(); err == nil {
-		priv, _ := pem.Decode(v)
-		if priv == nil || !strings.Contains(priv.Type, "PRIVATE") {
-			return nil, errors.New("acme/autocert: invalid account key found in cache")
-		}
-		return parsePrivateKey(priv.Bytes)
-	} else if !errors.Is(err, ipn.ErrStateNotExist) {
-		return nil, err
-	}
-
-	privKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
-	if err != nil {
-		return nil, err
-	}
-	var pemBuf bytes.Buffer
-	if err := encodeECDSAKey(&pemBuf, privKey); err != nil {
-		return nil, err
-	}
-	if err := cs.WriteACMEKey(pemBuf.Bytes()); err != nil {
-		return nil, err
-	}
-	return privKey, nil
-}
-
-func acmeClient(cs certStore) (*acme.Client, error) {
-	key, err := acmeKey(cs)
-	if err != nil {
-		return nil, fmt.Errorf("acmeKey: %w", err)
-	}
-	// Note: if we add support for additional ACME providers (other than
-	// LetsEncrypt), we should make sure that they support ARI extension (see
-	// shouldStartDomainRenewalARI).
-	return &acme.Client{
-		Key:          key,
-		UserAgent:    "tailscaled/" + version.Long(),
-		DirectoryURL: envknob.String("TS_DEBUG_ACME_DIRECTORY_URL"),
-	}, nil
-}
-
-// validCertPEM reports whether the given certificate is valid for domain at now.
-//
-// If roots != nil, it is used instead of the system root pool. This is meant
-// to support testing; production code should pass roots == nil.
-func validCertPEM(domain string, keyPEM, certPEM []byte, roots *x509.CertPool, now time.Time) bool {
-	if len(keyPEM) == 0 || len(certPEM) == 0 {
-		return false
-	}
-	tlsCert, err := tls.X509KeyPair(certPEM, keyPEM)
-	if err != nil {
-		return false
-	}
-
-	var leaf *x509.Certificate
-	intermediates := x509.NewCertPool()
-	for i, certDER := range tlsCert.Certificate {
-		cert, err := x509.ParseCertificate(certDER)
-		if err != nil {
-			return false
-		}
-		if i == 0 {
-			leaf = cert
-		} else {
-			intermediates.AddCert(cert)
-		}
-	}
-	return validateLeaf(leaf, intermediates, domain, now, roots)
-}
-
-// validateLeaf is a helper for [validCertPEM].
-//
-// If called with roots == nil, it will use the system root pool as well as the
-// baked-in roots. If non-nil, only those roots are used.
-func validateLeaf(leaf *x509.Certificate, intermediates *x509.CertPool, domain string, now time.Time, roots *x509.CertPool) bool {
-	if leaf == nil {
-		return false
-	}
-	_, err := leaf.Verify(x509.VerifyOptions{
-		DNSName:       domain,
-		CurrentTime:   now,
-		Roots:         roots,
-		Intermediates: intermediates,
+		w.Header().Set("Content-Type", "application/json")
+		io.WriteString(w, `{"Missing":true}`) // a minimal tailcfg.C2NTLSCertInfo
 	})
-	if err != nil && roots == nil {
-		// If validation failed and they specified nil for roots (meaning to use
-		// the system roots), then give it another chance to validate using the
-		// binary's baked-in roots (LetsEncrypt). See tailscale/tailscale#14690.
-		return validateLeaf(leaf, intermediates, domain, now, bakedroots.Get())
-	}
-
-	if err == nil {
-		return true
-	}
-
-	// When pointed at a non-prod ACME server, we don't expect to have the CA
-	// in our system or baked-in roots. Verify only throws UnknownAuthorityError
-	// after first checking the leaf cert's expiry, hostnames etc, so we know
-	// that the only reason for an error is to do with constructing a full chain.
-	// Allow this error so that cert caching still works in testing environments.
-	if errors.As(err, &x509.UnknownAuthorityError{}) {
-		acmeURL := envknob.String("TS_DEBUG_ACME_DIRECTORY_URL")
-		if !isDefaultDirectoryURL(acmeURL) {
-			return true
-		}
-	}
-
-	return false
 }
 
-func isDefaultDirectoryURL(u string) bool {
-	return u == "" || u == acme.LetsEncryptURL
+// GetCertPEM returns a TLSCertKeyPair for domain, either from the local
+// cache or by issuing a new cert via ACME. See
+// [LocalBackend.GetCertPEMWithValidity] for the full semantics.
+func (b *LocalBackend) GetCertPEM(ctx context.Context, domain string) (*TLSCertKeyPair, error) {
+	return b.GetCertPEMWithValidity(ctx, domain, 0)
 }
 
-// validLookingCertDomain reports whether name looks like a valid domain name that
-// we might be able to get a cert for.
+// GetCertPEMWithValidity is like [LocalBackend.GetCertPEM] but with a
+// minimum cert validity duration. If the cached cert would expire
+// sooner than minValidity, it is renewed synchronously.
 //
-// It's a light check primarily for double checking before it's used
-// as part of a filesystem path. The actual validation happens in resolveCertDomain.
-func validLookingCertDomain(name string) bool {
-	if name == "" ||
-		strings.Contains(name, "..") ||
-		strings.ContainsAny(name, ":/\\\x00") ||
-		!strings.Contains(name, ".") {
-		return false
+// The domain must be one of:
+//
+//   - An exact CertDomain (e.g., "node.ts.net")
+//   - A wildcard domain (e.g., "*.node.ts.net")
+//   - A bring-your-own Funnel domain referenced by the local serve
+//     config (e.g., "foo.com" when ServeConfig.AllowFunnel has
+//     "foo.com:443").
+//
+// On an ACME rate-limit failure the returned error implements
+// [tsweb.HTTPStatuser] with a 429 + Retry-After response; other errors
+// are returned unchanged.
+func (b *LocalBackend) GetCertPEMWithValidity(ctx context.Context, domain string, minValidity time.Duration) (*TLSCertKeyPair, error) {
+	if f, ok := HookGetCertPEM.GetOk(); ok {
+		return f(ctx, b, domain, minValidity)
 	}
-	// Only allow * as a wildcard prefix "*.domain.tld"
-	if rest, ok := strings.CutPrefix(name, "*."); ok {
-		if strings.Contains(rest, "*") || !strings.Contains(rest, ".") {
-			return false
-		}
-	} else if strings.Contains(name, "*") {
-		return false
-	}
-	return true
+	return nil, errNoCerts
 }
 
-// resolveCertDomain validates a domain and returns the cert domain to use.
-//
-//   - "node.ts.net" -> "node.ts.net" (exact CertDomain match)
-//   - "*.node.ts.net" -> "*.node.ts.net" (explicit wildcard, requires NodeAttrDNSSubdomainResolve)
-//
-// Subdomain requests like "app.node.ts.net" are rejected; callers should
-// request "*.node.ts.net" explicitly for subdomain coverage.
-func (b *LocalBackend) resolveCertDomain(domain string) (string, error) {
-	if domain == "" {
-		return "", errors.New("missing domain name")
+// getACMETLSALPNCert returns the short-lived ACME challenge certificate
+// for hi.ServerName, if any. The ok result reports whether hi offered
+// acme-tls/1 and an ACME order is actively waiting on that challenge
+// for hi.ServerName.
+func (b *LocalBackend) getACMETLSALPNCert(hi *tls.ClientHelloInfo) (*tls.Certificate, bool) {
+	if f, ok := HookGetACMETLSALPNCert.GetOk(); ok {
+		return f(b, hi)
 	}
-
-	// Read the netmap once to get both CertDomains and capabilities atomically.
-	nm := b.NetMap()
-	if nm == nil {
-		return "", errors.New("no netmap available")
-	}
-	certDomains := nm.DNS.CertDomains
-	if len(certDomains) == 0 {
-		return "", errors.New("your Tailscale account does not support getting TLS certs")
-	}
-
-	// Wildcard request like "*.node.ts.net".
-	if base, ok := strings.CutPrefix(domain, "*."); ok {
-		if !nm.AllCaps.Contains(tailcfg.NodeAttrDNSSubdomainResolve) {
-			return "", fmt.Errorf("wildcard certificates are not enabled for this node")
-		}
-		if !slices.Contains(certDomains, base) {
-			return "", fmt.Errorf("invalid domain %q; wildcard certificates are not enabled for this domain", domain)
-		}
-		return domain, nil
-	}
-
-	// Exact CertDomain match.
-	if slices.Contains(certDomains, domain) {
-		return domain, nil
-	}
-
-	return "", fmt.Errorf("invalid domain %q; must be one of %q", domain, certDomains)
+	return nil, false
 }
 
-// handleC2NTLSCertStatus returns info about the last TLS certificate issued for the
-// provided domain. This can be called by the controlplane to clean up DNS TXT
-// records when they're no longer needed by LetsEncrypt.
-//
-// It does not kick off a cert fetch or async refresh. It only reports anything
-// that's already sitting on disk, and only reports metadata about the public
-// cert (stuff that'd be the in CT logs anyway).
-func handleC2NTLSCertStatus(b *LocalBackend, w http.ResponseWriter, r *http.Request) {
-	cs, err := b.getCertStore()
-	if err != nil {
-		http.Error(w, err.Error(), http.StatusInternalServerError)
-		return
+// getACMETLSALPNProto reports whether serveTLSConfig should advertise
+// an ACME ALPN protocol for this ClientHello.
+func (b *LocalBackend) getACMETLSALPNProto(hi *tls.ClientHelloInfo) (string, bool) {
+	if f, ok := HookGetACMETLSALPNProto.GetOk(); ok {
+		return f(b, hi)
 	}
+	return "", false
+}
 
-	domain := r.FormValue("domain")
-	if domain == "" {
-		http.Error(w, "no 'domain'", http.StatusBadRequest)
-		return
+// updateCertRefreshLoopLocked is called when b.state or b.serveConfig
+// changes, so the cert refresh loop can be (re)started or stopped.
+// b.mu must be held.
+func (b *LocalBackend) updateCertRefreshLoopLocked() {
+	if f, ok := HookUpdateCertRefreshLoop.GetOk(); ok {
+		f(b, b.state, b.serveConfig)
 	}
+}
 
-	ret := &tailcfg.C2NTLSCertInfo{}
-	pair, err := getCertPEMCached(cs, domain, b.clock.Now())
-	ret.Valid = err == nil
-	if err != nil {
-		ret.Error = err.Error()
-		if errors.Is(err, errCertExpired) {
-			ret.Expired = true
-		} else if errors.Is(err, ipn.ErrStateNotExist) {
-			ret.Missing = true
-			ret.Error = "no certificate"
-		}
-	} else {
-		block, _ := pem.Decode(pair.CertPEM)
-		if block == nil {
-			ret.Error = "invalid PEM"
-			ret.Valid = false
-		} else {
-			cert, err := x509.ParseCertificate(block.Bytes)
-			if err != nil {
-				ret.Error = fmt.Sprintf("invalid certificate: %v", err)
-				ret.Valid = false
-			} else {
-				ret.NotBefore = cert.NotBefore.UTC().Format(time.RFC3339)
-				ret.NotAfter = cert.NotAfter.UTC().Format(time.RFC3339)
-			}
-		}
+// shutdownCertRefreshLoopLocked is called from
+// [LocalBackend.Shutdown] to cancel the cert refresh loop.
+// b.mu must be held.
+func (b *LocalBackend) shutdownCertRefreshLoopLocked() {
+	if f, ok := HookShutdownCertRefreshLoop.GetOk(); ok {
+		f(b)
 	}
+}
 
-	writeJSON(w, ret)
+// serveTLSNextProtos returns the baseline ALPN protocols for ordinary
+// Serve TLS traffic. ACME tls-alpn-01 is intentionally not advertised
+// here; it is added dynamically by serveTLSConfig only while a matching
+// challenge certificate is pending.
+func serveTLSNextProtos() []string {
+	return []string{"h2", "http/1.1"}
 }
diff --git a/ipn/ipnlocal/cert_disabled.go b/ipn/ipnlocal/cert_disabled.go
deleted file mode 100644
index 0caab6bc3..000000000
--- a/ipn/ipnlocal/cert_disabled.go
+++ /dev/null
@@ -1,45 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-//go:build js || ts_omit_acme
-
-package ipnlocal
-
-import (
-	"context"
-	"errors"
-	"io"
-	"net/http"
-	"time"
-)
-
-func init() {
-	RegisterC2N("GET /tls-cert-status", handleC2NTLSCertStatusDisabled)
-}
-
-var errNoCerts = errors.New("cert support not compiled in this build")
-
-type TLSCertKeyPair struct {
-	CertPEM, KeyPEM []byte
-}
-
-func (b *LocalBackend) GetCertPEM(ctx context.Context, domain string) (*TLSCertKeyPair, error) {
-	return nil, errNoCerts
-}
-
-var errCertExpired = errors.New("cert expired")
-
-type certStore interface{}
-
-func getCertPEMCached(cs certStore, domain string, now time.Time) (p *TLSCertKeyPair, err error) {
-	return nil, errNoCerts
-}
-
-func (b *LocalBackend) getCertStore() (certStore, error) {
-	return nil, errNoCerts
-}
-
-func handleC2NTLSCertStatusDisabled(b *LocalBackend, w http.ResponseWriter, r *http.Request) {
-	w.Header().Set("Content-Type", "application/json")
-	io.WriteString(w, `{"Missing":true}`) // a minimal tailcfg.C2NTLSCertInfo
-}
diff --git a/ipn/ipnlocal/cert_test.go b/ipn/ipnlocal/cert_test.go
deleted file mode 100644
index e2d69da52..000000000
--- a/ipn/ipnlocal/cert_test.go
+++ /dev/null
@@ -1,587 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-//go:build !ios && !android && !js
-
-package ipnlocal
-
-import (
-	"context"
-	"crypto/ecdsa"
-	"crypto/elliptic"
-	"crypto/rand"
-	"crypto/x509"
-	"crypto/x509/pkix"
-	"embed"
-	"encoding/pem"
-	"math/big"
-	"os"
-	"path/filepath"
-	"slices"
-	"testing"
-	"time"
-
-	"github.com/google/go-cmp/cmp"
-	"tailscale.com/envknob"
-	"tailscale.com/ipn/store/mem"
-	"tailscale.com/tailcfg"
-	"tailscale.com/tstest"
-	"tailscale.com/types/logger"
-	"tailscale.com/types/netmap"
-	"tailscale.com/util/must"
-	"tailscale.com/util/set"
-)
-
-func TestCertRequest(t *testing.T) {
-	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
-	if err != nil {
-		t.Fatalf("GenerateKey: %v", err)
-	}
-
-	tests := []struct {
-		name     string
-		domain   string
-		wantSANs []string
-	}{
-		{
-			name:     "example-com",
-			domain:   "example.com",
-			wantSANs: []string{"example.com"},
-		},
-		{
-			name:     "wildcard-example-com",
-			domain:   "*.example.com",
-			wantSANs: []string{"*.example.com", "example.com"},
-		},
-		{
-			name:     "wildcard-foo-bar-com",
-			domain:   "*.foo.bar.com",
-			wantSANs: []string{"*.foo.bar.com", "foo.bar.com"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			csrDER, err := certRequest(key, tt.domain, nil)
-			if err != nil {
-				t.Fatalf("certRequest: %v", err)
-			}
-			csr, err := x509.ParseCertificateRequest(csrDER)
-			if err != nil {
-				t.Fatalf("ParseCertificateRequest: %v", err)
-			}
-			if csr.Subject.CommonName != tt.domain {
-				t.Errorf("CommonName = %q, want %q", csr.Subject.CommonName, tt.domain)
-			}
-			if !slices.Equal(csr.DNSNames, tt.wantSANs) {
-				t.Errorf("DNSNames = %v, want %v", csr.DNSNames, tt.wantSANs)
-			}
-		})
-	}
-}
-
-func TestResolveCertDomain(t *testing.T) {
-	tests := []struct {
-		name        string
-		domain      string
-		certDomains []string
-		hasCap      bool
-		skipNetmap  bool
-		want        string
-		wantErr     string
-	}{
-		{
-			name:        "exact_match",
-			domain:      "node.ts.net",
-			certDomains: []string{"node.ts.net"},
-			want:        "node.ts.net",
-		},
-		{
-			name:        "exact_match_with_cap",
-			domain:      "node.ts.net",
-			certDomains: []string{"node.ts.net"},
-			hasCap:      true,
-			want:        "node.ts.net",
-		},
-		{
-			name:        "wildcard_with_cap",
-			domain:      "*.node.ts.net",
-			certDomains: []string{"node.ts.net"},
-			hasCap:      true,
-			want:        "*.node.ts.net",
-		},
-		{
-			name:        "wildcard_without_cap",
-			domain:      "*.node.ts.net",
-			certDomains: []string{"node.ts.net"},
-			hasCap:      false,
-			wantErr:     "wildcard certificates are not enabled for this node",
-		},
-		{
-			name:        "subdomain_with_cap_rejected",
-			domain:      "app.node.ts.net",
-			certDomains: []string{"node.ts.net"},
-			hasCap:      true,
-			wantErr:     `invalid domain "app.node.ts.net"; must be one of ["node.ts.net"]`,
-		},
-		{
-			name:        "subdomain_without_cap_rejected",
-			domain:      "app.node.ts.net",
-			certDomains: []string{"node.ts.net"},
-			hasCap:      false,
-			wantErr:     `invalid domain "app.node.ts.net"; must be one of ["node.ts.net"]`,
-		},
-		{
-			name:        "multi_level_subdomain_rejected",
-			domain:      "a.b.node.ts.net",
-			certDomains: []string{"node.ts.net"},
-			hasCap:      true,
-			wantErr:     `invalid domain "a.b.node.ts.net"; must be one of ["node.ts.net"]`,
-		},
-		{
-			name:        "wildcard_no_matching_parent",
-			domain:      "*.unrelated.ts.net",
-			certDomains: []string{"node.ts.net"},
-			hasCap:      true,
-			wantErr:     `invalid domain "*.unrelated.ts.net"; wildcard certificates are not enabled for this domain`,
-		},
-		{
-			name:        "subdomain_unrelated_rejected",
-			domain:      "app.unrelated.ts.net",
-			certDomains: []string{"node.ts.net"},
-			hasCap:      true,
-			wantErr:     `invalid domain "app.unrelated.ts.net"; must be one of ["node.ts.net"]`,
-		},
-		{
-			name:        "no_cert_domains",
-			domain:      "node.ts.net",
-			certDomains: nil,
-			wantErr:     "your Tailscale account does not support getting TLS certs",
-		},
-		{
-			name:        "wildcard_no_cert_domains",
-			domain:      "*.foo.ts.net",
-			certDomains: nil,
-			hasCap:      true,
-			wantErr:     "your Tailscale account does not support getting TLS certs",
-		},
-		{
-			name:        "empty_domain",
-			domain:      "",
-			certDomains: []string{"node.ts.net"},
-			wantErr:     "missing domain name",
-		},
-		{
-			name:       "nil_netmap",
-			domain:     "node.ts.net",
-			skipNetmap: true,
-			wantErr:    "no netmap available",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			b := newTestLocalBackend(t)
-
-			if !tt.skipNetmap {
-				// Set up netmap with CertDomains and capability
-				var allCaps set.Set[tailcfg.NodeCapability]
-				if tt.hasCap {
-					allCaps = set.Of(tailcfg.NodeAttrDNSSubdomainResolve)
-				}
-				b.mu.Lock()
-				b.currentNode().SetNetMap(&netmap.NetworkMap{
-					SelfNode: (&tailcfg.Node{}).View(),
-					DNS: tailcfg.DNSConfig{
-						CertDomains: tt.certDomains,
-					},
-					AllCaps: allCaps,
-				})
-				b.mu.Unlock()
-			}
-
-			got, err := b.resolveCertDomain(tt.domain)
-			if tt.wantErr != "" {
-				if err == nil {
-					t.Errorf("resolveCertDomain(%q) = %q, want error %q", tt.domain, got, tt.wantErr)
-				} else if err.Error() != tt.wantErr {
-					t.Errorf("resolveCertDomain(%q) error = %q, want %q", tt.domain, err.Error(), tt.wantErr)
-				}
-				return
-			}
-			if err != nil {
-				t.Errorf("resolveCertDomain(%q) error = %v, want nil", tt.domain, err)
-				return
-			}
-			if got != tt.want {
-				t.Errorf("resolveCertDomain(%q) = %q, want %q", tt.domain, got, tt.want)
-			}
-		})
-	}
-}
-
-func TestValidLookingCertDomain(t *testing.T) {
-	tests := []struct {
-		in   string
-		want bool
-	}{
-		{"foo.com", true},
-		{"foo..com", false},
-		{"foo/com.com", false},
-		{"NUL", false},
-		{"", false},
-		{"foo\\bar.com", false},
-		{"foo\x00bar.com", false},
-		// Wildcard tests
-		{"*.foo.com", true},
-		{"*.foo.bar.com", true},
-		{"*foo.com", false},      // must be *.
-		{"*.com", false},         // must have domain after *.
-		{"*.", false},            // must have domain after *.
-		{"*.*.foo.com", false},   // no nested wildcards
-		{"foo.*.bar.com", false}, // no wildcard mid-string
-		{"app.foo.com", true},    // regular subdomain
-		{"*", false},             // bare asterisk
-	}
-	for _, tt := range tests {
-		if got := validLookingCertDomain(tt.in); got != tt.want {
-			t.Errorf("validLookingCertDomain(%q) = %v, want %v", tt.in, got, tt.want)
-		}
-	}
-}
-
-//go:embed testdata/*
-var certTestFS embed.FS
-
-func TestCertStoreRoundTrip(t *testing.T) {
-	const testDomain = "example.com"
-
-	// Use fixed verification timestamps so validity doesn't change over time.
-	// If you update the test data below, these may also need to be updated.
-	testNow := time.Date(2023, time.February, 10, 0, 0, 0, 0, time.UTC)
-	testExpired := time.Date(2026, time.February, 10, 0, 0, 0, 0, time.UTC)
-
-	// To re-generate a root certificate and domain certificate for testing,
-	// use:
-	//
-	//   	go run filippo.io/mkcert@latest example.com
-	//
-	// The content is not important except to be structurally valid so we can be
-	// sure the round-trip succeeds.
-	testRoot, err := certTestFS.ReadFile("testdata/rootCA.pem")
-	if err != nil {
-		t.Fatal(err)
-	}
-	roots := x509.NewCertPool()
-	if !roots.AppendCertsFromPEM(testRoot) {
-		t.Fatal("Unable to add test CA to the cert pool")
-	}
-
-	testCert, err := certTestFS.ReadFile("testdata/example.com.pem")
-	if err != nil {
-		t.Fatal(err)
-	}
-	testKey, err := certTestFS.ReadFile("testdata/example.com-key.pem")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	tests := []struct {
-		name         string
-		store        certStore
-		debugACMEURL bool
-	}{
-		{"FileStore", certFileStore{dir: t.TempDir(), testRoots: roots}, false},
-		{"FileStore_UnknownCA", certFileStore{dir: t.TempDir()}, true},
-		{"StateStore", certStateStore{StateStore: new(mem.Store), testRoots: roots}, false},
-		{"StateStore_UnknownCA", certStateStore{StateStore: new(mem.Store)}, true},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			if test.debugACMEURL {
-				t.Setenv("TS_DEBUG_ACME_DIRECTORY_URL", "https://acme-staging-v02.api.letsencrypt.org/directory")
-			}
-			if err := test.store.WriteTLSCertAndKey(testDomain, testCert, testKey); err != nil {
-				t.Fatalf("WriteTLSCertAndKey: unexpected error: %v", err)
-			}
-			kp, err := test.store.Read(testDomain, testNow)
-			if err != nil {
-				t.Fatalf("Read: unexpected error: %v", err)
-			}
-			if diff := cmp.Diff(kp.CertPEM, testCert); diff != "" {
-				t.Errorf("Certificate (-got, +want):\n%s", diff)
-			}
-			if diff := cmp.Diff(kp.KeyPEM, testKey); diff != "" {
-				t.Errorf("Key (-got, +want):\n%s", diff)
-			}
-			unexpected, err := test.store.Read(testDomain, testExpired)
-			if err != errCertExpired {
-				t.Fatalf("Read: expected expiry error: %v", string(unexpected.CertPEM))
-			}
-		})
-	}
-}
-
-func TestShouldStartDomainRenewal(t *testing.T) {
-	reset := func() {
-		renewMu.Lock()
-		defer renewMu.Unlock()
-		clear(renewCertAt)
-	}
-
-	mustMakePair := func(template *x509.Certificate) *TLSCertKeyPair {
-		priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
-		if err != nil {
-			panic(err)
-		}
-
-		b, err := x509.CreateCertificate(rand.Reader, template, template, &priv.PublicKey, priv)
-		if err != nil {
-			panic(err)
-		}
-		certPEM := pem.EncodeToMemory(&pem.Block{
-			Type:  "CERTIFICATE",
-			Bytes: b,
-		})
-
-		return &TLSCertKeyPair{
-			Cached:  false,
-			CertPEM: certPEM,
-			KeyPEM:  []byte("unused"),
-		}
-	}
-
-	now := time.Unix(1685714838, 0)
-	subject := pkix.Name{
-		Organization:  []string{"Tailscale, Inc."},
-		Country:       []string{"CA"},
-		Province:      []string{"ON"},
-		Locality:      []string{"Toronto"},
-		StreetAddress: []string{"290 Bremner Blvd"},
-		PostalCode:    []string{"M5V 3L9"},
-	}
-
-	testCases := []struct {
-		name      string
-		notBefore time.Time
-		lifetime  time.Duration
-		want      bool
-		wantErr   string
-	}{
-		{
-			name:      "should-renew",
-			notBefore: now.AddDate(0, 0, -89),
-			lifetime:  90 * 24 * time.Hour,
-			want:      true,
-		},
-		{
-			name:      "short-lived-renewal",
-			notBefore: now.AddDate(0, 0, -7),
-			lifetime:  10 * 24 * time.Hour,
-			want:      true,
-		},
-		{
-			name:      "no-renew",
-			notBefore: now.AddDate(0, 0, -59), // 59 days ago == not 2/3rds of the way through 90 days yet
-			lifetime:  90 * 24 * time.Hour,
-			want:      false,
-		},
-	}
-	b := new(LocalBackend)
-	for _, tt := range testCases {
-		t.Run(tt.name, func(t *testing.T) {
-			reset()
-
-			ret, err := b.domainRenewalTimeByExpiry(mustMakePair(&x509.Certificate{
-				SerialNumber: big.NewInt(2019),
-				Subject:      subject,
-				NotBefore:    tt.notBefore,
-				NotAfter:     tt.notBefore.Add(tt.lifetime),
-			}))
-
-			if tt.wantErr != "" {
-				if err == nil {
-					t.Errorf("wanted error, got nil")
-				} else if err.Error() != tt.wantErr {
-					t.Errorf("got err=%q, want %q", err.Error(), tt.wantErr)
-				}
-			} else {
-				renew := now.After(ret)
-				if renew != tt.want {
-					t.Errorf("got renew=%v (ret=%v), want renew %v", renew, ret, tt.want)
-				}
-			}
-		})
-	}
-}
-
-func TestDebugACMEDirectoryURL(t *testing.T) {
-	for _, tc := range []string{"", "https://acme-staging-v02.api.letsencrypt.org/directory"} {
-		const setting = "TS_DEBUG_ACME_DIRECTORY_URL"
-		t.Run(tc, func(t *testing.T) {
-			t.Setenv(setting, tc)
-			ac, err := acmeClient(certStateStore{StateStore: new(mem.Store)})
-			if err != nil {
-				t.Fatalf("acmeClient creation err: %v", err)
-			}
-			if ac.DirectoryURL != tc {
-				t.Fatalf("acmeClient.DirectoryURL = %q, want %q", ac.DirectoryURL, tc)
-			}
-		})
-	}
-}
-
-func TestGetCertPEMWithValidity(t *testing.T) {
-	const testDomain = "example.com"
-	b := newTestLocalBackend(t)
-	b.varRoot = t.TempDir()
-
-	// Set up netmap with CertDomains so resolveCertDomain works
-	b.mu.Lock()
-	b.currentNode().SetNetMap(&netmap.NetworkMap{
-		SelfNode: (&tailcfg.Node{}).View(),
-		DNS: tailcfg.DNSConfig{
-			CertDomains: []string{testDomain},
-		},
-	})
-	b.mu.Unlock()
-
-	certDir, err := b.certDir()
-	if err != nil {
-		t.Fatalf("certDir error: %v", err)
-	}
-	if _, err := b.getCertStore(); err != nil {
-		t.Fatalf("getCertStore error: %v", err)
-	}
-	testRoot, err := certTestFS.ReadFile("testdata/rootCA.pem")
-	if err != nil {
-		t.Fatal(err)
-	}
-	roots := x509.NewCertPool()
-	if !roots.AppendCertsFromPEM(testRoot) {
-		t.Fatal("Unable to add test CA to the cert pool")
-	}
-	testX509Roots = roots
-	defer func() { testX509Roots = nil }()
-	tests := []struct {
-		name string
-		now  time.Time
-		// storeCerts is true if the test cert and key should be written to store.
-		storeCerts       bool
-		readOnlyMode     bool // TS_READ_ONLY_CERTS env var
-		wantAsyncRenewal bool // async issuance should be started
-		wantIssuance     bool // sync issuance should be started
-		wantErr          bool
-	}{
-		{
-			name:             "valid_no_renewal",
-			now:              time.Date(2023, time.February, 20, 0, 0, 0, 0, time.UTC),
-			storeCerts:       true,
-			wantAsyncRenewal: false,
-			wantIssuance:     false,
-			wantErr:          false,
-		},
-		{
-			name:             "issuance_needed",
-			now:              time.Date(2023, time.February, 20, 0, 0, 0, 0, time.UTC),
-			storeCerts:       false,
-			wantAsyncRenewal: false,
-			wantIssuance:     true,
-			wantErr:          false,
-		},
-		{
-			name:             "renewal_needed",
-			now:              time.Date(2025, time.May, 1, 0, 0, 0, 0, time.UTC),
-			storeCerts:       true,
-			wantAsyncRenewal: true,
-			wantIssuance:     false,
-			wantErr:          false,
-		},
-		{
-			name:             "renewal_needed_read_only_mode",
-			now:              time.Date(2025, time.May, 1, 0, 0, 0, 0, time.UTC),
-			storeCerts:       true,
-			readOnlyMode:     true,
-			wantAsyncRenewal: false,
-			wantIssuance:     false,
-			wantErr:          false,
-		},
-		{
-			name:             "no_certs_read_only_mode",
-			now:              time.Date(2025, time.May, 1, 0, 0, 0, 0, time.UTC),
-			storeCerts:       false,
-			readOnlyMode:     true,
-			wantAsyncRenewal: false,
-			wantIssuance:     false,
-			wantErr:          true,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-
-			if tt.readOnlyMode {
-				envknob.Setenv("TS_CERT_SHARE_MODE", "ro")
-			}
-
-			os.RemoveAll(certDir)
-			if tt.storeCerts {
-				os.MkdirAll(certDir, 0755)
-				if err := os.WriteFile(filepath.Join(certDir, "example.com.crt"),
-					must.Get(os.ReadFile("testdata/example.com.pem")), 0644); err != nil {
-					t.Fatal(err)
-				}
-				if err := os.WriteFile(filepath.Join(certDir, "example.com.key"),
-					must.Get(os.ReadFile("testdata/example.com-key.pem")), 0644); err != nil {
-					t.Fatal(err)
-				}
-			}
-
-			b.clock = tstest.NewClock(tstest.ClockOpts{Start: tt.now})
-
-			allDone := make(chan bool, 1)
-			defer b.goTracker.AddDoneCallback(func() {
-				b.mu.Lock()
-				defer b.mu.Unlock()
-				if b.goTracker.RunningGoroutines() > 0 {
-					return
-				}
-				select {
-				case allDone <- true:
-				default:
-				}
-			})()
-
-			// Set to true if get getCertPEM is called. GetCertPEM can be called in a goroutine for async
-			// renewal or in the main goroutine if issuance is required to obtain valid TLS credentials.
-			getCertPemWasCalled := false
-			getCertPEM = func(ctx context.Context, b *LocalBackend, cs certStore, logf logger.Logf, traceACME func(any), domain string, now time.Time, minValidity time.Duration) (*TLSCertKeyPair, error) {
-				getCertPemWasCalled = true
-				return nil, nil
-			}
-			prevGoRoutines := b.goTracker.StartedGoroutines()
-			_, err = b.GetCertPEMWithValidity(context.Background(), testDomain, 0)
-			if (err != nil) != tt.wantErr {
-				t.Errorf("b.GetCertPemWithValidity got err %v, wants error: '%v'", err, tt.wantErr)
-			}
-			// GetCertPEMWithValidity calls getCertPEM in a goroutine if async renewal is needed. That's the
-			// only goroutine it starts, so this can be used to test if async renewal was started.
-			gotAsyncRenewal := b.goTracker.StartedGoroutines()-prevGoRoutines != 0
-			if gotAsyncRenewal {
-				select {
-				case <-time.After(5 * time.Second):
-					t.Fatal("timed out waiting for goroutines to finish")
-				case <-allDone:
-				}
-			}
-			// Verify that async renewal was triggered if expected.
-			if tt.wantAsyncRenewal != gotAsyncRenewal {
-				t.Fatalf("wants getCertPem to be called async: %v, got called %v", tt.wantAsyncRenewal, gotAsyncRenewal)
-			}
-			// Verify that (non-async) issuance was started if expected.
-			gotIssuance := getCertPemWasCalled && !gotAsyncRenewal
-			if tt.wantIssuance != gotIssuance {
-				t.Errorf("wants getCertPem to be called: %v, got called %v", tt.wantIssuance, gotIssuance)
-			}
-		})
-	}
-}
diff --git a/ipn/ipnlocal/diskcache.go b/ipn/ipnlocal/diskcache.go
index 03ced7967..91fe728a8 100644
--- a/ipn/ipnlocal/diskcache.go
+++ b/ipn/ipnlocal/diskcache.go
@@ -10,6 +10,7 @@ import (
 
 	"tailscale.com/feature/buildfeatures"
 	"tailscale.com/ipn/ipnlocal/netmapcache"
+	"tailscale.com/tailcfg"
 	"tailscale.com/types/netmap"
 )
 
@@ -21,12 +22,57 @@ type diskCache struct {
 	cache *netmapcache.Cache
 }
 
-func (b *LocalBackend) writeNetmapToDiskLocked(nm *netmap.NetworkMap) error {
+// writePeerDeltaToDiskLocked applies the specified peer delta to the cache,
+// leaving other existing cached fields (self, profiles, other peers not
+// mentioned in the arguments) unchanged.  It does nothing (without error) if
+// both slices are empty.
+func (b *LocalBackend) writePeerDeltaToDiskLocked(update []tailcfg.NodeView, remove []tailcfg.StableNodeID) error {
+	if !buildfeatures.HasCacheNetMap || (len(update) == 0 && len(remove) == 0) {
+		return nil
+	} else if err := b.ensureDiskCacheLocked(); err != nil {
+		return err
+	}
+	// Do not log this, we get deltas all the time and it's very noisy.
+	return b.diskCache.cache.UpdatePeers(b.currentNode().Context(), update, remove)
+}
+
+// writeNetmapToDiskLockedWithoutPeers updates nm in the cache, excluding peers and profiles.
+func (b *LocalBackend) writeNetmapToDiskLockedWithoutPeers(nm *netmap.NetworkMap) error {
 	if !buildfeatures.HasCacheNetMap || nm == nil || nm.Cached {
 		return nil
+	} else if err := b.ensureDiskCacheLocked(); err != nil {
+		return err
+	}
+	b.logf("updating netmap in disk cache")
+	return b.diskCache.cache.UpdateSelfOnly(b.currentNode().Context(), b.patchNetmapHomeDERPLocked(nm))
+}
+
+// writeNetmapToDiskLockedWithPeers writes nm into the cache, including peers and profiles.
+func (b *LocalBackend) writeNetmapToDiskLockedWithPeers(nm *netmap.NetworkMap) error {
+	if !buildfeatures.HasCacheNetMap || nm == nil || nm.Cached {
+		return nil
+	} else if err := b.ensureDiskCacheLocked(); err != nil {
+		return err
 	}
 	b.logf("writing netmap to disk cache")
+	return b.diskCache.cache.Store(b.currentNode().Context(), b.patchNetmapHomeDERPLocked(nm))
+}
 
+func (b *LocalBackend) patchNetmapHomeDERPLocked(nm *netmap.NetworkMap) *netmap.NetworkMap {
+	// Set the homeDERP on the self node before saving. The self node homeDERP is
+	// generally not used since the homeDERP for self is stored in magicsock, but
+	// to be able to load it during loading the cache, we use the existing field
+	// to save it.
+
+	// Make a shallow copy and mutate a copy of the selfNode.
+	nmCopy := *nm
+	selfNode := nm.SelfNode.AsStruct()
+	selfNode.HomeDERP = int(b.currentNode().homeDERP.Load())
+	nmCopy.SelfNode = selfNode.View()
+	return &nmCopy
+}
+
+func (b *LocalBackend) ensureDiskCacheLocked() error {
 	dir, err := b.profileMkdirAllLocked(b.pm.CurrentProfile().ID(), "netmap-cache")
 	if err != nil {
 		return err
@@ -35,7 +81,7 @@ func (b *LocalBackend) writeNetmapToDiskLocked(nm *netmap.NetworkMap) error {
 		b.diskCache.cache = netmapcache.NewCache(netmapcache.FileStore(dir))
 		b.diskCache.dir = dir
 	}
-	return b.diskCache.cache.Store(b.currentNode().Context(), nm)
+	return nil
 }
 
 func (b *LocalBackend) loadDiskCacheLocked() (om *netmap.NetworkMap, ok bool) {
diff --git a/ipn/ipnlocal/diskcache_test.go b/ipn/ipnlocal/diskcache_test.go
new file mode 100644
index 000000000..48f09b46f
--- /dev/null
+++ b/ipn/ipnlocal/diskcache_test.go
@@ -0,0 +1,229 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package ipnlocal
+
+import (
+	"net/netip"
+	"testing"
+
+	"tailscale.com/tailcfg"
+	"tailscale.com/tstest"
+	"tailscale.com/types/netmap"
+	"tailscale.com/util/eventbus"
+	"tailscale.com/wgengine/magicsock"
+)
+
+// newCacheTestNetmap returns a minimal valid netmap suitable for testing disk
+// cache operations.
+func newCacheTestNetmap() *netmap.NetworkMap {
+	return &netmap.NetworkMap{
+		SelfNode: (&tailcfg.Node{
+			Name: "test-node.ts.net",
+			User: tailcfg.UserID(1),
+			Addresses: []netip.Prefix{
+				netip.MustParsePrefix("100.64.0.1/32"),
+			},
+		}).View(),
+		UserProfiles: map[tailcfg.UserID]tailcfg.UserProfileView{
+			tailcfg.UserID(1): (&tailcfg.UserProfile{
+				LoginName:   "user@example.com",
+				DisplayName: "Test User",
+			}).View(),
+		},
+		DERPMap: &tailcfg.DERPMap{
+			Regions: map[int]*tailcfg.DERPRegion{
+				1:  {},
+				2:  {},
+				3:  {},
+				4:  {},
+				5:  {},
+				6:  {},
+				7:  {},
+				8:  {},
+				9:  {},
+				10: {},
+				11: {},
+			},
+		},
+	}
+}
+
+func TestWriteAndLoadHomeDERP(t *testing.T) {
+	b := newTestBackend(t)
+
+	nm := newCacheTestNetmap()
+	b.currentNode().SetNetMap(nm)
+
+	const wantDERP = 7
+	b.currentNode().homeDERP.Store(wantDERP)
+
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	if err := b.writeNetmapToDiskLockedWithPeers(nm); err != nil {
+		t.Fatalf("writeNetmapToDiskLocked: %v", err)
+	}
+
+	loaded, ok := b.loadDiskCacheLocked()
+	if !ok {
+		t.Fatal("loadDiskCacheLocked returned ok=false")
+	}
+	if !loaded.SelfNode.Valid() {
+		t.Fatal("loaded netmap SelfNode is invalid")
+	}
+	if got := loaded.SelfNode.HomeDERP(); got != wantDERP {
+		t.Errorf("loaded SelfNode.HomeDERP() = %d, want %d", got, wantDERP)
+	}
+}
+
+func TestOnHomeDERPUpdate(t *testing.T) {
+	t.Run("normal_derp_change", func(t *testing.T) {
+		b := newTestBackend(t)
+		done := make(chan struct{})
+		tstest.Replace(t, &testOnlyHomeDERPUpdate, func() { close(done) })
+
+		nm := newCacheTestNetmap()
+		b.currentNode().SetNetMap(nm)
+
+		// Publish a HomeDERPChanged event via the backend's event bus.
+		bus := b.Sys().Bus.Get()
+		ec := bus.Client("test.TestOnHomeDERPUpdate")
+		pub := eventbus.Publish[magicsock.HomeDERPChanged](ec)
+
+		const wantDERP = 11
+		pub.Publish(magicsock.HomeDERPChanged{Old: 0, New: wantDERP})
+		<-done
+
+		if got := b.currentNode().homeDERP.Load(); got != wantDERP {
+			t.Errorf("b.homeDERP = %d, want %d", got, wantDERP)
+		}
+
+		// Verify the value was persisted to the disk cache.
+		b.mu.Lock()
+		defer b.mu.Unlock()
+		loaded, ok := b.loadDiskCacheLocked()
+		if !ok {
+			t.Fatal("loadDiskCacheLocked returned ok=false after homeDERP update")
+		}
+		if got := loaded.SelfNode.HomeDERP(); got != wantDERP {
+			t.Errorf("cached SelfNode.HomeDERP() = %d, want %d", got, wantDERP)
+		}
+	})
+	t.Run("old_does_not_match", func(t *testing.T) {
+		b := newTestBackend(t)
+		done := make(chan struct{})
+		tstest.Replace(t, &testOnlyHomeDERPUpdate, func() { close(done) })
+
+		const setDERP = 11
+		const wantDERP = 4
+
+		nm := newCacheTestNetmap()
+		selfNode := nm.SelfNode.AsStruct()
+		selfNode.HomeDERP = wantDERP
+		nm.SelfNode = selfNode.View()
+		b.currentNode().SetNetMap(nm)
+		b.currentNode().homeDERP.Store(wantDERP)
+
+		// Write an initial cache entry so we can verify it is not overwritten.
+		b.mu.Lock()
+		if err := b.writeNetmapToDiskLockedWithPeers(nm); err != nil {
+			b.mu.Unlock()
+			t.Fatalf("setup writeNetmapToDiskLocked: %v", err)
+		}
+		b.mu.Unlock()
+
+		// Publish a HomeDERPChanged event via the backend's event bus.
+		bus := b.Sys().Bus.Get()
+		ec := bus.Client("test.TestOnHomeDERPUpdate")
+		pub := eventbus.Publish[magicsock.HomeDERPChanged](ec)
+		pub.Publish(magicsock.HomeDERPChanged{Old: wantDERP + 1, New: setDERP})
+		<-done
+
+		if got := b.currentNode().homeDERP.Load(); got != wantDERP {
+			t.Errorf("b.homeDERP = %d, wanted no change %d", got, wantDERP)
+		}
+
+		// Verify the cache still exists and still holds the original value.
+		b.mu.Lock()
+		defer b.mu.Unlock()
+		loaded, ok := b.loadDiskCacheLocked()
+		if !ok {
+			t.Fatal("loadDiskCacheLocked returned ok=false; expected cache to still exist")
+		}
+		if got := loaded.SelfNode.HomeDERP(); got != wantDERP {
+			t.Errorf("cached SelfNode.HomeDERP() = %d after rejected event, want original %d", got, wantDERP)
+		}
+	})
+	t.Run("new_does_not_exist_in_map", func(t *testing.T) {
+		b := newTestBackend(t)
+		done := make(chan struct{})
+		tstest.Replace(t, &testOnlyHomeDERPUpdate, func() { close(done) })
+
+		const setDERP = 111
+		const wantDERP = 4
+
+		nm := newCacheTestNetmap()
+		selfNode := nm.SelfNode.AsStruct()
+		selfNode.HomeDERP = wantDERP
+		nm.SelfNode = selfNode.View()
+		b.currentNode().SetNetMap(nm)
+		b.currentNode().homeDERP.Store(wantDERP)
+
+		// Write an initial cache entry so we can verify it is not overwritten.
+		b.mu.Lock()
+		if err := b.writeNetmapToDiskLockedWithPeers(nm); err != nil {
+			b.mu.Unlock()
+			t.Fatalf("setup writeNetmapToDiskLocked: %v", err)
+		}
+		b.mu.Unlock()
+
+		// Publish a HomeDERPChanged event via the backend's event bus.
+		// Old matches the stored homeDERP so only the "new region not in map"
+		// guard is exercised.
+		bus := b.Sys().Bus.Get()
+		ec := bus.Client("test.TestOnHomeDERPUpdate")
+		pub := eventbus.Publish[magicsock.HomeDERPChanged](ec)
+		pub.Publish(magicsock.HomeDERPChanged{Old: wantDERP, New: setDERP})
+		<-done
+
+		if got := b.currentNode().homeDERP.Load(); got != wantDERP {
+			t.Errorf("b.homeDERP = %d, wanted no change %d", got, wantDERP)
+		}
+
+		// Verify the cache still exists and still holds the original value.
+		b.mu.Lock()
+		defer b.mu.Unlock()
+		loaded, ok := b.loadDiskCacheLocked()
+		if !ok {
+			t.Fatal("loadDiskCacheLocked returned ok=false; expected cache to still exist")
+		}
+		if got := loaded.SelfNode.HomeDERP(); got != wantDERP {
+			t.Errorf("cached SelfNode.HomeDERP() = %d after rejected event, want original %d", got, wantDERP)
+		}
+	})
+}
+
+func TestWriteNetmapDoesNotMutateOriginal(t *testing.T) {
+	b := newTestBackend(t)
+
+	nm := newCacheTestNetmap()
+	b.currentNode().SetNetMap(nm)
+
+	originalDERP := nm.SelfNode.HomeDERP() // expected to be 0 initially
+
+	const storeDERP = 5
+	b.currentNode().homeDERP.Store(storeDERP)
+
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	if err := b.writeNetmapToDiskLockedWithPeers(nm); err != nil {
+		t.Fatalf("writeNetmapToDiskLocked: %v", err)
+	}
+
+	// The original netmap must not have been mutated.
+	if got := nm.SelfNode.HomeDERP(); got != originalDERP {
+		t.Errorf("original nm.SelfNode.HomeDERP() = %d after write, want %d (original was mutated)", got, originalDERP)
+	}
+}
diff --git a/ipn/ipnlocal/dnsconfig_test.go b/ipn/ipnlocal/dnsconfig_test.go
index 9d30029ff..3198222f1 100644
--- a/ipn/ipnlocal/dnsconfig_test.go
+++ b/ipn/ipnlocal/dnsconfig_test.go
@@ -72,6 +72,7 @@ func TestDNSConfigForNetmap(t *testing.T) {
 		},
 		{
 			name: "self_name_and_peers",
+			os:   "windows", // the full Hosts map is built only for the Windows hosts-file path
 			nm: &netmap.NetworkMap{
 				SelfNode: (&tailcfg.Node{
 					Name:      "myname.net.",
@@ -108,6 +109,7 @@ func TestDNSConfigForNetmap(t *testing.T) {
 		},
 		{
 			name: "subdomain_resolve_capability",
+			os:   "windows", // the full Hosts map is built only for the Windows hosts-file path
 			nm: &netmap.NetworkMap{
 				SelfNode: (&tailcfg.Node{
 					Name:      "myname.net.",
@@ -136,7 +138,6 @@ func TestDNSConfigForNetmap(t *testing.T) {
 					"peer-with-cap.net.":    ips("100.102.0.1"),
 					"peer-without-cap.net.": ips("100.102.0.2"),
 				},
-				SubdomainHosts: set.Of[dnsname.FQDN]("myname.net.", "peer-with-cap.net."),
 			},
 		},
 		{
@@ -144,6 +145,7 @@ func TestDNSConfigForNetmap(t *testing.T) {
 			// should get IPv6 records for all its peers,
 			// even if they have IPv4.
 			name: "v6_only_self",
+			os:   "windows", // the full Hosts map is built only for the Windows hosts-file path
 			nm: &netmap.NetworkMap{
 				SelfNode: (&tailcfg.Node{
 					Name:      "myname.net.",
@@ -198,9 +200,8 @@ func TestDNSConfigForNetmap(t *testing.T) {
 			want: &dns.Config{
 				Routes: map[dnsname.FQDN][]*dnstype.Resolver{},
 				Hosts: map[dnsname.FQDN][]netip.Addr{
-					"myname.net.": ips("100.101.101.101"),
-					"foo.com.":    ips("1.2.3.4"),
-					"bar.com.":    ips("1::6"),
+					"foo.com.": ips("1.2.3.4"),
+					"bar.com.": ips("1::6"),
 				},
 			},
 		},
@@ -425,19 +426,17 @@ func TestDNSConfigForNetmap(t *testing.T) {
 			},
 			want: &dns.Config{
 				AcceptDNS: true,
-				Hosts: map[dnsname.FQDN][]netip.Addr{
-					"a.":  ips("100.101.101.101"),
-					"p1.": ips("100.102.0.1"),
-				},
+				Hosts:     map[dnsname.FQDN][]netip.Addr{},
 				Routes: map[dnsname.FQDN][]*dnstype.Resolver{
 					dnsname.FQDN("example.com."): {
-						{Addr: "http://100.102.0.1:1234/dns-query"},
+						{Addr: "tailscale-app:app1", UseWithExitNode: true},
 					},
 				},
+				MagicDNSHostsUnrouted: true,
 			},
 		},
 		{
-			name: "conn25-split-dns-no-matching-peers",
+			name: "conn25-split-dns-with-exit-node",
 			nm: &netmap.NetworkMap{
 				SelfNode: (&tailcfg.Node{
 					Name:      "a",
@@ -453,9 +452,11 @@ func TestDNSConfigForNetmap(t *testing.T) {
 			peers: nodeViews([]*tailcfg.Node{
 				{
 					ID:        1,
+					StableID:  "exit",
 					Name:      "p1",
+					Cap:       26, // can proxy DNS over DoH
 					Addresses: ipps("100.102.0.1"),
-					Tags:      []string{"tag:nomatch"},
+					Tags:      []string{"tag:woo"},
 					Hostinfo: (&tailcfg.Hostinfo{
 						Services: []tailcfg.Service{
 							{
@@ -463,28 +464,33 @@ func TestDNSConfigForNetmap(t *testing.T) {
 								Port:  1234,
 							},
 						},
-						AppConnector: opt.NewBool(true),
 					}).View(),
 				},
 			}),
 			prefs: &ipn.Prefs{
-				CorpDNS: true,
+				CorpDNS:    true,
+				ExitNodeID: "exit",
 			},
 			want: &dns.Config{
 				AcceptDNS: true,
-				Routes:    map[dnsname.FQDN][]*dnstype.Resolver{},
-				Hosts: map[dnsname.FQDN][]netip.Addr{
-					"a.":  ips("100.101.101.101"),
-					"p1.": ips("100.102.0.1"),
+				Hosts:     map[dnsname.FQDN][]netip.Addr{},
+				Routes: map[dnsname.FQDN][]*dnstype.Resolver{
+					dnsname.FQDN("example.com."): {
+						{Addr: "tailscale-app:app1", UseWithExitNode: true},
+					},
 				},
+				DefaultResolvers: []*dnstype.Resolver{
+					{Addr: "http://100.102.0.1:1234/dns-query"},
+				},
+				MagicDNSHostsUnrouted: true,
 			},
 		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			verOS := cmp.Or(tt.os, "linux")
+			goos := cmp.Or(tt.os, "linux")
 			var log tstest.MemLogger
-			got := dnsConfigForNetmap(tt.nm, peersMap(tt.peers), tt.prefs.View(), tt.expired, log.Logf, verOS)
+			got := dnsConfigForNetmap(tt.nm, peersMap(tt.peers), tt.prefs.View(), tt.expired, log.Logf, goos)
 			if !reflect.DeepEqual(got, tt.want) {
 				gotj, _ := json.MarshalIndent(got, "", "\t")
 				wantj, _ := json.MarshalIndent(tt.want, "", "\t")
diff --git a/ipn/ipnlocal/drive.go b/ipn/ipnlocal/drive.go
index 485114eae..70a52cb1d 100644
--- a/ipn/ipnlocal/drive.go
+++ b/ipn/ipnlocal/drive.go
@@ -9,6 +9,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"iter"
 	"net/http"
 	"net/netip"
 	"os"
@@ -18,20 +19,41 @@ import (
 	"tailscale.com/ipn"
 	"tailscale.com/tailcfg"
 	"tailscale.com/types/logger"
-	"tailscale.com/types/netmap"
 	"tailscale.com/types/views"
 	"tailscale.com/util/httpm"
 )
 
 func init() {
 	hookSetNetMapLockedDrive.Set(setNetMapLockedDrive)
+	hookInstallDriveRemoteSource.Set(installDriveRemoteSource)
 }
 
-func setNetMapLockedDrive(b *LocalBackend, nm *netmap.NetworkMap) {
-	b.updateDrivePeersLocked(nm)
+// setNetMapLockedDrive runs on every full netmap install (the only path that
+// can flip self caps or change the tailnet domain) to re-notify IPN bus
+// listeners of the current local shares.
+//
+// It deliberately does NOT touch the remotes list passed to the local drive
+// filesystem: that flows through [driveRemoteSource], which the filesystem
+// pulls from lazily and only when something might have changed. See
+// [LocalBackend.driveGen].
+func setNetMapLockedDrive(b *LocalBackend) {
 	b.driveNotifyCurrentSharesLocked()
 }
 
+// installDriveRemoteSource registers a [drive.RemoteSource] on the local
+// Taildrive filesystem so it can pull the current set of remotes on demand
+// instead of being pushed a fresh list on every netmap update.
+//
+// It is wired from [NewLocalBackend] via [hookInstallDriveRemoteSource] so
+// non-drive builds don't reference the drive package at all.
+func installDriveRemoteSource(b *LocalBackend) {
+	fs, ok := b.sys.DriveForLocal.GetOK()
+	if !ok {
+		return
+	}
+	fs.SetRemoteSource(driveRemoteSource{b})
+}
+
 // DriveSetServerAddr tells Taildrive to use the given address for connecting
 // to the drive.FileServer that's exposing local files as an unprivileged
 // user.
@@ -285,80 +307,93 @@ func (b *LocalBackend) DriveGetShares() views.SliceView[*drive.Share, drive.Shar
 	return b.pm.prefs.DriveShares()
 }
 
-// updateDrivePeersLocked sets all applicable peers from the netmap as Taildrive
-// remotes.
-func (b *LocalBackend) updateDrivePeersLocked(nm *netmap.NetworkMap) {
-	fs, ok := b.sys.DriveForLocal.GetOK()
-	if !ok {
-		return
-	}
+// driveRemoteSource implements [drive.RemoteSource] by reading from a
+// [LocalBackend]. It is installed once on the local Taildrive filesystem
+// at [NewLocalBackend] time and consulted lazily on incoming WebDAV
+// requests.
+//
+// The filesystem only rebuilds its internal child list when [Generation]
+// changes, so peer churn that doesn't affect the drive-capable peer set
+// (e.g. endpoint or online-status mutations on non-drive peers) costs
+// nothing more than a single atomic load.
+type driveRemoteSource struct{ b *LocalBackend }
 
-	var driveRemotes []*drive.Remote
-	if b.DriveAccessEnabled() {
-		// Only populate peers if access is enabled, otherwise leave blank.
-		driveRemotes = b.driveRemotesFromPeers(nm)
-	}
-
-	fs.SetRemotes(nm.Domain, driveRemotes, b.newDriveTransport())
+// Generation implements [drive.RemoteSource].
+func (s driveRemoteSource) Generation() uint64 {
+	return s.b.driveGen.Load()
 }
 
-func (b *LocalBackend) driveRemotesFromPeers(nm *netmap.NetworkMap) []*drive.Remote {
-	b.logf("[v1] taildrive: setting up drive remotes from peers")
-	driveRemotes := make([]*drive.Remote, 0, len(nm.Peers))
-	for _, p := range nm.Peers {
-		peer := p
-		peerID := peer.ID()
-		peerKey := peer.Key().ShortString()
-		b.logf("[v1] taildrive: appending remote for peer %s", peerKey)
-		driveRemotes = append(driveRemotes, &drive.Remote{
-			Name: p.DisplayName(false),
-			URL: func() string {
-				url := fmt.Sprintf("%s/%s", b.currentNode().PeerAPIBase(peer), taildrivePrefix[1:])
-				b.logf("[v2] taildrive: url for peer %s: %s", peerKey, url)
-				return url
-			},
-			Available: func() bool {
-				// Peers are available to Taildrive if:
-				// - They are online
-				// - Their PeerAPI is reachable
-				// - They are allowed to share at least one folder with us
-				cn := b.currentNode()
-				peer, ok := cn.NodeByID(peerID)
-				if !ok {
-					b.logf("[v2] taildrive: Available(): peer %s not found", peerKey)
-					return false
-				}
+// Domain implements [drive.RemoteSource].
+func (s driveRemoteSource) Domain() string {
+	nm := s.b.currentNode().NetMap()
+	if nm == nil {
+		return ""
+	}
+	return nm.Domain
+}
 
-				// Exclude offline peers.
-				// TODO(oxtoacart): for some reason, this correctly
-				// catches when a node goes from offline to online,
-				// but not the other way around...
-				// TODO(oxtoacart,nickkhyl): the reason was probably
-				// that we were using netmap.Peers instead of b.peers.
-				// The netmap.Peers slice is not updated in all cases.
-				// It should be fixed now that we use PeerByIDOk.
-				if !peer.Online().Get() {
-					b.logf("[v2] taildrive: Available(): peer %s offline", peerKey)
-					return false
-				}
+// Transport implements [drive.RemoteSource].
+func (s driveRemoteSource) Transport() http.RoundTripper {
+	return s.b.newDriveTransport()
+}
 
-				if b.currentNode().PeerAPIBase(peer) == "" {
-					b.logf("[v2] taildrive: Available(): peer %s PeerAPI unreachable", peerKey)
+// Remotes implements [drive.RemoteSource]. It yields one [*drive.Remote]
+// per peer; the per-Remote Available closure filters out peers that
+// aren't online, don't expose PeerAPI, or haven't granted us the
+// Taildrive sharer cap. If drive access is disabled on this node, no
+// remotes are yielded at all, so the filesystem ends up with an empty
+// child list.
+func (s driveRemoteSource) Remotes() iter.Seq[*drive.Remote] {
+	return func(yield func(*drive.Remote) bool) {
+		b := s.b
+		if !b.DriveAccessEnabled() {
+			return
+		}
+		cn := b.currentNode()
+		peers := cn.Peers()
+		b.logf("[v1] taildrive: building drive remotes from %d peers", len(peers))
+		for _, peer := range peers {
+			peerID := peer.ID()
+			peerKey := peer.Key().ShortString()
+			peerName := peer.DisplayName(false)
+			r := &drive.Remote{
+				Name: peerName,
+				URL: func() string {
+					url := fmt.Sprintf("%s/%s", cn.PeerAPIBase(peer), taildrivePrefix[1:])
+					b.logf("[v2] taildrive: url for peer %s (%s): %s", peerKey, peerName, url)
+					return url
+				},
+				Available: func() bool {
+					// Peers are available to Taildrive if:
+					// - They are online
+					// - Their PeerAPI is reachable
+					// - They are allowed to share at least one folder with us
+					peer, ok := cn.NodeByID(peerID)
+					if !ok {
+						b.logf("[v2] taildrive: peer %s (%s, id=%v) not found", peerKey, peerName, peerID)
+						return false
+					}
+					if !peer.Online().Get() {
+						b.logf("[v2] taildrive: peer %s (%s, id=%v) offline", peerKey, peerName, peerID)
+						return false
+					}
+					if cn.PeerAPIBase(peer) == "" {
+						b.logf("[v2] taildrive: peer %s (%s, id=%v) PeerAPI unreachable", peerKey, peerName, peerID)
+						return false
+					}
+					if cn.PeerHasCap(peer, tailcfg.PeerCapabilityTaildriveSharer) {
+						b.logf("[v2] taildrive: peer %s (%s, id=%v) available", peerKey, peerName, peerID)
+						return true
+					}
+					b.logf("[v2] taildrive: peer %s (%s, id=%v) not allowed to share", peerKey, peerName, peerID)
 					return false
-				}
-
-				// Check that the peer is allowed to share with us.
-				if cn.PeerHasCap(peer, tailcfg.PeerCapabilityTaildriveSharer) {
-					b.logf("[v2] taildrive: Available(): peer %s available", peerKey)
-					return true
-				}
-
-				b.logf("[v2] taildrive: Available(): peer %s not allowed to share", peerKey)
-				return false
-			},
-		})
+				},
+			}
+			if !yield(r) {
+				return
+			}
+		}
 	}
-	return driveRemotes
 }
 
 // responseBodyWrapper wraps an io.ReadCloser and stores
diff --git a/ipn/ipnlocal/drive_test.go b/ipn/ipnlocal/drive_test.go
index aca05432b..faa32f3d1 100644
--- a/ipn/ipnlocal/drive_test.go
+++ b/ipn/ipnlocal/drive_test.go
@@ -7,9 +7,33 @@ package ipnlocal
 
 import (
 	"errors"
+	"fmt"
+	"net"
 	"net/http"
 	"net/http/httptest"
+	"net/netip"
+	"slices"
+	"sync"
 	"testing"
+	"time"
+
+	"github.com/studio-b12/gowebdav"
+	"tailscale.com/control/controlclient"
+	"tailscale.com/drive"
+	"tailscale.com/drive/driveimpl"
+	"tailscale.com/ipn"
+	"tailscale.com/ipn/store/mem"
+	"tailscale.com/tailcfg"
+	"tailscale.com/tsd"
+	"tailscale.com/tstest"
+	"tailscale.com/types/ipproto"
+	"tailscale.com/types/logger"
+	"tailscale.com/types/netmap"
+	"tailscale.com/types/views"
+	"tailscale.com/util/eventbus/eventbustest"
+	"tailscale.com/util/set"
+	"tailscale.com/wgengine"
+	"tailscale.com/wgengine/filter/filtertype"
 )
 
 // TestDriveTransportRoundTrip_NetworkError tests that driveTransport.RoundTrip
@@ -48,3 +72,473 @@ type mockRoundTripper struct {
 func (m *mockRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
 	return nil, m.err
 }
+
+// TestDriveGenBumps verifies that driveGen increments at each of the three
+// call sites the [driveRemoteSource] cache invalidation depends on:
+// full netmap installs, netmap deltas, and packet-filter updates. If any of
+// these stops bumping, WebDAV clients would see a stale remote list until
+// some other event happened to bump the counter, so the test asserts each
+// site independently.
+func TestDriveGenBumps(t *testing.T) {
+	b := newTestLocalBackend(t)
+
+	assertBumped := func(name string, fn func()) {
+		t.Helper()
+		before := b.driveGen.Load()
+		fn()
+		after := b.driveGen.Load()
+		if after <= before {
+			t.Errorf("%s: driveGen = %d after, %d before; want strictly greater", name, after, before)
+		}
+	}
+
+	selfNode := (&tailcfg.Node{
+		ID:        1,
+		Key:       makeNodeKeyFromID(1),
+		Addresses: []netip.Prefix{netip.MustParsePrefix("100.64.0.1/32")},
+	}).View()
+	peer2 := (&tailcfg.Node{
+		ID:        2,
+		Key:       makeNodeKeyFromID(2),
+		Addresses: []netip.Prefix{netip.MustParsePrefix("100.64.0.2/32")},
+	}).View()
+
+	assertBumped("setNetMapLocked", func() {
+		b.mu.Lock()
+		defer b.mu.Unlock()
+		b.setNetMapLocked(&netmap.NetworkMap{
+			SelfNode: selfNode,
+			Peers:    []tailcfg.NodeView{peer2},
+		})
+	})
+
+	assertBumped("UpdateNetmapDelta", func() {
+		muts, ok := netmap.MutationsFromMapResponse(&tailcfg.MapResponse{
+			OnlineChange: map[tailcfg.NodeID]bool{peer2.ID(): true},
+		}, time.Time{})
+		if !ok {
+			t.Fatal("MutationsFromMapResponse failed")
+		}
+		if !b.UpdateNetmapDelta(muts) {
+			t.Fatal("UpdateNetmapDelta returned false")
+		}
+	})
+
+	assertBumped("UpdatePacketFilter", func() {
+		if !b.UpdatePacketFilter(views.Slice[tailcfg.FilterRule]{}, nil) {
+			t.Fatal("UpdatePacketFilter returned false")
+		}
+	})
+}
+
+// TestDriveRemoteSourceAccessGate verifies that [driveRemoteSource.Remotes]
+// yields zero entries when the self node lacks NodeAttrsTaildriveAccess, and
+// the full peer set when it has it. This is the only path that decides
+// whether the local Taildrive root shows any folders at all, so a regression
+// here would silently break access for every user.
+func TestDriveRemoteSourceAccessGate(t *testing.T) {
+	b := newTestLocalBackend(t)
+
+	selfNode := (&tailcfg.Node{
+		ID:        1,
+		Key:       makeNodeKeyFromID(1),
+		Addresses: []netip.Prefix{netip.MustParsePrefix("100.64.0.1/32")},
+	}).View()
+	peers := []tailcfg.NodeView{
+		(&tailcfg.Node{
+			ID:        2,
+			Key:       makeNodeKeyFromID(2),
+			Addresses: []netip.Prefix{netip.MustParsePrefix("100.64.0.2/32")},
+		}).View(),
+		(&tailcfg.Node{
+			ID:        3,
+			Key:       makeNodeKeyFromID(3),
+			Addresses: []netip.Prefix{netip.MustParsePrefix("100.64.0.3/32")},
+		}).View(),
+	}
+
+	install := func(allCaps set.Set[tailcfg.NodeCapability]) {
+		b.mu.Lock()
+		defer b.mu.Unlock()
+		b.setNetMapLocked(&netmap.NetworkMap{
+			SelfNode: selfNode,
+			Peers:    peers,
+			AllCaps:  allCaps,
+		})
+	}
+
+	src := driveRemoteSource{b: b}
+	collect := func() []*drive.Remote {
+		var out []*drive.Remote
+		for r := range src.Remotes() {
+			out = append(out, r)
+		}
+		return out
+	}
+
+	install(nil)
+	if got := collect(); len(got) != 0 {
+		t.Errorf("Remotes without DriveAccess cap: got %d entries, want 0", len(got))
+	}
+
+	install(set.Of(tailcfg.NodeAttrsTaildriveAccess))
+	if got := collect(); len(got) != len(peers) {
+		t.Errorf("Remotes with DriveAccess cap: got %d entries, want %d", len(got), len(peers))
+	}
+}
+
+// captureFS wraps a real [drive.FileSystemForLocal] but records the most
+// recent [drive.RemoteSource] installed via SetRemoteSource. It lets the
+// test below observe what NewLocalBackend wires up without poking at
+// LocalBackend internals.
+type captureFS struct {
+	drive.FileSystemForLocal
+
+	mu     sync.Mutex
+	source drive.RemoteSource
+}
+
+func (c *captureFS) SetRemoteSource(source drive.RemoteSource) {
+	c.mu.Lock()
+	c.source = source
+	c.mu.Unlock()
+	c.FileSystemForLocal.SetRemoteSource(source)
+}
+
+func (c *captureFS) lastSource() drive.RemoteSource {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return c.source
+}
+
+// TestDriveRemoteSourceInstalled verifies that NewLocalBackend wires a
+// [driveRemoteSource] into sys.DriveForLocal via the
+// hookInstallDriveRemoteSource init hook. Without this wiring, every
+// remote-set update would silently no-op because the filesystem would
+// have no source to pull from.
+func TestDriveRemoteSourceInstalled(t *testing.T) {
+	bus := eventbustest.NewBus(t)
+	sys := tsd.NewSystemWithBus(bus)
+	cf := &captureFS{FileSystemForLocal: driveimpl.NewFileSystemForLocal(logger.Discard)}
+	sys.Set(drive.FileSystemForLocal(cf))
+	t.Cleanup(func() { cf.FileSystemForLocal.Close() })
+
+	b := newTestLocalBackendWithSys(t, sys)
+
+	src := cf.lastSource()
+	if src == nil {
+		t.Fatal("SetRemoteSource was never called on FileSystemForLocal")
+	}
+	drs, ok := src.(driveRemoteSource)
+	if !ok {
+		t.Fatalf("installed source is %T, want driveRemoteSource", src)
+	}
+	if drs.b != b {
+		t.Errorf("driveRemoteSource.b = %p, want LocalBackend %p", drs.b, b)
+	}
+}
+
+// driveEndToEndHarness wires up:
+//
+//   - a real [LocalBackend] backed by a mock controlclient, so a full netmap
+//     can be delivered through the same code path the real controlclient
+//     uses (SetControlClientStatus → setNetMapLocked → updateFilterLocked);
+//
+//   - a real [driveimpl.FileSystemForLocal] injected into [tsd.System]
+//     before NewLocalBackend, so installDriveRemoteSource fires; and
+//
+//   - a TCP listener that hands accepted connections to fs.HandleConn,
+//     plus a gowebdav client pointed at it, so WebDAV PROPFINDs traverse
+//     the same code path a real Mac/Windows client would.
+type driveEndToEndHarness struct {
+	t      *testing.T
+	b      *LocalBackend
+	cc     *mockControl
+	fs     drive.FileSystemForLocal
+	client *gowebdav.Client
+	domain string
+
+	selfAddr netip.Addr // self IPv4 single-IP address
+
+	// wg tracks the listener's accept loop and every per-connection
+	// fs.HandleConn goroutine, so t.Cleanup can Wait for them after
+	// closing the listener and prevent goroutine leaks across tests.
+	wg sync.WaitGroup
+}
+
+func newDriveEndToEndHarness(t *testing.T) *driveEndToEndHarness {
+	bus := eventbustest.NewBus(t)
+	sys := tsd.NewSystemWithBus(bus)
+
+	logf := logger.Discard
+	sys.Set(new(mem.Store))
+	eng, err := wgengine.NewFakeUserspaceEngine(logf, sys.Set, sys.HealthTracker.Get(), sys.UserMetricsRegistry(), sys.Bus.Get())
+	if err != nil {
+		t.Fatalf("NewFakeUserspaceEngine: %v", err)
+	}
+	t.Cleanup(eng.Close)
+	sys.Set(eng)
+
+	fs := driveimpl.NewFileSystemForLocal(logf)
+	sys.Set(drive.FileSystemForLocal(fs))
+	t.Cleanup(func() { fs.Close() })
+
+	b := newLocalBackendWithSysAndTestControl(t, false, sys, func(tb testing.TB, opts controlclient.Options) controlclient.Client {
+		return newClient(tb, opts)
+	})
+	if err := b.Start(ipn.Options{}); err != nil {
+		t.Fatalf("(*LocalBackend).Start: %v", err)
+	}
+
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("net.Listen: %v", err)
+	}
+
+	client := gowebdav.NewClient(fmt.Sprintf("http://%s", ln.Addr()), "", "")
+	client.SetTransport(&http.Transport{DisableKeepAlives: true})
+
+	h := &driveEndToEndHarness{
+		t:        t,
+		b:        b,
+		cc:       b.cc.(*mockControl),
+		fs:       fs,
+		client:   client,
+		domain:   "example.com",
+		selfAddr: netip.MustParseAddr("100.64.0.1"),
+	}
+
+	t.Cleanup(h.wg.Wait) // runs last, after ln.Close etc
+	t.Cleanup(func() { ln.Close() })
+
+	h.wg.Go(func() {
+		for {
+			conn, err := ln.Accept()
+			if err != nil {
+				return
+			}
+			h.wg.Go(func() { fs.HandleConn(conn, conn.RemoteAddr()) })
+		}
+	})
+
+	return h
+}
+
+// peerSpec describes a peer to be installed in a test netmap.
+// driveCap controls whether the packet filter is built with a rule that
+// grants the peer the [tailcfg.PeerCapabilityTaildriveSharer] cap to self.
+type peerSpec struct {
+	id       tailcfg.NodeID
+	name     string
+	addr     netip.Addr
+	online   bool
+	driveCap bool
+	peerAPI  bool
+}
+
+func (s peerSpec) node() *tailcfg.Node {
+	n := &tailcfg.Node{
+		ID:        s.id,
+		Name:      s.name + ".example.com.",
+		Key:       makeNodeKeyFromID(s.id),
+		Addresses: []netip.Prefix{netip.PrefixFrom(s.addr, s.addr.BitLen())},
+		Online:    new(s.online),
+	}
+	if s.peerAPI {
+		hi := &tailcfg.Hostinfo{
+			Services: []tailcfg.Service{{
+				Proto: tailcfg.PeerAPI4,
+				Port:  12345,
+			}},
+		}
+		n.Hostinfo = hi.View()
+	}
+	// The controlclient calls InitDisplayNames before delivering peers to
+	// LocalBackend. The mockControl path used here skips that step, so we
+	// do it explicitly to get DisplayName(false) → ComputedName ("alpha"
+	// etc.) rather than the node-key fallback.
+	n.InitDisplayNames("example.com")
+	return n
+}
+
+// filterMatchesFor builds the parsed packet-filter matches that grant
+// PeerCapabilityTaildriveSharer from each driveCap-enabled peer's address
+// to the self address. PeerHasCap reads its result, so this is what flips a
+// peer in or out of the drive-capable set in the e2e test.
+func (h *driveEndToEndHarness) filterMatchesFor(specs []peerSpec) []filtertype.Match {
+	var matches []filtertype.Match
+	for _, s := range specs {
+		if !s.driveCap {
+			continue
+		}
+		matches = append(matches, filtertype.Match{
+			IPProto: views.SliceOf([]ipproto.Proto{ipproto.TCP}),
+			Srcs:    []netip.Prefix{netip.PrefixFrom(s.addr, s.addr.BitLen())},
+			Caps: []filtertype.CapMatch{{
+				Dst: netip.PrefixFrom(h.selfAddr, h.selfAddr.BitLen()),
+				Cap: tailcfg.PeerCapabilityTaildriveSharer,
+			}},
+		})
+	}
+	return matches
+}
+
+// installNetMap pushes a netmap built from specs through the mock control
+// client. The self node always has Addresses and NodeAttrsTaildriveAccess
+// in AllCaps. The packet filter is generated to grant
+// PeerCapabilityTaildriveSharer from each driveCap-enabled peer's IP to
+// the self IP.
+func (h *driveEndToEndHarness) installNetMap(specs []peerSpec) {
+	h.t.Helper()
+	peers := make([]tailcfg.NodeView, 0, len(specs))
+	for _, s := range specs {
+		peers = append(peers, s.node().View())
+	}
+	nm := &netmap.NetworkMap{
+		SelfNode: (&tailcfg.Node{
+			ID:        1,
+			Name:      "self.example.com.",
+			Key:       makeNodeKeyFromID(1),
+			Addresses: []netip.Prefix{netip.PrefixFrom(h.selfAddr, h.selfAddr.BitLen())},
+		}).View(),
+		Domain:       h.domain,
+		Peers:        peers,
+		AllCaps:      set.Of(tailcfg.NodeAttrsTaildriveAccess),
+		PacketFilter: h.filterMatchesFor(specs),
+	}
+	h.cc.send(sendOpt{loginFinished: true, nm: nm})
+}
+
+// sendMapResponse turns a [tailcfg.MapResponse] into a slice of
+// [netmap.NodeMutation] via netmap.MutationsFromMapResponse — the same path
+// the real controlclient uses on the incremental-fast-path — and dispatches
+// it through [LocalBackend.UpdateNetmapDelta]. Going through MapResponse
+// rather than constructing NodeMutation values directly keeps the test
+// honest about wire-shaped inputs: every mutation kind exercised here is
+// reachable by the control server with no test-only constructs.
+func (h *driveEndToEndHarness) sendMapResponse(mr *tailcfg.MapResponse) {
+	h.t.Helper()
+	muts, ok := netmap.MutationsFromMapResponse(mr, time.Time{})
+	if !ok {
+		h.t.Fatalf("MutationsFromMapResponse(%+v) returned !ok", mr)
+	}
+	if !h.b.UpdateNetmapDelta(muts) {
+		h.t.Fatalf("UpdateNetmapDelta(%+v) returned false", muts)
+	}
+}
+
+// readDirNames issues a real WebDAV PROPFIND against the local Taildrive
+// root and returns the names of the directory entries the filesystem
+// reports as available, sorted for stable comparison.
+func (h *driveEndToEndHarness) readDirNames() []string {
+	h.t.Helper()
+	infos, err := h.client.ReadDir("/" + h.domain)
+	if err != nil {
+		h.t.Fatalf("ReadDir: %v", err)
+	}
+	var names []string
+	for _, fi := range infos {
+		names = append(names, fi.Name())
+	}
+	slices.Sort(names)
+	return names
+}
+
+// waitForDir polls readDirNames until it matches want or the timeout
+// elapses. We poll because the gen-bump → next-WebDAV-request rebuild has
+// no happens-before synchronization with the caller of UpdateNetmapDelta;
+// the rebuild happens lazily on the next inbound request.
+func (h *driveEndToEndHarness) waitForDir(want []string) {
+	h.t.Helper()
+	slices.Sort(want)
+	err := tstest.WaitFor(2*time.Second, func() error {
+		got := h.readDirNames()
+		if !slices.Equal(got, want) {
+			return fmt.Errorf("readDirNames = %v, want %v", got, want)
+		}
+		return nil
+	})
+	if err != nil {
+		h.t.Fatal(err)
+	}
+}
+
+// TestDriveRemotesEndToEnd exercises the full pipeline from netmap mutation
+// through driveGen invalidation, [driveRemoteSource.Remotes] re-evaluation,
+// and compositedav child rebuild, validated by a real WebDAV PROPFIND each
+// time.
+//
+// We cover the four ways a peer can enter or leave the drive-capable set:
+//
+//  1. Peer upsert (PeersChanged → NodeMutationUpsert): adds a brand-new
+//     sharer peer.
+//  2. Peer removal (PeersRemoved → NodeMutationRemove): removes an
+//     existing sharer.
+//  3. Packet-filter change (UpdatePacketFilter): flips an existing peer
+//     in or out of the drive-capable set without any per-peer mutation.
+//  4. Per-peer online toggle (OnlineChange → NodeMutationOnline): doesn't
+//     change drive-capable membership but does change Available(), so the
+//     PROPFIND listing must reflect it.
+//
+// Note: deltas are delivered via [LocalBackend.UpdateNetmapDelta] /
+// [LocalBackend.UpdatePacketFilter] directly rather than through a real
+// testcontrol stream. Those are the same entry points the controlclient
+// calls into after parsing a MapResponse, so the LocalBackend-side
+// semantics under test are identical; the wire-level netmap streaming
+// itself is covered by [TestNetmapDeltaFastPath] in tstest/largetailnet.
+func TestDriveRemotesEndToEnd(t *testing.T) {
+	h := newDriveEndToEndHarness(t)
+
+	peer2 := peerSpec{id: 2, name: "alpha", addr: netip.MustParseAddr("100.64.0.2"), online: true, driveCap: true, peerAPI: true}
+	peer3 := peerSpec{id: 3, name: "bravo", addr: netip.MustParseAddr("100.64.0.3"), online: true, driveCap: false, peerAPI: true}
+
+	// Initial state: peer2 has the sharer cap, peer3 does not. Only
+	// peer2 should appear in the WebDAV listing.
+	h.installNetMap([]peerSpec{peer2, peer3})
+	h.waitForDir([]string{"alpha"})
+
+	// 1) Upsert a new sharer peer (peer4) via PeersChanged, then refresh
+	//    the packet filter so PeerHasCap returns true for it. PeerHasCap
+	//    is driven by the filter, so adding the peer alone is not enough.
+	peer4 := peerSpec{id: 4, name: "charlie", addr: netip.MustParseAddr("100.64.0.4"), online: true, driveCap: true, peerAPI: true}
+	h.sendMapResponse(&tailcfg.MapResponse{
+		PeersChanged: []*tailcfg.Node{peer4.node()},
+	})
+	if !h.b.UpdatePacketFilter(views.Slice[tailcfg.FilterRule]{}, h.filterMatchesFor([]peerSpec{peer2, peer3, peer4})) {
+		t.Fatal("UpdatePacketFilter returned false")
+	}
+	h.waitForDir([]string{"alpha", "charlie"})
+
+	// 2) Remove peer2 via PeersRemoved.
+	h.sendMapResponse(&tailcfg.MapResponse{
+		PeersRemoved: []tailcfg.NodeID{peer2.id},
+	})
+	if !h.b.UpdatePacketFilter(views.Slice[tailcfg.FilterRule]{}, h.filterMatchesFor([]peerSpec{peer3, peer4})) {
+		t.Fatal("UpdatePacketFilter returned false")
+	}
+	h.waitForDir([]string{"charlie"})
+
+	// 3) Flip peer3 into the drive-capable set by changing only the
+	//    packet filter — no per-peer mutation. This exercises the
+	//    UpdatePacketFilter bump path specifically.
+	peer3.driveCap = true
+	if !h.b.UpdatePacketFilter(views.Slice[tailcfg.FilterRule]{}, h.filterMatchesFor([]peerSpec{peer3, peer4})) {
+		t.Fatal("UpdatePacketFilter returned false")
+	}
+	h.waitForDir([]string{"bravo", "charlie"})
+
+	// 4) Toggle peer3 offline via OnlineChange. The peer is still in the
+	//    drive-capable set so its name remains in the cached Remotes
+	//    slice, but Available() returns false so dirfs filters it out of
+	//    PROPFIND listings.
+	h.sendMapResponse(&tailcfg.MapResponse{
+		OnlineChange: map[tailcfg.NodeID]bool{peer3.id: false},
+	})
+	h.waitForDir([]string{"charlie"})
+
+	// And back online.
+	h.sendMapResponse(&tailcfg.MapResponse{
+		OnlineChange: map[tailcfg.NodeID]bool{peer3.id: true},
+	})
+	h.waitForDir([]string{"bravo", "charlie"})
+}
diff --git a/ipn/ipnlocal/extension_host.go b/ipn/ipnlocal/extension_host.go
index 0c4b1d933..1db183afe 100644
--- a/ipn/ipnlocal/extension_host.go
+++ b/ipn/ipnlocal/extension_host.go
@@ -7,7 +7,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"maps"
 	"reflect"
 	"slices"
 	"strings"
@@ -269,7 +268,10 @@ func (h *ExtensionHost) init() {
 	// Report active extensions to the log.
 	// TODO(nickkhyl): update client metrics to include the active/failed/skipped extensions.
 	h.mu.Lock()
-	extensionNames := slices.Collect(maps.Keys(h.extensionsByName))
+	var extensionNames []string
+	for _, ext := range h.activeExtensions {
+		extensionNames = append(extensionNames, ext.Name())
+	}
 	h.mu.Unlock()
 	h.logf("active extensions: %v", strings.Join(extensionNames, ", "))
 
diff --git a/ipn/ipnlocal/fortest.go b/ipn/ipnlocal/fortest.go
new file mode 100644
index 000000000..f820dca09
--- /dev/null
+++ b/ipn/ipnlocal/fortest.go
@@ -0,0 +1,152 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package ipnlocal
+
+import (
+	"crypto/tls"
+	"net/http"
+
+	"tailscale.com/control/controlclient"
+	"tailscale.com/ipn"
+	"tailscale.com/ipn/ipnauth"
+	"tailscale.com/tailcfg"
+	"tailscale.com/tstime"
+	"tailscale.com/types/key"
+	"tailscale.com/types/netmap"
+	"tailscale.com/util/testenv"
+	"tailscale.com/wgengine/filter"
+)
+
+// forTest is an unexported type to hide all the test-only
+// methods on [LocalBackend] from godoc.
+type forTest struct{ b *LocalBackend }
+
+// ForTest returns a handle to test-only methods on b.
+// The resulting type is unexported to make it very obvious
+// in godoc that this is not stable API. This method panics
+// if called outside of tests, which also centralizes all
+// must-be-in-tests validation.
+func (b *LocalBackend) ForTest() forTest {
+	testenv.AssertInTest()
+	return forTest{b}
+}
+
+// HandleC2N calls [LocalBackend.handleC2N], for use by feature/ packages that
+// register C2N handlers and want to test them.
+func (f forTest) HandleC2N(w http.ResponseWriter, r *http.Request) {
+	f.b.handleC2N(w, r)
+}
+
+// SetIPServiceMappings overwrites the LocalBackend's IP-to-service mappings
+// and propagates them to the netstack subsystem if registered.
+func (f forTest) SetIPServiceMappings(m netmap.IPServiceMappings) {
+	b := f.b
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	b.ipVIPServiceMap = m
+	if ns, ok := b.sys.Netstack.GetOK(); ok {
+		ns.UpdateIPServiceMappings(m)
+	}
+}
+
+// GetFilter returns the current packet filter.
+func (f forTest) GetFilter() *filter.Filter {
+	b := f.b
+	// Take b.mu so the read serializes with [LocalBackend.setControlClientStatusLocked],
+	// which installs the netmap and the filter at separate sub-steps. Without
+	// this, a test thread that observes the new netmap (via [LocalBackend.NetMapWithPeers])
+	// can race ahead of the filter store and read the previous filter.
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	return b.currentNode().filterAtomic.Load()
+}
+
+// SetControlClientGetter sets the func that creates a control plane
+// client. It can be called at most once, before Start.
+func (f forTest) SetControlClientGetter(newControlClient func(controlclient.Options) (controlclient.Client, error)) {
+	b := f.b
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	if b.ccGen != nil {
+		panic("invalid use of forTest.SetControlClientGetter after Start")
+	}
+	b.ccGen = newControlClient
+}
+
+// Peers returns all the current peers, sorted by Node.ID, for integration
+// tests in another repo.
+func (f forTest) Peers() []tailcfg.NodeView {
+	return f.b.currentNode().PeersForTest()
+}
+
+// AwaitNodeKey returns a channel that is closed once a peer with the given
+// node key first appears in the current netmap. If the peer is already
+// present, the returned channel is already closed. See
+// [nodeBackend.AwaitNodeKeyForTest].
+func (f forTest) AwaitNodeKey(k key.NodePublic) <-chan struct{} {
+	return f.b.currentNode().AwaitNodeKeyForTest(k)
+}
+
+// CurrentUser returns the current user and the associated WindowsUserID.
+// It will be removed along with the rest of the "current user" functionality
+// as we progress on the multi-user improvements (tailscale/corp#18342).
+func (f forTest) CurrentUser() (ipn.WindowsUserID, ipnauth.Actor) {
+	b := f.b
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	return b.pm.CurrentUserID(), b.currentUser
+}
+
+// ConfigureCerts sets a certificate retrieval function to be used by this
+// local backend, skipping the usual ACME certificate registration.
+func (f forTest) ConfigureCerts(getCert func(hostname string) (*TLSCertKeyPair, error)) {
+	hook, ok := HookConfigureCertsForTest.GetOk()
+	if !ok {
+		panic("forTest.ConfigureCerts called without cert extension registered")
+	}
+	hook(f.b, getCert)
+}
+
+// GetACMETLSALPNCert returns the short-lived ACME tls-alpn-01 challenge
+// certificate for hi, if any.
+func (f forTest) GetACMETLSALPNCert(hi *tls.ClientHelloInfo) (*tls.Certificate, bool) {
+	return f.b.getACMETLSALPNCert(hi)
+}
+
+// SetServeConfig installs sc as the backend's current
+// [ipn.ServeConfig] without going through the validation in
+// [LocalBackend.SetServeConfig]. It is intended for tests that need a
+// specific serve config without first standing up the prerequisites
+// (netmap, prefs, etc.).
+func (f forTest) SetServeConfig(sc ipn.ServeConfigView) {
+	b := f.b
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	b.serveConfig = sc
+}
+
+// SetNetMap installs nm as the backend's current netmap without going
+// through control-plane plumbing. It is intended for tests that need a
+// specific netmap (e.g. CertDomains, capabilities).
+func (f forTest) SetNetMap(nm *netmap.NetworkMap) {
+	b := f.b
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	b.currentNode().SetNetMap(nm)
+}
+
+// SetClock replaces b's clock with c, for tests that need
+// time-dependent behavior to be deterministic.
+func (f forTest) SetClock(c tstime.Clock) { f.b.clock = c }
+
+// SetPrefs replaces the current prefs with newp.
+func (f forTest) SetPrefs(newp *ipn.Prefs) {
+	if newp == nil {
+		panic("forTest.SetPrefs got nil prefs")
+	}
+	b := f.b
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	b.setPrefsLocked(newp)
+}
diff --git a/ipn/ipnlocal/ipnlocaltest/ipnlocaltest.go b/ipn/ipnlocal/ipnlocaltest/ipnlocaltest.go
new file mode 100644
index 000000000..01e6036e4
--- /dev/null
+++ b/ipn/ipnlocal/ipnlocaltest/ipnlocaltest.go
@@ -0,0 +1,64 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package ipnlocaltest provides test helpers for constructing a
+// [*ipnlocal.LocalBackend] from external test packages that cannot
+// access ipnlocal's internal test helpers.
+package ipnlocaltest
+
+import (
+	"testing"
+
+	"tailscale.com/ipn/ipnlocal"
+	"tailscale.com/ipn/store/mem"
+	"tailscale.com/net/netmon"
+	"tailscale.com/net/tsdial"
+	"tailscale.com/tsd"
+	"tailscale.com/types/logger"
+	"tailscale.com/types/logid"
+	"tailscale.com/util/eventbus/eventbustest"
+	"tailscale.com/util/testenv"
+	"tailscale.com/wgengine"
+)
+
+// NewBackend creates a new [*ipnlocal.LocalBackend] suitable for tests,
+// using an in-memory state store, a fake userspace engine, and a static
+// network monitor. Shutdown is registered as a t.Cleanup.
+func NewBackend(t testing.TB) *ipnlocal.LocalBackend {
+	testenv.AssertInTest()
+	bus := eventbustest.NewBus(t)
+	return NewBackendWithSys(t, tsd.NewSystemWithBus(bus))
+}
+
+// NewBackendWithSys creates a new [*ipnlocal.LocalBackend] with the
+// given [*tsd.System]. Missing components in sys (state store, engine,
+// dialer) are filled in with test fakes.
+func NewBackendWithSys(t testing.TB, sys *tsd.System) *ipnlocal.LocalBackend {
+	testenv.AssertInTest()
+	var logf logger.Logf = logger.Discard
+	if _, ok := sys.StateStore.GetOK(); !ok {
+		sys.Set(new(mem.Store))
+		t.Log("Added memory store for testing")
+	}
+	if _, ok := sys.Engine.GetOK(); !ok {
+		eng, err := wgengine.NewFakeUserspaceEngine(logf, sys.Set, sys.HealthTracker.Get(), sys.UserMetricsRegistry(), sys.Bus.Get())
+		if err != nil {
+			t.Fatalf("NewFakeUserspaceEngine: %v", err)
+		}
+		t.Cleanup(eng.Close)
+		sys.Set(eng)
+		t.Log("Added fake userspace engine for testing")
+	}
+	if _, ok := sys.Dialer.GetOK(); !ok {
+		dialer := tsdial.NewDialer(netmon.NewStatic())
+		dialer.SetBus(sys.Bus.Get())
+		sys.Set(dialer)
+		t.Log("Added static dialer for testing")
+	}
+	lb, err := ipnlocal.NewLocalBackend(logf, logid.PublicID{}, sys, 0)
+	if err != nil {
+		t.Fatalf("NewLocalBackend: %v", err)
+	}
+	t.Cleanup(lb.Shutdown)
+	return lb
+}
diff --git a/ipn/ipnlocal/local.go b/ipn/ipnlocal/local.go
index 610d1d7b5..e5c2d8e65 100644
--- a/ipn/ipnlocal/local.go
+++ b/ipn/ipnlocal/local.go
@@ -9,12 +9,11 @@ import (
 	"bufio"
 	"cmp"
 	"context"
-	"crypto/sha256"
-	"encoding/binary"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
+	"maps"
 	"math"
 	"math/rand/v2"
 	"net"
@@ -32,6 +31,7 @@ import (
 	"sync/atomic"
 	"time"
 
+	"github.com/gaissmai/bart"
 	"go4.org/mem"
 	"go4.org/netipx"
 	"golang.org/x/net/dns/dnsmessage"
@@ -58,12 +58,13 @@ import (
 	"tailscale.com/net/dnscache"
 	"tailscale.com/net/dnsfallback"
 	"tailscale.com/net/ipset"
-	"tailscale.com/net/netcheck"
 	"tailscale.com/net/netkernelconf"
 	"tailscale.com/net/netmon"
 	"tailscale.com/net/netns"
 	"tailscale.com/net/netutil"
 	"tailscale.com/net/packet"
+	"tailscale.com/net/routemanager"
+	"tailscale.com/net/traffic"
 	"tailscale.com/net/tsaddr"
 	"tailscale.com/net/tsdial"
 	"tailscale.com/paths"
@@ -106,7 +107,6 @@ import (
 	"tailscale.com/wgengine/magicsock"
 	"tailscale.com/wgengine/router"
 	"tailscale.com/wgengine/wgcfg"
-	"tailscale.com/wgengine/wgcfg/nmcfg"
 )
 
 var controlDebugFlags = getControlDebugFlags()
@@ -144,15 +144,52 @@ func RegisterNewSSHServer(fn newSSHServerFunc) {
 	newSSHServer = fn
 }
 
+// HookListenSSH is set by the ssh/tailssh package (via feature/ssh) to provide
+// an implementation of ListenSSH for use by tsnet.
+var HookListenSSH feature.Hook[func(net.Listener, *LocalBackend, logger.Logf) (net.Listener, error)]
+
+// ListenSSH wraps the given listener with an SSH server that authenticates
+// connections using Tailscale peer identity. The returned listener's Accept
+// yields net.Conn values that are *tailssh.Session.
+//
+// If the ssh/tailssh package has not been linked (e.g. via
+// _ "tailscale.com/feature/ssh"), ListenSSH returns an error.
+func (b *LocalBackend) ListenSSH(ln net.Listener, logf logger.Logf) (net.Listener, error) {
+	fn, ok := HookListenSSH.GetOk()
+	if !ok {
+		return nil, errors.New("SSH support not available; import _ \"tailscale.com/feature/ssh\"")
+	}
+	return fn(ln, b, logf)
+}
+
 // watchSession represents a WatchNotifications channel,
 // an [ipnauth.Actor] that owns it (e.g., a connected GUI/CLI),
 // and sessionID as required to close targeted buses.
 type watchSession struct {
 	ch        chan *ipn.Notify
+	ctx       context.Context
 	owner     ipnauth.Actor // or nil
 	sessionID string
 	cancel    context.CancelFunc // to shut down the session
 	mask      ipn.NotifyWatchOpt // watch options for this session
+
+	// lastSentUserProfile is the per-UserID [tailcfg.UserProfileView]
+	// most recently delivered to this session via [Notify.UserProfiles].
+	// On a subsequent send, an incoming entry whose
+	// [tailcfg.UserProfileView.Equal] reports identity-or-equal-fields
+	// to the stored view for that UserID is dropped from the
+	// per-session copy of [Notify.UserProfiles], so the session only
+	// sees genuinely new or changed profiles. The views share backing
+	// memory with the producer's tracking maps, so the common
+	// "control re-announces the same profile" case is a pointer-cheap
+	// equality check.
+	lastSentUserProfile map[tailcfg.UserID]tailcfg.UserProfileView
+
+	// lastSentSelf identifies the self node most recently delivered to
+	// this session via [Notify.SelfChange]. A change to self is a profile
+	// boundary for implicit bus state, so per-session dedup state such as
+	// lastSentUserProfile must be reset when this identity changes.
+	lastSentSelf tailcfg.NodeView
 }
 
 var (
@@ -192,6 +229,7 @@ type LocalBackend struct {
 	keyLogf     logger.Logf             // for printing list of peers on change
 	statsLogf   logger.Logf             // for printing peers stats on change
 	sys         *tsd.System
+	goos        string // runtime.GOOS usually, except in tests
 	eventClient *eventbus.Client
 	appcTask    execqueue.ExecQueue // handles updates from appc
 
@@ -238,6 +276,11 @@ type LocalBackend struct {
 	shouldInterceptTCPPortAtomic            syncs.AtomicValue[func(uint16) bool]         // TODO(nickkhyl): move to nodeBackend
 	shouldInterceptVIPServicesTCPPortAtomic syncs.AtomicValue[func(netip.AddrPort) bool] // TODO(nickkhyl): move to nodeBackend
 	numClientStatusCalls                    atomic.Uint32                                // TODO(nickkhyl): move to nodeBackend
+	lastDeadlockCheckUnix                   atomic.Int64
+	deadlockChecksInFlight                  atomic.Int64
+	deadlockTimerMu                         sync.Mutex
+	deadlockTimer                           *time.Timer
+	deadlockProbeTimer                      *time.Timer
 
 	// goTracker accounts for all goroutines started by LocalBacked, primarily
 	// for testing and graceful shutdown purposes.
@@ -294,6 +337,7 @@ type LocalBackend struct {
 	capTailnetLock bool      // whether netMap contains the tailnet lock capability
 	// hostinfo is mutated in-place while mu is held.
 	hostinfo          *tailcfg.Hostinfo      // TODO(nickkhyl): move to nodeBackend
+	explicitServices  []tailcfg.Service      // services set explicitly via SetExplicitServices; always uploaded
 	nmExpiryTimer     tstime.TimerController // for updating netMap on node expiry; can be nil; TODO(nickkhyl): move to nodeBackend
 	activeLogin       string                 // last logged LoginName from netMap; TODO(nickkhyl): move to nodeBackend (or remove? it's in [ipn.LoginProfile]).
 	engineStatus      ipn.EngineStatus
@@ -312,6 +356,21 @@ type LocalBackend struct {
 	lastStatusTime    time.Time                // status.AsOf value of the last processed status update
 	componentLogUntil map[string]componentLogState
 	currentUser       ipnauth.Actor
+	peerWGStateQueue  execqueue.ExecQueue // serializes WireGuard state transitions from wireguard-go
+	// peerWGState is the current non-zero WireGuard session state per peer,
+	// keyed by stable node ID for delivery on the IPN bus.
+	// Entries are added/updated by [LocalBackend.handlePeerWireGuardState]
+	// and removed when wireguard-go reports [wgengine.PeerWireGuardStateNone]
+	// (including the synthetic None fired by wireguard-go's RemovePeer path
+	// when a peer is removed from the WG config).
+	peerWGState map[tailcfg.StableNodeID]ipn.PeerState
+	// peerWGStableIDByKey caches the wireguard-go NodePublic -> StableNodeID
+	// translation so callbacks don't have to re-resolve through the netmap on
+	// every transition, and so the final PeerWireGuardStateNone callback for a
+	// removed peer can still be mapped to its StableNodeID after the peer is
+	// gone from the netmap. Entries are added on the first non-zero transition
+	// for a key and removed alongside the corresponding peerWGState entry.
+	peerWGStableIDByKey map[key.NodePublic]tailcfg.StableNodeID
 
 	// capForcedNetfilter is the netfilter that control instructs Linux clients
 	// to use, unless overridden locally.
@@ -351,6 +410,16 @@ type LocalBackend struct {
 	// notified about.
 	lastNotifiedDriveShares *views.SliceView[*drive.Share, drive.ShareView]
 
+	// driveGen is the generation counter consulted by the [drive.RemoteSource]
+	// installed on [sys.DriveForLocal]. It is bumped whenever the inputs that
+	// could change the set of drive-capable remotes might have changed: full
+	// netmap installs (domain + self caps), netmap delta updates (peer set or
+	// per-peer addresses), and packet-filter updates (which is where
+	// [PeerCapability] values actually live). The bump is a single atomic.Add,
+	// so we do it unconditionally rather than try to detect "did this
+	// mutation actually matter".
+	driveGen atomic.Uint64
+
 	// lastSuggestedExitNode stores the last suggested exit node suggestion to
 	// avoid unnecessary churn between multiple equally-good options.
 	lastSuggestedExitNode tailcfg.StableNodeID
@@ -364,21 +433,6 @@ type LocalBackend struct {
 	// refreshAutoExitNode indicates if the exit node should be recomputed when the next netcheck report is available.
 	refreshAutoExitNode bool // guarded by mu
 
-	// captiveCtx and captiveCancel are used to control captive portal
-	// detection. They are protected by 'mu' and can be changed during the
-	// lifetime of a LocalBackend.
-	//
-	// captiveCtx will always be non-nil, though it might be a canceled
-	// context. captiveCancel is non-nil if checkCaptivePortalLoop is
-	// running, and is set to nil after being canceled.
-	captiveCtx    context.Context
-	captiveCancel context.CancelFunc
-	// needsCaptiveDetection is a channel that is used to signal either
-	// that captive portal detection is required (sending true) or that the
-	// backend is healthy and captive portal detection is not required
-	// (sending false).
-	needsCaptiveDetection chan bool
-
 	// overrideAlwaysOn is whether [pkey.AlwaysOn] is overridden by the user
 	// and should have no impact on the WantRunning state until the policy changes,
 	// or the user re-connects manually, switches to a different profile, etc.
@@ -408,10 +462,6 @@ type LocalBackend struct {
 	// bind the node identity to this device.
 	hardwareAttested atomic.Bool
 
-	// getCertForTest is used to retrieve TLS certificates in tests.
-	// See [LocalBackend.ConfigureCertsForTest].
-	getCertForTest func(hostname string) (*TLSCertKeyPair, error)
-
 	// existsPendingAuthReconfig tracks if a goroutine is waiting to
 	// acquire [LocalBackend]'s mutex inside of [LocalBackend.AuthReconfig].
 	// It is used to prevent goroutines from piling up to do the same
@@ -438,6 +488,10 @@ func (b *LocalBackend) HealthTracker() *health.Tracker { return b.health }
 // Logger returns the logger for the backend.
 func (b *LocalBackend) Logger() logger.Logf { return b.logf }
 
+// BackendLogID returns the backend's log ID, or the zero value if logging is
+// not in use.
+func (b *LocalBackend) BackendLogID() logid.PublicID { return b.backendLogID }
+
 // UserMetricsRegistry returns the usermetrics registry for the backend
 func (b *LocalBackend) UserMetricsRegistry() *usermetric.Registry {
 	return b.sys.UserMetricsRegistry()
@@ -459,10 +513,24 @@ type metrics struct {
 	// approvedRoutes is a metric that reports the number of network routes served by the local node and approved
 	// by the control server.
 	approvedRoutes *usermetric.Gauge
+
+	// serveBytesInbound counts bytes received from peers on Serve connections
+	// for Tailscale Services, labeled by Service name. Plain (non-Service)
+	// serve and funnel traffic is not counted.
+	serveBytesInbound *usermetric.MultiLabelMap[serveLabels]
+
+	// serveBytesOutbound counts bytes sent to peers on Serve connections for
+	// Tailscale Services, labeled by Service name. Plain (non-Service) serve
+	// and funnel traffic is not counted.
+	serveBytesOutbound *usermetric.MultiLabelMap[serveLabels]
+}
+
+type serveLabels struct {
+	Service string `prom:"service"`
 }
 
 // clientGen is a func that creates a control plane client.
-// It's the type used by LocalBackend.SetControlClientGetterForTesting.
+// It's the type used by forTest.SetControlClientGetter.
 type clientGen func(controlclient.Options) (controlclient.Client, error)
 
 // NewLocalBackend returns a new LocalBackend that is ready to run,
@@ -500,46 +568,63 @@ func NewLocalBackend(logf logger.Logf, logID logid.PublicID, sys *tsd.System, lo
 	ctx, cancel := context.WithCancelCause(context.Background())
 	clock := tstime.StdClock{}
 
-	// Until we transition to a Running state, use a canceled context for
-	// our captive portal detection.
-	captiveCtx, captiveCancel := context.WithCancel(ctx)
-	captiveCancel()
-
 	m := metrics{
 		advertisedRoutes: sys.UserMetricsRegistry().NewGauge(
 			"tailscaled_advertised_routes", "Number of advertised network routes (e.g. by a subnet router)"),
 		approvedRoutes: sys.UserMetricsRegistry().NewGauge(
 			"tailscaled_approved_routes", "Number of approved network routes (e.g. by a subnet router)"),
+		serveBytesInbound: usermetric.NewMultiLabelMapWithRegistry[serveLabels](
+			sys.UserMetricsRegistry(),
+			"tailscaled_serve_inbound_bytes_total",
+			"counter",
+			"Bytes received from peers on Serve connections for Tailscale Services, labeled by Tailscale Service name."),
+		serveBytesOutbound: usermetric.NewMultiLabelMapWithRegistry[serveLabels](
+			sys.UserMetricsRegistry(),
+			"tailscaled_serve_outbound_bytes_total",
+			"counter",
+			"Bytes sent to peers on Serve connections for Tailscale Services, labeled by Tailscale Service name."),
 	}
 
 	b := &LocalBackend{
-		ctx:                   ctx,
-		ctxCancel:             cancel,
-		logf:                  logf,
-		keyLogf:               logger.LogOnChange(logf, 5*time.Minute, clock.Now),
-		statsLogf:             logger.LogOnChange(logf, 5*time.Minute, clock.Now),
-		sys:                   sys,
-		polc:                  sys.PolicyClientOrDefault(),
-		health:                sys.HealthTracker.Get(),
-		metrics:               m,
-		e:                     e,
-		dialer:                dialer,
-		store:                 store,
-		pm:                    pm,
-		backendLogID:          logID,
-		state:                 ipn.NoState,
-		em:                    newExpiryManager(logf, sys.Bus.Get()),
-		loginFlags:            loginFlags,
-		clock:                 clock,
-		captiveCtx:            captiveCtx,
-		captiveCancel:         nil, // so that we start checkCaptivePortalLoop when Running
-		needsCaptiveDetection: make(chan bool),
+		ctx:          ctx,
+		ctxCancel:    cancel,
+		logf:         logf,
+		keyLogf:      logger.LogOnChange(logf, 5*time.Minute, clock.Now),
+		statsLogf:    logger.LogOnChange(logf, 5*time.Minute, clock.Now),
+		sys:          sys,
+		polc:         sys.PolicyClientOrDefault(),
+		health:       sys.HealthTracker.Get(),
+		metrics:      m,
+		e:            e,
+		dialer:       dialer,
+		store:        store,
+		pm:           pm,
+		backendLogID: logID,
+		state:        ipn.NoState,
+		em:           newExpiryManager(logf, sys.Bus.Get()),
+		loginFlags:   loginFlags,
+		clock:        clock,
 	}
 
+	sys.NoiseRoundTripper.Set(noiseRoundTripper{b})
+
 	nb := newNodeBackend(ctx, b.logf, b.sys.Bus.Get())
 	b.currentNodeAtomic.Store(nb)
 	nb.ready()
 
+	e.SetPeerByIPPacketFunc(b.lookupPeerByIP)
+	e.SetPeerConfigFunc(b.peerAllowedIPs)
+	e.SetPeerForIPFunc(b.PeerForIP)
+	e.SetPeerSessionStateFunc(b.onPeerWireGuardState)
+	e.SetNetLogSource(netLogNodeSource{b})
+	e.SetWGPeerLookup(b.lookupPeerWireGuardString)
+	b.dialer.SetResolveMagicDNS(b.resolveMagicDNS)
+	if buildfeatures.HasDNS {
+		if dm, ok := sys.DNSManager.GetOK(); ok {
+			dm.Resolver().SetMagicDNSHosts(magicDNSHosts{b})
+		}
+	}
+
 	if sys.InitialConfig != nil {
 		if err := b.initPrefsFromConfig(sys.InitialConfig); err != nil {
 			return nil, err
@@ -627,8 +712,15 @@ func NewLocalBackend(logf logger.Logf, logID logid.PublicID, sys *tsd.System, lo
 	}
 	eventbus.SubscribeFunc(ec, b.onAppConnectorRouteUpdate)
 	eventbus.SubscribeFunc(ec, b.onAppConnectorStoreRoutes)
+	eventbus.SubscribeFunc(ec, b.onHomeDERPUpdate)
 	mConn.SetNetInfoCallback(b.setNetInfo) // TODO(tailscale/tailscale#17887): move to eventbus
 
+	if buildfeatures.HasDrive {
+		if f, ok := hookInstallDriveRemoteSource.GetOk(); ok {
+			f(b)
+		}
+	}
+
 	return b, nil
 }
 
@@ -658,6 +750,53 @@ func (b *LocalBackend) onAppConnectorStoreRoutes(ri appctype.RouteInfo) {
 	}
 }
 
+// testOnlyHomeDERPUpdate if non-nil is called after setting home DERP and
+// writing netmap to disk.
+var testOnlyHomeDERPUpdate func()
+
+func (b *LocalBackend) onHomeDERPUpdate(du magicsock.HomeDERPChanged) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	b.onHomeDERPUpdateLocked(du)
+
+	if testOnlyHomeDERPUpdate != nil {
+		testOnlyHomeDERPUpdate()
+	}
+}
+
+// onHomeDERPUpdateLocked considitonally updates the homeDERP for use in the
+// netmap cache.
+// If we switched our currentNode by switching profiles, we might be trying
+// to update the homeDERP from another profile. If the old homeDERP does not
+// match what we expect, don't swap the homeDERP.
+// In practice, it is possible that one profile with a homeDERP of 0 (no-derp)
+// got switched before setting any home DERP or that DERP IDs match across
+// DERP maps. Since the risk of this happening is small and the consequences
+// of this is just a possible less optimal DERP until the next reSTUN,
+// accept this possibility.
+func (b *LocalBackend) onHomeDERPUpdateLocked(du magicsock.HomeDERPChanged) {
+	cn := b.currentNode()
+
+	if cn == nil || cn.DERPMap() == nil || cn.DERPMap().Regions == nil {
+		return
+	}
+
+	if _, ok := cn.DERPMap().Regions[du.New]; !ok {
+		return
+	}
+
+	if !cn.homeDERP.CompareAndSwap(int64(du.Old), int64(du.New)) {
+		return
+	}
+
+	// Update the relevant parts of the cached copy of the network map, notably
+	// not including the peers.
+	if err := b.writeNetmapToDiskLockedWithoutPeers(b.NetMapNoPeers()); err != nil {
+		b.logf("update netmap cache: %v", err)
+	}
+}
+
 func (b *LocalBackend) Clock() tstime.Clock { return b.clock }
 func (b *LocalBackend) Sys() *tsd.System    { return b.sys }
 
@@ -937,16 +1076,6 @@ func (b *LocalBackend) IPServiceMappings() netmap.IPServiceMappings {
 	return b.ipVIPServiceMap
 }
 
-func (b *LocalBackend) SetIPServiceMappingsForTest(m netmap.IPServiceMappings) {
-	b.mu.Lock()
-	defer b.mu.Unlock()
-	testenv.AssertInTest()
-	b.ipVIPServiceMap = m
-	if ns, ok := b.sys.Netstack.GetOK(); ok {
-		ns.UpdateIPServiceMappings(m)
-	}
-}
-
 // setConfigLocked uses the provided config to update the backend's prefs
 // and other state.
 func (b *LocalBackend) setConfigLocked(conf *conffile.Config) error {
@@ -974,23 +1103,61 @@ func (b *LocalBackend) pauseOrResumeControlClientLocked() {
 	if b.cc == nil {
 		return
 	}
-	networkUp := b.interfaceState.AnyInterfaceUp()
-	pauseForNetwork := (b.state == ipn.Stopped && b.NetMap() != nil) || (!networkUp && !testenv.InTest() && !envknob.AssumeNetworkUp())
-
-	prefs := b.pm.CurrentPrefs()
-	pauseForSyncPref := prefs.Valid() && prefs.Sync().EqualBool(false)
-
-	b.cc.SetPaused(pauseForNetwork || pauseForSyncPref)
+	b.cc.SetPaused(b.shouldPauseControlClientLocked(b.pm.CurrentPrefs()))
 }
 
-// DisconnectControl shuts down control client. This can be run before node shutdown to force control to consider this ndoe
-// inactive. This can be used to ensure that nodes that are HA subnet router or app connector replicas are shutting
-// down, clients switch over to other replicas whilst the existing connections are kept alive for some period of time.
+// shouldPauseControlClientLocked reports whether the control client should be paused:
+// if the LocalBackend is in Stopped state with a valid NetMap,
+// if there is no network available,
+// or if syncing preferences from the control plane has been disabled.
+//
+// b.mu must be held.
+func (b *LocalBackend) shouldPauseControlClientLocked(prefs ipn.PrefsView) bool {
+	syncs.RequiresMutex(&b.mu)
+
+	pauseForSyncPref := prefs.Valid() && prefs.Sync().EqualBool(false)
+	if pauseForSyncPref {
+		return true
+	}
+
+	// If tailscaled is being restarted, but it is supposed to be stopped,
+	// it mustn’t pause until the initial netmap has been loaded.
+	isStopped := b.state == ipn.Stopped && b.NetMapNoPeers() != nil
+	if isStopped {
+		return true
+	}
+
+	networkUp := b.interfaceState.AnyInterfaceUp()
+	pauseForNetwork := !networkUp && !testenv.InTest() && !envknob.AssumeNetworkUp()
+	if pauseForNetwork {
+		return true
+	}
+
+	return false
+}
+
+// DisconnectControl shuts down the control client. This can be run before
+// node shutdown to force control to consider this node inactive. This can
+// be used to ensure that nodes that are HA subnet router or app connector
+// replicas are shutting down, clients switch over to other replicas whilst
+// the existing connections are kept alive for some period of time.
+//
+// Shutdown of the detached client is synchronous: it cancels the client's
+// in-flight requests and waits for its goroutines to exit, but it does not
+// wait for pending updates to be delivered.
 func (b *LocalBackend) DisconnectControl() {
 	b.mu.Lock()
 	cc := b.resetControlClientLocked()
 	b.mu.Unlock()
 
+	// The Shutdown call must not run while b.mu is held, per the deadlock
+	// history in tailscale/tailscale#18052: controlclient.Auto's
+	// goroutines deliver callbacks into LocalBackend through an execqueue
+	// whose RunSync holds the queue mutex while the callback acquires
+	// b.mu, and Auto.Shutdown acquires that same queue mutex, so calling
+	// it with b.mu held inverts the lock order. A previous attempt to
+	// shut the client down synchronously inside resetControlClientLocked
+	// with b.mu held (#18127) deadlocked and was reverted (#18149).
 	if cc != nil {
 		cc.Shutdown()
 	}
@@ -1051,12 +1218,6 @@ func (b *LocalBackend) linkChange(delta *netmon.ChangeDelta) {
 	}
 }
 
-// Captive portal detection hooks.
-var (
-	hookCaptivePortalHealthChange feature.Hook[func(*LocalBackend, *health.State)]
-	hookCheckCaptivePortalLoop    feature.Hook[func(*LocalBackend, context.Context)]
-)
-
 func (b *LocalBackend) onHealthChange(change health.Change) {
 	if !buildfeatures.HasHealth {
 		return
@@ -1084,10 +1245,6 @@ func (b *LocalBackend) onHealthChange(change health.Change) {
 		b.cc.SetIPForwardingBroken(broken)
 	}
 	b.mu.Unlock()
-
-	if f, ok := hookCaptivePortalHealthChange.GetOk(); ok {
-		f(b, state)
-	}
 }
 
 // GetOrSetCaptureSink returns the current packet capture sink, creating it
@@ -1133,12 +1290,15 @@ func (b *LocalBackend) ClearCaptureSink() {
 // Shutdown halts the backend and all its sub-components. The backend
 // can no longer be used after Shutdown returns.
 func (b *LocalBackend) Shutdown() {
+	defer b.CheckDeadlocks()()
+
 	// Close the [eventbus.Client] to wait for subscribers to
 	// return before acquiring b.mu:
 	//  1. Event handlers also acquire b.mu, they can deadlock with c.Shutdown().
 	//  2. Event handlers may not guard against undesirable post/in-progress
 	//     LocalBackend.Shutdown() behaviors.
 	b.appcTask.Shutdown()
+	b.peerWGStateQueue.Shutdown()
 	b.eventClient.Close()
 
 	b.em.close()
@@ -1150,10 +1310,7 @@ func (b *LocalBackend) Shutdown() {
 	}
 	b.shutdownCalled = true
 
-	if buildfeatures.HasCaptivePortal && b.captiveCancel != nil {
-		b.logf("canceling captive portal context")
-		b.captiveCancel()
-	}
+	b.shutdownCertRefreshLoopLocked()
 
 	b.stopReconnectTimerLocked()
 
@@ -1199,6 +1356,14 @@ func (b *LocalBackend) Shutdown() {
 	if cc != nil {
 		cc.Shutdown()
 	}
+	if buildfeatures.HasRuntimeMetrics {
+		// We disable runtime metrics _after_ the control client is shutdown to
+		// ensure we don't leak the metrics polling goroutine in the case where
+		// netmap handling races [LocalBackend] shutdown.
+		if f, ok := HookSetRuntimeMetricsEnabled.GetOk(); ok {
+			f(false)
+		}
+	}
 	b.ctxCancel(errShutdown)
 	b.currentNode().shutdown(errShutdown)
 	b.extHost.Shutdown()
@@ -1287,7 +1452,13 @@ func (b *LocalBackend) UpdateStatus(sb *ipnstate.StatusBuilder) {
 
 	b.mu.Lock()
 	defer b.mu.Unlock()
+	b.updateStatusLocked(sb)
+}
 
+// updateStatusLocked is the b.mu-holding portion of [LocalBackend.UpdateStatus].
+//
+// b.mu must be held.
+func (b *LocalBackend) updateStatusLocked(sb *ipnstate.StatusBuilder) {
 	cn := b.currentNode()
 	nm := cn.NetMap()
 	sb.MutateStatus(func(s *ipnstate.Status) {
@@ -1308,6 +1479,7 @@ func (b *LocalBackend) UpdateStatus(sb *ipnstate.StatusBuilder) {
 		}
 		if nm != nil {
 			s.CertDomains = append([]string(nil), nm.DNS.CertDomains...)
+			s.ExtraRecords = append([]tailcfg.DNSRecord(nil), nm.DNS.ExtraRecords...)
 			s.MagicDNSSuffix = nm.MagicDNSSuffix()
 			if s.CurrentTailnet == nil {
 				s.CurrentTailnet = &ipnstate.TailnetStatus{}
@@ -1380,6 +1552,15 @@ func (b *LocalBackend) UpdateStatus(sb *ipnstate.StatusBuilder) {
 	// TODO: hostinfo, and its networkinfo
 	// TODO: EngineStatus copy (and deprecate it?)
 
+	// Always add the self user's profile, even when peers are omitted, so that
+	// callers can resolve the self node's owner to a login name.
+	// See https://github.com/tailscale/tailscale/issues/19894.
+	if nm != nil {
+		if up, ok := nm.UserProfiles[nm.User()]; ok {
+			sb.AddUser(nm.User(), up)
+		}
+	}
+
 	if sb.WantPeers {
 		b.populatePeerStatusLocked(sb)
 	}
@@ -1396,6 +1577,7 @@ func (b *LocalBackend) populatePeerStatusLocked(sb *ipnstate.StatusBuilder) {
 		sb.AddUser(id, up)
 	}
 	exitNodeID := b.pm.CurrentPrefs().ExitNodeID()
+	blankHostinfo := new(tailcfg.Hostinfo).View()
 	for _, p := range cn.Peers() {
 		tailscaleIPs := make([]netip.Addr, 0, p.Addresses().Len())
 		for i := range p.Addresses().Len() {
@@ -1404,20 +1586,24 @@ func (b *LocalBackend) populatePeerStatusLocked(sb *ipnstate.StatusBuilder) {
 				tailscaleIPs = append(tailscaleIPs, addr.Addr())
 			}
 		}
+		hostinfo := p.Hostinfo()
+		if !hostinfo.Valid() {
+			hostinfo = blankHostinfo
+		}
 		ps := &ipnstate.PeerStatus{
 			InNetworkMap:    true,
 			UserID:          p.User(),
 			AltSharerUserID: p.Sharer(),
 			TailscaleIPs:    tailscaleIPs,
-			HostName:        p.Hostinfo().Hostname(),
+			HostName:        hostinfo.Hostname(),
 			DNSName:         p.Name(),
-			OS:              p.Hostinfo().OS(),
+			OS:              hostinfo.OS(),
 			LastSeen:        p.LastSeen().Get(),
 			Online:          p.Online().Get(),
-			ShareeNode:      p.Hostinfo().ShareeNode(),
+			ShareeNode:      hostinfo.ShareeNode(),
 			ExitNode:        p.StableID() != "" && p.StableID() == exitNodeID,
-			SSH_HostKeys:    p.Hostinfo().SSH_HostKeys().AsSlice(),
-			Location:        p.Hostinfo().Location().AsStruct(),
+			SSH_HostKeys:    hostinfo.SSH_HostKeys().AsSlice(),
+			Location:        hostinfo.Location().AsStruct(),
 			Capabilities:    p.Capabilities().AsSlice(),
 		}
 		for _, f := range b.extHost.Hooks().SetPeerStatus {
@@ -1447,6 +1633,7 @@ func (b *LocalBackend) populatePeerStatusLocked(sb *ipnstate.StatusBuilder) {
 func peerStatusFromNode(ps *ipnstate.PeerStatus, n tailcfg.NodeView) {
 	ps.PublicKey = n.Key()
 	ps.ID = n.StableID()
+	ps.NodeID = n.ID()
 	ps.Created = n.Created()
 	ps.ExitNodeOption = buildfeatures.HasUseExitNode && tsaddr.ContainsExitRoutes(n.AllowedIPs())
 	if n.Tags().Len() != 0 {
@@ -1489,9 +1676,9 @@ func (b *LocalBackend) WhoIsNodeKey(k key.NodePublic) (n tailcfg.NodeView, u tai
 	cn := b.currentNode()
 	if nid, ok := cn.NodeByKey(k); ok {
 		if n, ok := cn.NodeByID(nid); ok {
-			up, ok := cn.NetMap().UserProfiles[n.User()]
+			up, _ := cn.UserByID(n.User())
 			u = profileFromView(up)
-			return n, u, ok
+			return n, u, true
 		}
 	}
 	return n, u, false
@@ -1511,6 +1698,11 @@ var debugWhoIs = envknob.RegisterBool("TS_DEBUG_WHOIS")
 // If ok == true, n and u are valid.
 func (b *LocalBackend) WhoIs(proto string, ipp netip.AddrPort) (n tailcfg.NodeView, u tailcfg.UserProfile, ok bool) {
 	var zero tailcfg.NodeView
+
+	// Normalize IPv4-mapped IPv6 addresses (e.g. "::ffff:100.87.98.86") to
+	// their canonical IPv4 form so the lookup matches the node's IPv4 address.
+	ipp = netip.AddrPortFrom(ipp.Addr().Unmap(), ipp.Port())
+
 	b.mu.Lock()
 	defer b.mu.Unlock()
 
@@ -1571,15 +1763,52 @@ func (b *LocalBackend) PeerCaps(src netip.Addr) tailcfg.PeerCapMap {
 	return b.currentNode().PeerCaps(src)
 }
 
-func (b *LocalBackend) GetFilterForTest() *filter.Filter {
-	testenv.AssertInTest()
-	nb := b.currentNode()
-	return nb.filterAtomic.Load()
+// PeerCapsIncludingUnsigned is like [LocalBackend.PeerCaps] but does not deny
+// capabilities to peers with UnsignedPeerAPIOnly set. It exists only for the
+// Funnel ingress path; see [nodeBackend.PeerCapsIncludingUnsigned].
+func (b *LocalBackend) PeerCapsIncludingUnsigned(src netip.Addr) tailcfg.PeerCapMap {
+	return b.currentNode().PeerCapsIncludingUnsigned(src)
+}
+
+// PeerCapsForIP returns the capabilities that remote src IP has when
+// talking to the given destination IP on this node.
+func (b *LocalBackend) PeerCapsForIP(src, dst netip.Addr) tailcfg.PeerCapMap {
+	return b.currentNode().PeerCapsForIP(src, dst)
+}
+
+// PeerCapsForService returns the capabilities that remote src IP has when
+// talking to the named VIP service on this node.
+func (b *LocalBackend) PeerCapsForService(src netip.Addr, svcName tailcfg.ServiceName) tailcfg.PeerCapMap {
+	return b.currentNode().PeerCapsForService(src, svcName)
+}
+
+// PeerByID returns the current full [tailcfg.Node] for the peer with the
+// given NodeID, in O(1) time. It returns ok=false if no such peer is in
+// the current netmap.
+//
+// It is intended for callers that observed a peer-mutation signal (e.g.
+// [ipn.Notify.PeerChangedPatch] or [ipn.Notify.PeersChanged]) and want
+// the latest state of the affected node without having to apply the patch
+// themselves — useful for older clients that don't recognize a new
+// [tailcfg.PeerChange] field, or that just don't want to bother.
+func (b *LocalBackend) PeerByID(id tailcfg.NodeID) (n tailcfg.NodeView, ok bool) {
+	return b.currentNode().NodeByID(id)
+}
+
+// UserProfile returns the current [tailcfg.UserProfile] for the given UserID,
+// in O(1) time. It returns ok=false if no such User is in the current netmap.
+//
+// It is the LocalAPI/LocalBackend fallback for IPN-bus consumers that see a
+// UserID they don't recognize and want to resolve it.
+func (b *LocalBackend) UserProfile(id tailcfg.UserID) (u tailcfg.UserProfileView, ok bool) {
+	return b.currentNode().UserByID(id)
 }
 
 // SetControlClientStatus is the callback invoked by the control client whenever it posts a new status.
 // Among other things, this is where we update the netmap, packet filters, DNS and DERP maps.
 func (b *LocalBackend) SetControlClientStatus(c controlclient.Client, st controlclient.Status) {
+	defer b.CheckDeadlocks()()
+
 	if b.ignoreControlClientUpdates.Load() {
 		b.logf("ignoring SetControlClientStatus during controlclient shutdown")
 		return
@@ -1763,7 +1992,7 @@ func (b *LocalBackend) setControlClientStatusLocked(c controlclient.Client, st c
 	// Perform all reconfiguration based on the netmap here.
 	if st.NetMap != nil {
 		b.capTailnetLock = st.NetMap.HasCap(tailcfg.CapabilityTailnetLock)
-		b.setWebClientAtomicBoolLocked(st.NetMap)
+		b.setWebClientAtomicBoolLocked(st.NetMap.AllCaps)
 
 		b.mu.Unlock() // respect locking rules for tkaSyncIfNeeded
 		if err := b.tkaSyncIfNeeded(st.NetMap, prefs.View()); err != nil {
@@ -1820,8 +2049,25 @@ func (b *LocalBackend) setControlClientStatusLocked(c controlclient.Client, st c
 			}
 		}
 
-		b.e.SetNetworkMap(st.NetMap)
-		b.MagicConn().SetDERPMap(st.NetMap.DERPMap)
+		b.e.SetSelfNode(st.NetMap.SelfNode)
+
+		var cachedHome int
+		if c == nil && st.NetMap.Cached && st.NetMap.SelfNode.Valid() {
+			cachedHome = st.NetMap.SelfNode.HomeDERP()
+		}
+		if cachedHome != 0 {
+			// Loading from a cached netmap (c == nil means no live control
+			// client). Pre-seed the home DERP from the cached self node so
+			// that the guard in maybeSetNearestDERP prevents changing the
+			// DERP home before we reconnect to the control plane. If the cache has
+			// nothing in it, skip this, and let the node pick a DERP itself.
+			b.MagicConn().SetDERPMapWithoutReSTUN(st.NetMap.DERPMap)
+			b.health.SetOutOfPollNetMap()
+			b.MagicConn().ForceSetNearestDERP(cachedHome)
+		} else {
+			b.MagicConn().SetDERPMap(st.NetMap.DERPMap)
+		}
+
 		b.MagicConn().SetOnlyTCP443(st.NetMap.HasCap(tailcfg.NodeAttrOnlyTCP443))
 
 		// Update our cached DERP map
@@ -1830,7 +2076,26 @@ func (b *LocalBackend) setControlClientStatusLocked(c controlclient.Client, st c
 		// Update the DERP map in the health package, which uses it for health notifications
 		b.health.SetDERPMap(st.NetMap.DERPMap)
 
-		b.sendLocked(ipn.Notify{NetMap: st.NetMap})
+		// Notify watchers that the self node may have changed. Reactive
+		// consumers (containerboot, kube agents, sniproxy, etc.) listen on
+		// this signal and re-fetch peers/DNS via [LocalClient.NetMap] if
+		// they need more than self info.
+		var selfChange *tailcfg.Node
+		if st.NetMap.SelfNode.Valid() {
+			selfChange = st.NetMap.SelfNode.AsStruct()
+		}
+		notify := ipn.Notify{SelfChange: selfChange}
+		if b.hasPeerChangeWatcherLocked() {
+			notify.UserProfiles = st.NetMap.UserProfiles
+			notify.PeersChanged = make([]*tailcfg.Node, 0, len(st.NetMap.Peers))
+			for _, p := range st.NetMap.Peers {
+				notify.PeersChanged = append(notify.PeersChanged, p.AsStruct())
+			}
+		}
+		if goosGetsLegacyNetmapNotify {
+			notify.NetMap = st.NetMap
+		}
+		b.sendLocked(notify)
 
 		// The error here is unimportant as is the result.  This will recalculate the suggested exit node
 		// cache the value and push any changes to the IPN bus.
@@ -1856,16 +2121,11 @@ func (b *LocalBackend) setControlClientStatusLocked(c controlclient.Client, st c
 	b.authReconfigLocked()
 }
 
+// PatchDiscoKey records that a peer's new disco key was learned via TSMP,
+// so the netmap update carrying the same change need not reset the peer's
+// WireGuard session. It implements [controlclient.DiscoKeyUpdater].
 func (b *LocalBackend) PatchDiscoKey(pub key.NodePublic, disco key.DiscoPublic) {
-	// PatchDiscoKey mirrors the implementation of [controlclient.patchDiscoKeyer].
-	// It is implemented here to avoid the dependency edge to controlclient, but must be kept
-	// in sync with the original implementation.
-	type patchDiscoKeyer interface {
-		PatchDiscoKey(key.NodePublic, key.DiscoPublic)
-	}
-	if e, ok := b.e.(patchDiscoKeyer); ok {
-		e.PatchDiscoKey(pub, disco)
-	}
+	b.currentNode().recordTSMPLearnedDisco(pub, disco)
 }
 
 type preferencePolicyInfo struct {
@@ -2060,8 +2320,8 @@ func (b *LocalBackend) applyExitNodeSysPolicyLocked(prefs *ipn.Prefs) (anyChange
 // registerSysPolicyWatch subscribes to syspolicy change notifications
 // and immediately applies the effective syspolicy settings to the current profile.
 func (b *LocalBackend) registerSysPolicyWatch() (unregister func(), err error) {
-	if unregister, err = b.polc.RegisterChangeCallback(b.sysPolicyChanged); err != nil {
-		return nil, fmt.Errorf("syspolicy: LocalBacked failed to register policy change callback: %v", err)
+	if unregister, err = b.polc.RegisterChangeCallback("", b.sysPolicyChanged); err != nil {
+		return nil, fmt.Errorf("syspolicy: LocalBackend failed to register policy change callback: %v", err)
 	}
 	if prefs, anyChange := b.reconcilePrefs(); anyChange {
 		b.logf("syspolicy: changed initial profile prefs: %v", prefs.Pretty())
@@ -2088,6 +2348,8 @@ func (b *LocalBackend) reconcilePrefs() (_ ipn.PrefsView, anyChange bool) {
 // sysPolicyChanged is a callback triggered by syspolicy when it detects
 // a change in one or more syspolicy settings.
 func (b *LocalBackend) sysPolicyChanged(policy policyclient.PolicyChange) {
+	defer b.CheckDeadlocks()()
+
 	if policy.HasChangedAnyOf(pkey.AlwaysOn, pkey.AlwaysOnOverrideWithReason) {
 		// If the AlwaysOn or the AlwaysOnOverrideWithReason policy has changed,
 		// we should reset the overrideAlwaysOn flag, as the override might
@@ -2120,10 +2382,39 @@ func (b *LocalBackend) sysPolicyChanged(policy policyclient.PolicyChange) {
 	}
 }
 
-var _ controlclient.NetmapDeltaUpdater = (*LocalBackend)(nil)
+// sysPolicyChangedForSession is called when the effective policy for a session's
+// user changes. It fetches the new snapshot and sends it to that session.
+func (b *LocalBackend) sysPolicyChangedForSession(sess *watchSession) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	snapshot, err := b.polc.GetPolicySnapshot("")
+	if err != nil || snapshot == nil {
+		return
+	}
+
+	n := ipn.Notify{Policy: snapshot, Version: version.Long()}
+	for _, f := range b.extHost.Hooks().MutateNotifyLocked {
+		f(&n)
+	}
+	nForSess := b.notifyForSessionLocked(sess, &n)
+	select {
+	case sess.ch <- nForSess:
+	default:
+	}
+}
+
+var (
+	_ controlclient.NetmapDeltaUpdater  = (*LocalBackend)(nil)
+	_ controlclient.PacketFilterUpdater = (*LocalBackend)(nil)
+	_ controlclient.UserProfileUpdater  = (*LocalBackend)(nil)
+	_ controlclient.DiscoKeyUpdater     = (*LocalBackend)(nil)
+)
 
 // UpdateNetmapDelta implements controlclient.NetmapDeltaUpdater.
 func (b *LocalBackend) UpdateNetmapDelta(muts []netmap.NodeMutation) (handled bool) {
+	defer b.CheckDeadlocks()()
+
 	var notify *ipn.Notify // non-nil if we need to send a Notify
 	defer func() {
 		if notify != nil {
@@ -2135,10 +2426,94 @@ func (b *LocalBackend) UpdateNetmapDelta(muts []netmap.NodeMutation) (handled bo
 	defer b.mu.Unlock()
 
 	cn := b.currentNode()
-	cn.UpdateNetmapDelta(muts)
+	// Filter the mutations through tailnet lock before applying them.
+	// Unsigned (or invalidly-signed) peers arriving via PeersChanged
+	// ride the delta path as NodeMutationUpsert and would otherwise
+	// land in nodeBackend.peers without ever passing through
+	// tkaFilterNetmapLocked. tkaFilterDeltaMutsLocked rewrites any
+	// such upsert into a NodeMutationRemove for the same node ID, so
+	// any previously-signed peer at that ID is also evicted, matching
+	// the full-netmap behavior of [tkaFilterNetmapLocked].
+	muts = b.tkaFilterDeltaMutsLocked(muts)
+	needsAuthReconfig := netmapDeltaNeedsAuthReconfig(cn, muts)
 
-	if ms, ok := b.sys.MagicSock.GetOK(); ok {
-		ms.UpdateNetmapDelta(muts)
+	deltaRes, _ := cn.UpdateNetmapDelta(muts)
+	if buildfeatures.HasDrive {
+		// Drive's lazy remotes-source caches its rebuild keyed by this
+		// generation, so any delta — peer add/remove, address change,
+		// or otherwise — needs to invalidate that cache. We bump
+		// unconditionally rather than type-switch over [muts]; the
+		// atomic add is cheaper than the switch and immune to future
+		// mutation kinds that might affect drive-cap evaluation.
+		b.driveGen.Add(1)
+	}
+
+	// In order that we can update the cache, keep track of which nodes are
+	// updated and removed. The nodeBackend has already applied any deltas, so
+	// we just need to know which nodes need updating.
+	updateIDs := set.Of[tailcfg.NodeID]()
+	removeIDs := set.Of[tailcfg.NodeID]()
+
+	// Dispatch Upsert/Remove per-peer to magicsock, and any per-field
+	// patches via the existing UpdateNetmapDelta path. The per-peer
+	// methods take c.mu themselves, so we can't call them from inside
+	// magicsock.UpdateNetmapDelta which already holds c.mu.
+	peersUpsertedOrRemoved := false
+	ms := b.MagicConn()
+	for _, m := range muts {
+		switch m := m.(type) {
+		case netmap.NodeMutationUpsert:
+			ms.UpsertPeer(m.Node)
+			peersUpsertedOrRemoved = true
+			metricNetmapDeltaPeerUpserted.Add(1)
+			updateIDs.Add(m.Node.ID())
+		case netmap.NodeMutationRemove:
+			ms.RemovePeer(m.NodeIDBeingMutated())
+			peersUpsertedOrRemoved = true
+			metricNetmapDeltaPeerRemoved.Add(1)
+			removeIDs.Add(m.NodeIDBeingMutated())
+		default:
+			metricNetmapDeltaPeerPatched.Add(1)
+			updateIDs.Add(m.NodeIDBeingMutated())
+		}
+	}
+	ms.UpdateNetmapDelta(muts)
+
+	// Sync the WireGuard device for exactly the peers whose allowed
+	// source prefixes changed, as computed by the route manager when
+	// the delta was applied above. Removed peers appear with a nil
+	// value and are removed from the device; SyncDevicePeer reads
+	// the live per-peer config, so only the keys matter here.
+	for k := range deltaRes.ChangedAllowedIPs {
+		b.e.SyncDevicePeer(k)
+	}
+	b.setDataPlanePeerRoutes()
+
+	// Reset the WireGuard session for peers whose disco key changed in
+	// a way that indicates a restart, flushing their dead session keys;
+	// each such peer is lazily re-created on demand with current state.
+	for k := range deltaRes.DiscoChanged {
+		b.e.ResetDevicePeer(k)
+	}
+
+	// Force a full authReconfig + SetSelfNode on any peer add or
+	// remove. The WireGuard device itself no longer depends on this:
+	// the SyncDevicePeer calls above keep its peer set delta-correct,
+	// and its lazy peer creation reads live state via
+	// [wgengine.Engine.SetPeerConfigFunc]. What still rides
+	// authReconfig is everything else derived from the full peer set:
+	// OS routes (router.Config) and the quad-100 resolver's MagicDNS
+	// hosts map (dnsConfigForNetmap). Once those become delta-aware
+	// too, this can be gated on the route manager's OS-routes changes
+	// instead of firing on every peer change.
+	needsAuthReconfig = needsAuthReconfig || peersUpsertedOrRemoved
+	if needsAuthReconfig {
+		if peersUpsertedOrRemoved {
+			if self := cn.Self(); self.Valid() {
+				b.e.SetSelfNode(self)
+			}
+		}
+		b.authReconfigLocked()
 	}
 
 	// If auto exit nodes are enabled and our exit node went offline,
@@ -2160,6 +2535,9 @@ func (b *LocalBackend) UpdateNetmapDelta(muts []netmap.NodeMutation) (handled bo
 		}
 	}
 
+	// TODO(sfllaw): If [buildfeatures.HasRouteCheck] is enabled,
+	// a probe may be triggered for an updated routecheck reachability report,
+	// which should influence which exit nodes are considered valid to suggest.
 	if cn.NetMap() != nil && mutationsAreWorthyOfRecalculatingSuggestedExitNode(muts, cn, b.lastSuggestedExitNode) {
 		// Recompute the suggested exit node
 		b.suggestExitNodeLocked()
@@ -2170,15 +2548,54 @@ func (b *LocalBackend) UpdateNetmapDelta(muts []netmap.NodeMutation) (handled bo
 		return true
 	}
 
-	if mutationsAreWorthyOfTellingIPNBus(muts) {
-		// The notifier will strip the netmap based on the watchOpts mask if the watcher
-		// has indicated it can handle PeerChanges.
-		notify = &ipn.Notify{NetMap: cn.netMapWithPeers()}
-		if peerChanges, ok := ipnBusPeerChangesFromNodeMutations(muts); ok {
-			notify.PeerChanges = peerChanges
-		} else {
+	// Reaching here, apply any peer changes to the netmap cache (if relevant).
+	// Note we do this AFTER the updates are applied in the nodeBackend, so that
+	// we can get its updated views to put back into the cache.
+	if buildfeatures.HasCacheNetMap &&
+		cn.SelfHasCap(tailcfg.NodeAttrCacheNetworkMaps) &&
+		envknob.BoolDefaultTrue("TS_USE_CACHED_NETMAP") {
+
+		var peersToUpdate []tailcfg.NodeView
+		for id := range updateIDs {
+			if n, ok := cn.NodeByID(id); ok {
+				peersToUpdate = append(peersToUpdate, n)
+			}
+		}
+		var peersToRemove []tailcfg.StableNodeID
+		for id := range removeIDs {
+			if n, ok := cn.NodeByID(id); ok {
+				peersToRemove = append(peersToRemove, n.StableID())
+			}
+		}
+		if err := b.writePeerDeltaToDiskLocked(peersToUpdate, peersToRemove); err != nil {
+			b.logf("update netmap cache for peer deltas: %v", err)
+		}
+	}
+
+	// A single MapResponse can carry upserts/removes (full Nodes) AND
+	// per-field patches in the same delta. Build one Notify that
+	// reflects all of them; per-session stripping in [sendToLocked]
+	// hides fields the watcher didn't opt in to (and promotes patches
+	// into full Nodes for watchers that asked for PeerChanges but not
+	// PeerPatches).
+	if peersUpsertedOrRemoved || mutationsAreWorthyOfTellingIPNBus(muts) {
+		notify = &ipn.Notify{}
+		for _, m := range muts {
+			switch m := m.(type) {
+			case netmap.NodeMutationUpsert:
+				notify.PeersChanged = append(notify.PeersChanged, m.Node.AsStruct())
+			case netmap.NodeMutationRemove:
+				notify.PeersRemoved = append(notify.PeersRemoved, m.NodeIDBeingMutated())
+			}
+		}
+		if patches, ok := ipnBusPeerChangedPatchFromNodeMutations(muts); ok && len(patches) > 0 {
+			notify.PeerChangedPatch = patches
+		} else if !ok {
 			b.logf("[unexpected] got mutations worthy of telling IPN bus but failed to convert to peer changes")
 		}
+		if goosGetsLegacyNetmapNotify {
+			notify.NetMap = cn.netMapWithPeers()
+		}
 	} else if testenv.InTest() {
 		// In tests, send an empty Notify as a wake-up so end-to-end
 		// integration tests in another repo can check on the status of
@@ -2188,6 +2605,96 @@ func (b *LocalBackend) UpdateNetmapDelta(muts []netmap.NodeMutation) (handled bo
 	return true
 }
 
+func netmapDeltaNeedsAuthReconfig(cn *nodeBackend, muts []netmap.NodeMutation) bool {
+	for _, m := range muts {
+		switch m := m.(type) {
+		case netmap.NodeMutationUpsert:
+			old, ok := cn.NodeByID(m.Node.ID())
+			if !ok {
+				continue
+			}
+			if peerRouteConfigChanged(old, m.Node) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func peerRouteConfigChanged(old, new tailcfg.NodeView) bool {
+	return old.Key() != new.Key() ||
+		old.DiscoKey() != new.DiscoKey() ||
+		!views.SliceEqual(old.AllowedIPs(), new.AllowedIPs()) ||
+		old.Expired() != new.Expired() ||
+		old.IsJailed() != new.IsJailed() ||
+		old.IsWireGuardOnly() != new.IsWireGuardOnly() ||
+		old.SelfNodeV4MasqAddrForThisPeer() != new.SelfNodeV4MasqAddrForThisPeer() ||
+		old.SelfNodeV6MasqAddrForThisPeer() != new.SelfNodeV6MasqAddrForThisPeer()
+}
+
+// UpdatePacketFilter implements [controlclient.PacketFilterUpdater].
+//
+// It is called by the controlclient when a MapResponse carries a new packet
+// filter. Avoiding a full netmap rebuild matters here because the packet
+// filter currently changes on every peer add on large tailnets.
+func (b *LocalBackend) UpdatePacketFilter(rules views.Slice[tailcfg.FilterRule], parsed []filter.Match) bool {
+	defer b.CheckDeadlocks()()
+
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	cn := b.currentNode()
+	if cn.NetMap() == nil {
+		// No netmap installed yet; the initial full-netmap path will
+		// take care of installing the filter.
+		return false
+	}
+	metricUpdatePacketFilter.Add(1)
+	cn.setPacketFilter(rules, parsed)
+	b.updateFilterLocked(b.pm.CurrentPrefs())
+	if buildfeatures.HasDrive {
+		// The drive sharer cap (and any other PeerCapability) is
+		// derived from the packet filter, so an updated rule set can
+		// flip a peer in or out of the drive-capable set without any
+		// per-peer mutation. Bump so the next WebDAV request rebuilds.
+		b.driveGen.Add(1)
+	}
+	return true
+}
+
+// UpdateUserProfiles implements [controlclient.UserProfileUpdater].
+//
+// It is called by the controlclient when a MapResponse carries new or
+// updated [tailcfg.UserProfileView] entries. It merges them into the
+// current netmap's UserProfiles so [LocalBackend.UserProfile] can
+// resolve them, and emits an [ipn.Notify] with [Notify.UserProfiles]
+// populated so IPN-bus consumers (sessions opted in to
+// NotifyPeerChanges / NotifyPeerPatches) get the new profiles before
+// any subsequent PeersChanged / PeerChangedPatch entries that reference
+// these UserIDs.
+//
+// The views in profiles share backing memory with the controlclient
+// caller's tracking map; nodeBackend stores them as-is, and per-bus
+// sessions can dedup via [UserProfileView.Equal] without copying.
+func (b *LocalBackend) UpdateUserProfiles(profiles map[tailcfg.UserID]tailcfg.UserProfileView) bool {
+	defer b.CheckDeadlocks()()
+
+	if len(profiles) == 0 {
+		return true
+	}
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	cn := b.currentNode()
+	if cn.NetMap() == nil {
+		// No netmap installed yet; the initial full-netmap path will
+		// take care of installing UserProfiles.
+		return false
+	}
+	metricUpdateUserProfiles.Add(1)
+	cn.mergeUserProfiles(profiles)
+	b.sendLocked(ipn.Notify{UserProfiles: profiles})
+	return true
+}
+
 // mustationsAreWorthyOfRecalculatingSuggestedExitNode reports whether any mutation type in muts is
 // worthy of recalculating the suggested exit node.
 func mutationsAreWorthyOfRecalculatingSuggestedExitNode(muts []netmap.NodeMutation, cn *nodeBackend, sid tailcfg.StableNodeID) bool {
@@ -2226,32 +2733,40 @@ func mutationsAreWorthyOfRecalculatingSuggestedExitNode(muts []netmap.NodeMutati
 	return false
 }
 
-// ipnBusPeerChangesFromNodeMutations converts a slice of NodeMutations to a slice of
-// *tailcfg.PeerChange for use in ipn.Notify.PeerChanges.
-// Multiple mutations to the same node are merged into a single PeerChange.
-// If we encounter any mutations that we cannot convert to a PeerChange, we return (nil, false)
-// to indicate that the caller should send a Notify with the full netmap instead of
-// trying to send granular peer changes.
-func ipnBusPeerChangesFromNodeMutations(muts []netmap.NodeMutation) ([]*tailcfg.PeerChange, bool) {
+// ipnBusPeerChangedPatchFromNodeMutations converts the patch-shaped subset of
+// muts (per-field updates that fit in a [tailcfg.PeerChange]) into a slice of
+// [tailcfg.PeerChange] for use in [ipn.Notify.PeerChangedPatch]. Multiple
+// mutations against the same node are merged into a single PeerChange.
+//
+// Upsert/Remove mutations are skipped (they ride
+// [ipn.Notify.PeersChanged]/[ipn.Notify.PeersRemoved]). Any other mutation
+// type that doesn't fit a [tailcfg.PeerChange] causes ok=false; the caller
+// should fall back to a full netmap rebuild.
+func ipnBusPeerChangedPatchFromNodeMutations(muts []netmap.NodeMutation) ([]*tailcfg.PeerChange, bool) {
 	byID := map[tailcfg.NodeID]*tailcfg.PeerChange{}
 	var ordered []*tailcfg.PeerChange
-	for _, m := range muts {
-		nid := m.NodeIDBeingMutated()
+	getOrAdd := func(nid tailcfg.NodeID) *tailcfg.PeerChange {
 		pc := byID[nid]
 		if pc == nil {
 			pc = &tailcfg.PeerChange{NodeID: nid}
 			byID[nid] = pc
 			ordered = append(ordered, pc)
 		}
+		return pc
+	}
+	for _, m := range muts {
 		switch v := m.(type) {
+		case netmap.NodeMutationUpsert, netmap.NodeMutationRemove:
+			// These go in PeersChanged / PeersRemoved, not as patches.
+			continue
 		case netmap.NodeMutationOnline:
-			pc.Online = &v.Online
+			getOrAdd(v.NodeIDBeingMutated()).Online = &v.Online
 		case netmap.NodeMutationLastSeen:
-			pc.LastSeen = &v.LastSeen
+			getOrAdd(v.NodeIDBeingMutated()).LastSeen = &v.LastSeen
 		case netmap.NodeMutationDERPHome:
-			pc.DERPRegion = v.DERPRegion
+			getOrAdd(v.NodeIDBeingMutated()).DERPRegion = v.DERPRegion
 		case netmap.NodeMutationEndpoints:
-			pc.Endpoints = v.Endpoints
+			getOrAdd(v.NodeIDBeingMutated()).Endpoints = v.Endpoints
 		default:
 			return nil, false
 		}
@@ -2453,29 +2968,11 @@ func (b *LocalBackend) SetHTTPTestClient(c *http.Client) {
 	b.httpTestClient = c
 }
 
-// SetControlClientGetterForTesting sets the func that creates a
-// control plane client. It can be called at most once, before Start.
-func (b *LocalBackend) SetControlClientGetterForTesting(newControlClient func(controlclient.Options) (controlclient.Client, error)) {
-	b.mu.Lock()
-	defer b.mu.Unlock()
-	if b.ccGen != nil {
-		panic("invalid use of SetControlClientGetterForTesting after Start")
-	}
-	b.ccGen = newControlClient
-}
-
-// PeersForTest returns all the current peers, sorted by Node.ID,
-// for integration tests in another repo.
-func (b *LocalBackend) PeersForTest() []tailcfg.NodeView {
-	testenv.AssertInTest()
-	return b.currentNode().PeersForTest()
-}
-
 func (b *LocalBackend) getNewControlClientFuncLocked() clientGen {
 	if b.ccGen == nil {
 		// Initialize it rather than just returning the
 		// default to make any future call to
-		// SetControlClientGetterForTesting panic.
+		// forTest.SetControlClientGetter panic.
 		b.ccGen = func(opts controlclient.Options) (controlclient.Client, error) {
 			return controlclient.New(opts)
 		}
@@ -2507,6 +3004,25 @@ func (b *LocalBackend) controlDebugFlags() []string {
 // actually a supported operation (it should be, but it's very unclear
 // from the following whether or not that is a safe transition).
 func (b *LocalBackend) Start(opts ipn.Options) error {
+	defer b.CheckDeadlocks()()
+
+	// Shut down the previous control client, if any, before starting a
+	// new one, so the old client can't race with the new one. Without
+	// this, an in-flight lite map update carrying stale Hostinfo (notably
+	// RequestTags) could be processed by the control plane after the new
+	// client's requests, which made retagging with "tailscale up
+	// --advertise-tags" intermittently look like an invalid tag
+	// transition and log the node out (tailscale/tailscale#20365).
+	//
+	// TODO(bradfitz,nickkhyl): this is still racy if Start is called
+	// concurrently: whichever call loses the race to reacquire b.mu
+	// below then detaches the winner's new control client in startLocked
+	// and shuts it down in a goroutine, without the ordering guarantee
+	// that this call provides. This is a workaround until #18052 is
+	// properly fixed and a control client can be shut down synchronously
+	// with b.mu held.
+	b.DisconnectControl()
+
 	b.mu.Lock()
 	defer b.mu.Unlock()
 	return b.startLocked(opts)
@@ -2657,7 +3173,7 @@ func (b *LocalBackend) startLocked(opts ipn.Options) error {
 	// policy (as we have not yet spoken to the control plane).
 	//
 	// However, since we do not create or update a netmap cache unless we observe the
-	// [tailcfg.NodeAttrCachedNetworkMaps] capability, we can use the presence
+	// [tailcfg.NodeAttrCacheNetworkMaps] capability, we can use the presence
 	// of the cached netmap as a signal that we were expected to do so as of the
 	// last time we updated the cache.
 	//
@@ -2717,7 +3233,7 @@ func (b *LocalBackend) startLocked(opts ipn.Options) error {
 		ControlKnobs:         b.sys.ControlKnobs(),
 		Shutdown:             ccShutdown,
 		Bus:                  b.sys.Bus.Get(),
-		StartPaused:          prefs.Sync().EqualBool(false),
+		StartPaused:          b.shouldPauseControlClientLocked(prefs),
 	})
 	if err != nil {
 		return err
@@ -2767,7 +3283,7 @@ func (b *LocalBackend) startLocked(opts ipn.Options) error {
 		// Without this, the state machine transitions to "NeedsLogin" implying
 		// that user interaction is required, which is not the case and can
 		// regress tsnet.Server restarts.
-		cc.Login(controlclient.LoginDefault)
+		cc.Login(b.loginFlags)
 	}
 	b.stateMachineLocked()
 
@@ -2873,7 +3389,7 @@ func (b *LocalBackend) updateFilterLocked(prefs ipn.PrefsView) {
 		for i := range addrs.Len() {
 			localNetsB.AddPrefix(addrs.At(i))
 		}
-		packetFilter = netMap.PacketFilter
+		packetFilter = cn.PacketFilter()
 
 		if cn.unlockedNodesPermitted(packetFilter) {
 			b.health.SetUnhealthy(invalidPacketFilterWarnable, nil)
@@ -3190,17 +3706,27 @@ func applyConfigToHostinfo(hi *tailcfg.Hostinfo, c *conffile.Config) {
 // called with non-nil pointers. The caller must not modify roNotify. If
 // fn returns false, the watch also stops.
 //
-// Failure to consume many notifications in a row will result in dropped
-// notifications. There is currently (2022-11-22) no mechanism provided to
-// detect when a message has been dropped.
+// Failure to consume many notifications in a row will result in one final
+// notification with ErrMessage set, followed by the watch closing, unless mask
+// includes [ipn.NotifyInProcessNoDisconnect]. Watchers using
+// NotifyInProcessNoDisconnect must not call back into LocalBackend from fn or
+// wait on work that might call back into LocalBackend.
 func (b *LocalBackend) WatchNotifications(ctx context.Context, mask ipn.NotifyWatchOpt, onWatchAdded func(), fn func(roNotify *ipn.Notify) (keepGoing bool)) {
 	b.WatchNotificationsAs(ctx, nil, mask, onWatchAdded, fn)
 }
 
+const watchIPNBusFellBehindMessage = "IPN bus consumer fell behind; closing watch"
+
 // WatchNotificationsAs is like [LocalBackend.WatchNotifications] but takes an [ipnauth.Actor]
 // as an additional parameter. If non-nil, the specified callback is invoked
 // only for notifications relevant to this actor.
 func (b *LocalBackend) WatchNotificationsAs(ctx context.Context, actor ipnauth.Actor, mask ipn.NotifyWatchOpt, onWatchAdded func(), fn func(roNotify *ipn.Notify) (keepGoing bool)) {
+	if err := ipn.ValidateNotifyWatchOpt(mask); err != nil {
+		msg := err.Error()
+		fn(&ipn.Notify{Version: version.Long(), ErrMessage: &msg})
+		return
+	}
+
 	ch := make(chan *ipn.Notify, 128)
 	sessionID := rands.HexString(16)
 	if mask&ipn.NotifyHealthActions == 0 {
@@ -3211,9 +3737,31 @@ func (b *LocalBackend) WatchNotificationsAs(ctx context.Context, actor ipnauth.A
 
 	var ini *ipn.Notify
 
+	// Build the engine half of the InitialStatus before taking b.mu, since
+	// b.e.UpdateStatus has its own locking and shouldn't be called under
+	// b.mu (lock-ordering: outer-to-inner is b.mu -> engine, not the other
+	// way). The backend half is then populated under b.mu below, atomically
+	// with watcher registration so no events arrive on the watcher's
+	// channel before InitialStatus is delivered.
+	var statusSB *ipnstate.StatusBuilder
+	if mask&ipn.NotifyInitialStatus != 0 {
+		statusSB = &ipnstate.StatusBuilder{WantPeers: true}
+		b.e.UpdateStatus(statusSB)
+	}
+	if mask&ipn.NotifyPeerWireGuardState != 0 {
+		_ = b.peerWGStateQueue.Wait(ctx)
+	}
+
+	// Watch for deadlocks only during the registration phase below; the rest
+	// of this method blocks on ctx (often for hours) and shouldn't trip the
+	// watchdog.
+	deadlockDone := b.CheckDeadlocks()
 	b.mu.Lock()
 
-	const initialBits = ipn.NotifyInitialState | ipn.NotifyInitialPrefs | ipn.NotifyInitialNetMap | ipn.NotifyInitialDriveShares | ipn.NotifyInitialSuggestedExitNode | ipn.NotifyInitialClientVersion
+	const initialBits = ipn.NotifyInitialState | ipn.NotifyInitialPrefs |
+		ipn.NotifyInitialNetMap | ipn.NotifyInitialStatus |
+		ipn.NotifyInitialDriveShares | ipn.NotifyInitialSuggestedExitNode |
+		ipn.NotifyInitialClientVersion | ipn.NotifySysPolicyChanges | ipn.NotifyPeerWireGuardState
 	if mask&initialBits != 0 {
 		cn := b.currentNode()
 		ini = &ipn.Notify{Version: version.Long()}
@@ -3228,7 +3776,18 @@ func (b *LocalBackend) WatchNotificationsAs(ctx context.Context, actor ipnauth.A
 			ini.Prefs = new(b.sanitizedPrefsLocked())
 		}
 		if mask&ipn.NotifyInitialNetMap != 0 {
-			ini.NetMap = cn.NetMap()
+			if nm := cn.NetMap(); nm != nil && nm.SelfNode.Valid() {
+				ini.SelfChange = nm.SelfNode.AsStruct()
+			}
+			// The legacy initial NetMap is delivered cross-platform: it
+			// is what watchers asked for by setting NotifyInitialNetMap
+			// and is always a one-shot, so the cost of building it is
+			// paid once per bus subscription.
+			ini.NetMap = cn.netMapWithPeers()
+		}
+		if statusSB != nil {
+			b.updateStatusLocked(statusSB)
+			ini.InitialStatus = statusSB.Status()
 		}
 		if mask&ipn.NotifyInitialDriveShares != 0 && b.DriveSharingEnabled() {
 			ini.DriveShares = b.pm.prefs.DriveShares()
@@ -3246,6 +3805,13 @@ func (b *LocalBackend) WatchNotificationsAs(ctx context.Context, actor ipnauth.A
 				ini.ClientVersion = b.lastClientVersion
 			}
 		}
+		if mask&ipn.NotifySysPolicyChanges != 0 {
+			var err error
+			ini.Policy, err = b.polc.GetPolicySnapshot("")
+			if err != nil {
+				b.logf("syspolicy: GetPolicySnapshot(\"\"): %v", err)
+			}
+		}
 	}
 
 	ctx, cancel := context.WithCancel(ctx)
@@ -3253,13 +3819,28 @@ func (b *LocalBackend) WatchNotificationsAs(ctx context.Context, actor ipnauth.A
 
 	session := &watchSession{
 		ch:        ch,
+		ctx:       ctx,
 		owner:     actor,
 		sessionID: sessionID,
 		cancel:    cancel,
 		mask:      mask,
 	}
 	mak.Set(&b.notifyWatchers, sessionID, session)
+	if mask&ipn.NotifyPeerWireGuardState != 0 {
+		ini.PeerState = maps.Clone(b.peerWGState)
+	}
 	b.mu.Unlock()
+	deadlockDone()
+
+	if mask&ipn.NotifySysPolicyChanges != 0 {
+		if unreg, err := b.polc.RegisterChangeCallback("", func(_ policyclient.PolicyChange) {
+			b.sysPolicyChangedForSession(session)
+		}); err == nil {
+			defer unreg()
+		} else {
+			b.logf("syspolicy: RegisterChangeCallback(\"\"): %v", err)
+		}
+	}
 
 	metricCurrentWatchIPNBus.Add(1)
 	defer metricCurrentWatchIPNBus.Add(-1)
@@ -3357,16 +3938,6 @@ func (b *LocalBackend) DebugNotify(n ipn.Notify) {
 	b.send(n)
 }
 
-// DebugNotifyLastNetMap injects a fake notify message to clients,
-// repeating whatever the last netmap was.
-//
-// It should only be used via the LocalAPI's debug handler.
-func (b *LocalBackend) DebugNotifyLastNetMap() {
-	if nm := b.currentNode().NetMap(); nm != nil {
-		b.send(ipn.Notify{NetMap: nm})
-	}
-}
-
 // DebugForceNetmapUpdate forces a full no-op netmap update of the current
 // netmap in all the various subsystems (wireguard, magicsock, LocalBackend).
 //
@@ -3378,7 +3949,11 @@ func (b *LocalBackend) DebugForceNetmapUpdate() {
 	defer b.mu.Unlock()
 	// TODO(nickkhyl): this all should be done in [LocalBackend.setNetMapLocked].
 	nm := b.currentNode().NetMap()
-	b.e.SetNetworkMap(nm)
+	var self tailcfg.NodeView
+	if nm != nil {
+		self = nm.SelfNode
+	}
+	b.e.SetSelfNode(self)
 	if nm != nil {
 		b.MagicConn().SetDERPMap(nm.DERPMap)
 	}
@@ -3400,8 +3975,10 @@ func (b *LocalBackend) DebugForcePreferDERP(n int) {
 // send delivers n to the connected frontend and any API watchers from
 // LocalBackend.WatchNotifications (via the LocalAPI).
 //
-// If no frontend is connected or API watchers are backed up, the notification
-// is dropped without being delivered.
+// If no frontend is connected, the notification is dropped without being
+// delivered. If an out-of-process watcher is backed up, it is disconnected. If
+// an in-process no-disconnect watcher is backed up, sending blocks until the
+// watcher catches up.
 //
 // If n contains Prefs, those will be sanitized before being delivered.
 //
@@ -3481,6 +4058,9 @@ func (b *LocalBackend) sendTo(n ipn.Notify, recipient notificationTarget) {
 }
 
 // sendToLocked is like [LocalBackend.sendTo], but assumes b.mu is already held.
+// If a [ipn.NotifyInProcessNoDisconnect] watcher falls behind, sendToLocked
+// blocks until that watcher catches up or closes. Such watchers must not call
+// back into LocalBackend from their notification callback.
 func (b *LocalBackend) sendToLocked(n ipn.Notify, recipient notificationTarget) {
 	if n.Prefs != nil {
 		n.Prefs = new(stripKeysFromPrefs(*n.Prefs))
@@ -3497,27 +4077,181 @@ func (b *LocalBackend) sendToLocked(n ipn.Notify, recipient notificationTarget)
 		if !recipient.match(sess.owner) {
 			continue
 		}
-		nOut := &n
-		if n.PeerChanges != nil {
-			// Take a shallow copy of n so we can elide the PeerChanges or the Netmap
-			// based on the session's mask.
-			nOut = new(n)
-			if sess.mask&ipn.NotifyPeerChanges != 0 {
-				// Skip the full Netmap
-				nOut.NetMap = nil
-			} else {
-				// Skip the PeerChanges
-				nOut.PeerChanges = nil
-			}
-		}
+		nForSess := b.notifyForSessionLocked(sess, &n)
 		select {
-		case sess.ch <- nOut:
+		case sess.ch <- nForSess:
 		default:
-			// Drop the notification if the channel is full.
+			if sess.mask&ipn.NotifyInProcessNoDisconnect != 0 {
+				select {
+				case sess.ch <- nForSess:
+				case <-sess.ctx.Done():
+				}
+				continue
+			}
+			b.closeLaggingWatchSessionLocked(sess)
 		}
 	}
 }
 
+// closeLaggingWatchSessionLocked removes sess from the active watcher set and
+// arranges for its consumer to receive one final terminal error notification.
+//
+// b.mu must be held.
+func (b *LocalBackend) closeLaggingWatchSessionLocked(sess *watchSession) {
+	delete(b.notifyWatchers, sess.sessionID)
+
+	// The session already fell behind, so the queued delta stream is not
+	// trustworthy. Drop queued messages and replace them with a terminal
+	// notification.
+	for {
+		select {
+		case <-sess.ch:
+		default:
+			msg := watchIPNBusFellBehindMessage
+			sess.ch <- &ipn.Notify{
+				Version:    version.Long(),
+				ErrMessage: &msg,
+			}
+			close(sess.ch)
+			return
+		}
+	}
+}
+
+// notifyForSessionLocked returns the [ipn.Notify] to deliver to sess,
+// applying per-session field gating to n: stripping fields the session
+// didn't opt in to receive, promoting [Notify.PeerChangedPatch] entries
+// into full-Node [Notify.PeersChanged] entries for sessions that asked
+// for peer changes but not patches, and tracking on sess which
+// [tailcfg.UserProfileView]s have already been delivered so subsequent
+// sends only carry new/changed profiles.
+//
+// The returned pointer is either n itself (no adjustments needed for
+// this session) or a fresh *ipn.Notify with the adjusted fields. The
+// caller's *ipn.Notify is not mutated.
+//
+// b.mu must be held.
+func (b *LocalBackend) notifyForSessionLocked(sess *watchSession, n *ipn.Notify) *ipn.Notify {
+	// Visibility of peer-set fields is governed by the watcher's mask:
+	//
+	//   - NotifyPeerChanges:           PeersChanged + PeersRemoved
+	//   - NotifyPeerPatches (implies):  + PeerChangedPatch
+	//
+	// A watcher with NotifyPeerChanges but not NotifyPeerPatches still
+	// observes every per-peer mutation; we just promote each
+	// PeerChangedPatch entry into a full-Node entry in PeersChanged so
+	// the watcher doesn't have to handle the patch shape.
+	wantsPeerChanges := sess.mask&(ipn.NotifyPeerChanges|ipn.NotifyPeerPatches) != 0
+	wantsPeerPatches := sess.mask&ipn.NotifyPeerPatches != 0
+	stripNetMap := goosGetsLegacyNetmapNotify && n.NetMap != nil && sess.mask&ipn.NotifyNoNetMap != 0
+	stripPeersChanged := len(n.PeersChanged) > 0 && !wantsPeerChanges
+	stripPeersRemoved := len(n.PeersRemoved) > 0 && !wantsPeerChanges
+	stripPatches := len(n.PeerChangedPatch) > 0 && !wantsPeerPatches
+	stripPeerState := len(n.PeerState) > 0 && sess.mask&ipn.NotifyPeerWireGuardState == 0
+	promotePatches := len(n.PeerChangedPatch) > 0 && wantsPeerChanges && !wantsPeerPatches
+
+	if sess.selfChangeResetsImplicitState(n.SelfChange.View()) {
+		sess.lastSentUserProfile = nil
+	}
+
+	// UserProfiles ride alongside peer changes and are gated on the
+	// same opt-in. Sessions that didn't ask for peer changes get the
+	// field stripped entirely; opted-in sessions get a per-session
+	// subset containing only profiles that differ from what was last
+	// delivered to that session, compared via
+	// [tailcfg.UserProfileView.Equal] (pointer-cheap when the view
+	// shares backing memory with the previous send).
+	stripUserProfiles := len(n.UserProfiles) > 0 && !wantsPeerChanges
+	var sessUserProfiles map[tailcfg.UserID]tailcfg.UserProfileView
+	if !stripUserProfiles && len(n.UserProfiles) > 0 {
+		for id, up := range n.UserProfiles {
+			if up.Equal(sess.lastSentUserProfile[id]) {
+				continue // already has this exact profile
+			}
+			mak.Set(&sessUserProfiles, id, up)
+			mak.Set(&sess.lastSentUserProfile, id, up)
+		}
+		if len(sessUserProfiles) == 0 {
+			// All entries deduped.
+			stripUserProfiles = true
+		}
+	}
+	replaceUserProfiles := !stripUserProfiles && len(sessUserProfiles) != len(n.UserProfiles)
+
+	if !stripNetMap && !stripPeersChanged && !stripPeersRemoved && !stripPatches && !stripPeerState && !stripUserProfiles && !replaceUserProfiles && !promotePatches {
+		return n
+	}
+	nCopy := *n
+	if stripNetMap {
+		nCopy.NetMap = nil
+	}
+	if stripPeersChanged {
+		nCopy.PeersChanged = nil
+	}
+	if stripPeersRemoved {
+		nCopy.PeersRemoved = nil
+	}
+	if promotePatches {
+		// Look up each patched peer's current Node and append it to
+		// PeersChanged. Watchers in this mode receive only full-Node
+		// updates; they never see PeerChangedPatch.
+		cn := b.currentNode()
+		for _, pc := range n.PeerChangedPatch {
+			nv, ok := cn.NodeByID(pc.NodeID)
+			if !ok {
+				continue
+			}
+			nCopy.PeersChanged = append(nCopy.PeersChanged, nv.AsStruct())
+		}
+	}
+	if stripPatches {
+		nCopy.PeerChangedPatch = nil
+	}
+	if stripPeerState {
+		nCopy.PeerState = nil
+	}
+	if stripUserProfiles {
+		nCopy.UserProfiles = nil
+	} else if replaceUserProfiles {
+		nCopy.UserProfiles = sessUserProfiles
+	}
+	return &nCopy
+}
+
+// selfChangeResetsImplicitState reports whether self changes the identity of
+// the self node last delivered to sess. WatchIPNBus sessions survive profile
+// switches, but a self-node identity change is a boundary for implicit bus
+// state: publishers must resend any implicit state, such as UserProfiles,
+// needed to interpret subsequent peer deltas.
+func (sess *watchSession) selfChangeResetsImplicitState(self tailcfg.NodeView) bool {
+	if !self.Valid() {
+		return false
+	}
+	reset := !sess.lastSentSelf.Valid() || !sameSelfNode(sess.lastSentSelf, self)
+	sess.lastSentSelf = self
+	return reset
+}
+
+func sameSelfNode(a, b tailcfg.NodeView) bool {
+	// Include User in the identity even though a node can move users, for
+	// example when an untagged auth-key node is later tagged. Treating that as
+	// a boundary only causes redundant implicit-state delivery; missing the
+	// boundary would leave consumers unable to resolve newly referenced users.
+	return a.ID() == b.ID() && a.StableID() == b.StableID() && a.User() == b.User()
+}
+
+// hasPeerChangeWatcherLocked reports whether any active watcher wants peer-set
+// notifications. b.mu must be held.
+func (b *LocalBackend) hasPeerChangeWatcherLocked() bool {
+	syncs.AssertLocked(&b.mu)
+	for _, sess := range b.notifyWatchers {
+		if sess.mask&(ipn.NotifyPeerChanges|ipn.NotifyPeerPatches) != 0 {
+			return true
+		}
+	}
+	return false
+}
+
 // setAuthURLLocked sets the authURL and triggers [LocalBackend.popBrowserAuthNow] if the URL has changed.
 // This method is called when a new authURL is received from the control plane, meaning that either a user
 // has started a new interactive login (e.g., by running `tailscale login` or clicking Login in the GUI),
@@ -3563,12 +4297,11 @@ func (b *LocalBackend) setAuthURLLocked(url string) {
 //
 // b.mu must be held.
 func (b *LocalBackend) popBrowserAuthNowLocked(url string, keyExpired bool, recipient ipnauth.Actor) {
-	b.logf("popBrowserAuthNow(%q): url=%v, key-expired=%v, seamless-key-renewal=%v", maybeUsernameOf(recipient), url != "", keyExpired, b.seamlessRenewalEnabled())
+	b.logf("popBrowserAuthNow(%q): url=%v, key-expired=%v", maybeUsernameOf(recipient), url != "", keyExpired)
 
-	// Deconfigure the local network data plane if:
-	// - seamless key renewal is not enabled;
-	// - key is expired (in which case tailnet connectivity is down anyway).
-	if !b.seamlessRenewalEnabled() || keyExpired {
+	// Deconfigure the local network data plane if the key is expired
+	// (in which case tailnet connectivity is down anyway).
+	if keyExpired {
 		b.blockEngineUpdatesLocked(true)
 		b.stopEngineAndWaitLocked()
 
@@ -3985,18 +4718,18 @@ func (b *LocalBackend) pingPeerAPI(ctx context.Context, ip netip.Addr) (peer tai
 	var zero tailcfg.NodeView
 	ctx, cancel := context.WithTimeout(ctx, 10*time.Second)
 	defer cancel()
-	nm := b.NetMap()
-	if nm == nil {
-		return zero, "", errors.New("no netmap")
+	cn := b.currentNode()
+	var ok bool
+	if nid, addrOK := cn.NodeByAddr(ip); addrOK {
+		peer, ok = cn.PeerByID(nid)
 	}
-	peer, ok := nm.PeerByTailscaleIP(ip)
 	if !ok {
 		return zero, "", fmt.Errorf("no peer found with Tailscale IP %v", ip)
 	}
 	if peer.Expired() {
 		return zero, "", errors.New("peer's node key has expired")
 	}
-	base := peerAPIBase(nm, peer)
+	base := peerAPIBase(cn.NetMap(), peer)
 	if base == "" {
 		return zero, "", fmt.Errorf("no PeerAPI base found for peer %v (%v)", peer.ID(), ip)
 	}
@@ -4202,16 +4935,8 @@ func (b *LocalBackend) resolveBestProfileLocked() (_ ipn.LoginProfileView, isBac
 	return b.pm.CurrentProfile(), false
 }
 
-// CurrentUserForTest returns the current user and the associated WindowsUserID.
-// It is used for testing only, and will be removed along with the rest of the
-// "current user" functionality as we progress on the multi-user improvements (tailscale/corp#18342).
-func (b *LocalBackend) CurrentUserForTest() (ipn.WindowsUserID, ipnauth.Actor) {
-	testenv.AssertInTest()
-	b.mu.Lock()
-	defer b.mu.Unlock()
-	return b.pm.CurrentUserID(), b.currentUser
-}
-
+// CheckPrefs validates the provided user modifiable settings for correctness
+// and returns an error if they are invalid for the current backend.
 func (b *LocalBackend) CheckPrefs(p *ipn.Prefs) error {
 	b.mu.Lock()
 	defer b.mu.Unlock()
@@ -4803,7 +5528,8 @@ func (b *LocalBackend) setPrefsLocked(newp *ipn.Prefs) ipn.PrefsView {
 		}
 	}
 	if netMap != nil {
-		newProfile := profileFromView(netMap.UserProfiles[netMap.User()])
+		selfProfileView, _ := cn.UserByID(netMap.User())
+		newProfile := profileFromView(selfProfileView)
 		if newLoginName := newProfile.LoginName; newLoginName != "" {
 			if !oldp.Persist().Valid() {
 				b.logf("active login: %s", newLoginName)
@@ -4842,7 +5568,7 @@ func (b *LocalBackend) setPrefsLocked(newp *ipn.Prefs) ipn.PrefsView {
 
 	if !oldp.WantRunning() && newp.WantRunning && cc != nil {
 		b.logf("transitioning to running; doing Login...")
-		cc.Login(controlclient.LoginDefault)
+		cc.Login(b.loginFlags)
 	}
 
 	if oldp.WantRunning() != newp.WantRunning {
@@ -4893,7 +5619,7 @@ func (b *LocalBackend) handlePeerAPIConn(remote, local netip.AddrPort, c net.Con
 }
 
 func (b *LocalBackend) isLocalIP(ip netip.Addr) bool {
-	nm := b.NetMap()
+	nm := b.NetMapNoPeers()
 	return nm != nil && views.SliceContains(nm.GetAddresses(), netip.PrefixFrom(ip, ip.BitLen()))
 }
 
@@ -4963,6 +5689,30 @@ func (b *LocalBackend) setPortlistServices(sl []tailcfg.Service) {
 	b.doSetHostinfoFilterServices()
 }
 
+// SetExplicitServices sets the services this node advertises on the netmap.
+// Unlike the OS port-scan path (setPortlistServices), services set here are
+// always uploaded to the control server regardless of the ShouldUploadServices
+// hook — suitable for environments like browser WASM where OS port scanning is
+// unavailable and services are declared programmatically.
+func (b *LocalBackend) SetExplicitServices(sl []tailcfg.Service) {
+	b.mu.Lock()
+	if b.hostinfo == nil {
+		b.hostinfo = new(tailcfg.Hostinfo)
+	}
+	b.hostinfo.Services = sl
+	b.explicitServices = sl
+	ccAuto := b.ccAuto
+	b.mu.Unlock()
+
+	b.doSetHostinfoFilterServices()
+	// Restart the streaming map poll so the control server sends back a fresh
+	// netmap that includes our updated services in SelfNode, and so peers
+	// receive the update promptly via the control server's push.
+	if ccAuto != nil {
+		ccAuto.RestartMap()
+	}
+}
+
 // doSetHostinfoFilterServices calls SetHostinfo on the controlclient,
 // possibly after mangling the given hostinfo.
 //
@@ -5007,7 +5757,9 @@ func (b *LocalBackend) hostInfoWithServicesLocked() *tailcfg.Hostinfo {
 	// Make a shallow copy of hostinfo so we can mutate
 	// at the Service field.
 	if f, ok := b.extHost.Hooks().ShouldUploadServices.GetOk(); !ok || !f() {
-		hi.Services = []tailcfg.Service{}
+		if len(b.explicitServices) == 0 {
+			hi.Services = []tailcfg.Service{}
+		}
 	}
 
 	// Don't mutate hi.Service's underlying array. Append to
@@ -5045,10 +5797,134 @@ func extractPeerAPIPorts(services []tailcfg.Service) portPair {
 
 // NetMap returns the latest cached network map received from
 // controlclient, or nil if no network map was received yet.
+//
+// Deprecated: callers should declare their needs explicitly by calling
+// either [LocalBackend.NetMapNoPeers] (cheap; for code that reads
+// non-Peers fields like SelfNode, DNS, PacketFilter, capabilities) or
+// [LocalBackend.NetMapWithPeers] (currently the same; will be made to
+// return an up-to-date Peers slice in a follow-up change, at the cost of
+// O(N) work per call). NetMap will eventually be removed.
 func (b *LocalBackend) NetMap() *netmap.NetworkMap {
 	return b.currentNode().NetMap()
 }
 
+// NetMapNoPeers returns the latest cached network map received from
+// controlclient WITHOUT a freshly-built Peers slice.
+//
+// On a tailnet with frequent peer churn the cached netmap's Peers slice
+// can be stale relative to the live per-node-backend peers map; non-Peers
+// fields (SelfNode, DNS, PacketFilter, capabilities, ...) are always
+// current. Use this for any caller that does not need to iterate Peers,
+// since it's O(1) regardless of tailnet size.
+//
+// It returns nil if no network map has been received yet.
+func (b *LocalBackend) NetMapNoPeers() *netmap.NetworkMap {
+	return b.currentNode().NetMap()
+}
+
+// NetMapWithPeers returns a copy of the latest cached network map with
+// its Peers slice populated from the live per-node-backend peers map
+// (i.e. reflecting any incremental delta updates applied since the last
+// full netmap install). It is O(N) in the size of the peer set; prefer
+// [LocalBackend.NetMapNoPeers] when only non-Peers fields are needed.
+//
+// It returns nil if no netmap is yet available.
+func (b *LocalBackend) NetMapWithPeers() *netmap.NetworkMap {
+	return b.currentNode().netMapWithPeers()
+}
+
+// onPeerWireGuardState is called by wireguard-go, through wgengine, for
+// serialized WireGuard session state transitions. wireguard-go is holding locks
+// while calling this, so this must stay cheap, must not acquire b.mu, and must
+// not call back into wireguard-go. Acquiring b.mu here can deadlock with
+// LocalBackend operations that hold b.mu while waiting for wireguard-go to make
+// progress.
+func (b *LocalBackend) onPeerWireGuardState(peerKey key.NodePublic, state wgengine.PeerWireGuardState) {
+	st := peerWireGuardStateFromEngine(state)
+	// 10ms granularity is plenty for diagnostics and keeps the JSON form short.
+	at := b.clock.Now().Round(10 * time.Millisecond)
+	b.peerWGStateQueue.Add(func() {
+		b.handlePeerWireGuardState(peerKey, st, at)
+	})
+}
+
+func (b *LocalBackend) handlePeerWireGuardState(peerKey key.NodePublic, st ipn.PeerWireGuardState, at time.Time) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	id, ok := b.peerWGStableIDByKey[peerKey]
+	if !ok {
+		nb := b.currentNode()
+		nid, ok := nb.NodeByKey(peerKey)
+		if !ok {
+			b.logf("[unexpected] WireGuard session state for unknown peer %v", peerKey.ShortString())
+			return
+		}
+		peer, ok := nb.NodeByID(nid)
+		if !ok {
+			b.logf("[unexpected] WireGuard session state for unknown node %v", nid)
+			return
+		}
+		id = peer.StableID()
+	}
+
+	if st == ipn.PeerWireGuardStateNone {
+		old, ok := b.peerWGState[id]
+		if !ok {
+			return
+		}
+		delete(b.peerWGState, id)
+		delete(b.peerWGStableIDByKey, peerKey)
+		addPeerWGStateMetric(old.PeerWireGuardState, -1)
+	} else {
+		old := b.peerWGState[id].PeerWireGuardState
+		if old == st {
+			return
+		}
+		if old != ipn.PeerWireGuardStateNone {
+			addPeerWGStateMetric(old, -1)
+		}
+		mak.Set(&b.peerWGState, id, ipn.PeerState{
+			PeerWireGuardState:   st,
+			PeerWireGuardStateAt: at,
+		})
+		mak.Set(&b.peerWGStableIDByKey, peerKey, id)
+		addPeerWGStateMetric(st, 1)
+	}
+	b.sendToLocked(ipn.Notify{
+		PeerState: map[tailcfg.StableNodeID]ipn.PeerState{id: {
+			PeerWireGuardState:   st,
+			PeerWireGuardStateAt: at,
+		}},
+	}, allClients)
+}
+
+func addPeerWGStateMetric(state ipn.PeerWireGuardState, delta int64) {
+	switch state {
+	case ipn.PeerWireGuardStateHandshake:
+		metricPeerWGStateHandshake.Add(delta)
+	case ipn.PeerWireGuardStateEstablished:
+		metricPeerWGStateEstablished.Add(delta)
+	case ipn.PeerWireGuardStateExpired:
+		metricPeerWGStateExpired.Add(delta)
+	}
+}
+
+func peerWireGuardStateFromEngine(state wgengine.PeerWireGuardState) ipn.PeerWireGuardState {
+	switch state {
+	case wgengine.PeerWireGuardStateNone:
+		return ipn.PeerWireGuardStateNone
+	case wgengine.PeerWireGuardStateHandshake:
+		return ipn.PeerWireGuardStateHandshake
+	case wgengine.PeerWireGuardStateEstablished:
+		return ipn.PeerWireGuardStateEstablished
+	case wgengine.PeerWireGuardStateExpired:
+		return ipn.PeerWireGuardStateExpired
+	default:
+		panic(fmt.Sprintf("unexpected wgengine.PeerWireGuardState %d", state))
+	}
+}
+
 func (b *LocalBackend) isEngineBlocked() bool {
 	b.mu.Lock()
 	defer b.mu.Unlock()
@@ -5067,9 +5943,9 @@ func (b *LocalBackend) blockEngineUpdatesLocked(block bool) {
 }
 
 // reconfigAppConnectorLocked updates the app connector state based on the
-// current network map and preferences.
+// self node and preferences.
 // b.mu must be held.
-func (b *LocalBackend) reconfigAppConnectorLocked(nm *netmap.NetworkMap, prefs ipn.PrefsView) {
+func (b *LocalBackend) reconfigAppConnectorLocked(selfNode tailcfg.NodeView, prefs ipn.PrefsView) {
 	if !buildfeatures.HasAppConnectors {
 		return
 	}
@@ -5103,11 +5979,11 @@ func (b *LocalBackend) reconfigAppConnectorLocked(nm *netmap.NetworkMap, prefs i
 			HasStoredRoutes: shouldStoreRoutes,
 		})
 	}
-	if nm == nil {
+	if !selfNode.Valid() {
 		return
 	}
 
-	attrs, err := tailcfg.UnmarshalNodeCapViewJSON[appctype.AppConnectorAttr](nm.SelfNode.CapMap(), appConnectorCapName)
+	attrs, err := tailcfg.UnmarshalNodeCapViewJSON[appctype.AppConnectorAttr](selfNode.CapMap(), appConnectorCapName)
 	if err != nil {
 		b.logf("[unexpected] error parsing app connector mapcap: %v", err)
 		return
@@ -5115,7 +5991,7 @@ func (b *LocalBackend) reconfigAppConnectorLocked(nm *netmap.NetworkMap, prefs i
 
 	// Geometric cost, assumes that the number of advertised tags is small
 	selfHasTag := func(attrTags []string) bool {
-		return nm.SelfNode.Tags().ContainsFunc(func(tag string) bool {
+		return selfNode.Tags().ContainsFunc(func(tag string) bool {
 			return slices.Contains(attrTags, tag)
 		})
 	}
@@ -5199,7 +6075,6 @@ func (b *LocalBackend) authReconfig() {
 //
 // b.mu must be held.
 func (b *LocalBackend) authReconfigLocked() {
-
 	if b.shutdownCalled {
 		b.logf("[v1] authReconfig: skipping because in shutdown")
 		return
@@ -5211,6 +6086,9 @@ func (b *LocalBackend) authReconfigLocked() {
 
 	cn := b.currentNode()
 
+	// Note this netmap does not have its Peers populated. Nothing
+	// below needs them; per-peer work rides the incremental route
+	// manager and engine paths instead.
 	nm := cn.NetMap()
 	if nm == nil {
 		b.logf("[v1] authReconfig: netmap not yet valid. Skipping.")
@@ -5221,9 +6099,9 @@ func (b *LocalBackend) authReconfigLocked() {
 	hasPAC := b.interfaceState.HasPAC()
 	disableSubnetsIfPAC := cn.SelfHasCap(tailcfg.NodeAttrDisableSubnetsIfPAC)
 	dohURL, dohURLOK := cn.exitNodeCanProxyDNS(prefs.ExitNodeID())
-	dcfg := cn.dnsConfigForNetmap(prefs, b.keyExpired, version.OS())
+	dcfg := cn.dnsConfigForNetmap(prefs, b.keyExpired, cmp.Or(b.goos, runtime.GOOS))
 	// If the current node is an app connector, ensure the app connector machine is started
-	b.reconfigAppConnectorLocked(nm, prefs)
+	b.reconfigAppConnectorLocked(nm.SelfNode, prefs)
 
 	if !prefs.WantRunning() {
 		b.logf("[v1] authReconfig: skipping because !WantRunning.")
@@ -5257,26 +6135,55 @@ func (b *LocalBackend) authReconfigLocked() {
 		priv = key.NodePrivate{}
 	}
 
-	cfg, err := nmcfg.WGCfg(priv, nm, b.logf, flags, prefs.ExitNodeID())
-	if err != nil {
-		b.logf("wgcfg: %v", err)
-		return
+	// The config carries no peers; wireguard-go gets those from the
+	// live per-peer config source installed via
+	// [wgengine.Engine.SetPeerConfigFunc], fed by the route manager.
+	cfg := &wgcfg.Config{
+		PrivateKey: priv,
+		Addresses:  nm.GetAddresses().AsSlice(),
 	}
 
-	oneCGNATRoute := shouldUseOneCGNATRoute(b.logf, b.sys.NetMon.Get(), b.sys.ControlKnobs(), version.OS())
-	rcfg := b.routerConfigLocked(cfg, prefs, nm, oneCGNATRoute)
+	// Note: b.goos (set only by tests) speaks runtime.GOOS while
+	// version.OS is Tailscale-style ("macOS", "iOS"); they agree for
+	// the values tests pin ("linux", "windows"), which is all the
+	// override needs.
+	oneCGNATRoute := shouldUseOneCGNATRoute(b.logf, b.sys.NetMon.Get(), b.sys.ControlKnobs(), cmp.Or(b.goos, version.OS()))
+	// Sync the WireGuard device for any peers whose allowed source
+	// prefixes changed with the new prefs, such as the old and new
+	// exit node when the selection changes.
+	changedAllowedIPs := cn.updateRouteManagerPrefs(routePrefs{
+		ExitNodeID:       prefs.ExitNodeID(),
+		ExitNodeSelected: prefs.ExitNodeID() != "" || prefs.ExitNodeIP().IsValid(),
+		RouteAll:         flags&netmap.AllowSubnetRoutes != 0,
+		OneCGNAT:         oneCGNATRoute,
+	})
+	for k := range changedAllowedIPs {
+		b.e.SyncDevicePeer(k)
+	}
+	rcfg := b.routerConfigLocked(cfg, prefs, nm)
 
-	// Add these extra Allowed IPs after router configuration, because the expected
-	// extension (features/conn25), does not want these routes installed on the OS.
+	// Push each peer's extra WireGuard-only allowed IPs (the conn25
+	// extension's Transit IPs) into the route manager, which feeds
+	// them to WireGuard via the outbound peer lookup and the per-peer
+	// allowed source prefixes (including for lazily created peers)
+	// while keeping them out of the OS route set, because the
+	// expected extension (features/conn25) does not want these routes
+	// installed on the OS.
 	// See also [Hooks.ExtraWireGuardAllowedIPs].
 	if extraAllowedIPsFn, ok := b.extHost.hooks.ExtraWireGuardAllowedIPs.GetOk(); ok {
-		for i := range cfg.Peers {
-			extras := extraAllowedIPsFn(cfg.Peers[i].PublicKey)
-			cfg.Peers[i].AllowedIPs = extras.AppendTo(cfg.Peers[i].AllowedIPs)
+		for k := range cn.updateRouteManagerExtras(extraAllowedIPsFn) {
+			b.e.SyncDevicePeer(k)
 		}
 	}
+	// The prefs and extras commits above can both change the outbound
+	// table (such as installing the selected exit node's /0 routes),
+	// so refresh the data plane's view of it. This must stay after
+	// updateRouteManagerExtras, so the pushed snapshot includes its
+	// commit, and before the Reconfig below, so packets flowing under
+	// the new config never see a stale peer table.
+	b.setDataPlanePeerRoutes()
 
-	err = b.e.Reconfig(cfg, rcfg, dcfg)
+	err := b.e.Reconfig(cfg, rcfg, dcfg)
 	if err == wgengine.ErrNoChanges {
 		return
 	}
@@ -5288,6 +6195,29 @@ func (b *LocalBackend) authReconfigLocked() {
 	}
 }
 
+// setDataPlanePeerRoutes pushes the route manager's outbound table and
+// this node's native Tailscale addresses into the engine's tun-layer
+// data plane, which uses them for per-packet NAT rewrites and
+// jailed-filter selection. It must be called after every route manager
+// commit that can change the outbound table or the set of peers with
+// data-plane attributes: netmap updates (full or delta), prefs changes,
+// and extra-allowed-IP changes.
+//
+// When no current peer is jailed or masqueraded, it installs nil, which
+// keeps the data plane's per-packet fast path to a nil check.
+func (b *LocalBackend) setDataPlanePeerRoutes() {
+	nb := b.currentNode()
+	var native4, native6 netip.Addr
+	var routes *bart.Table[*routemanager.PeerRoute]
+	if nb.routeMgr.HasDataPlaneAttrs() {
+		routes = nb.routeMgr.Outbound()
+		if nm := nb.NetMap(); nm != nil {
+			native4, native6 = tsaddr.FirstTailscaleAddrs(nm.GetAddresses().All())
+		}
+	}
+	b.e.SetPeerRoutes(native4, native6, routes)
+}
+
 // shouldUseOneCGNATRoute reports whether we should prefer to make one big
 // CGNAT /10 route rather than a /32 per peer.
 //
@@ -5307,18 +6237,22 @@ func shouldUseOneCGNATRoute(logf logger.Logf, mon *netmon.Monitor, controlKnobs
 		return true
 	}
 
-	// Also prefer to do this on the Mac, so that we don't need to constantly
-	// update the network extension configuration (which is disruptive to
-	// Chrome, see https://github.com/tailscale/tailscale/issues/3102). Only
-	// use fine-grained routes if another interfaces is also using the CGNAT
+	// Prefer a single CGNAT route on platforms where updateing the VPN
+	// configuration is espensive. On macOS, changing the network extension
+	// configuration can disrupt existing connections notably Chrome; see
+	// https://github.com/tailscale/tailscale/issues/3102). On Android, updating
+	// VpnService.Builder configuration requires establishing a new VPN interface,
+	// which tears down long lived TCP connections.
+	//
+	// Only use fine-grained routes if another interfaces is also using the CGNAT
 	// IP range.
-	if versionOS == "macOS" {
+	if versionOS == "macOS" || versionOS == "android" {
 		hasCGNATInterface, err := mon.HasCGNATInterface()
 		if err != nil {
 			logf("shouldUseOneCGNATRoute: Could not determine if any interfaces use CGNAT: %v", err)
 			return false
 		}
-		logf("[v1] shouldUseOneCGNATRoute: macOS automatic=%v", !hasCGNATInterface)
+		logf("[v1] shouldUseOneCGNATRoute: %s automatic=%v", versionOS, !hasCGNATInterface)
 		if !hasCGNATInterface {
 			return true
 		}
@@ -5396,6 +6330,9 @@ func (b *LocalBackend) ProfileMkdirAll(id ipn.ProfileID, subs ...string) (string
 	return b.profileMkdirAllLocked(id, subs...)
 }
 
+// ProfileDataDir is the directory name, under the Tailscale var root, that holds per-profile data.
+const ProfileDataDir = "profile-data"
+
 // profileDataPathLocked returns a path of a profile-specific (sub)directory
 // inside the writable storage area for the given profile ID. It does not
 // create or verify the existence of the path in the filesystem.
@@ -5410,7 +6347,7 @@ func (b *LocalBackend) profileDataPathLocked(id ipn.ProfileID, subs ...string) s
 	if vr == "" {
 		return ""
 	}
-	return filepath.Join(append([]string{vr, "profile-data", string(id)}, subs...)...)
+	return filepath.Join(append([]string{vr, ProfileDataDir, string(id)}, subs...)...)
 }
 
 // profileMkdirAllLocked implements ProfileMkdirAll.
@@ -5597,64 +6534,10 @@ func magicDNSRootDomains(nm *netmap.NetworkMap) []dnsname.FQDN {
 	return nil
 }
 
-// peerRoutes returns the routerConfig.Routes to access peers.
-// If there are over cgnatThreshold CGNAT routes, one big CGNAT route
-// is used instead.
-func peerRoutes(logf logger.Logf, peers []wgcfg.Peer, cgnatThreshold int, routeAll bool) (routes []netip.Prefix) {
-	tsULA := tsaddr.TailscaleULARange()
-	cgNAT := tsaddr.CGNATRange()
-	var didULA bool
-	var cgNATIPs []netip.Prefix
-	for _, peer := range peers {
-		for _, aip := range peer.AllowedIPs {
-			aip = unmapIPPrefix(aip)
-
-			// Ensure that we're only accepting properly-masked
-			// prefixes; the control server should be masking
-			// these, so if we get them, skip.
-			if mm := aip.Masked(); aip != mm {
-				// To avoid a DoS where a peer could cause all
-				// reconfigs to fail by sending a bad prefix, we just
-				// skip, but don't error, on an unmasked route.
-				logf("advertised route %s from %s has non-address bits set; expected %s", aip, peer.PublicKey.ShortString(), mm)
-				continue
-			}
-
-			// Only add the Tailscale IPv6 ULA once, if we see anybody using part of it.
-			if aip.Addr().Is6() && aip.IsSingleIP() && tsULA.Contains(aip.Addr()) {
-				if !didULA {
-					didULA = true
-					routes = append(routes, tsULA)
-				}
-				continue
-			}
-			if aip.IsSingleIP() && cgNAT.Contains(aip.Addr()) {
-				cgNATIPs = append(cgNATIPs, aip)
-			} else if routeAll {
-				routes = append(routes, aip)
-			}
-		}
-	}
-	if len(cgNATIPs) > cgnatThreshold {
-		// Probably the hello server. Just append one big route.
-		routes = append(routes, cgNAT)
-	} else {
-		routes = append(routes, cgNATIPs...)
-	}
-
-	tsaddr.SortPrefixes(routes)
-	return routes
-}
-
 // routerConfig produces a router.Config from a wireguard config and IPN prefs.
 //
 // b.mu must be held.
-func (b *LocalBackend) routerConfigLocked(cfg *wgcfg.Config, prefs ipn.PrefsView, nm *netmap.NetworkMap, oneCGNATRoute bool) *router.Config {
-	singleRouteThreshold := 10_000
-	if oneCGNATRoute {
-		singleRouteThreshold = 1
-	}
-
+func (b *LocalBackend) routerConfigLocked(cfg *wgcfg.Config, prefs ipn.PrefsView, nm *netmap.NetworkMap) *router.Config {
 	netfilterKind := b.capForcedNetfilter // protected by b.mu (hence the Locked suffix)
 
 	if prefs.NetfilterKind() != "" {
@@ -5673,13 +6556,14 @@ func (b *LocalBackend) routerConfigLocked(cfg *wgcfg.Config, prefs ipn.PrefsView
 	}
 
 	rs := &router.Config{
-		LocalAddrs:        unmapIPPrefixes(cfg.Addresses),
-		SubnetRoutes:      unmapIPPrefixes(prefs.AdvertiseRoutes().AsSlice()),
-		SNATSubnetRoutes:  !prefs.NoSNAT(),
-		StatefulFiltering: doStatefulFiltering,
-		NetfilterMode:     prefs.NetfilterMode(),
-		Routes:            peerRoutes(b.logf, cfg.Peers, singleRouteThreshold, prefs.RouteAll()),
-		NetfilterKind:     netfilterKind,
+		LocalAddrs:          unmapIPPrefixes(cfg.Addresses),
+		SubnetRoutes:        unmapIPPrefixes(prefs.AdvertiseRoutes().AsSlice()),
+		SNATSubnetRoutes:    !prefs.NoSNAT(),
+		StatefulFiltering:   doStatefulFiltering,
+		NetfilterMode:       prefs.NetfilterMode(),
+		Routes:              b.currentNode().osRoutes(),
+		NetfilterKind:       netfilterKind,
+		RemoveCGNATDropRule: nm.HasCap(tailcfg.NodeAttrDisableLinuxCGNATDropRule),
 	}
 
 	if buildfeatures.HasSynology && distro.Get() == distro.Synology {
@@ -5782,7 +6666,17 @@ func (b *LocalBackend) applyPrefsToHostinfoLocked(hi *tailcfg.Hostinfo, prefs ip
 	hi.RoutableIPs = prefs.AdvertiseRoutes().AsSlice()
 	hi.RequestTags = prefs.AdvertiseTags().AsSlice()
 	hi.ShieldsUp = prefs.ShieldsUp()
-	hi.AllowsUpdate = buildfeatures.HasClientUpdate && (envknob.AllowsRemoteUpdate() || prefs.AutoUpdate().Apply.EqualBool(true))
+	// Only advertise RemoteConfig to control when the feature is both
+	// compiled in (buildfeatures.HasRemoteConfig; a const so the whole
+	// expression dead-code eliminates when ts_omit_remoteconfig is set)
+	// and its init actually ran to wire up the c2n handler. tsnet
+	// builds are the interesting case: they do not import
+	// feature/remoteconfig even though ts_omit_remoteconfig is not
+	// set, so we must not claim RemoteConfig is active there.
+	hi.RemoteConfig = buildfeatures.HasRemoteConfig && prefs.RemoteConfig() && feature.IsRegistered("remoteconfig")
+	// Likewise for AllowsUpdate: require the clientupdate feature's init to
+	// have run, not just the build tag being enabled.
+	hi.AllowsUpdate = buildfeatures.HasClientUpdate && (envknob.AllowsRemoteUpdate() || prefs.AutoUpdate().Apply.EqualBool(true)) && feature.IsRegistered("clientupdate")
 
 	if buildfeatures.HasAdvertiseRoutes {
 		b.metrics.advertisedRoutes.Set(float64(tsaddr.WithoutExitRoute(prefs.AdvertiseRoutes()).Len()))
@@ -5887,29 +6781,15 @@ func (b *LocalBackend) enterStateLocked(newState ipn.State) {
 			b.resetAuthURLLocked()
 		}
 
-		// Start a captive portal detection loop if none has been
-		// started. Create a new context if none is present, since it
-		// can be shut down if we transition away from Running.
-		if buildfeatures.HasCaptivePortal {
-			if b.captiveCancel == nil {
-				captiveCtx, captiveCancel := context.WithCancel(b.ctx)
-				b.captiveCtx, b.captiveCancel = captiveCtx, captiveCancel
-				b.goTracker.Go(func() { hookCheckCaptivePortalLoop.Get()(b, captiveCtx) })
-			}
-		}
+		// (Re)evaluate the background TLS cert refresh loop. It runs
+		// only while we're Running and ServeConfig has at least one
+		// HTTPS Web entry, so idle nodes don't hold a timer open.
+		b.updateCertRefreshLoopLocked()
 	} else if oldState == ipn.Running {
 		// Transitioning away from running.
 		b.closePeerAPIListenersLocked()
 
-		// Stop any existing captive portal detection loop.
-		if buildfeatures.HasCaptivePortal && b.captiveCancel != nil {
-			b.captiveCancel()
-			b.captiveCancel = nil
-
-			// NOTE: don't set captiveCtx to nil here, to ensure
-			// that we always have a (canceled) context to wait on
-			// in onHealthChange.
-		}
+		b.updateCertRefreshLoopLocked()
 	}
 	b.pauseOrResumeControlClientLocked()
 
@@ -5927,9 +6807,9 @@ func (b *LocalBackend) enterStateLocked(newState ipn.State) {
 	switch newState {
 	case ipn.NeedsLogin:
 		feature.SystemdStatus("Needs login: %s", authURL)
-		// always block updates on NeedsLogin even if seamless renewal is enabled,
-		// to prevent calls to authReconfigLocked from reconfiguring the engine when our
-		// key has expired and we're waiting to authenticate to use the new key.
+		// always block updates on NeedsLogin, to prevent calls to authReconfigLocked
+		// from reconfiguring the engine when our key has expired and we're waiting
+		// to authenticate to use the new key.
 		b.blockEngineUpdatesLocked(true)
 		fallthrough
 	case ipn.Stopped, ipn.NoState:
@@ -6096,6 +6976,12 @@ func (b *LocalBackend) setControlClientLocked(cc controlclient.Client) {
 	b.cc = cc
 	b.ccAuto, _ = cc.(*controlclient.Auto)
 	b.ignoreControlClientUpdates.Store(cc == nil)
+
+	// magicsock de-dupes NetInfo against a cache that outlives the control
+	// client; clear it on (re)install so the next netcheck re-reports our
+	// NetInfo (notably PreferredDERP, our home DERP) to the new client rather
+	// than suppressing it as unchanged.
+	b.MagicConn().ResetNetInfoLast()
 }
 
 // resetControlClientLocked sets b.cc to nil and returns the old value. If the
@@ -6156,13 +7042,14 @@ func (b *LocalBackend) ShouldExposeRemoteWebClient() bool {
 }
 
 // setWebClientAtomicBoolLocked sets webClientAtomicBool based on whether
-// tailcfg.NodeAttrDisableWebClient has been set in the netmap.NetworkMap.
+// tailcfg.NodeAttrDisableWebClient is present in caps. caps may be nil
+// if the caller has no netmap.
 //
 // b.mu must be held.
-func (b *LocalBackend) setWebClientAtomicBoolLocked(nm *netmap.NetworkMap) {
+func (b *LocalBackend) setWebClientAtomicBoolLocked(caps set.Set[tailcfg.NodeCapability]) {
 	syncs.RequiresMutex(&b.mu)
 
-	shouldRun := !nm.HasCap(tailcfg.NodeAttrDisableWebClient)
+	shouldRun := !caps.Contains(tailcfg.NodeAttrDisableWebClient)
 	wasRunning := b.webClientAtomicBool.Swap(shouldRun)
 	if wasRunning && !shouldRun {
 		b.goTracker.Go(b.webClientShutdown) // stop web client
@@ -6401,9 +7288,26 @@ func (b *LocalBackend) resolveExitNodeInPrefsLocked(prefs *ipn.Prefs) (changed b
 // received nm. If nm is nil, it resets all configuration as though
 // Tailscale is turned off.
 func (b *LocalBackend) setNetMapLocked(nm *netmap.NetworkMap) {
-	oldSelf := b.currentNode().NetMap().SelfNodeOrZero()
+	if buildfeatures.HasCacheNetMap {
+		// As a defensive measure, if something triggers a panic when we are
+		// installing a network map, make an effort to discard any cached netmaps.
+		// This helps avert the possibility that a restart after panic will stick in
+		// a cycle. Importantly, we do not attempt to swallow or handle the panic,
+		// since that indicates a real bug.
+		//
+		// See https://github.com/tailscale/tailscale/issues/12639
+		defer func() {
+			if p := recover(); p != nil {
+				b.logf("WARNING: Panic while installing netmap; discardng caches")
+				b.discardDiskCacheLocked()
+				panic(p) // propagate
+			}
+		}()
+	}
+
+	oldNetMap := b.currentNode().NetMap()
+	oldSelf := oldNetMap.SelfNodeOrZero()
 
-	b.dialer.SetNetMap(nm)
 	if ns, ok := b.sys.Netstack.GetOK(); ok {
 		ns.UpdateNetstackIPs(nm)
 	}
@@ -6411,14 +7315,31 @@ func (b *LocalBackend) setNetMapLocked(nm *netmap.NetworkMap) {
 	if nm != nil {
 		login = cmp.Or(profileFromView(nm.UserProfiles[nm.User()]).LoginName, "<missing-profile>")
 	}
-	b.currentNode().SetNetMap(nm)
+	discoChanged, routeChanged := b.currentNode().SetNetMap(nm)
+	b.setDataPlanePeerRoutes()
 	if ms, ok := b.sys.MagicSock.GetOK(); ok {
 		if nm != nil {
-			ms.SetNetworkMap(nm.SelfNode, nm.Peers)
+			if nm.Cached {
+				ms.SetNetworkMapCached(nm.SelfNode, nm.Peers)
+			} else {
+				ms.SetNetworkMap(nm.SelfNode, nm.Peers)
+			}
 		} else {
 			ms.SetNetworkMap(tailcfg.NodeView{}, nil)
 		}
 	}
+	// Reset the WireGuard session for peers whose disco key changed in
+	// a way that indicates a restart, flushing their dead session keys;
+	// each such peer is lazily re-created on demand with current state.
+	for _, k := range discoChanged {
+		b.e.ResetDevicePeer(k)
+	}
+	// Converge the wireguard-go device for peers whose routes changed
+	// (or that were removed) in the full-netmap resync above; peers not
+	// in routeChanged are already up to date.
+	for k := range routeChanged {
+		b.e.SyncDevicePeer(k)
+	}
 	if login != b.activeLogin {
 		b.logf("active login: %v", login)
 		b.activeLogin = login
@@ -6450,9 +7371,18 @@ func (b *LocalBackend) setNetMapLocked(nm *netmap.NetworkMap) {
 
 	b.MagicConn().SetSilentDisco(b.ControlKnobs().SilentDisco.Load())
 	b.MagicConn().SetProbeUDPLifetime(b.ControlKnobs().ProbeUDPLifetime.Load())
+	if buildfeatures.HasRuntimeMetrics {
+		if f, ok := HookSetRuntimeMetricsEnabled.GetOk(); ok {
+			f(b.ControlKnobs().EmitRuntimeMetrics.Load())
+		}
+	}
 
 	if buildfeatures.HasDebug {
-		b.setDebugLogsByCapabilityLocked(nm)
+		var caps set.Set[tailcfg.NodeCapability]
+		if nm != nil {
+			caps = nm.AllCaps
+		}
+		b.setDebugLogsByCapabilityLocked(caps)
 	}
 
 	// See the netns package for documentation on what these capability do.
@@ -6476,6 +7406,12 @@ func (b *LocalBackend) setNetMapLocked(nm *netmap.NetworkMap) {
 
 	}
 
+	if oldNetMap != nm && (oldNetMap == nil || nm == nil) {
+		for _, f := range b.extHost.Hooks().OnNetMapToggle {
+			f(nm)
+		}
+	}
+
 	if !oldSelf.Equal(nm.SelfNodeOrZero()) {
 		for _, f := range b.extHost.Hooks().OnSelfChange {
 			f(nm.SelfNode)
@@ -6498,9 +7434,17 @@ func (b *LocalBackend) setNetMapLocked(nm *netmap.NetworkMap) {
 		}
 	}
 
-	if buildfeatures.HasDrive && nm != nil {
-		if f, ok := hookSetNetMapLockedDrive.GetOk(); ok {
-			f(b, nm)
+	if buildfeatures.HasDrive {
+		// Bump the drive remotes-source generation on every full netmap
+		// install. The hook is invoked separately below for share-list
+		// notifications; the bump itself is unconditional because the
+		// drive feature might not be wired in this build but the atomic
+		// add is cheap.
+		b.driveGen.Add(1)
+		if nm != nil {
+			if f, ok := hookSetNetMapLockedDrive.GetOk(); ok {
+				f(b)
+			}
 		}
 	}
 
@@ -6519,7 +7463,7 @@ func (b *LocalBackend) setNetMapLocked(nm *netmap.NetworkMap) {
 	// the node starts up.
 	if nm != nil {
 		if b.currentNode().SelfHasCap(tailcfg.NodeAttrCacheNetworkMaps) && envknob.BoolDefaultTrue("TS_USE_CACHED_NETMAP") {
-			if err := b.writeNetmapToDiskLocked(nm); err != nil {
+			if err := b.writeNetmapToDiskLockedWithPeers(nm); err != nil {
 				b.logf("write netmap to cache: %v", err)
 			}
 		} else {
@@ -6528,7 +7472,24 @@ func (b *LocalBackend) setNetMapLocked(nm *netmap.NetworkMap) {
 	}
 }
 
-var hookSetNetMapLockedDrive feature.Hook[func(*LocalBackend, *netmap.NetworkMap)]
+// HookSetRuntimeMetricsEnabled is an optional hook for the "runtimemetrics" feature.
+var HookSetRuntimeMetricsEnabled feature.Hook[func(enabled bool)]
+
+// hookSetNetMapLockedDrive is invoked on every full netmap install when the
+// drive feature is linked in. It does NOT fire on netmap delta updates (peer
+// add/remove etc.); those are picked up by the lazy [drive.RemoteSource]
+// installed via [hookInstallDriveRemoteSource] plus the per-event bumps to
+// [LocalBackend.driveGen]. Its only remaining job is to re-notify IPN bus
+// listeners of the current local share list, whose visibility depends on
+// self caps that only change on full installs.
+var hookSetNetMapLockedDrive feature.Hook[func(*LocalBackend)]
+
+// hookInstallDriveRemoteSource is invoked from [NewLocalBackend] once the
+// LocalBackend is far enough along to be used as a source. It registers a
+// [drive.RemoteSource] on [sys.DriveForLocal] so the filesystem can pull
+// remotes lazily instead of being pushed a fresh list on every netmap
+// update.
+var hookInstallDriveRemoteSource feature.Hook[func(*LocalBackend)]
 
 // roundTraffic rounds bytes. This is used to preserve user privacy within logs.
 func roundTraffic(bytes int64) float64 {
@@ -6557,11 +7518,11 @@ func roundTraffic(bytes int64) float64 {
 }
 
 // setDebugLogsByCapabilityLocked sets debug logging based on the self node's
-// capabilities in the provided NetMap.
-func (b *LocalBackend) setDebugLogsByCapabilityLocked(nm *netmap.NetworkMap) {
+// capabilities. caps may be nil if the caller has no netmap.
+func (b *LocalBackend) setDebugLogsByCapabilityLocked(caps set.Set[tailcfg.NodeCapability]) {
 	// These are sufficiently cheap (atomic bools) that we don't need to
 	// store state and compare.
-	if nm.HasCap(tailcfg.CapabilityDebugTSDNSResolution) {
+	if caps.Contains(tailcfg.CapabilityDebugTSDNSResolution) {
 		dnscache.SetDebugLoggingEnabled(true)
 	} else {
 		dnscache.SetDebugLoggingEnabled(false)
@@ -6710,6 +7671,9 @@ func (b *LocalBackend) SetDNS(ctx context.Context, name, value string) error {
 }
 
 func peerAPIPorts(peer tailcfg.NodeView) (p4, p6 uint16) {
+	if !peer.Valid() || !peer.Hostinfo().Valid() {
+		return
+	}
 	svcs := peer.Hostinfo().Services()
 	for _, s := range svcs.All() {
 		switch s.Proto {
@@ -6866,7 +7830,7 @@ func (b *LocalBackend) AppConnector() *appc.AppConnector {
 func (b *LocalBackend) allowExitNodeDNSProxyToServeName(name string) bool {
 	b.mu.Lock()
 	defer b.mu.Unlock()
-	nm := b.NetMap()
+	nm := b.NetMapNoPeers()
 	if nm == nil {
 		return false
 	}
@@ -7010,11 +7974,28 @@ func (b *LocalBackend) DebugRotateDiscoKey() error {
 
 	b.mu.Lock()
 	cc := b.cc
+	wantRunning := b.pm.CurrentPrefs().WantRunning()
 	b.mu.Unlock()
 	if cc != nil {
 		cc.SetDiscoPublicKey(newDiscoKey)
 	}
 
+	// Bounce WantRunning to fully reset wireguard-go state for all peers.
+	if wantRunning {
+		if _, err := b.EditPrefs(&ipn.MaskedPrefs{
+			Prefs:          ipn.Prefs{WantRunning: false},
+			WantRunningSet: true,
+		}); err != nil {
+			return err
+		}
+		if _, err := b.EditPrefs(&ipn.MaskedPrefs{
+			Prefs:          ipn.Prefs{WantRunning: true},
+			WantRunningSet: true,
+		}); err != nil {
+			return err
+		}
+	}
+
 	return nil
 }
 
@@ -7022,6 +8003,15 @@ func (b *LocalBackend) DebugPeerRelayServers() set.Set[netip.Addr] {
 	return b.MagicConn().PeerRelays()
 }
 
+// DebugPeerDiscoKeys returns the disco public keys this node has learned for
+// each of its current peers. Intended for tests
+// (the production [ipnstate.PeerStatus] purposefully does not surface disco
+// keys; surfacing them via the [ipnstate.Status] API would also pollute
+// every PeerStatus consumer with a non-comparable struct field).
+func (b *LocalBackend) DebugPeerDiscoKeys() map[key.NodePublic]key.DiscoPublic {
+	return b.currentNode().peerDiscoKeys()
+}
+
 // ControlKnobs returns the node's control knobs.
 func (b *LocalBackend) ControlKnobs() *controlknobs.Knobs {
 	return b.sys.ControlKnobs()
@@ -7049,6 +8039,98 @@ func (b *LocalBackend) DoNoiseRequest(req *http.Request) (*http.Response, error)
 	return cc.DoNoiseRequest(req)
 }
 
+// noiseRoundTripper adapts LocalBackend.DoNoiseRequest to http.RoundTripper.
+type noiseRoundTripper struct {
+	lb *LocalBackend
+}
+
+func (n noiseRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+	return n.lb.DoNoiseRequest(req)
+}
+
+// netLogNodeSource adapts LocalBackend to [wgengine.NetLogSource].
+// Each method consults [LocalBackend.currentNode] or the current netmap
+// so that profile rotations are picked up automatically without
+// re-installing the source.
+type netLogNodeSource struct {
+	b *LocalBackend
+}
+
+func (s netLogNodeSource) SelfNode() (tailcfg.NodeView, tailcfg.UserProfileView) {
+	nb := s.b.currentNode()
+	self := nb.Self()
+	if !self.Valid() {
+		return tailcfg.NodeView{}, tailcfg.UserProfileView{}
+	}
+	up, _ := nb.UserByID(self.User())
+	return self, up
+}
+
+func (s netLogNodeSource) NodeByAddr(addr netip.Addr) (_ tailcfg.NodeView, _ tailcfg.UserProfileView, ok bool) {
+	nb := s.b.currentNode()
+	nid, ok := nb.NodeByAddr(addr)
+	if !ok {
+		return tailcfg.NodeView{}, tailcfg.UserProfileView{}, false
+	}
+	nv, ok := nb.NodeByID(nid)
+	if !ok {
+		return tailcfg.NodeView{}, tailcfg.UserProfileView{}, false
+	}
+	up, _ := nb.UserByID(nv.User())
+	return nv, up, true
+}
+
+// NetLogIDs implements [wgengine.NetLogSource], returning the network
+// flow logging identity from the current netmap. ok is false if the
+// netmap does not enable network flow logging for this node.
+func (s netLogNodeSource) NetLogIDs() (nodeID, domainID logid.PrivateID, logExitFlows bool, ok bool) {
+	nm := s.b.NetMap()
+	if nm == nil || !nm.SelfNode.Valid() {
+		return
+	}
+	if !nm.SelfNode.HasCap(tailcfg.CapabilityDataPlaneAuditLogs) {
+		return
+	}
+	if nm.SelfNode.DataPlaneAuditLogID() == "" || nm.DomainAuditLogID == "" {
+		return
+	}
+	nodeID, errNode := logid.ParsePrivateID(nm.SelfNode.DataPlaneAuditLogID())
+	if errNode != nil {
+		s.b.logf("[v1] netlog: unable to parse node audit log ID: %v", errNode)
+	}
+	domainID, errDomain := logid.ParsePrivateID(nm.DomainAuditLogID)
+	if errDomain != nil {
+		s.b.logf("[v1] netlog: unable to parse domain audit log ID: %v", errDomain)
+	}
+	if errNode != nil || errDomain != nil {
+		return logid.PrivateID{}, logid.PrivateID{}, false, false
+	}
+	return nodeID, domainID, nm.SelfNode.HasCap(tailcfg.NodeAttrLogExitFlows), true
+}
+
+// Compile-time assertion that netLogNodeSource implements
+// [wgengine.NetLogSource].
+var _ wgengine.NetLogSource = netLogNodeSource{}
+
+// lookupPeerWireGuardString returns the Tailscale-conventional short string
+// (e.g. "[IMTBr]") for the peer whose wireguard-go-formatted public key
+// string is wgString (e.g. "peer(IMTB…r7lM)"), or "", false if no current
+// peer matches. It is installed on the engine via [Engine.SetWGPeerLookup]
+// in [NewLocalBackend] so that [wglog.Logger] can rewrite peer references
+// in wireguard-go log lines without any per-Reconfig denormalization.
+func (b *LocalBackend) lookupPeerWireGuardString(wgString string) (tsString string, ok bool) {
+	nb := b.currentNode()
+	nid, ok := nb.NodeByWireGuardString(wgString)
+	if !ok {
+		return "", false
+	}
+	nv, ok := nb.NodeByID(nid)
+	if !ok {
+		return "", false
+	}
+	return nv.Key().ShortString(), true
+}
+
 // ActiveSSHConns returns the number of active SSH connections,
 // or 0 if SSH is not linked into the binary or available on the platform.
 func (b *LocalBackend) ActiveSSHConns() int {
@@ -7280,8 +8362,8 @@ func (b *LocalBackend) resetForProfileChangeLocked() error {
 	defer newNode.ready()
 	b.setNetMapLocked(nil) // Reset netmap.
 	b.updateFilterLocked(ipn.PrefsView{})
-	// Reset the NetworkMap in the engine
-	b.e.SetNetworkMap(new(netmap.NetworkMap))
+	// Reset the self node in the engine.
+	b.e.SetSelfNode(tailcfg.NodeView{})
 	if prevCC := b.resetControlClientLocked(); prevCC != nil {
 		// Shutdown outside of b.mu to avoid deadlocks.
 		b.goTracker.Go(prevCC.Shutdown)
@@ -7385,7 +8467,7 @@ func (b *LocalBackend) ResetAuth() error {
 }
 
 func (b *LocalBackend) GetPeerEndpointChanges(ctx context.Context, ip netip.Addr) ([]magicsock.EndpointChange, error) {
-	pip, ok := b.e.PeerForIP(ip)
+	pip, ok := b.PeerForIP(ip)
 	if !ok {
 		return nil, fmt.Errorf("no matching peer")
 	}
@@ -7570,14 +8652,6 @@ func (b *LocalBackend) ReadRouteInfo() (*appctype.RouteInfo, error) {
 	return b.readRouteInfoLocked()
 }
 
-// seamlessRenewalEnabled reports whether seamless key renewals are enabled.
-//
-// As of 2025-09-11, this is the default behaviour unless nodes receive
-// [tailcfg.NodeAttrDisableSeamlessKeyRenewal] in their netmap.
-func (b *LocalBackend) seamlessRenewalEnabled() bool {
-	return b.ControlKnobs().SeamlessKeyRenewal.Load()
-}
-
 var (
 	disallowedAddrs = []netip.Addr{
 		netip.MustParseAddr("::1"),
@@ -7606,22 +8680,43 @@ func allowedAutoRoute(ipp netip.Prefix) bool {
 	return true
 }
 
+// HookRouteCheckReport is the hook that returns the latest routecheck Report for this LocalBackend.
+var HookRouteCheckReport feature.Hook[func(*LocalBackend) RouteCheckReport]
+
 var ErrNoPreferredDERP = errors.New("no preferred DERP, try again later")
 
 // suggestExitNodeLocked computes a suggestion based on the current netmap and
 // other optional factors. If there are multiple equally good options, one may
 // be selected at random, so the result is not stable. To be eligible for
-// consideration, the peer must have NodeAttrSuggestExitNode in its CapMap.
+// consideration, the peer must have [tailcfg.NodeAttrSuggestExitNode] in its CapMap.
+//
+// When the client has [tailcfg.NodeAttrClientSideReachabilityRouteCheck] in its CapMap,
+// it will use [HookRouteCheckReport] to get the latest cached routecheck report.
 //
 // b.mu must be held.
 func (b *LocalBackend) suggestExitNodeLocked() (response apitype.ExitNodeSuggestionResponse, err error) {
 	if !buildfeatures.HasUseExitNode {
 		return response, feature.ErrUnavailable
 	}
-	lastReport := b.MagicConn().GetLastNetcheckReport(b.ctx)
+
+	mc := b.MagicConn()
+	var preferredDERP int
+	if lastReport := mc.GetLastNetcheckReport(b.ctx); lastReport != nil {
+		preferredDERP = lastReport.PreferredDERP
+	}
+	// Use netcheck's recent per-region latency rather than only the latest report:
+	// the latest report may be an incremental netcheck that didn't re-probe the
+	// regions where far-away candidate exit nodes live, which would otherwise force
+	// a random choice.
+	regionLatency := mc.GetDERPRegionLatency()
 	prevSuggestion := b.lastSuggestedExitNode
 
-	res, err := suggestExitNode(lastReport, b.currentNode(), prevSuggestion, randomRegion, randomNode, b.getAllowedSuggestions())
+	var rp RouteCheckReport
+	if hook := HookRouteCheckReport.GetOrNil(); hook != nil {
+		rp = hook(b)
+	}
+
+	res, err := suggestExitNode(preferredDERP, regionLatency, rp, b.currentNode(), prevSuggestion, randomRegion, randomNode, b.getAllowedSuggestions())
 	if err != nil {
 		return res, err
 	}
@@ -7634,6 +8729,10 @@ func (b *LocalBackend) suggestExitNodeLocked() (response apitype.ExitNodeSuggest
 	return res, err
 }
 
+// SuggestExitNode computes an exit-node suggestion based on the current netmap and
+// other optional factors. If there are multiple equally good options, one may
+// be selected at random, so the result is not stable. To be eligible for
+// consideration, the peer must have [tailcfg.NodeAttrSuggestExitNode] in its CapMap.
 func (b *LocalBackend) SuggestExitNode() (response apitype.ExitNodeSuggestionResponse, err error) {
 	if !buildfeatures.HasUseExitNode {
 		return response, feature.ErrUnavailable
@@ -7693,22 +8792,30 @@ func fillAllowedSuggestions(polc policyclient.Client) (set.Set[tailcfg.StableNod
 
 // suggestExitNode returns a suggestion for reasonably good exit node based on
 // the current netmap and the previous suggestion.
-func suggestExitNode(report *netcheck.Report, nb *nodeBackend, prevSuggestion tailcfg.StableNodeID, selectRegion selectRegionFunc, selectNode selectNodeFunc, allowList set.Set[tailcfg.StableNodeID]) (res apitype.ExitNodeSuggestionResponse, err error) {
+//
+// preferredDERP is this device's home DERP region (0 if unknown) and
+// regionLatency is the best recent latency to each DERP region; both come from
+// netcheck and are only used by the DERP-based algorithm.
+//
+// Errors are always logged. Suggestions are logged if they defer from prevSuggestion.
+func suggestExitNode(preferredDERP int, regionLatency map[int]time.Duration, rp RouteCheckReport, nb *nodeBackend, prevSuggestion tailcfg.StableNodeID, selectRegion selectRegionFunc, selectNode selectNodeFunc, allowList set.Set[tailcfg.StableNodeID]) (res apitype.ExitNodeSuggestionResponse, err error) {
 	switch {
 	case nb.SelfHasCap(tailcfg.NodeAttrTrafficSteering):
 		// The traffic-steering feature flag is enabled on this tailnet.
-		res, err = suggestExitNodeUsingTrafficSteering(nb, allowList)
+		res, err = suggestExitNodeUsingTrafficSteering(rp, nb, allowList)
 	default:
 		// The control plane will always strip the `traffic-steering`
 		// node attribute if it isn’t enabled for this tailnet, even if
 		// it is set in the policy file: tailscale/corp#34401
-		res, err = suggestExitNodeUsingDERP(report, nb, prevSuggestion, selectRegion, selectNode, allowList)
+		res, err = suggestExitNodeUsingDERP(preferredDERP, regionLatency, nb, prevSuggestion, selectRegion, selectNode, allowList)
 	}
 	if err != nil {
 		nb.logf("netmap: suggested exit node: %v", err)
 	} else {
-		name, _, _ := strings.Cut(res.Name, ".")
-		nb.logf("netmap: suggested exit node: %s (%s)", name, res.ID)
+		if res.ID != prevSuggestion {
+			name, _, _ := strings.Cut(res.Name, ".")
+			nb.logf("netmap: suggested exit node: %s (%s)", name, res.ID)
+		}
 	}
 	return res, err
 }
@@ -7717,29 +8824,26 @@ func suggestExitNode(report *netcheck.Report, nb *nodeBackend, prevSuggestion ta
 // before traffic steering was implemented. This handles the plain failover
 // case, in addition to the optional Regional Routing.
 //
-// It computes a suggestion based on the current netmap and last netcheck
-// report. If there are multiple equally good options, one is selected at
-// random, so the result is not stable. To be eligible for consideration, the
-// peer must have NodeAttrSuggestExitNode in its CapMap.
+// It computes a suggestion based on the current netmap, this device's preferred
+// DERP region, and the recent measured latency to each DERP region (regionLatency).
+// If there are multiple equally good options, one is selected at random, so the
+// result is not stable. To be eligible for consideration, the peer must have
+// NodeAttrSuggestExitNode in its CapMap.
 //
 // Currently, peers with a DERP home are preferred over those without (typically
 // this means Mullvad). Peers are selected based on having a DERP home that is
 // the lowest latency to this device. For peers without a DERP home, we look for
 // geographic proximity to this device's DERP home.
-func suggestExitNodeUsingDERP(report *netcheck.Report, nb *nodeBackend, prevSuggestion tailcfg.StableNodeID, selectRegion selectRegionFunc, selectNode selectNodeFunc, allowList set.Set[tailcfg.StableNodeID]) (res apitype.ExitNodeSuggestionResponse, err error) {
-	// TODO(sfllaw): Context needs to be plumbed down here to support
-	// reachability testing.
-	ctx := context.TODO()
-
+func suggestExitNodeUsingDERP(preferredRegionID int, regionLatency map[int]time.Duration, nb *nodeBackend, prevSuggestion tailcfg.StableNodeID, selectRegion selectRegionFunc, selectNode selectNodeFunc, allowList set.Set[tailcfg.StableNodeID]) (res apitype.ExitNodeSuggestionResponse, err error) {
 	netMap := nb.NetMap()
-	if report == nil || report.PreferredDERP == 0 || netMap == nil || netMap.DERPMap == nil {
+	if preferredRegionID == 0 || netMap == nil || netMap.DERPMap == nil {
 		return res, ErrNoPreferredDERP
 	}
 	// Use [nodeBackend.AppendMatchingPeers] instead of the netmap directly,
 	// since the netmap doesn't include delta updates (e.g., home DERP or Online
 	// status changes) from the control plane since the last full update.
 	candidates := nb.AppendMatchingPeers(nil, func(peer tailcfg.NodeView) bool {
-		if !peer.Valid() || !nb.PeerIsReachable(ctx, peer) {
+		if !peer.Valid() || !nb.PeerIsReachable(nil, peer) {
 			return false
 		}
 		if allowList != nil && !allowList.Contains(peer.StableID()) {
@@ -7763,7 +8867,7 @@ func suggestExitNodeUsingDERP(report *netcheck.Report, nb *nodeBackend, prevSugg
 	}
 
 	candidatesByRegion := make(map[int][]tailcfg.NodeView, len(netMap.DERPMap.Regions))
-	preferredDERP, ok := netMap.DERPMap.Regions[report.PreferredDERP]
+	preferredDERP, ok := netMap.DERPMap.Regions[preferredRegionID]
 	if !ok {
 		return res, ErrNoPreferredDERP
 	}
@@ -7799,10 +8903,10 @@ func suggestExitNodeUsingDERP(report *netcheck.Report, nb *nodeBackend, prevSugg
 		}
 		distances = append(distances, nodeDistance{nv: c, distance: distance})
 	}
-	// First, try to select an exit node that has the closest DERP home, based on lastReport's DERP latency.
+	// First, try to select an exit node that has the closest DERP home, based on recent DERP latency.
 	// If there are no latency values, it returns an arbitrary region
 	if len(candidatesByRegion) > 0 {
-		minRegion := minLatencyDERPRegion(slicesx.MapKeys(candidatesByRegion), report)
+		minRegion := minLatencyDERPRegion(slicesx.MapKeys(candidatesByRegion), regionLatency)
 		if minRegion == 0 {
 			minRegion = selectRegion(views.SliceOf(slicesx.MapKeys(candidatesByRegion)))
 		}
@@ -7867,11 +8971,7 @@ var ErrNoNetMap = errors.New("no network map, try again later")
 // pick one of the best exit nodes. These priorities are provided by Control in
 // the node’s [tailcfg.Location]. To be eligible for consideration, the node
 // must have NodeAttrSuggestExitNode in its CapMap.
-func suggestExitNodeUsingTrafficSteering(nb *nodeBackend, allowed set.Set[tailcfg.StableNodeID]) (apitype.ExitNodeSuggestionResponse, error) {
-	// TODO(sfllaw): Context needs to be plumbed down here to support
-	// reachability testing.
-	ctx := context.TODO()
-
+func suggestExitNodeUsingTrafficSteering(rp RouteCheckReport, nb *nodeBackend, allowed set.Set[tailcfg.StableNodeID]) (apitype.ExitNodeSuggestionResponse, error) {
 	nm := nb.NetMap()
 	if nm == nil {
 		return apitype.ExitNodeSuggestionResponse{}, ErrNoNetMap
@@ -7890,7 +8990,7 @@ func suggestExitNodeUsingTrafficSteering(nb *nodeBackend, allowed set.Set[tailcf
 		if !p.Valid() {
 			return false
 		}
-		if !nb.PeerIsReachable(ctx, p) {
+		if !nb.PeerIsReachable(rp, p) {
 			return false
 		}
 		if allowed != nil && !allowed.Contains(p.StableID()) {
@@ -7905,42 +9005,18 @@ func suggestExitNodeUsingTrafficSteering(nb *nodeBackend, allowed set.Set[tailcf
 		return true
 	})
 
-	scores := make(map[tailcfg.NodeID]int, len(nodes))
-	score := func(n tailcfg.NodeView) int {
-		id := n.ID()
-		s, ok := scores[id]
-		if !ok {
-			s = 0 // score of zero means incomparable
-			if hi := n.Hostinfo(); hi.Valid() {
-				if loc := hi.Location(); loc.Valid() {
-					s = loc.Priority()
-				}
-			}
-			scores[id] = s
-		}
-		return s
-	}
-	rdvHash := makeRendezvousHasher(self.ID())
+	ss := traffic.ScoresFor(self.ID(), nodes)
 
 	var pick tailcfg.NodeView
 	if len(nodes) == 1 {
 		pick = nodes[0]
 	}
 	if len(nodes) > 1 {
-		// Find the highest scoring exit nodes.
-		slices.SortFunc(nodes, func(a, b tailcfg.NodeView) int {
-			c := cmp.Compare(score(b), score(a)) // Highest score first.
-			if c == 0 {
-				// Rendezvous hashing for reliably picking the
-				// same node from a list: tailscale/tailscale#16551.
-				return cmp.Compare(rdvHash(b.ID()), rdvHash(a.ID()))
-			}
-			return c
-		})
+		ss.SortNodes(nodes)
 
 		// TODO(sfllaw): add a temperature knob so that this client has
 		// a chance of picking the next best option.
-		pick = nodes[0]
+		pick = nodes[0] // Pick the highest score.
 	}
 
 	nb.logf("netmap: traffic steering: exit node scores: %v", logger.ArgWriter(func(bw *bufio.Writer) {
@@ -7954,7 +9030,7 @@ func suggestExitNodeUsingTrafficSteering(nb *nodeBackend, allowed set.Set[tailcf
 				bw.WriteString(", ")
 			}
 			name, _, _ := strings.Cut(n.Name(), ".")
-			fmt.Fprintf(bw, "%d:%s", score(n), name)
+			fmt.Fprintf(bw, "%d:%s", ss.Score(n), name)
 		}
 	}))
 
@@ -8015,16 +9091,16 @@ func randomNode(nodes views.Slice[tailcfg.NodeView], prefer tailcfg.StableNodeID
 	return nodes.At(rand.IntN(nodes.Len()))
 }
 
-// minLatencyDERPRegion returns the region with the lowest latency value given the last netcheck report.
-// If there are no latency values, it returns 0.
-func minLatencyDERPRegion(regions []int, report *netcheck.Report) int {
+// minLatencyDERPRegion returns the region with the lowest latency value given
+// the per-region latency map. If there are no latency values, it returns 0.
+func minLatencyDERPRegion(regions []int, regionLatency map[int]time.Duration) int {
 	min := slices.MinFunc(regions, func(i, j int) int {
 		const largeDuration time.Duration = math.MaxInt64
-		iLatency, ok := report.RegionLatency[i]
+		iLatency, ok := regionLatency[i]
 		if !ok {
 			iLatency = largeDuration
 		}
-		jLatency, ok := report.RegionLatency[j]
+		jLatency, ok := regionLatency[j]
 		if !ok {
 			jLatency = largeDuration
 		}
@@ -8033,7 +9109,7 @@ func minLatencyDERPRegion(regions []int, report *netcheck.Report) int {
 		}
 		return cmp.Compare(i, j)
 	})
-	latency, ok := report.RegionLatency[min]
+	latency, ok := regionLatency[min]
 	if !ok || latency == 0 {
 		return 0
 	} else {
@@ -8056,19 +9132,6 @@ func longLatDistance(fromLat, fromLong, toLat, toLong float64) float64 {
 	return earthRadiusMeters * c
 }
 
-// makeRendezvousHasher returns a function that hashes a node ID to a uint64.
-// https://en.wikipedia.org/wiki/Rendezvous_hashing
-func makeRendezvousHasher(seed tailcfg.NodeID) func(tailcfg.NodeID) uint64 {
-	en := binary.BigEndian
-	return func(n tailcfg.NodeID) uint64 {
-		var b [16]byte
-		en.PutUint64(b[:], uint64(seed))
-		en.PutUint64(b[8:], uint64(n))
-		v := sha256.Sum256(b[:])
-		return en.Uint64(v[:])
-	}
-}
-
 const (
 	// unresolvedExitNodeID is a special [tailcfg.StableNodeID] value
 	// used as an exit node ID to install a blackhole route, preventing
@@ -8110,7 +9173,7 @@ func (b *LocalBackend) srcIPHasCapForFilter(srcIP netip.Addr, cap tailcfg.NodeCa
 	if !ok {
 		return false
 	}
-	return n.HasCap(cap)
+	return !n.UnsignedPeerAPIOnly() && n.HasCap(cap)
 }
 
 // maybeUsernameOf returns the actor's username if the actor
@@ -8126,6 +9189,25 @@ func maybeUsernameOf(actor ipnauth.Actor) string {
 var (
 	metricCurrentWatchIPNBus     = clientmetric.NewGauge("localbackend_current_watch_ipn_bus")
 	metricIPForwardingCheckError = clientmetric.NewCounter("localbackend_ip_forwarding_check_error")
+	metricPeerWGStateHandshake   = clientmetric.NewGauge("localbackend_peer_wireguard_state_handshake")
+	metricPeerWGStateEstablished = clientmetric.NewGauge("localbackend_peer_wireguard_state_established")
+	metricPeerWGStateExpired     = clientmetric.NewGauge("localbackend_peer_wireguard_state_expired")
+
+	// Counters for the controlclient's delta-update fast path: each
+	// counts a destination-side call into [LocalBackend] from
+	// [mapSession.tryHandleIncrementally]. Useful as test signals that a
+	// MapResponse landed on the incremental path with the expected
+	// payload shape.
+	metricNetmapDeltaPeerUpserted = clientmetric.NewCounter("localbackend_netmap_delta_peer_upserted")
+	metricNetmapDeltaPeerRemoved  = clientmetric.NewCounter("localbackend_netmap_delta_peer_removed")
+	metricNetmapDeltaPeerPatched  = clientmetric.NewCounter("localbackend_netmap_delta_peer_patched")
+	metricUpdatePacketFilter      = clientmetric.NewCounter("localbackend_update_packet_filter")
+	metricUpdateUserProfiles      = clientmetric.NewCounter("localbackend_update_user_profiles")
+
+	// metricTSMPLearnedKeyMismatch counts netmap updates carrying a peer
+	// disco key that doesn't match the one previously learned via TSMP
+	// for the same peer. See [nodeBackend.discoChangedLocked].
+	metricTSMPLearnedKeyMismatch = clientmetric.NewCounter("magicsock_tsmp_learned_key_mismatch")
 )
 
 func (b *LocalBackend) stateEncrypted() opt.Bool {
diff --git a/ipn/ipnlocal/local_test.go b/ipn/ipnlocal/local_test.go
index d930735cd..d72d59c43 100644
--- a/ipn/ipnlocal/local_test.go
+++ b/ipn/ipnlocal/local_test.go
@@ -32,6 +32,7 @@ import (
 	"tailscale.com/appc"
 	"tailscale.com/appc/appctest"
 	"tailscale.com/control/controlclient"
+	"tailscale.com/control/controlknobs"
 	"tailscale.com/drive"
 	"tailscale.com/drive/driveimpl"
 	"tailscale.com/feature"
@@ -70,7 +71,10 @@ import (
 	"tailscale.com/util/set"
 	"tailscale.com/util/syspolicy"
 	"tailscale.com/util/syspolicy/pkey"
+	"tailscale.com/util/syspolicy/policyclient"
 	"tailscale.com/util/syspolicy/policytest"
+	"tailscale.com/util/syspolicy/rsop"
+	"tailscale.com/util/syspolicy/setting"
 	"tailscale.com/util/syspolicy/source"
 	"tailscale.com/wgengine"
 	"tailscale.com/wgengine/filter"
@@ -185,135 +189,6 @@ func TestShrinkDefaultRoute(t *testing.T) {
 	}
 }
 
-func TestPeerRoutes(t *testing.T) {
-	pp := netip.MustParsePrefix
-	tests := []struct {
-		name  string
-		peers []wgcfg.Peer
-		want  []netip.Prefix
-	}{
-		{
-			name: "small_v4",
-			peers: []wgcfg.Peer{
-				{
-					AllowedIPs: []netip.Prefix{
-						pp("100.101.102.103/32"),
-					},
-				},
-			},
-			want: []netip.Prefix{
-				pp("100.101.102.103/32"),
-			},
-		},
-		{
-			name: "big_v4",
-			peers: []wgcfg.Peer{
-				{
-					AllowedIPs: []netip.Prefix{
-						pp("100.101.102.103/32"),
-						pp("100.101.102.104/32"),
-						pp("100.101.102.105/32"),
-					},
-				},
-			},
-			want: []netip.Prefix{
-				pp("100.64.0.0/10"),
-			},
-		},
-		{
-			name: "has_1_v6",
-			peers: []wgcfg.Peer{
-				{
-					AllowedIPs: []netip.Prefix{
-						pp("fd7a:115c:a1e0:ab12:4843:cd96:6258:b240/128"),
-					},
-				},
-			},
-			want: []netip.Prefix{
-				pp("fd7a:115c:a1e0::/48"),
-			},
-		},
-		{
-			name: "has_2_v6",
-			peers: []wgcfg.Peer{
-				{
-					AllowedIPs: []netip.Prefix{
-						pp("fd7a:115c:a1e0:ab12:4843:cd96:6258:b240/128"),
-						pp("fd7a:115c:a1e0:ab12:4843:cd96:6258:b241/128"),
-					},
-				},
-			},
-			want: []netip.Prefix{
-				pp("fd7a:115c:a1e0::/48"),
-			},
-		},
-		{
-			name: "big_v4_big_v6",
-			peers: []wgcfg.Peer{
-				{
-					AllowedIPs: []netip.Prefix{
-						pp("100.101.102.103/32"),
-						pp("100.101.102.104/32"),
-						pp("100.101.102.105/32"),
-						pp("fd7a:115c:a1e0:ab12:4843:cd96:6258:b240/128"),
-						pp("fd7a:115c:a1e0:ab12:4843:cd96:6258:b241/128"),
-					},
-				},
-			},
-			want: []netip.Prefix{
-				pp("100.64.0.0/10"),
-				pp("fd7a:115c:a1e0::/48"),
-			},
-		},
-		{
-			name: "output-should-be-sorted",
-			peers: []wgcfg.Peer{
-				{
-					AllowedIPs: []netip.Prefix{
-						pp("100.64.0.2/32"),
-						pp("10.0.0.0/16"),
-					},
-				},
-				{
-					AllowedIPs: []netip.Prefix{
-						pp("100.64.0.1/32"),
-						pp("10.0.0.0/8"),
-					},
-				},
-			},
-			want: []netip.Prefix{
-				pp("10.0.0.0/8"),
-				pp("10.0.0.0/16"),
-				pp("100.64.0.1/32"),
-				pp("100.64.0.2/32"),
-			},
-		},
-		{
-			name: "skip-unmasked-prefixes",
-			peers: []wgcfg.Peer{
-				{
-					PublicKey: key.NewNode().Public(),
-					AllowedIPs: []netip.Prefix{
-						pp("100.64.0.2/32"),
-						pp("10.0.0.100/16"),
-					},
-				},
-			},
-			want: []netip.Prefix{
-				pp("100.64.0.2/32"),
-			},
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := peerRoutes(t.Logf, tt.peers, 2, true)
-			if !reflect.DeepEqual(got, tt.want) {
-				t.Errorf("got = %v; want %v", got, tt.want)
-			}
-		})
-	}
-}
-
 func TestPeerAPIBase(t *testing.T) {
 	tests := []struct {
 		name string
@@ -1418,11 +1293,13 @@ func TestConfigureExitNode(t *testing.T) {
 			sys := tsd.NewSystem()
 			sys.PolicyClient.Set(pol)
 			lb := newTestLocalBackendWithSys(t, sys)
-			lb.SetPrefsForTest(tt.prefs.Clone())
+			lb.ForTest().SetPrefs(tt.prefs.Clone())
 
-			// Then set the netcheck report and netmap, if any.
+			// Then set the netcheck report and netmap, if any. Clone the shared
+			// report because AddNetcheckReportForTest mutates it and subtests run
+			// in parallel.
 			if tt.report != nil {
-				lb.MagicConn().SetLastNetcheckReportForTest(t.Context(), tt.report)
+				lb.MagicConn().AddNetcheckReportForTest(clientNetmap.DERPMap, tt.report, time.Now())
 			}
 			if tt.netMap != nil {
 				lb.SetControlClientStatus(lb.cc, controlclient.Status{NetMap: tt.netMap})
@@ -1640,9 +1517,9 @@ func TestPrefsChangeDisablesExitNode(t *testing.T) {
 			if tt.netMap != nil {
 				lb.SetControlClientStatus(lb.cc, controlclient.Status{NetMap: tt.netMap})
 			}
-			// Set the initial prefs via SetPrefsForTest
+			// Set the initial prefs via the test helper.
 			// to apply necessary adjustments.
-			lb.SetPrefsForTest(tt.prefs.Clone())
+			lb.ForTest().SetPrefs(tt.prefs.Clone())
 			initialPrefs := lb.Prefs()
 
 			// Check whether changeDisablesExitNodeLocked correctly identifies the change.
@@ -1680,8 +1557,8 @@ func TestExitNodeNotifyOrder(t *testing.T) {
 	clientNetmap := buildNetmapWithPeers(selfNode, exitNode1, exitNode2)
 
 	lb := newTestLocalBackend(t)
-	lb.sys.MagicSock.Get().SetLastNetcheckReportForTest(lb.ctx, report)
-	lb.SetPrefsForTest(&ipn.Prefs{
+	lb.sys.MagicSock.Get().AddNetcheckReportForTest(clientNetmap.DERPMap, report, time.Now())
+	lb.ForTest().SetPrefs(&ipn.Prefs{
 		ControlURL:   controlURL,
 		AutoExitNode: ipn.AnyExitNode,
 	})
@@ -1692,18 +1569,18 @@ func TestExitNodeNotifyOrder(t *testing.T) {
 	// and an exit node ID notification (since an exit node is selected).
 	// The netmap notification should be sent first.
 	nw.watch(0, []wantedNotification{
-		wantNetmapNotify(clientNetmap),
+		wantSelfChangeNotify(selfNode),
 		wantExitNodeIDNotify(exitNode1.StableID()),
 	})
 	lb.SetControlClientStatus(lb.cc, controlclient.Status{NetMap: clientNetmap})
 	nw.check()
 }
 
-func wantNetmapNotify(want *netmap.NetworkMap) wantedNotification {
+func wantSelfChangeNotify(want tailcfg.NodeView) wantedNotification {
 	return wantedNotification{
-		name: "Netmap",
+		name: "SelfChange",
 		cond: func(t testing.TB, _ ipnauth.Actor, n *ipn.Notify) bool {
-			return n.NetMap == want
+			return n.SelfChange != nil && want.Valid() && n.SelfChange.StableID == want.StableID()
 		},
 	}
 }
@@ -2024,6 +1901,44 @@ func TestStatusPeerCapabilities(t *testing.T) {
 	}
 }
 
+// TestStatusWithoutPeersSelfUserProfile verifies that the self user's
+// UserProfile is reported in Status.User even when peers are omitted, so that
+// callers like `tailscale status --peers=false` can resolve the self node's
+// owner to a login name rather than a bare user ID.
+// Regression test for https://github.com/tailscale/tailscale/issues/19894.
+func TestStatusWithoutPeersSelfUserProfile(t *testing.T) {
+	b := newTestLocalBackend(t)
+	const selfUID = tailcfg.UserID(42)
+	const loginName = "alice@example.com"
+	b.setNetMapLocked(&netmap.NetworkMap{
+		SelfNode: (&tailcfg.Node{
+			MachineAuthorized: true,
+			Addresses:         ipps("100.101.101.101"),
+			User:              selfUID,
+		}).View(),
+		UserProfiles: map[tailcfg.UserID]tailcfg.UserProfileView{
+			selfUID: (&tailcfg.UserProfile{
+				ID:        selfUID,
+				LoginName: loginName,
+			}).View(),
+		},
+	})
+	st := b.StatusWithoutPeers()
+	if st.Self == nil {
+		t.Fatal("Status.Self is nil")
+	}
+	if got, want := st.Self.UserID, selfUID; got != want {
+		t.Errorf("Status.Self.UserID = %v; want %v", got, want)
+	}
+	up, ok := st.User[selfUID]
+	if !ok {
+		t.Fatalf("Status.User missing entry for self UserID %v; got %v", selfUID, st.User)
+	}
+	if got, want := up.LoginName, loginName; got != want {
+		t.Errorf("Status.User[%v].LoginName = %q; want %q", selfUID, got, want)
+	}
+}
+
 // legacyBackend was the interface between Tailscale frontends
 // (e.g. cmd/tailscale, iOS/MacOS/Windows GUIs) and the tailscale
 // backend (e.g. cmd/tailscaled) running on the same machine.
@@ -2077,10 +1992,637 @@ func TestWatchNotificationsCallbacks(t *testing.T) {
 	}
 }
 
+func TestWatchNotificationsClosesSlowConsumer(t *testing.T) {
+	b := newTestLocalBackend(t)
+	ctx := t.Context()
+
+	watchAdded := make(chan struct{})
+	firstNotify := make(chan struct{}, 1)
+	releaseFirstNotify := make(chan struct{})
+	terminalMessage := make(chan string, 1)
+	done := make(chan struct{})
+
+	go func() {
+		defer close(done)
+		b.WatchNotificationsAs(ctx, nil, 0, func() { close(watchAdded) }, func(n *ipn.Notify) bool {
+			if n.ErrMessage != nil {
+				terminalMessage <- *n.ErrMessage
+				return true
+			}
+			select {
+			case firstNotify <- struct{}{}:
+				<-releaseFirstNotify
+			default:
+			}
+			return true
+		})
+	}()
+	<-watchAdded
+
+	state := ipn.Running
+	b.send(ipn.Notify{State: &state})
+	select {
+	case <-firstNotify:
+	case <-time.After(10 * time.Second):
+		t.Fatal("timeout waiting for first notification")
+	}
+
+	// The watcher's callback is blocked on the first notification. Fill the
+	// 128-slot queue, then send one more notification to force overflow.
+	for range 129 {
+		b.send(ipn.Notify{State: &state})
+	}
+
+	close(releaseFirstNotify)
+
+	select {
+	case got := <-terminalMessage:
+		if got != watchIPNBusFellBehindMessage {
+			t.Fatalf("terminal message = %q; want %q", got, watchIPNBusFellBehindMessage)
+		}
+	case <-time.After(10 * time.Second):
+		t.Fatal("timeout waiting for terminal notification")
+	}
+
+	select {
+	case <-done:
+	case <-time.After(10 * time.Second):
+		t.Fatal("timeout waiting for watcher to close")
+	}
+}
+
+func TestWatchNotificationsInProcessNoDisconnectBlocksSender(t *testing.T) {
+	b := newTestLocalBackend(t)
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	watchAdded := make(chan struct{})
+	firstNotify := make(chan struct{}, 1)
+	releaseFirstNotify := make(chan struct{})
+	terminalMessage := make(chan string, 1)
+	done := make(chan struct{})
+
+	go func() {
+		defer close(done)
+		b.WatchNotificationsAs(ctx, nil, ipn.NotifyInProcessNoDisconnect, func() { close(watchAdded) }, func(n *ipn.Notify) bool {
+			if n.ErrMessage != nil {
+				terminalMessage <- *n.ErrMessage
+				return true
+			}
+			select {
+			case firstNotify <- struct{}{}:
+				<-releaseFirstNotify
+			default:
+			}
+			return true
+		})
+	}()
+	<-watchAdded
+
+	state := ipn.Running
+	b.send(ipn.Notify{State: &state})
+	select {
+	case <-firstNotify:
+	case <-time.After(10 * time.Second):
+		t.Fatal("timeout waiting for first notification")
+	}
+
+	// Fill the 128-slot queue. The next send should block until the
+	// subscriber catches up, not disconnect the subscriber.
+	for range 128 {
+		b.send(ipn.Notify{State: &state})
+	}
+
+	sendDone := make(chan struct{})
+	go func() {
+		b.send(ipn.Notify{State: &state})
+		close(sendDone)
+	}()
+	select {
+	case <-sendDone:
+		t.Fatal("send returned before the subscriber caught up")
+	case <-time.After(100 * time.Millisecond):
+	}
+
+	select {
+	case got := <-terminalMessage:
+		close(releaseFirstNotify)
+		t.Fatalf("got terminal message %q; want none", got)
+	default:
+	}
+
+	close(releaseFirstNotify)
+	select {
+	case <-sendDone:
+	case <-time.After(10 * time.Second):
+		t.Fatal("timeout waiting for blocked send to complete")
+	}
+
+	cancel()
+	select {
+	case <-done:
+	case <-time.After(10 * time.Second):
+		t.Fatal("timeout waiting for watcher to close")
+	}
+}
+
+// TestNotifyForSessionPeerVisibility verifies the per-session masking
+// logic in [LocalBackend.notifyForSessionLocked] for the
+// NotifyPeerChanges / NotifyPeerPatches flag pair:
+//
+//   - A watcher with no peer-change bits should not see PeersChanged,
+//     PeersRemoved, or PeerChangedPatch.
+//   - A watcher with NotifyPeerChanges (but not NotifyPeerPatches) should
+//     see PeersChanged and PeersRemoved, AND any incoming
+//     PeerChangedPatch entries should be promoted to full Nodes in
+//     PeersChanged. PeerChangedPatch itself must be cleared.
+//   - A watcher with NotifyPeerPatches should see all three fields.
+func TestNotifyForSessionPeerVisibility(t *testing.T) {
+	b := newTestLocalBackend(t)
+
+	// Install a netmap with two peers so the patch-promotion path can
+	// resolve PeerChangedPatch entries to full Nodes.
+	nm := &netmap.NetworkMap{}
+	for _, id := range []tailcfg.NodeID{10, 20} {
+		nm.Peers = append(nm.Peers, (&tailcfg.Node{
+			ID:        id,
+			Key:       makeNodeKeyFromID(id),
+			Addresses: []netip.Prefix{netip.MustParsePrefix(fmt.Sprintf("100.64.0.%d/32", id))},
+		}).View())
+	}
+	b.currentNode().SetNetMap(nm)
+
+	// Build a Notify carrying every peer-change kind: an added peer
+	// (PeersChanged), a removed peer (PeersRemoved), and a patch for an
+	// existing peer (PeerChangedPatch).
+	addedPeer := &tailcfg.Node{ID: 30, Key: makeNodeKeyFromID(30)}
+	online := true
+	notify := ipn.Notify{
+		PeersChanged:     []*tailcfg.Node{addedPeer},
+		PeersRemoved:     []tailcfg.NodeID{99},
+		PeerChangedPatch: []*tailcfg.PeerChange{{NodeID: 10, Online: &online}},
+	}
+
+	deliver := func(mask ipn.NotifyWatchOpt) *ipn.Notify {
+		sess := &watchSession{mask: mask}
+		b.mu.Lock()
+		defer b.mu.Unlock()
+		return b.notifyForSessionLocked(sess, &notify)
+	}
+
+	t.Run("no_peer_bits", func(t *testing.T) {
+		n := deliver(0)
+		if len(n.PeersChanged) != 0 {
+			t.Errorf("PeersChanged = %v; want empty", n.PeersChanged)
+		}
+		if len(n.PeersRemoved) != 0 {
+			t.Errorf("PeersRemoved = %v; want empty", n.PeersRemoved)
+		}
+		if len(n.PeerChangedPatch) != 0 {
+			t.Errorf("PeerChangedPatch = %v; want empty", n.PeerChangedPatch)
+		}
+	})
+
+	t.Run("peer_changes_only_promotes_patches", func(t *testing.T) {
+		n := deliver(ipn.NotifyPeerChanges)
+		if len(n.PeerChangedPatch) != 0 {
+			t.Errorf("PeerChangedPatch should be stripped; got %v", n.PeerChangedPatch)
+		}
+		if len(n.PeersRemoved) != 1 || n.PeersRemoved[0] != 99 {
+			t.Errorf("PeersRemoved = %v; want [99]", n.PeersRemoved)
+		}
+		// PeersChanged should contain the originally-added peer (30) AND
+		// a promoted full-Node entry for the patched peer (10).
+		ids := make(map[tailcfg.NodeID]bool, len(n.PeersChanged))
+		for _, p := range n.PeersChanged {
+			ids[p.ID] = true
+		}
+		if !ids[30] {
+			t.Errorf("PeersChanged missing added peer 30; got %+v", n.PeersChanged)
+		}
+		if !ids[10] {
+			t.Errorf("PeersChanged missing promoted peer 10; got %+v", n.PeersChanged)
+		}
+	})
+
+	t.Run("peer_patches_keeps_patch_field", func(t *testing.T) {
+		n := deliver(ipn.NotifyPeerPatches)
+		if len(n.PeerChangedPatch) != 1 || n.PeerChangedPatch[0].NodeID != 10 {
+			t.Errorf("PeerChangedPatch = %v; want [{NodeID:10,...}]", n.PeerChangedPatch)
+		}
+		if len(n.PeersChanged) != 1 || n.PeersChanged[0].ID != 30 {
+			t.Errorf("PeersChanged = %v; want [{ID:30}]", n.PeersChanged)
+		}
+		if len(n.PeersRemoved) != 1 || n.PeersRemoved[0] != 99 {
+			t.Errorf("PeersRemoved = %v; want [99]", n.PeersRemoved)
+		}
+	})
+
+	t.Run("both_bits_unchanged", func(t *testing.T) {
+		n := deliver(ipn.NotifyPeerChanges | ipn.NotifyPeerPatches)
+		if len(n.PeerChangedPatch) != 1 {
+			t.Errorf("PeerChangedPatch len = %d; want 1", len(n.PeerChangedPatch))
+		}
+		if len(n.PeersChanged) != 1 {
+			t.Errorf("PeersChanged len = %d; want 1", len(n.PeersChanged))
+		}
+		if len(n.PeersRemoved) != 1 {
+			t.Errorf("PeersRemoved len = %d; want 1", len(n.PeersRemoved))
+		}
+	})
+}
+
+func TestNotifyForSessionPeerWireGuardStateVisibility(t *testing.T) {
+	b := newTestLocalBackend(t)
+	notify := ipn.Notify{
+		PeerState: map[tailcfg.StableNodeID]ipn.PeerState{
+			"stable1": {PeerWireGuardState: ipn.PeerWireGuardStateEstablished},
+		},
+	}
+
+	deliver := func(mask ipn.NotifyWatchOpt) *ipn.Notify {
+		sess := &watchSession{mask: mask}
+		b.mu.Lock()
+		defer b.mu.Unlock()
+		return b.notifyForSessionLocked(sess, &notify)
+	}
+
+	if n := deliver(0); len(n.PeerState) != 0 {
+		t.Fatalf("PeerState without watch bit = %v; want empty", n.PeerState)
+	}
+	if n := deliver(ipn.NotifyPeerWireGuardState); n.PeerState["stable1"].PeerWireGuardState != ipn.PeerWireGuardStateEstablished {
+		t.Fatalf("PeerState with watch bit = %v; want stable1=established", n.PeerState)
+	}
+}
+
+func TestPeerWireGuardStateValuesMatchWGEngine(t *testing.T) {
+	const unknownPeerWireGuardState wgengine.PeerWireGuardState = 255
+
+	tests := []struct {
+		name string
+		in   wgengine.PeerWireGuardState
+		want ipn.PeerWireGuardState
+	}{
+		{"none", wgengine.PeerWireGuardStateNone, ipn.PeerWireGuardStateNone},
+		{"handshake", wgengine.PeerWireGuardStateHandshake, ipn.PeerWireGuardStateHandshake},
+		{"established", wgengine.PeerWireGuardStateEstablished, ipn.PeerWireGuardStateEstablished},
+		{"expired", wgengine.PeerWireGuardStateExpired, ipn.PeerWireGuardStateExpired},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := peerWireGuardStateFromEngine(tt.in); got != tt.want {
+				t.Fatalf("converted state = %v; want %v", got, tt.want)
+			}
+			if got, want := uint8(tt.in), uint8(tt.want); got != want {
+				t.Fatalf("wgengine const = %v; want %v", got, want)
+			}
+		})
+	}
+
+	defer func() {
+		if recover() == nil {
+			t.Fatal("expected panic for unknown wgengine state")
+		}
+	}()
+	_ = peerWireGuardStateFromEngine(unknownPeerWireGuardState)
+}
+
+func TestPeerWireGuardStateWatchInitialThenDeltas(t *testing.T) {
+	b := newTestLocalBackend(t)
+
+	peer1 := &tailcfg.Node{
+		ID:       1,
+		StableID: "stable1",
+		Key:      makeNodeKeyFromID(1),
+	}
+	peer2 := &tailcfg.Node{
+		ID:       2,
+		StableID: "stable2",
+		Key:      makeNodeKeyFromID(2),
+	}
+	b.currentNode().SetNetMap(&netmap.NetworkMap{
+		Peers: []tailcfg.NodeView{peer1.View(), peer2.View()},
+	})
+
+	t1 := time.Unix(1700000000, 0)
+	b.handlePeerWireGuardState(peer1.Key, ipn.PeerWireGuardStateEstablished, t1)
+	b.handlePeerWireGuardState(peer1.Key, ipn.PeerWireGuardStateEstablished, t1.Add(time.Second))
+	defer b.handlePeerWireGuardState(peer1.Key, ipn.PeerWireGuardStateNone, time.Now())
+	defer b.handlePeerWireGuardState(peer2.Key, ipn.PeerWireGuardStateNone, time.Now())
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	gotCh := make(chan *ipn.Notify, 2)
+	doneCh := make(chan struct{})
+	go func() {
+		defer close(doneCh)
+		var got int
+		b.WatchNotificationsAs(ctx, nil, ipn.NotifyPeerWireGuardState, func() {
+			b.onPeerWireGuardState(peer2.Key, wgengine.PeerWireGuardStateHandshake)
+		}, func(n *ipn.Notify) bool {
+			gotCh <- n
+			got++
+			if got == 2 {
+				cancel()
+				return false
+			}
+			return true
+		})
+	}()
+
+	var got []*ipn.Notify
+	for len(got) < 2 {
+		select {
+		case n := <-gotCh:
+			got = append(got, n)
+		case <-time.After(5 * time.Second):
+			t.Fatalf("timed out waiting for notifications; got %v", got)
+		}
+	}
+	<-doneCh
+
+	if got[0].PeerState["stable1"].PeerWireGuardState != ipn.PeerWireGuardStateEstablished {
+		t.Fatalf("initial PeerState = %v; want stable1=established", got[0].PeerState)
+	}
+	if got, want := got[0].PeerState["stable1"].PeerWireGuardStateAt, t1; !got.Equal(want) {
+		t.Fatalf("initial PeerState[stable1].PeerWireGuardStateAt = %v; want %v (no-op transition preserves first-entry time)", got, want)
+	}
+	if _, ok := got[0].PeerState["stable2"]; ok {
+		t.Fatalf("initial PeerState includes post-registration delta: %v", got[0].PeerState)
+	}
+	if len(got[1].PeerState) != 1 || got[1].PeerState["stable2"].PeerWireGuardState != ipn.PeerWireGuardStateHandshake {
+		t.Fatalf("delta PeerState = %v; want stable2=handshake only", got[1].PeerState)
+	}
+	if got[1].PeerState["stable2"].PeerWireGuardStateAt.IsZero() {
+		t.Fatalf("delta PeerState[stable2].PeerWireGuardStateAt is zero; want set by LocalBackend clock")
+	}
+}
+
+func TestPeerWireGuardStateMetrics(t *testing.T) {
+	b := newTestLocalBackend(t)
+	peer := &tailcfg.Node{
+		ID:       1,
+		StableID: "stable1",
+		Key:      makeNodeKeyFromID(1),
+	}
+	b.currentNode().SetNetMap(&netmap.NetworkMap{
+		Peers: []tailcfg.NodeView{peer.View()},
+	})
+	now := time.Now()
+	defer b.handlePeerWireGuardState(peer.Key, ipn.PeerWireGuardStateNone, now)
+
+	baseHandshake := metricPeerWGStateHandshake.Value()
+	baseEstablished := metricPeerWGStateEstablished.Value()
+	baseExpired := metricPeerWGStateExpired.Value()
+
+	b.handlePeerWireGuardState(peer.Key, ipn.PeerWireGuardStateEstablished, now)
+	if got, want := metricPeerWGStateEstablished.Value(), baseEstablished+1; got != want {
+		t.Fatalf("established gauge = %v; want %v", got, want)
+	}
+	b.handlePeerWireGuardState(peer.Key, ipn.PeerWireGuardStateEstablished, now)
+	if got, want := metricPeerWGStateEstablished.Value(), baseEstablished+1; got != want {
+		t.Fatalf("established gauge after no-op = %v; want %v", got, want)
+	}
+
+	b.handlePeerWireGuardState(peer.Key, ipn.PeerWireGuardStateHandshake, now)
+	if got, want := metricPeerWGStateEstablished.Value(), baseEstablished; got != want {
+		t.Fatalf("established gauge after transition = %v; want %v", got, want)
+	}
+	if got, want := metricPeerWGStateHandshake.Value(), baseHandshake+1; got != want {
+		t.Fatalf("handshake gauge = %v; want %v", got, want)
+	}
+
+	b.handlePeerWireGuardState(peer.Key, ipn.PeerWireGuardStateExpired, now)
+	if got, want := metricPeerWGStateHandshake.Value(), baseHandshake; got != want {
+		t.Fatalf("handshake gauge after transition = %v; want %v", got, want)
+	}
+	if got, want := metricPeerWGStateExpired.Value(), baseExpired+1; got != want {
+		t.Fatalf("expired gauge = %v; want %v", got, want)
+	}
+
+	b.handlePeerWireGuardState(peer.Key, ipn.PeerWireGuardStateNone, now)
+	if got, want := metricPeerWGStateExpired.Value(), baseExpired; got != want {
+		t.Fatalf("expired gauge after none = %v; want %v", got, want)
+	}
+}
+
+func TestPeerWireGuardStateCallbackDoesNotBlockOnLocalBackendMu(t *testing.T) {
+	b := newTestLocalBackend(t)
+	peer := &tailcfg.Node{
+		ID:       1,
+		StableID: "stable1",
+		Key:      makeNodeKeyFromID(1),
+	}
+	b.currentNode().SetNetMap(&netmap.NetworkMap{
+		Peers: []tailcfg.NodeView{peer.View()},
+	})
+
+	b.mu.Lock()
+	done := make(chan struct{})
+	go func() {
+		b.onPeerWireGuardState(peer.Key, wgengine.PeerWireGuardStateEstablished)
+		close(done)
+	}()
+	select {
+	case <-done:
+	case <-time.After(5 * time.Second):
+		b.mu.Unlock()
+		t.Fatal("onPeerWireGuardState blocked on LocalBackend.mu")
+	}
+	b.mu.Unlock()
+
+	_ = b.peerWGStateQueue.Wait(context.Background())
+	b.handlePeerWireGuardState(peer.Key, ipn.PeerWireGuardStateNone, time.Now())
+}
+
+func TestSetControlClientStatusSendsFullNetmapAsPeerChanges(t *testing.T) {
+	b := newTestLocalBackend(t)
+	nw := newNotificationWatcher(t, b, ipnauth.Self)
+	nw.watch(ipn.NotifyPeerChanges|ipn.NotifyNoNetMap, []wantedNotification{{
+		name: "full netmap as peer changes",
+		cond: func(t testing.TB, _ ipnauth.Actor, n *ipn.Notify) bool {
+			if n.SelfChange == nil {
+				return false
+			}
+			if n.NetMap != nil {
+				t.Errorf("NetMap was delivered to NotifyNoNetMap watcher")
+			}
+			if got, want := len(n.PeersChanged), 2; got != want {
+				t.Errorf("PeersChanged len = %d; want %d", got, want)
+				return false
+			}
+			if got, want := len(n.UserProfiles), 3; got != want {
+				t.Errorf("UserProfiles len = %d; want %d", got, want)
+				return false
+			}
+			gotPeers := set.Of(n.PeersChanged[0].ID, n.PeersChanged[1].ID)
+			wantPeers := set.Of(tailcfg.NodeID(10), tailcfg.NodeID(20))
+			if !gotPeers.Equal(wantPeers) {
+				t.Errorf("PeersChanged IDs = %v; want %v", gotPeers, wantPeers)
+			}
+			return true
+		},
+	}})
+
+	nm := &netmap.NetworkMap{
+		SelfNode: (&tailcfg.Node{
+			ID:   1,
+			User: 1,
+			Key:  makeNodeKeyFromID(1),
+		}).View(),
+		Peers: []tailcfg.NodeView{
+			(&tailcfg.Node{ID: 10, User: 2, Key: makeNodeKeyFromID(10)}).View(),
+			(&tailcfg.Node{ID: 20, User: 3, Key: makeNodeKeyFromID(20)}).View(),
+		},
+		UserProfiles: map[tailcfg.UserID]tailcfg.UserProfileView{
+			1: (&tailcfg.UserProfile{ID: 1, LoginName: "self@example.com"}).View(),
+			2: (&tailcfg.UserProfile{ID: 2, LoginName: "peer1@example.com"}).View(),
+			3: (&tailcfg.UserProfile{ID: 3, LoginName: "peer2@example.com"}).View(),
+		},
+	}
+	b.SetControlClientStatus(b.cc, controlclient.Status{NetMap: nm, LoggedIn: true})
+	nw.check()
+}
+
+// TestNotifyForSessionUserProfilesGating verifies that
+// [Notify.UserProfiles] is only delivered to sessions opted in to
+// NotifyPeerChanges/NotifyPeerPatches, and is deduped per-UserID
+// against [watchSession.lastSentUserProfile] across successive sends.
+func TestNotifyForSessionUserProfilesGating(t *testing.T) {
+	b := newTestLocalBackend(t)
+
+	deliver := func(sess *watchSession, profiles map[tailcfg.UserID]tailcfg.UserProfileView) *ipn.Notify {
+		b.mu.Lock()
+		defer b.mu.Unlock()
+		return b.notifyForSessionLocked(sess, &ipn.Notify{UserProfiles: profiles})
+	}
+
+	profiles := map[tailcfg.UserID]tailcfg.UserProfileView{
+		7: (&tailcfg.UserProfile{ID: 7, LoginName: "alice@example.com", DisplayName: "Alice"}).View(),
+	}
+
+	t.Run("no_bits_strips", func(t *testing.T) {
+		n := deliver(&watchSession{}, profiles)
+		if len(n.UserProfiles) != 0 {
+			t.Errorf("UserProfiles = %v; want empty", n.UserProfiles)
+		}
+	})
+	t.Run("peer_changes_delivers", func(t *testing.T) {
+		n := deliver(&watchSession{mask: ipn.NotifyPeerChanges}, profiles)
+		if got, want := len(n.UserProfiles), 1; got != want {
+			t.Fatalf("UserProfiles len = %d; want %d", got, want)
+		}
+		if n.UserProfiles[7].LoginName() != "alice@example.com" {
+			t.Errorf("got %+v; want alice", n.UserProfiles)
+		}
+	})
+	t.Run("peer_patches_delivers", func(t *testing.T) {
+		n := deliver(&watchSession{mask: ipn.NotifyPeerPatches}, profiles)
+		if got, want := len(n.UserProfiles), 1; got != want {
+			t.Fatalf("UserProfiles len = %d; want %d", got, want)
+		}
+	})
+
+	// The remaining cases share a single session so the dedup state on
+	// [watchSession.lastSentUserProfile] persists across deliveries.
+	sess := &watchSession{mask: ipn.NotifyPeerChanges}
+
+	t.Run("first_send", func(t *testing.T) {
+		n := deliver(sess, profiles)
+		if got, want := len(n.UserProfiles), 1; got != want {
+			t.Fatalf("UserProfiles len = %d; want %d", got, want)
+		}
+	})
+	t.Run("dedup_repeat_same_map", func(t *testing.T) {
+		// Resending the exact same map should deliver nothing.
+		n := deliver(sess, profiles)
+		if len(n.UserProfiles) != 0 {
+			t.Errorf("got UserProfiles=%v on repeat; want empty (deduped)", n.UserProfiles)
+		}
+	})
+	t.Run("per_user_dedup", func(t *testing.T) {
+		// A Notify with two profiles where only one changed should
+		// deliver only the changed one.
+		mixed := map[tailcfg.UserID]tailcfg.UserProfileView{
+			7: (&tailcfg.UserProfile{ID: 7, LoginName: "alice@example.com", DisplayName: "Alice"}).View(),     // unchanged
+			8: (&tailcfg.UserProfile{ID: 8, LoginName: "bob@example.com", DisplayName: "Bob the New"}).View(), // new
+		}
+		n := deliver(sess, mixed)
+		if got, want := len(n.UserProfiles), 1; got != want {
+			t.Fatalf("UserProfiles len = %d; want %d (only the new user)", got, want)
+		}
+		if _, ok := n.UserProfiles[7]; ok {
+			t.Errorf("UserProfiles still includes user 7 (should have been deduped)")
+		}
+		if got := n.UserProfiles[8].LoginName(); got != "bob@example.com" {
+			t.Errorf("UserProfiles[8].LoginName = %q; want bob", got)
+		}
+	})
+	t.Run("changed_user_delivers", func(t *testing.T) {
+		// Updating an existing UserID re-sends just that one.
+		updated := map[tailcfg.UserID]tailcfg.UserProfileView{
+			7: (&tailcfg.UserProfile{ID: 7, LoginName: "alice@example.com", DisplayName: "Alice 2.0"}).View(),
+		}
+		n := deliver(sess, updated)
+		if n.UserProfiles[7].DisplayName() != "Alice 2.0" {
+			t.Errorf("got %+v; want updated alice", n.UserProfiles)
+		}
+	})
+}
+
+func TestNotifyForSessionUserProfilesDedupResetsOnSelfChange(t *testing.T) {
+	b := newTestLocalBackend(t)
+
+	deliver := func(sess *watchSession, n *ipn.Notify) *ipn.Notify {
+		b.mu.Lock()
+		defer b.mu.Unlock()
+		return b.notifyForSessionLocked(sess, n)
+	}
+
+	sess := &watchSession{mask: ipn.NotifyPeerChanges}
+	self1 := &tailcfg.Node{ID: 1, StableID: "self1", User: 10}
+	self2 := &tailcfg.Node{ID: 2, StableID: "self2", User: 20}
+	profiles1 := map[tailcfg.UserID]tailcfg.UserProfileView{
+		10: (&tailcfg.UserProfile{ID: 10, LoginName: "alice@example.com", DisplayName: "Alice"}).View(),
+		11: (&tailcfg.UserProfile{ID: 11, LoginName: "peer@example.com", DisplayName: "Peer"}).View(),
+	}
+	profiles2 := map[tailcfg.UserID]tailcfg.UserProfileView{
+		20: (&tailcfg.UserProfile{ID: 20, LoginName: "bob@example.com", DisplayName: "Bob"}).View(),
+	}
+
+	n := deliver(sess, &ipn.Notify{SelfChange: self1, UserProfiles: profiles1})
+	if got, want := len(n.UserProfiles), len(profiles1); got != want {
+		t.Fatalf("initial UserProfiles len = %d; want %d", got, want)
+	}
+	n = deliver(sess, &ipn.Notify{SelfChange: self1, UserProfiles: profiles1})
+	if len(n.UserProfiles) != 0 {
+		t.Fatalf("same self duplicate UserProfiles = %v; want empty", n.UserProfiles)
+	}
+	n = deliver(sess, &ipn.Notify{SelfChange: self2, UserProfiles: profiles2})
+	if got, want := len(n.UserProfiles), len(profiles2); got != want {
+		t.Fatalf("new self UserProfiles len = %d; want %d", got, want)
+	}
+	n = deliver(sess, &ipn.Notify{SelfChange: self1, UserProfiles: profiles1})
+	if got, want := len(n.UserProfiles), len(profiles1); got != want {
+		t.Fatalf("returned self UserProfiles len = %d; want %d", got, want)
+	}
+
+	sess = &watchSession{mask: ipn.NotifyPeerChanges}
+	n = deliver(sess, &ipn.Notify{UserProfiles: profiles1})
+	if got, want := len(n.UserProfiles), len(profiles1); got != want {
+		t.Fatalf("pre-self UserProfiles len = %d; want %d", got, want)
+	}
+	n = deliver(sess, &ipn.Notify{SelfChange: self1, UserProfiles: profiles1})
+	if got, want := len(n.UserProfiles), len(profiles1); got != want {
+		t.Fatalf("first self UserProfiles len = %d; want %d", got, want)
+	}
+}
+
 // tests LocalBackend.updateNetmapDeltaLocked
 func TestUpdateNetmapDelta(t *testing.T) {
 	b := newTestLocalBackend(t)
-	if b.currentNode().UpdateNetmapDelta(nil) {
+	if _, handled := b.currentNode().UpdateNetmapDelta(nil); handled {
 		t.Errorf("updateNetmapDeltaLocked() = true, want false with nil netmap")
 	}
 
@@ -2119,7 +2661,7 @@ func TestUpdateNetmapDelta(t *testing.T) {
 		t.Fatal("netmap.MutationsFromMapResponse failed")
 	}
 
-	if !b.currentNode().UpdateNetmapDelta(muts) {
+	if _, handled := b.currentNode().UpdateNetmapDelta(muts); !handled {
 		t.Fatalf("updateNetmapDeltaLocked() = false, want true with new netmap")
 	}
 
@@ -2235,6 +2777,7 @@ func TestWhoIs(t *testing.T) {
 		{"round1MyselfWithPort", "100.101.102.103:123", 1, "Myself", nil},
 		{"round1Peer2NoPort", "100.200.200.200:0", 2, "Peer2", []string{"group:foo"}},
 		{"round1Peer2WithPort", "100.200.200.200:123", 2, "Peer2", []string{"group:foo"}},
+		{"round1Peer2Mapped4in6", "[::ffff:100.200.200.200]:123", 2, "Peer2", []string{"group:foo"}},
 		{"round1UnknownPeer", "100.4.0.4:404", 0, "", nil},
 	}
 	expectWhois(t, testsRound1, b)
@@ -2824,7 +3367,7 @@ func TestCoveredRouteRangeNoDefault(t *testing.T) {
 
 func TestReconfigureAppConnector(t *testing.T) {
 	b := newTestBackend(t)
-	b.reconfigAppConnectorLocked(b.NetMap(), b.pm.prefs)
+	b.reconfigAppConnectorLocked(b.currentNode().Self(), b.pm.prefs)
 	if b.appConnector != nil {
 		t.Fatal("unexpected app connector")
 	}
@@ -2837,7 +3380,7 @@ func TestReconfigureAppConnector(t *testing.T) {
 		},
 		AppConnectorSet: true,
 	})
-	b.reconfigAppConnectorLocked(b.NetMap(), b.pm.prefs)
+	b.reconfigAppConnectorLocked(b.currentNode().Self(), b.pm.prefs)
 	if b.appConnector == nil {
 		t.Fatal("expected app connector")
 	}
@@ -2860,7 +3403,7 @@ func TestReconfigureAppConnector(t *testing.T) {
 
 	b.currentNode().SetNetMap(nm)
 
-	b.reconfigAppConnectorLocked(b.NetMap(), b.pm.prefs)
+	b.reconfigAppConnectorLocked(b.currentNode().Self(), b.pm.prefs)
 	b.appConnector.Wait(context.Background())
 
 	want := []string{"example.com"}
@@ -2880,7 +3423,7 @@ func TestReconfigureAppConnector(t *testing.T) {
 		},
 		AppConnectorSet: true,
 	})
-	b.reconfigAppConnectorLocked(b.NetMap(), b.pm.prefs)
+	b.reconfigAppConnectorLocked(b.currentNode().Self(), b.pm.prefs)
 	if b.appConnector != nil {
 		t.Fatal("expected no app connector")
 	}
@@ -2912,7 +3455,7 @@ func TestBackfillAppConnectorRoutes(t *testing.T) {
 	}); err != nil {
 		t.Fatal(err)
 	}
-	b.reconfigAppConnectorLocked(b.NetMap(), b.pm.prefs)
+	b.reconfigAppConnectorLocked(b.currentNode().Self(), b.pm.prefs)
 
 	// Smoke check that AdvertiseRoutes doesn't have the test IP.
 	ip := netip.MustParseAddr("1.2.3.4")
@@ -2933,7 +3476,7 @@ func TestBackfillAppConnectorRoutes(t *testing.T) {
 
 	// Mimic b.authReconfigure for the app connector bits.
 	b.mu.Lock()
-	b.reconfigAppConnectorLocked(b.NetMap(), b.pm.prefs)
+	b.reconfigAppConnectorLocked(b.currentNode().Self(), b.pm.prefs)
 	b.mu.Unlock()
 	b.readvertiseAppConnectorRoutes()
 
@@ -3300,11 +3843,11 @@ func TestSetExitNodeIDPolicy(t *testing.T) {
 				t.Errorf("wanted prefs changed %v, got prefs changed %v", test.prefsChanged, changed)
 			}
 
-			// Both [LocalBackend.SetPrefsForTest] and [LocalBackend.EditPrefs]
+			// Both [forTest.SetPrefs] and [LocalBackend.EditPrefs]
 			// apply syspolicy settings to the current profile's preferences. Therefore,
 			// we pass the current, unmodified preferences and expect the effective
 			// preferences to change.
-			b.SetPrefsForTest(pm.CurrentPrefs().AsStruct())
+			b.ForTest().SetPrefs(pm.CurrentPrefs().AsStruct())
 
 			if got := b.Prefs().ExitNodeID(); got != tailcfg.StableNodeID(test.exitNodeIDWant) {
 				t.Errorf("ExitNodeID: got %q; want %q", got, test.exitNodeIDWant)
@@ -3423,8 +3966,8 @@ func TestUpdateNetmapDeltaAutoExitNode(t *testing.T) {
 			b := newTestLocalBackendWithSys(t, sys)
 			b.currentNode().SetNetMap(tt.netmap)
 			b.lastSuggestedExitNode = tt.lastSuggestedExitNode
-			b.sys.MagicSock.Get().SetLastNetcheckReportForTest(b.ctx, tt.report)
-			b.SetPrefsForTest(b.pm.CurrentPrefs().AsStruct())
+			b.sys.MagicSock.Get().AddNetcheckReportForTest(derpMap, tt.report, time.Now())
+			b.ForTest().SetPrefs(b.pm.CurrentPrefs().AsStruct())
 
 			allDone := make(chan bool, 1)
 			defer b.goTracker.AddDoneCallback(func() {
@@ -3552,19 +4095,19 @@ func TestAutoExitNodeSetNetInfoCallback(t *testing.T) {
 		DERPMap: defaultDERPMap,
 	})
 	b.lastSuggestedExitNode = peer1.StableID()
-	b.SetPrefsForTest(b.pm.CurrentPrefs().AsStruct())
+	b.ForTest().SetPrefs(b.pm.CurrentPrefs().AsStruct())
 	if eid := b.Prefs().ExitNodeID(); eid != peer1.StableID() {
 		t.Errorf("got initial exit node %v, want %v", eid, peer1.StableID())
 	}
 	b.refreshAutoExitNode = true
-	b.sys.MagicSock.Get().SetLastNetcheckReportForTest(b.ctx, &netcheck.Report{
+	b.sys.MagicSock.Get().AddNetcheckReportForTest(defaultDERPMap, &netcheck.Report{
 		RegionLatency: map[int]time.Duration{
 			1: 10 * time.Millisecond,
 			2: 5 * time.Millisecond,
 			3: 30 * time.Millisecond,
 		},
 		PreferredDERP: 2,
-	})
+	}, time.Now())
 	b.setNetInfo(&ni)
 	if eid := b.Prefs().ExitNodeID(); eid != peer2.StableID() {
 		t.Errorf("got final exit node %v, want %v", eid, peer2.StableID())
@@ -3621,8 +4164,8 @@ func TestSetControlClientStatusAutoExitNode(t *testing.T) {
 	// Peer 2 should be the initial exit node, as it's better than peer 1
 	// in terms of latency and DERP region.
 	b.lastSuggestedExitNode = peer2.StableID()
-	b.sys.MagicSock.Get().SetLastNetcheckReportForTest(b.ctx, report)
-	b.SetPrefsForTest(b.pm.CurrentPrefs().AsStruct())
+	b.sys.MagicSock.Get().AddNetcheckReportForTest(derpMap, report, time.Now())
+	b.ForTest().SetPrefs(b.pm.CurrentPrefs().AsStruct())
 	offlinePeer2 := makePeer(2, withCap(26), withSuggest(), withExitRoutes(), withOnline(false), withNodeKey())
 	updatedNetmap := &netmap.NetworkMap{
 		Peers: []tailcfg.NodeView{
@@ -4720,15 +5263,6 @@ func TestRoundTraffic(t *testing.T) {
 	}
 }
 
-func (b *LocalBackend) SetPrefsForTest(newp *ipn.Prefs) {
-	if newp == nil {
-		panic("SetPrefsForTest got nil prefs")
-	}
-	b.mu.Lock()
-	defer b.mu.Unlock()
-	b.setPrefsLocked(newp)
-}
-
 type peerOptFunc func(*tailcfg.Node)
 
 func makePeer(id tailcfg.NodeID, opts ...peerOptFunc) tailcfg.NodeView {
@@ -4833,6 +5367,12 @@ func withAddresses(addresses ...netip.Prefix) peerOptFunc {
 	}
 }
 
+func withAllowedIPs(prefixes ...netip.Prefix) peerOptFunc {
+	return func(n *tailcfg.Node) {
+		n.AllowedIPs = append(n.AllowedIPs, prefixes...)
+	}
+}
+
 func deterministicRegionForTest(t testing.TB, want views.Slice[int], use int) selectRegionFunc {
 	t.Helper()
 
@@ -5391,7 +5931,14 @@ func TestSuggestExitNode(t *testing.T) {
 			defer nb.shutdown(errShutdown)
 			nb.SetNetMap(tt.netMap)
 
-			got, err := suggestExitNode(tt.lastReport, nb, tt.lastSuggestion, selectRegion, selectNode, allowList)
+			var preferredDERP int
+			var regionLatency map[int]time.Duration
+			if tt.lastReport != nil {
+				preferredDERP = tt.lastReport.PreferredDERP
+				regionLatency = tt.lastReport.RegionLatency
+			}
+
+			got, err := suggestExitNode(preferredDERP, regionLatency, nil, nb, tt.lastSuggestion, selectRegion, selectNode, allowList)
 			if got.Name != tt.wantName {
 				t.Errorf("name=%v, want %v", got.Name, tt.wantName)
 			}
@@ -5411,6 +5958,89 @@ func TestSuggestExitNode(t *testing.T) {
 	}
 }
 
+// TestSuggestExitNodeUsesRecentDERPLatency exercises DERP latency-based exit node
+// suggestion when the most recent netcheck report is incremental.
+func TestSuggestExitNodeUsesRecentDERPLatency(t *testing.T) {
+	t.Parallel()
+
+	derpMap := &tailcfg.DERPMap{
+		Regions: map[int]*tailcfg.DERPRegion{
+			1: {Nodes: []*tailcfg.DERPNode{{Name: "1a", RegionID: 1}}},
+			2: {Nodes: []*tailcfg.DERPNode{{Name: "2a", RegionID: 2}}},
+			3: {Nodes: []*tailcfg.DERPNode{{Name: "3a", RegionID: 3}}},
+			4: {Nodes: []*tailcfg.DERPNode{{Name: "4a", RegionID: 4}}},
+			5: {Nodes: []*tailcfg.DERPNode{{Name: "5a", RegionID: 5}}},
+		},
+	}
+
+	// Two candidate exit nodes, each homed in a far region (4 and 5) that the most
+	// recent (incremental) netcheck won't re-probe.
+	exitRegion4 := makePeer(4, withDERP(4), withExitRoutes(), withSuggest())
+	exitRegion5 := makePeer(5, withDERP(5), withExitRoutes(), withSuggest())
+
+	selfNode := tailcfg.Node{
+		Addresses: []netip.Prefix{netip.MustParsePrefix("100.64.1.1/32")},
+	}
+	netMap := &netmap.NetworkMap{
+		SelfNode: selfNode.View(),
+		DERPMap:  derpMap,
+		Peers:    []tailcfg.NodeView{exitRegion4, exitRegion5},
+	}
+
+	// A full netcheck measured every region: region 4 (100ms) is closer than
+	// region 5 (200ms).
+	fullReport := &netcheck.Report{
+		PreferredDERP: 1,
+		RegionLatency: map[int]time.Duration{
+			1: 10 * time.Millisecond,
+			2: 20 * time.Millisecond,
+			3: 30 * time.Millisecond,
+			4: 100 * time.Millisecond,
+			5: 200 * time.Millisecond,
+		},
+	}
+	// A later incremental netcheck only re-probed the home and fastest regions, so
+	// it has no latency for regions 4 or 5.
+	incrementalReport := &netcheck.Report{
+		RegionLatency: map[int]time.Duration{
+			1: 10 * time.Millisecond,
+			2: 20 * time.Millisecond,
+			3: 30 * time.Millisecond,
+		},
+	}
+
+	b := newTestLocalBackend(t)
+	b.currentNode().SetNetMap(netMap)
+	mc := b.sys.MagicSock.Get()
+
+	// Without any netcheck reports, SuggestExitNode returns an error because no
+	// preferred DERP can be determined.
+	if _, err := b.SuggestExitNode(); !errors.Is(err, ErrNoPreferredDERP) {
+		t.Fatalf("SuggestExitNode() error = %v, want ErrNoPreferredDERP", err)
+	}
+
+	// Seed the full report, then the incremental one a minute later, so both
+	// remain in netcheck's recent history.
+	now := time.Now()
+	mc.AddNetcheckReportForTest(derpMap, fullReport, now.Add(-time.Minute))
+	mc.AddNetcheckReportForTest(derpMap, incrementalReport, now)
+
+	// suggestExitNodeLocked falls back to a random region when it cannot order the
+	// candidates by latency, so query repeatedly to make sure it always returns the closer region-4 node.
+	const iterations = 64
+	got := make(map[tailcfg.StableNodeID]int)
+	for range iterations {
+		res, err := b.SuggestExitNode()
+		if err != nil {
+			t.Fatalf("SuggestExitNode() error = %v", err)
+		}
+		got[res.ID]++
+	}
+	if len(got) != 1 || got[exitRegion4.StableID()] != iterations {
+		t.Errorf("expected all %v suggestions to be for %v, got %+v", iterations, exitRegion4.StableID(), got)
+	}
+}
+
 func TestSuggestExitNodePickWeighted(t *testing.T) {
 	location10 := tailcfg.Location{
 		Priority: 10,
@@ -5639,8 +6269,8 @@ func TestSuggestExitNodeTrafficSteering(t *testing.T) {
 				},
 			},
 			// Change this, if the hashing function changes.
-			wantID:   "stable3",
-			wantName: "peer3",
+			wantID:   "stable1",
+			wantName: "peer1",
 		},
 		{
 			name: "exit-nodes-without-priority-for-suggestions",
@@ -5780,8 +6410,9 @@ func TestSuggestExitNodeTrafficSteering(t *testing.T) {
 						withLocationPriority(2)), // top
 				},
 			},
-			wantID:   "stable5",
-			wantName: "peer5",
+			// Change this, if the hashing function changes.
+			wantID:   "stable2",
+			wantName: "peer2",
 			wantPri:  2,
 		},
 		{
@@ -5865,7 +6496,7 @@ func TestSuggestExitNodeTrafficSteering(t *testing.T) {
 			defer nb.shutdown(errShutdown)
 			nb.SetNetMap(tt.netMap)
 
-			got, err := suggestExitNodeUsingTrafficSteering(nb, allowList)
+			got, err := suggestExitNodeUsingTrafficSteering(nil, nb, allowList)
 			if tt.wantErr == nil && err != nil {
 				t.Fatalf("err=%v, want nil", err)
 			}
@@ -5897,46 +6528,41 @@ func TestSuggestExitNodeTrafficSteering(t *testing.T) {
 
 func TestMinLatencyDERPregion(t *testing.T) {
 	tests := []struct {
-		name       string
-		regions    []int
-		report     *netcheck.Report
-		wantRegion int
+		name          string
+		regions       []int
+		regionLatency map[int]time.Duration
+		wantRegion    int
 	}{
 		{
 			name:       "regions-no-latency",
 			regions:    []int{1, 2, 3},
 			wantRegion: 0,
-			report:     &netcheck.Report{},
 		},
 		{
 			name:       "regions-different-latency",
 			regions:    []int{1, 2, 3},
 			wantRegion: 2,
-			report: &netcheck.Report{
-				RegionLatency: map[int]time.Duration{
-					1: 10 * time.Millisecond,
-					2: 5 * time.Millisecond,
-					3: 30 * time.Millisecond,
-				},
+			regionLatency: map[int]time.Duration{
+				1: 10 * time.Millisecond,
+				2: 5 * time.Millisecond,
+				3: 30 * time.Millisecond,
 			},
 		},
 		{
 			name:       "regions-same-latency",
 			regions:    []int{1, 2, 3},
 			wantRegion: 1,
-			report: &netcheck.Report{
-				RegionLatency: map[int]time.Duration{
-					1: 10 * time.Millisecond,
-					2: 10 * time.Millisecond,
-					3: 10 * time.Millisecond,
-				},
+			regionLatency: map[int]time.Duration{
+				1: 10 * time.Millisecond,
+				2: 10 * time.Millisecond,
+				3: 10 * time.Millisecond,
 			},
 		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			got := minLatencyDERPRegion(tt.regions, tt.report)
+			got := minLatencyDERPRegion(tt.regions, tt.regionLatency)
 			if got != tt.wantRegion {
 				t.Errorf("got region %v want region %v", got, tt.wantRegion)
 			}
@@ -6324,7 +6950,7 @@ func newLocalBackendWithSysAndTestControl(t testing.TB, enableLogging bool, sys
 	}
 	t.Cleanup(b.Shutdown)
 
-	b.SetControlClientGetterForTesting(func(opts controlclient.Options) (controlclient.Client, error) {
+	b.ForTest().SetControlClientGetter(func(opts controlclient.Options) (controlclient.Client, error) {
 		return newControl(t, opts), nil
 	})
 	return b
@@ -6735,6 +7361,78 @@ func TestConfigFileReload(t *testing.T) {
 				}
 			},
 		},
+		{
+			name: "enable_relay_server",
+			initial: &conffile.Config{
+				Parsed: ipn.ConfigVAlpha{
+					Version: "alpha0",
+				},
+			},
+			updated: &conffile.Config{
+				Parsed: ipn.ConfigVAlpha{
+					Version:                    "alpha0",
+					RelayServerPort:            new(uint16(12345)),
+					RelayServerStaticEndpoints: []netip.AddrPort{netip.MustParseAddrPort("[2001:db8::1]:40000")},
+				},
+			},
+			checkFn: func(t *testing.T, b *LocalBackend) {
+				pv := b.Prefs()
+				if port, ok := pv.RelayServerPort().GetOk(); !ok || port != 12345 {
+					t.Errorf("RelayServerPort = (%d, %v); want (12345, true)", port, ok)
+				}
+				if got := pv.RelayServerStaticEndpoints().AsSlice(); !slices.Equal(got, []netip.AddrPort{netip.MustParseAddrPort("[2001:db8::1]:40000")}) {
+					t.Errorf("RelayServerStaticEndpoints = %v; want [[2001:db8::1]:40000]", got)
+				}
+			},
+		},
+		{
+			// Disabling: a config that omits the relay server fields
+			// must clear any previously configured values, because
+			// ToPrefs sets the masks unconditionally.
+			name: "disable_relay_server",
+			initial: &conffile.Config{
+				Parsed: ipn.ConfigVAlpha{
+					Version:                    "alpha0",
+					RelayServerPort:            new(uint16(12345)),
+					RelayServerStaticEndpoints: []netip.AddrPort{netip.MustParseAddrPort("[2001:db8::1]:40000")},
+				},
+			},
+			updated: &conffile.Config{
+				Parsed: ipn.ConfigVAlpha{
+					Version: "alpha0",
+				},
+			},
+			checkFn: func(t *testing.T, b *LocalBackend) {
+				pv := b.Prefs()
+				if _, ok := pv.RelayServerPort().GetOk(); ok {
+					t.Errorf("RelayServerPort = %v; want disabled", pv.RelayServerPort())
+				}
+				if got := pv.RelayServerStaticEndpoints().AsSlice(); len(got) != 0 {
+					t.Errorf("RelayServerStaticEndpoints = %v; want empty", got)
+				}
+			},
+		},
+		{
+			name: "change_relay_server_port",
+			initial: &conffile.Config{
+				Parsed: ipn.ConfigVAlpha{
+					Version:         "alpha0",
+					RelayServerPort: new(uint16(12345)),
+				},
+			},
+			updated: &conffile.Config{
+				Parsed: ipn.ConfigVAlpha{
+					Version:         "alpha0",
+					RelayServerPort: new(uint16(54321)),
+				},
+			},
+			checkFn: func(t *testing.T, b *LocalBackend) {
+				pv := b.Prefs()
+				if port, ok := pv.RelayServerPort().GetOk(); !ok || port != 54321 {
+					t.Errorf("RelayServerPort = (%d, %v); want (54321, true)", port, ok)
+				}
+			},
+		},
 	}
 
 	for _, tc := range tests {
@@ -7046,7 +7744,7 @@ func TestUpdatePrefsOnSysPolicyChange(t *testing.T) {
 				return newClient(tb, opts)
 			})
 			if tt.initialPrefs != nil {
-				lb.SetPrefsForTest(tt.initialPrefs)
+				lb.ForTest().SetPrefs(tt.initialPrefs)
 			}
 			if err := lb.Start(ipn.Options{}); err != nil {
 				t.Fatalf("(*LocalBackend).Start(): %v", err)
@@ -7327,7 +8025,7 @@ func TestSrcCapPacketFilter(t *testing.T) {
 		}},
 	}})
 
-	f := lb.GetFilterForTest()
+	f := lb.ForTest().GetFilter()
 	res := f.Check(netip.MustParseAddr("2.2.2.2"), netip.MustParseAddr("1.1.1.1"), 22, ipproto.TCP)
 	if res != filter.Accept {
 		t.Errorf("Check(2.2.2.2, ...) = %s, want %s", res, filter.Accept)
@@ -7339,6 +8037,165 @@ func TestSrcCapPacketFilter(t *testing.T) {
 	}
 }
 
+func TestSrcCapPacketFilterUnsignedPeer(t *testing.T) {
+	lb := newLocalBackendWithTestControl(t, false, func(tb testing.TB, opts controlclient.Options) controlclient.Client {
+		return newClient(tb, opts)
+	})
+	if err := lb.Start(ipn.Options{}); err != nil {
+		t.Fatalf("(*LocalBackend).Start(): %v", err)
+	}
+
+	var signedKey, unsignedKey key.NodePublic
+	must.Do(signedKey.UnmarshalText([]byte("nodekey:5c8f86d5fc70d924e55f02446165a5dae8f822994ad26bcf4b08fd841f9bf261")))
+	must.Do(unsignedKey.UnmarshalText([]byte("nodekey:6c8f86d5fc70d924e55f02446165a5dae8f822994ad26bcf4b08fd841f9bf262")))
+
+	controlClient := lb.cc.(*mockControl)
+	controlClient.send(sendOpt{nm: &netmap.NetworkMap{
+		SelfNode: (&tailcfg.Node{
+			Addresses: []netip.Prefix{netip.MustParsePrefix("1.1.1.1/32")},
+		}).View(),
+		Peers: []tailcfg.NodeView{
+			// A normal (signed) peer holding cap-X: it should be accepted.
+			(&tailcfg.Node{
+				Addresses: []netip.Prefix{netip.MustParsePrefix("2.2.2.2/32")},
+				ID:        2,
+				Key:       signedKey,
+				CapMap:    tailcfg.NodeCapMap{"cap-X": nil},
+			}).View(),
+			// An unsigned peer that control has also granted cap-X: it must be
+			// dropped despite holding the capability, because tailnet lock does
+			// not trust it.
+			(&tailcfg.Node{
+				Addresses:           []netip.Prefix{netip.MustParsePrefix("3.3.3.3/32")},
+				ID:                  3,
+				Key:                 unsignedKey,
+				UnsignedPeerAPIOnly: true,
+				CapMap:              tailcfg.NodeCapMap{"cap-X": nil},
+			}).View(),
+		},
+		PacketFilter: []filtertype.Match{{
+			IPProto: views.SliceOf([]ipproto.Proto{ipproto.TCP}),
+			SrcCaps: []tailcfg.NodeCapability{"cap-X"},
+			Dsts: []filtertype.NetPortRange{{
+				Net: netip.MustParsePrefix("1.1.1.1/32"),
+				Ports: filtertype.PortRange{
+					First: 22,
+					Last:  22,
+				},
+			}},
+		}},
+	}})
+
+	f := lb.ForTest().GetFilter()
+
+	// The signed peer with the capability is accepted
+	if res := f.Check(netip.MustParseAddr("2.2.2.2"), netip.MustParseAddr("1.1.1.1"), 22, ipproto.TCP); res != filter.Accept {
+		t.Errorf("Check(signed 2.2.2.2, ...) = %s, want %s", res, filter.Accept)
+	}
+
+	// The unsigned peer with the same capability is dropped
+	if res := f.Check(netip.MustParseAddr("3.3.3.3"), netip.MustParseAddr("1.1.1.1"), 22, ipproto.TCP); !res.IsDrop() {
+		t.Errorf("Check(unsigned 3.3.3.3, ...) = %s, want drop", res)
+	}
+
+	// Directly exercise the runtime capability test used by the filter
+	if lb.srcIPHasCapForFilter(netip.MustParseAddr("3.3.3.3"), "cap-X") {
+		t.Error("srcIPHasCapForFilter returned true for UnsignedPeerAPIOnly peer")
+	}
+	if !lb.srcIPHasCapForFilter(netip.MustParseAddr("2.2.2.2"), "cap-X") {
+		t.Error("srcIPHasCapForFilter returned false for signed peer with cap")
+	}
+}
+
+// TestCapsGrantPacketFilterUnsignedPeer verifies that a CapGrant-style packet filter match
+// (Srcs + Caps, no Dsts) whose broad Srcs covers an unsigned peer's AllowedIPs does NOT cause
+// the packet filter to be discarded: a grant alone permits no traffic, so legitimate rules for
+// signed peers must keep working.
+func TestCapsGrantPacketFilterUnsignedPeer(t *testing.T) {
+	lb := newLocalBackendWithTestControl(t, false, func(tb testing.TB, opts controlclient.Options) controlclient.Client {
+		return newClient(tb, opts)
+	})
+	if err := lb.Start(ipn.Options{}); err != nil {
+		t.Fatalf("(*LocalBackend).Start(): %v", err)
+	}
+
+	var signedKey, unsignedKey key.NodePublic
+	must.Do(signedKey.UnmarshalText([]byte("nodekey:5c8f86d5fc70d924e55f02446165a5dae8f822994ad26bcf4b08fd841f9bf261")))
+	must.Do(unsignedKey.UnmarshalText([]byte("nodekey:6c8f86d5fc70d924e55f02446165a5dae8f822994ad26bcf4b08fd841f9bf262")))
+
+	controlClient := lb.cc.(*mockControl)
+	// Send a netmap with:
+	//  - a broad CapGrant-style match (Srcs 0.0.0.0/0) covering both peers
+	//  - a legitimate traffic rule for the signed peer
+	controlClient.send(sendOpt{nm: &netmap.NetworkMap{
+		SelfNode: (&tailcfg.Node{
+			Addresses: []netip.Prefix{netip.MustParsePrefix("1.1.1.1/32")},
+		}).View(),
+		Peers: []tailcfg.NodeView{
+			(&tailcfg.Node{
+				Addresses:  []netip.Prefix{netip.MustParsePrefix("2.2.2.2/32")},
+				AllowedIPs: []netip.Prefix{netip.MustParsePrefix("2.2.2.2/32")},
+				ID:         2,
+				Key:        signedKey,
+			}).View(),
+			(&tailcfg.Node{
+				Addresses:           []netip.Prefix{netip.MustParsePrefix("3.3.3.3/32")},
+				AllowedIPs:          []netip.Prefix{netip.MustParsePrefix("3.3.3.3/32")},
+				ID:                  3,
+				Key:                 unsignedKey,
+				UnsignedPeerAPIOnly: true,
+			}).View(),
+		},
+		PacketFilter: []filtertype.Match{
+			{
+				// Broad grant covering both peers: must NOT trigger vetting
+				Srcs: []netip.Prefix{netip.MustParsePrefix("0.0.0.0/0")},
+				Caps: []filtertype.CapMatch{{
+					Dst: netip.MustParsePrefix("1.1.1.1/32"),
+					Cap: "cap-X",
+				}},
+			},
+			{
+				// Legitimate traffic rule for the signed peer
+				IPProto: views.SliceOf([]ipproto.Proto{ipproto.TCP}),
+				Srcs:    []netip.Prefix{netip.MustParsePrefix("2.2.2.2/32")},
+				Dsts: []filtertype.NetPortRange{{
+					Net:   netip.MustParsePrefix("1.1.1.1/32"),
+					Ports: filtertype.PortRange{First: 22, Last: 22},
+				}},
+			},
+		},
+	}})
+
+	f := lb.ForTest().GetFilter()
+
+	// The filter must be installed, not discarded: the signed peer's legitimate traffic rule accepts traffic
+	if res := f.Check(netip.MustParseAddr("2.2.2.2"), netip.MustParseAddr("1.1.1.1"), 22, ipproto.TCP); res != filter.Accept {
+		t.Errorf("Check(signed 2.2.2.2, ...) = %s, want %s (filter must not be discarded for a caps-only grant)", res, filter.Accept)
+	}
+
+	// The unsigned peer has no traffic rule, so its packets are dropped
+	if res := f.Check(netip.MustParseAddr("3.3.3.3"), netip.MustParseAddr("1.1.1.1"), 22, ipproto.TCP); !res.IsDrop() {
+		t.Errorf("Check(unsigned 3.3.3.3, ...) = %s, want drop", res)
+	}
+
+	// The unsigned peer is denied the granted capability at resolution time
+	if caps := lb.PeerCapsForIP(netip.MustParseAddr("3.3.3.3"), netip.MustParseAddr("1.1.1.1")); len(caps) != 0 {
+		t.Errorf("PeerCapsForIP(unsigned src) = %v, want empty", caps)
+	}
+	if caps := lb.PeerCaps(netip.MustParseAddr("3.3.3.3")); len(caps) != 0 {
+		t.Errorf("PeerCaps(unsigned src) = %v, want empty", caps)
+	}
+
+	// The signed peer keeps its grant: legitimate functionality is unaffected
+	if caps := lb.PeerCapsForIP(netip.MustParseAddr("2.2.2.2"), netip.MustParseAddr("1.1.1.1")); !caps.HasCapability("cap-X") {
+		t.Errorf("PeerCapsForIP(signed src) missing cap-X: %v", caps)
+	}
+	if caps := lb.PeerCaps(netip.MustParseAddr("2.2.2.2")); !caps.HasCapability("cap-X") {
+		t.Errorf("PeerCaps(signed src) missing cap-X: %v", caps)
+	}
+}
+
 func TestDisplayMessages(t *testing.T) {
 	b := newTestLocalBackend(t)
 
@@ -7479,7 +8336,7 @@ func TestDisplayMessageIPNBus(t *testing.T) {
 					if ok {
 						if diff := cmp.Diff(tt.wantWarning, got, cmpopts.IgnoreFields(health.UnhealthyState{}, "ETag")); diff != "" {
 							t.Errorf("unexpected warning details (-want/+got):\n%s", diff)
-							return true // we failed the test so tell the watcher we've seen what we need to to stop it waiting
+							return true // we failed the test so tell the watcher we've seen what we need to stop it waiting
 						}
 					} else {
 						got := slices.Collect(maps.Keys(n.Health.Warnings))
@@ -7489,7 +8346,7 @@ func TestDisplayMessageIPNBus(t *testing.T) {
 				},
 			}})
 
-			lb.SetPrefsForTest(&ipn.Prefs{
+			lb.ForTest().SetPrefs(&ipn.Prefs{
 				ControlURL:  "https://localhost:1/",
 				WantRunning: true,
 				LoggedOut:   false,
@@ -7559,7 +8416,7 @@ func TestOnClientVersionRespectsAutoUpdateCheck(t *testing.T) {
 	}
 
 	// With Check disabled, onClientVersion should cache but not broadcast.
-	lb.SetPrefsForTest(&ipn.Prefs{
+	lb.ForTest().SetPrefs(&ipn.Prefs{
 		AutoUpdate: ipn.AutoUpdatePrefs{Check: false},
 	})
 
@@ -7577,7 +8434,7 @@ func TestOnClientVersionRespectsAutoUpdateCheck(t *testing.T) {
 	}
 
 	// With Check enabled, onClientVersion should broadcast.
-	lb.SetPrefsForTest(&ipn.Prefs{
+	lb.ForTest().SetPrefs(&ipn.Prefs{
 		AutoUpdate: ipn.AutoUpdatePrefs{Check: true},
 	})
 
@@ -7597,7 +8454,7 @@ func TestWatchNotificationsInitialClientVersion(t *testing.T) {
 	}
 
 	// Set Check=true and cache a ClientVersion.
-	lb.SetPrefsForTest(&ipn.Prefs{
+	lb.ForTest().SetPrefs(&ipn.Prefs{
 		AutoUpdate: ipn.AutoUpdatePrefs{Check: true},
 	})
 	lb.mu.Lock()
@@ -7617,7 +8474,7 @@ func TestWatchNotificationsInitialClientVersion(t *testing.T) {
 	nw2.check()
 
 	// Watch with the flag but Check=false, should not include it.
-	lb.SetPrefsForTest(&ipn.Prefs{
+	lb.ForTest().SetPrefs(&ipn.Prefs{
 		AutoUpdate: ipn.AutoUpdatePrefs{Check: false},
 	})
 	nw3 := newNotificationWatcher(t, lb, ipnauth.Self)
@@ -7662,6 +8519,153 @@ func toStrings[T ~string](in []T) []string {
 	return out
 }
 
+func TestWatchNotificationsInitialPolicy(t *testing.T) {
+	setting.SetDefinitionsForTest(t,
+		setting.NewDefinition(pkey.AdminConsoleVisibility, setting.UserSetting, setting.VisibilityValue),
+	)
+	store := source.NewTestStore(t)
+	rsop.RegisterStoreForTest(t, "TestStore", setting.DeviceScope, store)
+
+	sys := tsd.NewSystem()
+	sys.PolicyClient.Set(testPolicyClient{})
+	lb := newTestLocalBackendWithSys(t, sys)
+
+	nw := newNotificationWatcher(t, lb, &ipnauth.TestActor{})
+	nw.watch(ipn.NotifySysPolicyChanges, []wantedNotification{
+		wantPolicyNotify(),
+	})
+	nw.check()
+
+	nw2 := newNotificationWatcher(t, lb, &ipnauth.TestActor{})
+	nw2.watch(0, nil, unexpectedPolicy)
+	nw2.check()
+}
+
+func TestPolicyChangeNotifiesWatcher(t *testing.T) {
+	setting.SetDefinitionsForTest(t,
+		setting.NewDefinition(pkey.AdminConsoleVisibility, setting.UserSetting, setting.VisibilityValue),
+	)
+	store := source.NewTestStore(t)
+	rsop.RegisterStoreForTest(t, "TestStore", setting.DeviceScope, store)
+
+	sys := tsd.NewSystem()
+	sys.PolicyClient.Set(testPolicyClient{})
+	lb := newTestLocalBackendWithSys(t, sys)
+	if err := lb.Start(ipn.Options{}); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+
+	nw := newNotificationWatcher(t, lb, &ipnauth.TestActor{})
+	nw.watch(ipn.NotifySysPolicyChanges, []wantedNotification{
+		wantPolicyNotify(),
+		wantPolicyWithSetting(pkey.AdminConsoleVisibility, "hide"),
+	})
+
+	store.SetStrings(source.TestSettingOf(pkey.AdminConsoleVisibility, "hide"))
+
+	nw.check()
+}
+
+func TestPolicyNotifyPerUser(t *testing.T) {
+	store := source.NewTestStore(t)
+	rsop.RegisterStoreForTest(t, "TestStore", setting.DeviceScope, store)
+
+	sys := tsd.NewSystem()
+	sys.PolicyClient.Set(testPolicyClient{})
+	lb := newTestLocalBackendWithSys(t, sys)
+
+	actorA := &ipnauth.TestActor{UID: "S-1-5-21-1001"}
+	actorB := &ipnauth.TestActor{UID: "S-1-5-21-1002"}
+
+	nwA := newNotificationWatcher(t, lb, actorA)
+	nwA.watch(ipn.NotifySysPolicyChanges, []wantedNotification{
+		wantPolicyNotify(),
+	})
+	nwA.check()
+
+	nwB := newNotificationWatcher(t, lb, actorB)
+	nwB.watch(ipn.NotifySysPolicyChanges, []wantedNotification{
+		wantPolicyNotify(),
+	})
+	nwB.check()
+
+	nwNoPolicy := newNotificationWatcher(t, lb, actorA)
+	nwNoPolicy.watch(0, nil, unexpectedPolicy)
+
+	store.SetStrings(source.TestSettingOf(pkey.AdminConsoleVisibility, "hide"))
+
+	nwNoPolicy.check()
+}
+
+func wantPolicyNotify() wantedNotification {
+	return wantedNotification{
+		name: "Policy",
+		cond: func(_ testing.TB, _ ipnauth.Actor, n *ipn.Notify) bool {
+			return n.Policy != nil
+		},
+	}
+}
+
+func wantPolicyWithSetting(key pkey.Key, value string) wantedNotification {
+	return wantedNotification{
+		name: fmt.Sprintf("Policy-%s=%s", key, value),
+		cond: func(t testing.TB, _ ipnauth.Actor, n *ipn.Notify) bool {
+			if n.Policy == nil {
+				return false
+			}
+			if n.Policy == nil {
+				return false
+			}
+			got := n.Policy.Get(key)
+			if got == nil {
+				return false
+			}
+			if fmt.Sprint(got) != value {
+				t.Errorf("Policy[%s] = %v (%T); want %q", key, got, got, value)
+			}
+			return true
+		},
+	}
+}
+
+func unexpectedPolicy(t testing.TB, _ ipnauth.Actor, n *ipn.Notify) bool {
+	if n.Policy != nil {
+		t.Errorf("unexpected Policy notification")
+		return true
+	}
+	return false
+}
+
+type testPolicyClient struct {
+	policyclient.NoPolicyClient
+}
+
+func (testPolicyClient) GetPolicySnapshot(uid string) (*policyclient.PolicySnapshot, error) {
+	scope := setting.DefaultScope()
+	if uid != "" {
+		scope = setting.UserScopeOf(uid)
+	}
+	p, err := rsop.PolicyFor(scope)
+	if err != nil {
+		return nil, err
+	}
+	return p.Get(), nil
+}
+
+func (testPolicyClient) RegisterChangeCallback(uid string, cb func(policyclient.PolicyChange)) (func(), error) {
+	scope := setting.DefaultScope()
+	if uid != "" {
+		scope = setting.UserScopeOf(uid)
+	}
+	p, err := rsop.PolicyFor(scope)
+	if err != nil {
+		return func() {}, err
+	}
+	return p.RegisterChangeCallback(func(change policyclient.PolicyChange) {
+		cb(change)
+	}), nil
+}
+
 type textUpdate struct {
 	Advertise   []string
 	Unadvertise []string
@@ -7709,7 +8713,7 @@ func (f *fakeAttestationKey) Clone() key.HardwareAttestationKey {
 // TestStripKeysFromPrefs tests that LocalBackend's [stripKeysFromPrefs] (as used
 // by sendNotify etc) correctly removes all private keys from an ipn.Notify.
 //
-// It does so by testing the the two ways that Notifys are sent: via sendNotify,
+// It does so by testing the two ways that Notifys are sent: via sendNotify,
 // and via extension hooks.
 func TestStripKeysFromPrefs(t *testing.T) {
 	// genNotify generates a sample ipn.Notify with various private keys set
@@ -7805,72 +8809,65 @@ func TestStripKeysFromPrefs(t *testing.T) {
 func TestRouteAllDisabled(t *testing.T) {
 	pp := netip.MustParsePrefix
 
+	peer := &tailcfg.Node{
+		ID:       1,
+		Key:      key.NewNode().Public(),
+		HomeDERP: 1,
+		Addresses: []netip.Prefix{
+			pp("100.80.207.38/32"),
+		},
+		AllowedIPs: []netip.Prefix{
+			pp("100.80.207.38/32"),
+
+			// If one IP in the Tailscale ULA range is added, the
+			// entire range is added to the router config.
+			pp("fd7a:115c:a1e0::2501:9b83/128"),
+
+			// Other single CGNAT IPs (such as VIP service addresses)
+			// are added individually regardless of RouteAll.
+			pp("100.80.207.56/32"),
+			pp("100.80.207.40/32"),
+			pp("100.94.122.93/32"),
+			pp("100.79.141.115/32"),
+
+			// A /28 is a subnet route, added only with RouteAll.
+			pp("100.64.0.0/28"),
+
+			// Single IPs outside the Tailscale CGNAT/ULA ranges are
+			// subnet routes too.
+			pp("192.168.0.45/32"),
+			pp("fd7a:115c:b1e0::2501:9b83/128"),
+			pp("fdf8:f966:e27c:0:5:0:0:10/128"),
+		},
+	}
+
 	tests := []struct {
-		name          string
-		peers         []wgcfg.Peer
-		wantEndpoints []netip.Prefix
-		routeAll      bool
+		name     string
+		routeAll bool
+		want     []netip.Prefix
 	}{
 		{
 			name:     "route_all_disabled",
 			routeAll: false,
-			peers: []wgcfg.Peer{
-				{
-					AllowedIPs: []netip.Prefix{
-						// if one ip in the Tailscale ULA range is added, the entire range is added to the router config
-						pp("fd7a:115c:a1e0::2501:9b83/128"),
-						pp("100.80.207.38/32"),
-						pp("100.80.207.56/32"),
-						pp("100.80.207.40/32"),
-						pp("100.94.122.93/32"),
-						pp("100.79.141.115/32"),
-
-						// a /28 range will not be added, since this is not a Service IP range (which is always /32, a single IP)
-						pp("100.64.0.0/28"),
-
-						// ips outside the tailscale cgnat/ula range are not added to the router config
-						pp("192.168.0.45/32"),
-						pp("fd7a:115c:b1e0::2501:9b83/128"),
-						pp("fdf8:f966:e27c:0:5:0:0:10/128"),
-					},
-				},
-			},
-			wantEndpoints: []netip.Prefix{
-				pp("100.80.207.38/32"),
-				pp("100.80.207.56/32"),
-				pp("100.80.207.40/32"),
-				pp("100.94.122.93/32"),
+			want: []netip.Prefix{
 				pp("100.79.141.115/32"),
+				pp("100.80.207.38/32"),
+				pp("100.80.207.40/32"),
+				pp("100.80.207.56/32"),
+				pp("100.94.122.93/32"),
 				pp("fd7a:115c:a1e0::/48"),
 			},
 		},
 		{
 			name:     "route_all_enabled",
 			routeAll: true,
-			peers: []wgcfg.Peer{
-				{
-					AllowedIPs: []netip.Prefix{
-						// if one ip in the Tailscale ULA range is added, the entire range is added to the router config
-						pp("fd7a:115c:a1e0::2501:9b83/128"),
-						pp("100.80.207.38/32"),
-						pp("100.80.207.56/32"),
-						pp("100.80.207.40/32"),
-						pp("100.94.122.93/32"),
-						pp("100.79.141.115/32"),
-
-						// ips outside the tailscale cgnat/ula range are not added to the router config
-						pp("192.168.0.45/32"),
-						pp("fd7a:115c:b1e0::2501:9b83/128"),
-						pp("fdf8:f966:e27c:0:5:0:0:10/128"),
-					},
-				},
-			},
-			wantEndpoints: []netip.Prefix{
-				pp("100.80.207.38/32"),
-				pp("100.80.207.56/32"),
-				pp("100.80.207.40/32"),
-				pp("100.94.122.93/32"),
+			want: []netip.Prefix{
+				pp("100.64.0.0/28"),
 				pp("100.79.141.115/32"),
+				pp("100.80.207.38/32"),
+				pp("100.80.207.40/32"),
+				pp("100.80.207.56/32"),
+				pp("100.94.122.93/32"),
 				pp("192.168.0.45/32"),
 				pp("fd7a:115c:a1e0::/48"),
 				pp("fd7a:115c:b1e0::2501:9b83/128"),
@@ -7883,9 +8880,6 @@ func TestRouteAllDisabled(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			prefs := ipn.Prefs{RouteAll: tt.routeAll}
 			lb := newTestLocalBackend(t)
-			cfg := &wgcfg.Config{
-				Peers: tt.peers,
-			}
 			ServiceIPMappings := tailcfg.ServiceIPMappings{
 				"svc:test-service": []netip.Addr{
 					netip.MustParseAddr("100.64.1.2"),
@@ -7908,20 +8902,15 @@ func TestRouteAllDisabled(t *testing.T) {
 						},
 					},
 				}).View(),
+				Peers: []tailcfg.NodeView{peer.View()},
 			}
+			cn := lb.currentNode()
+			cn.SetNetMap(nm)
+			cn.updateRouteManagerPrefs(routePrefs{RouteAll: tt.routeAll})
 
-			rcfg := lb.routerConfigLocked(cfg, prefs.View(), nm, false)
-			for _, p := range rcfg.Routes {
-				found := false
-				for _, r := range tt.wantEndpoints {
-					if p.Addr() == r.Addr() {
-						found = true
-						break
-					}
-				}
-				if !found {
-					t.Errorf("unexpected prefix %q in router config", p.String())
-				}
+			rcfg := lb.routerConfigLocked(&wgcfg.Config{}, prefs.View(), nm)
+			if !slices.Equal(rcfg.Routes, tt.want) {
+				t.Errorf("Routes = %v; want %v", rcfg.Routes, tt.want)
 			}
 		})
 	}
@@ -8080,7 +9069,7 @@ func TestNoSNATWithAdvertisedExitNodeWarning(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			b := newTestLocalBackend(t)
-			b.SetPrefsForTest(tt.prefs)
+			b.ForTest().SetPrefs(tt.prefs)
 			_, hasWarning := b.HealthTracker().CurrentState().Warnings[warnCode]
 			if hasWarning != tt.wantWarning {
 				t.Errorf("warning present = %v, want %v", hasWarning, tt.wantWarning)
@@ -8091,13 +9080,616 @@ func TestNoSNATWithAdvertisedExitNodeWarning(t *testing.T) {
 	// Verify that the warning clears when the conflicting combination is resolved.
 	t.Run("warning-clears-on-fix", func(t *testing.T) {
 		b := newTestLocalBackend(t)
-		b.SetPrefsForTest(&ipn.Prefs{NoSNAT: true, AdvertiseRoutes: exitRoutes})
+		b.ForTest().SetPrefs(&ipn.Prefs{NoSNAT: true, AdvertiseRoutes: exitRoutes})
 		if _, ok := b.HealthTracker().CurrentState().Warnings[warnCode]; !ok {
 			t.Fatal("expected warning to be set")
 		}
-		b.SetPrefsForTest(&ipn.Prefs{NoSNAT: false, AdvertiseRoutes: exitRoutes})
+		b.ForTest().SetPrefs(&ipn.Prefs{NoSNAT: false, AdvertiseRoutes: exitRoutes})
 		if _, ok := b.HealthTracker().CurrentState().Warnings[warnCode]; ok {
 			t.Fatal("expected warning to be cleared after enabling SNAT")
 		}
 	})
 }
+
+// TestStartPreservesLoginFlags is a regression test for a bug where the
+// LoginEphemeral flag stored on LocalBackend was silently dropped by the
+// auto-login paths in Start() and setPrefsLocked(). The user-visible symptom
+// was tsnet.Server.Ephemeral=true being ignored when combined with an auth
+// key, because the resulting RegisterRequest.Ephemeral was false.
+//
+// The test manually constructs the LocalBackend to be able set
+// loginFlags=LoginEphemeral, and then checks that at least one cc.Login call
+// carried the LoginEphemeral bit.
+func TestStartPreservesLoginFlags(t *testing.T) {
+	logf := tstest.WhileTestRunningLogger(t)
+	sys := tsd.NewSystem()
+	sys.Set(new(mem.Store))
+	e, err := wgengine.NewFakeUserspaceEngine(logf, sys.Set, sys.HealthTracker.Get(), sys.UserMetricsRegistry(), sys.Bus.Get())
+	if err != nil {
+		t.Fatalf("NewFakeUserspaceEngine: %v", err)
+	}
+	t.Cleanup(e.Close)
+	sys.Set(e)
+
+	b, err := NewLocalBackend(logf, logid.PublicID{}, sys, controlclient.LoginEphemeral)
+	if err != nil {
+		t.Fatalf("NewLocalBackend: %v", err)
+	}
+	t.Cleanup(b.Shutdown)
+
+	var cc *mockControl
+	b.ForTest().SetControlClientGetter(func(opts controlclient.Options) (controlclient.Client, error) {
+		cc = newClient(t, opts)
+		return cc, nil
+	})
+
+	if err := b.Start(ipn.Options{
+		UpdatePrefs: &ipn.Prefs{
+			ControlURL:  "https://controlplane.example.com",
+			WantRunning: false,
+		},
+		AuthKey: "tskey-auth-test",
+	}); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+
+	if _, err := b.EditPrefs(&ipn.MaskedPrefs{
+		Prefs:          ipn.Prefs{WantRunning: true},
+		WantRunningSet: true,
+	}); err != nil {
+		t.Fatalf("EditPrefs: %v", err)
+	}
+
+	cc.mu.Lock()
+	flags := cc.loginFlags
+	cc.mu.Unlock()
+	if flags&controlclient.LoginEphemeral == 0 {
+		t.Errorf("cc.Login was never called with LoginEphemeral; got flags=%v", flags)
+	}
+}
+
+func TestShouldUseOneCGNATRoute(t *testing.T) {
+	tstest.AssertNotParallel(t)
+
+	makeInterface := func(index int, name, addr string) netmon.Interface {
+		t.Helper()
+
+		_, ipnet, err := net.ParseCIDR(addr)
+		if err != nil {
+			t.Fatalf("invalid CIDR %q: %v", addr, err)
+		}
+
+		// Loopback interface:
+		flags := net.FlagUp
+		if strings.HasPrefix(name, "lo") || strings.HasPrefix(name, "Loopback") || name == "/net/ipifc/0" {
+			flags |= net.FlagLoopback
+		}
+
+		return netmon.Interface{
+			Interface: &net.Interface{
+				Index: index,
+				Name:  name,
+				Flags: flags,
+			},
+			AltAddrs: []net.Addr{ipnet},
+		}
+	}
+
+	tests := []struct {
+		name      string
+		versionOS string
+		ifaces    []netmon.Interface
+		tsName    string
+		tsIndex   int
+		want      bool
+	}{
+		{
+			name:      "android/tailscale-cgnat",
+			versionOS: "android",
+			ifaces: []netmon.Interface{
+				makeInterface(1, "lo", "127.0.0.1/8"),
+				makeInterface(15, "rmnet_data1", "10.203.33.114/23"),
+				makeInterface(26, "tun0", "100.95.71.186/32"),
+			},
+			tsName: "tun0",
+			want:   true,
+		},
+		{
+			name:      "android/multiple-cgnats",
+			versionOS: "android",
+			ifaces: []netmon.Interface{
+				makeInterface(1, "lo", "127.0.0.1/8"),
+				makeInterface(2, "rmnet_data1", "100.124.0.1/32"),
+				makeInterface(26, "tun0", "100.95.71.186/32"),
+			},
+			tsName: "tun0",
+			want:   false,
+		},
+		{
+			name:      "linux/tailscale-cgnat",
+			versionOS: "linux",
+			ifaces: []netmon.Interface{
+				makeInterface(1, "lo", "127.0.0.1/8"),
+				makeInterface(2, "eth0", "10.203.33.114/23"),
+				makeInterface(3, "tailscale0", "100.95.71.186/32"),
+			},
+			tsName:  "tailscale0",
+			tsIndex: 3,
+			want:    false,
+		},
+		{
+			name:      "linux/multiple-cgnats",
+			versionOS: "linux",
+			ifaces: []netmon.Interface{
+				makeInterface(1, "lo", "127.0.0.1/8"),
+				makeInterface(2, "eth0", "100.124.0.1/32"),
+				makeInterface(3, "tailscale0", "100.95.71.186/32"),
+			},
+			tsName:  "tailscale0",
+			tsIndex: 3,
+			want:    false,
+		},
+		{
+			name:      "macOS/tailscale-cgnat",
+			versionOS: "macOS",
+			ifaces: []netmon.Interface{
+				makeInterface(1, "lo0", "127.0.0.1/8"),
+				makeInterface(2, "en0", "10.203.33.114/23"),
+				makeInterface(3, "utun0", "100.95.71.186/32"),
+			},
+			tsName:  "utun0",
+			tsIndex: 3,
+			want:    true,
+		},
+		{
+			name:      "macOS/multiple-cgnats",
+			versionOS: "macOS",
+			ifaces: []netmon.Interface{
+				makeInterface(1, "lo0", "127.0.0.1/8"),
+				makeInterface(2, "en0", "100.124.0.1/32"),
+				makeInterface(3, "utun0", "100.95.71.186/32"),
+			},
+			tsName:  "utun0",
+			tsIndex: 3,
+			want:    false,
+		},
+		{
+			name:      "plan9/tailscale-cgnat",
+			versionOS: "plan9",
+			ifaces: []netmon.Interface{
+				makeInterface(1, "/net/ipifc/0", "127.0.0.1/8"),
+				makeInterface(2, "/net/ipifc/1", "10.203.33.114/23"),
+				makeInterface(3, "/net/ipifc/2", "100.95.71.186/32"),
+			},
+			tsName:  "/net/ipifc/2",
+			tsIndex: 3,
+			want:    true,
+		},
+		{
+			name:      "plan9/multiple-cgnats",
+			versionOS: "plan9",
+			ifaces: []netmon.Interface{
+				makeInterface(1, "/net/ipifc/0", "127.0.0.1/8"),
+				makeInterface(2, "/net/ipifc/1", "100.124.0.1/32"),
+				makeInterface(3, "/net/ipifc/2", "100.95.71.186/32"),
+			},
+			tsName:  "/net/ipifc/2",
+			tsIndex: 3,
+			want:    true,
+		},
+		{
+			name:      "windows/tailscale-cgnat",
+			versionOS: "windows",
+			ifaces: []netmon.Interface{
+				makeInterface(1, "Loopback Pseudo-Interface 1", "127.0.0.1/8"),
+				makeInterface(2, "Wi-Fi", "10.203.33.114/23"),
+				makeInterface(3, "Tailscale", "100.95.71.186/32"),
+			},
+			tsName:  "Tailscale",
+			tsIndex: 3,
+			want:    false,
+		},
+		{
+			name:      "windows/multiple-cgnats",
+			versionOS: "windows",
+			ifaces: []netmon.Interface{
+				makeInterface(1, "Loopback Pseudo-Interface 1", "127.0.0.1/8"),
+				makeInterface(2, "Wi-Fi", "100.124.0.1/32"),
+				makeInterface(3, "Tailscale", "100.95.71.186/32"),
+			},
+			tsName:  "Tailscale",
+			tsIndex: 3,
+			want:    false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			tstest.AssertNotParallel(t)
+
+			// Stub out the network interfaces from the system.
+			t.Cleanup(func() {
+				netmon.RegisterInterfaceGetter(nil)
+			})
+			netmon.RegisterInterfaceGetter(func() ([]netmon.Interface, error) {
+				return tt.ifaces, nil
+			})
+
+			// Stub out the Tailscale interface properties.
+			tsName, _ := netmon.TailscaleInterfaceName()
+			tsIndex, _ := netmon.TailscaleInterfaceIndex()
+			t.Cleanup(func() {
+				netmon.SetTailscaleInterfaceProps(tsName, tsIndex)
+			})
+			netmon.SetTailscaleInterfaceProps(tt.tsName, tt.tsIndex)
+
+			got := shouldUseOneCGNATRoute(t.Logf, nil, nil, tt.versionOS)
+			if got != tt.want {
+				t.Errorf("shouldUseOneCGNATRoute(%q) = %v; want %v", tt.versionOS, got, tt.want)
+			}
+
+			// Control knob takes precedence over everything.
+			t.Run("control-knob-override", func(t *testing.T) {
+				knobs := &controlknobs.Knobs{}
+				knobs.OneCGNAT.Store(opt.NewBool(false))
+				if got := shouldUseOneCGNATRoute(t.Logf, nil, knobs, tt.versionOS); got {
+					t.Errorf("control knob should override %s; got true, want false", tt.versionOS)
+				}
+				knobs.OneCGNAT.Store(opt.NewBool(true))
+				if got := shouldUseOneCGNATRoute(t.Logf, nil, knobs, tt.versionOS); !got {
+					t.Errorf("control knob should override %s; got false, want true", tt.versionOS)
+				}
+			})
+		})
+	}
+
+}
+
+func TestResetAuthClearsMachineKey(t *testing.T) {
+	store := new(mem.Store)
+
+	// Write a machine key to the store.
+	machineKey := key.NewMachine()
+	keyText, _ := machineKey.MarshalText()
+	if err := store.WriteState(ipn.MachineKeyStateKey, keyText); err != nil {
+		t.Fatal(err)
+	}
+
+	// Verify key is readable.
+	if bs, err := store.ReadState(ipn.MachineKeyStateKey); err != nil {
+		t.Fatalf("ReadState before clear: %v", err)
+	} else if len(bs) == 0 {
+		t.Fatal("machine key is empty before clear")
+	}
+
+	// Clear the key the same way ResetAuth does.
+	if err := ipn.WriteState(store, ipn.MachineKeyStateKey, nil); err != nil {
+		t.Fatal(err)
+	}
+
+	// Verify key is gone. It should return ErrStateNotExist,
+	// not nil/nil which would cause initMachineKeyLocked to
+	// fail with "invalid key ... doesn't have expected type prefix".
+	if _, err := store.ReadState(ipn.MachineKeyStateKey); err != ipn.ErrStateNotExist {
+		t.Fatalf("ReadState after clear: got err %v, want ErrStateNotExist", err)
+	}
+}
+
+func TestEnginePeerForIPAdjustsForPrefs(t *testing.T) {
+	// Build a netmap with:
+	//   - self node at 100.64.0.1
+	//   - exitA (node 1): exit node at 100.64.0.2
+	//   - exitB (node 2): exit node at 100.64.0.3
+	//   - subnetBig (node 3): subnet router for 10.0.0.0/16 at 100.64.0.4
+	//   - subnetSmall (node 4): subnet router for 10.0.0.0/24 at 100.64.0.5
+	hi := (&tailcfg.Hostinfo{}).View()
+
+	selfNode := (&tailcfg.Node{
+		ID:       10,
+		StableID: "self",
+		Key:      makeNodeKeyFromID(10),
+		DiscoKey: makeDiscoKeyFromID(10),
+		Name:     "self",
+		Hostinfo: hi,
+		Cap:      26,
+		Addresses: []netip.Prefix{
+			netip.MustParsePrefix("100.64.0.1/32"),
+		},
+		MachineAuthorized: true,
+	}).View()
+
+	exitA := (&tailcfg.Node{
+		ID:       1,
+		StableID: "exitA",
+		Key:      makeNodeKeyFromID(1),
+		DiscoKey: makeDiscoKeyFromID(1),
+		Name:     "exitA",
+		Hostinfo: hi,
+		Cap:      26,
+		Addresses: []netip.Prefix{
+			netip.MustParsePrefix("100.64.0.2/32"),
+		},
+		AllowedIPs:        append([]netip.Prefix{netip.MustParsePrefix("100.64.0.2/32")}, tsaddr.ExitRoutes()...),
+		MachineAuthorized: true,
+		HomeDERP:          1,
+	}).View()
+
+	exitB := (&tailcfg.Node{
+		ID:       2,
+		StableID: "exitB",
+		Key:      makeNodeKeyFromID(2),
+		DiscoKey: makeDiscoKeyFromID(2),
+		Name:     "exitB",
+		Hostinfo: hi,
+		Cap:      26,
+		Addresses: []netip.Prefix{
+			netip.MustParsePrefix("100.64.0.3/32"),
+		},
+		AllowedIPs:        append([]netip.Prefix{netip.MustParsePrefix("100.64.0.3/32")}, tsaddr.ExitRoutes()...),
+		MachineAuthorized: true,
+		HomeDERP:          2,
+	}).View()
+
+	subnetBig := (&tailcfg.Node{
+		ID:       3,
+		StableID: "subnetBig",
+		Key:      makeNodeKeyFromID(3),
+		DiscoKey: makeDiscoKeyFromID(3),
+		Name:     "subnetBig",
+		Hostinfo: hi,
+		Cap:      26,
+		Addresses: []netip.Prefix{
+			netip.MustParsePrefix("100.64.0.4/32"),
+		},
+		AllowedIPs: []netip.Prefix{
+			netip.MustParsePrefix("100.64.0.4/32"),
+			netip.MustParsePrefix("10.0.0.0/16"),
+		},
+		PrimaryRoutes:     []netip.Prefix{netip.MustParsePrefix("10.0.0.0/16")},
+		MachineAuthorized: true,
+		HomeDERP:          1,
+	}).View()
+
+	subnetSmall := (&tailcfg.Node{
+		ID:       4,
+		StableID: "subnetSmall",
+		Key:      makeNodeKeyFromID(4),
+		DiscoKey: makeDiscoKeyFromID(4),
+		Name:     "subnetSmall",
+		Hostinfo: hi,
+		Cap:      26,
+		Addresses: []netip.Prefix{
+			netip.MustParsePrefix("100.64.0.5/32"),
+		},
+		AllowedIPs: []netip.Prefix{
+			netip.MustParsePrefix("100.64.0.5/32"),
+			netip.MustParsePrefix("10.0.0.0/24"),
+		},
+		PrimaryRoutes:     []netip.Prefix{netip.MustParsePrefix("10.0.0.0/24")},
+		MachineAuthorized: true,
+		HomeDERP:          1,
+	}).View()
+
+	nm := buildNetmapWithPeers(selfNode, exitA, exitB, subnetBig, subnetSmall)
+
+	var curLB *LocalBackend
+	var curT *testing.T // active subtest, for test helpers
+
+	wantPeer := func(ip string, n tailcfg.NodeView) {
+		t := curT
+		t.Helper()
+		pip, ok := curLB.PeerForIP(netip.MustParseAddr(ip))
+		if !ok {
+			t.Fatalf("PeerForIP(%s): ok=false, want true", ip)
+		}
+		if pip.IsSelf {
+			t.Fatalf("PeerForIP(%s): IsSelf=true, want false", ip)
+		}
+		if pip.Node.Key() != n.Key() {
+			t.Fatalf("PeerForIP(%s): key=%v, want %v", ip, pip.Node.Key(), n.Key())
+		}
+	}
+	wantNotPeer := func(ip string) {
+		t := curT
+		t.Helper()
+		if _, ok := curLB.PeerForIP(netip.MustParseAddr(ip)); ok {
+			t.Fatalf("PeerForIP(%s): ok=true, want false", ip)
+		}
+	}
+	wantKey := func(ip string, n tailcfg.NodeView) {
+		t := curT
+		t.Helper()
+		pr, ok := curLB.currentNode().routeMgr.Outbound().Lookup(netip.MustParseAddr(ip))
+		if !ok {
+			t.Fatalf("routeMgr.Outbound().Lookup(%s): ok=false, want true", ip)
+		}
+		if pr.Key != n.Key() {
+			t.Fatalf("routeMgr.Outbound().Lookup(%s): key=%v, want %v", ip, pr.Key, n.Key())
+		}
+	}
+	wantNotKey := func(ip string) {
+		t := curT
+		t.Helper()
+		if _, ok := curLB.currentNode().routeMgr.Outbound().Lookup(netip.MustParseAddr(ip)); ok {
+			t.Fatalf("routeMgr.Outbound().Lookup(%s): ok=true, want false", ip)
+		}
+	}
+	wantSelf := func(ip string) {
+		t := curT
+		t.Helper()
+		pip, ok := curLB.PeerForIP(netip.MustParseAddr(ip))
+		if !ok {
+			t.Fatalf("PeerForIP(%s): ok=false, want true", ip)
+		}
+		if !pip.IsSelf {
+			t.Fatalf("PeerForIP(%s): IsSelf=false, want true", ip)
+		}
+	}
+
+	tests := []struct {
+		name  string
+		prefs ipn.Prefs
+		check func()
+	}{
+		{
+			name: "no_routes_no_exit",
+			prefs: ipn.Prefs{
+				RouteAll:   false,
+				ExitNodeID: "",
+			},
+			check: func() {
+				wantSelf("100.64.0.1")
+				wantPeer("100.64.0.2", exitA)
+				wantPeer("100.64.0.3", exitB)
+				wantPeer("100.64.0.4", subnetBig)
+				wantPeer("100.64.0.5", subnetSmall)
+				wantNotPeer("10.0.0.5")
+				wantNotPeer("10.0.1.5")
+				wantNotPeer("8.8.8.8")
+				wantNotKey("10.0.0.5")
+				wantNotKey("8.8.8.8")
+			},
+		},
+		{
+			name: "accept_routes_on",
+			prefs: ipn.Prefs{
+				RouteAll:   true,
+				ExitNodeID: "",
+			},
+			check: func() {
+				// 10.0.0.5 is in both /16 and /24; longest prefix match picks subnetSmall.
+				wantPeer("10.0.0.5", subnetSmall)
+				wantKey("10.0.0.5", subnetSmall)
+				// 10.0.1.5 is in /16 only; goes to subnetBig.
+				wantPeer("10.0.1.5", subnetBig)
+				wantKey("10.0.1.5", subnetBig)
+				wantNotPeer("8.8.8.8")
+			},
+		},
+		{
+			name: "exit_node_A",
+			prefs: ipn.Prefs{
+				RouteAll:   true,
+				ExitNodeID: "exitA",
+			},
+			check: func() {
+				wantPeer("8.8.8.8", exitA)
+				wantKey("8.8.8.8", exitA)
+				wantPeer("10.0.0.5", subnetSmall)
+				wantPeer("10.0.1.5", subnetBig)
+			},
+		},
+		{
+			name: "exit_node_B",
+			prefs: ipn.Prefs{
+				RouteAll:   true,
+				ExitNodeID: "exitB",
+			},
+			check: func() {
+				wantPeer("8.8.8.8", exitB)
+				wantKey("8.8.8.8", exitB)
+				wantPeer("10.0.0.5", subnetSmall)
+				wantPeer("10.0.1.5", subnetBig)
+			},
+		},
+		{
+			name: "exit_node_off_routes_on",
+			prefs: ipn.Prefs{
+				RouteAll:   true,
+				ExitNodeID: "",
+			},
+			check: func() {
+				wantNotPeer("8.8.8.8")
+				wantNotKey("8.8.8.8")
+				wantPeer("10.0.0.5", subnetSmall)
+				wantPeer("10.0.1.5", subnetBig)
+			},
+		},
+		{
+			name: "accept_routes_off",
+			prefs: ipn.Prefs{
+				RouteAll:   false,
+				ExitNodeID: "",
+			},
+			check: func() {
+				wantNotPeer("10.0.0.5")
+				wantNotKey("10.0.0.5")
+				wantPeer("100.64.0.4", subnetBig)
+				wantPeer("100.64.0.5", subnetSmall)
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			lb := newTestLocalBackend(t)
+
+			nk := key.NewNode()
+			nmCopy := new(*nm)
+			nmCopy.NodeKey = nk.Public()
+
+			lb.mu.Lock()
+			err := lb.pm.SetPrefs((&ipn.Prefs{
+				ControlURL:  "https://localhost:1/",
+				WantRunning: true,
+				RouteAll:    tt.prefs.RouteAll,
+				ExitNodeID:  tt.prefs.ExitNodeID,
+				Persist:     &persist.Persist{PrivateNodeKey: nk},
+			}).View(), ipn.NetworkProfile{})
+			lb.mu.Unlock()
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			lb.SetControlClientStatus(lb.cc, controlclient.Status{
+				NetMap:   nmCopy,
+				LoggedIn: true,
+			})
+
+			curLB = lb
+			curT = t
+			tt.check()
+		})
+	}
+}
+
+// Tests that selecting an exit node that doesn't resolve to any
+// current peer (a nonexistent node, or MDM's "auto:any" placeholder
+// before it is resolved) still installs the blackhole default routes,
+// so internet traffic is dropped rather than escaping to the local
+// network. That behavior is documented on [ipn.Prefs.ExitNodeID] and
+// must survive the migration of OS route computation to
+// net/routemanager.
+func TestRouterConfigExitNodeBlackhole(t *testing.T) {
+	lb := newTestLocalBackend(t)
+	nm := &netmap.NetworkMap{
+		SelfNode: (&tailcfg.Node{
+			Name:      "test-node",
+			Addresses: []netip.Prefix{netip.MustParsePrefix("100.64.1.1/32")},
+		}).View(),
+	}
+	cfg := &wgcfg.Config{} // no peer carries the default routes
+
+	hasDefaults := func(routes []netip.Prefix) bool {
+		return slices.Contains(routes, tsaddr.AllIPv4()) && slices.Contains(routes, tsaddr.AllIPv6())
+	}
+	// Push the netmap and prefs into the route manager first, as
+	// authReconfigLocked does before calling routerConfigLocked, now
+	// that the OS routes are derived from the route manager.
+	cn := lb.currentNode()
+	cn.SetNetMap(nm)
+	for _, exitID := range []tailcfg.StableNodeID{"auto:any", "no-such-node"} {
+		prefs := ipn.Prefs{ExitNodeID: exitID}
+		cn.updateRouteManagerPrefs(routePrefs{ExitNodeID: exitID, ExitNodeSelected: true})
+		rcfg := lb.routerConfigLocked(cfg, prefs.View(), nm)
+		if !hasDefaults(rcfg.Routes) {
+			t.Errorf("ExitNodeID=%q: Routes = %v; want blackhole default routes", exitID, rcfg.Routes)
+		}
+	}
+
+	// With no exit node selected, there must be no default routes.
+	cn.updateRouteManagerPrefs(routePrefs{})
+	rcfg := lb.routerConfigLocked(cfg, new(ipn.Prefs).View(), nm)
+	if hasDefaults(rcfg.Routes) {
+		t.Errorf("no exit node: Routes = %v; want no default routes", rcfg.Routes)
+	}
+}
diff --git a/ipn/ipnlocal/loglines_test.go b/ipn/ipnlocal/loglines_test.go
index 733c7381b..dde70e742 100644
--- a/ipn/ipnlocal/loglines_test.go
+++ b/ipn/ipnlocal/loglines_test.go
@@ -80,7 +80,7 @@ func TestLocalLogLines(t *testing.T) {
 	persist := &persist.Persist{}
 	prefs := ipn.NewPrefs()
 	prefs.Persist = persist
-	lb.SetPrefsForTest(prefs)
+	lb.ForTest().SetPrefs(prefs)
 
 	t.Run("after_prefs", testWantRemain("[v1] peer keys: %s", "[v1] v%v peers: %v"))
 
diff --git a/ipn/ipnlocal/netmapcache/netmapcache.go b/ipn/ipnlocal/netmapcache/netmapcache.go
index 1b8347f0b..3c4b01cf3 100644
--- a/ipn/ipnlocal/netmapcache/netmapcache.go
+++ b/ipn/ipnlocal/netmapcache/netmapcache.go
@@ -83,8 +83,8 @@ func (c *Cache) writeJSON(ctx context.Context, key cacheKey, v any) error {
 		return fmt.Errorf("JSON marshalling %q: %w", key, err)
 	}
 
-	// TODO(creachadair): Maybe use a hash instead of the contents? Do we need
-	// this at all?
+	// If the digest of this value has not changed since it was last written,
+	// record that the key is of interest, but do not actually perform a write.
 	last, ok := c.lastWrote[key]
 	if ok && cacheDigest(j) == last.digest {
 		c.wantKeys.Add(key)
@@ -193,6 +193,23 @@ const (
 	packetFilterKey cacheKey = "filter"
 )
 
+// UpdateSelfOnly updates nm in the cache, replacing any previously cached
+// values for nm.Self and other tailnet metadata for the current node, but
+// skipping the Peers and UserProfiles fields. Any existing peer and profile
+// data are left unmodified.
+func (c *Cache) UpdateSelfOnly(ctx context.Context, nm *netmap.NetworkMap) error {
+	if !buildfeatures.HasCacheNetMap || nm == nil || nm.Cached {
+		return nil
+	}
+	if selfID := nm.User(); selfID == 0 {
+		return errors.New("no user in netmap")
+	}
+	// Since we are not modifying peers or users (and in particular, not
+	// removing any), we do not need to do any garbage collection on the storage
+	// keys.
+	return c.updateSelfOnly(ctx, nm)
+}
+
 // Store records nm in the cache, replacing any previously-cached values.
 func (c *Cache) Store(ctx context.Context, nm *netmap.NetworkMap) error {
 	if !buildfeatures.HasCacheNetMap || nm == nil || nm.Cached {
@@ -202,7 +219,70 @@ func (c *Cache) Store(ctx context.Context, nm *netmap.NetworkMap) error {
 		return errors.New("no user in netmap")
 	}
 
+	// Because we may modify which peers and user profiles are valid, we need to
+	// keep track of which storage keys we actually touch during the store.
+	// This is used by c.removeUnwantedKeys to clean up keys that are no longer
+	// referenced after peers and/or profiles are removed from nm.
 	clear(c.wantKeys)
+	if err := c.updateSelfOnly(ctx, nm); err != nil {
+		return err
+	}
+	for _, p := range nm.Peers {
+		key := peerKeyPrefix + cacheKey(p.StableID())
+		if err := c.writeJSON(ctx, key, netmapNode{Node: &p}); err != nil {
+			return err
+		}
+	}
+	for uid, u := range nm.UserProfiles {
+		key := fmt.Sprintf("%s%d", userKeyPrefix, uid)
+		if err := c.writeJSON(ctx, cacheKey(key), netmapUserProfile{UserProfile: &u}); err != nil {
+			return err
+		}
+	}
+	return c.removeUnwantedKeys(ctx)
+}
+
+// UpdatePeers updates the cache to add or replace ("upsert") any peers
+// specified in update, and discard any peers specified in remove. This does
+// not affect any previous cached values for the self node or user profiles.
+//
+// It is expected that update and remove will be disjoint, but in the event
+// they are not, remove takes precedence. If the cache does not already contain
+// at least a self node, UpdatePeers reports an error without changing anything.
+func (c *Cache) UpdatePeers(ctx context.Context, update []tailcfg.NodeView, remove []tailcfg.StableNodeID) error {
+	if !buildfeatures.HasCacheNetMap {
+		return nil
+	}
+	if !c.wantKeys.Contains(selfKey) {
+		return errors.New("no netmap is cached to apply an update")
+	}
+
+	// Attempt all updates and removals before reporting any errors.
+	var errs []error
+	for _, p := range update {
+		// We may already have an entry for this peer, or it may be new, but
+		// rather than do a lookup we can just replace the existing entry if it
+		// exists.
+		key := peerKeyPrefix + cacheKey(p.StableID())
+		if err := c.writeJSON(ctx, key, netmapNode{Node: &p}); err != nil {
+			errs = append(errs, err)
+			continue
+		}
+		c.wantKeys.Add(key)
+	}
+	for _, q := range remove {
+		key := peerKeyPrefix + cacheKey(q)
+		if err := c.store.Remove(ctx, string(key)); err != nil {
+			errs = append(errs, err)
+		}
+		c.wantKeys.Delete(key)
+	}
+	return errors.Join(errs...)
+}
+
+// updateSelfOnly updates the "static" parts of the netmap in the cache.  It is
+// shared between [Cache.UpdateSelfOnly] and [Cache.Store].
+func (c *Cache) updateSelfOnly(ctx context.Context, nm *netmap.NetworkMap) error {
 	if err := c.writeJSON(ctx, miscKey, netmapMisc{
 		MachineKey:       &nm.MachineKey,
 		CollectServices:  &nm.CollectServices,
@@ -226,29 +306,15 @@ func (c *Cache) Store(ctx context.Context, nm *netmap.NetworkMap) error {
 		// N.B. The NodeKey and AllCaps fields can be recovered from SelfNode on
 		// load, and do not need to be stored separately.
 	}
-	for _, p := range nm.Peers {
-		key := peerKeyPrefix + cacheKey(p.StableID())
-		if err := c.writeJSON(ctx, key, netmapNode{Node: &p}); err != nil {
-			return err
-		}
-	}
-	for uid, u := range nm.UserProfiles {
-		key := fmt.Sprintf("%s%d", userKeyPrefix, uid)
-		if err := c.writeJSON(ctx, cacheKey(key), netmapUserProfile{UserProfile: &u}); err != nil {
-			return err
-		}
-	}
 	if err := c.writeJSON(ctx, packetFilterKey, netmapPacketFilter{Rules: &nm.PacketFilterRules}); err != nil {
 		return err
 	}
-
 	if buildfeatures.HasSSH && nm.SSHPolicy != nil {
 		if err := c.writeJSON(ctx, sshPolicyKey, netmapSSH{SSHPolicy: &nm.SSHPolicy}); err != nil {
 			return err
 		}
 	}
-
-	return c.removeUnwantedKeys(ctx)
+	return nil
 }
 
 // Load loads the cached [netmap.NetworkMap] value stored in c, if one is available.
diff --git a/ipn/ipnlocal/netmapcache/netmapcache_test.go b/ipn/ipnlocal/netmapcache/netmapcache_test.go
index ca66a1713..884e450e4 100644
--- a/ipn/ipnlocal/netmapcache/netmapcache_test.go
+++ b/ipn/ipnlocal/netmapcache/netmapcache_test.go
@@ -258,6 +258,104 @@ func TestInvalidCache(t *testing.T) {
 	})
 }
 
+func TestUpdateSelfOnly(t *testing.T) {
+	s := make(testStore)
+	c := netmapcache.NewCache(s)
+
+	// Initialize the cache with the test map so we get a baseline.
+	if err := c.Store(t.Context(), testMap); err != nil {
+		t.Fatalf("Store initial netmap: %v", err)
+	}
+
+	// Modify a shallow copy of the map so we can perform an update and verify
+	// that it round-trips through a Load after calling UpdateSelfOnly.
+	newSelf := &tailcfg.Node{
+		ID:           23456,
+		StableID:     "n23456FAKE",
+		User:         8675309,
+		Name:         "alt.example.com.",
+		Key:          testNodeKey,
+		HomeDERP:     6174,
+		Capabilities: []tailcfg.NodeCapability{"cap1", "cap3"},
+	}
+	updated := *testMap // shallow copy
+	updated.SelfNode = newSelf.View()
+	updated.AllCaps = set.Of[tailcfg.NodeCapability]("cap1", "cap3")
+	updated.DNS = tailcfg.DNSConfig{Domains: []string{"example3.org", "example4.horse"}}
+
+	// Empty the peers and profiles so that we can verify the update does not
+	// attempt to use them or GC based on their absence.
+	updated.Peers = nil
+	updated.UserProfiles = nil
+
+	if err := c.UpdateSelfOnly(t.Context(), &updated); err != nil {
+		t.Fatalf("UpdateSelfOnly failed: %v", err)
+	}
+
+	// Verify we got the same results back. Importantly, we expect the same
+	// peers and profiles as before, to enforce that the self-only update did
+	// not prune
+	updated.Peers = testMap.Peers
+	updated.UserProfiles = testMap.UserProfiles
+
+	got, err := c.Load(t.Context())
+	if err != nil {
+		t.Fatalf("Load netmap failed: %v", err)
+	}
+	if diff := diffNetMaps(got, &updated); diff != "" {
+		t.Fatalf("Updated map differs (-got, +want):\n%s", diff)
+	}
+}
+
+func TestUpdatePeers(t *testing.T) {
+	modNode1 := (&tailcfg.Node{
+		ID:       99001,
+		StableID: "n99001FAKE",
+		Name:     "test1altered.example.com.",
+	}).View() // a modified version of testNode1
+	newNode3 := (&tailcfg.Node{
+		ID:       99003,
+		StableID: "n99003FAKE",
+		Name:     "test3.example.com.",
+	}).View() // a new node hitherto unseen
+
+	update := []tailcfg.NodeView{newNode3, modNode1}
+	remove := []tailcfg.StableNodeID{testNode2.StableID()}
+
+	// Modify a shallow copy of the map so we can perform an update and verify
+	// that it round-trips through a Load after calling UpdatePeers.
+	updated := *testMap
+	updated.Peers = []tailcfg.NodeView{modNode1, newNode3} // N.B. sorted
+
+	s := make(testStore)
+	c := netmapcache.NewCache(s)
+
+	// Prior to storing anything, the cache should reject an update because it
+	// has no base netmap to apply changes to.
+	if err := c.UpdatePeers(t.Context(), update, remove); err == nil {
+		t.Error("UpdatePeers on empty cache unexpectedly succeeded")
+	} else {
+		t.Logf("UpdatePeers on empty cache: %v (OK)", err)
+	}
+
+	// Initialize the cache with the test map so we get a baseline.
+	if err := c.Store(t.Context(), testMap); err != nil {
+		t.Fatalf("Store initial netmap: %v", err)
+	}
+
+	if err := c.UpdatePeers(t.Context(), update, remove); err != nil {
+		t.Fatalf("UpdatePeers failed; %v", err)
+	}
+
+	got, err := c.Load(t.Context())
+	if err != nil {
+		t.Fatalf("Load netmap failed: %v", err)
+	}
+	if diff := diffNetMaps(got, &updated); diff != "" {
+		t.Fatalf("Updated map differs (-got, +want):\n%s", diff)
+	}
+}
+
 // skippedMapFields are the names of fields that should not be considered by
 // network map caching, and thus skipped when comparing test results.
 var skippedMapFields = []string{
diff --git a/ipn/ipnlocal/node_backend.go b/ipn/ipnlocal/node_backend.go
index 75550b3d5..ada72f80c 100644
--- a/ipn/ipnlocal/node_backend.go
+++ b/ipn/ipnlocal/node_backend.go
@@ -6,29 +6,37 @@ package ipnlocal
 import (
 	"cmp"
 	"context"
-	"fmt"
+	"iter"
+	"maps"
 	"net/netip"
 	"slices"
+	"strings"
 	"sync"
 	"sync/atomic"
 
 	"go4.org/netipx"
 	"tailscale.com/appc"
+	"tailscale.com/envknob"
 	"tailscale.com/feature/buildfeatures"
 	"tailscale.com/ipn"
 	"tailscale.com/net/dns"
+	"tailscale.com/net/routecheck/peernode"
+	"tailscale.com/net/routemanager"
 	"tailscale.com/net/tsaddr"
 	"tailscale.com/syncs"
 	"tailscale.com/tailcfg"
 	"tailscale.com/types/dnstype"
 	"tailscale.com/types/key"
 	"tailscale.com/types/logger"
+	"tailscale.com/types/mapx"
 	"tailscale.com/types/netmap"
 	"tailscale.com/types/views"
 	"tailscale.com/util/dnsname"
 	"tailscale.com/util/eventbus"
 	"tailscale.com/util/mak"
+	"tailscale.com/util/set"
 	"tailscale.com/util/slicesx"
+	"tailscale.com/util/testenv"
 	"tailscale.com/wgengine/filter"
 )
 
@@ -79,6 +87,13 @@ type nodeBackend struct {
 	eventClient    *eventbus.Client
 	derpMapViewPub *eventbus.Publisher[tailcfg.DERPMapView]
 
+	// homeDERP lives here temporarily. as long as mapSession is short lived, we
+	// don't have a location delivering netmaps to local backend that knows our
+	// homeDERP hence why it is cached here for now.
+	// TODO(cmol): move this field into a refactored mapSession that is not
+	// short lived.
+	homeDERP atomic.Int64
+
 	// TODO(nickkhyl): maybe use sync.RWMutex?
 	mu syncs.Mutex // protects the following fields
 
@@ -107,6 +122,67 @@ type nodeBackend struct {
 	// nodeByKey is an index of node public key to node ID for fast lookups.
 	// It is mutated in place (with mu held) and must not escape the [nodeBackend].
 	nodeByKey map[key.NodePublic]tailcfg.NodeID
+
+	// nodeByWGString indexes wireguard-go's truncated peer-string form
+	// (see [key.NodePublic.WireGuardGoString]) to node ID. It mirrors
+	// nodeByKey and lets the wireguard-go log path resolve
+	// "peer(XXXX…YYYY)" references in O(1), without scanning every
+	// peer, while still tolerating the fact that the wireguard-go form
+	// is lossy and can't be inverted to a [key.NodePublic].
+	// It is mutated in place (with mu held) and must not escape the [nodeBackend].
+	nodeByWGString map[string]tailcfg.NodeID
+
+	// nodeByStableID is an index of peer stable node ID to node ID.
+	// Unlike nodeByAddr and nodeByKey, it covers only peers, not the
+	// self node.
+	// It is mutated in place (with mu held) and must not escape the [nodeBackend].
+	nodeByStableID map[tailcfg.StableNodeID]tailcfg.NodeID
+
+	// nodeByName maps MagicDNS hostnames (lowercase, no trailing dot) to
+	// node IDs. Both the FQDN and the short name (suffix stripped) are
+	// keys. It is used by the tsdial MagicDNS resolution callback.
+	// It is mutated in place (with mu held) and must not escape the [nodeBackend].
+	nodeByName map[string]tailcfg.NodeID
+
+	// extraDNS stores DNS.ExtraRecords A/AAAA entries from the netmap
+	// (typically service VIPs pushed by control), keyed by canonicalized
+	// hostname (lowercase, no trailing dot).
+	extraDNS map[string]netip.Addr
+
+	// userProfiles is the live set of user profiles, updated incrementally
+	// by mergeUserProfiles as deltas arrive. It parallels the peers map:
+	// netMap.UserProfiles is the frozen snapshot from the last full install,
+	// while this field reflects incremental updates. Readers that need a
+	// snapshot (e.g. the legacy Notify.NetMap path) must clone this map.
+	userProfiles map[tailcfg.UserID]tailcfg.UserProfileView
+
+	// packetFilterRules and packetFilter are the live packet filter state,
+	// updated by setPacketFilter as deltas arrive. Like userProfiles, they
+	// exist separately from netMap's frozen fields so that concurrent
+	// JSON-encoding of a Notify.NetMap snapshot doesn't race with writes.
+	packetFilterRules views.Slice[tailcfg.FilterRule]
+	packetFilter      []filter.Match
+
+	// keyWaitersForTest is the test-only registry of channels waiting for
+	// a given peer key to first appear in the netmap. See
+	// [nodeBackend.AwaitNodeKeyForTest]. It is populated lazily and remains
+	// nil in production, where no test installs a waiter.
+	keyWaitersForTest map[key.NodePublic]chan struct{}
+
+	// tsmpLearnedDisco records, per node key, a peer disco key that was
+	// learned via TSMP (that is, over an existing WireGuard session with
+	// that peer). When a netmap update later reports the same disco key
+	// change, the peer's WireGuard session does not need to be reset,
+	// because the change demonstrably arrived over a working session.
+	// See [nodeBackend.discoChangedLocked].
+	tsmpLearnedDisco map[key.NodePublic]key.DiscoPublic
+
+	// routeMgr tracks this node's view of which IPs route to which
+	// peers and publishes lock-free snapshots for the data plane and
+	// the OS router. It is initialized once and immutable, but its
+	// Begin/Commit mutations must be serialized, which we do by only
+	// mutating it with mu held.
+	routeMgr *routemanager.RouteManager
 }
 
 func newNodeBackend(ctx context.Context, logf logger.Logf, bus *eventbus.Bus) *nodeBackend {
@@ -117,6 +193,7 @@ func newNodeBackend(ctx context.Context, logf logger.Logf, bus *eventbus.Bus) *n
 		ctxCancel:   ctxCancel,
 		eventClient: bus.Client("ipnlocal.nodeBackend"),
 		readyCh:     make(chan struct{}),
+		routeMgr:    routemanager.New(logf),
 	}
 	// Default filter blocks everything and logs nothing.
 	noneFilter := filter.NewAllowNone(logger.Discard, &netipx.IPSet{})
@@ -132,6 +209,7 @@ func (nb *nodeBackend) Context() context.Context {
 	return nb.ctx
 }
 
+// Self returns the current node.
 func (nb *nodeBackend) Self() tailcfg.NodeView {
 	nb.mu.Lock()
 	defer nb.mu.Unlock()
@@ -200,9 +278,41 @@ func (nb *nodeBackend) NodeByKey(k key.NodePublic) (_ tailcfg.NodeID, ok bool) {
 	return nid, ok
 }
 
+// PeerAllowedIPs returns the prefixes from which the peer with the
+// given public key is currently allowed to originate traffic, or
+// ok=false if the key is unknown or the peer currently contributes no
+// prefixes.
+func (nb *nodeBackend) PeerAllowedIPs(k key.NodePublic) ([]netip.Prefix, bool) {
+	nb.mu.Lock()
+	defer nb.mu.Unlock()
+	id, ok := nb.nodeByKey[k]
+	if !ok {
+		return nil, false
+	}
+	// Holding nb.mu satisfies routeMgr's serialization requirement:
+	// all routeMgr mutations also run under nb.mu.
+	return nb.routeMgr.PeerAllowedIPs(id)
+}
+
+// NodeByWireGuardString returns the node ID of the peer whose
+// [key.NodePublic.WireGuardGoString] form is s (e.g. "peer(IMTB…r7lM)").
+// ok is false if no current peer matches.
+func (nb *nodeBackend) NodeByWireGuardString(s string) (_ tailcfg.NodeID, ok bool) {
+	nb.mu.Lock()
+	defer nb.mu.Unlock()
+	nid, ok := nb.nodeByWGString[s]
+	return nid, ok
+}
+
 func (nb *nodeBackend) NodeByID(id tailcfg.NodeID) (_ tailcfg.NodeView, ok bool) {
 	nb.mu.Lock()
 	defer nb.mu.Unlock()
+	return nb.nodeByIDLocked(id)
+}
+
+// nodeByIDLocked returns the node (peer or self) with the given node
+// ID. nb.mu must be held.
+func (nb *nodeBackend) nodeByIDLocked(id tailcfg.NodeID) (_ tailcfg.NodeView, ok bool) {
 	if nb.netMap != nil {
 		if self := nb.netMap.SelfNode; self.Valid() && self.ID() == id {
 			return self, true
@@ -215,22 +325,17 @@ func (nb *nodeBackend) NodeByID(id tailcfg.NodeID) (_ tailcfg.NodeView, ok bool)
 func (nb *nodeBackend) PeerByStableID(id tailcfg.StableNodeID) (_ tailcfg.NodeView, ok bool) {
 	nb.mu.Lock()
 	defer nb.mu.Unlock()
-	for _, n := range nb.peers {
-		if n.StableID() == id {
-			return n, true
-		}
+	if nid, ok := nb.nodeByStableID[id]; ok {
+		n, ok := nb.peers[nid]
+		return n, ok
 	}
 	return tailcfg.NodeView{}, false
 }
 
 func (nb *nodeBackend) UserByID(id tailcfg.UserID) (_ tailcfg.UserProfileView, ok bool) {
 	nb.mu.Lock()
-	nm := nb.netMap
-	nb.mu.Unlock()
-	if nm == nil {
-		return tailcfg.UserProfileView{}, false
-	}
-	u, ok := nm.UserProfiles[id]
+	defer nb.mu.Unlock()
+	u, ok := nb.userProfiles[id]
 	return u, ok
 }
 
@@ -241,6 +346,30 @@ func (nb *nodeBackend) Peers() []tailcfg.NodeView {
 	return slicesx.MapValues(nb.peers)
 }
 
+// PeerByID returns the current state of the peer (not self) node with
+// the given ID, or ok=false if it is not a current peer.
+func (nb *nodeBackend) PeerByID(id tailcfg.NodeID) (_ tailcfg.NodeView, ok bool) {
+	nb.mu.Lock()
+	defer nb.mu.Unlock()
+	n, ok := nb.peers[id]
+	return n, ok
+}
+
+// peerDiscoKeys returns the disco public keys of all current peers,
+// keyed by their node public keys. Peers without a disco key are
+// omitted.
+func (nb *nodeBackend) peerDiscoKeys() map[key.NodePublic]key.DiscoPublic {
+	nb.mu.Lock()
+	defer nb.mu.Unlock()
+	m := make(map[key.NodePublic]key.DiscoPublic, len(nb.peers))
+	for _, p := range nb.peers {
+		if dk := p.DiscoKey(); !dk.IsZero() {
+			m[p.Key()] = dk
+		}
+	}
+	return m
+}
+
 func (nb *nodeBackend) PeersForTest() []tailcfg.NodeView {
 	nb.mu.Lock()
 	defer nb.mu.Unlock()
@@ -259,28 +388,22 @@ func (nb *nodeBackend) CollectServices() bool {
 
 // AppendMatchingPeers returns base with all peers that match pred appended.
 //
-// It acquires b.mu to read the netmap but releases it before calling pred.
+// It acquires nb.mu to snapshot the peers but releases it before
+// calling pred.
 func (nb *nodeBackend) AppendMatchingPeers(base []tailcfg.NodeView, pred func(tailcfg.NodeView) bool) []tailcfg.NodeView {
-	var peers []tailcfg.NodeView
-
 	nb.mu.Lock()
-	if nb.netMap != nil {
-		// All fields on b.netMap are immutable, so this is
-		// safe to copy and use outside the lock.
-		peers = nb.netMap.Peers
-	}
+	peers := slicesx.MapValues(nb.peers)
 	nb.mu.Unlock()
 
+	// Sort by node ID for deterministic results; the map iteration
+	// above is randomly ordered.
+	slices.SortFunc(peers, func(a, b tailcfg.NodeView) int {
+		return cmp.Compare(a.ID(), b.ID())
+	})
+
 	ret := base
 	for _, peer := range peers {
-		// The peers in b.netMap don't contain updates made via
-		// UpdateNetmapDelta. So only use PeerView in b.netMap for its NodeID,
-		// and then look up the latest copy in b.peers which is updated in
-		// response to UpdateNetmapDelta edits.
-		nb.mu.Lock()
-		peer, ok := nb.peers[peer.ID()]
-		nb.mu.Unlock()
-		if ok && pred(peer) {
+		if pred(peer) {
 			ret = append(ret, peer)
 		}
 	}
@@ -295,7 +418,46 @@ func (nb *nodeBackend) PeerCaps(src netip.Addr) tailcfg.PeerCapMap {
 	return nb.peerCapsLocked(src)
 }
 
+// srcIsUnsignedPeerLocked reports whether src is an address of a peer with
+// UnsignedPeerAPIOnly set. Such peers are not covered by tailnet lock and must
+// never be granted peer capabilities.
+//
+// nb.mu must be held before calling.
+func (nb *nodeBackend) srcIsUnsignedPeerLocked(src netip.Addr) bool {
+	id, ok := nb.nodeByAddr[src]
+	if !ok {
+		return false
+	}
+	n, ok := nb.nodeByIDLocked(id)
+	return ok && n.UnsignedPeerAPIOnly()
+}
+
+// PeerCapsIncludingUnsigned is like [nodeBackend.PeerCaps] but does not deny
+// capabilities to peers with UnsignedPeerAPIOnly set.
+//
+// Funnel ingress relays are delivered as UnsignedPeerAPIOnly nodes: per the
+// docs on [tailcfg.Node.UnsignedPeerAPIOnly] they get no network access at all
+// and exist solely to reach this node's peerapi. The ingress endpoint they need
+// is gated on [tailcfg.PeerCapabilityIngress], so denying them capabilities
+// wholesale — as peerCapsLocked does upstream as of 0eb38dc2e — makes Funnel
+// impossible. Callers must therefore be limited to the ingress path.
+//
+// This is a fork-local patch; drop it once upstream restores Funnel.
+// See webnet/tailscale#16.
+func (nb *nodeBackend) PeerCapsIncludingUnsigned(src netip.Addr) tailcfg.PeerCapMap {
+	nb.mu.Lock()
+	defer nb.mu.Unlock()
+	return nb.peerCapsIgnoringSignatureLocked(src)
+}
+
 func (nb *nodeBackend) peerCapsLocked(src netip.Addr) tailcfg.PeerCapMap {
+	if nb.srcIsUnsignedPeerLocked(src) {
+		return nil
+	}
+	return nb.peerCapsIgnoringSignatureLocked(src)
+}
+
+func (nb *nodeBackend) peerCapsIgnoringSignatureLocked(src netip.Addr) tailcfg.PeerCapMap {
 	if nb.netMap == nil {
 		return nil
 	}
@@ -317,6 +479,52 @@ func (nb *nodeBackend) peerCapsLocked(src netip.Addr) tailcfg.PeerCapMap {
 	return nil
 }
 
+// PeerCapsForIP returns the capabilities that remote src IP has when
+// talking to the given destination IP on this node. The destination may
+// be any IP the node handles: its own tailnet address, a VIP service
+// address, or any future routable IP.
+func (nb *nodeBackend) PeerCapsForIP(src, dst netip.Addr) tailcfg.PeerCapMap {
+	nb.mu.Lock()
+	defer nb.mu.Unlock()
+	if nb.srcIsUnsignedPeerLocked(src) {
+		return nil
+	}
+	if nb.netMap == nil {
+		return nil
+	}
+	filt := nb.filterAtomic.Load()
+	if filt == nil {
+		return nil
+	}
+	return filt.CapsWithValues(src, dst)
+}
+
+// PeerCapsForService returns the capabilities that remote src IP has when
+// talking to the named VIP service on this node. The service name is
+// resolved to its VIP addresses via the node's service IP mappings, and
+// the first address matching the src IP family is used for cap lookup.
+func (nb *nodeBackend) PeerCapsForService(src netip.Addr, svcName tailcfg.ServiceName) tailcfg.PeerCapMap {
+	nb.mu.Lock()
+	defer nb.mu.Unlock()
+	if nb.srcIsUnsignedPeerLocked(src) {
+		return nil
+	}
+	if nb.netMap == nil {
+		return nil
+	}
+	filt := nb.filterAtomic.Load()
+	if filt == nil {
+		return nil
+	}
+	addrs := nb.netMap.GetVIPServiceIPMap()[svcName]
+	for _, ip := range addrs {
+		if ip.BitLen() == src.BitLen() {
+			return filt.CapsWithValues(src, ip)
+		}
+	}
+	return nil
+}
+
 // PeerHasCap reports whether the peer contains the given capability string,
 // with any value(s).
 func (nb *nodeBackend) PeerHasCap(peer tailcfg.NodeView, wantCap tailcfg.PeerCapability) bool {
@@ -351,10 +559,37 @@ func (nb *nodeBackend) PeerAPIBase(p tailcfg.NodeView) string {
 	return peerAPIBase(nm, p)
 }
 
-// PeerIsReachable reports whether the current node can reach p. If the ctx is
-// done, this function may return a result based on stale reachability data.
-func (nb *nodeBackend) PeerIsReachable(ctx context.Context, p tailcfg.NodeView) bool {
-	if !nb.SelfHasCap(tailcfg.NodeAttrClientSideReachability) {
+// RouteCheckReport is an interface that reports whether a peer is reachable by the current node.
+type RouteCheckReport interface {
+	// IsReachable reports whether a peer is reachable by the current node.
+	IsReachable(tailcfg.NodeID) peernode.Reachability
+}
+
+// PeerIsReachable reports whether the current node can reach p.
+// This function may return a result based on stale reachability data,
+// either from the control plane or because the latest routecheck report is old.
+// If rp is nil, then this will report whether p is connected to the control plane
+// according to [tailcfg.NodeView.Online].
+//
+// The latest routecheck report will be considered if the current node has both
+// [tailcfg.NodeAttrClientSideReachability] and [tailcfg.NodeAttrClientSideReachabilityRouteCheck]
+// in its CapMap.
+func (nb *nodeBackend) PeerIsReachable(rp RouteCheckReport, p tailcfg.NodeView) bool {
+	nb.mu.Lock()
+	nm := nb.netMap
+	nb.mu.Unlock()
+
+	if nm == nil || !p.Valid() {
+		// If there is no netmap, then how did we get a NodeView?
+		// Assuming that p came from the control plane,
+		// report whether it was connected to tailcontrol.
+		return p.Valid() && p.Online().Get()
+	}
+
+	self := nm.SelfNode
+	useRouteCheck := isRouteCheckEnabled(self)
+
+	if !useRouteCheck && !self.HasCap(tailcfg.NodeAttrClientSideReachability) {
 		// Legacy behavior is to always trust the control plane, which
 		// isn’t always correct because the peer could be slow to check
 		// in so that control marks it as offline.
@@ -362,27 +597,34 @@ func (nb *nodeBackend) PeerIsReachable(ctx context.Context, p tailcfg.NodeView)
 		return p.Online().Get()
 	}
 
-	nb.mu.Lock()
-	nm := nb.netMap
-	nb.mu.Unlock()
-
-	if self := nm.SelfNode; self.Valid() && self.ID() == p.ID() {
+	if self.Valid() && self.ID() == p.ID() {
 		// This node can always reach itself.
 		return true
 	}
-	return nb.peerIsReachable(ctx, p)
-}
 
-func (nb *nodeBackend) peerIsReachable(ctx context.Context, p tailcfg.NodeView) bool {
-	// TODO(sfllaw): The following does not actually test for client-side
-	// reachability. This would require a mechanism that tracks whether the
-	// current node can actually reach this peer, either because they are
-	// already communicating or because they can ping each other.
-	//
-	// Instead, it makes the client ignore p.Online completely.
-	//
-	// See tailscale/corp#32686.
-	return true
+	if !useRouteCheck && !self.HasCap(tailcfg.NodeAttrClientSideReachabilityRouteCheck) {
+		// TODO(sfllaw): The following does not actually test for client-side
+		// reachability. This would require a mechanism that tracks whether the
+		// current node can actually reach this peer, either because they are
+		// already communicating or because they can ping each other.
+		//
+		// Instead, it makes the client ignore p.Online completely.
+		//
+		// See tailscale/corp#32686.
+		return true
+	}
+
+	if rp == nil {
+		// The routecheck report hasn’t been collected yet,
+		// so fall back and report whether it was connected to tailcontrol.
+		return p.Online().Get()
+	}
+	r := rp.IsReachable(p.ID())
+	if r == peernode.Unknown {
+		// Reachability is unknown, because the node is a new router, so fall back.
+		return p.Online().Get()
+	}
+	return r.IsReachable()
 }
 
 func nodeIP(n tailcfg.NodeView, pred func(netip.Addr) bool) netip.Addr {
@@ -411,21 +653,71 @@ func (nb *nodeBackend) netMapWithPeers() *netmap.NetworkMap {
 	slices.SortFunc(nm.Peers, func(a, b tailcfg.NodeView) int {
 		return cmp.Compare(a.ID(), b.ID())
 	})
+	nm.UserProfiles = maps.Clone(nb.userProfiles)
+	nm.PacketFilterRules = nb.packetFilterRules
+	nm.PacketFilter = nb.packetFilter
 	return nm
 }
 
-func (nb *nodeBackend) SetNetMap(nm *netmap.NetworkMap) {
+func (nb *nodeBackend) SetNetMap(nm *netmap.NetworkMap) (discoChanged []key.NodePublic, routeChanged routemanager.PeersWithRouteChanges) {
 	nb.mu.Lock()
 	defer nb.mu.Unlock()
 	nb.netMap = nm
 	nb.updateNodeByAddrLocked()
 	nb.updateNodeByKeyLocked()
-	nb.updatePeersLocked()
+	nb.updateNodeByStableIDLocked()
+	nb.updateNodeByNameLocked()
+	discoChanged, routeChanged = nb.updatePeersLocked()
+	nb.signalKeyWaitersForTestLocked()
 	if nm != nil {
+		nb.userProfiles = maps.Clone(nm.UserProfiles)
+		nb.packetFilterRules = nm.PacketFilterRules
+		nb.packetFilter = nm.PacketFilter
 		nb.derpMapViewPub.Publish(nm.DERPMap.View())
 	} else {
+		nb.userProfiles = nil
+		nb.packetFilterRules = views.Slice[tailcfg.FilterRule]{}
+		nb.packetFilter = nil
 		nb.derpMapViewPub.Publish(tailcfg.DERPMapView{})
 	}
+	return discoChanged, routeChanged
+}
+
+// AwaitNodeKeyForTest returns a channel that is closed once a peer with the
+// given node key first appears in this nodeBackend's peer index, or
+// immediately (a closed channel) if it's already present. It is intended for
+// in-process benchmarks that drive synthetic netmap deltas and need a
+// zero-overhead signal that the client has applied a delta, replacing
+// poll-based [local.Client.WhoIsNodeKey] loops in tests. It panics outside
+// of tests.
+func (nb *nodeBackend) AwaitNodeKeyForTest(k key.NodePublic) <-chan struct{} {
+	testenv.AssertInTest()
+	nb.mu.Lock()
+	defer nb.mu.Unlock()
+	if _, ok := nb.nodeByKey[k]; ok {
+		return syncs.ClosedChan()
+	}
+	if ch, ok := nb.keyWaitersForTest[k]; ok {
+		return ch
+	}
+	ch := make(chan struct{})
+	mak.Set(&nb.keyWaitersForTest, k, ch)
+	return ch
+}
+
+// signalKeyWaitersForTestLocked closes any waiter channels whose keys now
+// appear in nb.nodeByKey. It is cheap when there are no waiters, which is
+// the common case in production. It is called from [nodeBackend.SetNetMap]
+// after the per-key index has been rebuilt.
+//
+// Caller must hold nb.mu.
+func (nb *nodeBackend) signalKeyWaitersForTestLocked() {
+	for k, ch := range nb.keyWaitersForTest {
+		if _, ok := nb.nodeByKey[k]; ok {
+			close(ch)
+			delete(nb.keyWaitersForTest, k)
+		}
+	}
 }
 
 func (nb *nodeBackend) updateNodeByAddrLocked() {
@@ -435,110 +727,456 @@ func (nb *nodeBackend) updateNodeByAddrLocked() {
 		return
 	}
 
-	// Update the nodeByAddr index.
-	if nb.nodeByAddr == nil {
-		nb.nodeByAddr = map[netip.Addr]tailcfg.NodeID{}
-	}
-	// First pass, mark everything unwanted.
-	for k := range nb.nodeByAddr {
-		nb.nodeByAddr[k] = 0
-	}
-	addNode := func(n tailcfg.NodeView) {
+	addNodeAddr := func(n tailcfg.NodeView) {
 		for _, ipp := range n.Addresses().All() {
 			if ipp.IsSingleIP() {
 				nb.nodeByAddr[ipp.Addr()] = n.ID()
 			}
 		}
 	}
-	if nm.SelfNode.Valid() {
-		addNode(nm.SelfNode)
-	}
-	for _, p := range nm.Peers {
-		addNode(p)
-	}
-	// Third pass, actually delete the unwanted items.
-	for k, v := range nb.nodeByAddr {
-		if v == 0 {
-			delete(nb.nodeByAddr, k)
+	mapx.RepopulateNonzero(&nb.nodeByAddr, func() {
+		if nm.SelfNode.Valid() {
+			addNodeAddr(nm.SelfNode)
 		}
-	}
+		for _, p := range nm.Peers {
+			addNodeAddr(p)
+		}
+	})
 }
 
 func (nb *nodeBackend) updateNodeByKeyLocked() {
 	nm := nb.netMap
 	if nm == nil {
 		nb.nodeByKey = nil
+		nb.nodeByWGString = nil
 		return
 	}
 
-	if nb.nodeByKey == nil {
-		nb.nodeByKey = map[key.NodePublic]tailcfg.NodeID{}
-	}
-	// First pass, mark everything unwanted.
-	for k := range nb.nodeByKey {
-		nb.nodeByKey[k] = 0
-	}
-	addNode := func(n tailcfg.NodeView) {
-		nb.nodeByKey[n.Key()] = n.ID()
-	}
-	if nm.SelfNode.Valid() {
-		addNode(nm.SelfNode)
-	}
-	for _, p := range nm.Peers {
-		addNode(p)
-	}
-	// Third pass, actually delete the unwanted items.
-	for k, v := range nb.nodeByKey {
-		if v == 0 {
-			delete(nb.nodeByKey, k)
+	mapx.RepopulateNonzero(&nb.nodeByKey, func() {
+		if nm.SelfNode.Valid() {
+			nb.nodeByKey[nm.SelfNode.Key()] = nm.SelfNode.ID()
 		}
-	}
+		for _, p := range nm.Peers {
+			nb.nodeByKey[p.Key()] = p.ID()
+		}
+	})
+	mapx.RepopulateNonzero(&nb.nodeByWGString, func() {
+		if nm.SelfNode.Valid() {
+			nb.nodeByWGString[nm.SelfNode.Key().WireGuardGoString()] = nm.SelfNode.ID()
+		}
+		for _, p := range nm.Peers {
+			nb.nodeByWGString[p.Key().WireGuardGoString()] = p.ID()
+		}
+	})
 }
 
-func (nb *nodeBackend) updatePeersLocked() {
+func (nb *nodeBackend) updateNodeByStableIDLocked() {
 	nm := nb.netMap
 	if nm == nil {
-		nb.peers = nil
+		nb.nodeByStableID = nil
 		return
 	}
 
-	// First pass, mark everything unwanted.
-	for k := range nb.peers {
-		nb.peers[k] = tailcfg.NodeView{}
-	}
-
-	// Second pass, add everything wanted.
-	for _, p := range nm.Peers {
-		mak.Set(&nb.peers, p.ID(), p)
-	}
-
-	// Third pass, remove deleted things.
-	for k, v := range nb.peers {
-		if !v.Valid() {
-			delete(nb.peers, k)
+	mapx.RepopulateNonzero(&nb.nodeByStableID, func() {
+		for _, p := range nm.Peers {
+			nb.nodeByStableID[p.StableID()] = p.ID()
 		}
+	})
+}
+
+// addNodeNameLocked adds both the FQDN and short-name keys for the given
+// node to nb.nodeByName. nb.mu must be held.
+func (nb *nodeBackend) addNodeNameLocked(name string, nid tailcfg.NodeID) {
+	if name == "" {
+		// We might support name-less nodes in the future; tailscale/corp#43949
+		return
+	}
+	canon := strings.ToLower(strings.TrimSuffix(name, "."))
+	mak.Set(&nb.nodeByName, canon, nid)
+	if suffix := nb.netMap.MagicDNSSuffix(); dnsname.HasSuffix(canon, suffix) {
+		mak.Set(&nb.nodeByName, dnsname.TrimSuffix(canon, suffix), nid)
 	}
 }
 
-func (nb *nodeBackend) UpdateNetmapDelta(muts []netmap.NodeMutation) (handled bool) {
+// removeNodeNameLocked removes both the FQDN and short-name keys for the
+// given node from nb.nodeByName. nb.mu must be held.
+func (nb *nodeBackend) removeNodeNameLocked(name string) {
+	if name == "" {
+		// We might support name-less nodes in the future; tailscale/corp#43949
+		return
+	}
+	canon := strings.ToLower(strings.TrimSuffix(name, "."))
+	delete(nb.nodeByName, canon)
+	if suffix := nb.netMap.MagicDNSSuffix(); dnsname.HasSuffix(canon, suffix) {
+		delete(nb.nodeByName, dnsname.TrimSuffix(canon, suffix))
+	}
+}
+
+func (nb *nodeBackend) updateNodeByNameLocked() {
+	nm := nb.netMap
+	if nm == nil {
+		nb.nodeByName = nil
+		nb.extraDNS = nil
+		return
+	}
+
+	mapx.RepopulateNonzero(&nb.nodeByName, func() {
+		if nm.SelfNode.Valid() {
+			nb.addNodeNameLocked(nm.SelfNode.Name(), nm.SelfNode.ID())
+		}
+		for _, p := range nm.Peers {
+			nb.addNodeNameLocked(p.Name(), p.ID())
+		}
+	})
+
+	// Rebuild extraDNS from DNS.ExtraRecords (service VIPs, etc).
+	nb.extraDNS = nil
+	for _, rec := range nm.DNS.ExtraRecords {
+		if rec.Type != "" {
+			continue
+		}
+		ip, err := netip.ParseAddr(rec.Value)
+		if err != nil {
+			continue
+		}
+		mak.Set(&nb.extraDNS, strings.ToLower(strings.TrimSuffix(rec.Name, ".")), ip)
+	}
+}
+
+// NodeByName returns the node ID for a MagicDNS hostname. The input
+// must be lowercase with no trailing dot; both short names ("foo") and
+// FQDNs ("foo.tail-scale.ts.net") are accepted.
+func (nb *nodeBackend) NodeByName(hostname string) (_ tailcfg.NodeID, ok bool) {
 	nb.mu.Lock()
 	defer nb.mu.Unlock()
-	if nb.netMap == nil || len(nb.peers) == 0 {
+	nid, ok := nb.nodeByName[hostname]
+	return nid, ok
+}
+
+// ExtraDNSByName returns the IP for a DNS.ExtraRecords entry (e.g. service VIPs).
+func (nb *nodeBackend) ExtraDNSByName(hostname string) (_ netip.Addr, ok bool) {
+	nb.mu.Lock()
+	defer nb.mu.Unlock()
+	ip, ok := nb.extraDNS[hostname]
+	return ip, ok
+}
+
+func (nb *nodeBackend) updatePeersLocked() (discoChanged []key.NodePublic, routeChanged routemanager.PeersWithRouteChanges) {
+	nm := nb.netMap
+	oldIDs := slices.Collect(maps.Keys(nb.peers))
+
+	// Snapshot the previous disco keys (by node key) before the peers
+	// map is repopulated, to detect restarted peers below.
+	var prevDisco map[key.NodePublic]key.DiscoPublic
+	for _, p := range nb.peers {
+		if !p.DiscoKey().IsZero() {
+			mak.Set(&prevDisco, p.Key(), p.DiscoKey())
+		}
+	}
+
+	if nm == nil {
+		nb.peers = nil
+	} else {
+		mapx.RepopulateNonzero(&nb.peers, func() {
+			for _, p := range nm.Peers {
+				nb.peers[p.ID()] = p
+			}
+		})
+	}
+
+	for _, p := range nb.peers {
+		if prev, ok := prevDisco[p.Key()]; ok && nb.discoChangedLocked(p.Key(), prev, p.DiscoKey()) {
+			discoChanged = append(discoChanged, p.Key())
+		}
+	}
+	// Drop TSMP-learned disco keys for peers no longer in the netmap.
+	for k := range nb.tsmpLearnedDisco {
+		if _, ok := nb.nodeByKey[k]; !ok {
+			delete(nb.tsmpLearnedDisco, k)
+		}
+	}
+
+	// Resync the route manager to the new peer set. Upserts of
+	// unchanged peers are cheap no-ops; this is a full-netmap event,
+	// so O(n) work is expected here.
+	rt := nb.routeMgr.Begin()
+	for _, id := range oldIDs {
+		if _, ok := nb.peers[id]; !ok {
+			rt.RemovePeer(id)
+		}
+	}
+	for _, p := range nb.peers {
+		rt.UpsertPeer(p)
+	}
+	res := rt.Commit()
+	return discoChanged, res.AllowedIPs
+}
+
+// recordTSMPLearnedDisco notes that a peer's new disco key was learned via
+// TSMP, so the netmap update carrying the same change need not reset the
+// peer's WireGuard session. See the [nodeBackend.tsmpLearnedDisco] field doc.
+func (nb *nodeBackend) recordTSMPLearnedDisco(pub key.NodePublic, disco key.DiscoPublic) {
+	nb.mu.Lock()
+	defer nb.mu.Unlock()
+	mak.Set(&nb.tsmpLearnedDisco, pub, disco)
+}
+
+// discoChangedLocked reports whether a peer's disco key change from prev to
+// cur should reset the peer's WireGuard session. A changed disco key means
+// the peer restarted, so any existing session key material is dead weight;
+// resetting lets the handshake start over immediately. The exception is a
+// key change already learned via TSMP: that arrived over a working WireGuard
+// session with the peer, so the session is demonstrably fine and is kept.
+//
+// It consumes any [nodeBackend.tsmpLearnedDisco] entry for pub.
+// nb.mu must be held.
+func (nb *nodeBackend) discoChangedLocked(pub key.NodePublic, prev, cur key.DiscoPublic) bool {
+	if prev.IsZero() || cur.IsZero() || prev == cur {
 		return false
 	}
+	if discoTSMP, ok := nb.tsmpLearnedDisco[pub]; ok {
+		delete(nb.tsmpLearnedDisco, pub)
+		if discoTSMP == cur {
+			nb.logf("nodeBackend: skipping WireGuard session reset (TSMP key): %s changed from %q to %q",
+				pub.ShortString(), prev, cur)
+			return false
+		}
+		// The new disco key does not match what we received via
+		// TSMP for this peer. This is unexpected, though possible
+		// if processing a change in a large netmap ends up taking
+		// longer than the 2 second timeout in
+		// [controlclient.mapRoutineState.UpdateNetmapDelta], or if
+		// the context is cancelled mid update. Log the event, and reset
+		// the session as it is possibly a stale entry in the map
+		// instead of a TSMP disco key update that led us here.
+		nb.logf("nodeBackend: [unexpected] using TSMP key for %s (control stale): tsmp=%q control=%q old=%q",
+			pub.ShortString(), discoTSMP, cur, prev)
+		metricTSMPLearnedKeyMismatch.Add(1)
+	}
+	nb.logf("nodeBackend: peer %s disco key changed from %q to %q", pub.ShortString(), prev, cur)
+	return true
+}
+
+// routePrefs is the subset of routing-relevant prefs (and derived
+// state) that [nodeBackend.updateRouteManagerPrefs] pushes into the
+// RouteManager.
+type routePrefs struct {
+	// ExitNodeID is the stable node ID of the selected exit node, or
+	// zero if none is selected.
+	ExitNodeID tailcfg.StableNodeID
+
+	// ExitNodeSelected is whether the prefs select any exit node at
+	// all, even one that doesn't resolve (e.g. an ExitNodeIP that
+	// never resolved to an ExitNodeID); it mirrors
+	// routerConfigLocked's blackhole condition.
+	ExitNodeSelected bool
+
+	// RouteAll is whether advertised subnet routes from peers are
+	// accepted.
+	RouteAll bool
+
+	// OneCGNAT is whether the OS route set should collapse peers'
+	// CGNAT addresses into the single /10 route.
+	OneCGNAT bool
+}
+
+// updateRouteManagerPrefs pushes p into the route manager.
+//
+// It returns the peers whose allowed source prefixes changed as a
+// result, for example the old and new exit node when the selection
+// changes.
+func (nb *nodeBackend) updateRouteManagerPrefs(p routePrefs) routemanager.PeersWithRouteChanges {
+	nb.mu.Lock()
+	defer nb.mu.Unlock()
+	var exitID tailcfg.NodeID
+	if !p.ExitNodeID.IsZero() {
+		// The lookup can miss: the selected exit node may not exist,
+		// or may be a placeholder like MDM's "auto:any" awaiting
+		// resolution. ExitNodeSelected then makes the RouteManager
+		// blackhole internet traffic rather than treat it as "no
+		// exit node"; see [routemanager.Prefs.ExitNodeSelected].
+		exitID = nb.nodeByStableID[p.ExitNodeID]
+	}
+	rt := nb.routeMgr.Begin()
+	rt.SetPrefs(routemanager.Prefs{
+		ExitNodeID:       exitID,
+		ExitNodeSelected: p.ExitNodeSelected,
+		RouteAll:         p.RouteAll,
+	})
+	rt.SetTailnetConfig(routemanager.TailnetConfig{OneCGNAT: p.OneCGNAT})
+	res := rt.Commit()
+	return res.AllowedIPs
+}
+
+// updateRouteManagerExtras pushes extra WireGuard-only allowed IPs
+// into the route manager, obtained by calling fn (the
+// [ipnext.Hooks.ExtraWireGuardAllowedIPs] hook) with a sequence of
+// the current peers.
+//
+// It returns the peers whose allowed source prefixes changed as a
+// result.
+func (nb *nodeBackend) updateRouteManagerExtras(fn func(peers iter.Seq2[tailcfg.NodeID, key.NodePublic]) map[tailcfg.NodeID][]netip.Prefix) routemanager.PeersWithRouteChanges {
+	nb.mu.Lock()
+	defer nb.mu.Unlock()
+	extras := fn(func(yield func(tailcfg.NodeID, key.NodePublic) bool) {
+		for id, p := range nb.peers {
+			if !yield(id, p.Key()) {
+				return
+			}
+		}
+	})
+	rt := nb.routeMgr.Begin()
+	rt.SetExtraAllowedIPs(extras)
+	res := rt.Commit()
+	return res.AllowedIPs
+}
+
+// osRoutes returns the sorted set of prefixes that the route manager
+// wants programmed into the OS routing table.
+func (nb *nodeBackend) osRoutes() []netip.Prefix {
+	var routes []netip.Prefix
+	for pfx := range nb.routeMgr.OSRoutes().All() {
+		routes = append(routes, pfx)
+	}
+	tsaddr.SortPrefixes(routes)
+	return routes
+}
+
+// setPacketFilter stores the live packet filter rules and parsed
+// matches. It does not touch the frozen netMap. nb.mu is acquired by
+// this method.
+func (nb *nodeBackend) setPacketFilter(rules views.Slice[tailcfg.FilterRule], parsed []filter.Match) {
+	nb.mu.Lock()
+	defer nb.mu.Unlock()
+	nb.packetFilterRules = rules
+	nb.packetFilter = parsed
+}
+
+// PacketFilter returns the current live packet filter matches.
+func (nb *nodeBackend) PacketFilter() []filter.Match {
+	nb.mu.Lock()
+	defer nb.mu.Unlock()
+	return nb.packetFilter
+}
+
+// mergeUserProfiles merges new/updated [tailcfg.UserProfileView]
+// entries into the live userProfiles map. It does not touch
+// netMap.UserProfiles (which is frozen once set). Callers must hold
+// [LocalBackend.mu]. nb.mu is acquired by this method.
+func (nb *nodeBackend) mergeUserProfiles(profiles map[tailcfg.UserID]tailcfg.UserProfileView) {
+	nb.mu.Lock()
+	defer nb.mu.Unlock()
+	for id, up := range profiles {
+		mak.Set(&nb.userProfiles, id, up)
+	}
+}
+
+// netmapDeltaResult describes the side effects of applying netmap
+// delta mutations that the caller must propagate.
+type netmapDeltaResult struct {
+	// ChangedAllowedIPs are the peers whose allowed source prefixes
+	// changed; the caller syncs those peers to the WireGuard device.
+	ChangedAllowedIPs routemanager.PeersWithRouteChanges
+
+	// DiscoChanged is the set of peers whose disco key changed in a
+	// way that requires a WireGuard session reset (see
+	// [nodeBackend.discoChangedLocked]).
+	DiscoChanged set.Set[key.NodePublic]
+}
+
+// UpdateNetmapDelta applies the given netmap mutations to the live
+// peer state. It returns the side effects for the caller to
+// propagate, and reports whether it handled all of the mutations.
+func (nb *nodeBackend) UpdateNetmapDelta(muts []netmap.NodeMutation) (res netmapDeltaResult, handled bool) {
+	nb.mu.Lock()
+	defer nb.mu.Unlock()
+	if nb.netMap == nil {
+		return res, false
+	}
 
 	// Locally cloned mutable nodes, to avoid calling AsStruct (clone)
 	// multiple times on a node if it's mutated multiple times in this
 	// call (e.g. its endpoints + online status both change)
 	var mutableNodes map[tailcfg.NodeID]*tailcfg.Node
 
+	// Mirror peer add/remove mutations into the route manager.
+	// The Commit is unconditional (even if we panic or return false)
+	// to stay in sync with the peers map, which is likewise mutated
+	// in place as the loop runs. And if we return false, we'll just
+	// get a full netmap soon and reset all our state anyway.
+	rt := nb.routeMgr.Begin()
+	defer func() {
+		res.ChangedAllowedIPs = rt.Commit().AllowedIPs
+	}()
+
 	for _, m := range muts {
-		n, ok := mutableNodes[m.NodeIDBeingMutated()]
+		switch m := m.(type) {
+		case netmap.NodeMutationUpsert:
+			nid := m.Node.ID()
+			if old, ok := nb.peers[nid]; ok {
+				if old.Key() == m.Node.Key() {
+					if nb.discoChangedLocked(m.Node.Key(), old.DiscoKey(), m.Node.DiscoKey()) {
+						res.DiscoChanged.Make()
+						res.DiscoChanged.Add(m.Node.Key())
+					}
+				} else {
+					delete(nb.tsmpLearnedDisco, old.Key())
+				}
+				// Evict index entries derived from the old node value
+				// before re-adding them from the new one below, so a
+				// changed name, address, or key doesn't leave a stale
+				// entry behind. Notably, a node rename in the admin
+				// console arrives as an upsert with a new Name, and a
+				// stale nodeByName entry would keep serving MagicDNS
+				// answers for the old name (tailscale/corp#45631).
+				for _, ipp := range old.Addresses().All() {
+					if ipp.IsSingleIP() {
+						delete(nb.nodeByAddr, ipp.Addr())
+					}
+				}
+				delete(nb.nodeByKey, old.Key())
+				delete(nb.nodeByWGString, old.Key().WireGuardGoString())
+				delete(nb.nodeByStableID, old.StableID())
+				nb.removeNodeNameLocked(old.Name())
+			}
+			mak.Set(&nb.peers, nid, m.Node)
+			for _, ipp := range m.Node.Addresses().All() {
+				if ipp.IsSingleIP() {
+					mak.Set(&nb.nodeByAddr, ipp.Addr(), nid)
+				}
+			}
+			mak.Set(&nb.nodeByKey, m.Node.Key(), nid)
+			mak.Set(&nb.nodeByWGString, m.Node.Key().WireGuardGoString(), nid)
+			mak.Set(&nb.nodeByStableID, m.Node.StableID(), nid)
+			nb.addNodeNameLocked(m.Node.Name(), nid)
+			rt.UpsertPeer(m.Node)
+			continue
+		case netmap.NodeMutationRemove:
+			nid := m.NodeIDBeingMutated()
+			if old, ok := nb.peers[nid]; ok {
+				for _, ipp := range old.Addresses().All() {
+					if ipp.IsSingleIP() {
+						delete(nb.nodeByAddr, ipp.Addr())
+					}
+				}
+				delete(nb.nodeByKey, old.Key())
+				delete(nb.nodeByWGString, old.Key().WireGuardGoString())
+				delete(nb.nodeByStableID, old.StableID())
+				delete(nb.tsmpLearnedDisco, old.Key())
+				nb.removeNodeNameLocked(old.Name())
+				delete(nb.peers, nid)
+				rt.RemovePeer(nid)
+			}
+			continue
+		}
+		// Per-field mutation.
+		nid := m.NodeIDBeingMutated()
+		n, ok := mutableNodes[nid]
 		if !ok {
-			nv, ok := nb.peers[m.NodeIDBeingMutated()]
+			nv, ok := nb.peers[nid]
 			if !ok {
 				// TODO(bradfitz): unexpected metric?
-				return false
+				return res, false
 			}
 			n = nv.AsStruct()
 			mak.Set(&mutableNodes, nv.ID(), n)
@@ -548,7 +1186,8 @@ func (nb *nodeBackend) UpdateNetmapDelta(muts []netmap.NodeMutation) (handled bo
 	for nid, n := range mutableNodes {
 		nb.peers[nid] = n.View()
 	}
-	return true
+	nb.signalKeyWaitersForTestLocked()
+	return res, true
 }
 
 // unlockedNodesPermitted reports whether any peer with theUnsignedPeerAPIOnly bool set true has any of its allowed IPs
@@ -571,10 +1210,137 @@ func (nb *nodeBackend) setFilter(f *filter.Filter) {
 	nb.filterAtomic.Store(f)
 }
 
-func (nb *nodeBackend) dnsConfigForNetmap(prefs ipn.PrefsView, selfExpired bool, versionOS string) *dns.Config {
+func (nb *nodeBackend) dnsConfigForNetmap(prefs ipn.PrefsView, selfExpired bool, goos string) *dns.Config {
 	nb.mu.Lock()
 	defer nb.mu.Unlock()
-	return dnsConfigForNetmap(nb.netMap, nb.peers, prefs, selfExpired, nb.logf, versionOS)
+	return dnsConfigForNetmap(nb.netMap, nb.peers, prefs, selfExpired, nb.logf, goos)
+}
+
+// magicDNSHostAddrs returns the MagicDNS A/AAAA answer for fqdn from
+// the live node indexes, and whether the name is known. It backs
+// [resolver.MagicDNSHosts.LookupHost], replacing the full
+// dns.Config.Hosts map so that netmap deltas need no per-peer DNS
+// rebuild.
+func (nb *nodeBackend) magicDNSHostAddrs(fqdn dnsname.FQDN) (ips []netip.Addr, ok bool) {
+	if !buildfeatures.HasDNS {
+		return nil, false
+	}
+	nb.mu.Lock()
+	defer nb.mu.Unlock()
+	n, ok := nb.nodeByFQDNLocked(fqdn)
+	if !ok || n.Addresses().Len() == 0 {
+		return nil, false
+	}
+	nm := nb.netMap
+	var flags magicDNSAddrsFlags
+	if nm.GetAddresses().ContainsFunc(tsaddr.PrefixIs6) &&
+		!nm.GetAddresses().ContainsFunc(tsaddr.PrefixIs4) {
+		flags |= selfV6Only
+	}
+	if nm.AllCaps.Contains(tailcfg.NodeAttrMagicDNSPeerAAAA) {
+		flags |= wantAAAA
+	}
+	return magicDNSAddrs(n.Addresses(), flags), true
+}
+
+// magicDNSPTR returns the MagicDNS name of the node (peer or self)
+// that owns ip, backing [resolver.MagicDNSHosts.LookupPTR].
+func (nb *nodeBackend) magicDNSPTR(ip netip.Addr) (_ dnsname.FQDN, ok bool) {
+	if !buildfeatures.HasDNS {
+		return "", false
+	}
+	nb.mu.Lock()
+	defer nb.mu.Unlock()
+	nid, ok := nb.nodeByAddr[ip]
+	if !ok {
+		return "", false
+	}
+	n, ok := nb.nodeByIDLocked(nid)
+	if !ok {
+		return "", false
+	}
+	fqdn, err := dnsname.ToFQDN(n.Name())
+	if err != nil {
+		return "", false
+	}
+	return fqdn, true
+}
+
+// magicDNSSubdomainHost reports whether fqdn names a node with the
+// [tailcfg.NodeAttrDNSSubdomainResolve] attribute, backing
+// [resolver.MagicDNSHosts.SubdomainHost].
+func (nb *nodeBackend) magicDNSSubdomainHost(fqdn dnsname.FQDN) bool {
+	if !buildfeatures.HasDNS {
+		return false
+	}
+	nb.mu.Lock()
+	defer nb.mu.Unlock()
+	n, ok := nb.nodeByFQDNLocked(fqdn)
+	if !ok {
+		return false
+	}
+	if nm := nb.netMap; nm != nil && nm.SelfNode.Valid() && nm.SelfNode.ID() == n.ID() {
+		return nm.AllCaps.Contains(tailcfg.NodeAttrDNSSubdomainResolve)
+	}
+	return n.CapMap().Contains(tailcfg.NodeAttrDNSSubdomainResolve)
+}
+
+// nodeByFQDNLocked returns the node (peer or self) with the given
+// MagicDNS FQDN. nb.mu must be held.
+func (nb *nodeBackend) nodeByFQDNLocked(fqdn dnsname.FQDN) (_ tailcfg.NodeView, ok bool) {
+	// The resolver already lowercases query names, but lowercase
+	// again (nearly free when already lowercase) so that no other
+	// caller of the [resolver.MagicDNSHosts] hook can miss on case.
+	nid, ok := nb.nodeByName[strings.ToLower(strings.TrimSuffix(string(fqdn), "."))]
+	if !ok {
+		return tailcfg.NodeView{}, false
+	}
+	return nb.nodeByIDLocked(nid)
+}
+
+// magicDNSAddrsFlags is a bitmask of flags for magicDNSAddrs.
+type magicDNSAddrsFlags uint8
+
+const (
+	selfV6Only magicDNSAddrsFlags = 1 << iota // the querying node has only IPv6 addresses
+	wantAAAA                                  // include IPv6 addresses even for nodes that also have IPv4
+)
+
+// magicDNSAddrs returns the MagicDNS answer addresses for a node
+// owning the given addresses: all of its IPv6 addresses if this node
+// (the querier) is IPv6-only, otherwise everything except the node's
+// IPv6 addresses when it also has IPv4, unless wantAAAA. The result
+// may be empty (name exists, no records of the desired family).
+func magicDNSAddrs(addrs views.Slice[netip.Prefix], flags magicDNSAddrsFlags) (ips []netip.Addr) {
+	wantAAAA := flags&wantAAAA != 0
+	selfV6Only := flags&selfV6Only != 0
+	var have4 bool
+	for _, addr := range addrs.All() {
+		if addr.Addr().Is4() {
+			have4 = true
+			break
+		}
+	}
+	for _, addr := range addrs.All() {
+		if selfV6Only {
+			if addr.Addr().Is6() {
+				ips = append(ips, addr.Addr())
+			}
+			continue
+		}
+		// If this node has an IPv4 address, then remove peers'
+		// IPv6 addresses for now, as we don't guarantee that
+		// the peer node actually can speak IPv6 correctly.
+		//
+		// https://github.com/tailscale/tailscale/issues/1152
+		// tracks adding the right capability reporting to
+		// enable AAAA in MagicDNS.
+		if addr.Addr().Is6() && have4 && !wantAAAA {
+			continue
+		}
+		ips = append(ips, addr.Addr())
+	}
+	return ips
 }
 
 func (nb *nodeBackend) exitNodeCanProxyDNS(exitNodeID tailcfg.StableNodeID) (dohURL string, ok bool) {
@@ -679,9 +1445,9 @@ func useWithExitNodeRoutes(routes map[string][]*dnstype.Resolver) map[string][]*
 // dnsConfigForNetmap returns a *dns.Config for the given netmap,
 // prefs, client OS version, and cloud hosting environment.
 //
-// The versionOS is a Tailscale-style version ("iOS", "macOS") and not
-// a runtime.GOOS.
-func dnsConfigForNetmap(nm *netmap.NetworkMap, peers map[tailcfg.NodeID]tailcfg.NodeView, prefs ipn.PrefsView, selfExpired bool, logf logger.Logf, versionOS string) *dns.Config {
+// The goos is runtime.GOOS usually, except in tests, where it may
+// vary to test any OS's behavior from any host.
+func dnsConfigForNetmap(nm *netmap.NetworkMap, peers map[tailcfg.NodeID]tailcfg.NodeView, prefs ipn.PrefsView, selfExpired bool, logf logger.Logf, goos string) *dns.Config {
 	if nm == nil {
 		return nil
 	}
@@ -707,70 +1473,40 @@ func dnsConfigForNetmap(nm *netmap.NetworkMap, peers map[tailcfg.NodeID]tailcfg.
 		Hosts:     map[dnsname.FQDN][]netip.Addr{},
 	}
 
-	// selfV6Only is whether we only have IPv6 addresses ourselves.
-	selfV6Only := nm.GetAddresses().ContainsFunc(tsaddr.PrefixIs6) &&
-		!nm.GetAddresses().ContainsFunc(tsaddr.PrefixIs4)
-	dcfg.OnlyIPv6 = selfV6Only
-
-	wantAAAA := nm.AllCaps.Contains(tailcfg.NodeAttrMagicDNSPeerAAAA)
-
-	// Populate MagicDNS records. We do this unconditionally so that
-	// quad-100 can always respond to MagicDNS queries, even if the OS
-	// isn't configured to make MagicDNS resolution truly
-	// magic. Details in
-	// https://github.com/tailscale/tailscale/issues/1886.
-	set := func(name string, addrs views.Slice[netip.Prefix]) {
-		if addrs.Len() == 0 || name == "" {
-			return
-		}
-		fqdn, err := dnsname.ToFQDN(name)
-		if err != nil {
-			return // TODO: propagate error?
-		}
-		var have4 bool
-		for _, addr := range addrs.All() {
-			if addr.Addr().Is4() {
-				have4 = true
-				break
-			}
-		}
-		var ips []netip.Addr
-		for _, addr := range addrs.All() {
-			if selfV6Only {
-				if addr.Addr().Is6() {
-					ips = append(ips, addr.Addr())
-				}
-				continue
-			}
-			// If this node has an IPv4 address, then
-			// remove peers' IPv6 addresses for now, as we
-			// don't guarantee that the peer node actually
-			// can speak IPv6 correctly.
-			//
-			// https://github.com/tailscale/tailscale/issues/1152
-			// tracks adding the right capability reporting to
-			// enable AAAA in MagicDNS.
-			if addr.Addr().Is6() && have4 && !wantAAAA {
-				continue
-			}
-			ips = append(ips, addr.Addr())
-		}
-		dcfg.Hosts[fqdn] = ips
+	var addrFlags magicDNSAddrsFlags
+	if nm.GetAddresses().ContainsFunc(tsaddr.PrefixIs6) &&
+		!nm.GetAddresses().ContainsFunc(tsaddr.PrefixIs4) {
+		// We only have IPv6 addresses ourselves.
+		addrFlags |= selfV6Only
+		dcfg.OnlyIPv6 = true
 	}
-	set(nm.SelfName(), nm.GetAddresses())
-	if nm.AllCaps.Contains(tailcfg.NodeAttrDNSSubdomainResolve) {
-		if fqdn, err := dnsname.ToFQDN(nm.SelfName()); err == nil {
-			dcfg.SubdomainHosts.Make()
-			dcfg.SubdomainHosts.Add(fqdn)
-		}
+	if nm.AllCaps.Contains(tailcfg.NodeAttrMagicDNSPeerAAAA) {
+		addrFlags |= wantAAAA
 	}
-	for _, peer := range peers {
-		set(peer.Name(), peer.Addresses())
-		if peer.CapMap().Contains(tailcfg.NodeAttrDNSSubdomainResolve) {
-			if fqdn, err := dnsname.ToFQDN(peer.Name()); err == nil {
-				dcfg.SubdomainHosts.Make()
-				dcfg.SubdomainHosts.Add(fqdn)
+
+	// Populate MagicDNS records. The internal quad-100 resolver pulls
+	// per-node records on demand from the live node indexes (see
+	// [nodeBackend.magicDNSHostAddrs]), so quad-100 can always respond
+	// to MagicDNS queries without dcfg.Hosts; details in
+	// https://github.com/tailscale/tailscale/issues/1886. dcfg.Hosts
+	// carries only what must be enumerable in full: control's
+	// DNS.ExtraRecords below, plus every node's records on Windows,
+	// whose hosts-file fallback path (see compileHostEntries in
+	// net/dns) needs the complete set.
+	if goos == "windows" {
+		set := func(name string, addrs views.Slice[netip.Prefix]) {
+			if addrs.Len() == 0 || name == "" {
+				return
 			}
+			fqdn, err := dnsname.ToFQDN(name)
+			if err != nil {
+				return // TODO: propagate error?
+			}
+			dcfg.Hosts[fqdn] = magicDNSAddrs(addrs, addrFlags)
+		}
+		set(nm.SelfName(), nm.GetAddresses())
+		for _, peer := range peers {
+			set(peer.Name(), peer.Addresses())
 		}
 	}
 	for _, rec := range nm.DNS.ExtraRecords {
@@ -808,6 +1544,14 @@ func dnsConfigForNetmap(nm *netmap.NetworkMap, peers map[tailcfg.NodeID]tailcfg.
 		for _, dom := range magicDNSRootDomains(nm) {
 			dcfg.Routes[dom] = nil // resolve internally with dcfg.Hosts
 		}
+	} else {
+		// Without MagicDNS domain routing, no Routes entry covers the
+		// node records served on demand via [magicDNSHosts]. Tell
+		// dns.Manager they exist, so it keeps quad-100 in the OS
+		// resolver path and the names still resolve, as they did when
+		// they were listed in dcfg.Hosts. Any netmap with a self node
+		// has such records.
+		dcfg.MagicDNSHostsUnrouted = nm.SelfNode.Valid()
 	}
 
 	addDefault := func(resolvers []*dnstype.Resolver) {
@@ -830,6 +1574,15 @@ func dnsConfigForNetmap(nm *netmap.NetworkMap, peers map[tailcfg.NodeID]tailcfg.
 		}
 	}
 
+	// conn25 split DNS routes are calculated from the domains in the SelfNode.CapMap
+	// section of the netmap, so need to be assembled separately.
+	// TODO(tailscale/corp#37125): make this a hook the extension can add
+	// to reduce dependency from ipnlocal to appc.
+	var conn25AppRoutes map[string][]*dnstype.Resolver
+	if (envknob.UseWIPCode() || testenv.InTest()) && buildfeatures.HasConn25 && !prefs.AppConnector().Advertise {
+		conn25AppRoutes = appc.AppDNSRoutes(nm.HasCap, nm.SelfNode)
+	}
+
 	// If we're using an exit node and that exit node is new enough (1.19.x+)
 	// to run a DoH DNS proxy, then send all our DNS traffic through it,
 	// unless we find resolvers with UseWithExitNode set, in which case we use that.
@@ -845,6 +1598,7 @@ func dnsConfigForNetmap(nm *netmap.NetworkMap, peers map[tailcfg.NodeID]tailcfg.
 			}
 
 			addSplitDNSRoutes(useWithExitNodeRoutes(nm.DNS.Routes))
+			addSplitDNSRoutes(useWithExitNodeRoutes(conn25AppRoutes))
 			return dcfg
 		}
 	}
@@ -862,25 +1616,7 @@ func dnsConfigForNetmap(nm *netmap.NetworkMap, peers map[tailcfg.NodeID]tailcfg.
 
 	// Add split DNS routes, with no regard to exit node configuration.
 	addSplitDNSRoutes(nm.DNS.Routes)
-
-	// Add split DNS routes for conn25
-	conn25DNSTargets := appc.PickSplitDNSPeers(nm.HasCap, nm.SelfNode, peers)
-	if conn25DNSTargets != nil {
-		var m map[string][]*dnstype.Resolver
-		for domain, candidateSplitDNSPeers := range conn25DNSTargets {
-			for _, peer := range candidateSplitDNSPeers {
-				base := peerAPIBase(nm, peer)
-				if base == "" {
-					continue
-				}
-				mak.Set(&m, domain, []*dnstype.Resolver{{Addr: fmt.Sprintf("%s/dns-query", base)}})
-				break // Just make one resolver for the first peer we can get a peerAPIBase for.
-			}
-		}
-		if m != nil {
-			addSplitDNSRoutes(m)
-		}
-	}
+	addSplitDNSRoutes(conn25AppRoutes)
 
 	// Set FallbackResolvers as the default resolvers in the
 	// scenarios that can't handle a purely split-DNS config. See
diff --git a/ipn/ipnlocal/node_backend_test.go b/ipn/ipnlocal/node_backend_test.go
index ca61624b8..991ccf299 100644
--- a/ipn/ipnlocal/node_backend_test.go
+++ b/ipn/ipnlocal/node_backend_test.go
@@ -6,13 +6,22 @@ package ipnlocal
 import (
 	"context"
 	"errors"
+	"iter"
+	"maps"
+	"net/netip"
+	"slices"
 	"testing"
 	"time"
 
+	"tailscale.com/net/routecheck/peernode"
 	"tailscale.com/tailcfg"
 	"tailscale.com/tstest"
+	"tailscale.com/types/key"
 	"tailscale.com/types/netmap"
+	"tailscale.com/util/dnsname"
 	"tailscale.com/util/eventbus"
+	"tailscale.com/util/mak"
+	"tailscale.com/util/set"
 )
 
 func TestNodeBackendReadiness(t *testing.T) {
@@ -134,58 +143,516 @@ func TestNodeBackendReachability(t *testing.T) {
 		//
 		// When disabled, the client relies on the control plane sending
 		// an accurate peer.Online flag. When enabled, the client
-		// ignores peer.Online and determines whether it can reach the
-		// peer node.
+		// ignores peer.Online and is forced to return true.
 		cap bool
+		// rchk sets [tailcfg.NodeAttrClientSideReachabilityRouteCheck]
+		// on the self node.
+		//
+		// When enabled with [tailcfg.NodeAttrClientSideReachability]
+		// above, the client ignores peer.Online and determines whether
+		// it can reach the peer node using [routecheck] reports.
+		rchk bool
 
-		peer tailcfg.Node
-		want bool
+		online bool
+		pong   peernode.Reachability
+		want   bool
 	}{
 		{
-			name: "disabled/offline",
-			cap:  false,
-			peer: tailcfg.Node{
-				Online: new(false),
-			},
-			want: false,
+			name:   "disabled/offline",
+			cap:    false,
+			online: false,
+			want:   false,
 		},
 		{
-			name: "disabled/online",
-			cap:  false,
-			peer: tailcfg.Node{
-				Online: new(true),
-			},
-			want: true,
+			name:   "disabled/online",
+			cap:    false,
+			online: true,
+			want:   true,
 		},
 		{
-			name: "enabled/offline",
-			cap:  true,
-			peer: tailcfg.Node{
-				Online: new(false),
-			},
-			want: true,
+			name:   "forced/offline",
+			cap:    true,
+			rchk:   false,
+			online: false,
+			want:   true,
 		},
 		{
-			name: "enabled/online",
-			cap:  true,
-			peer: tailcfg.Node{
-				Online: new(true),
-			},
-			want: true,
+			name:   "forced/online",
+			cap:    true,
+			rchk:   false,
+			online: true,
+			want:   true,
+		},
+		{
+			name:   "routecheck/offline/needs-probe",
+			cap:    true,
+			rchk:   true,
+			online: false,
+			pong:   peernode.Unknown,
+			want:   false,
+		},
+		{
+			name:   "routecheck/offline/unreachable",
+			cap:    true,
+			rchk:   true,
+			online: false,
+			pong:   peernode.Unreachable,
+			want:   false,
+		},
+		{
+			name:   "routecheck/offline/reachable",
+			cap:    true,
+			rchk:   true,
+			online: false,
+			pong:   peernode.Reachable,
+			want:   true,
+		},
+		{
+			name:   "routecheck/online/needs-probe",
+			cap:    true,
+			rchk:   true,
+			online: true,
+			pong:   peernode.Unknown,
+			want:   true,
+		},
+		{
+			name:   "routecheck/online/unreachable",
+			cap:    true,
+			rchk:   true,
+			online: true,
+			pong:   peernode.Unreachable,
+			want:   false,
+		},
+		{
+			name:   "routecheck/online/reachable",
+			cap:    true,
+			rchk:   true,
+			online: true,
+			pong:   peernode.Reachable,
+			want:   true,
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
-			nb := newNodeBackend(t.Context(), tstest.WhileTestRunningLogger(t), eventbus.New())
-			nb.netMap = &netmap.NetworkMap{}
+			self := &tailcfg.Node{
+				ID:       1,
+				StableID: "stable1",
+				Name:     "self",
+			}
 			if tc.cap {
-				nb.netMap.AllCaps.Make()
-				nb.netMap.AllCaps.Add(tailcfg.NodeAttrClientSideReachability)
+				mak.Set(&self.CapMap, tailcfg.NodeAttrClientSideReachability, nil)
+			}
+			if tc.rchk {
+				mak.Set(&self.CapMap, tailcfg.NodeAttrClientSideReachabilityRouteCheck, nil)
 			}
 
-			got := nb.PeerIsReachable(t.Context(), tc.peer.View())
+			peer := &tailcfg.Node{
+				ID:       2,
+				StableID: "stable2",
+				Name:     "peer",
+				Online:   &tc.online,
+			}
+
+			nb := newNodeBackend(t.Context(), tstest.WhileTestRunningLogger(t), eventbus.New())
+			nb.netMap = &netmap.NetworkMap{
+				SelfNode: self.View(),
+				Peers:    []tailcfg.NodeView{peer.View()},
+				// HACK: AllCaps is usually populated by Control
+				AllCaps: set.SetOf(slices.Collect(maps.Keys(self.CapMap))),
+			}
+
+			got := nb.PeerIsReachable(routecheckReport(tc.pong), peer.View())
 			if got != tc.want {
 				t.Errorf("got %v, want %v", got, tc.want)
 			}
 		})
 	}
 }
+
+type routecheckReport peernode.Reachability
+
+var _ RouteCheckReport = *new(routecheckReport)
+
+func (rp routecheckReport) IsReachable(_ tailcfg.NodeID) peernode.Reachability {
+	return peernode.Reachability(rp)
+}
+
+func TestNodeBackendRouteManager(t *testing.T) {
+	nb := newNodeBackend(t.Context(), tstest.WhileTestRunningLogger(t), eventbus.New())
+
+	mkPeer := func(id tailcfg.NodeID, stableID tailcfg.StableNodeID, addr4 string, extra ...string) tailcfg.NodeView {
+		n := &tailcfg.Node{
+			ID:       id,
+			StableID: stableID,
+			Key:      key.NewNode().Public(),
+			HomeDERP: 1, // required by the route manager's reachability filter
+			Addresses: []netip.Prefix{
+				netip.MustParsePrefix(addr4),
+			},
+		}
+		n.AllowedIPs = append(n.AllowedIPs, n.Addresses...)
+		for _, s := range extra {
+			n.AllowedIPs = append(n.AllowedIPs, netip.MustParsePrefix(s))
+		}
+		return n.View()
+	}
+	wantPeerFor := func(ip string, want tailcfg.NodeView) {
+		t.Helper()
+		got, ok := nb.routeMgr.Outbound().Lookup(netip.MustParseAddr(ip))
+		if !want.Valid() {
+			if ok {
+				t.Errorf("Outbound lookup %s = %v; want no match", ip, got)
+			}
+			return
+		}
+		if !ok || got.Key != want.Key() {
+			t.Errorf("Outbound lookup %s = %v, %v; want %v", ip, got, ok, want.Key())
+		}
+	}
+
+	p1 := mkPeer(1, "stable1", "100.64.0.1/32")
+	p2 := mkPeer(2, "stable2", "100.64.0.2/32", "0.0.0.0/0", "::/0")
+
+	// A full netmap populates the route manager.
+	nb.SetNetMap(&netmap.NetworkMap{Peers: []tailcfg.NodeView{p1, p2}})
+	wantPeerFor("100.64.0.1", p1)
+	wantPeerFor("100.64.0.2", p2)
+	wantPeerFor("8.8.8.8", tailcfg.NodeView{}) // exit node not selected
+
+	// Selecting peer 2 as the exit node resolves its stable ID and
+	// installs its /0 routes. The commit reports peer 2's allowed
+	// prefixes as changed.
+	if changed := nb.updateRouteManagerPrefs(routePrefs{ExitNodeID: "stable2", ExitNodeSelected: true}); len(changed) != 1 || changed[p2.Key()] == nil {
+		t.Errorf("updateRouteManagerPrefs(exit=stable2) changed = %v; want just %v", changed, p2.Key())
+	}
+	wantPeerFor("8.8.8.8", p2)
+
+	// A selected exit node that resolves to no current peer must
+	// blackhole internet traffic, not fall back to "no exit node":
+	// the default routes stay in the OS route set with no outbound
+	// peer to carry them. Peer 2's allowed prefixes lose the /0s,
+	// which the commit reports.
+	if changed := nb.updateRouteManagerPrefs(routePrefs{ExitNodeID: "no-such-node", ExitNodeSelected: true}); len(changed) != 1 || changed[p2.Key()] == nil {
+		t.Errorf("updateRouteManagerPrefs(exit=unresolved) changed = %v; want just %v", changed, p2.Key())
+	}
+	wantPeerFor("8.8.8.8", tailcfg.NodeView{})
+	if !nb.routeMgr.OSRoutes().Get(netip.MustParsePrefix("0.0.0.0/0")) {
+		t.Error("unresolved exit node: OSRoutes missing 0.0.0.0/0 blackhole route")
+	}
+
+	nb.updateRouteManagerPrefs(routePrefs{})
+	wantPeerFor("8.8.8.8", tailcfg.NodeView{})
+	if nb.routeMgr.OSRoutes().Get(netip.MustParsePrefix("0.0.0.0/0")) {
+		t.Error("no exit node: OSRoutes unexpectedly contains 0.0.0.0/0")
+	}
+
+	// Incremental deltas: add peer 3, remove peer 1.
+	p3 := mkPeer(3, "stable3", "100.64.0.3/32")
+	deltaRes, handled := nb.UpdateNetmapDelta([]netmap.NodeMutation{
+		netmap.NodeMutationUpsert{Node: p3},
+		netmap.MakeNodeMutationRemove(1),
+	})
+	if !handled {
+		t.Fatal("UpdateNetmapDelta not handled")
+	}
+	if changed := deltaRes.ChangedAllowedIPs; len(changed) != 2 || changed[p3.Key()] == nil {
+		t.Errorf("UpdateNetmapDelta changed = %v; want entries for %v and %v", changed, p3.Key(), p1.Key())
+	}
+	if v, ok := deltaRes.ChangedAllowedIPs[p1.Key()]; !ok || v != nil {
+		t.Errorf("UpdateNetmapDelta changed[%v] = %v, %v; want nil, true for removed peer", p1.Key(), v, ok)
+	}
+	wantPeerFor("100.64.0.3", p3)
+	wantPeerFor("100.64.0.1", tailcfg.NodeView{})
+
+	// A full netmap that drops a peer removes it from the route manager.
+	nb.SetNetMap(&netmap.NetworkMap{Peers: []tailcfg.NodeView{p2}})
+	wantPeerFor("100.64.0.3", tailcfg.NodeView{})
+	wantPeerFor("100.64.0.2", p2)
+}
+
+// TestNodeBackendDiscoChanged exercises the full-netmap disco change
+// detection: a peer whose disco key changes has restarted and needs its
+// WireGuard session reset, unless the new key was already learned over
+// TSMP (that is, over a working WireGuard session with the peer).
+func TestNodeBackendDiscoChanged(t *testing.T) {
+	nb := newNodeBackend(t.Context(), tstest.WhileTestRunningLogger(t), eventbus.New())
+
+	nk := key.NewNode().Public()
+	mkNetMap := func(disco key.DiscoPublic) *netmap.NetworkMap {
+		n := &tailcfg.Node{
+			ID:       1,
+			Key:      nk,
+			DiscoKey: disco,
+			HomeDERP: 1,
+		}
+		return &netmap.NetworkMap{Peers: []tailcfg.NodeView{n.View()}}
+	}
+	newDisco := func() key.DiscoPublic { return key.NewDisco().Public() }
+
+	// A brand-new peer is not a disco change.
+	d1 := newDisco()
+	if got, _ := nb.SetNetMap(mkNetMap(d1)); len(got) != 0 {
+		t.Errorf("SetNetMap(new peer) discoChanged = %v; want none", got)
+	}
+
+	// A changed disco key requires a session reset.
+	d2 := newDisco()
+	if got, _ := nb.SetNetMap(mkNetMap(d2)); !slices.Contains(got, nk) {
+		t.Errorf("SetNetMap(changed disco) discoChanged = %v; want %v", got, nk)
+	}
+
+	// An unchanged disco key does not.
+	if got, _ := nb.SetNetMap(mkNetMap(d2)); len(got) != 0 {
+		t.Errorf("SetNetMap(same disco) discoChanged = %v; want none", got)
+	}
+
+	// A change already learned via TSMP is suppressed...
+	d3 := newDisco()
+	nb.recordTSMPLearnedDisco(nk, d3)
+	if got, _ := nb.SetNetMap(mkNetMap(d3)); len(got) != 0 {
+		t.Errorf("SetNetMap(TSMP-learned disco) discoChanged = %v; want none", got)
+	}
+
+	// ...but the TSMP entry is consumed, so the next change resets again.
+	d4 := newDisco()
+	if got, _ := nb.SetNetMap(mkNetMap(d4)); !slices.Contains(got, nk) {
+		t.Errorf("SetNetMap(after TSMP entry consumed) discoChanged = %v; want %v", got, nk)
+	}
+
+	// A TSMP-learned key that doesn't match the netmap's new key still
+	// resets the session and bumps the mismatch metric.
+	before := metricTSMPLearnedKeyMismatch.Value()
+	nb.recordTSMPLearnedDisco(nk, newDisco())
+	d5 := newDisco()
+	if got, _ := nb.SetNetMap(mkNetMap(d5)); !slices.Contains(got, nk) {
+		t.Errorf("SetNetMap(TSMP mismatch) discoChanged = %v; want %v", got, nk)
+	}
+	if delta := metricTSMPLearnedKeyMismatch.Value() - before; delta != 1 {
+		t.Errorf("metricTSMPLearnedKeyMismatch delta = %d; want 1", delta)
+	}
+
+	// Removing the peer garbage-collects its TSMP entry: after the peer
+	// comes back, a change to the once-recorded key is a normal reset.
+	d6 := newDisco()
+	nb.recordTSMPLearnedDisco(nk, d6)
+	nb.SetNetMap(&netmap.NetworkMap{})
+	nb.SetNetMap(mkNetMap(d5))
+	if got, _ := nb.SetNetMap(mkNetMap(d6)); !slices.Contains(got, nk) {
+		t.Errorf("SetNetMap(after TSMP entry GC) discoChanged = %v; want %v", got, nk)
+	}
+
+	// Transitions to or from a zero disco key never reset.
+	if got, _ := nb.SetNetMap(mkNetMap(key.DiscoPublic{})); len(got) != 0 {
+		t.Errorf("SetNetMap(to zero disco) discoChanged = %v; want none", got)
+	}
+	if got, _ := nb.SetNetMap(mkNetMap(d1)); len(got) != 0 {
+		t.Errorf("SetNetMap(from zero disco) discoChanged = %v; want none", got)
+	}
+}
+
+// TestNodeBackendDiscoChangedDelta is like TestNodeBackendDiscoChanged
+// but for the incremental path: disco changes arriving as
+// [netmap.NodeMutationUpsert] deltas.
+func TestNodeBackendDiscoChangedDelta(t *testing.T) {
+	nb := newNodeBackend(t.Context(), tstest.WhileTestRunningLogger(t), eventbus.New())
+
+	mkNode := func(k key.NodePublic, disco key.DiscoPublic) tailcfg.NodeView {
+		return (&tailcfg.Node{ID: 1, Key: k, DiscoKey: disco, HomeDERP: 1}).View()
+	}
+	newDisco := func() key.DiscoPublic { return key.NewDisco().Public() }
+	apply := func(muts ...netmap.NodeMutation) set.Set[key.NodePublic] {
+		t.Helper()
+		deltaRes, handled := nb.UpdateNetmapDelta(muts)
+		if !handled {
+			t.Fatal("UpdateNetmapDelta not handled")
+		}
+		return deltaRes.DiscoChanged
+	}
+
+	nk := key.NewNode().Public()
+	d1 := newDisco()
+	nb.SetNetMap(&netmap.NetworkMap{Peers: []tailcfg.NodeView{mkNode(nk, d1)}})
+
+	// An upserted peer with a changed disco key needs a session reset.
+	d2 := newDisco()
+	if got := apply(netmap.NodeMutationUpsert{Node: mkNode(nk, d2)}); !got.Contains(nk) {
+		t.Errorf("upsert(changed disco) discoChanged = %v; want %v", got, nk)
+	}
+
+	// An unchanged disco key does not.
+	if got := apply(netmap.NodeMutationUpsert{Node: mkNode(nk, d2)}); len(got) != 0 {
+		t.Errorf("upsert(same disco) discoChanged = %v; want none", got)
+	}
+
+	// A change already learned via TSMP is suppressed.
+	d3 := newDisco()
+	nb.recordTSMPLearnedDisco(nk, d3)
+	if got := apply(netmap.NodeMutationUpsert{Node: mkNode(nk, d3)}); len(got) != 0 {
+		t.Errorf("upsert(TSMP-learned disco) discoChanged = %v; want none", got)
+	}
+
+	// A node key rotation replaces the WireGuard peer outright, so no
+	// disco-based reset is reported.
+	nk2 := key.NewNode().Public()
+	if got := apply(netmap.NodeMutationUpsert{Node: mkNode(nk2, newDisco())}); len(got) != 0 {
+		t.Errorf("upsert(rotated node key) discoChanged = %v; want none", got)
+	}
+
+	// Removing the peer garbage-collects its TSMP entry: after the peer
+	// comes back, a change to the once-recorded key is a normal reset.
+	d4 := newDisco()
+	nb.recordTSMPLearnedDisco(nk2, d4)
+	apply(netmap.MakeNodeMutationRemove(1))
+	apply(netmap.NodeMutationUpsert{Node: mkNode(nk2, newDisco())})
+	if got := apply(netmap.NodeMutationUpsert{Node: mkNode(nk2, d4)}); !got.Contains(nk2) {
+		t.Errorf("upsert(after TSMP entry GC) discoChanged = %v; want %v", got, nk2)
+	}
+}
+
+func TestNodeBackendRouteManagerExtras(t *testing.T) {
+	nb := newNodeBackend(t.Context(), tstest.WhileTestRunningLogger(t), eventbus.New())
+
+	n := &tailcfg.Node{
+		ID:       1,
+		Key:      key.NewNode().Public(),
+		HomeDERP: 1,
+		Addresses: []netip.Prefix{
+			netip.MustParsePrefix("100.64.0.1/32"),
+		},
+	}
+	n.AllowedIPs = n.Addresses
+	p1 := n.View()
+	nb.SetNetMap(&netmap.NetworkMap{Peers: []tailcfg.NodeView{p1}})
+
+	transit := netip.MustParsePrefix("fe80::1234/128")
+	extrasFor := func(peers iter.Seq2[tailcfg.NodeID, key.NodePublic]) map[tailcfg.NodeID][]netip.Prefix {
+		var extras map[tailcfg.NodeID][]netip.Prefix
+		for id, k := range peers {
+			if k == p1.Key() {
+				mak.Set(&extras, id, []netip.Prefix{transit})
+			}
+		}
+		return extras
+	}
+
+	// Installing extras reports the peer's allowed prefixes as
+	// changed and adds the transit IP to the outbound table.
+	changed := nb.updateRouteManagerExtras(extrasFor)
+	if len(changed) != 1 || !slices.Contains(changed[p1.Key()], transit) {
+		t.Errorf("updateRouteManagerExtras changed = %v; want %v including %v", changed, p1.Key(), transit)
+	}
+	if pr, ok := nb.routeMgr.Outbound().Lookup(transit.Addr()); !ok || pr.Key != p1.Key() {
+		t.Errorf("Outbound lookup %v = %v, %v; want %v", transit.Addr(), pr, ok, p1.Key())
+	}
+	if nb.routeMgr.OSRoutes().Get(transit) {
+		t.Errorf("OSRoutes contains %v; extras must not reach the OS route set", transit)
+	}
+
+	// An unchanged hook result is a no-op.
+	if changed := nb.updateRouteManagerExtras(extrasFor); changed != nil {
+		t.Errorf("unchanged extras reported changes: %v", changed)
+	}
+
+	// A hook that no longer returns extras removes them.
+	changed = nb.updateRouteManagerExtras(func(iter.Seq2[tailcfg.NodeID, key.NodePublic]) map[tailcfg.NodeID][]netip.Prefix {
+		return nil
+	})
+	if len(changed) != 1 {
+		t.Errorf("clearing extras changed = %v; want just %v", changed, p1.Key())
+	}
+	if _, ok := nb.routeMgr.Outbound().Lookup(transit.Addr()); ok {
+		t.Errorf("Outbound still routes %v after extras cleared", transit.Addr())
+	}
+}
+
+// Tests the live MagicDNS lookup methods backing
+// [resolver.MagicDNSHosts]: forward, reverse, and subdomain-cap
+// lookups must serve from the node indexes and stay correct across
+// netmap deltas without any full Hosts map rebuild.
+func TestNodeBackendMagicDNSHosts(t *testing.T) {
+	nb := newNodeBackend(t.Context(), tstest.WhileTestRunningLogger(t), eventbus.New())
+
+	self := &tailcfg.Node{
+		ID:        1,
+		Name:      "self.example.ts.net.",
+		Addresses: []netip.Prefix{netip.MustParsePrefix("100.64.0.1/32")},
+	}
+	p1 := &tailcfg.Node{
+		ID:   2,
+		Key:  key.NewNode().Public(),
+		Name: "p1.example.ts.net.",
+		Addresses: []netip.Prefix{
+			netip.MustParsePrefix("100.64.0.2/32"),
+			netip.MustParsePrefix("fd7a:115c:a1e0::2/128"),
+		},
+		CapMap: tailcfg.NodeCapMap{tailcfg.NodeAttrDNSSubdomainResolve: nil},
+	}
+	nb.SetNetMap(&netmap.NetworkMap{
+		SelfNode: self.View(),
+		Peers:    []tailcfg.NodeView{p1.View()},
+	})
+
+	wantHost := func(fqdn dnsname.FQDN, want ...netip.Addr) {
+		t.Helper()
+		ips, ok := nb.magicDNSHostAddrs(fqdn)
+		if len(want) == 0 {
+			if ok {
+				t.Errorf("magicDNSHostAddrs(%q) = %v; want no match", fqdn, ips)
+			}
+			return
+		}
+		if !ok || !slices.Equal(ips, want) {
+			t.Errorf("magicDNSHostAddrs(%q) = %v, %v; want %v", fqdn, ips, ok, want)
+		}
+	}
+
+	// The self node has IPv4, so the peer's IPv6 address is
+	// filtered out (issue 1152).
+	wantHost("p1.example.ts.net.", netip.MustParseAddr("100.64.0.2"))
+	wantHost("self.example.ts.net.", netip.MustParseAddr("100.64.0.1"))
+	wantHost("unknown.example.ts.net.")
+
+	if fqdn, ok := nb.magicDNSPTR(netip.MustParseAddr("100.64.0.2")); !ok || fqdn != "p1.example.ts.net." {
+		t.Errorf("magicDNSPTR(100.64.0.2) = %q, %v; want p1's name", fqdn, ok)
+	}
+	if got, want := nb.magicDNSSubdomainHost("p1.example.ts.net."), true; got != want {
+		t.Errorf("magicDNSSubdomainHost(p1) = %v; want %v", got, want)
+	}
+	if got, want := nb.magicDNSSubdomainHost("self.example.ts.net."), false; got != want {
+		t.Errorf("magicDNSSubdomainHost(self) = %v; want %v", got, want)
+	}
+
+	// Removing the peer via a delta drops its records.
+	if _, handled := nb.UpdateNetmapDelta([]netmap.NodeMutation{netmap.MakeNodeMutationRemove(2)}); !handled {
+		t.Fatal("UpdateNetmapDelta not handled")
+	}
+	wantHost("p1.example.ts.net.")
+	if fqdn, ok := nb.magicDNSPTR(netip.MustParseAddr("100.64.0.2")); ok {
+		t.Errorf("magicDNSPTR(100.64.0.2) after removal = %q; want no match", fqdn)
+	}
+
+	// Adding a peer via a delta serves it immediately.
+	p3 := &tailcfg.Node{
+		ID:        3,
+		Key:       key.NewNode().Public(),
+		Name:      "p3.example.ts.net.",
+		Addresses: []netip.Prefix{netip.MustParsePrefix("100.64.0.3/32")},
+	}
+	if _, handled := nb.UpdateNetmapDelta([]netmap.NodeMutation{netmap.NodeMutationUpsert{Node: p3.View()}}); !handled {
+		t.Fatal("UpdateNetmapDelta not handled")
+	}
+	wantHost("p3.example.ts.net.", netip.MustParseAddr("100.64.0.3"))
+
+	// Renaming a peer arrives as an upsert of the full node with a
+	// new Name. The old name must stop resolving and the new one
+	// must start (tailscale/corp#45631).
+	p3renamed := p3.Clone()
+	p3renamed.Name = "p3-renamed.example.ts.net."
+	if _, handled := nb.UpdateNetmapDelta([]netmap.NodeMutation{netmap.NodeMutationUpsert{Node: p3renamed.View()}}); !handled {
+		t.Fatal("UpdateNetmapDelta not handled")
+	}
+	wantHost("p3-renamed.example.ts.net.", netip.MustParseAddr("100.64.0.3"))
+	wantHost("p3.example.ts.net.")
+	if fqdn, ok := nb.magicDNSPTR(netip.MustParseAddr("100.64.0.3")); !ok || fqdn != "p3-renamed.example.ts.net." {
+		t.Errorf("magicDNSPTR(100.64.0.3) after rename = %q, %v; want p3's new name", fqdn, ok)
+	}
+}
diff --git a/ipn/ipnlocal/peerapi.go b/ipn/ipnlocal/peerapi.go
index 322884fc7..f1f1999a6 100644
--- a/ipn/ipnlocal/peerapi.go
+++ b/ipn/ipnlocal/peerapi.go
@@ -192,7 +192,7 @@ func (pln *peerAPIListener) ServeConn(src netip.AddrPort, c net.Conn) {
 		c.Close()
 		return
 	}
-	nm := pln.lb.NetMap()
+	nm := pln.lb.NetMapNoPeers()
 	if nm == nil || !nm.SelfNode.Valid() {
 		logf("peerapi: no netmap")
 		c.Close()
@@ -592,8 +592,14 @@ func (h *peerAPIHandler) canDebug() bool {
 var allowSelfIngress = envknob.RegisterBool("TS_ALLOW_SELF_INGRESS")
 
 // canIngress reports whether h can send ingress requests to this node.
+//
+// The ingress cap is resolved without the unsigned-peer denial that
+// [nodeBackend.PeerCaps] applies, because Funnel ingress relays are by design
+// UnsignedPeerAPIOnly nodes whose only permitted action is this endpoint.
+// See [nodeBackend.PeerCapsIncludingUnsigned].
 func (h *peerAPIHandler) canIngress() bool {
-	return h.peerHasCap(tailcfg.PeerCapabilityIngress) || (allowSelfIngress() && h.isSelf)
+	caps := h.ps.b.PeerCapsIncludingUnsigned(h.remoteAddr.Addr())
+	return caps.HasCapability(tailcfg.PeerCapabilityIngress) || (allowSelfIngress() && h.isSelf)
 }
 
 func (h *peerAPIHandler) peerHasCap(wantCap tailcfg.PeerCapability) bool {
@@ -674,6 +680,12 @@ func (h *peerAPIHandler) handleServeDNSFwd(w http.ResponseWriter, r *http.Reques
 	dh.ServeHTTP(w, r)
 }
 
+// HookReplyToDNSQueries allows extensions to register a willingness to allow
+// handling PeerAPI DNS queries for the peer making this request.
+var HookReplyToDNSQueries = feature.Hooks[func(PeerAPIHandler) bool]{
+	offersExitNodeOrAppConnectorAndPeerHasAutogroupInternet,
+}
+
 func (h *peerAPIHandler) replyToDNSQueries() bool {
 	if !buildfeatures.HasDNS {
 		return false
@@ -683,17 +695,36 @@ func (h *peerAPIHandler) replyToDNSQueries() bool {
 		// without further checks.
 		return true
 	}
-	b := h.ps.b
-	if !b.OfferingExitNode() && !b.OfferingAppConnector() {
-		// If we're not an exit node or app connector, there's
-		// no point to being a DNS server for somebody.
-		return false
-	}
 	if !h.remoteAddr.IsValid() {
 		// This should never be the case if the peerAPIHandler
 		// was wired up correctly, but just in case.
 		return false
 	}
+
+	for _, hook := range HookReplyToDNSQueries {
+		if hook(h) {
+			return true
+		}
+	}
+	return false
+}
+
+// offersExitNodeOrAppConnectorAndPeerHasAutogroupInternet is run as part of
+// [HookReplyToDNSQueries] and handles our legacy PeerAPI DNS acceptance
+// criteria:
+//   - When a node is advertising an exit node it will accept DNS queries
+//     from peers that have access to autogroup:internet.
+//   - When a node is advertising an app connector, it will accept DNS queries
+//     to peers that have access to a relevant app.
+//
+// Further details about how these are accomplished are in inline comments.
+func offersExitNodeOrAppConnectorAndPeerHasAutogroupInternet(h PeerAPIHandler) bool {
+	b := h.LocalBackend()
+	if !b.OfferingExitNode() && !b.OfferingAppConnector() {
+		// If we're not an exit node or app connector, this hook
+		// doesn't apply.
+		return false
+	}
 	// Otherwise, we're an exit node but the peer is not us, so
 	// we need to check if they're allowed access to the internet.
 	// As peerapi bypasses wgengine/filter checks, we need to check
@@ -716,7 +747,7 @@ func (h *peerAPIHandler) replyToDNSQueries() bool {
 	// arbitrary. DNS runs over TCP and UDP, so sure... we check
 	// TCP.
 	dstIP := netaddr.IPv4(0, 0, 0, 0)
-	remoteIP := h.remoteAddr.Addr()
+	remoteIP := h.RemoteAddr().Addr()
 	if remoteIP.Is6() {
 		// autogroup:internet for IPv6 is defined to start with 2000::/3,
 		// so use 2000::0 as the probe "the internet" address.
diff --git a/ipn/ipnlocal/profiles.go b/ipn/ipnlocal/profiles.go
index 4e073e5c9..5619f0639 100644
--- a/ipn/ipnlocal/profiles.go
+++ b/ipn/ipnlocal/profiles.go
@@ -21,6 +21,7 @@ import (
 	"tailscale.com/ipn"
 	"tailscale.com/ipn/ipnext"
 	"tailscale.com/tailcfg"
+	"tailscale.com/tstime"
 	"tailscale.com/types/key"
 	"tailscale.com/types/logger"
 	"tailscale.com/types/persist"
@@ -64,6 +65,10 @@ type profileManager struct {
 
 	// Override for key.NewEmptyHardwareAttestationKey used for testing.
 	newEmptyHardwareAttestationKey func() (key.HardwareAttestationKey, error)
+
+	// clock supplies the current time when stamping LoginProfile.Created.
+	// Tests substitute a fake clock to make creation timestamps deterministic.
+	clock tstime.DefaultClock
 }
 
 // SetExtensionHost sets the [ExtensionHost] for the [profileManager].
@@ -250,7 +255,14 @@ func (pm *profileManager) allProfilesFor(uid ipn.WindowsUserID) []ipn.LoginProfi
 		}
 	}
 	slices.SortFunc(out, func(a, b ipn.LoginProfileView) int {
-		return cmp.Compare(a.Name(), b.Name())
+		// Legacy (zero Created) first, then stamped oldest-first.
+		if c := a.Created().Compare(b.Created()); c != 0 {
+			return c
+		}
+		if c := cmp.Compare(a.Name(), b.Name()); c != 0 {
+			return c
+		}
+		return cmp.Compare(a.NetworkProfile().DomainName, b.NetworkProfile().DomainName)
 	})
 	return out
 }
@@ -413,6 +425,7 @@ func (pm *profileManager) setProfilePrefs(lp *ipn.LoginProfile, prefsIn ipn.Pref
 		if persist := prefsIn.Persist(); persist.Valid() && persist.NodeID() != "" && persist.UserProfile().LoginName() != "" {
 			// Generate an ID and [ipn.StateKey] now that we have the node info.
 			lp.ID, lp.Key = newUnusedID(pm.knownProfiles)
+			lp.Created = pm.clock.Now()
 		}
 
 		// Set the current user as the profile owner, unless the current user ID does
diff --git a/ipn/ipnlocal/profiles_test.go b/ipn/ipnlocal/profiles_test.go
index ec92673e5..8ac22a656 100644
--- a/ipn/ipnlocal/profiles_test.go
+++ b/ipn/ipnlocal/profiles_test.go
@@ -10,6 +10,7 @@ import (
 	"strconv"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
@@ -19,6 +20,8 @@ import (
 	"tailscale.com/ipn"
 	"tailscale.com/ipn/store/mem"
 	"tailscale.com/tailcfg"
+	"tailscale.com/tstest"
+	"tailscale.com/tstime"
 	"tailscale.com/types/key"
 	"tailscale.com/types/logger"
 	"tailscale.com/types/persist"
@@ -1185,3 +1188,150 @@ func (k *failingHardwareAttestationKey) UnmarshalJSON([]byte) error {
 	k.unmarshalCalled = true
 	return errors.New("failed to unmarshal attestation key!")
 }
+
+func TestDeleteProfileClearsState(t *testing.T) {
+	store := new(mem.Store)
+
+	pm, err := newProfileManagerWithGOOS(store, logger.Discard, health.NewTracker(eventbustest.NewBus(t)), "linux")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	pm.SetCurrentUserID("user1")
+	pm.SwitchToNewProfile()
+	p := pm.CurrentPrefs().AsStruct()
+	p.Persist = &persist.Persist{
+		NodeID:         "node1",
+		PrivateNodeKey: key.NewNode(),
+		UserProfile: tailcfg.UserProfile{
+			ID:        1,
+			LoginName: "user@example.com",
+		},
+	}
+	if err := pm.SetPrefs(p.View(), ipn.NetworkProfile{}); err != nil {
+		t.Fatal(err)
+	}
+
+	profileKey := pm.currentProfile.Key()
+	if profileKey == "" {
+		t.Fatal("profile key is empty")
+	}
+
+	// Verify profile state exists in store.
+	if _, err := store.ReadState(profileKey); err != nil {
+		t.Fatalf("ReadState before delete: %v", err)
+	}
+
+	profileID := pm.currentProfile.ID()
+	if err := pm.DeleteProfile(profileID); err != nil {
+		t.Fatal(err)
+	}
+
+	// Verify profile state is deleted from store.
+	if _, err := store.ReadState(profileKey); err != ipn.ErrStateNotExist {
+		t.Fatalf("ReadState after delete: got err %v, want ErrStateNotExist", err)
+	}
+}
+
+// TestProfileSortOrder verifies that allProfilesFor sorts zero-Created
+// (legacy) profiles before stamped profiles, with stamped profiles
+// ordered oldest-first so the most recently added one lands at the
+// bottom. Name then DomainName break ties within either group.
+func TestProfileSortOrder(t *testing.T) {
+	pm, err := newProfileManagerWithGOOS(new(mem.Store), logger.Discard, health.NewTracker(eventbustest.NewBus(t)), "linux")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	base := time.Date(2026, 6, 23, 12, 0, 0, 0, time.UTC)
+	add := func(id ipn.ProfileID, name, domain string, created time.Time) {
+		pm.knownProfiles[id] = (&ipn.LoginProfile{
+			ID:             id,
+			Name:           name,
+			NetworkProfile: ipn.NetworkProfile{DomainName: domain},
+			Created:        created,
+		}).View()
+	}
+
+	add("a", "alice", "example.com", time.Time{})
+	add("a2", "alice", "acme.com", time.Time{}) // legacy ties alice on Name; DomainName breaks it
+	add("b", "bob", "example.com", time.Time{})
+	add("c", "carol", "example.com", base)
+	add("d", "dave", "example.com", base.Add(time.Minute))
+	add("e", "eve", "example.com", base.Add(time.Minute)) // ties dave on Created; Name breaks it
+	add("e2", "eve", "acme.com", base.Add(time.Minute))   // ties eve on Created+Name; DomainName breaks it
+
+	got := pm.allProfilesFor("")
+	type want struct{ name, domain string }
+	wantOrder := []want{
+		// Legacy first, Name asc then DomainName asc.
+		{"alice", "acme.com"},
+		{"alice", "example.com"},
+		{"bob", "example.com"},
+		// Stamped, oldest first.
+		{"carol", "example.com"},
+		{"dave", "example.com"},
+		{"eve", "acme.com"},
+		{"eve", "example.com"},
+	}
+	if len(got) != len(wantOrder) {
+		t.Fatalf("got %d profiles, want %d", len(got), len(wantOrder))
+	}
+	for i, w := range wantOrder {
+		if got[i].Name() != w.name || got[i].NetworkProfile().DomainName != w.domain {
+			t.Errorf("position %d: got (%q,%q), want (%q,%q) (full: %v)",
+				i, got[i].Name(), got[i].NetworkProfile().DomainName, w.name, w.domain, profileNames(got))
+		}
+	}
+}
+
+func profileNames(ps []ipn.LoginProfileView) []string {
+	out := make([]string, len(ps))
+	for i, p := range ps {
+		out[i] = p.Name()
+	}
+	return out
+}
+
+// TestProfileCreatedStamped verifies that Created is set on profile creation
+// from the injected clock, and is preserved across an update even when the
+// clock advances.
+func TestProfileCreatedStamped(t *testing.T) {
+	pm, err := newProfileManagerWithGOOS(new(mem.Store), logger.Discard, health.NewTracker(eventbustest.NewBus(t)), "linux")
+	if err != nil {
+		t.Fatal(err)
+	}
+	start := time.Date(2026, 6, 23, 12, 0, 0, 0, time.UTC)
+	clock := tstest.NewClock(tstest.ClockOpts{Start: start})
+	pm.clock = tstime.DefaultClock{Clock: clock}
+
+	pm.SwitchToNewProfile()
+	p := pm.CurrentPrefs().AsStruct()
+	p.Persist = &persist.Persist{
+		NodeID:         "n1",
+		PrivateNodeKey: key.NewNode(),
+		UserProfile: tailcfg.UserProfile{
+			ID:        1,
+			LoginName: "alice@example.com",
+		},
+	}
+	if err := pm.SetPrefs(p.View(), ipn.NetworkProfile{}); err != nil {
+		t.Fatal(err)
+	}
+
+	if got := pm.currentProfile.Created(); !got.Equal(start) {
+		t.Errorf("Created = %v after create, want %v", got, start)
+	}
+
+	// Advancing the clock and then performing an unrelated update (e.g.
+	// ProfileName change) must not move Created.
+	clock.Advance(time.Hour)
+	p = pm.CurrentPrefs().AsStruct()
+	p.ProfileName = "Alice"
+	if err := pm.SetPrefs(p.View(), ipn.NetworkProfile{}); err != nil {
+		t.Fatal(err)
+	}
+	if got := pm.currentProfile.Created(); !got.Equal(start) {
+		t.Errorf("Created changed across update: got %v, want %v", got, start)
+	}
+}
diff --git a/ipn/ipnlocal/resolve.go b/ipn/ipnlocal/resolve.go
new file mode 100644
index 000000000..394f579aa
--- /dev/null
+++ b/ipn/ipnlocal/resolve.go
@@ -0,0 +1,195 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package ipnlocal
+
+import (
+	"net/netip"
+	"strings"
+
+	"tailscale.com/feature/buildfeatures"
+	"tailscale.com/net/dns/resolver"
+	"tailscale.com/net/tsaddr"
+	"tailscale.com/tailcfg"
+	"tailscale.com/types/key"
+	"tailscale.com/util/dnsname"
+	"tailscale.com/wgengine"
+)
+
+// lookupPeerByIP returns the node public key for the peer that should
+// handle traffic to the given IP address. It is installed as the
+// [wgengine.Engine.SetPeerByIPPacketFunc] callback: exact node
+// addresses hit the nodeByAddr fast path, and subnet routes and
+// exit-node default routes fall back to the RouteManager's outbound
+// table, so it stays correct under incremental netmap deltas.
+//
+// It is called by wireguard-go on every outbound packet (not cached),
+// so it must be fast.
+func (b *LocalBackend) lookupPeerByIP(ip netip.Addr) (key.NodePublic, bool) {
+	nb := b.currentNode()
+	if nid, ok := nb.NodeByAddr(ip); ok {
+		peer, ok := nb.NodeByID(nid)
+		if !ok {
+			return key.NodePublic{}, false
+		}
+		return peer.Key(), true
+	}
+	if pr, ok := nb.routeMgr.Outbound().Lookup(ip); ok {
+		return pr.Key, true
+	}
+	return key.NodePublic{}, false
+}
+
+// peerAllowedIPs returns the prefixes from which the peer with the
+// given public key is currently allowed to originate traffic, or
+// ok=false if the peer is unknown (or currently routable via no
+// prefix at all). It is installed as the
+// [wgengine.Engine.SetPeerConfigFunc] callback, backing wireguard-go's
+// lazy peer creation and per-delta peer sync.
+func (b *LocalBackend) peerAllowedIPs(k key.NodePublic) (_ []netip.Prefix, ok bool) {
+	return b.currentNode().PeerAllowedIPs(k)
+}
+
+// resolveMagicDNS resolves a MagicDNS hostname to the owning node's IP
+// address, respecting the requested network address family ("tcp4",
+// "tcp6", "tcp", etc.). It accepts peer FQDNs ("foo.tail-scale.ts.net"),
+// short names ("foo"), and DNS.ExtraRecords entries (service VIPs).
+// The hostname must be lowercase with no trailing dot. It is installed
+// as the [tsdial.Dialer.SetResolveMagicDNS] callback.
+func (b *LocalBackend) resolveMagicDNS(hostname, network string) (_ netip.Addr, ok bool) {
+	nb := b.currentNode()
+	if nid, ok := nb.NodeByName(hostname); ok {
+		n, ok := nb.NodeByID(nid)
+		if !ok {
+			b.logf("[unexpected] resolveMagicDNS: NodeByName(%q) returned node %v but NodeByID failed", hostname, nid)
+			return netip.Addr{}, false
+		}
+		if ip, ok := nodeAddrForNetwork(n, network); ok {
+			return ip, true
+		}
+		return netip.Addr{}, false
+	}
+	if ip, ok := nb.ExtraDNSByName(hostname); ok && addrFamilyMatch(ip, network) {
+		return ip, true
+	}
+	return netip.Addr{}, false
+}
+
+// magicDNSHosts implements [resolver.MagicDNSHosts] on top of the
+// current nodeBackend's live node indexes, so the quad-100 resolver
+// pulls each MagicDNS answer on demand rather than LocalBackend
+// pushing a Hosts map of every node into it on every netmap change.
+// It is installed once at LocalBackend construction; going through
+// currentNode makes profile switches take effect immediately.
+type magicDNSHosts struct{ b *LocalBackend }
+
+func (m magicDNSHosts) LookupHost(fqdn dnsname.FQDN) (ips []netip.Addr, ok bool) {
+	if !buildfeatures.HasDNS {
+		return nil, false
+	}
+	return m.b.currentNode().magicDNSHostAddrs(fqdn)
+}
+
+func (m magicDNSHosts) LookupPTR(ip netip.Addr) (_ dnsname.FQDN, ok bool) {
+	if !buildfeatures.HasDNS {
+		return "", false
+	}
+	return m.b.currentNode().magicDNSPTR(ip)
+}
+
+func (m magicDNSHosts) SubdomainHost(fqdn dnsname.FQDN) bool {
+	if !buildfeatures.HasDNS {
+		return false
+	}
+	return m.b.currentNode().magicDNSSubdomainHost(fqdn)
+}
+
+var _ resolver.MagicDNSHosts = magicDNSHosts{}
+
+// nodeAddrForNetwork returns the best address from n for the given
+// network ("tcp", "tcp4", "tcp6", "udp", "udp4", "udp6"). For
+// unqualified networks ("tcp", "udp"), it prefers IPv4.
+func nodeAddrForNetwork(n tailcfg.NodeView, network string) (_ netip.Addr, ok bool) {
+	addrs := n.Addresses()
+	if addrs.Len() == 0 {
+		return netip.Addr{}, false
+	}
+	want4 := strings.HasSuffix(network, "4")
+	want6 := strings.HasSuffix(network, "6")
+	var v6 netip.Addr
+	for _, pfx := range addrs.All() {
+		ip := pfx.Addr()
+		if want4 && ip.Is4() {
+			return ip, true
+		}
+		if want6 && ip.Is6() {
+			return ip, true
+		}
+		if !want4 && !want6 {
+			if ip.Is4() {
+				return ip, true
+			}
+			if !v6.IsValid() {
+				v6 = ip
+			}
+		}
+	}
+	if v6.IsValid() {
+		return v6, true
+	}
+	return netip.Addr{}, false
+}
+
+// addrFamilyMatch reports whether ip is compatible with the requested
+// network address family.
+func addrFamilyMatch(ip netip.Addr, network string) bool {
+	if strings.HasSuffix(network, "4") {
+		return ip.Is4()
+	}
+	if strings.HasSuffix(network, "6") {
+		return ip.Is6()
+	}
+	return true
+}
+
+// PeerForIP returns which peer is responsible for a given IP address.
+// Despite the name, it can also return the self node (with IsSelf set).
+// It handles both Tailscale IPs (returning the owning peer or self) and
+// non-Tailscale addresses like subnet-routed IPs or exit-node global
+// internet IPs (returning whichever peer would route that traffic).
+// It is installed as the [wgengine.Engine.SetPeerForIPFunc] callback,
+// serving the engine's internal cold-path lookups (Ping, TSMP, pendopen
+// diagnostics).
+func (b *LocalBackend) PeerForIP(ip netip.Addr) (_ wgengine.PeerForIP, ok bool) {
+	nb := b.currentNode()
+
+	if tsaddr.IsTailscaleIP(ip) {
+		if nid, ok := nb.NodeByAddr(ip); ok {
+			n, ok := nb.NodeByID(nid)
+			if !ok {
+				b.logf("[unexpected] peerForIP: NodeByAddr(%v) returned node %v but NodeByID failed", ip, nid)
+				return wgengine.PeerForIP{}, false
+			}
+			self := nb.Self()
+			return wgengine.PeerForIP{
+				Node:   n,
+				IsSelf: self.Valid() && self.ID() == nid,
+				Route:  netip.PrefixFrom(ip, ip.BitLen()),
+			}, true
+		}
+	}
+
+	route, pr, ok := nb.routeMgr.Outbound().LookupPrefixLPM(netip.PrefixFrom(ip, ip.BitLen()))
+	if !ok {
+		return wgengine.PeerForIP{}, false
+	}
+	nid, ok := nb.NodeByKey(pr.Key)
+	if !ok {
+		return wgengine.PeerForIP{}, false
+	}
+	n, ok := nb.NodeByID(nid)
+	if !ok {
+		return wgengine.PeerForIP{}, false
+	}
+	return wgengine.PeerForIP{Node: n, Route: route}, true
+}
diff --git a/ipn/ipnlocal/resolve_test.go b/ipn/ipnlocal/resolve_test.go
new file mode 100644
index 000000000..c00290de4
--- /dev/null
+++ b/ipn/ipnlocal/resolve_test.go
@@ -0,0 +1,89 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package ipnlocal
+
+import (
+	"net/netip"
+	"testing"
+
+	"tailscale.com/tailcfg"
+	"tailscale.com/types/netmap"
+)
+
+func TestResolveMagicDNS(t *testing.T) {
+	b := newTestLocalBackend(t)
+
+	nm := &netmap.NetworkMap{
+		SelfNode: (&tailcfg.Node{
+			ID:       1,
+			Name:     "self.tail-scale.ts.net.",
+			Key:      makeNodeKeyFromID(1),
+			DiscoKey: makeDiscoKeyFromID(1),
+			Addresses: []netip.Prefix{
+				netip.MustParsePrefix("100.64.0.1/32"),
+				netip.MustParsePrefix("fd7a:115c:a1e0::1/128"),
+			},
+		}).View(),
+		Peers: []tailcfg.NodeView{
+			(&tailcfg.Node{
+				ID:       2,
+				Name:     "peer1.tail-scale.ts.net.",
+				Key:      makeNodeKeyFromID(2),
+				DiscoKey: makeDiscoKeyFromID(2),
+				Addresses: []netip.Prefix{
+					netip.MustParsePrefix("100.64.0.2/32"),
+					netip.MustParsePrefix("fd7a:115c:a1e0::2/128"),
+				},
+			}).View(),
+			(&tailcfg.Node{
+				ID:       3,
+				Name:     "v6only.tail-scale.ts.net.",
+				Key:      makeNodeKeyFromID(3),
+				DiscoKey: makeDiscoKeyFromID(3),
+				Addresses: []netip.Prefix{
+					netip.MustParsePrefix("fd7a:115c:a1e0::3/128"),
+				},
+			}).View(),
+		},
+		DNS: tailcfg.DNSConfig{
+			ExtraRecords: []tailcfg.DNSRecord{
+				{Name: "svc-foo.tail-scale.ts.net.", Value: "100.11.22.33"},
+			},
+		},
+	}
+	nm.Domain = "tail-scale.ts.net"
+	b.currentNode().SetNetMap(nm)
+
+	tests := []struct {
+		name    string
+		host    string
+		network string
+		wantIP  string
+		wantOK  bool
+	}{
+		{name: "fqdn", host: "peer1.tail-scale.ts.net", network: "tcp", wantIP: "100.64.0.2", wantOK: true},
+		{name: "short_name", host: "peer1", network: "tcp", wantIP: "100.64.0.2", wantOK: true},
+		{name: "self_fqdn", host: "self.tail-scale.ts.net", network: "tcp", wantIP: "100.64.0.1", wantOK: true},
+		{name: "self_short", host: "self", network: "tcp", wantIP: "100.64.0.1", wantOK: true},
+		{name: "tcp4", host: "peer1", network: "tcp4", wantIP: "100.64.0.2", wantOK: true},
+		{name: "tcp6", host: "peer1", network: "tcp6", wantIP: "fd7a:115c:a1e0::2", wantOK: true},
+		{name: "v6only_tcp", host: "v6only", network: "tcp", wantIP: "fd7a:115c:a1e0::3", wantOK: true},
+		{name: "v6only_tcp4_miss", host: "v6only", network: "tcp4", wantOK: false},
+		{name: "extra_record", host: "svc-foo.tail-scale.ts.net", network: "tcp", wantIP: "100.11.22.33", wantOK: true},
+		{name: "extra_record_tcp6_miss", host: "svc-foo.tail-scale.ts.net", network: "tcp6", wantOK: false},
+		{name: "unknown", host: "nope", network: "tcp", wantOK: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ip, ok := b.resolveMagicDNS(tt.host, tt.network)
+			if ok != tt.wantOK {
+				t.Fatalf("resolveMagicDNS(%q, %q): ok=%v, want %v", tt.host, tt.network, ok, tt.wantOK)
+			}
+			if ok && ip.String() != tt.wantIP {
+				t.Fatalf("resolveMagicDNS(%q, %q): ip=%v, want %v", tt.host, tt.network, ip, tt.wantIP)
+			}
+		})
+	}
+}
diff --git a/ipn/ipnlocal/routecheck_disabled.go b/ipn/ipnlocal/routecheck_disabled.go
new file mode 100644
index 000000000..3a4194651
--- /dev/null
+++ b/ipn/ipnlocal/routecheck_disabled.go
@@ -0,0 +1,12 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build ts_omit_routecheck
+
+package ipnlocal
+
+import "tailscale.com/tailcfg"
+
+func isRouteCheckEnabled(self tailcfg.NodeView) bool {
+	return false
+}
diff --git a/ipn/ipnlocal/routecheck_enabled.go b/ipn/ipnlocal/routecheck_enabled.go
new file mode 100644
index 000000000..3687ba60f
--- /dev/null
+++ b/ipn/ipnlocal/routecheck_enabled.go
@@ -0,0 +1,15 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !ts_omit_routecheck
+
+package ipnlocal
+
+import (
+	"tailscale.com/net/routecheck"
+	"tailscale.com/tailcfg"
+)
+
+func isRouteCheckEnabled(self tailcfg.NodeView) bool {
+	return routecheck.IsEnabled(self)
+}
diff --git a/ipn/ipnlocal/serve.go b/ipn/ipnlocal/serve.go
index 9460896ad..a2520e300 100644
--- a/ipn/ipnlocal/serve.go
+++ b/ipn/ipnlocal/serve.go
@@ -48,6 +48,7 @@ import (
 	"tailscale.com/util/ctxkey"
 	"tailscale.com/util/mak"
 	"tailscale.com/util/slicesx"
+	"tailscale.com/util/usermetric"
 	"tailscale.com/version"
 )
 
@@ -276,7 +277,7 @@ func (b *LocalBackend) updateServeTCPPortNetMapAddrListenersLocked(ports []uint1
 		}
 	}
 
-	nm := b.NetMap()
+	nm := b.NetMapNoPeers()
 	if nm == nil {
 		b.logf("netMap is nil")
 		return
@@ -333,7 +334,7 @@ func (b *LocalBackend) setServeConfigLocked(config *ipn.ServeConfig, etag string
 		return errors.New("can't reconfigure tailscaled when using a config file; config file is locked")
 	}
 
-	nm := b.NetMap()
+	nm := b.NetMapNoPeers()
 	if nm == nil {
 		return errors.New("netMap is nil")
 	}
@@ -393,6 +394,11 @@ func (b *LocalBackend) setServeConfigLocked(config *ipn.ServeConfig, etag string
 		}
 	}
 
+	// Notify the control plane immediately so that changes to IngressEnabled /
+	// WireIngress (required for Funnel DNS provisioning) are not delayed until
+	// the next periodic heartbeat.
+	b.authReconfigLocked()
+
 	return nil
 }
 
@@ -534,6 +540,56 @@ func (b *LocalBackend) vipServicesFromPrefsLocked(prefs ipn.PrefsView) []*tailcf
 	return servicesList
 }
 
+type serviceMeteredConn struct {
+	net.Conn
+	inbound, outbound *usermetric.MultiLabelMap[serveLabels]
+	key               serveLabels
+}
+
+func (c *serviceMeteredConn) Read(p []byte) (int, error) {
+	n, err := c.Conn.Read(p)
+	if n > 0 {
+		c.inbound.Add(c.key, int64(n))
+	}
+	return n, err
+}
+
+func (c *serviceMeteredConn) Write(p []byte) (int, error) {
+	n, err := c.Conn.Write(p)
+	if n > 0 {
+		c.outbound.Add(c.key, int64(n))
+	}
+	return n, err
+}
+
+// CloseWrite forwards a write-half close to the underlying conn. We only embed
+// the net.Conn interface, which would otherwise hide the underlying conn's
+// CloseWrite; net/http's server relies on it (closeWriteAndWait) to send a FIN
+// and drain gracefully when a connection won't be reused, avoiding a truncating
+// RST on the final response.
+func (c *serviceMeteredConn) CloseWrite() error {
+	if cw, ok := c.Conn.(interface{ CloseWrite() error }); ok {
+		return cw.CloseWrite()
+	}
+	return nil
+}
+
+// meteredConnForService wraps c to count peer bytes against the per-Service
+// Serve counters. The per-Service series is never evicted, so it leaks
+// (intentionally) until tailscaled exits.
+func (b *LocalBackend) meteredConnForService(c net.Conn, svc tailcfg.ServiceName) net.Conn {
+	// Plain (non-Service) serve passes an empty svc; don't meter it.
+	if svc == "" || b.metrics.serveBytesInbound == nil || b.metrics.serveBytesOutbound == nil {
+		return c
+	}
+	return &serviceMeteredConn{
+		Conn:     c,
+		inbound:  b.metrics.serveBytesInbound,
+		outbound: b.metrics.serveBytesOutbound,
+		key:      serveLabels{Service: svc.String()},
+	}
+}
+
 // tcpHandlerForVIPService returns a handler for a TCP connection to a VIP service
 // that is being served via the ipn.ServeConfig. It returns nil if the destination
 // address is not a VIP service or if the VIP service does not have a TCP handler set.
@@ -560,68 +616,14 @@ func (b *LocalBackend) tcpHandlerForVIPService(dstAddr, srcAddr netip.AddrPort)
 		return nil
 	}
 
-	if tcph.HTTPS() || tcph.HTTP() {
-		hs := &http.Server{
-			Handler: http.HandlerFunc(b.serveWebHandler),
-			BaseContext: func(_ net.Listener) context.Context {
-				return serveHTTPContextKey.WithValue(context.Background(), &serveHTTPContext{
-					SrcAddr:       srcAddr,
-					ForVIPService: dstSvc,
-					DestPort:      dport,
-				})
-			},
-		}
-		if tcph.HTTPS() {
-			// TODO(kevinliang10): just leaving this TLS cert creation as if we don't have other
-			// hostnames, but for services this getTLSServeCetForPort will need a version that also take
-			// in the hostname. How to store the TLS cert is still being discussed.
-			hs.TLSConfig = &tls.Config{
-				GetCertificate: b.getTLSServeCertForPort(dport, dstSvc),
-			}
-			return func(c net.Conn) error {
-				return hs.ServeTLS(netutil.NewOneConnListener(c, nil), "", "")
-			}
-		}
-
-		return func(c net.Conn) error {
-			return hs.Serve(netutil.NewOneConnListener(c, nil))
-		}
-	}
-
-	if backDst := tcph.TCPForward(); backDst != "" {
-		return func(conn net.Conn) error {
-			defer conn.Close()
-			ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-			backConn, err := b.dialer.SystemDial(ctx, "tcp", backDst)
-			cancel()
-			if err != nil {
-				b.logf("localbackend: failed to TCP proxy port %v (from %v) to %s: %v", dport, srcAddr, backDst, err)
-				return nil
-			}
-			defer backConn.Close()
-			if sni := tcph.TerminateTLS(); sni != "" {
-				conn = tls.Server(conn, &tls.Config{
-					GetCertificate: func(hi *tls.ClientHelloInfo) (*tls.Certificate, error) {
-						ctx, cancel := context.WithTimeout(context.Background(), time.Minute)
-						defer cancel()
-						pair, err := b.GetCertPEM(ctx, sni)
-						if err != nil {
-							return nil, err
-						}
-						cert, err := tls.X509KeyPair(pair.CertPEM, pair.KeyPEM)
-						if err != nil {
-							return nil, err
-						}
-						return &cert, nil
-					},
-				})
-			}
-
-			return b.forwardTCPWithProxyProtocol(conn, backConn, tcph.ProxyProtocol(), srcAddr, dport, backDst)
-		}
-	}
-
-	return nil
+	// TODO(kevinliang10): just leaving this TLS cert creation as if we don't have other
+	// hostnames, but for services this getTLSServeCetForPort will need a version that also take
+	// in the hostname. How to store the TLS cert is still being discussed.
+	return b.tcpHandlerForServeTCP(tcph, dport, srcAddr, &serveHTTPContext{
+		SrcAddr:       srcAddr,
+		ForVIPService: dstSvc,
+		DestPort:      dport,
+	}, dstSvc)
 }
 
 // tcpHandlerForServe returns a handler for a TCP connection to be served via
@@ -641,27 +643,32 @@ func (b *LocalBackend) tcpHandlerForServe(dport uint16, srcAddr netip.AddrPort,
 		return nil
 	}
 
+	return b.tcpHandlerForServeTCP(tcph, dport, srcAddr, &serveHTTPContext{
+		Funnel:   f,
+		SrcAddr:  srcAddr,
+		DestPort: dport,
+	}, "")
+}
+
+func (b *LocalBackend) tcpHandlerForServeTCP(tcph ipn.TCPPortHandlerView, dport uint16, srcAddr netip.AddrPort, httpCtx *serveHTTPContext, forVIPService tailcfg.ServiceName) func(net.Conn) error {
 	if tcph.HTTPS() || tcph.HTTP() {
 		hs := &http.Server{
 			Handler: http.HandlerFunc(b.serveWebHandler),
 			BaseContext: func(_ net.Listener) context.Context {
-				return serveHTTPContextKey.WithValue(context.Background(), &serveHTTPContext{
-					Funnel:   f,
-					SrcAddr:  srcAddr,
-					DestPort: dport,
-				})
+				c := *httpCtx
+				return serveHTTPContextKey.WithValue(context.Background(), &c)
 			},
 		}
 		if tcph.HTTPS() {
-			hs.TLSConfig = &tls.Config{
-				GetCertificate: b.getTLSServeCertForPort(dport, ""),
-			}
+			hs.TLSConfig = b.serveTLSConfig(b.getTLSServeCertForPort(dport, forVIPService), serveTLSNextProtos())
 			return func(c net.Conn) error {
+				c = b.meteredConnForService(c, forVIPService)
 				return hs.ServeTLS(netutil.NewOneConnListener(c, nil), "", "")
 			}
 		}
 
 		return func(c net.Conn) error {
+			c = b.meteredConnForService(c, forVIPService)
 			return hs.Serve(netutil.NewOneConnListener(c, nil))
 		}
 	}
@@ -669,8 +676,16 @@ func (b *LocalBackend) tcpHandlerForServe(dport uint16, srcAddr netip.AddrPort,
 	if backDst := tcph.TCPForward(); backDst != "" {
 		return func(conn net.Conn) error {
 			defer conn.Close()
+			conn = b.meteredConnForService(conn, forVIPService)
 			ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-			backConn, err := b.dialer.SystemDial(ctx, "tcp", backDst)
+			var backConn net.Conn
+			var err error
+			if socketPath, ok := strings.CutPrefix(backDst, "unix:"); ok {
+				var d net.Dialer
+				backConn, err = d.DialContext(ctx, "unix", socketPath)
+			} else {
+				backConn, err = b.dialer.SystemDial(ctx, "tcp", backDst)
+			}
 			cancel()
 			if err != nil {
 				b.logf("localbackend: failed to TCP proxy port %v (from %v) to %s: %v", dport, srcAddr, backDst, err)
@@ -678,21 +693,22 @@ func (b *LocalBackend) tcpHandlerForServe(dport uint16, srcAddr netip.AddrPort,
 			}
 			defer backConn.Close()
 			if sni := tcph.TerminateTLS(); sni != "" {
-				conn = tls.Server(conn, &tls.Config{
-					GetCertificate: func(hi *tls.ClientHelloInfo) (*tls.Certificate, error) {
-						ctx, cancel := context.WithTimeout(context.Background(), time.Minute)
-						defer cancel()
-						pair, err := b.GetCertPEM(ctx, sni)
-						if err != nil {
-							return nil, err
-						}
-						cert, err := tls.X509KeyPair(pair.CertPEM, pair.KeyPEM)
-						if err != nil {
-							return nil, err
-						}
-						return &cert, nil
-					},
-				})
+				conn = tls.Server(conn, b.serveTLSConfig(func(hi *tls.ClientHelloInfo) (*tls.Certificate, error) {
+					if cert, ok := b.getACMETLSALPNCert(hi); ok {
+						return cert, nil
+					}
+					ctx, cancel := context.WithTimeout(context.Background(), time.Minute)
+					defer cancel()
+					pair, err := b.GetCertPEM(ctx, sni)
+					if err != nil {
+						return nil, err
+					}
+					cert, err := tls.X509KeyPair(pair.CertPEM, pair.KeyPEM)
+					if err != nil {
+						return nil, err
+					}
+					return &cert, nil
+				}, nil))
 			}
 
 			// TODO(bradfitz): do the RegisterIPPortIdentity and
@@ -710,7 +726,13 @@ func (b *LocalBackend) tcpHandlerForServe(dport uint16, srcAddr netip.AddrPort,
 func (b *LocalBackend) forwardTCPWithProxyProtocol(conn, backConn net.Conn, proxyProtoVer int, srcAddr netip.AddrPort, dport uint16, backDst string) error {
 	var proxyHeader []byte
 	if proxyProtoVer > 0 {
-		backAddr := backConn.RemoteAddr().(*net.TCPAddr)
+		// PROXY protocol requires a valid TCP destination address.
+		// For Unix socket backends, RemoteAddr is *net.UnixAddr;
+		// the CLI rejects this combination, but guard here as well.
+		backAddr, ok := backConn.RemoteAddr().(*net.TCPAddr)
+		if !ok {
+			return fmt.Errorf("PROXY protocol is not supported with non-TCP backend %s", backDst)
+		}
 
 		// We always want to format the PROXY protocol header based on
 		// the IPv4 or IPv6-ness of the client. The SourceAddr and
@@ -814,6 +836,15 @@ func (b *LocalBackend) getServeHandler(r *http.Request) (_ ipn.HTTPHandlerView,
 		return h, r.URL.Path, true
 	}
 	pth := path.Clean(r.URL.Path)
+	// A well-formed origin-form request path is absolute. Malformed request
+	// targets — "*" (e.g. "GET *") and "" (e.g. "CONNECT" authority-form),
+	// clean to "*" and "." respectively. Those are path.Dir fixed points that
+	// never equal "/" and match no mount, so without this guard the loop below
+	// would spin forever on one CPU core (a remote DoS via serve, or via funnel
+	// from the internet).
+	if !strings.HasPrefix(pth, "/") {
+		return z, "", false
+	}
 	for {
 		withSlash := pth + "/"
 		if h, ok := wsc.Handlers().GetOk(withSlash); ok {
@@ -825,7 +856,13 @@ func (b *LocalBackend) getServeHandler(r *http.Request) (_ ipn.HTTPHandlerView,
 		if pth == "/" {
 			return z, "", false
 		}
-		pth = path.Dir(pth)
+		// Belt-and-suspenders with the absolute-path check above: stop if
+		// path.Dir stops shrinking rather than assuming it always reaches "/".
+		if parent := path.Dir(pth); parent != pth {
+			pth = parent
+		} else {
+			return z, "", false
+		}
 	}
 }
 
@@ -1311,6 +1348,9 @@ func (b *LocalBackend) getTLSServeCertForPort(port uint16, forVIPService tailcfg
 		if hi == nil || hi.ServerName == "" {
 			return nil, errors.New("no SNI ServerName")
 		}
+		if cert, ok := b.getACMETLSALPNCert(hi); ok {
+			return cert, nil
+		}
 		_, ok := b.webServerConfig(hi.ServerName, forVIPService, port)
 		if !ok {
 			return nil, errors.New("no webserver configured for name/port")
@@ -1330,6 +1370,48 @@ func (b *LocalBackend) getTLSServeCertForPort(port uint16, forVIPService tailcfg
 	}
 }
 
+// serveTLSConfig returns the TLS configuration used by Serve and TCP-forwarded
+// TLS listeners. nextProtos is the ALPN list to advertise for normal
+// handshakes; it should be serveTLSNextProtos for HTTPS Serve and nil for
+// TLS-terminated TCP forwarding where we don't know the backend protocol.
+// During an ACME tls-alpn-01 renewal, GetConfigForClient clones the base config
+// and temporarily prepends acme-tls/1, but only for the exact SNI with a pending
+// challenge certificate. This keeps ordinary Serve traffic from advertising
+// ACME support and lets Go's TLS stack negotiate the challenge protocol before
+// GetCertificate is called.
+func (b *LocalBackend) serveTLSConfig(getCert func(*tls.ClientHelloInfo) (*tls.Certificate, error), nextProtos []string) *tls.Config {
+	base := &tls.Config{
+		GetCertificate: getCert,
+		NextProtos:     nextProtos,
+	}
+	base.GetConfigForClient = func(hi *tls.ClientHelloInfo) (*tls.Config, error) {
+		var nextProtos []string
+		if proto, ok := b.getACMETLSALPNProto(hi); ok {
+			b.logf("serve: accepting ACME tls-alpn-01 challenge for %q", hi.ServerName)
+			nextProtos = append(nextProtos, proto)
+		}
+		if len(nextProtos) == 0 {
+			return nil, nil
+		}
+		cfg := base.Clone()
+		cfg.NextProtos = append(nextProtos, base.NextProtos...)
+		return cfg, nil
+	}
+	return base
+}
+
+// HasFunnelForHostPort reports whether the LocalBackend's serve config
+// has Funnel enabled for host:port.
+func (b *LocalBackend) HasFunnelForHostPort(host string, port uint16) bool {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	if !b.serveConfig.Valid() {
+		return false
+	}
+	hp := ipn.HostPort(net.JoinHostPort(host, strconv.Itoa(int(port))))
+	return b.serveConfig.HasFunnelForTarget(hp)
+}
+
 // setServeProxyHandlersLocked ensures there is an http proxy handler for each
 // backend specified in serveConfig. It expects serveConfig to be valid and
 // up-to-date, so should be called after reloadServeConfigLocked.
@@ -1551,6 +1633,7 @@ func (b *LocalBackend) reloadServeConfigLocked(prefs ipn.PrefsView) {
 	if err != nil {
 		b.lastServeConfJSON = mem.B(nil)
 		b.serveConfig = ipn.ServeConfigView{}
+		b.updateCertRefreshLoopLocked()
 		return
 	}
 	if b.lastServeConfJSON.Equal(mem.B(confj)) {
@@ -1561,6 +1644,7 @@ func (b *LocalBackend) reloadServeConfigLocked(prefs ipn.PrefsView) {
 	if err := json.Unmarshal(confj, &conf); err != nil {
 		b.logf("invalid ServeConfig %q in StateStore: %v", confKey, err)
 		b.serveConfig = ipn.ServeConfigView{}
+		b.updateCertRefreshLoopLocked()
 		return
 	}
 
@@ -1571,6 +1655,7 @@ func (b *LocalBackend) reloadServeConfigLocked(prefs ipn.PrefsView) {
 	})
 
 	b.serveConfig = conf.View()
+	b.updateCertRefreshLoopLocked()
 }
 
 func (b *LocalBackend) setVIPServicesTCPPortsInterceptedLocked(svcPorts map[tailcfg.ServiceName][]uint16) {
diff --git a/ipn/ipnlocal/serve_disabled.go b/ipn/ipnlocal/serve_disabled.go
index e9d2678a8..7123ebe3b 100644
--- a/ipn/ipnlocal/serve_disabled.go
+++ b/ipn/ipnlocal/serve_disabled.go
@@ -28,6 +28,9 @@ type funnelFlow = struct{}
 
 func (*LocalBackend) hasIngressEnabledLocked() bool         { return false }
 func (*LocalBackend) shouldWireInactiveIngressLocked() bool { return false }
+func (*LocalBackend) HasFunnelForHostPort(host string, port uint16) bool {
+	return false
+}
 
 func (b *LocalBackend) vipServicesFromPrefsLocked(prefs ipn.PrefsView) []*tailcfg.VIPService {
 	return nil
diff --git a/ipn/ipnlocal/serve_metrics_test.go b/ipn/ipnlocal/serve_metrics_test.go
new file mode 100644
index 000000000..d1289ec31
--- /dev/null
+++ b/ipn/ipnlocal/serve_metrics_test.go
@@ -0,0 +1,82 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !ts_omit_serve && !ts_omit_usermetrics
+
+package ipnlocal
+
+import (
+	"expvar"
+	"io"
+	"net"
+	"testing"
+
+	"tailscale.com/tailcfg"
+	"tailscale.com/util/usermetric"
+)
+
+func counterValue(m *usermetric.MultiLabelMap[serveLabels], svc string) int64 {
+	v, _ := m.Get(serveLabels{Service: svc}).(*expvar.Int)
+	if v == nil {
+		return -1
+	}
+	return v.Value()
+}
+
+func TestServiceMeteredConn(t *testing.T) {
+	b := newTestBackend(t)
+
+	clientSide, serverSide := net.Pipe()
+	defer clientSide.Close()
+	defer serverSide.Close()
+
+	wrapped := b.meteredConnForService(serverSide, tailcfg.ServiceName("svc:foo"))
+
+	const inboundPayload = "hello from client"
+	writeDone := make(chan struct{})
+	go func() {
+		clientSide.Write([]byte(inboundPayload))
+		close(writeDone)
+	}()
+	buf := make([]byte, len(inboundPayload))
+	if _, err := io.ReadFull(wrapped, buf); err != nil {
+		t.Fatalf("read: %v", err)
+	}
+	<-writeDone
+	if got := counterValue(b.metrics.serveBytesInbound, "svc:foo"); got != int64(len(inboundPayload)) {
+		t.Errorf("inbound = %d; want %d", got, len(inboundPayload))
+	}
+
+	// Deliberately a different length than inboundPayload so a backwards
+	// inbound/outbound wiring can't pass.
+	const outboundPayload = "hello from the server side"
+	writeDone = make(chan struct{})
+	go func() {
+		wrapped.Write([]byte(outboundPayload))
+		close(writeDone)
+	}()
+	buf = make([]byte, len(outboundPayload))
+	if _, err := io.ReadFull(clientSide, buf); err != nil {
+		t.Fatalf("read: %v", err)
+	}
+	<-writeDone
+	if got := counterValue(b.metrics.serveBytesOutbound, "svc:foo"); got != int64(len(outboundPayload)) {
+		t.Errorf("outbound = %d; want %d", got, len(outboundPayload))
+	}
+}
+
+func TestServiceMeteredConnLabelKeepsPrefix(t *testing.T) {
+	b := newTestBackend(t)
+	c1, c2 := net.Pipe()
+	defer c1.Close()
+	defer c2.Close()
+	wrapped := b.meteredConnForService(c1, tailcfg.ServiceName("svc:my-app"))
+	go c2.Write([]byte("x"))
+	io.ReadFull(wrapped, make([]byte, 1))
+	if v := counterValue(b.metrics.serveBytesInbound, "svc:my-app"); v != 1 {
+		t.Errorf("inbound for service=\"svc:my-app\" = %d; want 1", v)
+	}
+	if v := counterValue(b.metrics.serveBytesInbound, "my-app"); v != -1 {
+		t.Errorf("counter unexpectedly present under prefix-stripped name; got %d", v)
+	}
+}
diff --git a/ipn/ipnlocal/serve_test.go b/ipn/ipnlocal/serve_test.go
index 05f4936b2..205dc674e 100644
--- a/ipn/ipnlocal/serve_test.go
+++ b/ipn/ipnlocal/serve_test.go
@@ -15,6 +15,7 @@ import (
 	"fmt"
 	"io"
 	"mime"
+	"net"
 	"net/http"
 	"net/http/httptest"
 	"net/netip"
@@ -22,6 +23,7 @@ import (
 	"os"
 	"path/filepath"
 	"reflect"
+	"strconv"
 	"strings"
 	"testing"
 	"time"
@@ -188,6 +190,34 @@ func TestGetServeHandler(t *testing.T) {
 			path: "/foo/../../../../../../../../etc/passwd",
 			want: "/",
 		},
+		// Malformed request targets that net/http hands the handler verbatim.
+		// These clean to a path.Dir fixed point ("*" or ".") that never reaches
+		// "/", and once spun the getServeHandler loop below forever (a remote
+		// serve/funnel DoS). They must resolve to not-found, not hang.
+		{
+			name: "asterisk", // "GET *"
+			conf: conf1,
+			path: "*",
+			want: "",
+		},
+		{
+			name: "empty", // "CONNECT" authority-form sets URL.Path to ""
+			conf: conf1,
+			path: "",
+			want: "",
+		},
+		{
+			name: "dot",
+			conf: conf1,
+			path: ".",
+			want: "",
+		},
+		{
+			name: "asterisk-subpath",
+			conf: conf1,
+			path: "*/foo",
+			want: "",
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -207,6 +237,9 @@ func TestGetServeHandler(t *testing.T) {
 				DestPort: port,
 			}))
 
+			// A malformed target like "*" or "" once spun getServeHandler's
+			// path-walk loop forever; a regression would hang here until the
+			// package test timeout fires.
 			h, got, ok := b.getServeHandler(req)
 			if (got != "") != ok {
 				t.Fatalf("got ok=%v, but got mountPoint=%q", ok, got)
@@ -1361,6 +1394,227 @@ func TestServeGRPCProxy(t *testing.T) {
 	}
 }
 
+// TestServeProxyHTTP2PreservesContentType is a repro for tailscale/tailscale#19866.
+// A client POSTs over HTTP/2 to a serve listener configured to reverse-proxy to a
+// plaintext HTTP/1.1 backend; the test asserts the backend sees the Content-Type
+// header that the client sent.
+func TestServeProxyHTTP2PreservesContentType(t *testing.T) {
+	var (
+		gotHeader http.Header
+		gotMethod string
+		gotProto  string
+		gotBody   string
+	)
+	backend := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotHeader = r.Header.Clone()
+		gotMethod = r.Method
+		gotProto = r.Proto
+		b, _ := io.ReadAll(r.Body)
+		gotBody = string(b)
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer backend.Close()
+	backendURL := must.Get(url.Parse(backend.URL))
+
+	lb := newTestBackend(t)
+	rp := &reverseProxy{
+		logf:    t.Logf,
+		url:     backendURL,
+		backend: backend.URL,
+		lb:      lb,
+	}
+
+	// Mirror serveWebHandler's behavior for a mount of "/" with a non-"/" path:
+	// it wraps the proxy in http.StripPrefix("", rp). That's a no-op for "/mcp"
+	// but worth exercising in case StripPrefix interacts weirdly with HTTP/2.
+	frontHandler := http.StripPrefix("", http.HandlerFunc(rp.ServeHTTP))
+	front := httptest.NewUnstartedServer(frontHandler)
+	front.EnableHTTP2 = true
+	front.StartTLS()
+	defer front.Close()
+
+	const reqBody = `{"jsonrpc":"2.0","id":1,"method":"initialize","params":{}}`
+
+	type variant struct {
+		name           string
+		http1Only      bool
+		contentType    string
+		setAccept      bool
+		setContentLen  bool // if false, body is a Reader with unknown length (chunked)
+		dropContentLen bool
+		emptyBody      bool
+	}
+	variants := []variant{
+		{name: "baseline_http2", contentType: "application/json", setAccept: true, setContentLen: true},
+		{name: "http1_baseline", http1Only: true, contentType: "application/json", setAccept: true, setContentLen: true},
+		{name: "no_accept", contentType: "application/json", setContentLen: true},
+		{name: "charset_param", contentType: "application/json; charset=utf-8", setAccept: true, setContentLen: true},
+		{name: "chunked", contentType: "application/json", setAccept: true, setContentLen: false},
+		{name: "drop_content_length", contentType: "application/json", setAccept: true, dropContentLen: true},
+		{name: "empty_body", contentType: "application/json", setAccept: true, emptyBody: true},
+	}
+
+	for _, v := range variants {
+		t.Run(v.name, func(t *testing.T) {
+			gotHeader = nil
+			gotMethod = ""
+			gotProto = ""
+			gotBody = ""
+
+			var body io.Reader
+			switch {
+			case v.emptyBody:
+				body = http.NoBody
+			case v.setContentLen:
+				body = strings.NewReader(reqBody)
+			default:
+				// io.Reader that isn't a *bytes.Reader / *strings.Reader / *bytes.Buffer
+				// so net/http does not auto-set Content-Length.
+				body = struct{ io.Reader }{strings.NewReader(reqBody)}
+			}
+
+			url := front.URL + "/mcp"
+			req, err := http.NewRequest("POST", url, body)
+			if err != nil {
+				t.Fatal(err)
+			}
+			req.Header.Set("Content-Type", v.contentType)
+			if v.setAccept {
+				req.Header.Set("Accept", "application/json, text/event-stream")
+			}
+			if v.dropContentLen {
+				req.ContentLength = -1
+			}
+
+			client := front.Client()
+			if v.http1Only {
+				// Force the client onto HTTP/1.1 by removing h2 from ALPN.
+				tr := client.Transport.(*http.Transport).Clone()
+				if tr.TLSClientConfig != nil {
+					tr.TLSClientConfig = tr.TLSClientConfig.Clone()
+					tr.TLSClientConfig.NextProtos = []string{"http/1.1"}
+				}
+				tr.ForceAttemptHTTP2 = false
+				client = &http.Client{Transport: tr}
+			}
+
+			res, err := client.Do(req)
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer res.Body.Close()
+			io.Copy(io.Discard, res.Body)
+
+			wantProtoMajor := 2
+			if v.http1Only {
+				wantProtoMajor = 1
+			}
+			if res.ProtoMajor != wantProtoMajor {
+				t.Fatalf("front-end proto = %s, want HTTP/%d.x", res.Proto, wantProtoMajor)
+			}
+			if res.StatusCode != http.StatusOK {
+				t.Fatalf("backend returned status %d, want 200", res.StatusCode)
+			}
+			if gotMethod != "POST" {
+				t.Errorf("backend method = %q, want POST", gotMethod)
+			}
+			t.Logf("backend saw proto=%q content-length=%q transfer-encoding=%v body=%q",
+				gotProto, gotHeader.Get("Content-Length"), gotHeader.Values("Transfer-Encoding"), gotBody)
+			if got, want := gotHeader.Get("Content-Type"), v.contentType; got != want {
+				t.Errorf("Content-Type at backend = %q, want %q (full headers: %v)", got, want, gotHeader)
+			}
+		})
+	}
+}
+
+// TestServeWebHandlerHTTP2PreservesContentType drives the full
+// b.serveWebHandler entry point (the actual production code path) via a real
+// HTTP/2 TLS frontend, with serveHTTPContext.Funnel set to mimic a funnel
+// request. Repro probe for tailscale/tailscale#19866.
+func TestServeWebHandlerHTTP2PreservesContentType(t *testing.T) {
+	var gotHeader http.Header
+	backend := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotHeader = r.Header.Clone()
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer backend.Close()
+
+	b := newTestBackend(t)
+
+	front := httptest.NewUnstartedServer(http.HandlerFunc(b.serveWebHandler))
+	front.EnableHTTP2 = true
+	realFrontAddr := front.Listener.Addr().String()
+	_, portStr, _ := net.SplitHostPort(realFrontAddr)
+	p, _ := strconv.ParseUint(portStr, 10, 16)
+	frontPort := uint16(p)
+	front.Config.BaseContext = func(_ net.Listener) context.Context {
+		return serveHTTPContextKey.WithValue(context.Background(), &serveHTTPContext{
+			Funnel:   &funnelFlow{Host: "example.ts.net"},
+			SrcAddr:  netip.MustParseAddrPort("1.2.3.4:1234"),
+			DestPort: frontPort,
+		})
+	}
+	front.StartTLS()
+	defer front.Close()
+
+	conf := &ipn.ServeConfig{
+		Web: map[ipn.HostPort]*ipn.WebServerConfig{
+			ipn.HostPort(net.JoinHostPort("example.ts.net", portStr)): {Handlers: map[string]*ipn.HTTPHandler{
+				"/": {Proxy: backend.URL},
+			}},
+		},
+	}
+	if err := b.SetServeConfig(conf, ""); err != nil {
+		t.Fatal(err)
+	}
+
+	// Custom client: dial example.ts.net:PORT to the real httptest address,
+	// skip cert verification, and send SNI "example.ts.net" so the serveConfig
+	// host lookup works.
+	tr := front.Client().Transport.(*http.Transport).Clone()
+	tr.DialContext = func(ctx context.Context, network, addr string) (net.Conn, error) {
+		var d net.Dialer
+		return d.DialContext(ctx, "tcp", realFrontAddr)
+	}
+	tr.TLSClientConfig = &tls.Config{
+		InsecureSkipVerify: true,
+		ServerName:         "example.ts.net",
+		NextProtos:         []string{"h2", "http/1.1"},
+	}
+	tr.ForceAttemptHTTP2 = true
+	client := &http.Client{Transport: tr}
+
+	const reqBody = `{"jsonrpc":"2.0","id":1,"method":"initialize","params":{}}`
+	url := "https://example.ts.net:" + portStr + "/mcp"
+	req, err := http.NewRequest("POST", url, strings.NewReader(reqBody))
+	if err != nil {
+		t.Fatal(err)
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Accept", "application/json, text/event-stream")
+
+	res, err := client.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer res.Body.Close()
+	body, _ := io.ReadAll(res.Body)
+
+	if res.ProtoMajor != 2 {
+		t.Fatalf("front-end proto = %s, want HTTP/2", res.Proto)
+	}
+	if res.StatusCode != http.StatusOK {
+		t.Fatalf("status %d, want 200; body=%q", res.StatusCode, body)
+	}
+	t.Logf("backend headers (full): %v", gotHeader)
+	if got, want := gotHeader.Get("Content-Type"), "application/json"; got != want {
+		t.Errorf("Content-Type at backend = %q, want %q", got, want)
+	}
+	if got := gotHeader.Get("Tailscale-Funnel-Request"); got != "?1" {
+		t.Errorf("Tailscale-Funnel-Request = %q, want %q (sanity check)", got, "?1")
+	}
+}
+
 func TestServeHTTPRedirect(t *testing.T) {
 	b := newTestBackend(t)
 
diff --git a/ipn/ipnlocal/serve_unix_test.go b/ipn/ipnlocal/serve_unix_test.go
index 9e641e0e5..d2db63ff0 100644
--- a/ipn/ipnlocal/serve_unix_test.go
+++ b/ipn/ipnlocal/serve_unix_test.go
@@ -12,12 +12,14 @@ import (
 	"net"
 	"net/http"
 	"net/http/httptest"
+	"net/netip"
 	"net/url"
 	"os"
 	"path/filepath"
 	"testing"
 	"time"
 
+	"tailscale.com/ipn"
 	"tailscale.com/tstest"
 )
 
@@ -238,3 +240,83 @@ func TestServeBlocksTailscaledSocket(t *testing.T) {
 		t.Error("expected valid handler for legitimate socket")
 	}
 }
+
+func TestTCPForwardUnixSocket(t *testing.T) {
+	tmpDir := t.TempDir()
+
+	socketPath := filepath.Join(tmpDir, "backend.sock")
+
+	// Create a Unix socket echo server
+	listener, err := net.Listen("unix", socketPath)
+	if err != nil {
+		t.Fatalf("failed to create unix socket listener: %v", err)
+	}
+	defer listener.Close()
+
+	go func() {
+		for {
+			conn, err := listener.Accept()
+			if err != nil {
+				return
+			}
+			go func() {
+				defer conn.Close()
+				io.Copy(conn, conn) // echo
+			}()
+		}
+	}()
+
+	// Set up a LocalBackend with a ServeConfig that forwards TCP port 3128 to the unix socket
+	b := newTestBackend(t)
+	b.logf = tstest.WhileTestRunningLogger(t)
+
+	conf := &ipn.ServeConfig{
+		TCP: map[uint16]*ipn.TCPPortHandler{
+			3128: {TCPForward: "unix:" + socketPath},
+		},
+	}
+	if err := b.SetServeConfig(conf, ""); err != nil {
+		t.Fatal("setting serve config:", err)
+	}
+
+	// Get the handler from tcpHandlerForServe
+	srcAddr := netip.MustParseAddrPort("100.100.100.1:12345")
+	handler := b.tcpHandlerForServe(3128, srcAddr, nil)
+	if handler == nil {
+		t.Fatal("tcpHandlerForServe returned nil handler")
+	}
+
+	// Create a pipe to simulate an incoming connection
+	clientConn, serverConn := net.Pipe()
+	defer clientConn.Close()
+
+	// Run the handler in a goroutine
+	handlerDone := make(chan error, 1)
+	go func() {
+		handlerDone <- handler(serverConn)
+	}()
+
+	// Write data through the "client" side and read the echo back
+	testData := []byte("hello via tcpHandlerForServe")
+	if _, err := clientConn.Write(testData); err != nil {
+		t.Fatalf("write failed: %v", err)
+	}
+	buf := make([]byte, len(testData))
+	if _, err := io.ReadFull(clientConn, buf); err != nil {
+		t.Fatalf("read failed: %v", err)
+	}
+	if string(buf) != string(testData) {
+		t.Fatalf("echo mismatch: got %q, want %q", buf, testData)
+	}
+
+	// Close client side, handler should finish
+	clientConn.Close()
+	select {
+	case err := <-handlerDone:
+		if err != nil {
+			t.Fatalf("handler returned unexpected error: %v", err)
+		}
+	case <-time.After(5 * time.Second):
+		t.Fatal("handler did not finish in time")
+	}
+}
diff --git a/ipn/ipnlocal/state_test.go b/ipn/ipnlocal/state_test.go
index 17e93a430..3ce554fac 100644
--- a/ipn/ipnlocal/state_test.go
+++ b/ipn/ipnlocal/state_test.go
@@ -9,6 +9,7 @@ import (
 	"fmt"
 	"math/rand/v2"
 	"net/netip"
+	"slices"
 	"strings"
 	"sync"
 	"sync/atomic"
@@ -16,6 +17,7 @@ import (
 	"time"
 
 	qt "github.com/frankban/quicktest"
+	"github.com/gaissmai/bart"
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
 
@@ -28,6 +30,7 @@ import (
 	"tailscale.com/net/dns"
 	"tailscale.com/net/netmon"
 	"tailscale.com/net/packet"
+	"tailscale.com/net/routemanager"
 	"tailscale.com/net/tsdial"
 	"tailscale.com/tailcfg"
 	"tailscale.com/tsd"
@@ -41,8 +44,6 @@ import (
 	"tailscale.com/types/preftype"
 	"tailscale.com/util/dnsname"
 	"tailscale.com/util/eventbus/eventbustest"
-	"tailscale.com/util/mak"
-	"tailscale.com/util/must"
 	"tailscale.com/wgengine"
 	"tailscale.com/wgengine/filter"
 	"tailscale.com/wgengine/magicsock"
@@ -136,6 +137,7 @@ type mockControl struct {
 	calls       []string
 	authBlocked bool
 	shutdown    chan struct{}
+	loginFlags  controlclient.LoginFlags
 
 	hi *tailcfg.Hostinfo
 }
@@ -273,6 +275,7 @@ func (cc *mockControl) Login(flags controlclient.LoginFlags) {
 	cc.mu.Lock()
 	defer cc.mu.Unlock()
 	cc.authBlocked = interact || newKeys
+	cc.loginFlags |= flags
 }
 
 func (cc *mockControl) Logout(ctx context.Context) error {
@@ -349,6 +352,39 @@ func (b *LocalBackend) nonInteractiveLoginForStateTest() {
 	cc.Login(b.loginFlags | controlclient.LoginInteractive)
 }
 
+// TestStartShutsDownPreviousControlClient verifies that Start waits for the
+// previous control client to fully shut down before creating a new one.
+//
+// If the old client is still alive when the new one starts, its in-flight
+// requests (carrying stale Hostinfo, notably RequestTags) can race with the
+// new client's requests at the control plane. That made retagging a node
+// with "tailscale up --advertise-tags" intermittently log the node out
+// (tailscale/tailscale#20365): a stale RequestTags update processed after
+// the tag transition looks like an invalid transition, so the control
+// server expires the node key.
+func TestStartShutsDownPreviousControlClient(t *testing.T) {
+	const enableLogging = true
+	var cc *mockControl
+	b := newLocalBackendWithTestControl(t, enableLogging, func(tb testing.TB, opts controlclient.Options) controlclient.Client {
+		if cc != nil {
+			select {
+			case <-cc.shutdown:
+			default:
+				t.Errorf("new control client created before the previous one was shut down")
+			}
+		}
+		cc = newClient(t, opts)
+		return cc
+	})
+
+	for i := range 3 {
+		t.Logf("Start %d", i+1)
+		if err := b.Start(ipn.Options{}); err != nil {
+			t.Fatalf("Start: %v", err)
+		}
+	}
+}
+
 // A very precise test of the sequence of function calls generated by
 // ipnlocal.Local into its controlclient instance, and the events it
 // produces upstream into the UI.
@@ -371,14 +407,6 @@ func (b *LocalBackend) nonInteractiveLoginForStateTest() {
 // predictable, but maybe a bit less thorough. This is more of an overall
 // state machine test than a test of the wgengine+magicsock integration.
 func TestStateMachine(t *testing.T) {
-	runTestStateMachine(t, false)
-}
-
-func TestStateMachineSeamless(t *testing.T) {
-	runTestStateMachine(t, true)
-}
-
-func runTestStateMachine(t *testing.T, seamless bool) {
 	envknob.Setenv("TAILSCALE_USE_WIP_CODE", "1")
 	defer envknob.Setenv("TAILSCALE_USE_WIP_CODE", "")
 	c := qt.New(t)
@@ -401,7 +429,7 @@ func runTestStateMachine(t *testing.T, seamless bool) {
 	t.Cleanup(b.Shutdown)
 
 	var cc, previousCC *mockControl
-	b.SetControlClientGetterForTesting(func(opts controlclient.Options) (controlclient.Client, error) {
+	b.ForTest().SetControlClientGetter(func(opts controlclient.Options) (controlclient.Client, error) {
 		previousCC = cc
 		cc = newClient(t, opts)
 
@@ -588,12 +616,6 @@ func runTestStateMachine(t *testing.T, seamless bool) {
 	cc.persist.UserProfile.LoginName = "user1"
 	cc.persist.NodeID = "node1"
 
-	// even if seamless is being enabled by default rather than by policy, this is
-	// the point where it will first get enabled.
-	if seamless {
-		sys.ControlKnobs().SeamlessKeyRenewal.Store(true)
-	}
-
 	cc.send(sendOpt{loginFinished: true, nm: &netmap.NetworkMap{}})
 	{
 		nn := notifies.drain(3)
@@ -696,6 +718,7 @@ func runTestStateMachine(t *testing.T, seamless bool) {
 	notifies.expect(5)
 	b.Logout(context.Background(), ipnauth.Self)
 	{
+		b.awaitNoGoroutinesInTest()
 		nn := notifies.drain(5)
 		previousCC.assertCalls("pause", "Logout", "unpause", "Shutdown")
 		// nn[0] is state notification (Stopped)
@@ -873,7 +896,9 @@ func runTestStateMachine(t *testing.T, seamless bool) {
 	// additional netmap updates. Since our LocalBackend instance already
 	// has a netmap, we will reset it to nil to simulate the first netmap
 	// retrieval.
+	b.mu.Lock()
 	b.setNetMapLocked(nil)
+	b.mu.Unlock()
 	cc.assertCalls("unpause")
 	//
 	// TODO: really the various GUIs and prefs should be refactored to
@@ -1052,6 +1077,7 @@ func runTestStateMachine(t *testing.T, seamless bool) {
 	}
 	notifies.expect(1)
 	// Fake a DERP connection.
+	b.awaitNoGoroutinesInTest()
 	b.setWgengineStatus(&wgengine.Status{DERPs: 1, AsOf: time.Now()}, nil)
 	{
 		nn := notifies.drain(1)
@@ -1153,7 +1179,7 @@ func TestWGEngineStatusRace(t *testing.T) {
 	t.Cleanup(b.Shutdown)
 
 	var cc *mockControl
-	b.SetControlClientGetterForTesting(func(opts controlclient.Options) (controlclient.Client, error) {
+	b.ForTest().SetControlClientGetter(func(opts controlclient.Options) (controlclient.Client, error) {
 		cc = newClient(t, opts)
 		return cc, nil
 	})
@@ -1212,10 +1238,10 @@ func TestEngineReconfigOnStateChange(t *testing.T) {
 	connect := &ipn.MaskedPrefs{Prefs: ipn.Prefs{WantRunning: true}, WantRunningSet: true}
 	disconnect := &ipn.MaskedPrefs{Prefs: ipn.Prefs{WantRunning: false}, WantRunningSet: true}
 	node1 := buildNetmapWithPeers(
-		makePeer(1, withName("node-1"), withAddresses(netip.MustParsePrefix("100.64.1.1/32"))),
+		makePeer(1, withName("node-1"), withAddresses(netip.MustParsePrefix("100.64.1.1/32")), withAllowedIPs(netip.MustParsePrefix("100.64.1.1/32"))),
 	)
 	node2 := buildNetmapWithPeers(
-		makePeer(2, withName("node-2"), withAddresses(netip.MustParsePrefix("100.64.1.2/32"))),
+		makePeer(2, withName("node-2"), withAddresses(netip.MustParsePrefix("100.64.1.2/32")), withAllowedIPs(netip.MustParsePrefix("100.64.1.2/32"))),
 	)
 	node3 := buildNetmapWithPeers(
 		makePeer(3, withName("node-3"), withAddresses(netip.MustParsePrefix("100.64.1.3/32"))),
@@ -1225,35 +1251,19 @@ func TestEngineReconfigOnStateChange(t *testing.T) {
 	routesWithQuad100 := func(extra ...netip.Prefix) []netip.Prefix {
 		return append(extra, netip.MustParsePrefix("100.100.100.100/32"))
 	}
-	hostsFor := func(nm *netmap.NetworkMap) map[dnsname.FQDN][]netip.Addr {
-		var hosts map[dnsname.FQDN][]netip.Addr
-		appendNode := func(n tailcfg.NodeView) {
-			addrs := make([]netip.Addr, 0, n.Addresses().Len())
-			for _, addr := range n.Addresses().All() {
-				addrs = append(addrs, addr.Addr())
-			}
-			mak.Set(&hosts, must.Get(dnsname.ToFQDN(n.Name())), addrs)
-		}
-		if nm != nil && nm.SelfNode.Valid() {
-			appendNode(nm.SelfNode)
-		}
-		for _, n := range nm.Peers {
-			appendNode(n)
-		}
-		return hosts
-	}
 
 	tests := []struct {
 		name          string
 		steps         func(*testing.T, *LocalBackend, func() *mockControl)
 		wantState     ipn.State
 		wantCfg       *wgcfg.Config
+		wantPeers     []key.NodePublic
 		wantRouterCfg *router.Config
 		wantDNSCfg    *dns.Config
 	}{
 		{
 			name: "Initial",
-			// The configs are nil until the the LocalBackend is started.
+			// The configs are nil until the LocalBackend is started.
 			wantState:     ipn.NoState,
 			wantCfg:       nil,
 			wantRouterCfg: nil,
@@ -1292,7 +1302,6 @@ func TestEngineReconfigOnStateChange(t *testing.T) {
 			// After the auth is completed, the configs must be updated to reflect the node's netmap.
 			wantState: ipn.Starting,
 			wantCfg: &wgcfg.Config{
-				Peers:     []wgcfg.Peer{},
 				Addresses: node1.SelfNode.Addresses().AsSlice(),
 			},
 			wantRouterCfg: &router.Config{
@@ -1302,9 +1311,10 @@ func TestEngineReconfigOnStateChange(t *testing.T) {
 				Routes:           routesWithQuad100(),
 			},
 			wantDNSCfg: &dns.Config{
-				AcceptDNS: true,
-				Routes:    map[dnsname.FQDN][]*dnstype.Resolver{},
-				Hosts:     hostsFor(node1),
+				AcceptDNS:             true,
+				Routes:                map[dnsname.FQDN][]*dnstype.Resolver{},
+				Hosts:                 map[dnsname.FQDN][]netip.Addr{},
+				MagicDNSHostsUnrouted: true,
 			},
 		},
 		{
@@ -1349,7 +1359,6 @@ func TestEngineReconfigOnStateChange(t *testing.T) {
 			// Once the auth is completed, the configs must be updated to reflect the node's netmap.
 			wantState: ipn.Starting,
 			wantCfg: &wgcfg.Config{
-				Peers:     []wgcfg.Peer{},
 				Addresses: node2.SelfNode.Addresses().AsSlice(),
 			},
 			wantRouterCfg: &router.Config{
@@ -1359,9 +1368,10 @@ func TestEngineReconfigOnStateChange(t *testing.T) {
 				Routes:           routesWithQuad100(),
 			},
 			wantDNSCfg: &dns.Config{
-				AcceptDNS: true,
-				Routes:    map[dnsname.FQDN][]*dnstype.Resolver{},
-				Hosts:     hostsFor(node2),
+				AcceptDNS:             true,
+				Routes:                map[dnsname.FQDN][]*dnstype.Resolver{},
+				Hosts:                 map[dnsname.FQDN][]netip.Addr{},
+				MagicDNSHostsUnrouted: true,
 			},
 		},
 		{
@@ -1398,7 +1408,6 @@ func TestEngineReconfigOnStateChange(t *testing.T) {
 			// must be updated to reflect the node's netmap.
 			wantState: ipn.Starting,
 			wantCfg: &wgcfg.Config{
-				Peers:     []wgcfg.Peer{},
 				Addresses: node1.SelfNode.Addresses().AsSlice(),
 			},
 			wantRouterCfg: &router.Config{
@@ -1408,9 +1417,10 @@ func TestEngineReconfigOnStateChange(t *testing.T) {
 				Routes:           routesWithQuad100(),
 			},
 			wantDNSCfg: &dns.Config{
-				AcceptDNS: true,
-				Routes:    map[dnsname.FQDN][]*dnstype.Resolver{},
-				Hosts:     hostsFor(node1),
+				AcceptDNS:             true,
+				Routes:                map[dnsname.FQDN][]*dnstype.Resolver{},
+				Hosts:                 map[dnsname.FQDN][]netip.Addr{},
+				MagicDNSHostsUnrouted: true,
 			},
 		},
 		{
@@ -1422,28 +1432,23 @@ func TestEngineReconfigOnStateChange(t *testing.T) {
 			},
 			wantState: ipn.Starting,
 			wantCfg: &wgcfg.Config{
-				Peers: []wgcfg.Peer{
-					{
-						PublicKey: node1.SelfNode.Key(),
-						DiscoKey:  node1.SelfNode.DiscoKey(),
-					},
-					{
-						PublicKey: node2.SelfNode.Key(),
-						DiscoKey:  node2.SelfNode.DiscoKey(),
-					},
-				},
 				Addresses: node3.SelfNode.Addresses().AsSlice(),
 			},
+			wantPeers: []key.NodePublic{
+				node1.SelfNode.Key(),
+				node2.SelfNode.Key(),
+			},
 			wantRouterCfg: &router.Config{
 				SNATSubnetRoutes: true,
 				NetfilterMode:    preftype.NetfilterOn,
 				LocalAddrs:       node3.SelfNode.Addresses().AsSlice(),
-				Routes:           routesWithQuad100(),
+				Routes:           routesWithQuad100(netip.MustParsePrefix("100.64.1.1/32"), netip.MustParsePrefix("100.64.1.2/32")),
 			},
 			wantDNSCfg: &dns.Config{
-				AcceptDNS: true,
-				Routes:    map[dnsname.FQDN][]*dnstype.Resolver{},
-				Hosts:     hostsFor(node3),
+				AcceptDNS:             true,
+				Routes:                map[dnsname.FQDN][]*dnstype.Resolver{},
+				Hosts:                 map[dnsname.FQDN][]netip.Addr{},
+				MagicDNSHostsUnrouted: true,
 			},
 		},
 		{
@@ -1474,11 +1479,23 @@ func TestEngineReconfigOnStateChange(t *testing.T) {
 				lb.StartLoginInteractive(context.Background())
 				cc().sendAuthURL(node1)
 			},
-			// Without seamless renewal, even starting a reauth tears down everything:
-			wantState:     ipn.Starting,
-			wantCfg:       &wgcfg.Config{},
-			wantRouterCfg: &router.Config{},
-			wantDNSCfg:    &dns.Config{},
+			// Starting a reauth should leave everything up:
+			wantState: ipn.Starting,
+			wantCfg: &wgcfg.Config{
+				Addresses: node1.SelfNode.Addresses().AsSlice(),
+			},
+			wantRouterCfg: &router.Config{
+				SNATSubnetRoutes: true,
+				NetfilterMode:    preftype.NetfilterOn,
+				LocalAddrs:       node1.SelfNode.Addresses().AsSlice(),
+				Routes:           routesWithQuad100(),
+			},
+			wantDNSCfg: &dns.Config{
+				AcceptDNS:             true,
+				Routes:                map[dnsname.FQDN][]*dnstype.Resolver{},
+				Hosts:                 map[dnsname.FQDN][]netip.Addr{},
+				MagicDNSHostsUnrouted: true,
+			},
 		},
 		{
 			name: "Start/Connect/Login/InitReauth/Login",
@@ -1496,7 +1513,6 @@ func TestEngineReconfigOnStateChange(t *testing.T) {
 			},
 			wantState: ipn.Starting,
 			wantCfg: &wgcfg.Config{
-				Peers:     []wgcfg.Peer{},
 				Addresses: node1.SelfNode.Addresses().AsSlice(),
 			},
 			wantRouterCfg: &router.Config{
@@ -1506,77 +1522,15 @@ func TestEngineReconfigOnStateChange(t *testing.T) {
 				Routes:           routesWithQuad100(),
 			},
 			wantDNSCfg: &dns.Config{
-				AcceptDNS: true,
-				Routes:    map[dnsname.FQDN][]*dnstype.Resolver{},
-				Hosts:     hostsFor(node1),
+				AcceptDNS:             true,
+				Routes:                map[dnsname.FQDN][]*dnstype.Resolver{},
+				Hosts:                 map[dnsname.FQDN][]netip.Addr{},
+				MagicDNSHostsUnrouted: true,
 			},
 		},
 		{
-			name: "Seamless/Start/Connect/Login/InitReauth",
+			name: "Start/Connect/Login/Expire",
 			steps: func(t *testing.T, lb *LocalBackend, cc func() *mockControl) {
-				lb.ControlKnobs().SeamlessKeyRenewal.Store(true)
-				mustDo(t)(lb.Start(ipn.Options{}))
-				mustDo2(t)(lb.EditPrefs(connect))
-				cc().authenticated(node1)
-
-				// Start the re-auth process:
-				lb.StartLoginInteractive(context.Background())
-				cc().sendAuthURL(node1)
-			},
-			// With seamless renewal, starting a reauth should leave everything up:
-			wantState: ipn.Starting,
-			wantCfg: &wgcfg.Config{
-				Peers:     []wgcfg.Peer{},
-				Addresses: node1.SelfNode.Addresses().AsSlice(),
-			},
-			wantRouterCfg: &router.Config{
-				SNATSubnetRoutes: true,
-				NetfilterMode:    preftype.NetfilterOn,
-				LocalAddrs:       node1.SelfNode.Addresses().AsSlice(),
-				Routes:           routesWithQuad100(),
-			},
-			wantDNSCfg: &dns.Config{
-				AcceptDNS: true,
-				Routes:    map[dnsname.FQDN][]*dnstype.Resolver{},
-				Hosts:     hostsFor(node1),
-			},
-		},
-		{
-			name: "Seamless/Start/Connect/Login/InitReauth/Login",
-			steps: func(t *testing.T, lb *LocalBackend, cc func() *mockControl) {
-				lb.ControlKnobs().SeamlessKeyRenewal.Store(true)
-				mustDo(t)(lb.Start(ipn.Options{}))
-				mustDo2(t)(lb.EditPrefs(connect))
-				cc().authenticated(node1)
-
-				// Start the re-auth process:
-				lb.StartLoginInteractive(context.Background())
-				cc().sendAuthURL(node1)
-
-				// Complete the re-auth process:
-				cc().authenticated(node1)
-			},
-			wantState: ipn.Starting,
-			wantCfg: &wgcfg.Config{
-				Peers:     []wgcfg.Peer{},
-				Addresses: node1.SelfNode.Addresses().AsSlice(),
-			},
-			wantRouterCfg: &router.Config{
-				SNATSubnetRoutes: true,
-				NetfilterMode:    preftype.NetfilterOn,
-				LocalAddrs:       node1.SelfNode.Addresses().AsSlice(),
-				Routes:           routesWithQuad100(),
-			},
-			wantDNSCfg: &dns.Config{
-				AcceptDNS: true,
-				Routes:    map[dnsname.FQDN][]*dnstype.Resolver{},
-				Hosts:     hostsFor(node1),
-			},
-		},
-		{
-			name: "Seamless/Start/Connect/Login/Expire",
-			steps: func(t *testing.T, lb *LocalBackend, cc func() *mockControl) {
-				lb.ControlKnobs().SeamlessKeyRenewal.Store(true)
 				mustDo(t)(lb.Start(ipn.Options{}))
 				mustDo2(t)(lb.EditPrefs(connect))
 				cc().authenticated(node1)
@@ -1586,7 +1540,7 @@ func TestEngineReconfigOnStateChange(t *testing.T) {
 					}).View(),
 				}})
 			},
-			// Even with seamless, if the key we are using expires, we want to disconnect:
+			// If the key we are using expires, we want to disconnect:
 			wantState:     ipn.NeedsLogin,
 			wantCfg:       &wgcfg.Config{},
 			wantRouterCfg: &router.Config{},
@@ -1597,6 +1551,7 @@ func TestEngineReconfigOnStateChange(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			lb, engine, cc := newLocalBackendWithMockEngineAndControl(t, enableLogging)
+			lb.goos = "linux" // so the expectations below are the same on every host OS
 
 			if tt.steps != nil {
 				tt.steps(t, lb, cc)
@@ -1606,13 +1561,12 @@ func TestEngineReconfigOnStateChange(t *testing.T) {
 				t.Errorf("State: got %v; want %v", gotState, tt.wantState)
 			}
 
-			if engine.Config() != nil {
-				for _, p := range engine.Config().Peers {
-					pKey := p.PublicKey.UntypedHexString()
-					_, err := lb.MagicConn().ParseEndpoint(pKey)
-					if err != nil {
-						t.Errorf("ParseEndpoint(%q) failed: %v", pKey, err)
-					}
+			// Peers are not part of wgcfg.Config; the engine learns
+			// them from the config source installed by LocalBackend
+			// via SetPeerConfigFunc.
+			for _, k := range tt.wantPeers {
+				if _, ok := engine.PeerAllowedIPs(k); !ok {
+					t.Errorf("PeerAllowedIPs(%v) = false; want peer known", k.ShortString())
 				}
 			}
 
@@ -1632,17 +1586,47 @@ func TestEngineReconfigOnStateChange(t *testing.T) {
 	}
 }
 
+// TestPeerConfigUpdatedOnPeerRouteDelta tests that a netmap delta that
+// changes a peer's allowed IPs is visible through the live per-peer
+// config source that LocalBackend installs on the engine.
+func TestPeerConfigUpdatedOnPeerRouteDelta(t *testing.T) {
+	connect := &ipn.MaskedPrefs{Prefs: ipn.Prefs{WantRunning: true}, WantRunningSet: true}
+	peerAddr := netip.MustParsePrefix("100.64.1.1/32")
+	vipAddr := netip.MustParsePrefix("100.99.99.99/32")
+
+	peer := makePeer(1, withName("node-1"), withAddresses(peerAddr))
+	peerStruct := peer.AsStruct()
+	peerStruct.AllowedIPs = []netip.Prefix{peerAddr}
+	peer = peerStruct.View()
+
+	nm := buildNetmapWithPeers(
+		makePeer(2, withName("node-2"), withAddresses(netip.MustParsePrefix("100.64.1.2/32"))),
+		peer,
+	)
+
+	lb, engine, cc := newLocalBackendWithMockEngineAndControl(t, false)
+	mustDo(t)(lb.Start(ipn.Options{}))
+	mustDo2(t)(lb.EditPrefs(connect))
+	cc().authenticated(nm)
+
+	replacement := nm.Peers[0].AsStruct()
+	replacement.AllowedIPs = append(replacement.AllowedIPs, vipAddr)
+	if !lb.UpdateNetmapDelta([]netmap.NodeMutation{netmap.NodeMutationUpsert{Node: replacement.View()}}) {
+		t.Fatal("UpdateNetmapDelta = false, want true")
+	}
+
+	ips, ok := engine.PeerAllowedIPs(replacement.Key)
+	if !ok {
+		t.Fatalf("peer config source missing peer %v", replacement.Key.ShortString())
+	}
+	if !slices.Contains(ips, vipAddr) {
+		t.Fatalf("peer AllowedIPs = %v; want %v", ips, vipAddr)
+	}
+}
+
 // TestSendPreservesAuthURL tests that wgengine updates arriving in the middle of
 // processing an auth URL doesn't result in the auth URL being cleared.
 func TestSendPreservesAuthURL(t *testing.T) {
-	runTestSendPreservesAuthURL(t, false)
-}
-
-func TestSendPreservesAuthURLSeamless(t *testing.T) {
-	runTestSendPreservesAuthURL(t, true)
-}
-
-func runTestSendPreservesAuthURL(t *testing.T, seamless bool) {
 	var cc *mockControl
 	b := newLocalBackendWithTestControl(t, true, func(tb testing.TB, opts controlclient.Options) controlclient.Client {
 		cc = newClient(t, opts)
@@ -1661,10 +1645,6 @@ func runTestSendPreservesAuthURL(t *testing.T, seamless bool) {
 	cc.persist.UserProfile.LoginName = "user1"
 	cc.persist.NodeID = "node1"
 
-	if seamless {
-		b.sys.ControlKnobs().SeamlessKeyRenewal.Store(true)
-	}
-
 	cc.send(sendOpt{loginFinished: true, nm: &netmap.NetworkMap{
 		SelfNode: (&tailcfg.Node{MachineAuthorized: true}).View(),
 	}})
@@ -1905,6 +1885,8 @@ type mockEngine struct {
 
 	filter, jailedFilter *filter.Filter
 
+	peerConfigFn func(key.NodePublic) (allowedIPs []netip.Prefix, ok bool)
+
 	statusCb wgengine.StatusCallback
 }
 
@@ -1944,10 +1926,6 @@ func (e *mockEngine) DNSConfig() *dns.Config {
 	return e.dnsCfg
 }
 
-func (e *mockEngine) PeerForIP(netip.Addr) (_ wgengine.PeerForIP, ok bool) {
-	return wgengine.PeerForIP{}, false
-}
-
 func (e *mockEngine) GetFilter() *filter.Filter {
 	e.mu.Lock()
 	defer e.mu.Unlock()
@@ -1972,6 +1950,9 @@ func (e *mockEngine) SetJailedFilter(f *filter.Filter) {
 	e.mu.Unlock()
 }
 
+func (e *mockEngine) SetPeerRoutes(native4, native6 netip.Addr, routes *bart.Table[*routemanager.PeerRoute]) {
+}
+
 func (e *mockEngine) SetStatusCallback(cb wgengine.StatusCallback) {
 	e.mu.Lock()
 	e.statusCb = cb
@@ -1999,7 +1980,7 @@ func (e *mockEngine) PeerByKey(key.NodePublic) (_ wgint.Peer, ok bool) {
 	return wgint.Peer{}, false
 }
 
-func (e *mockEngine) SetNetworkMap(*netmap.NetworkMap) {}
+func (e *mockEngine) SetSelfNode(tailcfg.NodeView) {}
 
 func (e *mockEngine) UpdateStatus(*ipnstate.StatusBuilder) {}
 
@@ -2009,6 +1990,34 @@ func (e *mockEngine) Ping(ip netip.Addr, pingType tailcfg.PingType, size int, cb
 
 func (e *mockEngine) InstallCaptureHook(packet.CaptureCallback) {}
 
+func (e *mockEngine) SetPeerByIPPacketFunc(func(netip.Addr) (_ key.NodePublic, ok bool)) {}
+func (e *mockEngine) SetPeerForIPFunc(func(netip.Addr) (_ wgengine.PeerForIP, ok bool))  {}
+func (e *mockEngine) SetPeerConfigFunc(fn func(key.NodePublic) (allowedIPs []netip.Prefix, ok bool)) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	e.peerConfigFn = fn
+}
+
+// PeerAllowedIPs looks up a peer's allowed IPs via the live per-peer
+// config source installed by LocalBackend with SetPeerConfigFunc.
+func (e *mockEngine) PeerAllowedIPs(k key.NodePublic) (_ []netip.Prefix, ok bool) {
+	e.mu.Lock()
+	fn := e.peerConfigFn
+	e.mu.Unlock()
+	if fn == nil {
+		return nil, false
+	}
+	return fn(k)
+}
+
+func (e *mockEngine) SyncDevicePeer(key.NodePublic)  {}
+func (e *mockEngine) ResetDevicePeer(key.NodePublic) {}
+func (e *mockEngine) SetPeerSessionStateFunc(func(key.NodePublic, wgengine.PeerWireGuardState)) {
+}
+func (e *mockEngine) SetNetLogSource(wgengine.NetLogSource)                            {}
+func (e *mockEngine) SetWGPeerLookup(func(wgString string) (tsString string, ok bool)) {}
+func (e *mockEngine) ProbeLocks()                                                      {}
+
 func (e *mockEngine) Close() {
 	e.mu.Lock()
 	defer e.mu.Unlock()
diff --git a/ipn/ipnlocal/network-lock.go b/ipn/ipnlocal/tailnet-lock.go
similarity index 81%
rename from ipn/ipnlocal/network-lock.go
rename to ipn/ipnlocal/tailnet-lock.go
index 535d9803d..7cd391467 100644
--- a/ipn/ipnlocal/network-lock.go
+++ b/ipn/ipnlocal/tailnet-lock.go
@@ -23,10 +23,12 @@ import (
 	"slices"
 	"time"
 
+	"tailscale.com/envknob"
 	"tailscale.com/health"
 	"tailscale.com/health/healthmsg"
 	"tailscale.com/ipn"
 	"tailscale.com/ipn/ipnstate"
+	"tailscale.com/ipn/store/mem"
 	"tailscale.com/net/tsaddr"
 	"tailscale.com/tailcfg"
 	"tailscale.com/tka"
@@ -38,25 +40,36 @@ import (
 	"tailscale.com/types/tkatype"
 	"tailscale.com/util/mak"
 	"tailscale.com/util/set"
+	"tailscale.com/util/testenv"
 )
 
 // TODO(tom): RPC retry/backoff was broken and has been removed. Fix?
 
 var (
 	errMissingNetmap        = errors.New("missing netmap: verify that you are logged in")
-	errNetworkLockNotActive = errors.New("tailnet-lock is not active")
-
-	tkaCompactionDefaults = tka.CompactionOptions{
-		MinChain: 24,                  // Keep at minimum 24 AUMs since head.
-		MinAge:   14 * 24 * time.Hour, // Keep 2 weeks of AUMs.
-	}
+	errTailnetLockNotActive = errors.New("tailnet-lock is not active")
 )
 
+// IsTailnetLockNotActive reports whether the given error indicates that
+// tailnet-lock is not active. Stop-gap for feature/tailnetlock to check this
+// until all of this is code is moved to the feature.
+func IsTailnetLockNotActive(err error) bool {
+	return errors.Is(err, errTailnetLockNotActive)
+}
+
+// Deprecated: use [IsTailnetLockNotActive] instead.
+func IsNetworkLockNotActive(err error) bool {
+	return IsTailnetLockNotActive(err)
+}
+
 type tkaState struct {
 	profile   ipn.ProfileID
 	authority *tka.Authority
 	storage   tka.CompactableChonk
-	filtered  []ipnstate.TKAPeer
+
+	// filtered tracks peers that were removed from the netmap because
+	// they failed tailnet lock signature verification.
+	filtered map[tailcfg.NodeID]ipnstate.TKAPeer
 }
 
 func (b *LocalBackend) initTKALocked() error {
@@ -76,13 +89,13 @@ func (b *LocalBackend) initTKALocked() error {
 	root := b.TailscaleVarRoot()
 	if root == "" {
 		b.tka = nil
-		b.logf("cannot fetch existing TKA state; no state directory for network-lock")
+		b.logf("cannot fetch existing TKA state; no state directory for tailnet-lock")
 		return nil
 	}
 
 	chonkDir := b.chonkPathLocked()
 	if _, err := os.Stat(chonkDir); err == nil {
-		// The directory exists, which means network-lock has been initialized.
+		// The directory exists, which means tailnet-lock has been initialized.
 		storage, err := tka.ChonkDir(chonkDir)
 		if err != nil {
 			return fmt.Errorf("opening tailchonk: %v", err)
@@ -92,31 +105,75 @@ func (b *LocalBackend) initTKALocked() error {
 			return fmt.Errorf("initializing tka: %v", err)
 		}
 
-		if err := authority.Compact(storage, tkaCompactionDefaults); err != nil {
-			b.logf("tka compaction failed: %v", err)
-		}
-
 		b.tka = &tkaState{
 			profile:   cp.ID(),
 			authority: authority,
 			storage:   storage,
 		}
-		b.logf("tka initialized at head %x", authority.Head())
+		b.logf("tka initialized at head %s", authority.Head())
 	}
 
 	return nil
 }
 
-// noNetworkLockStateDirWarnable is a Warnable to warn the user that Tailnet Lock data
+// noTailnetLockStateDirWarnable is a Warnable to warn the user that Tailnet Lock data
 // (in particular, the list of AUMs in the TKA state) is being stored in memory and will
 // be lost when tailscaled restarts.
-var noNetworkLockStateDirWarnable = health.Register(&health.Warnable{
+var noTailnetLockStateDirWarnable = health.Register(&health.Warnable{
 	Code:     "no-tailnet-lock-state-dir",
 	Title:    "No statedir for Tailnet Lock",
 	Severity: health.SeverityMedium,
 	Text:     health.StaticMessage(healthmsg.InMemoryTailnetLockState),
 })
 
+// tkaFilterDeltaMutsLocked drops any [netmap.NodeMutationUpsert] in muts
+// whose peer would fail tailnet lock signature verification, replacing
+// each such upsert with a [netmap.NodeMutationRemove] for the same node
+// ID. This matches the semantics of [tkaFilterNetmapLocked] on a full
+// netmap: an unsigned (or invalidly-signed) peer must not land in
+// [nodeBackend.peers], and a previously-signed peer at the same node ID
+// must be evicted if the latest state from control fails verification.
+//
+// If tailnet lock is not active on this node (b.tka == nil) muts is
+// returned unchanged. The returned slice may share backing storage with
+// the input.
+//
+// b.mu must be held.
+func (b *LocalBackend) tkaFilterDeltaMutsLocked(muts []netmap.NodeMutation) []netmap.NodeMutation {
+	if b.tka == nil {
+		return muts
+	}
+	if envknob.TKASkipSignatureCheck() {
+		return muts
+	}
+	for i, m := range muts {
+		switch m := m.(type) {
+		case netmap.NodeMutationUpsert:
+			n := m.Node
+			if n.UnsignedPeerAPIOnly() {
+				continue
+			}
+			var why string
+			if n.KeySignature().Len() == 0 {
+				why = "missing signature"
+			} else if err := b.tka.authority.NodeKeyAuthorized(n.Key(), n.KeySignature().AsSlice()); err != nil {
+				why = fmt.Sprintf("failed signature check: %v", err)
+			} else {
+				continue
+			}
+			b.logf("Tailnet lock is dropping delta-upserted peer %v(%v) due to %v", n.ID(), n.StableID(), why)
+			mak.Set(&b.tka.filtered, n.ID(), tkaStateFromPeer(n))
+			muts[i] = netmap.MakeNodeMutationRemove(n.ID())
+		case netmap.NodeMutationRemove:
+			// If a peer is explicitly removed by control, clear it from
+			// the filtered set too so TailnetLockStatus doesn't report
+			// stale entries.
+			delete(b.tka.filtered, m.NodeIDBeingMutated())
+		}
+	}
+	return muts
+}
+
 // tkaFilterNetmapLocked checks the signatures on each node key, dropping
 // nodes from the netmap whose signature does not verify.
 //
@@ -139,12 +196,12 @@ func (b *LocalBackend) tkaFilterNetmapLocked(nm *netmap.NetworkMap) {
 			continue
 		}
 		if p.KeySignature().Len() == 0 {
-			b.logf("Network lock is dropping peer %v(%v) due to missing signature", p.ID(), p.StableID())
+			b.logf("Tailnet lock is dropping peer %v(%v) due to missing signature", p.ID(), p.StableID())
 			mak.Set(&toDelete, i, true)
 		} else {
 			details, err := b.tka.authority.NodeKeyAuthorizedWithDetails(p.Key(), p.KeySignature().AsSlice())
 			if err != nil {
-				b.logf("Network lock is dropping peer %v(%v) due to failed signature check: %v", p.ID(), p.StableID(), err)
+				b.logf("Tailnet lock is dropping peer %v(%v) due to failed signature check: %v", p.ID(), p.StableID(), err)
 				mak.Set(&toDelete, i, true)
 				continue
 			}
@@ -160,16 +217,15 @@ func (b *LocalBackend) tkaFilterNetmapLocked(nm *netmap.NetworkMap) {
 	// nm.Peers is ordered, so deletion must be order-preserving.
 	if len(toDelete) > 0 || len(obsoleteByRotation) > 0 {
 		peers := make([]tailcfg.NodeView, 0, len(nm.Peers))
-		filtered := make([]ipnstate.TKAPeer, 0, len(toDelete)+len(obsoleteByRotation))
+		filtered := make(map[tailcfg.NodeID]ipnstate.TKAPeer, len(toDelete)+len(obsoleteByRotation))
 		for i, p := range nm.Peers {
 			if !toDelete[i] && !obsoleteByRotation.Contains(p.Key()) {
 				peers = append(peers, p)
 			} else {
 				if obsoleteByRotation.Contains(p.Key()) {
-					b.logf("Network lock is dropping peer %v(%v) due to key rotation", p.ID(), p.StableID())
+					b.logf("Tailnet lock is dropping peer %v(%v) due to key rotation", p.ID(), p.StableID())
 				}
-				// Record information about the node we filtered out.
-				filtered = append(filtered, tkaStateFromPeer(p))
+				filtered[p.ID()] = tkaStateFromPeer(p)
 			}
 		}
 		nm.Peers = peers
@@ -304,7 +360,11 @@ func (b *LocalBackend) tkaSyncIfNeeded(nm *netmap.NetworkMap, prefs ipn.PrefsVie
 	wantEnabled := nm.TKAEnabled
 
 	if isEnabled || wantEnabled {
-		b.logf("tkaSyncIfNeeded: isEnabled=%t, wantEnabled=%t, head=%v", isEnabled, wantEnabled, nm.TKAHead)
+		nodeHead := "<not-enabled>"
+		if b.tka != nil {
+			nodeHead = b.tka.authority.Head().String()
+		}
+		b.logf("tkaSyncIfNeeded: isEnabled=%t, wantEnabled=%t, nodeHead=%v, netmapHead=%v", isEnabled, wantEnabled, nodeHead, nm.TKAHead)
 	}
 
 	ourNodeKey, ok := prefs.Persist().PublicNodeKeyOK()
@@ -360,7 +420,7 @@ func (b *LocalBackend) tkaSyncIfNeeded(nm *netmap.NetworkMap, prefs ipn.PrefsVie
 		//
 		// We run this on every sync so that clients compact consistently. In many
 		// cases this will be a no-op.
-		if err := b.tka.authority.Compact(b.tka.storage, tkaCompactionDefaults); err != nil {
+		if err := b.tka.authority.Compact(b.tka.storage, tka.CompactionDefaults); err != nil {
 			return fmt.Errorf("tka compact: %w", err)
 		}
 	}
@@ -491,8 +551,8 @@ func (b *LocalBackend) tkaBootstrapFromGenesisLocked(g tkatype.MarshaledAUM, per
 	root := b.TailscaleVarRoot()
 	var storage tka.CompactableChonk
 	if root == "" {
-		b.health.SetUnhealthy(noNetworkLockStateDirWarnable, nil)
-		b.logf("network-lock using in-memory storage; no state directory")
+		b.health.SetUnhealthy(noTailnetLockStateDirWarnable, nil)
+		b.logf("tailnet-lock using in-memory storage; no state directory")
 		storage = tka.ChonkMem()
 	} else {
 		chonkDir := b.chonkPathLocked()
@@ -515,9 +575,9 @@ func (b *LocalBackend) tkaBootstrapFromGenesisLocked(g tkatype.MarshaledAUM, per
 	return nil
 }
 
-// NetworkLockStatus returns a structure describing the state of the
+// TailnetLockStatus returns a structure describing the state of the
 // tailnet key authority, if any.
-func (b *LocalBackend) NetworkLockStatus() *ipnstate.NetworkLockStatus {
+func (b *LocalBackend) TailnetLockStatus() *ipnstate.TailnetLockStatus {
 	b.mu.Lock()
 	defer b.mu.Unlock()
 
@@ -532,13 +592,13 @@ func (b *LocalBackend) NetworkLockStatus() *ipnstate.NetworkLockStatus {
 	}
 
 	if nlPriv.IsZero() {
-		return &ipnstate.NetworkLockStatus{
+		return &ipnstate.TailnetLockStatus{
 			Enabled: false,
 			NodeKey: nodeKey,
 		}
 	}
 	if b.tka == nil {
-		return &ipnstate.NetworkLockStatus{
+		return &ipnstate.TailnetLockStatus{
 			Enabled:   false,
 			NodeKey:   nodeKey,
 			PublicKey: nlPriv.Public(),
@@ -570,9 +630,9 @@ func (b *LocalBackend) NetworkLockStatus() *ipnstate.NetworkLockStatus {
 		}
 	}
 
-	filtered := make([]*ipnstate.TKAPeer, len(b.tka.filtered))
-	for i := range len(filtered) {
-		filtered[i] = b.tka.filtered[i].Clone()
+	var filtered []*ipnstate.TKAPeer
+	for _, fp := range b.tka.filtered {
+		filtered = append(filtered, new(fp))
 	}
 
 	var visible []*ipnstate.TKAPeer
@@ -586,7 +646,7 @@ func (b *LocalBackend) NetworkLockStatus() *ipnstate.NetworkLockStatus {
 
 	stateID1, _ := b.tka.authority.StateIDs()
 
-	return &ipnstate.NetworkLockStatus{
+	return &ipnstate.TailnetLockStatus{
 		Enabled:          true,
 		Head:             &head,
 		PublicKey:        nlPriv.Public(),
@@ -600,6 +660,11 @@ func (b *LocalBackend) NetworkLockStatus() *ipnstate.NetworkLockStatus {
 	}
 }
 
+// Deprecated: use [LocalBackend.TailnetLockStatus] instead.
+func (b *LocalBackend) NetworkLockStatus() *ipnstate.TailnetLockStatus {
+	return b.TailnetLockStatus()
+}
+
 func tkaStateFromPeer(p tailcfg.NodeView) ipnstate.TKAPeer {
 	fp := ipnstate.TKAPeer{
 		Name:         p.Name(),
@@ -620,7 +685,7 @@ func tkaStateFromPeer(p tailcfg.NodeView) ipnstate.TKAPeer {
 	return fp
 }
 
-// NetworkLockInit enables network-lock for the tailnet, with the tailnets'
+// TailnetLockInit enables tailnet-lock for the tailnet, with the tailnets'
 // key authority initialized to trust the provided keys.
 //
 // Initialization involves two RPCs with control, termed 'begin' and 'finish'.
@@ -628,8 +693,8 @@ func tkaStateFromPeer(p tailcfg.NodeView) ipnstate.TKAPeer {
 // encodes the initial state of the authority, and the list of all nodes
 // needing signatures is returned as a response.
 // The Finish RPC submits signatures for all these nodes, at which point
-// Control has everything it needs to atomically enable network lock.
-func (b *LocalBackend) NetworkLockInit(keys []tka.Key, disablementValues [][]byte, supportDisablement []byte) error {
+// Control has everything it needs to atomically enable tailnet lock.
+func (b *LocalBackend) TailnetLockInit(keys []tka.Key, disablementValues [][]byte, supportDisablement []byte) error {
 	var ourNodeKey key.NodePublic
 	var nlPriv key.NLPrivate
 
@@ -663,7 +728,7 @@ func (b *LocalBackend) NetworkLockInit(keys []tka.Key, disablementValues [][]byt
 		return fmt.Errorf("tka.Create: %v", err)
 	}
 
-	b.logf("Generated genesis AUM to initialize network lock, trusting the following keys:")
+	b.logf("Generated genesis AUM to initialize tailnet lock, trusting the following keys:")
 	for i, k := range genesisAUM.State.Keys {
 		b.logf(" - key[%d] = tlpub:%x with %d votes", i, k.Public, k.Votes)
 	}
@@ -678,7 +743,7 @@ func (b *LocalBackend) NetworkLockInit(keys []tka.Key, disablementValues [][]byt
 	// node-key signatures, we need to sign keys for all the existing nodes.
 	// If we don't get these signatures ahead of time, everyone will lose
 	// connectivity because control won't have any signatures to send which
-	// satisfy network-lock checks.
+	// satisfy tailnet-lock checks.
 	sigs := make(map[tailcfg.NodeID]tkatype.MarshaledSignature, len(initResp.NeedSignatures))
 	for _, nodeInfo := range initResp.NeedSignatures {
 		nks, err := signNodeKey(nodeInfo, nlPriv)
@@ -694,40 +759,54 @@ func (b *LocalBackend) NetworkLockInit(keys []tka.Key, disablementValues [][]byt
 	return err
 }
 
-// NetworkLockAllowed reports whether the node is allowed to use Tailnet Lock.
-func (b *LocalBackend) NetworkLockAllowed() bool {
+// Deprecated: use [LocalBackend.TailnetLockInit] instead.
+func (b *LocalBackend) NetworkLockInit(keys []tka.Key, disablementValues [][]byte, supportDisablement []byte) error {
+	return b.TailnetLockInit(keys, disablementValues, supportDisablement)
+}
+
+// TailnetLockAllowed reports whether the node is allowed to use Tailnet Lock.
+func (b *LocalBackend) TailnetLockAllowed() bool {
 	b.mu.Lock()
 	defer b.mu.Unlock()
 	return b.capTailnetLock
 }
 
-// Only use is in tests.
-func (b *LocalBackend) NetworkLockVerifySignatureForTest(nks tkatype.MarshaledSignature, nodeKey key.NodePublic) error {
+// Deprecated: use [LocalBackend.TailnetLockAllowed] instead.
+func (b *LocalBackend) NetworkLockAllowed() bool {
+	return b.TailnetLockAllowed()
+}
+
+// TailnetLockVerifySignature verifies that nks is a valid tailnet lock
+// signature for the given node key.
+func (f forTest) TailnetLockVerifySignature(nks tkatype.MarshaledSignature, nodeKey key.NodePublic) error {
+	b := f.b
 	b.mu.Lock()
 	defer b.mu.Unlock()
 	if b.tka == nil {
-		return errNetworkLockNotActive
+		return errTailnetLockNotActive
 	}
 	return b.tka.authority.NodeKeyAuthorized(nodeKey, nks)
 }
 
-// Only use is in tests.
-func (b *LocalBackend) NetworkLockKeyTrustedForTest(keyID tkatype.KeyID) bool {
+// TailnetLockKeyTrusted reports whether keyID is trusted by the tailnet lock
+// authority. It panics if tailnet lock is not initialized.
+func (f forTest) TailnetLockKeyTrusted(keyID tkatype.KeyID) bool {
+	b := f.b
 	b.mu.Lock()
 	defer b.mu.Unlock()
 	if b.tka == nil {
-		panic("network lock not initialized")
+		panic("tailnet lock not initialized")
 	}
 	return b.tka.authority.KeyTrusted(keyID)
 }
 
-// NetworkLockForceLocalDisable shuts down TKA locally, and denylists the current
+// TailnetLockForceLocalDisable shuts down TKA locally, and denylists the current
 // TKA from being initialized locally in future.
-func (b *LocalBackend) NetworkLockForceLocalDisable() error {
+func (b *LocalBackend) TailnetLockForceLocalDisable() error {
 	b.mu.Lock()
 	defer b.mu.Unlock()
 	if b.tka == nil {
-		return errNetworkLockNotActive
+		return errTailnetLockNotActive
 	}
 
 	id1, id2 := b.tka.authority.StateIDs()
@@ -747,9 +826,14 @@ func (b *LocalBackend) NetworkLockForceLocalDisable() error {
 	return nil
 }
 
-// NetworkLockSign signs the given node-key and submits it to the control plane.
+// Deprecated: use [LocalBackend.TailnetLockForceLocalDisable] instead.
+func (b *LocalBackend) NetworkLockForceLocalDisable() error {
+	return b.TailnetLockForceLocalDisable()
+}
+
+// TailnetLockSign signs the given node-key and submits it to the control plane.
 // rotationPublic, if specified, must be an ed25519 public key.
-func (b *LocalBackend) NetworkLockSign(nodeKey key.NodePublic, rotationPublic []byte) error {
+func (b *LocalBackend) TailnetLockSign(nodeKey key.NodePublic, rotationPublic []byte) error {
 	ourNodeKey, sig, err := func(nodeKey key.NodePublic, rotationPublic []byte) (key.NodePublic, tka.NodeKeySignature, error) {
 		b.mu.Lock()
 		defer b.mu.Unlock()
@@ -763,7 +847,7 @@ func (b *LocalBackend) NetworkLockSign(nodeKey key.NodePublic, rotationPublic []
 		}
 
 		if b.tka == nil {
-			return key.NodePublic{}, tka.NodeKeySignature{}, errNetworkLockNotActive
+			return key.NodePublic{}, tka.NodeKeySignature{}, errTailnetLockNotActive
 		}
 		if !b.tka.authority.KeyTrusted(nlPriv.KeyID()) {
 			return key.NodePublic{}, tka.NodeKeySignature{}, errors.New(tsconst.TailnetLockNotTrustedMsg)
@@ -790,15 +874,20 @@ func (b *LocalBackend) NetworkLockSign(nodeKey key.NodePublic, rotationPublic []
 		return err
 	}
 
-	b.logf("Generated network-lock signature for %v, submitting to control plane", nodeKey)
+	b.logf("Generated tailnet-lock signature for %v, submitting to control plane", nodeKey)
 	if _, err := b.tkaSubmitSignature(ourNodeKey, sig.Serialize()); err != nil {
 		return err
 	}
 	return nil
 }
 
-// NetworkLockModify adds and/or removes keys in the tailnet's key authority.
-func (b *LocalBackend) NetworkLockModify(addKeys, removeKeys []tka.Key) (err error) {
+// Deprecated: use [LocalBackend.TailnetLockSign] instead.
+func (b *LocalBackend) NetworkLockSign(nodeKey key.NodePublic, rotationPublic []byte) error {
+	return b.TailnetLockSign(nodeKey, rotationPublic)
+}
+
+// TailnetLockModify adds and/or removes keys in the tailnet's key authority.
+func (b *LocalBackend) TailnetLockModify(addKeys, removeKeys []tka.Key) (err error) {
 	defer func() {
 		if err != nil {
 			err = fmt.Errorf("modify tailnet-lock keys: %w", err)
@@ -824,7 +913,7 @@ func (b *LocalBackend) NetworkLockModify(addKeys, removeKeys []tka.Key) (err err
 		return errMissingNetmap
 	}
 	if b.tka == nil {
-		return errNetworkLockNotActive
+		return errTailnetLockNotActive
 	}
 	if !b.tka.authority.KeyTrusted(nlPriv.KeyID()) {
 		return errors.New("this node does not have a trusted tailnet lock key")
@@ -877,8 +966,13 @@ func (b *LocalBackend) NetworkLockModify(addKeys, removeKeys []tka.Key) (err err
 	return nil
 }
 
-// NetworkLockDisable disables network-lock using the provided disablement secret.
-func (b *LocalBackend) NetworkLockDisable(secret []byte) error {
+// Deprecated: use [LocalBackend.TailnetLockModify] instead.
+func (b *LocalBackend) NetworkLockModify(addKeys, removeKeys []tka.Key) (err error) {
+	return b.TailnetLockModify(addKeys, removeKeys)
+}
+
+// TailnetLockDisable disables tailnet-lock using the provided disablement secret.
+func (b *LocalBackend) TailnetLockDisable(secret []byte) error {
 	var (
 		ourNodeKey key.NodePublic
 		head       tka.AUMHash
@@ -890,7 +984,7 @@ func (b *LocalBackend) NetworkLockDisable(secret []byte) error {
 		ourNodeKey = p.Persist().PublicNodeKey()
 	}
 	if b.tka == nil {
-		err = errNetworkLockNotActive
+		err = errTailnetLockNotActive
 	} else {
 		head = b.tka.authority.Head()
 		if !b.tka.authority.ValidDisablement(secret) {
@@ -909,16 +1003,21 @@ func (b *LocalBackend) NetworkLockDisable(secret []byte) error {
 	return err
 }
 
-// NetworkLockLog returns the changelog of TKA state up to maxEntries in size.
-func (b *LocalBackend) NetworkLockLog(maxEntries int) ([]ipnstate.NetworkLockUpdate, error) {
+// Deprecated: use [LocalBackend.TailnetLockDisable] instead.
+func (b *LocalBackend) NetworkLockDisable(secret []byte) error {
+	return b.TailnetLockDisable(secret)
+}
+
+// TailnetLockLog returns the changelog of TKA state up to maxEntries in size.
+func (b *LocalBackend) TailnetLockLog(maxEntries int) ([]ipnstate.TailnetLockUpdate, error) {
 	b.mu.Lock()
 	defer b.mu.Unlock()
 
 	if b.tka == nil {
-		return nil, errNetworkLockNotActive
+		return nil, errTailnetLockNotActive
 	}
 
-	var out []ipnstate.NetworkLockUpdate
+	var out []ipnstate.TailnetLockUpdate
 	cursor := b.tka.authority.Head()
 	for range maxEntries {
 		aum, err := b.tka.storage.AUM(cursor)
@@ -929,7 +1028,7 @@ func (b *LocalBackend) NetworkLockLog(maxEntries int) ([]ipnstate.NetworkLockUpd
 			return out, fmt.Errorf("reading AUM (%v): %w", cursor, err)
 		}
 
-		update := ipnstate.NetworkLockUpdate{
+		update := ipnstate.TailnetLockUpdate{
 			Hash:   cursor,
 			Change: aum.MessageKind.String(),
 			Raw:    aum.Serialize(),
@@ -946,9 +1045,14 @@ func (b *LocalBackend) NetworkLockLog(maxEntries int) ([]ipnstate.NetworkLockUpd
 	return out, nil
 }
 
-// NetworkLockAffectedSigs returns the signatures which would be invalidated
+// Deprecated: use [LocalBackend.TailnetLockLog] instead.
+func (b *LocalBackend) NetworkLockLog(maxEntries int) ([]ipnstate.TailnetLockUpdate, error) {
+	return b.TailnetLockLog(maxEntries)
+}
+
+// TailnetLockAffectedSigs returns the signatures which would be invalidated
 // by removing trust in the specified KeyID.
-func (b *LocalBackend) NetworkLockAffectedSigs(keyID tkatype.KeyID) ([]tkatype.MarshaledSignature, error) {
+func (b *LocalBackend) TailnetLockAffectedSigs(keyID tkatype.KeyID) ([]tkatype.MarshaledSignature, error) {
 	var (
 		ourNodeKey key.NodePublic
 		err        error
@@ -958,7 +1062,7 @@ func (b *LocalBackend) NetworkLockAffectedSigs(keyID tkatype.KeyID) ([]tkatype.M
 		ourNodeKey = p.Persist().PublicNodeKey()
 	}
 	if b.tka == nil {
-		err = errNetworkLockNotActive
+		err = errTailnetLockNotActive
 	}
 	b.mu.Unlock()
 	if err != nil {
@@ -973,7 +1077,7 @@ func (b *LocalBackend) NetworkLockAffectedSigs(keyID tkatype.KeyID) ([]tkatype.M
 	b.mu.Lock()
 	defer b.mu.Unlock()
 	if b.tka == nil {
-		return nil, errNetworkLockNotActive
+		return nil, errTailnetLockNotActive
 	}
 
 	// Confirm for ourselves tha the signatures would actually be invalidated
@@ -1004,16 +1108,21 @@ func (b *LocalBackend) NetworkLockAffectedSigs(keyID tkatype.KeyID) ([]tkatype.M
 	return resp.Signatures, nil
 }
 
-// NetworkLockGenerateRecoveryAUM generates an AUM which retroactively removes trust in the
+// Deprecated: use [LocalBackend.TailnetLockAffectedSigs] instead.
+func (b *LocalBackend) NetworkLockAffectedSigs(keyID tkatype.KeyID) ([]tkatype.MarshaledSignature, error) {
+	return b.TailnetLockAffectedSigs(keyID)
+}
+
+// TailnetLockGenerateRecoveryAUM generates an AUM which retroactively removes trust in the
 // specified keys. This AUM is signed by the current node and returned.
 //
 // If forkFrom is specified, it is used as the parent AUM to fork from. If the zero value,
 // the parent AUM is determined automatically.
-func (b *LocalBackend) NetworkLockGenerateRecoveryAUM(removeKeys []tkatype.KeyID, forkFrom tka.AUMHash) (*tka.AUM, error) {
+func (b *LocalBackend) TailnetLockGenerateRecoveryAUM(removeKeys []tkatype.KeyID, forkFrom tka.AUMHash) (*tka.AUM, error) {
 	b.mu.Lock()
 	defer b.mu.Unlock()
 	if b.tka == nil {
-		return nil, errNetworkLockNotActive
+		return nil, errTailnetLockNotActive
 	}
 	var nlPriv key.NLPrivate
 	if p := b.pm.CurrentPrefs(); p.Valid() && p.Persist().Valid() {
@@ -1037,16 +1146,21 @@ func (b *LocalBackend) NetworkLockGenerateRecoveryAUM(removeKeys []tkatype.KeyID
 	return aum, nil
 }
 
-// NetworkLockCosignRecoveryAUM co-signs the provided recovery AUM and returns
+// Deprecated: use [LocalBackend.TailnetLockGenerateRecoveryAUM] instead.
+func (b *LocalBackend) NetworkLockGenerateRecoveryAUM(removeKeys []tkatype.KeyID, forkFrom tka.AUMHash) (*tka.AUM, error) {
+	return b.TailnetLockGenerateRecoveryAUM(removeKeys, forkFrom)
+}
+
+// TailnetLockCosignRecoveryAUM co-signs the provided recovery AUM and returns
 // the updated structure.
 //
 // The recovery AUM provided should be the output from a previous call to
-// NetworkLockGenerateRecoveryAUM or NetworkLockCosignRecoveryAUM.
-func (b *LocalBackend) NetworkLockCosignRecoveryAUM(aum *tka.AUM) (*tka.AUM, error) {
+// [LocalBackend.TailnetLockGenerateRecoveryAUM] or [LocalBackend.TailnetLockCosignRecoveryAUM].
+func (b *LocalBackend) TailnetLockCosignRecoveryAUM(aum *tka.AUM) (*tka.AUM, error) {
 	b.mu.Lock()
 	defer b.mu.Unlock()
 	if b.tka == nil {
-		return nil, errNetworkLockNotActive
+		return nil, errTailnetLockNotActive
 	}
 	var nlPriv key.NLPrivate
 	if p := b.pm.CurrentPrefs(); p.Valid() && p.Persist().Valid() {
@@ -1071,11 +1185,16 @@ func (b *LocalBackend) NetworkLockCosignRecoveryAUM(aum *tka.AUM) (*tka.AUM, err
 	return aum, nil
 }
 
-func (b *LocalBackend) NetworkLockSubmitRecoveryAUM(aum *tka.AUM) error {
+// Deprecated: use [LocalBackend.TailnetLockCosignRecoveryAUM] instead.
+func (b *LocalBackend) NetworkLockCosignRecoveryAUM(aum *tka.AUM) (*tka.AUM, error) {
+	return b.TailnetLockCosignRecoveryAUM(aum)
+}
+
+func (b *LocalBackend) TailnetLockSubmitRecoveryAUM(aum *tka.AUM) error {
 	b.mu.Lock()
 	defer b.mu.Unlock()
 	if b.tka == nil {
-		return errNetworkLockNotActive
+		return errTailnetLockNotActive
 	}
 	var ourNodeKey key.NodePublic
 	if p := b.pm.CurrentPrefs(); p.Valid() && p.Persist().Valid() && !p.Persist().PrivateNodeKey().IsZero() {
@@ -1091,19 +1210,24 @@ func (b *LocalBackend) NetworkLockSubmitRecoveryAUM(aum *tka.AUM) error {
 	return err
 }
 
+// Deprecated: use [LocalBackend.TailnetLockSubmitRecoveryAUM] instead.
+func (b *LocalBackend) NetworkLockSubmitRecoveryAUM(aum *tka.AUM) error {
+	return b.TailnetLockSubmitRecoveryAUM(aum)
+}
+
 var tkaSuffixEncoder = base64.RawStdEncoding
 
-// NetworkLockWrapPreauthKey wraps a pre-auth key with information to
+// TailnetLockWrapPreauthKey wraps a pre-auth key with information to
 // enable unattended bringup in the locked tailnet.
 //
 // The provided trusted tailnet-lock key is used to sign
 // a SigCredential structure, which is encoded along with the
 // private key and appended to the pre-auth key.
-func (b *LocalBackend) NetworkLockWrapPreauthKey(preauthKey string, tkaKey key.NLPrivate) (string, error) {
+func (b *LocalBackend) TailnetLockWrapPreauthKey(preauthKey string, tkaKey key.NLPrivate) (string, error) {
 	b.mu.Lock()
 	defer b.mu.Unlock()
 	if b.tka == nil {
-		return "", errNetworkLockNotActive
+		return "", errTailnetLockNotActive
 	}
 
 	pub, priv, err := ed25519.GenerateKey(nil) // nil == crypto/rand
@@ -1125,18 +1249,28 @@ func (b *LocalBackend) NetworkLockWrapPreauthKey(preauthKey string, tkaKey key.N
 	return fmt.Sprintf("%s--TL%s-%s", preauthKey, tkaSuffixEncoder.EncodeToString(sig.Serialize()), tkaSuffixEncoder.EncodeToString(priv)), nil
 }
 
-// NetworkLockVerifySigningDeeplink asks the authority to verify the given deeplink
+// Deprecated: use [LocalBackend.TailnetLockWrapPreauthKey] instead.
+func (b *LocalBackend) NetworkLockWrapPreauthKey(preauthKey string, tkaKey key.NLPrivate) (string, error) {
+	return b.TailnetLockWrapPreauthKey(preauthKey, tkaKey)
+}
+
+// TailnetLockVerifySigningDeeplink asks the authority to verify the given deeplink
 // URL. See the comment for ValidateDeeplink for details.
-func (b *LocalBackend) NetworkLockVerifySigningDeeplink(url string) tka.DeeplinkValidationResult {
+func (b *LocalBackend) TailnetLockVerifySigningDeeplink(url string) tka.DeeplinkValidationResult {
 	b.mu.Lock()
 	defer b.mu.Unlock()
 	if b.tka == nil {
-		return tka.DeeplinkValidationResult{IsValid: false, Error: errNetworkLockNotActive.Error()}
+		return tka.DeeplinkValidationResult{IsValid: false, Error: errTailnetLockNotActive.Error()}
 	}
 
 	return b.tka.authority.ValidateDeeplink(url)
 }
 
+// Deprecated: use [LocalBackend.TailnetLockVerifySigningDeeplink] instead.
+func (b *LocalBackend) NetworkLockVerifySigningDeeplink(url string) tka.DeeplinkValidationResult {
+	return b.TailnetLockVerifySigningDeeplink(url)
+}
+
 func signNodeKey(nodeInfo tailcfg.TKASignInfo, signer key.NLPrivate) (*tka.NodeKeySignature, error) {
 	p, err := nodeInfo.NodePublic.MarshalBinary()
 	if err != nil {
@@ -1482,3 +1616,24 @@ func (b *LocalBackend) tkaReadAffectedSigs(ourNodeKey key.NodePublic, key tkatyp
 
 	return a, nil
 }
+
+// LocalBackendWithTKAForTest creates a LocalBackend with an initialized TKA
+// state for testing tailnet lock from the feature/tailnetlock package. Will be
+// removed when tailnet lock is fully moved to its own package. Do not use this
+// from any other package.
+func LocalBackendWithTKAForTest(chonk tka.CompactableChonk, tka *tka.Authority) *LocalBackend {
+	testenv.AssertInTest()
+
+	var state *tkaState
+	if tka != nil {
+		state = &tkaState{
+			authority: tka,
+			storage:   chonk,
+		}
+	}
+	return &LocalBackend{
+		store: &mem.Store{},
+		logf:  logger.Discard,
+		tka:   state,
+	}
+}
diff --git a/ipn/ipnlocal/network-lock_test.go b/ipn/ipnlocal/tailnet-lock_test.go
similarity index 84%
rename from ipn/ipnlocal/network-lock_test.go
rename to ipn/ipnlocal/tailnet-lock_test.go
index eead2d892..267142ffe 100644
--- a/ipn/ipnlocal/network-lock_test.go
+++ b/ipn/ipnlocal/tailnet-lock_test.go
@@ -84,7 +84,29 @@ func fakeNoiseServer(t *testing.T, handler http.HandlerFunc) (*httptest.Server,
 	return ts, client
 }
 
+// newLocalBackendForTKA creates a new instance of [LocalBackend] for testing
+// Tailnet Lock, in particular setting the tka field.
+func newLocalBackendForTKA(t *testing.T, varRoot string, client *http.Client, pm *profileManager, authority *tka.Authority, chonk tka.CompactableChonk) LocalBackend {
+	t.Helper()
+	cc := fakeControlClient(t, client)
+	return LocalBackend{
+		varRoot: varRoot,
+		cc:      cc,
+		ccAuto:  cc,
+		logf:    t.Logf,
+		health:  health.NewTracker(eventbustest.NewBus(t)),
+		tka: &tkaState{
+			profile:   pm.CurrentProfile().ID(),
+			authority: authority,
+			storage:   chonk,
+		},
+		pm:    pm,
+		store: pm.Store(),
+	}
+}
+
 func setupProfileManager(t *testing.T, nodePriv key.NodePrivate, nlPriv key.NLPrivate) *profileManager {
+	t.Helper()
 	pm := must.Get(newProfileManager(new(mem.Store), t.Logf, health.NewTracker(eventbustest.NewBus(t))))
 	must.Do(pm.SetPrefs((&ipn.Prefs{
 		Persist: &persist.Persist{
@@ -95,6 +117,18 @@ func setupProfileManager(t *testing.T, nodePriv key.NodePrivate, nlPriv key.NLPr
 	return pm
 }
 
+// setupChonkStorage creates a new [tka.FS] in a temporary folder.
+func setupChonkStorage(t *testing.T, pm *profileManager) (varRoot string, chonk *tka.FS) {
+	varRoot = t.TempDir()
+	tkaPath := filepath.Join(varRoot, "tka-profile", string(pm.CurrentProfile().ID()))
+	os.Mkdir(tkaPath, 0755)
+	chonk, err := tka.ChonkDir(tkaPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return varRoot, chonk
+}
+
 func TestTKAEnablementFlow(t *testing.T) {
 	nodePriv := key.NewNode()
 
@@ -102,11 +136,9 @@ func TestTKAEnablementFlow(t *testing.T) {
 	// our mock server can communicate.
 	nlPriv := key.NewNLPrivate()
 	key := tka.Key{Kind: tka.Key25519, Public: nlPriv.Public().Verifier(), Votes: 2}
+	state := tka.CreateStateForTest(key)
 	chonk := tka.ChonkMem()
-	a1, genesisAUM, err := tka.Create(chonk, tka.State{
-		Keys:              []tka.Key{key},
-		DisablementValues: [][]byte{bytes.Repeat([]byte{0xa5}, 32)},
-	}, nlPriv)
+	a1, genesisAUM, err := tka.Create(chonk, state, nlPriv)
 	if err != nil {
 		t.Fatalf("tka.Create() failed: %v", err)
 	}
@@ -188,13 +220,7 @@ func TestTKADisablementFlow(t *testing.T) {
 
 	pm := setupProfileManager(t, nodePriv, nlPriv)
 
-	temp := t.TempDir()
-	tkaPath := filepath.Join(temp, "tka-profile", string(pm.CurrentProfile().ID()))
-	os.Mkdir(tkaPath, 0755)
-	chonk, err := tka.ChonkDir(tkaPath)
-	if err != nil {
-		t.Fatal(err)
-	}
+	varRoot, chonk := setupChonkStorage(t, pm)
 	authority, _, err := tka.Create(chonk, tka.State{
 		Keys:              []tka.Key{key},
 		DisablementValues: [][]byte{tka.DisablementKDF(disablementSecret)},
@@ -239,20 +265,7 @@ func TestTKADisablementFlow(t *testing.T) {
 	}))
 	defer ts.Close()
 
-	cc := fakeControlClient(t, client)
-	b := LocalBackend{
-		varRoot: temp,
-		cc:      cc,
-		ccAuto:  cc,
-		logf:    t.Logf,
-		health:  health.NewTracker(eventbustest.NewBus(t)),
-		tka: &tkaState{
-			authority: authority,
-			storage:   chonk,
-		},
-		pm:    pm,
-		store: pm.Store(),
-	}
+	b := newLocalBackendForTKA(t, varRoot, client, pm, authority, chonk)
 
 	// Test that the wrong disablement secret does not shut down the authority.
 	returnWrongSecret = true
@@ -289,8 +302,6 @@ func TestTKASync(t *testing.T) {
 	someKeyPriv := key.NewNLPrivate()
 	someKey := tka.Key{Kind: tka.Key25519, Public: someKeyPriv.Public().Verifier(), Votes: 1}
 
-	disablementSecret := bytes.Repeat([]byte{0xa5}, 32)
-
 	type tkaSyncScenario struct {
 		name string
 		// controlAUMs is called (if non-nil) to get any AUMs which the tka state
@@ -369,10 +380,8 @@ func TestTKASync(t *testing.T) {
 			// Setup the tka authority on the control plane.
 			key := tka.Key{Kind: tka.Key25519, Public: nlPriv.Public().Verifier(), Votes: 2}
 			controlStorage := tka.ChonkMem()
-			controlAuthority, bootstrap, err := tka.Create(controlStorage, tka.State{
-				Keys:              []tka.Key{key, someKey},
-				DisablementValues: [][]byte{tka.DisablementKDF(disablementSecret)},
-			}, nlPriv)
+			controlState := tka.CreateStateForTest(key, someKey)
+			controlAuthority, bootstrap, err := tka.Create(controlStorage, controlState, nlPriv)
 			if err != nil {
 				t.Fatalf("tka.Create() failed: %v", err)
 			}
@@ -382,14 +391,8 @@ func TestTKASync(t *testing.T) {
 				}
 			}
 
-			temp := t.TempDir()
-			tkaPath := filepath.Join(temp, "tka-profile", string(pm.CurrentProfile().ID()))
-			os.Mkdir(tkaPath, 0755)
 			// Setup the TKA authority on the node.
-			nodeStorage, err := tka.ChonkDir(tkaPath)
-			if err != nil {
-				t.Fatal(err)
-			}
+			varRoot, nodeStorage := setupChonkStorage(t, pm)
 			nodeAuthority, err := tka.Bootstrap(nodeStorage, bootstrap)
 			if err != nil {
 				t.Fatalf("tka.Bootstrap() failed: %v", err)
@@ -424,20 +427,7 @@ func TestTKASync(t *testing.T) {
 			defer ts.Close()
 
 			// Setup the client.
-			cc := fakeControlClient(t, client)
-			b := LocalBackend{
-				varRoot: temp,
-				cc:      cc,
-				ccAuto:  cc,
-				logf:    t.Logf,
-				health:  health.NewTracker(eventbustest.NewBus(t)),
-				pm:      pm,
-				store:   pm.Store(),
-				tka: &tkaState{
-					authority: nodeAuthority,
-					storage:   nodeStorage,
-				},
-			}
+			b := newLocalBackendForTKA(t, varRoot, client, pm, nodeAuthority, nodeStorage)
 
 			// Finally, let's trigger a sync.
 			err = b.tkaSyncIfNeeded(&netmap.NetworkMap{
@@ -463,8 +453,6 @@ func TestTKASyncTriggersCompact(t *testing.T) {
 	someKeyPriv := key.NewNLPrivate()
 	someKey := tka.Key{Kind: tka.Key25519, Public: someKeyPriv.Public().Verifier(), Votes: 1}
 
-	disablementSecret := bytes.Repeat([]byte{0xa5}, 32)
-
 	nodePriv := key.NewNode()
 	nlPriv := key.NewNLPrivate()
 	pm := setupProfileManager(t, nodePriv, nlPriv)
@@ -480,10 +468,8 @@ func TestTKASyncTriggersCompact(t *testing.T) {
 	key := tka.Key{Kind: tka.Key25519, Public: nlPriv.Public().Verifier(), Votes: 2}
 	controlStorage := tka.ChonkMem()
 	controlStorage.SetClock(clock)
-	controlAuthority, bootstrap, err := tka.Create(controlStorage, tka.State{
-		Keys:              []tka.Key{key, someKey},
-		DisablementValues: [][]byte{tka.DisablementKDF(disablementSecret)},
-	}, nlPriv)
+	controlState := tka.CreateStateForTest(key, someKey)
+	controlAuthority, bootstrap, err := tka.Create(controlStorage, controlState, nlPriv)
 	if err != nil {
 		t.Fatalf("tka.Create() failed: %v", err)
 	}
@@ -542,19 +528,8 @@ func TestTKASyncTriggersCompact(t *testing.T) {
 	defer ts.Close()
 
 	// Setup the client.
-	cc := fakeControlClient(t, client)
-	b := LocalBackend{
-		cc:     cc,
-		ccAuto: cc,
-		logf:   t.Logf,
-		health: health.NewTracker(eventbustest.NewBus(t)),
-		pm:     pm,
-		store:  pm.Store(),
-		tka: &tkaState{
-			authority: nodeAuthority,
-			storage:   nodeStorage,
-		},
-	}
+	varRoot := ""
+	b := newLocalBackendForTKA(t, varRoot, client, pm, nodeAuthority, nodeStorage)
 
 	// Trigger a sync.
 	err = b.tkaSyncIfNeeded(&netmap.NetworkMap{
@@ -610,11 +585,9 @@ func TestTKASyncTriggersCompact(t *testing.T) {
 func TestTKAFilterNetmap(t *testing.T) {
 	nlPriv := key.NewNLPrivate()
 	nlKey := tka.Key{Kind: tka.Key25519, Public: nlPriv.Public().Verifier(), Votes: 2}
+	state := tka.CreateStateForTest(nlKey)
 	storage := tka.ChonkMem()
-	authority, _, err := tka.Create(storage, tka.State{
-		Keys:              []tka.Key{nlKey},
-		DisablementValues: [][]byte{bytes.Repeat([]byte{0xa5}, 32)},
-	}, nlPriv)
+	authority, _, err := tka.Create(storage, state, nlPriv)
 	if err != nil {
 		t.Fatalf("tka.Create() failed: %v", err)
 	}
@@ -668,7 +641,7 @@ func TestTKAFilterNetmap(t *testing.T) {
 		return node, nodeSig
 	}
 
-	preauth, err := b.NetworkLockWrapPreauthKey("tskey-auth-k7UagY1CNTRL-ZZZZZ", nlPriv)
+	preauth, err := b.TailnetLockWrapPreauthKey("tskey-auth-k7UagY1CNTRL-ZZZZZ", nlPriv)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -764,17 +737,11 @@ func TestTKADisable(t *testing.T) {
 	// Make a fake TKA authority, to seed local state.
 	disablementSecret := bytes.Repeat([]byte{0xa5}, 32)
 	nlPriv := key.NewNLPrivate()
+	key := tka.Key{Kind: tka.Key25519, Public: nlPriv.Public().Verifier(), Votes: 2}
 
 	pm := setupProfileManager(t, nodePriv, nlPriv)
 
-	temp := t.TempDir()
-	tkaPath := filepath.Join(temp, "tka-profile", string(pm.CurrentProfile().ID()))
-	os.Mkdir(tkaPath, 0755)
-	key := tka.Key{Kind: tka.Key25519, Public: nlPriv.Public().Verifier(), Votes: 2}
-	chonk, err := tka.ChonkDir(tkaPath)
-	if err != nil {
-		t.Fatal(err)
-	}
+	temp, chonk := setupChonkStorage(t, pm)
 	authority, _, err := tka.Create(chonk, tka.State{
 		Keys:              []tka.Key{key},
 		DisablementValues: [][]byte{tka.DisablementKDF(disablementSecret)},
@@ -821,28 +788,14 @@ func TestTKADisable(t *testing.T) {
 	}))
 	defer ts.Close()
 
-	cc := fakeControlClient(t, client)
-	b := LocalBackend{
-		varRoot: temp,
-		cc:      cc,
-		ccAuto:  cc,
-		logf:    t.Logf,
-		health:  health.NewTracker(eventbustest.NewBus(t)),
-		tka: &tkaState{
-			profile:   pm.CurrentProfile().ID(),
-			authority: authority,
-			storage:   chonk,
-		},
-		pm:    pm,
-		store: pm.Store(),
-	}
+	b := newLocalBackendForTKA(t, temp, client, pm, authority, chonk)
 
 	// Test that we get an error for an incorrect disablement secret.
-	if err := b.NetworkLockDisable([]byte{1, 2, 3, 4}); err == nil || err.Error() != "incorrect disablement secret" {
-		t.Errorf("NetworkLockDisable(<bad secret>).err = %v, want 'incorrect disablement secret'", err)
+	if err := b.TailnetLockDisable([]byte{1, 2, 3, 4}); err == nil || err.Error() != "incorrect disablement secret" {
+		t.Errorf("TailnetLockDisable(<bad secret>).err = %v, want 'incorrect disablement secret'", err)
 	}
-	if err := b.NetworkLockDisable(disablementSecret); err != nil {
-		t.Errorf("NetworkLockDisable() failed: %v", err)
+	if err := b.TailnetLockDisable(disablementSecret); err != nil {
+		t.Errorf("TailnetLockDisable() failed: %v", err)
 	}
 }
 
@@ -854,20 +807,11 @@ func TestTKASign(t *testing.T) {
 	pm := setupProfileManager(t, nodePriv, nlPriv)
 
 	// Make a fake TKA authority, to seed local state.
-	disablementSecret := bytes.Repeat([]byte{0xa5}, 32)
 	key := tka.Key{Kind: tka.Key25519, Public: nlPriv.Public().Verifier(), Votes: 2}
+	state := tka.CreateStateForTest(key)
 
-	temp := t.TempDir()
-	tkaPath := filepath.Join(temp, "tka-profile", string(pm.CurrentProfile().ID()))
-	os.Mkdir(tkaPath, 0755)
-	chonk, err := tka.ChonkDir(tkaPath)
-	if err != nil {
-		t.Fatal(err)
-	}
-	authority, _, err := tka.Create(chonk, tka.State{
-		Keys:              []tka.Key{key},
-		DisablementValues: [][]byte{tka.DisablementKDF(disablementSecret)},
-	}, nlPriv)
+	varRoot, chonk := setupChonkStorage(t, pm)
+	authority, _, err := tka.Create(chonk, state, nlPriv)
 	if err != nil {
 		t.Fatalf("tka.Create() failed: %v", err)
 	}
@@ -887,23 +831,11 @@ func TestTKASign(t *testing.T) {
 		}
 	}))
 	defer ts.Close()
-	cc := fakeControlClient(t, client)
-	b := LocalBackend{
-		varRoot: temp,
-		cc:      cc,
-		ccAuto:  cc,
-		logf:    t.Logf,
-		health:  health.NewTracker(eventbustest.NewBus(t)),
-		tka: &tkaState{
-			authority: authority,
-			storage:   chonk,
-		},
-		pm:    pm,
-		store: pm.Store(),
-	}
 
-	if err := b.NetworkLockSign(toSign.Public(), nil); err != nil {
-		t.Errorf("NetworkLockSign() failed: %v", err)
+	b := newLocalBackendForTKA(t, varRoot, client, pm, authority, chonk)
+
+	if err := b.TailnetLockSign(toSign.Public(), nil); err != nil {
+		t.Errorf("TailnetLockSign() failed: %v", err)
 	}
 }
 
@@ -911,23 +843,14 @@ func TestTKAForceDisable(t *testing.T) {
 	nodePriv := key.NewNode()
 
 	// Make a fake TKA authority, to seed local state.
-	disablementSecret := bytes.Repeat([]byte{0xa5}, 32)
 	nlPriv := key.NewNLPrivate()
 	key := tka.Key{Kind: tka.Key25519, Public: nlPriv.Public().Verifier(), Votes: 2}
+	state := tka.CreateStateForTest(key)
 
 	pm := setupProfileManager(t, nodePriv, nlPriv)
 
-	temp := t.TempDir()
-	tkaPath := filepath.Join(temp, "tka-profile", string(pm.CurrentProfile().ID()))
-	os.Mkdir(tkaPath, 0755)
-	chonk, err := tka.ChonkDir(tkaPath)
-	if err != nil {
-		t.Fatal(err)
-	}
-	authority, genesis, err := tka.Create(chonk, tka.State{
-		Keys:              []tka.Key{key},
-		DisablementValues: [][]byte{tka.DisablementKDF(disablementSecret)},
-	}, nlPriv)
+	temp, chonk := setupChonkStorage(t, pm)
+	authority, genesis, err := tka.Create(chonk, state, nlPriv)
 	if err != nil {
 		t.Fatalf("tka.Create() failed: %v", err)
 	}
@@ -960,7 +883,7 @@ func TestTKAForceDisable(t *testing.T) {
 
 	b := newTestLocalBackendWithSys(t, sys)
 	b.SetVarRoot(temp)
-	b.SetControlClientGetterForTesting(func(controlclient.Options) (controlclient.Client, error) {
+	b.ForTest().SetControlClientGetter(func(controlclient.Options) (controlclient.Client, error) {
 		return cc, nil
 	})
 	b.mu.Lock()
@@ -971,8 +894,8 @@ func TestTKAForceDisable(t *testing.T) {
 	b.pm = pm
 	b.mu.Unlock()
 
-	if err := b.NetworkLockForceLocalDisable(); err != nil {
-		t.Fatalf("NetworkLockForceLocalDisable() failed: %v", err)
+	if err := b.TailnetLockForceLocalDisable(); err != nil {
+		t.Fatalf("TailnetLockForceLocalDisable() failed: %v", err)
 	}
 	if b.tka != nil {
 		t.Fatal("tka was not shut down")
@@ -1002,20 +925,11 @@ func TestTKAAffectedSigs(t *testing.T) {
 	pm := setupProfileManager(t, nodePriv, nlPriv)
 
 	// Make a fake TKA authority, to seed local state.
-	disablementSecret := bytes.Repeat([]byte{0xa5}, 32)
 	tkaKey := tka.Key{Kind: tka.Key25519, Public: nlPriv.Public().Verifier(), Votes: 2}
+	state := tka.CreateStateForTest(tkaKey)
 
-	temp := t.TempDir()
-	tkaPath := filepath.Join(temp, "tka-profile", string(pm.CurrentProfile().ID()))
-	os.Mkdir(tkaPath, 0755)
-	chonk, err := tka.ChonkDir(tkaPath)
-	if err != nil {
-		t.Fatal(err)
-	}
-	authority, _, err := tka.Create(chonk, tka.State{
-		Keys:              []tka.Key{tkaKey},
-		DisablementValues: [][]byte{tka.DisablementKDF(disablementSecret)},
-	}, nlPriv)
+	varRoot, chonk := setupChonkStorage(t, pm)
+	authority, _, err := tka.Create(chonk, state, nlPriv)
 	if err != nil {
 		t.Fatalf("tka.Create() failed: %v", err)
 	}
@@ -1084,29 +998,16 @@ func TestTKAAffectedSigs(t *testing.T) {
 				}
 			}))
 			defer ts.Close()
-			cc := fakeControlClient(t, client)
-			b := LocalBackend{
-				varRoot: temp,
-				cc:      cc,
-				ccAuto:  cc,
-				logf:    t.Logf,
-				health:  health.NewTracker(eventbustest.NewBus(t)),
-				tka: &tkaState{
-					authority: authority,
-					storage:   chonk,
-				},
-				pm:    pm,
-				store: pm.Store(),
-			}
+			b := newLocalBackendForTKA(t, varRoot, client, pm, authority, chonk)
 
-			sigs, err := b.NetworkLockAffectedSigs(nlPriv.KeyID())
+			sigs, err := b.TailnetLockAffectedSigs(nlPriv.KeyID())
 			switch {
 			case tc.wantErr == "" && err != nil:
-				t.Errorf("NetworkLockAffectedSigs() failed: %v", err)
+				t.Errorf("TailnetLockAffectedSigs() failed: %v", err)
 			case tc.wantErr != "" && err == nil:
-				t.Errorf("NetworkLockAffectedSigs().err = nil, want %q", tc.wantErr)
+				t.Errorf("TailnetLockAffectedSigs().err = nil, want %q", tc.wantErr)
 			case tc.wantErr != "" && err.Error() != tc.wantErr:
-				t.Errorf("NetworkLockAffectedSigs().err = %q, want %q", err.Error(), tc.wantErr)
+				t.Errorf("TailnetLockAffectedSigs().err = %q, want %q", err.Error(), tc.wantErr)
 			}
 
 			if tc.wantErr == "" {
@@ -1130,22 +1031,13 @@ func TestTKARecoverCompromisedKeyFlow(t *testing.T) {
 	pm := setupProfileManager(t, nodePriv, nlPriv)
 
 	// Make a fake TKA authority, to seed local state.
-	disablementSecret := bytes.Repeat([]byte{0xa5}, 32)
 	key := tka.Key{Kind: tka.Key25519, Public: nlPriv.Public().Verifier(), Votes: 2}
 	cosignKey := tka.Key{Kind: tka.Key25519, Public: cosignPriv.Public().Verifier(), Votes: 2}
 	compromisedKey := tka.Key{Kind: tka.Key25519, Public: compromisedPriv.Public().Verifier(), Votes: 1}
+	state := tka.CreateStateForTest(key, compromisedKey, cosignKey)
 
-	temp := t.TempDir()
-	tkaPath := filepath.Join(temp, "tka-profile", string(pm.CurrentProfile().ID()))
-	os.Mkdir(tkaPath, 0755)
-	chonk, err := tka.ChonkDir(tkaPath)
-	if err != nil {
-		t.Fatal(err)
-	}
-	authority, _, err := tka.Create(chonk, tka.State{
-		Keys:              []tka.Key{key, compromisedKey, cosignKey},
-		DisablementValues: [][]byte{tka.DisablementKDF(disablementSecret)},
-	}, nlPriv)
+	varRoot, chonk := setupChonkStorage(t, pm)
+	authority, _, err := tka.Create(chonk, state, nlPriv)
 	if err != nil {
 		t.Fatalf("tka.Create() failed: %v", err)
 	}
@@ -1170,49 +1062,26 @@ func TestTKARecoverCompromisedKeyFlow(t *testing.T) {
 		}
 	}))
 	defer ts.Close()
-	cc := fakeControlClient(t, client)
-	b := LocalBackend{
-		varRoot: temp,
-		cc:      cc,
-		ccAuto:  cc,
-		logf:    t.Logf,
-		health:  health.NewTracker(eventbustest.NewBus(t)),
-		tka: &tkaState{
-			authority: authority,
-			storage:   chonk,
-		},
-		pm:    pm,
-		store: pm.Store(),
-	}
+	b := newLocalBackendForTKA(t, varRoot, client, pm, authority, chonk)
 
-	aum, err := b.NetworkLockGenerateRecoveryAUM([]tkatype.KeyID{compromisedPriv.KeyID()}, tka.AUMHash{})
+	aum, err := b.TailnetLockGenerateRecoveryAUM([]tkatype.KeyID{compromisedPriv.KeyID()}, tka.AUMHash{})
 	if err != nil {
-		t.Fatalf("NetworkLockGenerateRecoveryAUM() failed: %v", err)
+		t.Fatalf("TailnetLockGenerateRecoveryAUM() failed: %v", err)
 	}
 
 	// Cosign using the cosigning key.
 	{
 		pm := setupProfileManager(t, nodePriv, cosignPriv)
-		b := LocalBackend{
-			varRoot: temp,
-			logf:    t.Logf,
-			health:  health.NewTracker(eventbustest.NewBus(t)),
-			tka: &tkaState{
-				authority: authority,
-				storage:   chonk,
-			},
-			pm:    pm,
-			store: pm.Store(),
-		}
-		if aum, err = b.NetworkLockCosignRecoveryAUM(aum); err != nil {
-			t.Fatalf("NetworkLockCosignRecoveryAUM() failed: %v", err)
+		b := newLocalBackendForTKA(t, varRoot, client, pm, authority, chonk)
+		if aum, err = b.TailnetLockCosignRecoveryAUM(aum); err != nil {
+			t.Fatalf("TailnetLockCosignRecoveryAUM() failed: %v", err)
 		}
 	}
 
 	// Finally, submit the recovery AUM. Validation is done
 	// in the fake control handler.
-	if err := b.NetworkLockSubmitRecoveryAUM(aum); err != nil {
-		t.Errorf("NetworkLockSubmitRecoveryAUM() failed: %v", err)
+	if err := b.TailnetLockSubmitRecoveryAUM(aum); err != nil {
+		t.Errorf("TailnetLockSubmitRecoveryAUM() failed: %v", err)
 	}
 }
 
diff --git a/ipn/ipnlocal/tailnetlock_disabled.go b/ipn/ipnlocal/tailnetlock_disabled.go
index 0668437b1..c8d418531 100644
--- a/ipn/ipnlocal/tailnetlock_disabled.go
+++ b/ipn/ipnlocal/tailnetlock_disabled.go
@@ -26,6 +26,15 @@ func (b *LocalBackend) tkaSyncIfNeeded(nm *netmap.NetworkMap, prefs ipn.PrefsVie
 
 func (b *LocalBackend) tkaFilterNetmapLocked(nm *netmap.NetworkMap) {}
 
-func (b *LocalBackend) NetworkLockStatus() *ipnstate.NetworkLockStatus {
-	return &ipnstate.NetworkLockStatus{Enabled: false}
+func (b *LocalBackend) tkaFilterDeltaMutsLocked(muts []netmap.NodeMutation) []netmap.NodeMutation {
+	return muts
+}
+
+func (b *LocalBackend) TailnetLockStatus() *ipnstate.TailnetLockStatus {
+	return &ipnstate.TailnetLockStatus{Enabled: false}
+}
+
+// Deprecated: use [LocalBackend.TailnetLockStatus] instead.
+func (b *LocalBackend) NetworkLockStatus() *ipnstate.TailnetLockStatus {
+	return b.TailnetLockStatus()
 }
diff --git a/ipn/ipnlocal/watchdog.go b/ipn/ipnlocal/watchdog.go
new file mode 100644
index 000000000..2dd7b41dc
--- /dev/null
+++ b/ipn/ipnlocal/watchdog.go
@@ -0,0 +1,158 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package ipnlocal
+
+import (
+	"log"
+	"runtime"
+	"time"
+
+	"tailscale.com/tstime"
+)
+
+// deadlockProbeDelay is how long a watched call must be in flight before we
+// start probing locks to check for a deadlock. Calls that complete sooner do
+// not trigger any probing.
+const deadlockProbeDelay = 5 * time.Second
+
+// deadlockTimeout is how long the lock-probing goroutine is allowed to run
+// before we declare a deadlock and panic with goroutine stacks. That is, it's
+// the maximum total time we allow any of the probed locks to be held.
+const deadlockTimeout = 30 * time.Second
+
+// CheckDeadlocks schedules a delayed deadlock probe and returns a function to
+// call when the operation being watched is done. Callers typically use it as
+// "defer b.CheckDeadlocks()()" to bracket a region of code that should not
+// take more than [deadlockProbeDelay].
+//
+// This is a backstop for detecting and debugging deadlocks in the process, replacing
+// the earlier watchdogEngine removed in 2b338dd6a8dbd.
+func (b *LocalBackend) CheckDeadlocks() (done func()) {
+	// Bump the in-flight count. If a watched region is already open, the
+	// probe timer is already armed, so the bump is all we need to do: the
+	// matching doneDeadlockCheck will decrement when this caller returns and
+	// only the last one out will stop the timer.
+	if b.deadlockChecksInFlight.Add(1) != 1 {
+		return b.doneDeadlockCheck
+	}
+
+	// Fast path to avoid the deadlockTimerMu+Timer.Reset cost when
+	// CheckDeadlocks is called many times per second by non-overlapping
+	// callers: re-arm the probe timer at most once per wall-clock second.
+	// We use a unix-seconds timestamp (+1 so 0 can mean "never") and a CAS
+	// so that only one caller per second proceeds to touch the timer; the
+	// rest return early.
+	nowUnix := tstime.DefaultClock{Clock: b.Clock()}.Now().Unix() + 1
+	lastUnix := b.lastDeadlockCheckUnix.Load()
+	if lastUnix == nowUnix || !b.lastDeadlockCheckUnix.CompareAndSwap(lastUnix, nowUnix) {
+		return b.doneDeadlockCheck
+	}
+
+	// Slow path: (re)arm the probe timer. Lazily create it on first use.
+	b.deadlockTimerMu.Lock()
+	defer b.deadlockTimerMu.Unlock()
+
+	t := b.deadlockProbeTimer
+	if t == nil {
+		t = time.AfterFunc(deadlockProbeDelay, b.runDeadlockProbe)
+		b.deadlockProbeTimer = t
+	} else {
+		t.Reset(deadlockProbeDelay)
+	}
+	return b.doneDeadlockCheck
+}
+
+func (b *LocalBackend) doneDeadlockCheck() {
+	switch n := b.deadlockChecksInFlight.Add(-1); {
+	case n > 0:
+		return
+	case n < 0:
+		panic("ipnlocal: doneDeadlockCheck called without matching CheckDeadlocks")
+	}
+
+	b.deadlockTimerMu.Lock()
+	defer b.deadlockTimerMu.Unlock()
+	if b.deadlockProbeTimer == nil {
+		return
+	}
+	b.deadlockProbeTimer.Stop()
+}
+
+func (b *LocalBackend) runDeadlockProbe() {
+	b.deadlockTimerMu.Lock()
+	defer b.deadlockTimerMu.Unlock()
+
+	if b.deadlockChecksInFlight.Load() == 0 {
+		return
+	}
+
+	t := b.deadlockTimer
+	if t == nil {
+		t = time.AfterFunc(deadlockTimeout, b.reportDeadlock)
+		b.deadlockTimer = t
+	} else {
+		t.Reset(deadlockTimeout)
+	}
+	defer t.Stop()
+
+	b.probeLocks()
+}
+
+func (b *LocalBackend) probeLocks() {
+	b.probeLocalBackendLock()
+
+	sys := b.sys
+	if sys == nil {
+		return
+	}
+	if bus, ok := sys.Bus.GetOK(); ok && bus != nil {
+		bus.ProbeLocks()
+	}
+	if dialer, ok := sys.Dialer.GetOK(); ok && dialer != nil {
+		dialer.ProbeLocks()
+	}
+	if dm, ok := sys.DNSManager.GetOK(); ok && dm != nil {
+		dm.ProbeLocks()
+	}
+	if e, ok := sys.Engine.GetOK(); ok && e != nil {
+		e.ProbeLocks()
+	}
+	if nm, ok := sys.NetMon.GetOK(); ok && nm != nil {
+		nm.ProbeLocks()
+	}
+	if mc, ok := sys.MagicSock.GetOK(); ok && mc != nil {
+		mc.ProbeLocks()
+	}
+	if tun, ok := sys.Tun.GetOK(); ok && tun != nil {
+		tun.ProbeLocks()
+	}
+	if ht, ok := sys.HealthTracker.GetOK(); ok && ht != nil {
+		ht.ProbeLocks()
+	}
+}
+
+func (b *LocalBackend) probeLocalBackendLock() {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+}
+
+func (b *LocalBackend) reportDeadlock() {
+	logf := b.logf
+	if logf == nil {
+		logf = log.Printf
+	}
+	logf("ipnlocal watchdog goroutine stacks:\n%s", goroutineStacks())
+	panic("ipnlocal: watchdog timeout")
+}
+
+func goroutineStacks() []byte {
+	buf := make([]byte, 256<<10)
+	for {
+		n := runtime.Stack(buf, true)
+		if n < len(buf) {
+			return buf[:n]
+		}
+		buf = make([]byte, 2*len(buf))
+	}
+}
diff --git a/ipn/ipnlocal/watchdog_test.go b/ipn/ipnlocal/watchdog_test.go
new file mode 100644
index 000000000..b93a09b2b
--- /dev/null
+++ b/ipn/ipnlocal/watchdog_test.go
@@ -0,0 +1,64 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package ipnlocal
+
+import (
+	"testing"
+	"time"
+
+	"tailscale.com/tstest"
+)
+
+func TestCheckDeadlocksRateLimitAndTimerReuse(t *testing.T) {
+	clock := tstest.NewClock(tstest.ClockOpts{Start: time.Unix(123, 0)})
+	b := &LocalBackend{clock: clock}
+
+	done := b.CheckDeadlocks()
+	if b.lastDeadlockCheckUnix.Load() != 124 {
+		t.Fatalf("lastDeadlockCheckUnix = %v, want 124", b.lastDeadlockCheckUnix.Load())
+	}
+	timer := b.deadlockProbeTimer
+	if timer == nil {
+		t.Fatal("deadlockProbeTimer is nil")
+	}
+	if b.deadlockTimer != nil {
+		t.Fatal("deadlockTimer is non-nil before delayed probe fires")
+	}
+	if got := b.deadlockChecksInFlight.Load(); got != 1 {
+		t.Fatalf("deadlockChecksInFlight = %v, want 1", got)
+	}
+	done()
+	if b.deadlockChecksInFlight.Load() != 0 {
+		t.Fatalf("deadlockChecksInFlight after DoneDeadlockCheck = %v, want 0", b.deadlockChecksInFlight.Load())
+	}
+
+	doneCh := make(chan struct{})
+	go func() {
+		b.CheckDeadlocks()()
+		close(doneCh)
+	}()
+	select {
+	case <-doneCh:
+	case <-time.After(1 * time.Second):
+		t.Fatal("same-second CheckDeadlocks did not take the rate-limit fast path")
+	}
+	if b.deadlockProbeTimer != timer {
+		t.Fatal("same-second CheckDeadlocks allocated a new probe timer")
+	}
+
+	clock.Advance(time.Second)
+	done = b.CheckDeadlocks()
+	if b.deadlockProbeTimer != timer {
+		t.Fatal("CheckDeadlocks allocated a new probe timer instead of reusing the existing one")
+	}
+	if got := b.deadlockChecksInFlight.Load(); got != 1 {
+		t.Fatalf("deadlockChecksInFlight = %v, want 1", got)
+	}
+
+	b.runDeadlockProbe()
+	if b.deadlockTimer == nil {
+		t.Fatal("runDeadlockProbe did not allocate the deadlock timer")
+	}
+	done()
+}
diff --git a/ipn/ipnlocal/web_client.go b/ipn/ipnlocal/web_client.go
index 37dba93d0..6d4141ac5 100644
--- a/ipn/ipnlocal/web_client.go
+++ b/ipn/ipnlocal/web_client.go
@@ -1,7 +1,7 @@
 // Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
-//go:build !ios && !android && !ts_omit_webclient
+//go:build !android && !ts_omit_webclient
 
 package ipnlocal
 
@@ -173,7 +173,7 @@ func (b *LocalBackend) waitWebClientAuthURL(ctx context.Context, id string, src
 // one to be completed, based on the presence or absence of the
 // provided id value.
 func (b *LocalBackend) doWebClientNoiseRequest(ctx context.Context, id string, src tailcfg.NodeID) (*tailcfg.WebClientAuthResponse, error) {
-	nm := b.NetMap()
+	nm := b.NetMapNoPeers()
 	if nm == nil || !nm.SelfNode.Valid() {
 		return nil, errors.New("[unexpected] no self node")
 	}
diff --git a/ipn/ipnlocal/web_client_stub.go b/ipn/ipnlocal/web_client_stub.go
index 02798b4f7..9ba829c10 100644
--- a/ipn/ipnlocal/web_client_stub.go
+++ b/ipn/ipnlocal/web_client_stub.go
@@ -1,7 +1,7 @@
 // Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
-//go:build ios || android || ts_omit_webclient
+//go:build android || ts_omit_webclient
 
 package ipnlocal
 
diff --git a/ipn/ipnserver/server_test.go b/ipn/ipnserver/server_test.go
index 45a8d622d..409faf443 100644
--- a/ipn/ipnserver/server_test.go
+++ b/ipn/ipnserver/server_test.go
@@ -155,7 +155,7 @@ func TestConcurrentOSUserSwitchingOnWindows(t *testing.T) {
 
 		// Get the current user from the LocalBackend's perspective
 		// as soon as we're connected.
-		gotUID, gotActor := server.Backend().CurrentUserForTest()
+		gotUID, gotActor := server.Backend().ForTest().CurrentUser()
 
 		// Wait for the first notification to arrive.
 		// It will either be the initial state we've requested via [ipn.NotifyInitialState],
diff --git a/ipn/ipnstate/ipnstate.go b/ipn/ipnstate/ipnstate.go
index 17e6ac870..3e2c79151 100644
--- a/ipn/ipnstate/ipnstate.go
+++ b/ipn/ipnstate/ipnstate.go
@@ -73,6 +73,9 @@ type Status struct {
 	// trailing periods, and without any "_acme-challenge." prefix.
 	CertDomains []string
 
+	// ExtraRecords contains extra DNS records to add to the DNS resolver.
+	ExtraRecords []tailcfg.DNSRecord
+
 	// Peer is the state of each peer, keyed by each peer's current public key.
 	Peer map[key.NodePublic]*PeerStatus
 
@@ -86,7 +89,7 @@ type Status struct {
 	ClientVersion *tailcfg.ClientVersion
 }
 
-// TKAKey describes a key trusted by network lock.
+// TKAKey describes a key trusted by tailnet lock.
 type TKAKey struct {
 	Kind     string
 	Key      key.NLPublic
@@ -94,7 +97,7 @@ type TKAKey struct {
 	Votes    uint
 }
 
-// TKAPeer describes a peer and its network lock details.
+// TKAPeer describes a peer and its tailnet lock details.
 type TKAPeer struct {
 	Name             string // DNS
 	ID               tailcfg.NodeID
@@ -104,18 +107,18 @@ type TKAPeer struct {
 	NodeKeySignature tka.NodeKeySignature
 }
 
-// NetworkLockStatus represents whether network-lock is enabled,
+// TailnetLockStatus represents whether tailnet-lock is enabled,
 // along with details about the locally-known state of the tailnet
 // key authority.
-type NetworkLockStatus struct {
-	// Enabled is true if network lock is enabled.
+type TailnetLockStatus struct {
+	// Enabled is true if tailnet lock is enabled.
 	Enabled bool
 
 	// Head describes the AUM hash of the leaf AUM. Head is nil
-	// if network lock is not enabled.
+	// if tailnet lock is not enabled.
 	Head *[32]byte
 
-	// PublicKey describes the node's network-lock public key.
+	// PublicKey describes the node's tailnet-lock public key.
 	// It may be zero if the node has not logged in.
 	PublicKey key.NLPublic
 
@@ -123,18 +126,18 @@ type NetworkLockStatus struct {
 	// populated if the node is not operating (i.e. waiting for a login).
 	NodeKey *key.NodePublic
 
-	// NodeKeySigned is true if our node is authorized by network-lock.
+	// NodeKeySigned is true if our node is authorized by tailnet-lock.
 	NodeKeySigned bool
 
 	// NodeKeySignature is the current signature of this node's key.
 	NodeKeySignature *tka.NodeKeySignature
 
 	// TrustedKeys describes the keys currently trusted to make changes
-	// to network-lock.
+	// to tailnet-lock.
 	TrustedKeys []TKAKey
 
 	// VisiblePeers describes peers which are visible in the netmap that
-	// have valid Tailnet Lock signatures signatures.
+	// have valid Tailnet Lock signatures.
 	VisiblePeers []*TKAPeer
 
 	// FilteredPeers describes peers which were removed from the netmap
@@ -142,14 +145,17 @@ type NetworkLockStatus struct {
 	// checks.
 	FilteredPeers []*TKAPeer
 
-	// StateID is a nonce associated with the network lock authority,
+	// StateID is a nonce associated with the tailnet lock authority,
 	// generated upon enablement. This field is not populated if the
-	// network lock is disabled.
+	// tailnet lock is disabled.
 	StateID uint64
 }
 
-// NetworkLockUpdate describes a change to network-lock state.
-type NetworkLockUpdate struct {
+// Deprecated: use [TailnetLockStatus] instead.
+type NetworkLockStatus = TailnetLockStatus
+
+// TailnetLockUpdate describes a change to tailnet-lock state.
+type TailnetLockUpdate struct {
 	Hash   [32]byte
 	Change string // values of tka.AUMKind.String()
 
@@ -158,6 +164,9 @@ type NetworkLockUpdate struct {
 	Raw []byte
 }
 
+// Deprecated: use [TailnetLockUpdate] instead.
+type NetworkLockUpdate = TailnetLockUpdate
+
 // TailnetStatus is information about a Tailscale network ("tailnet").
 type TailnetStatus struct {
 	// Name is the name of the network that's currently in use.
@@ -223,6 +232,7 @@ type PeerStatusLite struct {
 // inconsistencies or lost data in the peer status.
 type PeerStatus struct {
 	ID        tailcfg.StableNodeID
+	NodeID    tailcfg.NodeID
 	PublicKey key.NodePublic
 	HostName  string // HostInfo's Hostname (not a DNS name or necessarily unique)
 
@@ -350,6 +360,24 @@ func (ps *PeerStatus) HasCap(cap tailcfg.NodeCapability) bool {
 	return ps.CapMap.Contains(cap)
 }
 
+// IsRouter reports whether ps describes a router:
+// a node that routes addresses besides its own.
+// Examples: an exit node, a subnet router, an app connector, etc.
+// It is the analogue of [tailcfg.Node.IsRouter].
+func (ps *PeerStatus) IsRouter() bool {
+	// TODO(sfllaw): Keep this aligned with dbx.Node.IsSubnetRouter.
+	if ps.AllowedIPs == nil {
+		return false
+	}
+
+	for _, r := range ps.AllowedIPs.All() {
+		if !r.IsSingleIP() || !slices.Contains(ps.TailscaleIPs, r.Addr()) {
+			return true
+		}
+	}
+	return false
+}
+
 // IsTagged reports whether ps is tagged.
 func (ps *PeerStatus) IsTagged() bool {
 	return ps.Tags != nil && ps.Tags.Len() > 0
@@ -443,6 +471,9 @@ func (sb *StatusBuilder) AddPeer(peer key.NodePublic, st *PeerStatus) {
 	if v := st.ID; v != "" {
 		e.ID = v
 	}
+	if v := st.NodeID; v != 0 {
+		e.NodeID = v
+	}
 	if v := st.HostName; v != "" {
 		e.HostName = v
 	}
diff --git a/ipn/ipnstate/ipnstate_test.go b/ipn/ipnstate/ipnstate_test.go
new file mode 100644
index 000000000..a6ea28b8d
--- /dev/null
+++ b/ipn/ipnstate/ipnstate_test.go
@@ -0,0 +1,164 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package ipnstate_test
+
+import (
+	"net/netip"
+	"testing"
+
+	"tailscale.com/ipn/ipnstate"
+	"tailscale.com/types/views"
+)
+
+func TestPeerStatusIsRouter(t *testing.T) {
+	for _, tc := range []struct {
+		name   string
+		status ipnstate.PeerStatus
+		want   bool
+	}{
+		{
+			name:   "empty",
+			status: ipnstate.PeerStatus{},
+			want:   false,
+		},
+		{
+			name: "invalid",
+			status: ipnstate.PeerStatus{
+				TailscaleIPs: []netip.Addr{
+					netip.MustParseAddr("100.64.0.1"),
+				},
+				AllowedIPs: new(views.SliceOf([]netip.Prefix{})),
+			},
+			want: false,
+		},
+		{
+			name: "plain-ipv4",
+			status: ipnstate.PeerStatus{
+				TailscaleIPs: []netip.Addr{
+					netip.MustParseAddr("100.64.0.1"),
+				},
+				AllowedIPs: new(views.SliceOf([]netip.Prefix{
+					netip.MustParsePrefix("100.64.0.1/32"),
+				})),
+			},
+			want: false,
+		},
+		{
+			name: "plain-ipv6",
+			status: ipnstate.PeerStatus{
+				TailscaleIPs: []netip.Addr{
+					netip.MustParseAddr("fd7a:115c:a1e0::1"),
+				},
+				AllowedIPs: new(views.SliceOf([]netip.Prefix{
+					netip.MustParsePrefix("fd7a:115c:a1e0::1/128"),
+				})),
+			},
+			want: false,
+		},
+		{
+			name: "plain-ipv4-ipv6",
+			status: ipnstate.PeerStatus{
+				TailscaleIPs: []netip.Addr{
+					netip.MustParseAddr("100.64.0.1"),
+					netip.MustParseAddr("fd7a:115c:a1e0::1"),
+				},
+				AllowedIPs: new(views.SliceOf([]netip.Prefix{
+					netip.MustParsePrefix("100.64.0.1/32"),
+					netip.MustParsePrefix("fd7a:115c:a1e0::1/128"),
+				})),
+			},
+			want: false,
+		},
+		{
+			name: "exit-node-ipv4",
+			status: ipnstate.PeerStatus{
+				TailscaleIPs: []netip.Addr{
+					netip.MustParseAddr("100.64.0.1"),
+				},
+				AllowedIPs: new(views.SliceOf([]netip.Prefix{
+					netip.MustParsePrefix("100.64.0.1/32"),
+					netip.MustParsePrefix("0.0.0.0/0"),
+				})),
+			},
+			want: true,
+		},
+		{
+			name: "exit-node-ipv6",
+			status: ipnstate.PeerStatus{
+				TailscaleIPs: []netip.Addr{
+					netip.MustParseAddr("fd7a:115c:a1e0::1"),
+				},
+				AllowedIPs: new(views.SliceOf([]netip.Prefix{
+					netip.MustParsePrefix("fd7a:115c:a1e0::1/128"),
+					netip.MustParsePrefix("::/0"),
+				})),
+			},
+			want: true,
+		},
+		{
+			name: "exit-node-ipv4-ipv6",
+			status: ipnstate.PeerStatus{
+				TailscaleIPs: []netip.Addr{
+					netip.MustParseAddr("100.64.0.1"),
+					netip.MustParseAddr("fd7a:115c:a1e0::1"),
+				},
+				AllowedIPs: new(views.SliceOf([]netip.Prefix{
+					netip.MustParsePrefix("100.64.0.1/32"),
+					netip.MustParsePrefix("fd7a:115c:a1e0::1/128"),
+					netip.MustParsePrefix("0.0.0.0/0"),
+					netip.MustParsePrefix("::/0"),
+				})),
+			},
+			want: true,
+		},
+		{
+			name: "subnet-router-ipv4",
+			status: ipnstate.PeerStatus{
+				TailscaleIPs: []netip.Addr{
+					netip.MustParseAddr("100.64.0.1"),
+				},
+				AllowedIPs: new(views.SliceOf([]netip.Prefix{
+					netip.MustParsePrefix("100.64.0.1/32"),
+					netip.MustParsePrefix("192.0.2.0/24"),
+				})),
+			},
+			want: true,
+		},
+		{
+			name: "subnet-router-ipv6",
+			status: ipnstate.PeerStatus{
+				TailscaleIPs: []netip.Addr{
+					netip.MustParseAddr("fd7a:115c:a1e0::1"),
+				},
+				AllowedIPs: new(views.SliceOf([]netip.Prefix{
+					netip.MustParsePrefix("fd7a:115c:a1e0::1/128"),
+					netip.MustParsePrefix("2001:db8::/32"),
+				})),
+			},
+			want: true,
+		},
+		{
+			name: "subnet-router-ipv4-ipv6",
+			status: ipnstate.PeerStatus{
+				TailscaleIPs: []netip.Addr{
+					netip.MustParseAddr("100.64.0.1"),
+					netip.MustParseAddr("fd7a:115c:a1e0::1"),
+				},
+				AllowedIPs: new(views.SliceOf([]netip.Prefix{
+					netip.MustParsePrefix("100.64.0.1/32"),
+					netip.MustParsePrefix("fd7a:115c:a1e0::1/128"),
+					netip.MustParsePrefix("192.0.2.0/24"),
+					netip.MustParsePrefix("2001:db8::/32"),
+				})),
+			},
+			want: true,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := tc.status.IsRouter(); got != tc.want {
+				t.Errorf("got %t, want %t", got, tc.want)
+			}
+		})
+	}
+}
diff --git a/ipn/lapitest/backend.go b/ipn/lapitest/backend.go
index b622d098f..fa21d8cc3 100644
--- a/ipn/lapitest/backend.go
+++ b/ipn/lapitest/backend.go
@@ -45,7 +45,7 @@ func newBackend(opts *options) *ipnlocal.LocalBackend {
 		tb.Fatalf("NewLocalBackend: %v", err)
 	}
 	tb.Cleanup(b.Shutdown)
-	b.SetControlClientGetterForTesting(opts.MakeControlClient)
+	b.ForTest().SetControlClientGetter(opts.MakeControlClient)
 	return b
 }
 
diff --git a/ipn/lapitest/opts.go b/ipn/lapitest/opts.go
index 5ed2f9757..1e2855700 100644
--- a/ipn/lapitest/opts.go
+++ b/ipn/lapitest/opts.go
@@ -66,7 +66,7 @@ func (o *options) Sys() *tsd.System {
 
 // Backend returns the [ipnlocal.LocalBackend] to be used by the server.
 // If a backend is provided via [WithBackend], it is used as-is.
-// Otherwise, a new backend is created with the the [options] in o.
+// Otherwise, a new backend is created with the [options] in o.
 func (o *options) Backend() *ipnlocal.LocalBackend {
 	return o.backend.Get(func() *ipnlocal.LocalBackend { return newBackend(o) })
 }
diff --git a/ipn/lapitest/server.go b/ipn/lapitest/server.go
index 2686682af..bb5b51164 100644
--- a/ipn/lapitest/server.go
+++ b/ipn/lapitest/server.go
@@ -195,7 +195,7 @@ func (s *Server) CheckCurrentUser(want ipnauth.Actor) {
 	if lb == nil {
 		s.tb.Fatalf("Backend: nil")
 	}
-	gotUID, gotActor := lb.CurrentUserForTest()
+	gotUID, gotActor := lb.ForTest().CurrentUser()
 	if gotUID != wantUID {
 		s.tb.Errorf("CurrentUser: got UID %q; want %q", gotUID, wantUID)
 	}
diff --git a/ipn/localapi/cert.go b/ipn/localapi/cert.go
index cd8afa03b..132f7bd1e 100644
--- a/ipn/localapi/cert.go
+++ b/ipn/localapi/cert.go
@@ -6,12 +6,15 @@
 package localapi
 
 import (
+	"errors"
 	"fmt"
+	"maps"
 	"net/http"
 	"strings"
 	"time"
 
 	"tailscale.com/ipn/ipnlocal"
+	"tailscale.com/tsweb"
 )
 
 func init() {
@@ -39,11 +42,15 @@ func (h *Handler) serveCert(w http.ResponseWriter, r *http.Request) {
 	}
 	pair, err := h.b.GetCertPEMWithValidity(r.Context(), domain, minValidity)
 	if err != nil {
-		// TODO(bradfitz): 500 is a little lazy here. The errors returned from
-		// GetCertPEM (and everywhere) should carry info info to get whether
-		// they're 400 vs 403 vs 500 at minimum. And then we should have helpers
-		// (in tsweb probably) to return an error that looks at the error value
-		// to determine the HTTP status code.
+		if hs, ok := errors.AsType[tsweb.HTTPStatuser](err); ok {
+			resp := hs.HTTPStatus()
+			maps.Copy(w.Header(), resp.Header)
+			http.Error(w, resp.Msg, resp.Code)
+			return
+		}
+		// TODO(bradfitz): 500 is a little lazy. Other errors from GetCertPEM
+		// should also implement tsweb.HTTPStatuser (400 vs 403 vs 500 vs …)
+		// rather than falling through here.
 		http.Error(w, fmt.Sprint(err), 500)
 		return
 	}
diff --git a/ipn/localapi/debug.go b/ipn/localapi/debug.go
index d8e46040d..f6b0d631b 100644
--- a/ipn/localapi/debug.go
+++ b/ipn/localapi/debug.go
@@ -9,6 +9,7 @@ import (
 	"cmp"
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net"
@@ -199,8 +200,6 @@ func (h *Handler) serveDebug(w http.ResponseWriter, r *http.Request) {
 			break
 		}
 		h.b.DebugNotify(n)
-	case "notify-last-netmap":
-		h.b.DebugNotifyLastNetMap()
 	case "break-tcp-conns":
 		err = h.b.DebugBreakTCPConns()
 	case "break-derp-conns":
@@ -232,6 +231,12 @@ func (h *Handler) serveDebug(w http.ResponseWriter, r *http.Request) {
 		if err == nil {
 			return
 		}
+	case "peer-disco-keys":
+		w.Header().Set("Content-Type", "application/json")
+		err = json.NewEncoder(w).Encode(h.b.DebugPeerDiscoKeys())
+		if err == nil {
+			return
+		}
 	case "rotate-disco-key":
 		err = h.b.DebugRotateDiscoKey()
 	case "statedir":
@@ -243,6 +248,22 @@ func (h *Handler) serveDebug(w http.ResponseWriter, r *http.Request) {
 		}
 	case "clear-netmap-cache":
 		h.b.ClearNetmapCache(r.Context())
+	case "current-netmap":
+		// Return the current netmap (with peers populated) as JSON. This
+		// is a debug-only path: the netmap.NetworkMap shape is an
+		// internal type and may change without notice. Production
+		// callers should fetch the narrower bits they need via their
+		// own LocalAPI methods instead.
+		nm := h.b.NetMapWithPeers()
+		if nm == nil {
+			err = errors.New("no netmap")
+			break
+		}
+		w.Header().Set("Content-Type", "application/json")
+		err = json.NewEncoder(w).Encode(nm)
+		if err == nil {
+			return
+		}
 	case "":
 		err = fmt.Errorf("missing parameter 'action'")
 	default:
@@ -278,7 +299,7 @@ func (h *Handler) serveDebugPacketFilterRules(w http.ResponseWriter, r *http.Req
 		http.Error(w, "debug access denied", http.StatusForbidden)
 		return
 	}
-	nm := h.b.NetMap()
+	nm := h.b.NetMapNoPeers()
 	if nm == nil {
 		http.Error(w, "no netmap", http.StatusNotFound)
 		return
@@ -295,7 +316,7 @@ func (h *Handler) serveDebugPacketFilterMatches(w http.ResponseWriter, r *http.R
 		http.Error(w, "debug access denied", http.StatusForbidden)
 		return
 	}
-	nm := h.b.NetMap()
+	nm := h.b.NetMapNoPeers()
 	if nm == nil {
 		http.Error(w, "no netmap", http.StatusNotFound)
 		return
diff --git a/ipn/localapi/debugderp.go b/ipn/localapi/debugderp.go
index 52987ee0a..fd42d2291 100644
--- a/ipn/localapi/debugderp.go
+++ b/ipn/localapi/debugderp.go
@@ -15,6 +15,7 @@ import (
 	"net/http"
 	"net/netip"
 	"strconv"
+	"strings"
 	"time"
 
 	"tailscale.com/derp/derphttp"
@@ -22,11 +23,28 @@ import (
 	"tailscale.com/net/netaddr"
 	"tailscale.com/net/netns"
 	"tailscale.com/net/stun"
+	"tailscale.com/net/tlsdial"
 	"tailscale.com/tailcfg"
 	"tailscale.com/types/key"
 	"tailscale.com/types/nettype"
 )
 
+// tlsConfigForNode builds a *tls.Config for connecting to a DERP node,
+// mirroring the logic in derphttp.Client.tlsClient so that sha256-raw cert
+// pinning and domain-fronting CertName values are handled correctly.
+func tlsConfigForNode(node *tailcfg.DERPNode) *tls.Config {
+	conf := tlsdial.Config(nil, nil)
+	conf.ServerName = node.HostName
+	if node.CertName != "" {
+		if suf, ok := strings.CutPrefix(node.CertName, "sha256-raw:"); ok {
+			tlsdial.SetConfigExpectedCertHash(conf, suf)
+		} else {
+			tlsdial.SetConfigExpectedCert(conf, node.CertName)
+		}
+	}
+	return conf
+}
+
 func (h *Handler) serveDebugDERPRegion(w http.ResponseWriter, r *http.Request) {
 	if !h.PermitWrite {
 		http.Error(w, "debug access denied", http.StatusForbidden)
@@ -100,9 +118,7 @@ func (h *Handler) serveDebugDERPRegion(w http.ResponseWriter, r *http.Request) {
 			defer conn.Close()
 
 			// Upgrade to TLS and verify that works properly.
-			tlsConn := tls.Client(conn, &tls.Config{
-				ServerName: cmp.Or(derpNode.CertName, derpNode.HostName),
-			})
+			tlsConn := tls.Client(conn, tlsConfigForNode(derpNode))
 			if err := tlsConn.HandshakeContext(ctx); err != nil {
 				st.Errors = append(st.Errors, fmt.Sprintf("Error upgrading connection to node %q @ %q to TLS over IPv4: %v", derpNode.HostName, addr, err))
 			} else {
@@ -119,12 +135,7 @@ func (h *Handler) serveDebugDERPRegion(w http.ResponseWriter, r *http.Request) {
 			defer conn.Close()
 
 			// Upgrade to TLS and verify that works properly.
-			tlsConn := tls.Client(conn, &tls.Config{
-				ServerName: cmp.Or(derpNode.CertName, derpNode.HostName),
-				// TODO(andrew-d): we should print more
-				// detailed failure information on if/why TLS
-				// verification fails
-			})
+			tlsConn := tls.Client(conn, tlsConfigForNode(derpNode))
 			if err := tlsConn.HandshakeContext(ctx); err != nil {
 				st.Errors = append(st.Errors, fmt.Sprintf("Error upgrading connection to node %q @ %q to TLS over IPv6: %v", derpNode.HostName, addr, err))
 			} else {
diff --git a/ipn/localapi/localapi.go b/ipn/localapi/localapi.go
index 43942c52f..2c880445f 100644
--- a/ipn/localapi/localapi.go
+++ b/ipn/localapi/localapi.go
@@ -7,6 +7,7 @@ package localapi
 import (
 	"bytes"
 	"cmp"
+	"context"
 	"crypto/subtle"
 	"encoding/json"
 	"errors"
@@ -44,6 +45,7 @@ import (
 	"tailscale.com/types/logger"
 	"tailscale.com/types/logid"
 	"tailscale.com/util/clientmetric"
+	"tailscale.com/util/def"
 	"tailscale.com/util/eventbus"
 	"tailscale.com/util/httpm"
 	"tailscale.com/util/mak"
@@ -72,20 +74,25 @@ var handler = map[string]LocalAPIHandler{
 
 	// The other /localapi/v0/NAME handlers are exact matches and contain only NAME
 	// without a trailing slash:
+	"cert-domains":         (*Handler).serveCertDomains,
 	"check-prefs":          (*Handler).serveCheckPrefs,
 	"check-so-mark-in-use": (*Handler).serveCheckSOMarkInUse,
 	"derpmap":              (*Handler).serveDERPMap,
+	"dns-config":           (*Handler).serveDNSConfig,
 	"goroutines":           (*Handler).serveGoroutines,
 	"login-interactive":    (*Handler).serveLoginInteractive,
 	"logout":               (*Handler).serveLogout,
+	"peer-by-id":           (*Handler).servePeerByID,
 	"ping":                 (*Handler).servePing,
 	"prefs":                (*Handler).servePrefs,
 	"reload-config":        (*Handler).reloadConfig,
 	"reset-auth":           (*Handler).serveResetAuth,
+	"services":             (*Handler).serveServices,
 	"set-expiry-sooner":    (*Handler).serveSetExpirySooner,
 	"shutdown":             (*Handler).serveShutdown,
 	"start":                (*Handler).serveStart,
 	"status":               (*Handler).serveStatus,
+	"user-profile":         (*Handler).serveUserProfile,
 	"whois":                (*Handler).serveWhoIs,
 }
 
@@ -262,6 +269,7 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 	}
+	defer h.b.CheckDeadlocks()()
 	if fn, route, ok := handlerForPath(r.URL.Path); ok {
 		h.logRequest(r.Method, route)
 		fn(h, w, r)
@@ -346,7 +354,7 @@ func (h *Handler) serveIDToken(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "id-token access denied", http.StatusForbidden)
 		return
 	}
-	nm := h.b.NetMap()
+	nm := h.b.NetMapNoPeers()
 	if nm == nil {
 		http.Error(w, "no netmap", http.StatusServiceUnavailable)
 		return
@@ -396,7 +404,7 @@ func (h *Handler) serveBugReport(w http.ResponseWriter, r *http.Request) {
 	defer h.b.TryFlushLogs() // kick off upload after bugreport's done logging
 
 	logMarker := func() string {
-		return fmt.Sprintf("BUG-%v-%v-%v", h.backendLogID, h.clock.Now().UTC().Format("20060102150405Z"), rands.HexString(16))
+		return fmt.Sprintf("BUG-%v-%v-%v", h.backendLogID, h.clock.Now().UTC().Format(tstime.NumericDateTimeZ), rands.HexString(16))
 	}
 	if envknob.NoLogsNoSupport() {
 		logMarker = func() string { return "BUG-NO-LOGS-NO-SUPPORT-this-node-has-had-its-logging-disabled" }
@@ -416,7 +424,7 @@ func (h *Handler) serveBugReport(w http.ResponseWriter, r *http.Request) {
 	}
 
 	// Information about the current node from the netmap
-	if nm := h.b.NetMap(); nm != nil {
+	if nm := h.b.NetMapNoPeers(); nm != nil {
 		if self := nm.SelfNode; self.Valid() {
 			h.logf("user bugreport node info: nodeid=%q stableid=%q expiry=%q", self.ID(), self.StableID(), self.KeyExpiry().Format(time.RFC3339))
 		}
@@ -434,7 +442,7 @@ func (h *Handler) serveBugReport(w http.ResponseWriter, r *http.Request) {
 	h.logf.JSON(1, "UserBugReportOS", osdiag.SupportInfo(osdiag.LogSupportInfoReasonBugReport))
 
 	// Tailnet Lock details
-	st := h.b.NetworkLockStatus()
+	st := h.b.TailnetLockStatus()
 	if st.Enabled {
 		h.logf.JSON(1, "UserBugReportTailnetLockStatus", st)
 		if st.NodeKeySignature != nil {
@@ -442,7 +450,7 @@ func (h *Handler) serveBugReport(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	if defBool(r.URL.Query().Get("diagnose"), false) {
+	if def.Bool(r.URL.Query().Get("diagnose"), false) {
 		if f, ok := ipnlocal.HookDoctor.GetOk(); ok {
 			f(r.Context(), h.b, logger.WithPrefix(h.logf, "diag: "))
 		}
@@ -452,7 +460,7 @@ func (h *Handler) serveBugReport(w http.ResponseWriter, r *http.Request) {
 
 	// Nothing else to do if we're not in record mode; we wrote the marker
 	// above, so we can just finish our response now.
-	if !defBool(r.URL.Query().Get("record"), false) {
+	if !def.Bool(r.URL.Query().Get("record"), false) {
 		return
 	}
 
@@ -541,6 +549,8 @@ type localBackendWhoIsMethods interface {
 	WhoIs(string, netip.AddrPort) (n tailcfg.NodeView, u tailcfg.UserProfile, ok bool)
 	WhoIsNodeKey(key.NodePublic) (n tailcfg.NodeView, u tailcfg.UserProfile, ok bool)
 	PeerCaps(netip.Addr) tailcfg.PeerCapMap
+	PeerCapsForIP(src, dst netip.Addr) tailcfg.PeerCapMap
+	PeerCapsForService(src netip.Addr, svcName tailcfg.ServiceName) tailcfg.PeerCapMap
 }
 
 func (h *Handler) serveWhoIsWithBackend(w http.ResponseWriter, r *http.Request, b localBackendWhoIsMethods) {
@@ -588,7 +598,25 @@ func (h *Handler) serveWhoIsWithBackend(w http.ResponseWriter, r *http.Request,
 		UserProfile: &u,           // always non-nil per WhoIsResponse contract
 	}
 	if n.Addresses().Len() > 0 {
-		res.CapMap = b.PeerCaps(n.Addresses().At(0).Addr())
+		src := n.Addresses().At(0).Addr()
+		switch {
+		case r.FormValue("svc_name") != "":
+			svcName := tailcfg.AsServiceName(r.FormValue("svc_name"))
+			if svcName == "" {
+				http.Error(w, "invalid svc_name", http.StatusBadRequest)
+				return
+			}
+			res.CapMap = b.PeerCapsForService(src, svcName)
+		case r.FormValue("dst_ip") != "":
+			svcAddr, err := netip.ParseAddr(r.FormValue("dst_ip"))
+			if err != nil {
+				http.Error(w, "invalid dst_ip", http.StatusBadRequest)
+				return
+			}
+			res.CapMap = b.PeerCapsForIP(src, svcAddr)
+		default:
+			res.CapMap = b.PeerCaps(src)
+		}
 	}
 	j, err := json.MarshalIndent(res, "", "\t")
 	if err != nil {
@@ -820,7 +848,7 @@ func (h *Handler) serveStatus(w http.ResponseWriter, r *http.Request) {
 	}
 	w.Header().Set("Content-Type", "application/json")
 	var st *ipnstate.Status
-	if defBool(r.FormValue("peers"), true) {
+	if def.Bool(r.FormValue("peers"), true) {
 		st = h.b.Status()
 	} else {
 		st = h.b.StatusWithoutPeers()
@@ -869,13 +897,25 @@ func (h *Handler) serveWatchIPNBus(w http.ResponseWriter, r *http.Request) {
 
 	var mask ipn.NotifyWatchOpt
 	if s := r.FormValue("mask"); s != "" {
-		v, err := strconv.ParseUint(s, 10, 64)
-		if err != nil {
+		if err := mask.UnmarshalText([]byte(s)); err != nil {
 			http.Error(w, "bad mask", http.StatusBadRequest)
 			return
 		}
-		mask = ipn.NotifyWatchOpt(v)
 	}
+	if mask&ipn.NotifyInProcessNoDisconnect != 0 {
+		http.Error(w, "NotifyInProcessNoDisconnect is only valid for in-process IPN bus subscribers", http.StatusBadRequest)
+		return
+	}
+	if err := ipn.ValidateNotifyWatchOpt(mask); err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
+	// NotifyInitialNetMap is permitted alongside NotifyPeerChanges /
+	// NotifyPeerPatches for backwards compatibility with clients that
+	// set both (e.g. the Apple client). On platforms where
+	// goosGetsLegacyNetmapNotify is true, the initial netmap is
+	// delivered regardless; peer-change subscribers simply receive
+	// deltas after that point.
 
 	w.Header().Set("Content-Type", "application/json")
 	ctx := r.Context()
@@ -1072,6 +1112,121 @@ func (h *Handler) serveDERPMap(w http.ResponseWriter, r *http.Request) {
 	e.Encode(h.b.DERPMap())
 }
 
+// serveCertDomains returns the list of DNS.CertDomains from the current
+// netmap, or an empty list if no netmap has been received yet.
+// The returned list is sorted in ascending order.
+func (h *Handler) serveCertDomains(w http.ResponseWriter, r *http.Request) {
+	if !h.PermitRead {
+		http.Error(w, "cert-domains access denied", http.StatusForbidden)
+		return
+	}
+	var domains []string
+	if nm := h.b.NetMapNoPeers(); nm != nil {
+		domains = slices.Clone(nm.DNS.CertDomains)
+		slices.Sort(domains)
+	}
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(domains)
+}
+
+// serveDNSConfig returns the [tailcfg.DNSConfig] from the current netmap.
+// It returns 503 if no netmap has been received yet.
+func (h *Handler) serveDNSConfig(w http.ResponseWriter, r *http.Request) {
+	if !h.PermitRead {
+		http.Error(w, "dns-config access denied", http.StatusForbidden)
+		return
+	}
+	nm := h.b.NetMapNoPeers()
+	if nm == nil {
+		http.Error(w, "no netmap", http.StatusServiceUnavailable)
+		return
+	}
+	w.Header().Set("Content-Type", "application/json")
+	e := json.NewEncoder(w)
+	e.SetIndent("", "\t")
+	e.Encode(nm.DNS)
+}
+
+// peerByIDBackend is the subset of [ipnlocal.LocalBackend] used by
+// [Handler.servePeerByID]. It exists so the handler can be tested with a
+// trivial mock without spinning up a full LocalBackend.
+type peerByIDBackend interface {
+	PeerByID(tailcfg.NodeID) (tailcfg.NodeView, bool)
+}
+
+// servePeerByID returns the current full [tailcfg.Node] for the peer with the
+// NodeID given in the "id" query parameter. It returns 404 if no such peer is
+// in the current netmap.
+//
+// It is intended for clients that observed a peer-mutation signal (e.g.
+// [ipn.Notify.PeerChangedPatch] or [ipn.Notify.PeersChanged]) and want the
+// latest state of the affected node without having to apply the patch
+// themselves.
+func (h *Handler) servePeerByID(w http.ResponseWriter, r *http.Request) {
+	h.servePeerByIDWithBackend(w, r, h.b)
+}
+
+func (h *Handler) servePeerByIDWithBackend(w http.ResponseWriter, r *http.Request, b peerByIDBackend) {
+	if !h.PermitRead {
+		http.Error(w, "peer-by-id access denied", http.StatusForbidden)
+		return
+	}
+	idStr := r.FormValue("id")
+	id, err := strconv.ParseInt(idStr, 10, 64)
+	if err != nil || id <= 0 {
+		http.Error(w, "invalid 'id' parameter", http.StatusBadRequest)
+		return
+	}
+	nv, ok := b.PeerByID(tailcfg.NodeID(id))
+	if !ok {
+		http.Error(w, "no peer with that NodeID", http.StatusNotFound)
+		return
+	}
+	w.Header().Set("Content-Type", "application/json")
+	e := json.NewEncoder(w)
+	e.SetIndent("", "\t")
+	e.Encode(nv.AsStruct())
+}
+
+// userProfileBackend is the subset of [ipnlocal.LocalBackend] used by
+// [Handler.serveUserProfile]. It exists so the handler can be tested
+// with a trivial mock without spinning up a full LocalBackend.
+type userProfileBackend interface {
+	UserProfile(tailcfg.UserID) (tailcfg.UserProfileView, bool)
+}
+
+// serveUserProfile returns the current [tailcfg.UserProfile] for the User
+// with the UserID given in the "id" query parameter, in O(1) time. It
+// returns 404 if no such user is in the current netmap.
+//
+// It is the LocalAPI fallback for IPN-bus consumers that see a UserID
+// referenced by a peer Node and want to resolve it to a UserProfile.
+func (h *Handler) serveUserProfile(w http.ResponseWriter, r *http.Request) {
+	h.serveUserProfileWithBackend(w, r, h.b)
+}
+
+func (h *Handler) serveUserProfileWithBackend(w http.ResponseWriter, r *http.Request, b userProfileBackend) {
+	if !h.PermitRead {
+		http.Error(w, "user-profile access denied", http.StatusForbidden)
+		return
+	}
+	idStr := r.FormValue("id")
+	id, err := strconv.ParseInt(idStr, 10, 64)
+	if err != nil || id <= 0 {
+		http.Error(w, "invalid 'id' parameter", http.StatusBadRequest)
+		return
+	}
+	uv, ok := b.UserProfile(tailcfg.UserID(id))
+	if !ok {
+		http.Error(w, "no user with that UserID", http.StatusNotFound)
+		return
+	}
+	w.Header().Set("Content-Type", "application/json")
+	e := json.NewEncoder(w)
+	e.SetIndent("", "\t")
+	e.Encode(uv.AsStruct())
+}
+
 // serveSetExpirySooner sets the expiry date on the current machine, specified
 // by an `expiry` unix timestamp as POST or query param.
 func (h *Handler) serveSetExpirySooner(w http.ResponseWriter, r *http.Request) {
@@ -1168,15 +1323,33 @@ func (h *Handler) serveDial(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "missing Dial-Host or Dial-Port header", http.StatusBadRequest)
 		return
 	}
+	network := cmp.Or(r.Header.Get("Dial-Network"), "tcp")
+
+	addr := net.JoinHostPort(hostStr, portStr)
+
+	// Check whether the resolved address is a Tailscale route.
+	// If not, tell the client to dial it directly so the connection
+	// comes from the calling user's UID rather than our root-owned daemon.
+	ipp, viaTailscale, err := h.b.Dialer().UserDialPlan(r.Context(), network, addr)
+	if err != nil {
+		http.Error(w, "resolve failure: "+err.Error(), http.StatusBadGateway)
+		return
+	}
+	if !viaTailscale {
+		w.Header().Set("Dial-Self", "true")
+		w.Header().Set("Dial-Addr", ipp.String())
+		w.WriteHeader(http.StatusOK)
+		return
+	}
+
 	hijacker, ok := w.(http.Hijacker)
 	if !ok {
 		http.Error(w, "make request over HTTP/1", http.StatusBadRequest)
 		return
 	}
 
-	network := cmp.Or(r.Header.Get("Dial-Network"), "tcp")
-
-	addr := net.JoinHostPort(hostStr, portStr)
+	// Dial via Tailscale with the original hostname so UserDial can
+	// resolve all addresses and race across families (happy eyeballs).
 	outConn, err := h.b.Dialer().UserDial(r.Context(), network, addr)
 	if err != nil {
 		http.Error(w, "dial failure: "+err.Error(), http.StatusBadGateway)
@@ -1457,7 +1630,7 @@ func (h *Handler) serveQueryFeature(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "missing feature", http.StatusInternalServerError)
 		return
 	}
-	nm := h.b.NetMap()
+	nm := h.b.NetMapNoPeers()
 	if nm == nil {
 		http.Error(w, "no netmap", http.StatusServiceUnavailable)
 		return
@@ -1493,17 +1666,6 @@ func (h *Handler) serveQueryFeature(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
-func defBool(a string, def bool) bool {
-	if a == "" {
-		return def
-	}
-	v, err := strconv.ParseBool(a)
-	if err != nil {
-		return def
-	}
-	return v
-}
-
 // serveUpdateCheck returns the ClientVersion from Status, which contains
 // information on whether an update is available, and if so, what version,
 // *if* we support auto-updates on this platform. If we don't, this endpoint
@@ -1653,16 +1815,68 @@ func dnsMessageTypeForString(s string) (t dnsmessage.Type, err error) {
 	return 0, errors.New("unknown DNS message type: " + s)
 }
 
+// HookRouteCheckRefresh is the hook to request a refresh of the routecheck Report
+// for this LocalBackend.
+// It is used by serveSuggestExitNode to probe for reachable exit nodes
+// before it makes a suggestion.
+var HookRouteCheckRefresh feature.Hook[func(*ipnlocal.LocalBackend, context.Context, time.Duration) error]
+
 // serveSuggestExitNode serves a POST endpoint for returning a suggested exit node.
+// If the probe query parameter is true,
+// then a new routecheck report will be probed
+// so that the suggested exit node isn’t based on stale reachability data.
+// Combined with probe=true:
+// if the timeout query parameter is 0, any probes will immediately timeout;
+// if the timeout is positive, probes will take that duration before timing out;
+// if the timeout is negative, probes will use the default routecheck timeout.
 func (h *Handler) serveSuggestExitNode(w http.ResponseWriter, r *http.Request) {
 	if !buildfeatures.HasUseExitNode {
 		http.Error(w, feature.ErrUnavailable.Error(), http.StatusNotImplemented)
 		return
 	}
-	if r.Method != httpm.GET {
-		http.Error(w, "only GET allowed", http.StatusMethodNotAllowed)
+
+	switch r.Method {
+	case httpm.GET:
+		// The GET method is inappropriate because it isn’t cacheable.
+		// However, we retain it for backwards compatibility.
+		//
+		// The original implementation used to only allow GET requests,
+		// but since this endpoint powers the `tailscale exit-node suggest` command
+		// whose results can change based on the shape of the network,
+		// it was never a proper GET method in the first place.
+		//
+		// Now that the suggestions are backed by routecheck
+		// and we provide the user the ability to trigger a probe,
+		// this is obviously a POST method because it has side-effects.
+		// However, we don’t want to break existing clients,
+		// so we silently support the old GET method
+		// without the extra query parameters.
+		//
+		// This is also why the default case returns a "want POST" error
+		// and not an "only POST allowed" like the other endpoints.
+		// We still accept GET requests but we don’t want them.
+	case httpm.POST:
+		if !def.Bool(r.FormValue("probe"), false) {
+			break
+		}
+		timeout := def.Duration(r.FormValue("timeout"), -1)
+
+		// Force routecheck to probe for a new report
+		// and use it to suggest an exit node.
+		routecheckRefresh := HookRouteCheckRefresh.GetOrNil()
+		if routecheckRefresh == nil {
+			break
+		}
+		if err := routecheckRefresh(h.b, r.Context(), timeout); err != nil {
+			WriteErrorJSON(w, err)
+			return
+		}
+	default:
+		// Discourage the GET method:
+		http.Error(w, "want POST", http.StatusMethodNotAllowed)
 		return
 	}
+
 	res, err := h.b.SuggestExitNode()
 	if err != nil {
 		WriteErrorJSON(w, err)
@@ -1707,6 +1921,20 @@ func (h *Handler) serveShutdown(w http.ResponseWriter, r *http.Request) {
 	eventbus.Publish[Shutdown](ec).Publish(Shutdown{})
 }
 
+func (h *Handler) serveServices(w http.ResponseWriter, r *http.Request) {
+	if r.Method != httpm.GET {
+		http.Error(w, "only GET allowed", http.StatusMethodNotAllowed)
+		return
+	}
+	nm := h.b.NetMapNoPeers()
+	if nm == nil {
+		http.Error(w, "no netmap", http.StatusServiceUnavailable)
+		return
+	}
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(nm.Services())
+}
+
 func (h *Handler) serveGetAppcRouteInfo(w http.ResponseWriter, r *http.Request) {
 	if !buildfeatures.HasAppConnectors {
 		http.Error(w, feature.ErrUnavailable.Error(), http.StatusNotImplemented)
diff --git a/ipn/localapi/localapi_test.go b/ipn/localapi/localapi_test.go
index 47e334571..cc5a6b6a7 100644
--- a/ipn/localapi/localapi_test.go
+++ b/ipn/localapi/localapi_test.go
@@ -116,9 +116,11 @@ func TestSetPushDeviceToken(t *testing.T) {
 }
 
 type whoIsBackend struct {
-	whoIs        func(proto string, ipp netip.AddrPort) (n tailcfg.NodeView, u tailcfg.UserProfile, ok bool)
-	whoIsNodeKey func(key.NodePublic) (n tailcfg.NodeView, u tailcfg.UserProfile, ok bool)
-	peerCaps     map[netip.Addr]tailcfg.PeerCapMap
+	whoIs              func(proto string, ipp netip.AddrPort) (n tailcfg.NodeView, u tailcfg.UserProfile, ok bool)
+	whoIsNodeKey       func(key.NodePublic) (n tailcfg.NodeView, u tailcfg.UserProfile, ok bool)
+	peerCaps           map[netip.Addr]tailcfg.PeerCapMap
+	peerCapsForIP      func(src, dst netip.Addr) tailcfg.PeerCapMap
+	peerCapsForSvcName func(src netip.Addr, svcName tailcfg.ServiceName) tailcfg.PeerCapMap
 }
 
 func (b whoIsBackend) WhoIs(proto string, ipp netip.AddrPort) (n tailcfg.NodeView, u tailcfg.UserProfile, ok bool) {
@@ -133,6 +135,20 @@ func (b whoIsBackend) PeerCaps(ip netip.Addr) tailcfg.PeerCapMap {
 	return b.peerCaps[ip]
 }
 
+func (b whoIsBackend) PeerCapsForIP(src, dst netip.Addr) tailcfg.PeerCapMap {
+	if b.peerCapsForIP != nil {
+		return b.peerCapsForIP(src, dst)
+	}
+	return nil
+}
+
+func (b whoIsBackend) PeerCapsForService(src netip.Addr, svcName tailcfg.ServiceName) tailcfg.PeerCapMap {
+	if b.peerCapsForSvcName != nil {
+		return b.peerCapsForSvcName(src, svcName)
+	}
+	return nil
+}
+
 // Tests that the WhoIs handler accepts IPs, IP:ports, or nodekeys.
 //
 // From https://github.com/tailscale/tailscale/pull/9714 (a PR that is effectively a bug report)
@@ -202,6 +218,309 @@ func TestWhoIsArgTypes(t *testing.T) {
 	}
 }
 
+func TestWhoIsServiceParams(t *testing.T) {
+	h := handlerForTest(t, &Handler{
+		PermitRead: true,
+	})
+
+	peerAddr := netip.MustParseAddr("100.101.102.103")
+	vipA := netip.MustParseAddr("100.100.0.1")
+	vipB := netip.MustParseAddr("100.100.0.2")
+
+	nodeCapsForAddr := tailcfg.PeerCapMap{"host-cap": {`"host-val"`}}
+	vipACaps := tailcfg.PeerCapMap{"svc-a-cap": {`"a-val"`}}
+	vipBCaps := tailcfg.PeerCapMap{"svc-b-cap": {`"b-val"`}}
+
+	match := func() (tailcfg.NodeView, tailcfg.UserProfile, bool) {
+		return (&tailcfg.Node{
+			ID:        123,
+			Addresses: []netip.Prefix{netip.PrefixFrom(peerAddr, 32)},
+		}).View(), tailcfg.UserProfile{ID: 456}, true
+	}
+
+	backend := whoIsBackend{
+		whoIs: func(proto string, ipp netip.AddrPort) (tailcfg.NodeView, tailcfg.UserProfile, bool) {
+			return match()
+		},
+		peerCaps: map[netip.Addr]tailcfg.PeerCapMap{
+			peerAddr: nodeCapsForAddr,
+		},
+		peerCapsForIP: func(src, dst netip.Addr) tailcfg.PeerCapMap {
+			switch dst {
+			case vipA:
+				return vipACaps
+			case vipB:
+				return vipBCaps
+			}
+			return nil
+		},
+		peerCapsForSvcName: func(src netip.Addr, svcName tailcfg.ServiceName) tailcfg.PeerCapMap {
+			switch svcName {
+			case "svc:db":
+				return vipACaps
+			case "svc:cache":
+				return vipBCaps
+			}
+			return nil
+		},
+	}
+
+	doWhoIs := func(t *testing.T, query string) apitype.WhoIsResponse {
+		t.Helper()
+		rec := httptest.NewRecorder()
+		h.serveWhoIsWithBackend(rec, httptest.NewRequest("GET", "/v0/whois?"+query, nil), backend)
+		if rec.Code != 200 {
+			t.Fatalf("response code %d; body: %s", rec.Code, rec.Body.String())
+		}
+		var res apitype.WhoIsResponse
+		if err := json.Unmarshal(rec.Body.Bytes(), &res); err != nil {
+			t.Fatalf("parsing response: %v", err)
+		}
+		return res
+	}
+
+	doWhoIsStatus := func(t *testing.T, query string) int {
+		t.Helper()
+		rec := httptest.NewRecorder()
+		h.serveWhoIsWithBackend(rec, httptest.NewRequest("GET", "/v0/whois?"+query, nil), backend)
+		return rec.Code
+	}
+
+	// No service params — uses PeerCaps (host-level).
+	t.Run("no_service_params_uses_PeerCaps", func(t *testing.T) {
+		res := doWhoIs(t, "addr="+peerAddr.String())
+		if _, ok := res.CapMap["host-cap"]; !ok {
+			t.Errorf("expected host-cap from PeerCaps; got %v", res.CapMap)
+		}
+		if _, ok := res.CapMap["svc-a-cap"]; ok {
+			t.Error("VIP cap should not appear without service param")
+		}
+	})
+
+	// dst_ip tests — PeerCapsForIP path.
+	t.Run("dst_ip_uses_PeerCapsForIP", func(t *testing.T) {
+		res := doWhoIs(t, "addr="+peerAddr.String()+"&dst_ip="+vipA.String())
+		if _, ok := res.CapMap["svc-a-cap"]; !ok {
+			t.Errorf("expected svc-a-cap; got %v", res.CapMap)
+		}
+		if _, ok := res.CapMap["host-cap"]; ok {
+			t.Error("host-cap should not appear when dst_ip is specified")
+		}
+	})
+
+	t.Run("dst_ip_scopes_to_specific_service", func(t *testing.T) {
+		resA := doWhoIs(t, "addr="+peerAddr.String()+"&dst_ip="+vipA.String())
+		resB := doWhoIs(t, "addr="+peerAddr.String()+"&dst_ip="+vipB.String())
+
+		if _, ok := resA.CapMap["svc-a-cap"]; !ok {
+			t.Errorf("dst_ip=vipA: expected svc-a-cap; got %v", resA.CapMap)
+		}
+		if _, ok := resA.CapMap["svc-b-cap"]; ok {
+			t.Error("dst_ip=vipA: svc-b-cap should not appear")
+		}
+
+		if _, ok := resB.CapMap["svc-b-cap"]; !ok {
+			t.Errorf("dst_ip=vipB: expected svc-b-cap; got %v", resB.CapMap)
+		}
+		if _, ok := resB.CapMap["svc-a-cap"]; ok {
+			t.Error("dst_ip=vipB: svc-a-cap should not appear")
+		}
+	})
+
+	t.Run("dst_ip_unrelated_ip_returns_empty", func(t *testing.T) {
+		res := doWhoIs(t, "addr="+peerAddr.String()+"&dst_ip=10.0.0.99")
+		if len(res.CapMap) != 0 {
+			t.Errorf("expected empty CapMap for unrelated dst_ip; got %v", res.CapMap)
+		}
+	})
+
+	t.Run("dst_ip_invalid_returns_400", func(t *testing.T) {
+		if code := doWhoIsStatus(t, "addr="+peerAddr.String()+"&dst_ip=not-an-ip"); code != 400 {
+			t.Errorf("expected 400 for invalid dst_ip; got %d", code)
+		}
+	})
+
+	// svc_name tests — PeerCapsForService path.
+	t.Run("svc_name_uses_PeerCapsForService", func(t *testing.T) {
+		res := doWhoIs(t, "addr="+peerAddr.String()+"&svc_name=svc:db")
+		if _, ok := res.CapMap["svc-a-cap"]; !ok {
+			t.Errorf("expected svc-a-cap; got %v", res.CapMap)
+		}
+		if _, ok := res.CapMap["host-cap"]; ok {
+			t.Error("host-cap should not appear when svc_name is specified")
+		}
+	})
+
+	t.Run("svc_name_scopes_to_specific_service", func(t *testing.T) {
+		resA := doWhoIs(t, "addr="+peerAddr.String()+"&svc_name=svc:db")
+		resB := doWhoIs(t, "addr="+peerAddr.String()+"&svc_name=svc:cache")
+
+		if _, ok := resA.CapMap["svc-a-cap"]; !ok {
+			t.Errorf("svc_name=svc:db: expected svc-a-cap; got %v", resA.CapMap)
+		}
+		if _, ok := resA.CapMap["svc-b-cap"]; ok {
+			t.Error("svc_name=svc:db: svc-b-cap should not appear")
+		}
+
+		if _, ok := resB.CapMap["svc-b-cap"]; !ok {
+			t.Errorf("svc_name=svc:cache: expected svc-b-cap; got %v", resB.CapMap)
+		}
+		if _, ok := resB.CapMap["svc-a-cap"]; ok {
+			t.Error("svc_name=svc:cache: svc-a-cap should not appear")
+		}
+	})
+
+	t.Run("svc_name_unknown_service_returns_empty", func(t *testing.T) {
+		res := doWhoIs(t, "addr="+peerAddr.String()+"&svc_name=svc:unknown")
+		if len(res.CapMap) != 0 {
+			t.Errorf("expected empty CapMap for unknown service; got %v", res.CapMap)
+		}
+	})
+
+	t.Run("svc_name_invalid_returns_400", func(t *testing.T) {
+		if code := doWhoIsStatus(t, "addr="+peerAddr.String()+"&svc_name=not-a-service-name"); code != 400 {
+			t.Errorf("expected 400 for invalid svc_name; got %d", code)
+		}
+	})
+
+	// svc_name takes priority over dst_ip when both are specified.
+	t.Run("svc_name_takes_priority_over_dst_ip", func(t *testing.T) {
+		res := doWhoIs(t, "addr="+peerAddr.String()+"&svc_name=svc:cache&dst_ip="+vipA.String())
+		if _, ok := res.CapMap["svc-b-cap"]; !ok {
+			t.Errorf("svc_name should take priority; expected svc-b-cap (cache); got %v", res.CapMap)
+		}
+		if _, ok := res.CapMap["svc-a-cap"]; ok {
+			t.Error("dst_ip result should not appear when svc_name is also specified")
+		}
+	})
+}
+
+type fakePeerByIDBackend map[tailcfg.NodeID]*tailcfg.Node
+
+func (f fakePeerByIDBackend) PeerByID(id tailcfg.NodeID) (tailcfg.NodeView, bool) {
+	n, ok := f[id]
+	if !ok {
+		return tailcfg.NodeView{}, false
+	}
+	return n.View(), true
+}
+
+func TestServePeerByID(t *testing.T) {
+	h := handlerForTest(t, &Handler{PermitRead: true})
+	b := fakePeerByIDBackend{
+		42: {
+			ID:   42,
+			Name: "alpha",
+			Addresses: []netip.Prefix{
+				netip.MustParsePrefix("100.64.0.42/32"),
+			},
+		},
+	}
+
+	tests := []struct {
+		name       string
+		query      string
+		wantCode   int
+		wantNodeID tailcfg.NodeID
+	}{
+		{"hit", "id=42", 200, 42},
+		{"miss", "id=99", 404, 0},
+		{"bad_id", "id=garbage", 400, 0},
+		{"missing_id", "", 400, 0},
+		{"zero_id", "id=0", 400, 0},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			rec := httptest.NewRecorder()
+			req := httptest.NewRequest("GET", "/v0/peer-by-id?"+tt.query, nil)
+			h.servePeerByIDWithBackend(rec, req, b)
+			if rec.Code != tt.wantCode {
+				t.Fatalf("status = %d, want %d; body=%q", rec.Code, tt.wantCode, rec.Body.String())
+			}
+			if tt.wantCode != 200 {
+				return
+			}
+			var got tailcfg.Node
+			if err := json.Unmarshal(rec.Body.Bytes(), &got); err != nil {
+				t.Fatalf("unmarshal body %q: %v", rec.Body.Bytes(), err)
+			}
+			if got.ID != tt.wantNodeID {
+				t.Errorf("Node.ID = %d, want %d", got.ID, tt.wantNodeID)
+			}
+		})
+	}
+
+	t.Run("forbidden", func(t *testing.T) {
+		hh := handlerForTest(t, &Handler{PermitRead: false})
+		rec := httptest.NewRecorder()
+		req := httptest.NewRequest("GET", "/v0/peer-by-id?id=42", nil)
+		hh.servePeerByIDWithBackend(rec, req, b)
+		if rec.Code != http.StatusForbidden {
+			t.Fatalf("status = %d, want %d", rec.Code, http.StatusForbidden)
+		}
+	})
+}
+
+type fakeUserProfileBackend map[tailcfg.UserID]*tailcfg.UserProfile
+
+func (f fakeUserProfileBackend) UserProfile(id tailcfg.UserID) (tailcfg.UserProfileView, bool) {
+	u, ok := f[id]
+	if !ok {
+		return tailcfg.UserProfileView{}, false
+	}
+	return u.View(), true
+}
+
+func TestServeUserProfile(t *testing.T) {
+	h := handlerForTest(t, &Handler{PermitRead: true})
+	b := fakeUserProfileBackend{
+		7: {ID: 7, LoginName: "alice@example.com", DisplayName: "Alice"},
+	}
+
+	tests := []struct {
+		name      string
+		query     string
+		wantCode  int
+		wantLogin string
+	}{
+		{"hit", "id=7", 200, "alice@example.com"},
+		{"miss", "id=99", 404, ""},
+		{"bad_id", "id=garbage", 400, ""},
+		{"missing_id", "", 400, ""},
+		{"zero_id", "id=0", 400, ""},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			rec := httptest.NewRecorder()
+			req := httptest.NewRequest("GET", "/v0/user-profile?"+tt.query, nil)
+			h.serveUserProfileWithBackend(rec, req, b)
+			if rec.Code != tt.wantCode {
+				t.Fatalf("status = %d, want %d; body=%q", rec.Code, tt.wantCode, rec.Body.String())
+			}
+			if tt.wantCode != 200 {
+				return
+			}
+			var got tailcfg.UserProfile
+			if err := json.Unmarshal(rec.Body.Bytes(), &got); err != nil {
+				t.Fatalf("unmarshal body %q: %v", rec.Body.Bytes(), err)
+			}
+			if got.LoginName != tt.wantLogin {
+				t.Errorf("LoginName = %q, want %q", got.LoginName, tt.wantLogin)
+			}
+		})
+	}
+
+	t.Run("forbidden", func(t *testing.T) {
+		hh := handlerForTest(t, &Handler{PermitRead: false})
+		rec := httptest.NewRecorder()
+		req := httptest.NewRequest("GET", "/v0/user-profile?id=7", nil)
+		hh.serveUserProfileWithBackend(rec, req, b)
+		if rec.Code != http.StatusForbidden {
+			t.Fatalf("status = %d, want %d", rec.Code, http.StatusForbidden)
+		}
+	})
+}
+
 func TestShouldDenyServeConfigForGOOSAndUserContext(t *testing.T) {
 	newHandler := func(connIsLocalAdmin bool) *Handler {
 		return handlerForTest(t, &Handler{
@@ -216,7 +535,7 @@ func TestShouldDenyServeConfigForGOOSAndUserContext(t *testing.T) {
 		wantErr  bool
 	}{
 		{
-			name: "not-path-handler",
+			name: "not-path-or-unix-handler",
 			configIn: &ipn.ServeConfig{
 				Web: map[ipn.HostPort]*ipn.WebServerConfig{
 					"foo.test.ts.net:443": {Handlers: map[string]*ipn.HTTPHandler{
@@ -251,6 +570,30 @@ func TestShouldDenyServeConfigForGOOSAndUserContext(t *testing.T) {
 			h:       newHandler(false),
 			wantErr: true,
 		},
+		{
+			name: "unix-handler-admin",
+			configIn: &ipn.ServeConfig{
+				Web: map[ipn.HostPort]*ipn.WebServerConfig{
+					"foo.test.ts.net:443": {Handlers: map[string]*ipn.HTTPHandler{
+						"/": {Proxy: "unix:/var/run/foo.sock"},
+					}},
+				},
+			},
+			h:       newHandler(true),
+			wantErr: false,
+		},
+		{
+			name: "unix-handler-not-admin",
+			configIn: &ipn.ServeConfig{
+				Web: map[ipn.HostPort]*ipn.WebServerConfig{
+					"foo.test.ts.net:443": {Handlers: map[string]*ipn.HTTPHandler{
+						"/": {Proxy: "unix:/var/run/foo.sock"},
+					}},
+				},
+			},
+			h:       newHandler(false),
+			wantErr: true,
+		},
 	}
 
 	for _, tt := range tests {
@@ -291,6 +634,7 @@ func TestServeWatchIPNBus(t *testing.T) {
 	tests := []struct {
 		desc                    string
 		permitRead, permitWrite bool
+		mask                    ipn.NotifyWatchOpt
 		wantStatus              int
 	}{
 		{
@@ -311,6 +655,18 @@ func TestServeWatchIPNBus(t *testing.T) {
 			permitWrite: true,
 			wantStatus:  http.StatusOK,
 		},
+		{
+			desc:       "invalid-rate-limit-mask",
+			permitRead: true,
+			mask:       ipn.NotifyRateLimit | ipn.NotifyPeerChanges,
+			wantStatus: http.StatusBadRequest,
+		},
+		{
+			desc:       "in-process-no-disconnect-forbidden",
+			permitRead: true,
+			mask:       ipn.NotifyInProcessNoDisconnect,
+			wantStatus: http.StatusBadRequest,
+		},
 	}
 
 	for _, tt := range tests {
@@ -325,7 +681,11 @@ func TestServeWatchIPNBus(t *testing.T) {
 			c := s.Client()
 
 			ctx, cancel := context.WithCancel(context.Background())
-			req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("%s/localapi/v0/watch-ipn-bus?mask=%d", s.URL, ipn.NotifyInitialState), nil)
+			mask := tt.mask
+			if mask == 0 {
+				mask = ipn.NotifyInitialState
+			}
+			req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("%s/localapi/v0/watch-ipn-bus?mask=%d", s.URL, mask), nil)
 			if err != nil {
 				t.Fatal(err)
 			}
@@ -500,3 +860,69 @@ func TestServeWithUnhealthyState(t *testing.T) {
 		})
 	}
 }
+
+func TestServeDialSelf(t *testing.T) {
+	h := handlerForTest(t, &Handler{
+		PermitRead:  true,
+		PermitWrite: true,
+		b:           newTestLocalBackend(t),
+	})
+
+	tests := []struct {
+		name       string
+		host       string
+		port       string
+		wantSelf   bool
+		wantAddr   string
+		wantStatus int
+	}{
+		{
+			name:       "loopback_v4",
+			host:       "127.0.0.1",
+			port:       "8080",
+			wantSelf:   true,
+			wantAddr:   "127.0.0.1:8080",
+			wantStatus: http.StatusOK,
+		},
+		{
+			name:       "loopback_v6",
+			host:       "::1",
+			port:       "8080",
+			wantSelf:   true,
+			wantAddr:   "[::1]:8080",
+			wantStatus: http.StatusOK,
+		},
+		{
+			name:       "localhost",
+			host:       "localhost",
+			port:       "3000",
+			wantSelf:   true,
+			wantStatus: http.StatusOK,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req := httptest.NewRequest("POST", "http://local-tailscaled.sock/localapi/v0/dial", nil)
+			req.Header.Set("Connection", "upgrade")
+			req.Header.Set("Upgrade", "ts-dial")
+			req.Header.Set("Dial-Host", tt.host)
+			req.Header.Set("Dial-Port", tt.port)
+			resp := httptest.NewRecorder()
+			h.serveDial(resp, req)
+
+			if resp.Code != tt.wantStatus {
+				t.Fatalf("status = %d, want %d; body: %s", resp.Code, tt.wantStatus, resp.Body.String())
+			}
+			gotSelf := resp.Header().Get("Dial-Self") == "true"
+			if gotSelf != tt.wantSelf {
+				t.Errorf("Dial-Self = %v, want %v", gotSelf, tt.wantSelf)
+			}
+			if tt.wantAddr != "" {
+				if got := resp.Header().Get("Dial-Addr"); got != tt.wantAddr {
+					t.Errorf("Dial-Addr = %q, want %q", got, tt.wantAddr)
+				}
+			}
+		})
+	}
+}
diff --git a/ipn/localapi/serve.go b/ipn/localapi/serve.go
index 1f677f7ab..5b5c9e964 100644
--- a/ipn/localapi/serve.go
+++ b/ipn/localapi/serve.go
@@ -53,7 +53,8 @@ func (h *Handler) serveServeConfig(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 
-		// require a local admin when setting a path handler
+		// require a local admin when setting a path handler or serving a Unix
+		// domain socket
 		// TODO: roll-up this Windows-specific check into either PermitWrite
 		// or a global admin escalation check.
 		if err := authorizeServeConfigForGOOSAndUserContext(runtime.GOOS, configIn, h); err != nil {
@@ -89,7 +90,7 @@ func authorizeServeConfigForGOOSAndUserContext(goos string, configIn *ipn.ServeC
 	if goos == "darwin" && version.IsSandboxedMacOS() {
 		return nil
 	}
-	if !configIn.HasPathHandler() {
+	if !configIn.HasPathHandler() && !configIn.IsServingUnixAny() {
 		return nil
 	}
 	if h.Actor.IsLocalAdmin(h.b.OperatorUserID()) {
@@ -97,9 +98,9 @@ func authorizeServeConfigForGOOSAndUserContext(goos string, configIn *ipn.ServeC
 	}
 	switch goos {
 	case "windows":
-		return errors.New("must be a Windows local admin to serve a path")
+		return errors.New("must be a Windows local admin to serve a path or Unix socket")
 	case "linux", "darwin", "illumos", "solaris":
-		return errors.New("must be root, or be an operator and able to run 'sudo tailscale' to serve a path")
+		return errors.New("must be root, or be an operator and able to run 'sudo tailscale' to serve a path or Unix socket")
 	default:
 		// We filter goos at the start of the func, this default case
 		// should never happen.
diff --git a/ipn/localapi/tailnetlock.go b/ipn/localapi/tailnetlock.go
index e2a2850cf..458a47d42 100644
--- a/ipn/localapi/tailnetlock.go
+++ b/ipn/localapi/tailnetlock.go
@@ -43,7 +43,7 @@ func (h *Handler) serveTKAStatus(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	j, err := json.MarshalIndent(h.b.NetworkLockStatus(), "", "\t")
+	j, err := json.MarshalIndent(h.b.TailnetLockStatus(), "", "\t")
 	if err != nil {
 		http.Error(w, "JSON encoding error", http.StatusInternalServerError)
 		return
@@ -72,7 +72,7 @@ func (h *Handler) serveTKASign(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if err := h.b.NetworkLockSign(req.NodeKey, req.RotationPublic); err != nil {
+	if err := h.b.TailnetLockSign(req.NodeKey, req.RotationPublic); err != nil {
 		http.Error(w, "signing failed: "+err.Error(), http.StatusInternalServerError)
 		return
 	}
@@ -101,17 +101,17 @@ func (h *Handler) serveTKAInit(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if !h.b.NetworkLockAllowed() {
+	if !h.b.TailnetLockAllowed() {
 		http.Error(w, "Tailnet Lock is not supported on your pricing plan", http.StatusForbidden)
 		return
 	}
 
-	if err := h.b.NetworkLockInit(req.Keys, req.DisablementValues, req.SupportDisablement); err != nil {
+	if err := h.b.TailnetLockInit(req.Keys, req.DisablementValues, req.SupportDisablement); err != nil {
 		http.Error(w, "initialization failed: "+err.Error(), http.StatusInternalServerError)
 		return
 	}
 
-	j, err := json.MarshalIndent(h.b.NetworkLockStatus(), "", "\t")
+	j, err := json.MarshalIndent(h.b.TailnetLockStatus(), "", "\t")
 	if err != nil {
 		http.Error(w, "JSON encoding error", http.StatusInternalServerError)
 		return
@@ -140,7 +140,7 @@ func (h *Handler) serveTKAModify(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if err := h.b.NetworkLockModify(req.AddKeys, req.RemoveKeys); err != nil {
+	if err := h.b.TailnetLockModify(req.AddKeys, req.RemoveKeys); err != nil {
 		http.Error(w, "tailnet-lock modify failed: "+err.Error(), http.StatusInternalServerError)
 		return
 	}
@@ -172,7 +172,7 @@ func (h *Handler) serveTKAWrapPreauthKey(w http.ResponseWriter, r *http.Request)
 		return
 	}
 
-	wrappedKey, err := h.b.NetworkLockWrapPreauthKey(req.TSKey, priv)
+	wrappedKey, err := h.b.TailnetLockWrapPreauthKey(req.TSKey, priv)
 	if err != nil {
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 		return
@@ -200,7 +200,7 @@ func (h *Handler) serveTKAVerifySigningDeeplink(w http.ResponseWriter, r *http.R
 		return
 	}
 
-	res := h.b.NetworkLockVerifySigningDeeplink(req.URL)
+	res := h.b.TailnetLockVerifySigningDeeplink(req.URL)
 	j, err := json.MarshalIndent(res, "", "\t")
 	if err != nil {
 		http.Error(w, "JSON encoding error", http.StatusInternalServerError)
@@ -227,7 +227,7 @@ func (h *Handler) serveTKADisable(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if err := h.b.NetworkLockDisable(secret); err != nil {
+	if err := h.b.TailnetLockDisable(secret); err != nil {
 		http.Error(w, "tailnet-lock disable failed: "+err.Error(), http.StatusBadRequest)
 		return
 	}
@@ -251,7 +251,7 @@ func (h *Handler) serveTKALocalDisable(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if err := h.b.NetworkLockForceLocalDisable(); err != nil {
+	if err := h.b.TailnetLockForceLocalDisable(); err != nil {
 		http.Error(w, "tailnet-lock local disable failed: "+err.Error(), http.StatusBadRequest)
 		return
 	}
@@ -274,7 +274,7 @@ func (h *Handler) serveTKALog(w http.ResponseWriter, r *http.Request) {
 		limit = int(lm)
 	}
 
-	updates, err := h.b.NetworkLockLog(limit)
+	updates, err := h.b.TailnetLockLog(limit)
 	if err != nil {
 		http.Error(w, "reading log failed: "+err.Error(), http.StatusInternalServerError)
 		return
@@ -300,7 +300,7 @@ func (h *Handler) serveTKAAffectedSigs(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	sigs, err := h.b.NetworkLockAffectedSigs(keyID)
+	sigs, err := h.b.TailnetLockAffectedSigs(keyID)
 	if err != nil {
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 		return
@@ -343,7 +343,7 @@ func (h *Handler) serveTKAGenerateRecoveryAUM(w http.ResponseWriter, r *http.Req
 		}
 	}
 
-	res, err := h.b.NetworkLockGenerateRecoveryAUM(req.Keys, forkFrom)
+	res, err := h.b.TailnetLockGenerateRecoveryAUM(req.Keys, forkFrom)
 	if err != nil {
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 		return
@@ -374,7 +374,7 @@ func (h *Handler) serveTKACosignRecoveryAUM(w http.ResponseWriter, r *http.Reque
 		return
 	}
 
-	res, err := h.b.NetworkLockCosignRecoveryAUM(&aum)
+	res, err := h.b.TailnetLockCosignRecoveryAUM(&aum)
 	if err != nil {
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 		return
@@ -405,7 +405,7 @@ func (h *Handler) serveTKASubmitRecoveryAUM(w http.ResponseWriter, r *http.Reque
 		return
 	}
 
-	if err := h.b.NetworkLockSubmitRecoveryAUM(&aum); err != nil {
+	if err := h.b.TailnetLockSubmitRecoveryAUM(&aum); err != nil {
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 		return
 	}
diff --git a/ipn/prefs.go b/ipn/prefs.go
index 9125df2c1..59b2b37b2 100644
--- a/ipn/prefs.go
+++ b/ipn/prefs.go
@@ -17,6 +17,7 @@ import (
 	"runtime"
 	"slices"
 	"strings"
+	"time"
 
 	"tailscale.com/atomicfile"
 	"tailscale.com/drive"
@@ -129,7 +130,8 @@ type Prefs struct {
 	ExitNodeAllowLANAccess bool
 
 	// CorpDNS specifies whether to install the Tailscale network's
-	// DNS configuration, if it exists.
+	// DNS configuration, if it exists. It is the internal name for
+	// the "tailscale set --accept-dns=" flag.
 	CorpDNS bool
 
 	// RunSSH bool is whether this node should run an SSH
@@ -276,6 +278,24 @@ type Prefs struct {
 	// Linux-only.
 	NetfilterKind string
 
+	// RemoteConfig, if true, delegates full remote control of this node's
+	// prefs and LocalAPI to the tailnet admin via the control plane. When
+	// enabled, the control server can read and edit any of this node's
+	// prefs at any time, and invoke any LocalAPI endpoint on this node,
+	// without any further local consent (no CLI or GUI confirmation).
+	//
+	// This is an alternative to Tailscale's default per-feature double
+	// opt-in model, in which both the tailnet admin and the local machine
+	// owner must agree to each individual setting change. RemoteConfig is
+	// a single client-side "I trust the tailnet admin" switch that hands
+	// over full remote management of this node.
+	//
+	// Only enable this when the tailnet admin owns the machine (e.g. a
+	// corporate fleet device) or the local user has explicitly delegated
+	// full control to the tailnet admin. Do NOT enable this on personal
+	// or BYOD devices where the tailnet admin is not fully trusted.
+	RemoteConfig bool
+
 	// DriveShares are the configured DriveShares, stored in increasing order
 	// by name.
 	DriveShares []*drive.Share
@@ -291,16 +311,6 @@ type Prefs struct {
 	// non-nil.
 	RelayServerStaticEndpoints []netip.AddrPort `json:",omitempty"`
 
-	// AllowSingleHosts was a legacy field that was always true
-	// for the past 4.5 years. It controlled whether Tailscale
-	// peers got /32 or /128 routes for each other.
-	// As of 2024-05-17 we're starting to ignore it, but to let
-	// people still downgrade Tailscale versions and not break
-	// all peer-to-peer networking we still write it to disk (as JSON)
-	// so it can be loaded back by old versions.
-	// TODO(bradfitz): delete this in 2025 sometime. See #12058.
-	AllowSingleHosts marshalAsTrueInJSON
-
 	// The Persist field is named 'Config' in the file for backward
 	// compatibility with earlier versions.
 	// TODO(apenwarr): We should move this out of here, it's not a pref.
@@ -331,13 +341,6 @@ func (au1 AutoUpdatePrefs) Equals(au2 AutoUpdatePrefs) bool {
 		ok1 == ok2
 }
 
-type marshalAsTrueInJSON struct{}
-
-var trueJSON = []byte("true")
-
-func (marshalAsTrueInJSON) MarshalJSON() ([]byte, error) { return trueJSON, nil }
-func (*marshalAsTrueInJSON) UnmarshalJSON([]byte) error  { return nil }
-
 // AppConnectorPrefs are the app connector settings for the node agent.
 type AppConnectorPrefs struct {
 	// Advertise specifies whether the app connector subsystem is advertising
@@ -383,6 +386,7 @@ type MaskedPrefs struct {
 	AppConnectorSet               bool                `json:",omitempty"`
 	PostureCheckingSet            bool                `json:",omitempty"`
 	NetfilterKindSet              bool                `json:",omitempty"`
+	RemoteConfigSet               bool                `json:",omitempty"`
 	DriveSharesSet                bool                `json:",omitempty"`
 	RelayServerPortSet            bool                `json:",omitempty"`
 	RelayServerStaticEndpointsSet bool                `json:",omitzero"`
@@ -569,6 +573,9 @@ func (p *Prefs) pretty(goos string) string {
 	if p.ShieldsUp {
 		sb.WriteString("shields=true ")
 	}
+	if p.RemoteConfig {
+		sb.WriteString("remoteconfig=true ")
+	}
 	if buildfeatures.HasUseExitNode {
 		if p.ExitNodeIP.IsValid() {
 			fmt.Fprintf(&sb, "exit=%v lan=%t ", p.ExitNodeIP, p.ExitNodeAllowLANAccess)
@@ -691,6 +698,7 @@ func (p *Prefs) Equals(p2 *Prefs) bool {
 		p.PostureChecking == p2.PostureChecking &&
 		slices.EqualFunc(p.DriveShares, p2.DriveShares, drive.SharesEqual) &&
 		p.NetfilterKind == p2.NetfilterKind &&
+		p.RemoteConfig == p2.RemoteConfig &&
 		compareUint16Ptrs(p.RelayServerPort, p2.RelayServerPort) &&
 		slices.Equal(p.RelayServerStaticEndpoints, p2.RelayServerStaticEndpoints)
 }
@@ -872,10 +880,14 @@ func (e ExitNodeLocalIPError) Error() string {
 	return fmt.Sprintf("cannot use %s as an exit node as it is a local IP address to this machine", e.hostOrIP)
 }
 
+// exitNodeIPOfArg returns the IP address of the exit node based on the
+// user-provided string.
 func exitNodeIPOfArg(s string, st *ipnstate.Status) (ip netip.Addr, err error) {
 	if s == "" {
 		return ip, os.ErrInvalid
 	}
+
+	// If the string is a valid IP address, that's the exit node.
 	ip, err = netip.ParseAddr(s)
 	if err == nil {
 		if !isRemoteIP(st, ip) {
@@ -894,6 +906,13 @@ func exitNodeIPOfArg(s string, st *ipnstate.Status) (ip netip.Addr, err error) {
 		}
 		return ip, nil
 	}
+
+	// If the string is not a valid IP address, assume it's a hostname.
+	// Search the list of peers for a matching hostname.
+	if len(st.Peer) == 0 {
+		return ip, errors.New("cannot resolve exit node by hostname while Tailscale is starting up; " +
+			"please use its Tailscale IP address instead")
+	}
 	match := 0
 	for _, ps := range st.Peer {
 		// Compare to the peer name in three forms:
@@ -920,7 +939,7 @@ func exitNodeIPOfArg(s string, st *ipnstate.Status) (ip netip.Addr, err error) {
 	}
 	switch match {
 	case 0:
-		return ip, fmt.Errorf("invalid value %q for --exit-node; must be IP or hostname", s)
+		return ip, fmt.Errorf("invalid value %q for --exit-node; must be IP or peer hostname", s)
 	case 1:
 		if !isRemoteIP(st, ip) {
 			return ip, ExitNodeLocalIPError{s}
@@ -1097,6 +1116,12 @@ type LoginProfile struct {
 	// ControlURL is the URL of the control server that this profile is logged
 	// into.
 	ControlURL string
+
+	// Created is when this profile was first added to this client. It is
+	// stamped once at profile creation and never changes. It is used to sort
+	// the profile list with newest first; profiles created before this field
+	// existed have a zero value and sort after all stamped profiles.
+	Created time.Time `json:",omitzero"`
 }
 
 // Equals reports whether p and p2 are equal.
diff --git a/ipn/prefs_test.go b/ipn/prefs_test.go
index 31dd2c55a..3a960a798 100644
--- a/ipn/prefs_test.go
+++ b/ipn/prefs_test.go
@@ -67,10 +67,10 @@ func TestPrefsEqual(t *testing.T) {
 		"AppConnector",
 		"PostureChecking",
 		"NetfilterKind",
+		"RemoteConfig",
 		"DriveShares",
 		"RelayServerPort",
 		"RelayServerStaticEndpoints",
-		"AllowSingleHosts",
 		"Persist",
 	}
 	if have := fieldsOf(reflect.TypeFor[Prefs]()); !reflect.DeepEqual(have, prefsHandles) {
@@ -524,6 +524,11 @@ func TestPrefsPretty(t *testing.T) {
 			"windows",
 			"Prefs{ra=false dns=false want=false shields=true update=off Persist=nil}",
 		},
+		{
+			Prefs{RemoteConfig: true},
+			"windows",
+			"Prefs{ra=false dns=false want=false remoteconfig=true update=off Persist=nil}",
+		},
 		{
 			Prefs{},
 			"windows",
@@ -714,7 +719,7 @@ func TestMaskedPrefsFields(t *testing.T) {
 	have := map[string]bool{}
 	for _, f := range fieldsOf(reflect.TypeFor[Prefs]()) {
 		switch f {
-		case "Persist", "AllowSingleHosts":
+		case "Persist":
 			// These can't be edited.
 			continue
 		}
@@ -1006,10 +1011,19 @@ func TestExitNodeIPOfArg(t *testing.T) {
 			want: mustIP("1.2.3.4"),
 		},
 		{
-			name:    "no_match",
-			arg:     "unknown",
-			st:      &ipnstate.Status{MagicDNSSuffix: ".foo"},
-			wantErr: `invalid value "unknown" for --exit-node; must be IP or hostname`,
+			name: "no_match",
+			arg:  "unknown",
+			st: &ipnstate.Status{
+				MagicDNSSuffix: ".foo",
+				Peer: map[key.NodePublic]*ipnstate.PeerStatus{
+					key.NewNode().Public(): {
+						DNSName:        "skippy.foo.",
+						TailscaleIPs:   []netip.Addr{mustIP("1.0.0.2")},
+						ExitNodeOption: true,
+					},
+				},
+			},
+			wantErr: `invalid value "unknown" for --exit-node; must be IP or peer hostname`,
 		},
 		{
 			name: "name",
@@ -1056,6 +1070,12 @@ func TestExitNodeIPOfArg(t *testing.T) {
 			},
 			want: mustIP("1.0.0.2"),
 		},
+		{
+			name:    "hostname_no_peer",
+			arg:     "skippy.foo",
+			st:      &ipnstate.Status{},
+			wantErr: `cannot resolve exit node by hostname while Tailscale is starting up; please use its Tailscale IP address instead`,
+		},
 		{
 			name: "name_not_exit",
 			arg:  "skippy",
@@ -1082,7 +1102,7 @@ func TestExitNodeIPOfArg(t *testing.T) {
 					},
 				},
 			},
-			wantErr: `invalid value "skippy.bar." for --exit-node; must be IP or hostname`,
+			wantErr: `invalid value "skippy.bar." for --exit-node; must be IP or peer hostname`,
 		},
 		{
 			name: "ambiguous",
@@ -1207,27 +1227,6 @@ func TestNotifyPrefsJSONRoundtrip(t *testing.T) {
 	}
 }
 
-// Verify that our Prefs type writes out an AllowSingleHosts field so we can
-// downgrade to older versions that require it.
-func TestPrefsDowngrade(t *testing.T) {
-	var p Prefs
-	j, err := json.Marshal(p)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	type oldPrefs struct {
-		AllowSingleHosts bool
-	}
-	var op oldPrefs
-	if err := json.Unmarshal(j, &op); err != nil {
-		t.Fatal(err)
-	}
-	if !op.AllowSingleHosts {
-		t.Fatal("AllowSingleHosts should be true")
-	}
-}
-
 func TestParseAutoExitNodeString(t *testing.T) {
 	tests := []struct {
 		name       string
diff --git a/ipn/serve.go b/ipn/serve.go
index 21d15ab81..5c1fa2975 100644
--- a/ipn/serve.go
+++ b/ipn/serve.go
@@ -139,7 +139,10 @@ type TCPPortHandler struct {
 	// It is mutually exclusive with TCPForward.
 	HTTP bool `json:",omitempty"`
 
-	// TCPForward is the IP:port to forward TCP connections to.
+	// TCPForward is the address to forward TCP connections to.
+	// It is either a host:port (e.g. "127.0.0.1:3128", "localhost:5432")
+	// or a Unix socket path prefixed with "unix:"
+	// (e.g. "unix:/var/run/app.sock" or "unix:relative.sock").
 	// Whether or not TLS is terminated by tailscaled depends on
 	// TerminateTLS.
 	//
@@ -191,7 +194,7 @@ func (sc *ServeConfig) WebHandlerExists(svcName tailcfg.ServiceName, hp HostPort
 }
 
 // GetWebHandler returns the HTTPHandler for the given host:port and mount point.
-// Returns nil if the handler does not exist.
+// It returns nil if the handler does not exist.
 func (sc *ServeConfig) GetWebHandler(svcName tailcfg.ServiceName, hp HostPort, mount string) *HTTPHandler {
 	if sc == nil {
 		return nil
@@ -264,6 +267,46 @@ func (sc *ServeConfig) HasPathHandler() bool {
 	return false
 }
 
+// IsServingUnixAny reports whether ServeConfig is serving Unix targets on any
+// port or web handler.
+func (sc *ServeConfig) IsServingUnixAny() bool {
+	if sc == nil {
+		return false
+	}
+	for _, fgSrvCfg := range sc.Foreground {
+		if fgSrvCfg.IsServingUnixAny() {
+			return true
+		}
+	}
+	for _, ph := range sc.TCP {
+		if strings.HasPrefix(ph.TCPForward, "unix:") {
+			return true
+		}
+	}
+	for _, web := range sc.Web {
+		for _, h := range web.Handlers {
+			if strings.HasPrefix(h.Proxy, "unix:") {
+				return true
+			}
+		}
+	}
+	for _, svcCfg := range sc.Services {
+		for _, ph := range svcCfg.TCP {
+			if strings.HasPrefix(ph.TCPForward, "unix:") {
+				return true
+			}
+		}
+		for _, web := range svcCfg.Web {
+			for _, h := range web.Handlers {
+				if strings.HasPrefix(h.Proxy, "unix:") {
+					return true
+				}
+			}
+		}
+	}
+	return false
+}
+
 // IsTCPForwardingAny reports whether ServeConfig is currently forwarding in
 // TCPForward mode on any port. This is exclusive of Web/HTTPS serving.
 func (sc *ServeConfig) IsTCPForwardingAny() bool {
@@ -422,10 +465,10 @@ func (sc *ServeConfig) SetWebHandler(handler *HTTPHandler, host string, port uin
 	}
 }
 
-// SetTCPForwarding sets the fwdAddr (IP:port form) to which to forward
-// connections from the given port. If terminateTLS is true, TLS connections
-// are terminated with only the given host name permitted before passing them
-// to the fwdAddr.
+// SetTCPForwarding sets the fwdAddr to which to forward connections from the
+// given port. fwdAddr is either an IP:port or "unix:/path/to/socket".
+// If terminateTLS is true, TLS connections are terminated with only the given
+// host name permitted before passing them to the fwdAddr.
 //
 // If proxyProtocol is non-zero, the corresponding PROXY protocol version
 // header is sent before forwarding the connection.
@@ -443,10 +486,11 @@ func (sc *ServeConfig) SetTCPForwarding(port uint16, fwdAddr string, terminateTL
 	}
 }
 
-// SetTCPForwardingForService sets the fwdAddr (IP:port form) to which to
-// forward connections from the given port on the service. If terminateTLS
-// is true, TLS connections are terminated, with only the FQDN that corresponds
-// to the given service being permitted, before passing them to the fwdAddr.
+// SetTCPForwardingForService sets the fwdAddr to which to forward connections
+// from the given port on the service. fwdAddr is either a host:port or
+// "unix:/path" (absolute or relative). If terminateTLS is true, TLS connections
+// are terminated, with only the FQDN that corresponds to the given service
+// being permitted, before passing them to the fwdAddr.
 func (sc *ServeConfig) SetTCPForwardingForService(port uint16, fwdAddr string, terminateTLS bool, svcName tailcfg.ServiceName, proxyProtocol int, magicDNSSuffix string) {
 	if sc == nil {
 		sc = new(ServeConfig)
diff --git a/ipn/serve_expand_test.go b/ipn/serve_expand_test.go
index 33f808d62..225e38799 100644
--- a/ipn/serve_expand_test.go
+++ b/ipn/serve_expand_test.go
@@ -42,6 +42,14 @@ func TestExpandProxyTargetValueUnix(t *testing.T) {
 			want:             "unix:./myservice.sock",
 			skipOnWindows:    true,
 		},
+		{
+			name:             "unix-socket-bare-relative-path",
+			target:           "unix:myservice.sock",
+			supportedSchemes: []string{"http", "https", "unix"},
+			defaultScheme:    "http",
+			want:             "unix:myservice.sock",
+			skipOnWindows:    true,
+		},
 		{
 			name:             "unix-socket-empty-path",
 			target:           "unix:",
@@ -56,6 +64,21 @@ func TestExpandProxyTargetValueUnix(t *testing.T) {
 			defaultScheme:    "http",
 			wantErr:          true,
 		},
+		{
+			name:             "unix-socket-tcp-supported",
+			target:           "unix:/var/run/app.sock",
+			supportedSchemes: []string{"tcp", "unix"},
+			defaultScheme:    "tcp",
+			want:             "unix:/var/run/app.sock",
+			skipOnWindows:    true,
+		},
+		{
+			name:             "unix-socket-tcp-not-supported",
+			target:           "unix:/var/run/app.sock",
+			supportedSchemes: []string{"tcp"},
+			defaultScheme:    "tcp",
+			wantErr:          true,
+		},
 	}
 
 	for _, tt := range tests {
diff --git a/ipn/serve_test.go b/ipn/serve_test.go
index bf043ca39..b8a7aee79 100644
--- a/ipn/serve_test.go
+++ b/ipn/serve_test.go
@@ -417,3 +417,150 @@ func TestIsFunnelOn(t *testing.T) {
 		})
 	}
 }
+
+func TestIsServingUnixAny(t *testing.T) {
+	tests := []struct {
+		name string
+		sc   *ServeConfig
+		want bool
+	}{
+		{
+			name: "empty",
+			sc:   &ServeConfig{},
+			want: false,
+		},
+		{
+			name: "nil",
+			sc:   &ServeConfig{},
+			want: false,
+		},
+		{
+			name: "no_unix",
+			sc: &ServeConfig{
+				TCP: map[uint16]*TCPPortHandler{
+					80: {TCPForward: "localhost:8080"},
+				},
+			},
+			want: false,
+		},
+		{
+			name: "tcp_to_unix",
+			sc: &ServeConfig{
+				TCP: map[uint16]*TCPPortHandler{
+					80: {TCPForward: "unix:/var/run/foo.sock"},
+				},
+			},
+			want: true,
+		},
+		{
+			name: "web_to_unix",
+			sc: &ServeConfig{
+				Web: map[HostPort]*WebServerConfig{
+					"foo.test.ts.net:80": {
+						Handlers: map[string]*HTTPHandler{
+							"/": {Proxy: "unix:/var/run/foo.sock"},
+						},
+					},
+				},
+			},
+			want: true,
+		},
+		{
+			name: "foreground_tcp_to_unix",
+			sc: &ServeConfig{
+				Foreground: map[string]*ServeConfig{
+					"abc": {
+						TCP: map[uint16]*TCPPortHandler{
+							80: {TCPForward: "unix:/var/run/foo.sock"},
+						},
+					},
+				},
+			},
+			want: true,
+		},
+		{
+			name: "foreground_web_to_unix",
+			sc: &ServeConfig{
+				Foreground: map[string]*ServeConfig{
+					"abc": {
+						Web: map[HostPort]*WebServerConfig{
+							"foo.test.ts.net:80": {
+								Handlers: map[string]*HTTPHandler{
+									"/": {Proxy: "unix:/var/run/foo.sock"},
+								},
+							},
+						},
+					},
+				},
+			},
+			want: true,
+		},
+		{
+			name: "services_tcp_to_unix",
+			sc: &ServeConfig{
+				Services: map[tailcfg.ServiceName]*ServiceConfig{
+					"svc:foo": {
+						TCP: map[uint16]*TCPPortHandler{
+							80: {TCPForward: "unix:/var/run/foo.sock"},
+						},
+					},
+				},
+			},
+			want: true,
+		},
+		{
+			name: "services_web_to_unix",
+			sc: &ServeConfig{
+				Services: map[tailcfg.ServiceName]*ServiceConfig{
+					"svc:foo": {
+						Web: map[HostPort]*WebServerConfig{
+							"foo.test.ts.net:80": {
+								Handlers: map[string]*HTTPHandler{
+									"/": {Proxy: "unix:/var/run/foo.sock"},
+								},
+							},
+						},
+					},
+				},
+			},
+			want: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := tt.sc.IsServingUnixAny(); got != tt.want {
+				t.Errorf("ServeConfig.IsServingUnixAny() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+// The structural checks below guard against new vulnerabilities in serving Unix
+// socket targets. If [ServeConfig] or [ServiceConfig] is updated, these checks
+// will fail, forcing you to consider updating [ServeConfig.IsServingUnixAny].
+//
+// If your updates have created a new way to serve Unix sockets, please update
+// IsServingUnixAny accordingly. Otherwise, you can just add your new field
+// below and move on.
+//
+// IsServingUnixAny helps avoid a class of vulnerabilities in which tailscaled
+// (by means of tailscale serve) gives non-root users access to Unix sockets
+// they otherwise would not have access to (e.g. /var/run/docker.sock). As of
+// 2026-06-03, serving Unix sockets at all requires root permissions, and
+// IsServingUnixAny is how tailscaled knows when to enforce this restriction.
+//
+// See https://github.com/tailscale/corp/issues/41998
+var _ ServeConfig = struct {
+	TCP         map[uint16]*TCPPortHandler             `json:",omitempty"`
+	Web         map[HostPort]*WebServerConfig          `json:",omitempty"`
+	Services    map[tailcfg.ServiceName]*ServiceConfig `json:",omitempty"`
+	AllowFunnel map[HostPort]bool                      `json:",omitempty"`
+	Foreground  map[string]*ServeConfig                `json:",omitempty"`
+	ETag        string                                 `json:"-"`
+}{}
+var _ ServiceConfig = struct {
+	TCP map[uint16]*TCPPortHandler    `json:",omitempty"`
+	Web map[HostPort]*WebServerConfig `json:",omitempty"`
+	Tun bool                          `json:",omitempty"`
+}{}
diff --git a/ipn/store.go b/ipn/store.go
index 1bd3e5a3b..49007c14e 100644
--- a/ipn/store.go
+++ b/ipn/store.go
@@ -92,7 +92,9 @@ type StateStore interface {
 	// ReadState returns the bytes associated with ID. Returns (nil,
 	// ErrStateNotExist) if the ID doesn't have associated state.
 	ReadState(id StateKey) ([]byte, error)
-	// WriteState saves bs as the state associated with ID.
+	// WriteState saves bs as the state associated with ID. If bs is nil,
+	// the state associated with ID is deleted, and a subsequent ReadState
+	// for ID will return ErrStateNotExist.
 	//
 	// Callers should generally use the ipn.WriteState wrapper func
 	// instead, which only writes if the value is different from what's
diff --git a/ipn/store/awsstore/store_aws.go b/ipn/store/awsstore/store_aws.go
index feb86e457..43d8e059c 100644
--- a/ipn/store/awsstore/store_aws.go
+++ b/ipn/store/awsstore/store_aws.go
@@ -79,7 +79,7 @@ type awsStore struct {
 //
 // Note that we store the entire store in a single parameter
 // key, therefore if the state is above 8kb, it can cause
-// Tailscaled to only only store new state in-memory and
+// Tailscaled to only store new state in-memory and
 // restarting Tailscaled can fail until you delete your state
 // from the AWS Parameter Store.
 //
diff --git a/ipn/store/kubestore/store_kube.go b/ipn/store/kubestore/store_kube.go
index f7d1b90cd..bfc287baa 100644
--- a/ipn/store/kubestore/store_kube.go
+++ b/ipn/store/kubestore/store_kube.go
@@ -5,7 +5,9 @@
 package kubestore
 
 import (
+	"bytes"
 	"context"
+	"crypto/sha256"
 	"encoding/json"
 	"fmt"
 	"net"
@@ -47,6 +49,17 @@ const (
 
 	keyTLSCert = "tls.crt"
 	keyTLSKey  = "tls.key"
+	// keyACMEAcctFP is the cert Secret field that records the SHA-256
+	// fingerprint of the PEM-encoded ACME account key that issued the
+	// cert. The renewal path uses this to decide whether to include the
+	// ARI "replaces" hint: only if the current account key matches
+	// (otherwise Let's Encrypt rejects the claim).
+	keyACMEAcctFP = "acme-account-fingerprint"
+
+	// acmeAccountStateKey is the ipn.StateStore key under which tailscaled
+	// stores its ACME account private key. Mirrors the acmePEMName constant
+	// in ipn/ipnlocal/cert.go. Duplicated here to avoid an import cycle.
+	acmeAccountStateKey = "acme-account.key.pem"
 )
 
 // Store is an ipn.StateStore that uses a Kubernetes Secret for persistence.
@@ -57,6 +70,17 @@ type Store struct {
 	certShareMode string // 'ro', 'rw', or empty
 	podName       string
 
+	// acmeAccountsSecretName, when non-empty in "rw" cert share mode,
+	// routes reads and writes of acmeAccountStateKey to acmeAccountField
+	// inside this shared per-tailnet Secret. See #18251.
+	acmeAccountsSecretName string
+	acmeAccountField       string
+
+	// preAdoptedLocalKey is the SHA-256 of the per-pod ACME account key
+	// that was in the local state Secret before we adopted a foreign
+	// shared key. Non-nil only when adoption changed the key.
+	preAdoptedLocalKey []byte
+
 	logf logger.Logf
 
 	// memory holds the latest tailscale state. Writes write state to a kube
@@ -106,6 +130,17 @@ func newWithClient(logf logger.Logf, c kubeclient.Client, secretName string) (*S
 		s.certShareMode = "ro"
 	}
 
+	// Configure shared ACME account lookup. Only meaningful for the cert
+	// issuer (cert share "rw") — read replicas never issue.
+	if s.certShareMode == "rw" {
+		s.acmeAccountsSecretName = os.Getenv("TS_ACME_ACCOUNT_SECRET_NAME")
+		s.acmeAccountField = os.Getenv("TS_ACME_ACCOUNT_FIELD")
+		if s.acmeAccountsSecretName != "" && s.acmeAccountField == "" {
+			s.logf("[unexpected] TS_ACME_ACCOUNT_SECRET_NAME set without TS_ACME_ACCOUNT_FIELD; ignoring shared ACME account configuration")
+			s.acmeAccountsSecretName = ""
+		}
+	}
+
 	// Load latest state from kube Secret if it already exists.
 	if err := s.loadState(); err != nil && err != ipn.ErrStateNotExist {
 		return nil, fmt.Errorf("error loading state from kube Secret: %w", err)
@@ -126,9 +161,135 @@ func newWithClient(logf logger.Logf, c kubeclient.Client, secretName string) (*S
 	if s.certShareMode == "ro" {
 		go s.runCertReload(context.Background())
 	}
+	if s.acmeAccountsSecretName != "" {
+		if err := s.reconcileSharedACMEAccountKey(); err != nil {
+			// Non-fatal: the cert loop will retry on next issuance.
+			s.logf("kubestore: reconciling shared ACME account key: %v", err)
+		}
+	}
 	return s, nil
 }
 
+// reconcileSharedACMEAccountKey aligns the in-memory ACME account key with
+// the shared per-tailnet field: adopt the shared value if present, otherwise
+// copy the local per-pod key up so upgrading deployments keep renewal
+// continuity.
+func (s *Store) reconcileSharedACMEAccountKey() error {
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+
+	sharedSecret, err := s.client.GetSecret(ctx, s.acmeAccountsSecretName)
+	if err != nil && !kubeclient.IsNotFoundErr(err) {
+		return fmt.Errorf("reading shared ACME accounts Secret %q: %w", s.acmeAccountsSecretName, err)
+	}
+	var sharedKey []byte
+	if sharedSecret != nil {
+		sharedKey = sharedSecret.Data[sanitizeKey(s.acmeAccountField)]
+	}
+	if len(sharedKey) > 0 {
+		// Shared field already populated for this tailnet. Adopt it. If
+		// our local per-pod key differs, remember its fingerprint so
+		// legacy certs on this pod (issued before we started stamping
+		// fingerprints) can be recognised as mis-aligned on renewal.
+		localKey, err := s.memory.ReadState(ipn.StateKey(acmeAccountStateKey))
+		if err == nil && len(localKey) > 0 && !bytes.Equal(localKey, sharedKey) {
+			sum := sha256.Sum256(localKey)
+			s.preAdoptedLocalKey = sum[:]
+		}
+		s.memory.WriteState(ipn.StateKey(acmeAccountStateKey), sharedKey)
+		return nil
+	}
+
+	// Shared field is empty. If we have a per-pod key from the state
+	// Secret, copy it up so existing renewals stay exempt.
+	localKey, err := s.memory.ReadState(ipn.StateKey(acmeAccountStateKey))
+	if err != nil || len(localKey) == 0 {
+		// Nothing local either; the cert loop will generate one on first
+		// use and route the write through writeSharedACMEAccountKey.
+		return nil
+	}
+	if err := s.writeSharedACMEAccountKey(localKey); err != nil {
+		return fmt.Errorf("copying per-pod ACME account key to shared Secret: %w", err)
+	}
+	s.logf("kubestore: migrated per-pod ACME account key into shared Secret %q field %q", s.acmeAccountsSecretName, s.acmeAccountField)
+	return nil
+}
+
+// writeSharedACMEAccountKey writes key to acmeAccountField inside
+// acmeAccountsSecretName, using whichever access pattern (patch or update)
+// this Store has permission for.
+func (s *Store) writeSharedACMEAccountKey(key []byte) error {
+	return s.updateSecret(map[string][]byte{s.acmeAccountField: key}, s.acmeAccountsSecretName)
+}
+
+// maybeRestoreSharedACMEAccountKey writes the in-memory ACME account key to
+// the shared Secret's per-tailnet field if that field is empty or missing,
+// e.g. because the Secret was deleted and recreated while this process was
+// running. It never overwrites an existing shared key.
+func (s *Store) maybeRestoreSharedACMEAccountKey() error {
+	if s.acmeAccountsSecretName == "" {
+		return nil
+	}
+	key, err := s.memory.ReadState(ipn.StateKey(acmeAccountStateKey))
+	if err != nil || len(key) == 0 {
+		return nil
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+	shared, err := s.client.GetSecret(ctx, s.acmeAccountsSecretName)
+	if err != nil && !kubeclient.IsNotFoundErr(err) {
+		return fmt.Errorf("reading shared ACME accounts Secret %q: %w", s.acmeAccountsSecretName, err)
+	}
+	if shared != nil && len(shared.Data[sanitizeKey(s.acmeAccountField)]) > 0 {
+		return nil
+	}
+	s.logf("kubestore: shared ACME accounts Secret %q field %q is empty; restoring account key from memory", s.acmeAccountsSecretName, s.acmeAccountField)
+	return s.writeSharedACMEAccountKey(key)
+}
+
+// acmeAccountKeyFingerprint returns the SHA-256 of the current in-memory
+// PEM-encoded ACME account key, or (nil, false) if the key isn't set.
+func acmeAccountKeyFingerprint(m *mem.Store) ([]byte, bool) {
+	key, err := m.ReadState(ipn.StateKey(acmeAccountStateKey))
+	if err != nil || len(key) == 0 {
+		return nil, false
+	}
+	sum := sha256.Sum256(key)
+	return sum[:], true
+}
+
+// ShouldUseARIReplacesForRenewal reports whether the current ACME account
+// key matches the one that issued the cert for domain. See #18251.
+func (s *Store) ShouldUseARIReplacesForRenewal(domain string) (bool, error) {
+	if s.certShareMode != "rw" {
+		return true, nil
+	}
+	curFP, ok := acmeAccountKeyFingerprint(&s.memory)
+	if !ok {
+		// No current account key in memory yet; nothing to compare.
+		return true, nil
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+	sec, err := s.client.GetSecret(ctx, domain)
+	if err != nil {
+		if kubeclient.IsNotFoundErr(err) {
+			return true, nil
+		}
+		return true, fmt.Errorf("getting TLS Secret %q: %w", domain, err)
+	}
+	certFP := sec.Data[keyACMEAcctFP]
+	if len(certFP) == 0 {
+		// Legacy cert, no fingerprint stamp. Assume misaligned only if
+		// we adopted a foreign shared key.
+		if len(s.preAdoptedLocalKey) > 0 {
+			return false, nil
+		}
+		return true, nil
+	}
+	return bytes.Equal(certFP, curFP), nil
+}
+
 func (s *Store) SetDialer(d func(ctx context.Context, network, address string) (net.Conn, error)) {
 	s.client.SetDialer(d)
 }
@@ -147,11 +308,22 @@ func (s *Store) WriteState(id ipn.StateKey, bs []byte) (err error) {
 			s.memory.WriteState(ipn.StateKey(sanitizeKey(id)), bs)
 		}
 	}()
+	if s.acmeAccountsSecretName != "" && string(id) == acmeAccountStateKey {
+		if bs == nil {
+			return s.removeSecretField(s.acmeAccountField, s.acmeAccountsSecretName)
+		}
+		return s.writeSharedACMEAccountKey(bs)
+	}
+	if bs == nil {
+		return s.removeSecretField(string(id), s.secretName)
+	}
 	return s.updateSecret(map[string][]byte{string(id): bs}, s.secretName)
 }
 
 // WriteTLSCertAndKey writes a TLS cert and key to domain.crt, domain.key fields
-// of a Tailscale Kubernetes node's state Secret.
+// of a Tailscale Kubernetes node's state Secret. In cert-share "rw" mode it
+// also stamps acme-account-fingerprint alongside the cert so the renewal path
+// can tell whether the current ACME account key issued this cert.
 func (s *Store) WriteTLSCertAndKey(domain string, cert, key []byte) (err error) {
 	if s.certShareMode == "ro" {
 		s.logf("[unexpected] TLS cert and key write in read-only mode")
@@ -172,6 +344,14 @@ func (s *Store) WriteTLSCertAndKey(domain string, cert, key []byte) (err error)
 			keyTLSCert: cert,
 			keyTLSKey:  key,
 		}
+		if fp, ok := acmeAccountKeyFingerprint(&s.memory); ok {
+			data[keyACMEAcctFP] = fp
+		}
+		// The shared Secret may have been deleted and recreated empty
+		// while we were running; re-assert the account key if so.
+		if err := s.maybeRestoreSharedACMEAccountKey(); err != nil {
+			s.logf("kubestore: restoring shared ACME account key: %v", err)
+		}
 	}
 	if err := s.updateSecret(data, secretName); err != nil {
 		return fmt.Errorf("error writing TLS cert and key to Secret: %w", err)
@@ -339,6 +519,29 @@ func (s *Store) updateSecret(data map[string][]byte, secretName string) (err err
 	return nil
 }
 
+func (s *Store) removeSecretField(key, secretName string) error {
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+	if s.canPatchSecret(secretName) {
+		return s.client.JSONPatchResource(ctx, secretName, kubeclient.TypeSecrets, []kubeclient.JSONPatch{
+			{
+				Op:   "remove",
+				Path: "/data/" + sanitizeKey(ipn.StateKey(key)),
+			},
+		})
+	}
+	// No patch permissions, use UPDATE: get the secret, delete the key, update.
+	secret, err := s.client.GetSecret(ctx, secretName)
+	if err != nil {
+		return fmt.Errorf("error getting Secret %s: %w", secretName, err)
+	}
+	delete(secret.Data, sanitizeKey(ipn.StateKey(key)))
+	if err := s.client.UpdateSecret(ctx, secret); err != nil {
+		return fmt.Errorf("error updating Secret %s: %w", secretName, err)
+	}
+	return nil
+}
+
 func (s *Store) loadState() (err error) {
 	ctx, cancel := context.WithTimeout(context.Background(), timeout)
 	defer cancel()
@@ -463,7 +666,9 @@ func (s *Store) loadCerts(ctx context.Context, sel map[string]string) error {
 // canCreateSecret returns true if this node should be allowed to create the given
 // Secret in its namespace.
 func (s *Store) canCreateSecret(secret string) bool {
-	// Only allow creating the state Secret (and not TLS Secrets).
+	// Only allow creating the state Secret (and not TLS Secrets). The
+	// shared ACME accounts Secret is precreated by the operator, so write
+	// replicas never need create permission for it.
 	return secret == s.secretName
 }
 
@@ -472,7 +677,8 @@ func (s *Store) canCreateSecret(secret string) bool {
 func (s *Store) canPatchSecret(secret string) bool {
 	// For backwards compatibility reasons, setups where the proxies are not
 	// given PATCH permissions for state Secrets are allowed. For TLS
-	// Secrets, we should always have PATCH permissions.
+	// Secrets and the shared ACME accounts Secret, we should always have
+	// PATCH permissions.
 	if secret == s.secretName {
 		return s.canPatch
 	}
diff --git a/ipn/store/kubestore/store_kube_test.go b/ipn/store/kubestore/store_kube_test.go
index 1e6f711d6..14b69787e 100644
--- a/ipn/store/kubestore/store_kube_test.go
+++ b/ipn/store/kubestore/store_kube_test.go
@@ -6,6 +6,7 @@ package kubestore
 import (
 	"bytes"
 	"context"
+	"crypto/sha256"
 	"encoding/json"
 	"fmt"
 	"strings"
@@ -172,6 +173,32 @@ func TestWriteState(t *testing.T) {
 			},
 			allowPatch: true,
 		},
+		{
+			name: "delete_with_patch",
+			initial: map[string][]byte{
+				"foo": []byte("bar"),
+				"baz": []byte("quux"),
+			},
+			key:   "foo",
+			value: nil,
+			wantData: map[string][]byte{
+				"baz": []byte("quux"),
+			},
+			allowPatch: true,
+		},
+		{
+			name: "delete_with_update",
+			initial: map[string][]byte{
+				"foo": []byte("bar"),
+				"baz": []byte("quux"),
+			},
+			key:   "foo",
+			value: nil,
+			wantData: map[string][]byte{
+				"baz": []byte("quux"),
+			},
+			allowPatch: false,
+		},
 	}
 
 	for _, tt := range tests {
@@ -208,6 +235,9 @@ func TestWriteState(t *testing.T) {
 						} else if p.Op == "add" && strings.HasPrefix(p.Path, "/data/") {
 							key := strings.TrimPrefix(p.Path, "/data/")
 							secret[key] = p.Value.([]byte)
+						} else if p.Op == "remove" && strings.HasPrefix(p.Path, "/data/") {
+							key := strings.TrimPrefix(p.Path, "/data/")
+							delete(secret, key)
 						}
 					}
 					return nil
@@ -234,11 +264,17 @@ func TestWriteState(t *testing.T) {
 
 			// Verify memory store was updated
 			got, err := s.memory.ReadState(ipn.StateKey(sanitizeKey(string(tt.key))))
-			if err != nil {
-				t.Errorf("reading from memory store: %v", err)
-			}
-			if !cmp.Equal(got, tt.value) {
-				t.Errorf("memory store key %q = %v, want %v", tt.key, got, tt.value)
+			if tt.value == nil {
+				if err != ipn.ErrStateNotExist {
+					t.Errorf("reading deleted key from memory store: got err %v, want ErrStateNotExist", err)
+				}
+			} else {
+				if err != nil {
+					t.Errorf("reading from memory store: %v", err)
+				}
+				if !cmp.Equal(got, tt.value) {
+					t.Errorf("memory store key %q = %v, want %v", tt.key, got, tt.value)
+				}
 			}
 		})
 	}
@@ -812,3 +848,441 @@ func TestNewWithClient(t *testing.T) {
 		})
 	}
 }
+
+func TestSharedACMEAccountKey(t *testing.T) {
+	const (
+		stateSecretName  = "ingress-proxies-0"
+		sharedSecretName = kubetypes.ACMEAccountsSecretName
+		sharedField      = "my-tailnet" + kubetypes.ACMEAccountKeySuffix
+	)
+	existingKey := []byte("-----BEGIN PRIVATE KEY-----\nexisting\n-----END PRIVATE KEY-----")
+	freshKey := []byte("-----BEGIN PRIVATE KEY-----\nfresh\n-----END PRIVATE KEY-----")
+
+	tests := []struct {
+		name             string
+		certMode         string
+		stateSecret      map[string][]byte
+		sharedSecret     map[string][]byte // nil = Secret does not exist
+		envSecretName    string
+		envField         string
+		writeAfterInit   []byte // if non-nil, call WriteState(acmeAccountStateKey, …) after init
+		wantMemoryACME   []byte
+		wantSharedSecret map[string][]byte
+		wantStateSecret  map[string][]byte // optional: when set, asserts state Secret was not touched on the ACME path
+		wantPreAdopted   []byte            // expected s.preAdoptedLocalKey (sha256 of pre-adoption local key)
+	}{
+		{
+			name:             "adopts_shared_key_when_present",
+			certMode:         "rw",
+			envSecretName:    sharedSecretName,
+			envField:         sharedField,
+			stateSecret:      map[string][]byte{},
+			sharedSecret:     map[string][]byte{sharedField: existingKey},
+			wantMemoryACME:   existingKey,
+			wantSharedSecret: map[string][]byte{sharedField: existingKey},
+		},
+		{
+			name:          "shared_overrides_per_pod_key",
+			certMode:      "rw",
+			envSecretName: sharedSecretName,
+			envField:      sharedField,
+			stateSecret: map[string][]byte{
+				acmeAccountStateKey: freshKey, // would be stale
+			},
+			sharedSecret:     map[string][]byte{sharedField: existingKey},
+			wantMemoryACME:   existingKey,
+			wantSharedSecret: map[string][]byte{sharedField: existingKey},
+			wantPreAdopted:   sha256Sum(freshKey),
+		},
+		{
+			name:          "adopting_matching_local_leaves_preadopted_nil",
+			certMode:      "rw",
+			envSecretName: sharedSecretName,
+			envField:      sharedField,
+			stateSecret: map[string][]byte{
+				acmeAccountStateKey: existingKey, // matches shared
+			},
+			sharedSecret:     map[string][]byte{sharedField: existingKey},
+			wantMemoryACME:   existingKey,
+			wantSharedSecret: map[string][]byte{sharedField: existingKey},
+		},
+		{
+			name:          "migrates_per_pod_key_when_shared_field_empty",
+			certMode:      "rw",
+			envSecretName: sharedSecretName,
+			envField:      sharedField,
+			stateSecret: map[string][]byte{
+				acmeAccountStateKey: existingKey,
+			},
+			sharedSecret:     map[string][]byte{}, // exists but no field for this tailnet
+			wantMemoryACME:   existingKey,
+			wantSharedSecret: map[string][]byte{sharedField: existingKey},
+		},
+		{
+			name:             "no_op_when_no_keys_anywhere",
+			certMode:         "rw",
+			envSecretName:    sharedSecretName,
+			envField:         sharedField,
+			stateSecret:      map[string][]byte{},
+			sharedSecret:     map[string][]byte{},
+			wantMemoryACME:   nil,
+			wantSharedSecret: map[string][]byte{},
+		},
+		{
+			name:          "ro_mode_ignores_env_vars",
+			certMode:      "ro",
+			envSecretName: sharedSecretName,
+			envField:      sharedField,
+			stateSecret: map[string][]byte{
+				acmeAccountStateKey: freshKey,
+			},
+			sharedSecret:   map[string][]byte{sharedField: existingKey},
+			wantMemoryACME: freshKey, // per-pod copy stays; shared Secret never consulted
+		},
+		{
+			name:             "write_routes_to_shared_secret",
+			certMode:         "rw",
+			envSecretName:    sharedSecretName,
+			envField:         sharedField,
+			stateSecret:      map[string][]byte{},
+			sharedSecret:     map[string][]byte{},
+			writeAfterInit:   freshKey,
+			wantMemoryACME:   freshKey,
+			wantSharedSecret: map[string][]byte{sharedField: freshKey},
+			wantStateSecret:  map[string][]byte{}, // state Secret untouched by the ACME write
+		},
+		{
+			name:             "write_in_ro_mode_goes_to_state_secret",
+			certMode:         "ro",
+			envSecretName:    sharedSecretName,
+			envField:         sharedField,
+			stateSecret:      map[string][]byte{},
+			sharedSecret:     map[string][]byte{},
+			writeAfterInit:   freshKey,
+			wantMemoryACME:   freshKey,
+			wantSharedSecret: map[string][]byte{}, // env vars ignored in ro mode
+			wantStateSecret:  map[string][]byte{acmeAccountStateKey: freshKey},
+		},
+		{
+			name:          "no_env_vars_routes_to_state_secret",
+			certMode:      "rw",
+			envSecretName: "", // shared account disabled
+			envField:      "",
+			stateSecret: map[string][]byte{
+				acmeAccountStateKey: existingKey,
+			},
+			sharedSecret:    nil, // does not exist; should not be touched
+			wantMemoryACME:  existingKey,
+			wantStateSecret: map[string][]byte{acmeAccountStateKey: existingKey},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Setenv("TS_CERT_SHARE_MODE", tt.certMode)
+			t.Setenv("TS_ACME_ACCOUNT_SECRET_NAME", tt.envSecretName)
+			t.Setenv("TS_ACME_ACCOUNT_FIELD", tt.envField)
+			t.Setenv("POD_NAME", stateSecretName)
+
+			stateData := cloneMap(tt.stateSecret)
+			sharedData := cloneMap(tt.sharedSecret)
+			sharedExists := tt.sharedSecret != nil
+
+			client := &kubeclient.FakeClient{
+				GetSecretImpl: func(ctx context.Context, name string) (*kubeapi.Secret, error) {
+					switch name {
+					case stateSecretName:
+						return &kubeapi.Secret{Data: stateData}, nil
+					case sharedSecretName:
+						if !sharedExists {
+							return nil, &kubeapi.Status{Code: 404}
+						}
+						return &kubeapi.Secret{Data: sharedData}, nil
+					}
+					return nil, &kubeapi.Status{Code: 404}
+				},
+				CheckSecretPermissionsImpl: func(ctx context.Context, name string) (bool, bool, error) {
+					return true, true, nil
+				},
+				JSONPatchResourceImpl: func(ctx context.Context, name, resourceType string, patches []kubeclient.JSONPatch) error {
+					var target *map[string][]byte
+					switch name {
+					case stateSecretName:
+						target = &stateData
+					case sharedSecretName:
+						target = &sharedData
+						sharedExists = true
+					default:
+						t.Errorf("unexpected patch target Secret %q", name)
+						return nil
+					}
+					if *target == nil {
+						*target = map[string][]byte{}
+					}
+					for _, p := range patches {
+						if p.Op == "add" && p.Path == "/data" {
+							*target = p.Value.(map[string][]byte)
+						} else if p.Op == "add" && strings.HasPrefix(p.Path, "/data/") {
+							key := strings.TrimPrefix(p.Path, "/data/")
+							(*target)[key] = p.Value.([]byte)
+						}
+					}
+					return nil
+				},
+				CreateSecretImpl: func(ctx context.Context, s *kubeapi.Secret) error {
+					switch s.Name {
+					case stateSecretName:
+						stateData = s.Data
+					case sharedSecretName:
+						sharedData = s.Data
+						sharedExists = true
+					default:
+						t.Errorf("unexpected create target Secret %q", s.Name)
+					}
+					return nil
+				},
+				ListSecretsImpl: func(ctx context.Context, selector map[string]string) (*kubeapi.SecretList, error) {
+					// Used by ro-mode TLS Secret preload; irrelevant to this test.
+					return &kubeapi.SecretList{}, nil
+				},
+			}
+
+			s, err := newWithClient(t.Logf, client, stateSecretName)
+			if err != nil {
+				t.Fatalf("newWithClient: %v", err)
+			}
+
+			if tt.writeAfterInit != nil {
+				if err := s.WriteState(ipn.StateKey(acmeAccountStateKey), tt.writeAfterInit); err != nil {
+					t.Fatalf("WriteState(ACME key): %v", err)
+				}
+			}
+
+			gotMemACME, err := s.memory.ReadState(ipn.StateKey(acmeAccountStateKey))
+			if err != nil && tt.wantMemoryACME != nil {
+				t.Errorf("memory ReadState(ACME key): %v", err)
+			}
+			if !bytes.Equal(gotMemACME, tt.wantMemoryACME) {
+				t.Errorf("memory ACME key = %q, want %q", gotMemACME, tt.wantMemoryACME)
+			}
+			if tt.wantSharedSecret != nil {
+				if diff := cmp.Diff(sharedData, tt.wantSharedSecret); diff != "" {
+					t.Errorf("shared Secret contents mismatch (-got +want):\n%s", diff)
+				}
+			}
+			if tt.wantStateSecret != nil {
+				if diff := cmp.Diff(stateData, tt.wantStateSecret); diff != "" {
+					t.Errorf("state Secret contents mismatch (-got +want):\n%s", diff)
+				}
+			}
+			if !bytes.Equal(s.preAdoptedLocalKey, tt.wantPreAdopted) {
+				t.Errorf("preAdoptedLocalKey = %x, want %x", s.preAdoptedLocalKey, tt.wantPreAdopted)
+			}
+		})
+	}
+}
+
+func cloneMap(m map[string][]byte) map[string][]byte {
+	if m == nil {
+		return nil
+	}
+	out := make(map[string][]byte, len(m))
+	for k, v := range m {
+		out[k] = append([]byte(nil), v...)
+	}
+	return out
+}
+
+func sha256Sum(b []byte) []byte {
+	sum := sha256.Sum256(b)
+	return sum[:]
+}
+
+func TestShouldUseARIReplacesForRenewal(t *testing.T) {
+	const domain = "app.tailnetxyz.ts.net"
+	acmeKey := []byte("-----BEGIN PRIVATE KEY-----\ncurrent\n-----END PRIVATE KEY-----")
+	otherKey := []byte("-----BEGIN PRIVATE KEY-----\nother\n-----END PRIVATE KEY-----")
+	curFP := sha256Sum(acmeKey)
+	otherFP := sha256Sum(otherKey)
+
+	tests := []struct {
+		name          string
+		certShareMode string
+		acmeInMemory  []byte // per-pod ACME key present in memory
+		preAdopted    []byte // sha256 of pre-adoption local key (foreign-key path)
+		certSecret    map[string][]byte
+		certGetErr    error
+		want          bool
+		wantErr       bool
+	}{
+		{
+			name:          "non_rw_mode_returns_true",
+			certShareMode: "",
+			want:          true,
+		},
+		{
+			name:          "ro_mode_returns_true",
+			certShareMode: "ro",
+			want:          true,
+		},
+		{
+			name:          "no_acme_key_returns_true",
+			certShareMode: "rw",
+			want:          true,
+		},
+		{
+			name:          "cert_not_found_returns_true",
+			certShareMode: "rw",
+			acmeInMemory:  acmeKey,
+			certGetErr:    &kubeapi.Status{Code: 404},
+			want:          true,
+		},
+		{
+			name:          "cert_get_error_returns_true_with_err",
+			certShareMode: "rw",
+			acmeInMemory:  acmeKey,
+			certGetErr:    fmt.Errorf("api down"),
+			want:          true,
+			wantErr:       true,
+		},
+		{
+			name:          "fingerprint_matches",
+			certShareMode: "rw",
+			acmeInMemory:  acmeKey,
+			certSecret:    map[string][]byte{keyACMEAcctFP: curFP},
+			want:          true,
+		},
+		{
+			name:          "fingerprint_differs",
+			certShareMode: "rw",
+			acmeInMemory:  acmeKey,
+			certSecret:    map[string][]byte{keyACMEAcctFP: otherFP},
+			want:          false,
+		},
+		{
+			name:          "legacy_cert_no_preadopted_returns_true",
+			certShareMode: "rw",
+			acmeInMemory:  acmeKey,
+			certSecret:    map[string][]byte{}, // no fingerprint field
+			want:          true,
+		},
+		{
+			name:          "legacy_cert_with_preadopted_returns_false",
+			certShareMode: "rw",
+			acmeInMemory:  acmeKey,
+			preAdopted:    sha256Sum(otherKey),
+			certSecret:    map[string][]byte{}, // no fingerprint field
+			want:          false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			client := &kubeclient.FakeClient{
+				GetSecretImpl: func(ctx context.Context, name string) (*kubeapi.Secret, error) {
+					if tt.certGetErr != nil {
+						return nil, tt.certGetErr
+					}
+					return &kubeapi.Secret{Data: tt.certSecret}, nil
+				},
+			}
+			s := &Store{
+				client:             client,
+				certShareMode:      tt.certShareMode,
+				memory:             mem.Store{},
+				preAdoptedLocalKey: tt.preAdopted,
+				logf:               t.Logf,
+			}
+			if len(tt.acmeInMemory) > 0 {
+				s.memory.WriteState(ipn.StateKey(acmeAccountStateKey), tt.acmeInMemory)
+			}
+
+			got, err := s.ShouldUseARIReplacesForRenewal(domain)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("err = %v, wantErr = %v", err, tt.wantErr)
+			}
+			if got != tt.want {
+				t.Errorf("got %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestWriteTLSCertAndKeyStampsFingerprint(t *testing.T) {
+	const domain = "app.tailnetxyz.ts.net"
+	acmeKey := []byte("-----BEGIN PRIVATE KEY-----\naccount\n-----END PRIVATE KEY-----")
+	wantFP := sha256Sum(acmeKey)
+
+	tests := []struct {
+		name         string
+		certMode     string
+		acmeInMemory []byte
+		wantFP       []byte // expected value of keyACMEAcctFP field; nil means field must be absent
+	}{
+		{
+			name:         "rw_mode_with_acme_key_stamps_fingerprint",
+			certMode:     "rw",
+			acmeInMemory: acmeKey,
+			wantFP:       wantFP,
+		},
+		{
+			name:     "rw_mode_no_acme_key_no_stamp",
+			certMode: "rw",
+		},
+		{
+			name:         "non_share_mode_no_stamp",
+			certMode:     "",
+			acmeInMemory: acmeKey,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			secret := map[string][]byte{}
+			client := &kubeclient.FakeClient{
+				GetSecretImpl: func(ctx context.Context, name string) (*kubeapi.Secret, error) {
+					return &kubeapi.Secret{Data: secret}, nil
+				},
+				CheckSecretPermissionsImpl: func(ctx context.Context, name string) (bool, bool, error) {
+					return true, true, nil
+				},
+				JSONPatchResourceImpl: func(ctx context.Context, name, resourceType string, patches []kubeclient.JSONPatch) error {
+					for _, p := range patches {
+						if p.Op == "add" && p.Path == "/data" {
+							secret = p.Value.(map[string][]byte)
+						} else if p.Op == "add" && strings.HasPrefix(p.Path, "/data/") {
+							secret[strings.TrimPrefix(p.Path, "/data/")] = p.Value.([]byte)
+						}
+					}
+					return nil
+				},
+			}
+			s := &Store{
+				client:        client,
+				canPatch:      true,
+				secretName:    "ts-state",
+				certShareMode: tt.certMode,
+				memory:        mem.Store{},
+				logf:          t.Logf,
+			}
+			if len(tt.acmeInMemory) > 0 {
+				s.memory.WriteState(ipn.StateKey(acmeAccountStateKey), tt.acmeInMemory)
+			}
+
+			if err := s.WriteTLSCertAndKey(domain, []byte("cert"), []byte("key")); err != nil {
+				t.Fatalf("WriteTLSCertAndKey: %v", err)
+			}
+
+			gotFP, present := secret[keyACMEAcctFP]
+			if tt.wantFP == nil {
+				if present {
+					t.Errorf("unexpected fingerprint stamped: %x", gotFP)
+				}
+				return
+			}
+			if !bytes.Equal(gotFP, tt.wantFP) {
+				t.Errorf("fingerprint = %x, want %x", gotFP, tt.wantFP)
+			}
+		})
+	}
+}
diff --git a/ipn/store/mem/store_mem.go b/ipn/store/mem/store_mem.go
index 247714c9a..eafa429c7 100644
--- a/ipn/store/mem/store_mem.go
+++ b/ipn/store/mem/store_mem.go
@@ -49,7 +49,11 @@ func (s *Store) WriteState(id ipn.StateKey, bs []byte) error {
 	if s.cache == nil {
 		s.cache = map[ipn.StateKey][]byte{}
 	}
-	s.cache[id] = bytes.Clone(bs)
+	if bs == nil {
+		delete(s.cache, id)
+	} else {
+		s.cache[id] = bytes.Clone(bs)
+	}
 	return nil
 }
 
diff --git a/ipn/store/stores.go b/ipn/store/stores.go
index fd51f8c38..31a055322 100644
--- a/ipn/store/stores.go
+++ b/ipn/store/stores.go
@@ -214,7 +214,11 @@ func (s *FileStore) WriteState(id ipn.StateKey, bs []byte) error {
 	if bytes.Equal(s.cache[id], bs) {
 		return nil
 	}
-	s.cache[id] = bytes.Clone(bs)
+	if bs == nil {
+		delete(s.cache, id)
+	} else {
+		s.cache[id] = bytes.Clone(bs)
+	}
 	bs, err := json.MarshalIndent(s.cache, "", "  ")
 	if err != nil {
 		return err
diff --git a/ipn/store/stores_test.go b/ipn/store/stores_test.go
index 345b1c103..c9f4e3348 100644
--- a/ipn/store/stores_test.go
+++ b/ipn/store/stores_test.go
@@ -135,11 +135,41 @@ func testStoreSemantics(t *testing.T, store ipn.StateStore) {
 	}
 }
 
+func testStoreDeleteSemantics(t *testing.T, store ipn.StateStore) {
+	t.Helper()
+
+	// Write a key, verify it exists.
+	if err := store.WriteState("delme", []byte("val")); err != nil {
+		t.Fatalf("WriteState: %v", err)
+	}
+	if bs, err := store.ReadState("delme"); err != nil {
+		t.Fatalf("ReadState after write: %v", err)
+	} else if string(bs) != "val" {
+		t.Fatalf("ReadState after write: got %q, want %q", bs, "val")
+	}
+
+	// Delete by writing nil.
+	if err := store.WriteState("delme", nil); err != nil {
+		t.Fatalf("WriteState(nil): %v", err)
+	}
+
+	// Read should return ErrStateNotExist.
+	if _, err := store.ReadState("delme"); err != ipn.ErrStateNotExist {
+		t.Fatalf("ReadState after delete: got err %v, want ErrStateNotExist", err)
+	}
+
+	// Delete of a non-existent key should not error.
+	if err := store.WriteState("never-existed", nil); err != nil {
+		t.Fatalf("WriteState(nil) on non-existent key: %v", err)
+	}
+}
+
 func TestMemoryStore(t *testing.T) {
 	tstest.PanicOnLog()
 
 	store := new(mem.Store)
 	testStoreSemantics(t, store)
+	testStoreDeleteSemantics(t, store)
 }
 
 func TestFileStore(t *testing.T) {
@@ -154,6 +184,7 @@ func TestFileStore(t *testing.T) {
 	}
 
 	testStoreSemantics(t, store)
+	testStoreDeleteSemantics(t, store)
 
 	// Build a brand new file store and check that both IDs written
 	// above are still there.
@@ -176,4 +207,9 @@ func TestFileStore(t *testing.T) {
 			t.Errorf("reading %q (2nd store): got %q, want %q", key, bs, want)
 		}
 	}
+
+	// Verify deleted key is still gone after reload.
+	if _, err := store.ReadState("delme"); err != ipn.ErrStateNotExist {
+		t.Fatalf("reading deleted key from reloaded store: got err %v, want ErrStateNotExist", err)
+	}
 }
diff --git a/k8s-operator/api-proxy/proxy.go b/k8s-operator/api-proxy/proxy.go
index acc7b6234..73a9884b2 100644
--- a/k8s-operator/api-proxy/proxy.go
+++ b/k8s-operator/api-proxy/proxy.go
@@ -31,6 +31,7 @@ import (
 	"tailscale.com/client/tailscale/apitype"
 	ksr "tailscale.com/k8s-operator/sessionrecording"
 	"tailscale.com/kube/kubetypes"
+	"tailscale.com/net/netutil"
 	"tailscale.com/net/netx"
 	"tailscale.com/sessionrecording"
 	"tailscale.com/tailcfg"
@@ -64,7 +65,7 @@ func NewAPIServerProxy(zlog *zap.SugaredLogger, restConfig *rest.Config, ts *tsn
 		return nil, fmt.Errorf("could not get rest.TransportConfig(): %w", err)
 	}
 
-	tr := http.DefaultTransport.(*http.Transport).Clone()
+	tr := netutil.NewDefaultTransport()
 	tr.TLSClientConfig, err = transport.TLSConfigFor(cfg)
 	if err != nil {
 		return nil, fmt.Errorf("could not get transport.TLSConfigFor(): %w", err)
diff --git a/k8s-operator/api.md b/k8s-operator/api.md
index 5a60f66e0..d4dc6f864 100644
--- a/k8s-operator/api.md
+++ b/k8s-operator/api.md
@@ -12,6 +12,8 @@
 - [ConnectorList](#connectorlist)
 - [DNSConfig](#dnsconfig)
 - [DNSConfigList](#dnsconfiglist)
+- [PeerRelay](#peerrelay)
+- [PeerRelayList](#peerrelaylist)
 - [ProxyClass](#proxyclass)
 - [ProxyClassList](#proxyclasslist)
 - [ProxyGroup](#proxygroup)
@@ -349,6 +351,7 @@ _Validation:_
 
 _Appears in:_
 - [ConnectorSpec](#connectorspec)
+- [PeerRelaySpec](#peerrelayspec)
 - [ProxyGroupSpec](#proxygroupspec)
 
 
@@ -483,6 +486,8 @@ _Appears in:_
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
 | `tolerations` _[Toleration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#toleration-v1-core) array_ | If specified, applies tolerations to the pods deployed by the DNSConfig resource. |  |  |
+| `affinity` _[Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#affinity-v1-core)_ | If specified, applies affinity rules to the pods deployed by the DNSConfig resource. |  |  |
+| `nodeSelector` _object (keys:string, values:string)_ | If specified, applies node selector rules to the pods deployed by the DNSConfig resource. |  |  |
 
 
 #### NameserverService
@@ -534,6 +539,154 @@ _Appears in:_
 | `selector` _object (keys:string, values:string)_ | A selector which will be used to select the node's that will have their `ExternalIP`'s advertised<br />by the ProxyGroup as Static Endpoints. |  |  |
 
 
+#### PeerRelay
+
+
+
+
+
+
+
+_Appears in:_
+- [PeerRelayList](#peerrelaylist)
+
+| Field | Description | Default | Validation |
+| --- | --- | --- | --- |
+| `apiVersion` _string_ | `tailscale.com/v1alpha1` | | |
+| `kind` _string_ | `PeerRelay` | | |
+| `kind` _string_ | Kind is a string value representing the REST resource this object represents.<br />Servers may infer this from the endpoint the client submits requests to.<br />Cannot be updated.<br />In CamelCase.<br />More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |  |  |
+| `apiVersion` _string_ | APIVersion defines the versioned schema of this representation of an object.<br />Servers should convert recognized schemas to the latest internal value, and<br />may reject unrecognized values.<br />More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |  |  |
+| `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. |  |  |
+| `spec` _[PeerRelaySpec](#peerrelayspec)_ | Spec describes the desired state of the PeerRelay.<br />More info:<br />https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status |  |  |
+| `status` _[PeerRelayStatus](#peerrelaystatus)_ | Status describes the status of the PeerRelay. This is set<br />and managed by the Tailscale operator. |  |  |
+
+
+#### PeerRelayAWS
+
+
+
+PeerRelayAWS contains AWS-specific configuration for a PeerRelay.
+
+
+
+_Appears in:_
+- [PeerRelaySpec](#peerrelayspec)
+
+| Field | Description | Default | Validation |
+| --- | --- | --- | --- |
+| `elasticIPs` _[PeerRelayAWSElasticIP](#peerrelayawselasticip) array_ | ElasticIPs pins each replica to a specific AWS EIP allocation and subnet. Only meaningful when Network Load<br />Balancers are provisioned by the AWS Load Balancer Controller. ElasticIPs supplies one allocation-subnet pair<br />per replica: replica N uses ElasticIPs[N]. The list must be at least as long as spec.replicas so every replica<br />has a distinct EIP; extra entries are permitted so that scale-up doesn't immediately trip validation.<br />When set, the reconciler stamps<br />service.beta.kubernetes.io/aws-load-balancer-eip-allocations and<br />service.beta.kubernetes.io/aws-load-balancer-subnets on each per-replica Service, overriding any values in<br />spec.service.annotations. |  | MinItems: 1 <br /> |
+
+
+#### PeerRelayAWSElasticIP
+
+
+
+PeerRelayAWSElasticIP pairs an EIP allocation with the subnet in the same AZ.
+
+
+
+_Appears in:_
+- [PeerRelayAWS](#peerrelayaws)
+
+| Field | Description | Default | Validation |
+| --- | --- | --- | --- |
+| `allocationID` _string_ | AllocationID is the AWS EIP allocation ID (e.g. eipalloc-0123abcd) whose public IP this replica is reachable<br />on. Stamped as service.beta.kubernetes.io/aws-load-balancer-eip-allocations on the replica's Service. |  | Pattern: `^eipalloc-[0-9a-f]+$` <br /> |
+| `subnetID` _string_ | SubnetID is the AWS subnet in the same availability zone as AllocationID (e.g. subnet-0123abcd). Stamped as<br />service.beta.kubernetes.io/aws-load-balancer-subnets on the replica's Service so the NLB is provisioned in<br />the same AZ as the EIP. |  | Pattern: `^subnet-[0-9a-f]+$` <br /> |
+
+
+#### PeerRelayEndpoint
+
+
+
+
+
+
+
+_Appears in:_
+- [PeerRelayStatus](#peerrelaystatus)
+
+| Field | Description | Default | Validation |
+| --- | --- | --- | --- |
+| `replica` _integer_ | Replica is the zero-based index of the peer relay replica this endpoint targets. |  |  |
+| `address` _string_ | Address is the public IP or hostname the cloud has allocated for this replica's LoadBalancer Service.<br />Peers reach this relay by connecting to Address:Port over UDP. |  |  |
+| `port` _integer_ | Port is the UDP port the peer relay listens on. |  |  |
+
+
+#### PeerRelayList
+
+
+
+
+
+
+
+
+
+| Field | Description | Default | Validation |
+| --- | --- | --- | --- |
+| `apiVersion` _string_ | `tailscale.com/v1alpha1` | | |
+| `kind` _string_ | `PeerRelayList` | | |
+| `kind` _string_ | Kind is a string value representing the REST resource this object represents.<br />Servers may infer this from the endpoint the client submits requests to.<br />Cannot be updated.<br />In CamelCase.<br />More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |  |  |
+| `apiVersion` _string_ | APIVersion defines the versioned schema of this representation of an object.<br />Servers should convert recognized schemas to the latest internal value, and<br />may reject unrecognized values.<br />More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |  |  |
+| `metadata` _[ListMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#listmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. |  |  |
+| `items` _[PeerRelay](#peerrelay) array_ |  |  |  |
+
+
+#### PeerRelayService
+
+
+
+
+
+
+
+_Appears in:_
+- [PeerRelaySpec](#peerrelayspec)
+
+| Field | Description | Default | Validation |
+| --- | --- | --- | --- |
+| `annotations` _object (keys:string, values:string)_ | Annotations to apply to the LoadBalancer service. Any annotations that conflict with those used by known<br />cloud providers to ensure IP addresses rather than DNS names are ignored. |  |  |
+
+
+#### PeerRelaySpec
+
+
+
+
+
+
+
+_Appears in:_
+- [PeerRelay](#peerrelay)
+
+| Field | Description | Default | Validation |
+| --- | --- | --- | --- |
+| `tags` _[Tags](#tags)_ | Tags that the Tailscale node will be tagged with.<br />Defaults to [tag:k8s].<br />To autoapprove the device defined by a PeerRelay,<br />you can configure Tailscale ACLs to give these tags the necessary<br />permissions.<br />See https://tailscale.com/kb/1337/acl-syntax#autoapprovers.<br />If you specify custom tags here, you must also make the operator an owner of these tags.<br />See  https://tailscale.com/kb/1236/kubernetes-operator/#setting-up-the-kubernetes-operator.<br />Tags cannot be changed once a PeerRelay node has been created.<br />Tag values must be in form ^tag:[a-zA-Z][a-zA-Z0-9-]*$. |  | Pattern: `^tag:[a-zA-Z][a-zA-Z0-9-]*$` <br />Type: string <br /> |
+| `hostnamePrefix` _[HostnamePrefix](#hostnameprefix)_ | HostnamePrefix specifies the hostname prefix for each<br />replica. Each device will have the integer number<br />from its StatefulSet pod appended to this prefix to form the full hostname.<br />HostnamePrefix can contain lower case letters, numbers and dashes, it<br />must not start with a dash and must be between 1 and 62 characters long. |  | Pattern: `^[a-z0-9][a-z0-9-]{0,61}$` <br />Type: string <br /> |
+| `proxyClass` _string_ | ProxyClass is the name of the ProxyClass custom resource that<br />contains configuration options that should be applied to the<br />resources created for this PeerRelay. If unset, the operator will<br />create resources with the default configuration. |  |  |
+| `replicas` _integer_ | Replicas specifies how many devices to create. Set this to enable<br />high availability for peer relays.<br />https://tailscale.com/kb/1115/high-availability. Defaults to 1. | 1 | Minimum: 0 <br /> |
+| `tailnet` _string_ | Tailnet specifies the tailnet this PeerRelay should join. If blank, the default tailnet is used. When set, this<br />name must match that of a valid Tailnet resource. This field is immutable and cannot be changed once set. |  |  |
+| `service` _[PeerRelayService](#peerrelayservice)_ | Service contains configuration values to modify the LoadBalancer service used to expose the peer relay. |  |  |
+| `aws` _[PeerRelayAWS](#peerrelayaws)_ | AWS contains configuration for pinning each replica to a specific AWS Elastic IP and subnet. Only meaningful<br />when running on EKS with the AWS Load Balancer Controller. When set, the per-replica values override any<br />aws-load-balancer-eip-allocations or aws-load-balancer-subnets values supplied via spec.service.annotations. |  |  |
+
+
+#### PeerRelayStatus
+
+
+
+
+
+
+
+_Appears in:_
+- [PeerRelay](#peerrelay)
+
+| Field | Description | Default | Validation |
+| --- | --- | --- | --- |
+| `conditions` _[Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#condition-v1-meta) array_ |  |  |  |
+| `endpoints` _[PeerRelayEndpoint](#peerrelayendpoint) array_ | Endpoints lists the public address:port pairs each peer relay replica is reachable on. There is one entry<br />per replica whose LoadBalancer Service has been assigned a public address; entries appear as the underlying<br />cloud provisions each Service. |  |  |
+
+
 #### Pod
 
 
@@ -1231,6 +1384,7 @@ _Validation:_
 
 _Appears in:_
 - [ConnectorSpec](#connectorspec)
+- [PeerRelaySpec](#peerrelayspec)
 - [ProxyGroupSpec](#proxygroupspec)
 - [RecorderSpec](#recorderspec)
 
@@ -1271,7 +1425,7 @@ _Appears in:_
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
-| `secretName` _string_ | The name of the secret containing the OAuth credentials. This secret must contain two fields "client_id" and<br />"client_secret". |  |  |
+| `secretName` _string_ | The name of the secret containing the credentials used to authenticate with this Tailnet. The secret must always<br />contain a "client_id" field. To authenticate with a static OAuth client, also set "client_secret". To authenticate<br />via workload identity federation, set "audience" to the audience value expected by the Tailscale OAuth<br />client; the operator will mint a ServiceAccount token for itself with that audience and exchange it for an API<br />token. "client_secret" and "audience" are mutually exclusive. |  |  |
 
 
 #### TailnetDevice
@@ -1326,7 +1480,7 @@ _Appears in:_
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
 | `loginUrl` _string_ | URL of the control plane to be used by all resources managed by the operator using this Tailnet. |  |  |
-| `credentials` _[TailnetCredentials](#tailnetcredentials)_ | Denotes the location of the OAuth credentials to use for authenticating with this Tailnet. |  |  |
+| `credentials` _[TailnetCredentials](#tailnetcredentials)_ | Denotes the location of the credentials to use for authenticating with this Tailnet. |  |  |
 
 
 #### TailnetStatus
diff --git a/k8s-operator/apis/v1alpha1/register.go b/k8s-operator/apis/v1alpha1/register.go
index 125d74198..367631631 100644
--- a/k8s-operator/apis/v1alpha1/register.go
+++ b/k8s-operator/apis/v1alpha1/register.go
@@ -71,6 +71,8 @@ func addKnownTypes(scheme *runtime.Scheme) error {
 		&TailnetList{},
 		&ProxyGroupPolicy{},
 		&ProxyGroupPolicyList{},
+		&PeerRelay{},
+		&PeerRelayList{},
 	)
 
 	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
diff --git a/k8s-operator/apis/v1alpha1/types_peerrelay.go b/k8s-operator/apis/v1alpha1/types_peerrelay.go
new file mode 100644
index 000000000..251e21663
--- /dev/null
+++ b/k8s-operator/apis/v1alpha1/types_peerrelay.go
@@ -0,0 +1,168 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !plan9
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// Code comments on these types should be treated as user facing documentation-
+// they will appear on the PeerRelay CRD i.e. if someone runs kubectl explain peerrelay.
+
+var PeerRelayKind = "PeerRelay"
+
+// +kubebuilder:object:root=true
+// +kubebuilder:subresource:status
+// +kubebuilder:resource:scope=Cluster,shortName=pr
+// +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp"
+// +kubebuilder:printcolumn:name="Status",type="string",JSONPath=`.status.conditions[?(@.type == "PeerRelayReady")].reason`,description="Status of the deployed PeerRelay resources."
+// +kubebuilder:printcolumn:name="Endpoints",type="string",JSONPath=`.status.endpoints[*].address`,description="Public addresses the peer relay replicas are reachable on."
+
+type PeerRelay struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitzero"`
+
+	// Spec describes the desired state of the PeerRelay.
+	// More info:
+	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+	Spec PeerRelaySpec `json:"spec"`
+
+	// Status describes the status of the PeerRelay. This is set
+	// and managed by the Tailscale operator.
+	// +optional
+	Status PeerRelayStatus `json:"status"`
+}
+
+// +kubebuilder:object:root=true
+
+type PeerRelayList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata"`
+
+	Items []PeerRelay `json:"items"`
+}
+
+// +kubebuilder:validation:XValidation:rule="!has(self.aws) || !has(self.aws.elasticIPs) || self.aws.elasticIPs.size() >= self.replicas",message="spec.aws.elasticIPs must contain at least one entry per replica"
+type PeerRelaySpec struct {
+	// Tags that the Tailscale node will be tagged with.
+	// Defaults to [tag:k8s].
+	// To autoapprove the device defined by a PeerRelay,
+	// you can configure Tailscale ACLs to give these tags the necessary
+	// permissions.
+	// See https://tailscale.com/kb/1337/acl-syntax#autoapprovers.
+	// If you specify custom tags here, you must also make the operator an owner of these tags.
+	// See  https://tailscale.com/kb/1236/kubernetes-operator/#setting-up-the-kubernetes-operator.
+	// Tags cannot be changed once a PeerRelay node has been created.
+	// Tag values must be in form ^tag:[a-zA-Z][a-zA-Z0-9-]*$.
+	// +optional
+	Tags Tags `json:"tags,omitempty"`
+
+	// HostnamePrefix specifies the hostname prefix for each
+	// replica. Each device will have the integer number
+	// from its StatefulSet pod appended to this prefix to form the full hostname.
+	// HostnamePrefix can contain lower case letters, numbers and dashes, it
+	// must not start with a dash and must be between 1 and 62 characters long.
+	// +optional
+	HostnamePrefix HostnamePrefix `json:"hostnamePrefix,omitzero"`
+
+	// ProxyClass is the name of the ProxyClass custom resource that
+	// contains configuration options that should be applied to the
+	// resources created for this PeerRelay. If unset, the operator will
+	// create resources with the default configuration.
+	// +optional
+	ProxyClass string `json:"proxyClass,omitempty"`
+
+	// Replicas specifies how many devices to create. Set this to enable
+	// high availability for peer relays.
+	// https://tailscale.com/kb/1115/high-availability. Defaults to 1.
+	// +optional
+	// +kubebuilder:validation:Minimum=0
+	// +kubebuilder:default=1
+	Replicas *int32 `json:"replicas,omitzero"`
+
+	// Tailnet specifies the tailnet this PeerRelay should join. If blank, the default tailnet is used. When set, this
+	// name must match that of a valid Tailnet resource. This field is immutable and cannot be changed once set.
+	// +optional
+	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="PeerRelay tailnet is immutable"
+	Tailnet string `json:"tailnet,omitempty"`
+
+	// Service contains configuration values to modify the LoadBalancer service used to expose the peer relay.
+	// +optional
+	Service *PeerRelayService `json:"service,omitzero"`
+
+	// AWS contains configuration for pinning each replica to a specific AWS Elastic IP and subnet. Only meaningful
+	// when running on EKS with the AWS Load Balancer Controller. When set, the per-replica values override any
+	// aws-load-balancer-eip-allocations or aws-load-balancer-subnets values supplied via spec.service.annotations.
+	// +optional
+	AWS *PeerRelayAWS `json:"aws,omitzero"`
+}
+
+type PeerRelayService struct {
+	// Annotations to apply to the LoadBalancer service. Any annotations that conflict with those used by known
+	// cloud providers to ensure IP addresses rather than DNS names are ignored.
+	// +optional
+	Annotations map[string]string `json:"annotations,omitempty"`
+}
+
+// PeerRelayAWS contains AWS-specific configuration for a PeerRelay.
+type PeerRelayAWS struct {
+	// ElasticIPs pins each replica to a specific AWS EIP allocation and subnet. Only meaningful when Network Load
+	// Balancers are provisioned by the AWS Load Balancer Controller. ElasticIPs supplies one allocation-subnet pair
+	// per replica: replica N uses ElasticIPs[N]. The list must be at least as long as spec.replicas so every replica
+	// has a distinct EIP; extra entries are permitted so that scale-up doesn't immediately trip validation.
+	//
+	// When set, the reconciler stamps
+	// service.beta.kubernetes.io/aws-load-balancer-eip-allocations and
+	// service.beta.kubernetes.io/aws-load-balancer-subnets on each per-replica Service, overriding any values in
+	// spec.service.annotations.
+	// +listType=atomic
+	// +kubebuilder:validation:MinItems=1
+	ElasticIPs []PeerRelayAWSElasticIP `json:"elasticIPs"`
+}
+
+// PeerRelayAWSElasticIP pairs an EIP allocation with the subnet in the same AZ.
+type PeerRelayAWSElasticIP struct {
+	// AllocationID is the AWS EIP allocation ID (e.g. eipalloc-0123abcd) whose public IP this replica is reachable
+	// on. Stamped as service.beta.kubernetes.io/aws-load-balancer-eip-allocations on the replica's Service.
+	// +kubebuilder:validation:Pattern=`^eipalloc-[0-9a-f]+$`
+	AllocationID string `json:"allocationID"`
+
+	// SubnetID is the AWS subnet in the same availability zone as AllocationID (e.g. subnet-0123abcd). Stamped as
+	// service.beta.kubernetes.io/aws-load-balancer-subnets on the replica's Service so the NLB is provisioned in
+	// the same AZ as the EIP.
+	// +kubebuilder:validation:Pattern=`^subnet-[0-9a-f]+$`
+	SubnetID string `json:"subnetID"`
+}
+
+type PeerRelayStatus struct {
+	// +listType=map
+	// +listMapKey=type
+	// +optional
+	Conditions []metav1.Condition `json:"conditions"`
+
+	// Endpoints lists the public address:port pairs each peer relay replica is reachable on. There is one entry
+	// per replica whose LoadBalancer Service has been assigned a public address; entries appear as the underlying
+	// cloud provisions each Service.
+	// +listType=map
+	// +listMapKey=replica
+	// +optional
+	Endpoints []PeerRelayEndpoint `json:"endpoints,omitempty"`
+}
+
+type PeerRelayEndpoint struct {
+	// Replica is the zero-based index of the peer relay replica this endpoint targets.
+	Replica int32 `json:"replica"`
+
+	// Address is the public IP or hostname the cloud has allocated for this replica's LoadBalancer Service.
+	// Peers reach this relay by connecting to Address:Port over UDP.
+	Address string `json:"address"`
+
+	// Port is the UDP port the peer relay listens on.
+	Port int32 `json:"port"`
+}
+
+// PeerRelayReady is set to True if the PeerRelay is available for use by operator workloads.
+const PeerRelayReady ConditionType = `PeerRelayReady`
diff --git a/k8s-operator/apis/v1alpha1/types_tailnet.go b/k8s-operator/apis/v1alpha1/types_tailnet.go
index b11b2cf17..cb55fa077 100644
--- a/k8s-operator/apis/v1alpha1/types_tailnet.go
+++ b/k8s-operator/apis/v1alpha1/types_tailnet.go
@@ -48,13 +48,16 @@ type TailnetSpec struct {
 	// URL of the control plane to be used by all resources managed by the operator using this Tailnet.
 	// +optional
 	LoginURL string `json:"loginUrl,omitempty"`
-	// Denotes the location of the OAuth credentials to use for authenticating with this Tailnet.
+	// Denotes the location of the credentials to use for authenticating with this Tailnet.
 	Credentials TailnetCredentials `json:"credentials"`
 }
 
 type TailnetCredentials struct {
-	// The name of the secret containing the OAuth credentials. This secret must contain two fields "client_id" and
-	// "client_secret".
+	// The name of the secret containing the credentials used to authenticate with this Tailnet. The secret must always
+	// contain a "client_id" field. To authenticate with a static OAuth client, also set "client_secret". To authenticate
+	// via workload identity federation, set "audience" to the audience value expected by the Tailscale OAuth
+	// client; the operator will mint a ServiceAccount token for itself with that audience and exchange it for an API
+	// token. "client_secret" and "audience" are mutually exclusive.
 	SecretName string `json:"secretName"`
 }
 
diff --git a/k8s-operator/apis/v1alpha1/types_tsdnsconfig.go b/k8s-operator/apis/v1alpha1/types_tsdnsconfig.go
index c1a2e7906..529114c2e 100644
--- a/k8s-operator/apis/v1alpha1/types_tsdnsconfig.go
+++ b/k8s-operator/apis/v1alpha1/types_tsdnsconfig.go
@@ -113,6 +113,12 @@ type NameserverPod struct {
 	// If specified, applies tolerations to the pods deployed by the DNSConfig resource.
 	// +optional
 	Tolerations []corev1.Toleration `json:"tolerations,omitempty"`
+	// If specified, applies affinity rules to the pods deployed by the DNSConfig resource.
+	// +optional
+	Affinity *corev1.Affinity `json:"affinity,omitzero"`
+	// If specified, applies node selector rules to the pods deployed by the DNSConfig resource.
+	// +optional
+	NodeSelector map[string]string `json:"nodeSelector,omitzero"`
 }
 
 type DNSConfigStatus struct {
diff --git a/k8s-operator/apis/v1alpha1/zz_generated.deepcopy.go b/k8s-operator/apis/v1alpha1/zz_generated.deepcopy.go
index 2528c89f3..4f4c1ee57 100644
--- a/k8s-operator/apis/v1alpha1/zz_generated.deepcopy.go
+++ b/k8s-operator/apis/v1alpha1/zz_generated.deepcopy.go
@@ -469,6 +469,18 @@ func (in *NameserverPod) DeepCopyInto(out *NameserverPod) {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
 	}
+	if in.Affinity != nil {
+		in, out := &in.Affinity, &out.Affinity
+		*out = new(corev1.Affinity)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.NodeSelector != nil {
+		in, out := &in.NodeSelector, &out.NodeSelector
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NameserverPod.
@@ -538,6 +550,199 @@ func (in *NodePortConfig) DeepCopy() *NodePortConfig {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PeerRelay) DeepCopyInto(out *PeerRelay) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PeerRelay.
+func (in *PeerRelay) DeepCopy() *PeerRelay {
+	if in == nil {
+		return nil
+	}
+	out := new(PeerRelay)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *PeerRelay) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PeerRelayAWS) DeepCopyInto(out *PeerRelayAWS) {
+	*out = *in
+	if in.ElasticIPs != nil {
+		in, out := &in.ElasticIPs, &out.ElasticIPs
+		*out = make([]PeerRelayAWSElasticIP, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PeerRelayAWS.
+func (in *PeerRelayAWS) DeepCopy() *PeerRelayAWS {
+	if in == nil {
+		return nil
+	}
+	out := new(PeerRelayAWS)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PeerRelayAWSElasticIP) DeepCopyInto(out *PeerRelayAWSElasticIP) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PeerRelayAWSElasticIP.
+func (in *PeerRelayAWSElasticIP) DeepCopy() *PeerRelayAWSElasticIP {
+	if in == nil {
+		return nil
+	}
+	out := new(PeerRelayAWSElasticIP)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PeerRelayEndpoint) DeepCopyInto(out *PeerRelayEndpoint) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PeerRelayEndpoint.
+func (in *PeerRelayEndpoint) DeepCopy() *PeerRelayEndpoint {
+	if in == nil {
+		return nil
+	}
+	out := new(PeerRelayEndpoint)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PeerRelayList) DeepCopyInto(out *PeerRelayList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]PeerRelay, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PeerRelayList.
+func (in *PeerRelayList) DeepCopy() *PeerRelayList {
+	if in == nil {
+		return nil
+	}
+	out := new(PeerRelayList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *PeerRelayList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PeerRelayService) DeepCopyInto(out *PeerRelayService) {
+	*out = *in
+	if in.Annotations != nil {
+		in, out := &in.Annotations, &out.Annotations
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PeerRelayService.
+func (in *PeerRelayService) DeepCopy() *PeerRelayService {
+	if in == nil {
+		return nil
+	}
+	out := new(PeerRelayService)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PeerRelaySpec) DeepCopyInto(out *PeerRelaySpec) {
+	*out = *in
+	if in.Tags != nil {
+		in, out := &in.Tags, &out.Tags
+		*out = make(Tags, len(*in))
+		copy(*out, *in)
+	}
+	if in.Replicas != nil {
+		in, out := &in.Replicas, &out.Replicas
+		*out = new(int32)
+		**out = **in
+	}
+	if in.Service != nil {
+		in, out := &in.Service, &out.Service
+		*out = new(PeerRelayService)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.AWS != nil {
+		in, out := &in.AWS, &out.AWS
+		*out = new(PeerRelayAWS)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PeerRelaySpec.
+func (in *PeerRelaySpec) DeepCopy() *PeerRelaySpec {
+	if in == nil {
+		return nil
+	}
+	out := new(PeerRelaySpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PeerRelayStatus) DeepCopyInto(out *PeerRelayStatus) {
+	*out = *in
+	if in.Conditions != nil {
+		in, out := &in.Conditions, &out.Conditions
+		*out = make([]v1.Condition, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.Endpoints != nil {
+		in, out := &in.Endpoints, &out.Endpoints
+		*out = make([]PeerRelayEndpoint, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PeerRelayStatus.
+func (in *PeerRelayStatus) DeepCopy() *PeerRelayStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(PeerRelayStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Pod) DeepCopyInto(out *Pod) {
 	*out = *in
diff --git a/k8s-operator/conditions.go b/k8s-operator/conditions.go
index 89b83dd5f..15fef5049 100644
--- a/k8s-operator/conditions.go
+++ b/k8s-operator/conditions.go
@@ -100,6 +100,14 @@ func SetTailnetCondition(tn *tsapi.Tailnet, conditionType tsapi.ConditionType, s
 	tn.Status.Conditions = conds
 }
 
+// SetPeerRelayCondition ensures that PeerRelay status has a condition with the
+// given attributes. LastTransitionTime gets set every time condition's status
+// changes.
+func SetPeerRelayCondition(pr *tsapi.PeerRelay, conditionType tsapi.ConditionType, status metav1.ConditionStatus, reason, message string, clock tstime.Clock, logger *zap.SugaredLogger) {
+	conds := updateCondition(pr.Status.Conditions, conditionType, status, reason, message, pr.Generation, clock, logger)
+	pr.Status.Conditions = conds
+}
+
 func updateCondition(conds []metav1.Condition, conditionType tsapi.ConditionType, status metav1.ConditionStatus, reason, message string, gen int64, clock tstime.Clock, logger *zap.SugaredLogger) []metav1.Condition {
 	newCondition := metav1.Condition{
 		Type:               string(conditionType),
diff --git a/k8s-operator/reconciler/peerrelay/authkey.go b/k8s-operator/reconciler/peerrelay/authkey.go
new file mode 100644
index 000000000..ca0270d69
--- /dev/null
+++ b/k8s-operator/reconciler/peerrelay/authkey.go
@@ -0,0 +1,18 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !plan9
+
+package peerrelay
+
+import (
+	tsapi "tailscale.com/k8s-operator/apis/v1alpha1"
+)
+
+func (r *Reconciler) peerRelayTags(pr *tsapi.PeerRelay) []string {
+	tags := pr.Spec.Tags.Stringify()
+	if len(tags) == 0 {
+		return r.defaultTags
+	}
+	return tags
+}
diff --git a/k8s-operator/reconciler/peerrelay/device.go b/k8s-operator/reconciler/peerrelay/device.go
new file mode 100644
index 000000000..81061717d
--- /dev/null
+++ b/k8s-operator/reconciler/peerrelay/device.go
@@ -0,0 +1,66 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !plan9
+
+package peerrelay
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"go.uber.org/zap"
+	corev1 "k8s.io/api/core/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	tailscaleclient "tailscale.com/client/tailscale/v2"
+
+	tsapi "tailscale.com/k8s-operator/apis/v1alpha1"
+	"tailscale.com/k8s-operator/reconciler/tailscaled"
+	"tailscale.com/kube/kubetypes"
+)
+
+func (r *Reconciler) deleteDevicesFrom(ctx context.Context, logger *zap.SugaredLogger, pr *tsapi.PeerRelay, fromIdx int32) error {
+	if r.tsClients == nil {
+		return nil
+	}
+
+	tsc, err := r.tsClients.For(pr.Spec.Tailnet)
+	if err != nil {
+		return fmt.Errorf("failed to resolve Tailscale API client for tailnet %q: %w", pr.Spec.Tailnet, err)
+	}
+
+	labels := peerRelayLabels(pr.Name)
+	labels[kubetypes.LabelSecretType] = kubetypes.LabelSecretTypeState
+
+	var list corev1.SecretList
+	if err = r.List(ctx, &list, client.InNamespace(r.tailscaleNamespace), client.MatchingLabels(labels)); err != nil {
+		return fmt.Errorf("failed to list state Secrets: %w", err)
+	}
+
+	var errs []error
+	for i := range list.Items {
+		s := &list.Items[i]
+		idx, ok := replicaIndexFromLabels(s.Labels)
+		if !ok || idx < fromIdx {
+			continue
+		}
+
+		if deviceID := tailscaled.DeviceIDFromStateSecret(s); deviceID != "" {
+			logger.Debugf("deleting tailnet device %q", deviceID)
+			if err = tsc.Devices().Delete(ctx, deviceID); err != nil && !tailscaleclient.IsNotFound(err) {
+				errs = append(errs, fmt.Errorf("failed to delete tailnet device %q: %w", deviceID, err))
+				continue
+			}
+		}
+
+		logger.Debugf("deleting state Secret %q", s.Name)
+		if err = r.Delete(ctx, s); err != nil && !apierrors.IsNotFound(err) {
+			errs = append(errs, fmt.Errorf("failed to delete state Secret %q: %w", s.Name, err))
+		}
+	}
+
+	return errors.Join(errs...)
+}
diff --git a/k8s-operator/reconciler/peerrelay/peerrelay.go b/k8s-operator/reconciler/peerrelay/peerrelay.go
new file mode 100644
index 000000000..a20b52304
--- /dev/null
+++ b/k8s-operator/reconciler/peerrelay/peerrelay.go
@@ -0,0 +1,572 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !plan9
+
+// Package peerrelay provides reconciliation logic for the PeerRelay custom resource definition. It is responsible
+// for managing the lifecycle of PeerRelay devices, including the StatefulSet and Service resources used to expose
+// them.
+package peerrelay
+
+import (
+	"cmp"
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"net/netip"
+	"reflect"
+	"slices"
+	"sync"
+	"time"
+
+	"go.uber.org/zap"
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/builder"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/handler"
+	"sigs.k8s.io/controller-runtime/pkg/manager"
+	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+
+	operatorutils "tailscale.com/k8s-operator"
+	tsapi "tailscale.com/k8s-operator/apis/v1alpha1"
+	"tailscale.com/k8s-operator/reconciler"
+	"tailscale.com/k8s-operator/reconciler/tailscaled"
+	"tailscale.com/kube/kubetypes"
+	"tailscale.com/tstime"
+	"tailscale.com/util/clientmetric"
+	"tailscale.com/util/set"
+)
+
+type (
+	// The Reconciler type is a reconcile.TypedReconciler implementation used to manage the reconciliation of
+	// PeerRelay custom resources.
+	Reconciler struct {
+		client.Client
+
+		tailscaleNamespace string
+		proxyImage         string
+		defaultTags        []string
+		tsClients          tailscaled.ClientProvider
+		resolver           func(ctx context.Context, network, host string) ([]netip.Addr, error)
+		logger             *zap.SugaredLogger
+		clock              tstime.Clock
+
+		// Metrics related fields
+		mu         sync.Mutex
+		peerRelays set.Slice[types.UID]
+	}
+
+	// The ReconcilerOptions type contains configuration values for the Reconciler.
+	ReconcilerOptions struct {
+		// The client for interacting with the Kubernetes API.
+		Client client.Client
+		// The namespace the operator is installed in. PeerRelay-managed resources (Services, StatefulSets, etc.)
+		// are created within this namespace.
+		TailscaleNamespace string
+		// ProxyImage is the container image used for the tailscaled pods that back each peer relay replica.
+		ProxyImage string
+		// DefaultTags is the tag list applied to freshly minted auth keys when a PeerRelay hasn't set its own
+		// spec.tags. Must be non-empty at construction time.
+		DefaultTags []string
+		// Clients resolves the Tailscale API client for a given tailnet name. Used to mint auth keys for each
+		// replica. Blank tailnet returns the operator's default client.
+		Clients tailscaled.ClientProvider
+		// Resolver is used to convert LoadBalancer Service hostnames to concrete IPs when the cloud
+		// controller doesn't populate Ingress[].IP directly (e.g. AWS NLBs). Defaults to a resolver backed by
+		// net.DefaultResolver when unset.
+		Resolver func(ctx context.Context, network string, host string) ([]netip.Addr, error)
+		// The logger to use for this Reconciler.
+		Logger *zap.SugaredLogger
+		// Clock is used to stamp condition transitions. Defaults to a real clock when unset.
+		Clock tstime.Clock
+	}
+)
+
+const (
+	reconcilerName                   = "peerrelay-reconciler"
+	fieldOwner     client.FieldOwner = "peerrelay-reconciler"
+)
+
+// Constants for condition reasons.
+const (
+	ReasonEndpointsPending   = "EndpointsPending"
+	ReasonPodsPending        = "PodsPending"
+	ReasonAWSConfigInvalid   = "AWSConfigInvalid"
+	ReasonTailnetUnavailable = "TailnetUnavailable"
+	ReasonReady              = "PeerRelayReady"
+)
+
+var (
+	// gaugePeerRelayResources tracks the overall number of PeerRelay resources currently managed by this operator
+	// instance.
+	gaugePeerRelayResources = clientmetric.NewGauge(kubetypes.MetricPeerRelayCount)
+)
+
+// NewReconciler returns a new instance of the Reconciler type. It watches specifically for changes to PeerRelay
+// custom resources. The ReconcilerOptions can be used to modify the behaviour of the Reconciler.
+func NewReconciler(options ReconcilerOptions) *Reconciler {
+	clock := options.Clock
+	if clock == nil {
+		clock = tstime.DefaultClock{}
+	}
+
+	resolver := options.Resolver
+	if resolver == nil {
+		resolver = net.DefaultResolver.LookupNetIP
+	}
+
+	return &Reconciler{
+		Client:             options.Client,
+		tailscaleNamespace: options.TailscaleNamespace,
+		proxyImage:         options.ProxyImage,
+		defaultTags:        options.DefaultTags,
+		tsClients:          options.Clients,
+		resolver:           resolver,
+		logger:             options.Logger.Named(reconcilerName),
+		clock:              clock,
+	}
+}
+
+// Register the Reconciler onto the given manager.Manager implementation. It watches PeerRelay resources directly,
+// the child resources it manages (Services, StatefulSets, Secrets) so external drift or cloud controller updates
+// enqueue a reconcile for the owning PeerRelay, and ProxyClass so config changes propagate to referring
+// PeerRelays.
+func (r *Reconciler) Register(mgr manager.Manager) error {
+	enqueue := handler.EnqueueRequestsFromMapFunc(reconciler.EnqueueForChild(parentTypePeerRelay))
+	return builder.
+		ControllerManagedBy(mgr).
+		For(&tsapi.PeerRelay{}).
+		Watches(&corev1.Service{}, enqueue).
+		Watches(&appsv1.StatefulSet{}, enqueue).
+		Watches(&corev1.Secret{}, enqueue).
+		Watches(&tsapi.ProxyClass{}, handler.EnqueueRequestsFromMapFunc(r.enqueuePeerRelaysForProxyClass)).
+		Named(reconcilerName).
+		Complete(r)
+}
+
+func (r *Reconciler) enqueuePeerRelaysForProxyClass(ctx context.Context, o client.Object) []reconcile.Request {
+	pc, ok := o.(*tsapi.ProxyClass)
+	if !ok {
+		return nil
+	}
+
+	var list tsapi.PeerRelayList
+	if err := r.List(ctx, &list); err != nil {
+		r.logger.Errorf("failed to list PeerRelays for ProxyClass %q change: %v", pc.Name, err)
+		return nil
+	}
+
+	var reqs []reconcile.Request
+	for _, pr := range list.Items {
+		if pr.Spec.ProxyClass == pc.Name {
+			reqs = append(reqs, reconcile.Request{NamespacedName: types.NamespacedName{Name: pr.Name}})
+		}
+	}
+	return reqs
+}
+
+// Reconcile is invoked when a change occurs to PeerRelay resources within the cluster. On create/update, it ensures
+// one LoadBalancer Service exists per replica. On delete, all managed Services are removed before the finalizer is
+// released.
+func (r *Reconciler) Reconcile(ctx context.Context, req reconcile.Request) (reconcile.Result, error) {
+	logger := r.logger.With("PeerRelay", req.Name)
+	logger.Debug("starting reconcile")
+	defer logger.Debug("reconcile finished")
+
+	var pr tsapi.PeerRelay
+	err := r.Get(ctx, req.NamespacedName, &pr)
+	switch {
+	case apierrors.IsNotFound(err):
+		logger.Debug("PeerRelay not found, assuming it was deleted")
+		return reconcile.Result{}, nil
+	case err != nil:
+		return reconcile.Result{}, fmt.Errorf("failed to get PeerRelay %q: %w", req.NamespacedName, err)
+	}
+
+	if r.tsClients != nil {
+		if _, err = r.tsClients.For(pr.Spec.Tailnet); err != nil {
+			return r.reportTailnetUnavailable(ctx, logger, &pr, err)
+		}
+	}
+
+	if !pr.DeletionTimestamp.IsZero() {
+		return r.delete(ctx, logger, &pr)
+	}
+
+	return r.createOrUpdate(ctx, logger, &pr)
+}
+
+func (r *Reconciler) reportTailnetUnavailable(ctx context.Context, logger *zap.SugaredLogger, pr *tsapi.PeerRelay, tsErr error) (reconcile.Result, error) {
+	operatorutils.SetPeerRelayCondition(pr, tsapi.PeerRelayReady, metav1.ConditionFalse, ReasonTailnetUnavailable, tsErr.Error(), r.clock, logger)
+	if err := r.Status().Update(ctx, pr); err != nil {
+		return reconcile.Result{}, errors.Join(tsErr, fmt.Errorf("failed to update PeerRelay status: %w", err))
+	}
+
+	return reconcile.Result{}, tsErr
+}
+
+func (r *Reconciler) createOrUpdate(ctx context.Context, logger *zap.SugaredLogger, pr *tsapi.PeerRelay) (reconcile.Result, error) {
+	if !slices.Contains(pr.Finalizers, reconciler.FinalizerName) {
+		reconciler.SetFinalizer(pr)
+		if err := r.Update(ctx, pr); err != nil {
+			return reconcile.Result{}, fmt.Errorf("failed to add finalizer to PeerRelay %q: %w", pr.Name, err)
+		}
+	}
+
+	r.mu.Lock()
+	if !r.peerRelays.Contains(pr.UID) {
+		r.peerRelays.Add(pr.UID)
+		logger.Infof("now managing PeerRelay %q", pr.Name)
+	}
+	r.mu.Unlock()
+	gaugePeerRelayResources.Set(int64(r.peerRelays.Len()))
+
+	replicas := int32(1)
+	if pr.Spec.Replicas != nil {
+		replicas = *pr.Spec.Replicas
+	}
+
+	// Belt-and-braces: CEL on the CRD enforces this at admission, but we also validate here to guard against older
+	// clusters without CEL, resources created before the CRD schema landed, or hand-edited status paths. If the user
+	// hasn't supplied enough EIPs for the requested replica count we refuse to touch existing state and surface the
+	// condition so they can fix the spec.
+	if pr.Spec.AWS != nil && int32(len(pr.Spec.AWS.ElasticIPs)) < replicas {
+		message := fmt.Sprintf("spec.aws.elasticIPs has %d entries but spec.replicas is %d", len(pr.Spec.AWS.ElasticIPs), replicas)
+		operatorutils.SetPeerRelayCondition(pr, tsapi.PeerRelayReady, metav1.ConditionFalse, ReasonAWSConfigInvalid, message, r.clock, logger)
+		if err := r.Status().Update(ctx, pr); err != nil {
+			return reconcile.Result{}, fmt.Errorf("failed to update PeerRelay status for %q: %w", pr.Name, err)
+		}
+		return reconcile.Result{}, nil
+	}
+
+	for i := int32(0); i < replicas; i++ {
+		desired := r.peerRelayService(pr, i)
+		if err := r.ensureService(ctx, logger, desired); err != nil {
+			return reconcile.Result{}, fmt.Errorf("failed to apply Service %q: %w", desired.Name, err)
+		}
+	}
+
+	// Read the LB addresses assigned by the cloud so each pod's config file can advertise its own public endpoint
+	// via RelayServerStaticEndpoints. On first reconcile the LBs aren't provisioned yet , endpointsByReplica ends
+	// up empty and the configs are written without static endpoints; the Watches-triggered reconcile that fires
+	// when the LB IP lands will fill them in.
+	endpoints, err := r.readEndpoints(ctx, logger, pr)
+	if err != nil {
+		return reconcile.Result{}, fmt.Errorf("failed to read endpoints for PeerRelay %q: %w", pr.Name, err)
+	}
+
+	endpointsByReplica := make(map[int32]tsapi.PeerRelayEndpoint, len(endpoints))
+	for _, ep := range endpoints {
+		endpointsByReplica[ep.Replica] = ep
+	}
+
+	for i := int32(0); i < replicas; i++ {
+		var endpoint *tsapi.PeerRelayEndpoint
+		if ep, ok := endpointsByReplica[i]; ok {
+			endpoint = &ep
+		}
+
+		if err = r.ensureStateSecret(ctx, logger, pr, i); err != nil {
+			return reconcile.Result{}, fmt.Errorf("failed to apply state Secret for PeerRelay %q replica %d: %w", pr.Name, i, err)
+		}
+
+		if err = r.ensureConfigSecret(ctx, logger, pr, i, endpoint); err != nil {
+			return reconcile.Result{}, fmt.Errorf("failed to apply config Secret for PeerRelay %q replica %d: %w", pr.Name, i, err)
+		}
+	}
+
+	ss, err := r.ensureStatefulSet(ctx, logger, pr, replicas)
+	if err != nil {
+		return reconcile.Result{}, fmt.Errorf("failed to apply StatefulSet for PeerRelay %q: %w", pr.Name, err)
+	}
+
+	if err = r.deleteDevicesFrom(ctx, logger, pr, replicas); err != nil {
+		return reconcile.Result{}, fmt.Errorf("failed to clean up scaled-down tailnet devices for PeerRelay %q: %w", pr.Name, err)
+	}
+
+	if err = r.deleteServicesFrom(ctx, logger, pr, replicas); err != nil {
+		return reconcile.Result{}, fmt.Errorf("failed to clean up scaled-down Services for PeerRelay %q: %w", pr.Name, err)
+	}
+
+	if err = r.deleteConfigSecretsFrom(ctx, logger, pr, replicas); err != nil {
+		return reconcile.Result{}, fmt.Errorf("failed to clean up scaled-down config Secrets for PeerRelay %q: %w", pr.Name, err)
+	}
+
+	if err = r.writeStatus(ctx, logger, pr, endpoints, replicas, ss); err != nil {
+		return reconcile.Result{}, fmt.Errorf("failed to update PeerRelay status for %q: %w", pr.Name, err)
+	}
+
+	if !peerRelayReady(pr) {
+		return reconcile.Result{RequeueAfter: 30 * time.Second}, nil
+	}
+
+	return reconcile.Result{}, nil
+}
+
+func peerRelayReady(pr *tsapi.PeerRelay) bool {
+	for _, c := range pr.Status.Conditions {
+		if c.Type == string(tsapi.PeerRelayReady) {
+			return c.Status == metav1.ConditionTrue
+		}
+	}
+
+	return false
+}
+
+func (r *Reconciler) readEndpoints(ctx context.Context, logger *zap.SugaredLogger, pr *tsapi.PeerRelay) ([]tsapi.PeerRelayEndpoint, error) {
+	var list corev1.ServiceList
+	if err := r.List(ctx, &list, client.InNamespace(r.tailscaleNamespace), client.MatchingLabels(peerRelayLabels(pr.Name))); err != nil {
+		return nil, fmt.Errorf("failed to list Services: %w", err)
+	}
+
+	prevByReplica := make(map[int32]tsapi.PeerRelayEndpoint, len(pr.Status.Endpoints))
+	for _, ep := range pr.Status.Endpoints {
+		prevByReplica[ep.Replica] = ep
+	}
+
+	var endpoints []tsapi.PeerRelayEndpoint
+	for i := range list.Items {
+		svc := &list.Items[i]
+		var prev *tsapi.PeerRelayEndpoint
+		if idx, ok := replicaIndexFromLabels(svc.Labels); ok {
+			if ep, ok := prevByReplica[idx]; ok {
+				prev = &ep
+			}
+		}
+
+		if endpoint := r.peerRelayEndpoint(ctx, logger, svc, prev); endpoint != nil {
+			endpoints = append(endpoints, *endpoint)
+		}
+	}
+
+	slices.SortFunc(endpoints, func(a, b tsapi.PeerRelayEndpoint) int {
+		return cmp.Compare(a.Replica, b.Replica)
+	})
+
+	return endpoints, nil
+}
+
+func (r *Reconciler) writeStatus(ctx context.Context, logger *zap.SugaredLogger, pr *tsapi.PeerRelay, endpoints []tsapi.PeerRelayEndpoint, replicas int32, ss *appsv1.StatefulSet) error {
+	prevStatus := pr.Status.DeepCopy()
+
+	pr.Status.Endpoints = endpoints
+
+	var readyReplicas int32
+	if ss != nil {
+		readyReplicas = ss.Status.ReadyReplicas
+	}
+
+	switch {
+	case int32(len(endpoints)) < replicas:
+		message := fmt.Sprintf("%d of %d replicas have a public IP", len(endpoints), replicas)
+		operatorutils.SetPeerRelayCondition(pr, tsapi.PeerRelayReady, metav1.ConditionFalse, ReasonEndpointsPending, message, r.clock, logger)
+	case readyReplicas < replicas:
+		message := fmt.Sprintf("%d of %d pods are ready", readyReplicas, replicas)
+		operatorutils.SetPeerRelayCondition(pr, tsapi.PeerRelayReady, metav1.ConditionFalse, ReasonPodsPending, message, r.clock, logger)
+	default:
+		operatorutils.SetPeerRelayCondition(pr, tsapi.PeerRelayReady, metav1.ConditionTrue, ReasonReady, ReasonReady, r.clock, logger)
+	}
+
+	if reflect.DeepEqual(prevStatus, &pr.Status) {
+		return nil
+	}
+
+	if err := r.Status().Update(ctx, pr); err != nil {
+		return fmt.Errorf("failed to update PeerRelay status: %w", err)
+	}
+
+	return nil
+}
+
+func (r *Reconciler) delete(ctx context.Context, logger *zap.SugaredLogger, pr *tsapi.PeerRelay) (reconcile.Result, error) {
+	logger.Infof("deleting PeerRelay %q", pr.Name)
+
+	if err := r.deleteDevicesFrom(ctx, logger, pr, 0); err != nil {
+		return reconcile.Result{}, fmt.Errorf("failed to delete tailnet devices for PeerRelay %q: %w", pr.Name, err)
+	}
+
+	if err := r.deleteStatefulSet(ctx, logger, pr); err != nil {
+		return reconcile.Result{}, fmt.Errorf("failed to delete StatefulSet for PeerRelay %q: %w", pr.Name, err)
+	}
+
+	if err := r.deleteConfigSecretsFrom(ctx, logger, pr, 0); err != nil {
+		return reconcile.Result{}, fmt.Errorf("failed to delete config Secrets for PeerRelay %q: %w", pr.Name, err)
+	}
+
+	if err := r.deleteServicesFrom(ctx, logger, pr, 0); err != nil {
+		return reconcile.Result{}, fmt.Errorf("failed to delete Services for PeerRelay %q: %w", pr.Name, err)
+	}
+
+	reconciler.RemoveFinalizer(pr)
+	if err := r.Update(ctx, pr); err != nil {
+		return reconcile.Result{}, fmt.Errorf("failed to remove finalizer from PeerRelay %q: %w", pr.Name, err)
+	}
+
+	r.mu.Lock()
+	r.peerRelays.Remove(pr.UID)
+	r.mu.Unlock()
+	gaugePeerRelayResources.Set(int64(r.peerRelays.Len()))
+
+	return reconcile.Result{}, nil
+}
+
+func (r *Reconciler) ensureService(ctx context.Context, logger *zap.SugaredLogger, desired *corev1.Service) error {
+	logger.Debugf("applying Service %q", desired.Name)
+	if err := r.Patch(ctx, desired, client.Apply, fieldOwner, client.ForceOwnership); err != nil {
+		return fmt.Errorf("failed to apply Service: %w", err)
+	}
+	return nil
+}
+
+func (r *Reconciler) deleteServicesFrom(ctx context.Context, logger *zap.SugaredLogger, pr *tsapi.PeerRelay, fromIdx int32) error {
+	var list corev1.ServiceList
+	if err := r.List(ctx, &list, client.InNamespace(r.tailscaleNamespace), client.MatchingLabels(peerRelayLabels(pr.Name))); err != nil {
+		return fmt.Errorf("failed to list Services: %w", err)
+	}
+
+	for i := range list.Items {
+		svc := &list.Items[i]
+		idx, ok := replicaIndexFromLabels(svc.Labels)
+		if !ok || idx < fromIdx {
+			continue
+		}
+
+		logger.Debugf("deleting Service %q", svc.Name)
+		if err := r.Delete(ctx, svc); err != nil && !apierrors.IsNotFound(err) {
+			return fmt.Errorf("failed to delete Service %q: %w", svc.Name, err)
+		}
+	}
+
+	return nil
+}
+
+func (r *Reconciler) ensureConfigSecret(ctx context.Context, logger *zap.SugaredLogger, pr *tsapi.PeerRelay, idx int32, endpoint *tsapi.PeerRelayEndpoint) error {
+	authKey, err := r.reuseOrMintAuthKey(ctx, pr, idx)
+	if err != nil {
+		return err
+	}
+
+	desired, err := r.peerRelayConfigSecret(pr, idx, endpoint, authKey)
+	if err != nil {
+		return fmt.Errorf("failed to build config Secret: %w", err)
+	}
+
+	logger.Debugf("applying config Secret %q", desired.Name)
+	if err = r.Patch(ctx, desired, client.Apply, fieldOwner, client.ForceOwnership); err != nil {
+		return fmt.Errorf("failed to apply config Secret: %w", err)
+	}
+
+	return nil
+}
+
+func (r *Reconciler) reuseOrMintAuthKey(ctx context.Context, pr *tsapi.PeerRelay, idx int32) (*string, error) {
+	var existing corev1.Secret
+	err := r.Get(ctx, types.NamespacedName{Namespace: r.tailscaleNamespace, Name: configSecretName(pr.Name, idx)}, &existing)
+	switch {
+	case apierrors.IsNotFound(err):
+		key, err := r.mintAuthKey(ctx, pr)
+		if err != nil {
+			return nil, err
+		}
+		return &key, nil
+	case err != nil:
+		return nil, fmt.Errorf("failed to get config Secret: %w", err)
+	}
+
+	if existingKey := tailscaled.AuthKeyFromConfigSecret(&existing); existingKey != nil {
+		return existingKey, nil
+	}
+
+	key, err := r.mintAuthKey(ctx, pr)
+	if err != nil {
+		return nil, err
+	}
+
+	return &key, nil
+}
+
+func (r *Reconciler) mintAuthKey(ctx context.Context, pr *tsapi.PeerRelay) (string, error) {
+	client, err := r.tsClients.For(pr.Spec.Tailnet)
+	if err != nil {
+		return "", fmt.Errorf("failed to resolve Tailscale API client for tailnet %q: %w", pr.Spec.Tailnet, err)
+	}
+
+	return tailscaled.NewAuthKey(ctx, client, r.peerRelayTags(pr))
+}
+
+func (r *Reconciler) ensureStateSecret(ctx context.Context, logger *zap.SugaredLogger, pr *tsapi.PeerRelay, idx int32) error {
+	desired := tailscaled.NewStateSecret(tailscaled.StateSecretOptions{
+		Name:      replicaName(pr.Name, idx),
+		Namespace: r.tailscaleNamespace,
+		Labels:    peerRelayServiceLabels(pr.Name, idx),
+	})
+
+	logger.Debugf("applying state Secret %q", desired.Name)
+	if err := r.Patch(ctx, desired, client.Apply, fieldOwner, client.ForceOwnership); err != nil {
+		return fmt.Errorf("failed to apply state Secret: %w", err)
+	}
+
+	return nil
+}
+
+func (r *Reconciler) deleteConfigSecretsFrom(ctx context.Context, logger *zap.SugaredLogger, pr *tsapi.PeerRelay, fromIdx int32) error {
+	labels := peerRelayLabels(pr.Name)
+	labels[kubetypes.LabelSecretType] = kubetypes.LabelSecretTypeConfig
+
+	var list corev1.SecretList
+	if err := r.List(ctx, &list, client.InNamespace(r.tailscaleNamespace), client.MatchingLabels(labels)); err != nil {
+		return fmt.Errorf("failed to list config Secrets: %w", err)
+	}
+
+	for i := range list.Items {
+		secret := &list.Items[i]
+		idx, ok := replicaIndexFromLabels(secret.Labels)
+		if !ok || idx < fromIdx {
+			continue
+		}
+
+		logger.Debugf("deleting config Secret %q", secret.Name)
+		if err := r.Delete(ctx, secret); err != nil && !apierrors.IsNotFound(err) {
+			return fmt.Errorf("failed to delete config Secret %q: %w", secret.Name, err)
+		}
+	}
+
+	return nil
+}
+
+func (r *Reconciler) ensureStatefulSet(ctx context.Context, logger *zap.SugaredLogger, pr *tsapi.PeerRelay, replicas int32) (*appsv1.StatefulSet, error) {
+	pc, err := r.getProxyClass(ctx, pr)
+	if err != nil {
+		return nil, err
+	}
+
+	desired := r.peerRelayStatefulSet(pr, replicas, pc)
+
+	logger.Debugf("applying StatefulSet %q", desired.Name)
+	if err = r.Patch(ctx, desired, client.Apply, fieldOwner, client.ForceOwnership); err != nil {
+		return nil, fmt.Errorf("failed to apply StatefulSet: %w", err)
+	}
+
+	var current appsv1.StatefulSet
+	if err = r.Get(ctx, types.NamespacedName{Namespace: desired.Namespace, Name: desired.Name}, &current); err != nil {
+		return nil, fmt.Errorf("failed to get StatefulSet: %w", err)
+	}
+
+	return &current, nil
+}
+
+func (r *Reconciler) deleteStatefulSet(ctx context.Context, logger *zap.SugaredLogger, pr *tsapi.PeerRelay) error {
+	ss := &appsv1.StatefulSet{
+		ObjectMeta: metav1.ObjectMeta{Name: resourceName(pr.Name), Namespace: r.tailscaleNamespace},
+	}
+	logger.Debugf("deleting StatefulSet %q", ss.Name)
+	if err := r.Delete(ctx, ss); err != nil && !apierrors.IsNotFound(err) {
+		return fmt.Errorf("failed to delete StatefulSet: %w", err)
+	}
+	return nil
+}
diff --git a/k8s-operator/reconciler/peerrelay/peerrelay_test.go b/k8s-operator/reconciler/peerrelay/peerrelay_test.go
new file mode 100644
index 000000000..c1c559722
--- /dev/null
+++ b/k8s-operator/reconciler/peerrelay/peerrelay_test.go
@@ -0,0 +1,1510 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !plan9
+
+package peerrelay_test
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net"
+	"net/netip"
+	"slices"
+	"strings"
+	"sync"
+	"testing"
+
+	"go.uber.org/zap"
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+	"sigs.k8s.io/controller-runtime/pkg/client/interceptor"
+	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+
+	tailscaleclient "tailscale.com/client/tailscale/v2"
+
+	"tailscale.com/ipn"
+	tsapi "tailscale.com/k8s-operator/apis/v1alpha1"
+	"tailscale.com/k8s-operator/reconciler/peerrelay"
+	"tailscale.com/k8s-operator/tsclient"
+)
+
+const (
+	tailscaleNamespace = "tailscale"
+	testProxyImage     = "tailscale/tailscale:test"
+)
+
+func testResolver(_ context.Context, _ string, host string) ([]netip.Addr, error) {
+	r := map[string][]netip.Addr{
+		"test-0.elb.amazonaws.com": {netip.MustParseAddr("203.0.113.10")},
+		"test-1.elb.amazonaws.com": {netip.MustParseAddr("203.0.113.11")},
+	}
+
+	if addrs, ok := r[host]; ok {
+		return addrs, nil
+	}
+
+	return nil, &net.DNSError{Err: "no such host", Name: host, IsNotFound: true}
+}
+
+type expectedService struct {
+	Name              string
+	Type              corev1.ServiceType
+	Port              int32
+	NodePort          int32
+	Protocol          corev1.Protocol
+	Selector          map[string]string
+	Labels            map[string]string
+	Annotations       map[string]string
+	AbsentLabels      []string
+	AbsentAnnotations []string
+}
+
+type statefulSetSpec struct {
+	Replicas int32
+	Image    string
+}
+
+func TestReconciler_Reconcile(t *testing.T) {
+	t.Parallel()
+
+	logger, err := zap.NewDevelopment()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	tt := []struct {
+		Name                  string
+		Request               reconcile.Request
+		PeerRelay             *tsapi.PeerRelay
+		ExistingResources     []client.Object
+		ExpectsError          bool
+		ExpectedServices      []expectedService
+		ExpectedEndpoints     []tsapi.PeerRelayEndpoint
+		ExpectedReadyStatus   metav1.ConditionStatus // asserted only when non-empty
+		ExpectedReadyReason   string                 // asserted only when non-empty
+		ExpectStatefulSetGone bool                   // assert the StatefulSet does not exist
+		ExpectStatefulSetSpec *statefulSetSpec       // asserted only when non-nil
+		ExpectFinalizer       bool
+		ExpectPRDeleted       bool
+	}{
+		{
+			Name:    "ignores-unknown-peer-relay",
+			Request: reconcile.Request{NamespacedName: types.NamespacedName{Name: "missing"}},
+		},
+		{
+			Name:    "default-replicas",
+			Request: reconcile.Request{NamespacedName: types.NamespacedName{Name: "test"}},
+			PeerRelay: &tsapi.PeerRelay{
+				ObjectMeta: metav1.ObjectMeta{Name: "test"},
+			},
+			ExpectedServices: []expectedService{
+				{
+					Name:     "peerrelay-test-0",
+					Type:     corev1.ServiceTypeLoadBalancer,
+					Port:     41641,
+					Protocol: corev1.ProtocolUDP,
+					Selector: map[string]string{"statefulset.kubernetes.io/pod-name": "peerrelay-test-0"},
+					Labels: map[string]string{
+						"tailscale.com/managed":              "true",
+						"tailscale.com/parent-resource-type": "peerrelay",
+						"tailscale.com/parent-resource":      "test",
+						"tailscale.com/peer-relay-replica":   "0",
+					},
+					Annotations: map[string]string{
+						"service.beta.kubernetes.io/aws-load-balancer-type":            "external",
+						"service.beta.kubernetes.io/aws-load-balancer-nlb-target-type": "ip",
+						"service.beta.kubernetes.io/aws-load-balancer-scheme":          "internet-facing",
+						"service.beta.kubernetes.io/aws-load-balancer-ip-address-type": "ipv4",
+						"service.beta.kubernetes.io/azure-load-balancer-internal":      "false",
+					},
+				},
+			},
+			ExpectFinalizer:       true,
+			ExpectStatefulSetSpec: &statefulSetSpec{Replicas: 1, Image: testProxyImage},
+		},
+		{
+			Name:    "multiple-replicas",
+			Request: reconcile.Request{NamespacedName: types.NamespacedName{Name: "test"}},
+			PeerRelay: &tsapi.PeerRelay{
+				ObjectMeta: metav1.ObjectMeta{Name: "test"},
+				Spec:       tsapi.PeerRelaySpec{Replicas: new(int32(3))},
+			},
+			ExpectedServices: []expectedService{
+				{Name: "peerrelay-test-0", Labels: map[string]string{"tailscale.com/peer-relay-replica": "0"}},
+				{Name: "peerrelay-test-1", Labels: map[string]string{"tailscale.com/peer-relay-replica": "1"}},
+				{Name: "peerrelay-test-2", Labels: map[string]string{"tailscale.com/peer-relay-replica": "2"}},
+			},
+			ExpectStatefulSetSpec: &statefulSetSpec{Replicas: 3, Image: testProxyImage},
+		},
+		{
+			Name:    "zero-replicas",
+			Request: reconcile.Request{NamespacedName: types.NamespacedName{Name: "test"}},
+			PeerRelay: &tsapi.PeerRelay{
+				ObjectMeta: metav1.ObjectMeta{Name: "test"},
+				Spec:       tsapi.PeerRelaySpec{Replicas: new(int32(0))},
+			},
+			ExpectStatefulSetSpec: &statefulSetSpec{Replicas: 0, Image: testProxyImage},
+		},
+		{
+			Name:    "scale-down",
+			Request: reconcile.Request{NamespacedName: types.NamespacedName{Name: "test"}},
+			PeerRelay: &tsapi.PeerRelay{
+				ObjectMeta: metav1.ObjectMeta{Name: "test"},
+				Spec:       tsapi.PeerRelaySpec{Replicas: new(int32(2))},
+			},
+			ExistingResources: []client.Object{
+				managedService("test", 0),
+				managedService("test", 1),
+				managedService("test", 2),
+				managedService("test", 3),
+			},
+			ExpectedServices: []expectedService{
+				{Name: "peerrelay-test-0"},
+				{Name: "peerrelay-test-1"},
+			},
+			ExpectStatefulSetSpec: &statefulSetSpec{Replicas: 2, Image: testProxyImage},
+		},
+		{
+			Name:    "scale-up",
+			Request: reconcile.Request{NamespacedName: types.NamespacedName{Name: "test"}},
+			PeerRelay: &tsapi.PeerRelay{
+				ObjectMeta: metav1.ObjectMeta{Name: "test"},
+				Spec:       tsapi.PeerRelaySpec{Replicas: new(int32(3))},
+			},
+			ExistingResources: []client.Object{
+				managedService("test", 0),
+			},
+			ExpectedServices: []expectedService{
+				{Name: "peerrelay-test-0"},
+				{Name: "peerrelay-test-1"},
+				{Name: "peerrelay-test-2"},
+			},
+		},
+		{
+			Name:    "scoped",
+			Request: reconcile.Request{NamespacedName: types.NamespacedName{Name: "test"}},
+			PeerRelay: &tsapi.PeerRelay{
+				ObjectMeta: metav1.ObjectMeta{Name: "test"},
+				Spec:       tsapi.PeerRelaySpec{Replicas: new(int32(1))},
+			},
+			ExistingResources: []client.Object{
+				// A Service belonging to a different PeerRelay must not be touched.
+				managedService("other", 5),
+			},
+			ExpectedServices: []expectedService{
+				{Name: "peerrelay-other-5"},
+				{Name: "peerrelay-test-0"},
+			},
+		},
+		{
+			Name:    "user-annotations",
+			Request: reconcile.Request{NamespacedName: types.NamespacedName{Name: "test"}},
+			PeerRelay: &tsapi.PeerRelay{
+				ObjectMeta: metav1.ObjectMeta{Name: "test"},
+				Spec: tsapi.PeerRelaySpec{
+					Service: &tsapi.PeerRelayService{Annotations: map[string]string{"example.com/custom": "value"}},
+				},
+			},
+			ExpectedServices: []expectedService{
+				{
+					Name: "peerrelay-test-0",
+					Annotations: map[string]string{
+						"example.com/custom": "value",
+						"service.beta.kubernetes.io/aws-load-balancer-type":       "external",
+						"service.beta.kubernetes.io/aws-load-balancer-scheme":     "internet-facing",
+						"service.beta.kubernetes.io/azure-load-balancer-internal": "false",
+					},
+				},
+			},
+		},
+		{
+			Name:    "cloud-annotations",
+			Request: reconcile.Request{NamespacedName: types.NamespacedName{Name: "test"}},
+			PeerRelay: &tsapi.PeerRelay{
+				ObjectMeta: metav1.ObjectMeta{Name: "test"},
+				Spec: tsapi.PeerRelaySpec{
+					Service: &tsapi.PeerRelayService{Annotations: map[string]string{
+						"service.beta.kubernetes.io/aws-load-balancer-scheme":     "internal",
+						"service.beta.kubernetes.io/azure-load-balancer-internal": "true",
+					}},
+				},
+			},
+			ExpectedServices: []expectedService{
+				{
+					Name: "peerrelay-test-0",
+					Annotations: map[string]string{
+						"service.beta.kubernetes.io/aws-load-balancer-scheme":     "internet-facing",
+						"service.beta.kubernetes.io/azure-load-balancer-internal": "false",
+					},
+				},
+			},
+		},
+		{
+			// The reconciler applies via server-side apply, so a drifted Service (wrong Spec.Type, wrong Ports)
+			// is restored on reconcile. Kubernetes owns the merge with fields belonging to other managers
+			// (cloud LB controller annotations, kube-proxy's NodePort) and preserves them — that contract is
+			// exercised in e2e tests where a real API server is available; here we only verify the drift is fixed.
+			Name:    "drift-corrected",
+			Request: reconcile.Request{NamespacedName: types.NamespacedName{Name: "test"}},
+			PeerRelay: &tsapi.PeerRelay{
+				ObjectMeta: metav1.ObjectMeta{Name: "test"},
+				Spec:       tsapi.PeerRelaySpec{Replicas: new(int32(1))},
+			},
+			ExistingResources: []client.Object{
+				&corev1.Service{
+					ObjectMeta: metav1.ObjectMeta{
+						Name:      "peerrelay-test-0",
+						Namespace: tailscaleNamespace,
+						Labels: map[string]string{
+							"tailscale.com/managed":              "true",
+							"tailscale.com/parent-resource-type": "peerrelay",
+							"tailscale.com/parent-resource":      "test",
+							"tailscale.com/peer-relay-replica":   "0",
+						},
+						Annotations: map[string]string{
+							"service.beta.kubernetes.io/aws-load-balancer-scheme": "internal",
+						},
+					},
+					Spec: corev1.ServiceSpec{
+						Type: corev1.ServiceTypeClusterIP,
+						Ports: []corev1.ServicePort{
+							{Name: "wrong", Protocol: corev1.ProtocolTCP, Port: 80},
+						},
+					},
+				},
+			},
+			ExpectedServices: []expectedService{
+				{
+					Name:     "peerrelay-test-0",
+					Type:     corev1.ServiceTypeLoadBalancer,
+					Port:     41641,
+					Protocol: corev1.ProtocolUDP,
+					Labels: map[string]string{
+						"tailscale.com/managed": "true",
+					},
+					Annotations: map[string]string{
+						"service.beta.kubernetes.io/aws-load-balancer-scheme": "internet-facing", // drift corrected
+					},
+				},
+			},
+			// No LB ingress seeded, so the PeerRelayReady condition stays Pending.
+			ExpectedReadyStatus: metav1.ConditionFalse,
+			ExpectedReadyReason: peerrelay.ReasonEndpointsPending,
+		},
+		{
+			// GCP/Azure-style: the LB reports a plain IPv4 address; we surface it verbatim in status.endpoints.
+			Name:    "endpoints-populated-from-lb-ip",
+			Request: reconcile.Request{NamespacedName: types.NamespacedName{Name: "test"}},
+			PeerRelay: &tsapi.PeerRelay{
+				ObjectMeta: metav1.ObjectMeta{Name: "test"},
+				Spec:       tsapi.PeerRelaySpec{Replicas: new(int32(2))},
+			},
+			ExistingResources: []client.Object{
+				managedServiceWithLB("test", 0, "1.2.3.4", ""),
+				managedServiceWithLB("test", 1, "5.6.7.8", ""),
+				// Seed a StatefulSet with both replicas Ready so the writeStatus precedence path can reach
+				// ReasonReady. Without this the fake client's fresh StatefulSet would have ReadyReplicas=0 and
+				// we'd land in PodsPending instead.
+				managedStatefulSet("test", 2, 2),
+			},
+			ExpectedServices: []expectedService{{Name: "peerrelay-test-0"}, {Name: "peerrelay-test-1"}},
+			ExpectedEndpoints: []tsapi.PeerRelayEndpoint{
+				{Replica: 0, Address: "1.2.3.4", Port: 41641},
+				{Replica: 1, Address: "5.6.7.8", Port: 41641},
+			},
+			ExpectedReadyStatus: metav1.ConditionTrue,
+			ExpectedReadyReason: peerrelay.ReasonReady,
+		},
+		{
+			// All LB IPs assigned but pods haven't reported Ready yet
+			Name:    "pods-pending-blocks-ready",
+			Request: reconcile.Request{NamespacedName: types.NamespacedName{Name: "test"}},
+			PeerRelay: &tsapi.PeerRelay{
+				ObjectMeta: metav1.ObjectMeta{Name: "test"},
+				Spec:       tsapi.PeerRelaySpec{Replicas: new(int32(2))},
+			},
+			ExistingResources: []client.Object{
+				managedServiceWithLB("test", 0, "1.2.3.4", ""),
+				managedServiceWithLB("test", 1, "5.6.7.8", ""),
+				managedStatefulSet("test", 2, 1), // only 1 of 2 pods Ready
+			},
+			ExpectedServices: []expectedService{{Name: "peerrelay-test-0"}, {Name: "peerrelay-test-1"}},
+			ExpectedEndpoints: []tsapi.PeerRelayEndpoint{
+				{Replica: 0, Address: "1.2.3.4", Port: 41641},
+				{Replica: 1, Address: "5.6.7.8", Port: 41641},
+			},
+			ExpectedReadyStatus: metav1.ConditionFalse,
+			ExpectedReadyReason: peerrelay.ReasonPodsPending,
+		},
+		{
+			// Hostname-only LBs (AWS NLBs) no longer produce a hard error, the reconciler resolves the hostname
+			// to a stable IP and advertises that instead. Here the resolver returns a canned address for the AWS
+			// hostname; the endpoint should reflect the resolved IP. The eip-allocations annotation is what
+			// signals to the reconciler that hostname resolution is safe — this is our AWS opt-in contract.
+			Name:    "hostname-only-lb-is-resolved-to-ip",
+			Request: reconcile.Request{NamespacedName: types.NamespacedName{Name: "test"}},
+			PeerRelay: &tsapi.PeerRelay{
+				ObjectMeta: metav1.ObjectMeta{Name: "test"},
+				Spec: tsapi.PeerRelaySpec{
+					Service: &tsapi.PeerRelayService{
+						Annotations: map[string]string{eipAllocationsAnnotation: "eipalloc-aaaa"},
+					},
+				},
+			},
+			ExistingResources: []client.Object{
+				managedServiceWithLB("test", 0, "", "test-0.elb.amazonaws.com"),
+				managedStatefulSet("test", 1, 1),
+			},
+			ExpectedServices: []expectedService{{Name: "peerrelay-test-0"}},
+			ExpectedEndpoints: []tsapi.PeerRelayEndpoint{
+				{Replica: 0, Address: "203.0.113.10", Port: 41641},
+			},
+			ExpectedReadyStatus: metav1.ConditionTrue,
+			ExpectedReadyReason: peerrelay.ReasonReady,
+		},
+		{
+			// Unresolvable hostname (e.g. NXDOMAIN during LB provisioning) stays in Pending — no hard error,
+			// reconciler will retry when the hostname comes online. Service still carries the eip-allocations
+			// annotation so we know the resolution path was attempted (and not just skipped for being non-AWS).
+			Name:    "unresolvable-hostname-stays-pending",
+			Request: reconcile.Request{NamespacedName: types.NamespacedName{Name: "test"}},
+			PeerRelay: &tsapi.PeerRelay{
+				ObjectMeta: metav1.ObjectMeta{Name: "test"},
+				Spec: tsapi.PeerRelaySpec{
+					Service: &tsapi.PeerRelayService{
+						Annotations: map[string]string{eipAllocationsAnnotation: "eipalloc-aaaa"},
+					},
+				},
+			},
+			ExistingResources: []client.Object{
+				managedServiceWithLB("test", 0, "", "unresolvable.example.invalid"),
+			},
+			ExpectedServices:    []expectedService{{Name: "peerrelay-test-0"}},
+			ExpectedReadyStatus: metav1.ConditionFalse,
+			ExpectedReadyReason: peerrelay.ReasonEndpointsPending,
+		},
+		{
+			// A hostname-only Service without the EIP annotation is a Service whose backing LB has unstable IPs
+			// (unmanaged AWS NLB, most third-party providers). The reconciler refuses to resolve — advertising a
+			// transient IP would leave peers connecting to a dead endpoint if AWS shifts the underlying A records.
+			// Users get an explicit "pending" state and either add the annotation or accept the LB isn't usable.
+			Name:    "hostname-without-eip-annotation-stays-pending",
+			Request: reconcile.Request{NamespacedName: types.NamespacedName{Name: "test"}},
+			PeerRelay: &tsapi.PeerRelay{
+				ObjectMeta: metav1.ObjectMeta{Name: "test"},
+			},
+			ExistingResources: []client.Object{
+				managedServiceWithLB("test", 0, "", "test-0.elb.amazonaws.com"),
+			},
+			ExpectedServices:    []expectedService{{Name: "peerrelay-test-0"}},
+			ExpectedReadyStatus: metav1.ConditionFalse,
+			ExpectedReadyReason: peerrelay.ReasonEndpointsPending,
+		},
+		{
+			// Mixed batch: one replica has a direct IP, another has only a hostname that resolves (with EIP
+			// annotation propagated from the PeerRelay spec). Both should end up in status.endpoints.
+			Name:    "mixed-ip-and-resolved-hostname",
+			Request: reconcile.Request{NamespacedName: types.NamespacedName{Name: "test"}},
+			PeerRelay: &tsapi.PeerRelay{
+				ObjectMeta: metav1.ObjectMeta{Name: "test"},
+				Spec: tsapi.PeerRelaySpec{
+					Replicas: new(int32(2)),
+					Service: &tsapi.PeerRelayService{
+						Annotations: map[string]string{eipAllocationsAnnotation: "eipalloc-bbbb"},
+					},
+				},
+			},
+			ExistingResources: []client.Object{
+				managedServiceWithLB("test", 0, "1.2.3.4", ""),
+				managedServiceWithLB("test", 1, "", "test-1.elb.amazonaws.com"),
+				managedStatefulSet("test", 2, 2),
+			},
+			ExpectedServices: []expectedService{{Name: "peerrelay-test-0"}, {Name: "peerrelay-test-1"}},
+			ExpectedEndpoints: []tsapi.PeerRelayEndpoint{
+				{Replica: 0, Address: "1.2.3.4", Port: 41641},
+				{Replica: 1, Address: "203.0.113.11", Port: 41641},
+			},
+			ExpectedReadyStatus: metav1.ConditionTrue,
+			ExpectedReadyReason: peerrelay.ReasonReady,
+		},
+		{
+			// Mid-provisioning: some LBs have addresses, some don't yet. Only the ready ones show up.
+			Name:    "endpoints-partial-when-lb-not-ready",
+			Request: reconcile.Request{NamespacedName: types.NamespacedName{Name: "test"}},
+			PeerRelay: &tsapi.PeerRelay{
+				ObjectMeta: metav1.ObjectMeta{Name: "test"},
+				Spec:       tsapi.PeerRelaySpec{Replicas: new(int32(3))},
+			},
+			ExistingResources: []client.Object{
+				managedServiceWithLB("test", 0, "1.2.3.4", ""),
+				managedService("test", 2),
+			},
+			ExpectedServices: []expectedService{{Name: "peerrelay-test-0"}, {Name: "peerrelay-test-1"}, {Name: "peerrelay-test-2"}},
+			ExpectedEndpoints: []tsapi.PeerRelayEndpoint{
+				{Replica: 0, Address: "1.2.3.4", Port: 41641},
+			},
+			ExpectedReadyStatus: metav1.ConditionFalse,
+			ExpectedReadyReason: peerrelay.ReasonEndpointsPending,
+		},
+		{
+			// spec.aws.elasticIPs fans out per-replica: each Service gets its OWN eip-allocations + subnets
+			// annotations from the array. This is the HA path on AWS where every replica needs a distinct EIP.
+			Name:    "aws-elasticips-fan-out-per-replica",
+			Request: reconcile.Request{NamespacedName: types.NamespacedName{Name: "test"}},
+			PeerRelay: &tsapi.PeerRelay{
+				ObjectMeta: metav1.ObjectMeta{Name: "test"},
+				Spec: tsapi.PeerRelaySpec{
+					Replicas: new(int32(2)),
+					AWS: &tsapi.PeerRelayAWS{
+						ElasticIPs: []tsapi.PeerRelayAWSElasticIP{
+							{AllocationID: "eipalloc-aaaa", SubnetID: "subnet-aaaa"},
+							{AllocationID: "eipalloc-bbbb", SubnetID: "subnet-bbbb"},
+						},
+					},
+				},
+			},
+			ExpectedServices: []expectedService{
+				{
+					Name: "peerrelay-test-0",
+					Annotations: map[string]string{
+						eipAllocationsAnnotation: "eipalloc-aaaa",
+						subnetsAnnotation:        "subnet-aaaa",
+					},
+				},
+				{
+					Name: "peerrelay-test-1",
+					Annotations: map[string]string{
+						eipAllocationsAnnotation: "eipalloc-bbbb",
+						subnetsAnnotation:        "subnet-bbbb",
+					},
+				},
+			},
+			ExpectStatefulSetSpec: &statefulSetSpec{Replicas: 2, Image: testProxyImage},
+		},
+		{
+			// spec.aws.elasticIPs wins over any conflicting eip-allocations / subnets in spec.service.annotations.
+			// Users get a single source of truth: whatever they put in per-replica config is what lands on the Service.
+			Name:    "aws-elasticips-override-shared-annotations",
+			Request: reconcile.Request{NamespacedName: types.NamespacedName{Name: "test"}},
+			PeerRelay: &tsapi.PeerRelay{
+				ObjectMeta: metav1.ObjectMeta{Name: "test"},
+				Spec: tsapi.PeerRelaySpec{
+					Service: &tsapi.PeerRelayService{
+						Annotations: map[string]string{
+							eipAllocationsAnnotation: "eipalloc-shared-wrong",
+							subnetsAnnotation:        "subnet-shared-wrong",
+						},
+					},
+					AWS: &tsapi.PeerRelayAWS{
+						ElasticIPs: []tsapi.PeerRelayAWSElasticIP{
+							{AllocationID: "eipalloc-perreplica", SubnetID: "subnet-perreplica"},
+						},
+					},
+				},
+			},
+			ExpectedServices: []expectedService{
+				{
+					Name: "peerrelay-test-0",
+					Annotations: map[string]string{
+						eipAllocationsAnnotation: "eipalloc-perreplica",
+						subnetsAnnotation:        "subnet-perreplica",
+					},
+				},
+			},
+		},
+		{
+			Name:    "aws-elasticips-clears-eip-annotations",
+			Request: reconcile.Request{NamespacedName: types.NamespacedName{Name: "test"}},
+			PeerRelay: &tsapi.PeerRelay{
+				ObjectMeta: metav1.ObjectMeta{Name: "test"},
+			},
+			ExistingResources: []client.Object{
+				&corev1.Service{
+					ObjectMeta: metav1.ObjectMeta{
+						Name:      "peerrelay-test-0",
+						Namespace: tailscaleNamespace,
+						Labels: map[string]string{
+							"tailscale.com/managed":              "true",
+							"tailscale.com/parent-resource-type": "peerrelay",
+							"tailscale.com/parent-resource":      "test",
+							"tailscale.com/peer-relay-replica":   "0",
+						},
+						Annotations: map[string]string{
+							eipAllocationsAnnotation: "eipalloc-stale",
+							subnetsAnnotation:        "subnet-stale",
+						},
+					},
+					Spec: corev1.ServiceSpec{
+						Type: corev1.ServiceTypeLoadBalancer,
+					},
+				},
+			},
+			ExpectedServices: []expectedService{
+				{
+					Name:              "peerrelay-test-0",
+					AbsentAnnotations: []string{eipAllocationsAnnotation, subnetsAnnotation},
+				},
+			},
+		},
+		{
+			// Length mismatch trips the belt-and-braces check: reconciler refuses to create Services and surfaces
+			// AWSConfigInvalid so the user can fix the spec. Nothing is created, existing state is preserved.
+			Name:    "aws-elasticips-insufficient",
+			Request: reconcile.Request{NamespacedName: types.NamespacedName{Name: "test"}},
+			PeerRelay: &tsapi.PeerRelay{
+				ObjectMeta: metav1.ObjectMeta{Name: "test"},
+				Spec: tsapi.PeerRelaySpec{
+					Replicas: new(int32(2)),
+					AWS: &tsapi.PeerRelayAWS{
+						ElasticIPs: []tsapi.PeerRelayAWSElasticIP{
+							{AllocationID: "eipalloc-aaaa", SubnetID: "subnet-aaaa"},
+						},
+					},
+				},
+			},
+			ExpectStatefulSetGone: true,
+			ExpectedReadyStatus:   metav1.ConditionFalse,
+			ExpectedReadyReason:   peerrelay.ReasonAWSConfigInvalid,
+		},
+		{
+			Name:    "deletion",
+			Request: reconcile.Request{NamespacedName: types.NamespacedName{Name: "test"}},
+			PeerRelay: &tsapi.PeerRelay{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:              "test",
+					Finalizers:        []string{"tailscale.com/finalizer"},
+					DeletionTimestamp: new(metav1.Now()),
+				},
+				Spec: tsapi.PeerRelaySpec{Replicas: new(int32(2))},
+			},
+			ExistingResources: []client.Object{
+				managedService("test", 0),
+				managedService("test", 1),
+				managedService("other", 0),
+				managedConfigSecret("test", 0),
+				managedConfigSecret("test", 1),
+				&appsv1.StatefulSet{
+					ObjectMeta: metav1.ObjectMeta{
+						Name:      "test",
+						Namespace: tailscaleNamespace,
+					},
+				},
+			},
+			ExpectedServices:      []expectedService{{Name: "peerrelay-other-0"}},
+			ExpectPRDeleted:       true,
+			ExpectStatefulSetGone: true,
+		},
+	}
+
+	for _, tc := range tt {
+		t.Run(tc.Name, func(t *testing.T) {
+			builder := fake.NewClientBuilder().WithInterceptorFuncs(applyPatchInterceptor()).
+				WithScheme(tsapi.GlobalScheme).
+				WithStatusSubresource(&tsapi.PeerRelay{}, &appsv1.StatefulSet{}).
+				WithInterceptorFuncs(applyPatchInterceptor())
+			if tc.PeerRelay != nil {
+				builder = builder.WithObjects(tc.PeerRelay)
+			}
+			builder = builder.WithObjects(tc.ExistingResources...)
+
+			fc := builder.Build()
+			r := peerrelay.NewReconciler(peerrelay.ReconcilerOptions{
+				Client:             fc,
+				TailscaleNamespace: tailscaleNamespace,
+				ProxyImage:         testProxyImage,
+				DefaultTags:        []string{"tag:test-peer-relay"},
+				Clients:            &fakeClientProvider{client: &fakeTSClient{}},
+				Resolver:           testResolver,
+				Logger:             logger.Sugar(),
+			})
+
+			_, err = r.Reconcile(t.Context(), tc.Request)
+			if tc.ExpectsError && err == nil {
+				t.Fatalf("expected error, got none")
+			}
+			if !tc.ExpectsError && err != nil {
+				t.Fatalf("expected no error, got %v", err)
+			}
+
+			var svcs corev1.ServiceList
+			if err = fc.List(t.Context(), &svcs, client.InNamespace(tailscaleNamespace)); err != nil {
+				t.Fatal(err)
+			}
+
+			gotByName := make(map[string]corev1.Service, len(svcs.Items))
+			gotNames := make([]string, 0, len(svcs.Items))
+			for _, svc := range svcs.Items {
+				gotByName[svc.Name] = svc
+				gotNames = append(gotNames, svc.Name)
+			}
+
+			wantNames := make([]string, 0, len(tc.ExpectedServices))
+			for _, want := range tc.ExpectedServices {
+				wantNames = append(wantNames, want.Name)
+			}
+
+			slices.Sort(gotNames)
+			slices.Sort(wantNames)
+			if !slices.Equal(gotNames, wantNames) {
+				t.Fatalf("expected services %v, got %v", wantNames, gotNames)
+			}
+
+			for _, want := range tc.ExpectedServices {
+				assertService(t, want, new(gotByName[want.Name]))
+			}
+
+			if tc.PeerRelay == nil {
+				return
+			}
+
+			var pr tsapi.PeerRelay
+			err = fc.Get(t.Context(), types.NamespacedName{Name: tc.PeerRelay.Name}, &pr)
+			switch {
+			case tc.ExpectPRDeleted:
+				if !apierrors.IsNotFound(err) {
+					t.Fatalf("expected PeerRelay to be gone, got %v", err)
+				}
+			case err != nil:
+				t.Fatalf("failed to refetch PeerRelay: %v", err)
+			case tc.ExpectFinalizer:
+				if !slices.Contains(pr.Finalizers, "tailscale.com/finalizer") {
+					t.Errorf("expected finalizer to be set, got %v", pr.Finalizers)
+				}
+			}
+
+			if !slices.Equal(pr.Status.Endpoints, tc.ExpectedEndpoints) {
+				t.Errorf("expected status.endpoints %v, got %v", tc.ExpectedEndpoints, pr.Status.Endpoints)
+			}
+
+			if tc.ExpectedReadyStatus != "" || tc.ExpectedReadyReason != "" {
+				cond := readyCondition(&pr)
+				if tc.ExpectedReadyStatus != "" && cond.Status != tc.ExpectedReadyStatus {
+					t.Errorf("expected PeerRelayReady status %s, got %q", tc.ExpectedReadyStatus, cond.Status)
+				}
+				if tc.ExpectedReadyReason != "" && cond.Reason != tc.ExpectedReadyReason {
+					t.Errorf("expected PeerRelayReady reason %s, got %q", tc.ExpectedReadyReason, cond.Reason)
+				}
+			}
+
+			assertStatefulSet(t, fc, tc.Request.Name, tc.ExpectStatefulSetSpec, tc.ExpectStatefulSetGone)
+			configSecrets, stateSecrets := childSecretsFromServices(tc.Request.Name, tc.ExpectedServices)
+			assertConfigSecrets(t, fc, tc.Request.Name, configSecrets)
+			assertStateSecrets(t, fc, tc.Request.Name, stateSecrets)
+		})
+	}
+}
+
+func assertStatefulSet(t *testing.T, fc client.Client, prName string, want *statefulSetSpec, gone bool) {
+	t.Helper()
+
+	stsName := "peerrelay-" + prName
+	var ss appsv1.StatefulSet
+	err := fc.Get(t.Context(), types.NamespacedName{Namespace: tailscaleNamespace, Name: stsName}, &ss)
+	switch {
+	case gone:
+		if !apierrors.IsNotFound(err) {
+			t.Errorf("expected StatefulSet %q to be absent, got err=%v", prName, err)
+		}
+		return
+	case want == nil:
+		return
+	case err != nil:
+		t.Fatalf("expected StatefulSet %q, got err %v", prName, err)
+	}
+
+	if ss.Spec.Replicas == nil || *ss.Spec.Replicas != want.Replicas {
+		got := "<nil>"
+		if ss.Spec.Replicas != nil {
+			got = fmt.Sprintf("%d", *ss.Spec.Replicas)
+		}
+		t.Errorf("expected StatefulSet replicas=%d, got %s", want.Replicas, got)
+	}
+
+	if want.Image != "" {
+		if len(ss.Spec.Template.Spec.Containers) == 0 {
+			t.Fatalf("StatefulSet template has no containers")
+		}
+		if ss.Spec.Template.Spec.Containers[0].Image != want.Image {
+			t.Errorf("expected container image %q, got %q", want.Image, ss.Spec.Template.Spec.Containers[0].Image)
+		}
+	}
+}
+
+func assertConfigSecrets(t *testing.T, fc client.Client, prName string, want []string) {
+	t.Helper()
+	assertSecretsForType(t, fc, prName, "config", "config Secrets", want)
+}
+
+func assertStateSecrets(t *testing.T, fc client.Client, prName string, want []string) {
+	t.Helper()
+	assertSecretsForType(t, fc, prName, "state", "state Secrets", want)
+}
+
+// childSecretsFromServices derives the expected config and state Secret names for the PeerRelay named prName from the
+// list of expected Services. Because the reconciler creates one config Secret (named <svc>-config) and one state
+// Secret (named <svc>) per Service, spelling those out separately in every test case is redundant.
+func childSecretsFromServices(prName string, services []expectedService) (configs, states []string) {
+	prefix := "peerrelay-" + prName + "-"
+	for _, s := range services {
+		if !strings.HasPrefix(s.Name, prefix) {
+			continue
+		}
+		configs = append(configs, s.Name+"-config")
+		states = append(states, s.Name)
+	}
+	return configs, states
+}
+
+func assertSecretsForType(t *testing.T, fc client.Client, prName, secretType, label string, want []string) {
+	t.Helper()
+
+	var list corev1.SecretList
+	if err := fc.List(t.Context(), &list, client.InNamespace(tailscaleNamespace), client.MatchingLabels(map[string]string{
+		"tailscale.com/parent-resource-type": "peerrelay",
+		"tailscale.com/parent-resource":      prName,
+		"tailscale.com/secret-type":          secretType,
+	})); err != nil {
+		t.Fatal(err)
+	}
+
+	got := make([]string, 0, len(list.Items))
+	for _, s := range list.Items {
+		got = append(got, s.Name)
+	}
+
+	slices.Sort(got)
+	sortedWant := slices.Clone(want)
+	slices.Sort(sortedWant)
+
+	if !slices.Equal(got, sortedWant) {
+		t.Errorf("expected %s %v, got %v", label, sortedWant, got)
+	}
+}
+
+func readyCondition(pr *tsapi.PeerRelay) metav1.Condition {
+	for _, cond := range pr.Status.Conditions {
+		if cond.Type == string(tsapi.PeerRelayReady) {
+			return cond
+		}
+	}
+
+	return metav1.Condition{}
+}
+
+func assertService(t *testing.T, want expectedService, got *corev1.Service) {
+	t.Helper()
+
+	if want.Type != "" && got.Spec.Type != want.Type {
+		t.Errorf("Service %q: expected type %q, got %q", want.Name, want.Type, got.Spec.Type)
+	}
+
+	if want.Port != 0 || want.Protocol != "" || want.NodePort != 0 {
+		if len(got.Spec.Ports) != 1 {
+			t.Fatalf("Service %q: expected exactly one port, got %d", want.Name, len(got.Spec.Ports))
+		}
+		if want.Protocol != "" && got.Spec.Ports[0].Protocol != want.Protocol {
+			t.Errorf("Service %q: expected protocol %q, got %q", want.Name, want.Protocol, got.Spec.Ports[0].Protocol)
+		}
+		if want.Port != 0 && got.Spec.Ports[0].Port != want.Port {
+			t.Errorf("Service %q: expected port %d, got %d", want.Name, want.Port, got.Spec.Ports[0].Port)
+		}
+		if want.NodePort != 0 && got.Spec.Ports[0].NodePort != want.NodePort {
+			t.Errorf("Service %q: expected nodePort %d, got %d", want.Name, want.NodePort, got.Spec.Ports[0].NodePort)
+		}
+	}
+
+	for k, v := range want.Selector {
+		if gotV := got.Spec.Selector[k]; gotV != v {
+			t.Errorf("Service %q: expected selector %q=%q, got %q", want.Name, k, v, gotV)
+		}
+	}
+
+	for k, v := range want.Labels {
+		if gotV := got.Labels[k]; gotV != v {
+			t.Errorf("Service %q: expected label %q=%q, got %q", want.Name, k, v, gotV)
+		}
+	}
+
+	for _, k := range want.AbsentLabels {
+		if v, ok := got.Labels[k]; ok {
+			t.Errorf("Service %q: expected label %q to be absent, got %q", want.Name, k, v)
+		}
+	}
+
+	for k, v := range want.Annotations {
+		if gotV := got.Annotations[k]; gotV != v {
+			t.Errorf("Service %q: expected annotation %q=%q, got %q", want.Name, k, v, gotV)
+		}
+	}
+
+	for _, k := range want.AbsentAnnotations {
+		if v, ok := got.Annotations[k]; ok {
+			t.Errorf("Service %q: expected annotation %q to be absent, got %q", want.Name, k, v)
+		}
+	}
+}
+
+func managedService(prName string, idx int) *corev1.Service {
+	return &corev1.Service{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      fmt.Sprintf("peerrelay-%s-%d", prName, idx),
+			Namespace: tailscaleNamespace,
+			Labels: map[string]string{
+				"tailscale.com/managed":              "true",
+				"tailscale.com/parent-resource-type": "peerrelay",
+				"tailscale.com/parent-resource":      prName,
+				"tailscale.com/peer-relay-replica":   fmt.Sprintf("%d", idx),
+			},
+		},
+		Spec: corev1.ServiceSpec{Type: corev1.ServiceTypeLoadBalancer},
+	}
+}
+
+func managedServiceWithLB(prName string, idx int, ip, hostname string) *corev1.Service {
+	svc := managedService(prName, idx)
+	svc.Status.LoadBalancer.Ingress = []corev1.LoadBalancerIngress{{IP: ip, Hostname: hostname}}
+	return svc
+}
+
+const (
+	eipAllocationsAnnotation = "service.beta.kubernetes.io/aws-load-balancer-eip-allocations"
+	subnetsAnnotation        = "service.beta.kubernetes.io/aws-load-balancer-subnets"
+)
+
+func managedStatefulSet(prName string, replicas, ready int32) *appsv1.StatefulSet {
+	labels := map[string]string{
+		"tailscale.com/managed":              "true",
+		"tailscale.com/parent-resource-type": "peerrelay",
+		"tailscale.com/parent-resource":      prName,
+	}
+	stsName := "peerrelay-" + prName
+	return &appsv1.StatefulSet{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      stsName,
+			Namespace: tailscaleNamespace,
+			Labels:    labels,
+		},
+		Spec: appsv1.StatefulSetSpec{
+			Replicas:    &replicas,
+			ServiceName: stsName,
+			Selector:    &metav1.LabelSelector{MatchLabels: labels},
+			Template: corev1.PodTemplateSpec{
+				ObjectMeta: metav1.ObjectMeta{Labels: labels},
+				Spec:       corev1.PodSpec{},
+			},
+		},
+		Status: appsv1.StatefulSetStatus{ReadyReplicas: ready},
+	}
+}
+
+func managedConfigSecret(prName string, idx int) *corev1.Secret {
+	return &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      fmt.Sprintf("peerrelay-%s-%d-config", prName, idx),
+			Namespace: tailscaleNamespace,
+			Labels: map[string]string{
+				"tailscale.com/managed":              "true",
+				"tailscale.com/parent-resource-type": "peerrelay",
+				"tailscale.com/parent-resource":      prName,
+				"tailscale.com/peer-relay-replica":   fmt.Sprintf("%d", idx),
+			},
+		},
+	}
+}
+
+func TestReconciler_TailscaledConfig(t *testing.T) {
+	t.Parallel()
+
+	logger, err := zap.NewDevelopment()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	pr := &tsapi.PeerRelay{
+		ObjectMeta: metav1.ObjectMeta{Name: "test"},
+		Spec:       tsapi.PeerRelaySpec{Replicas: new(int32(2))},
+	}
+
+	fc := fake.NewClientBuilder().WithInterceptorFuncs(applyPatchInterceptor()).
+		WithScheme(tsapi.GlobalScheme).
+		WithStatusSubresource(&tsapi.PeerRelay{}).
+		WithObjects(
+			pr,
+			managedServiceWithLB("test", 0, "1.2.3.4", ""),
+			managedService("test", 1),
+		).
+		Build()
+
+	r := peerrelay.NewReconciler(peerrelay.ReconcilerOptions{
+		Client:             fc,
+		TailscaleNamespace: tailscaleNamespace,
+		ProxyImage:         testProxyImage,
+		DefaultTags:        []string{"tag:test-peer-relay"},
+		Clients:            &fakeClientProvider{client: &fakeTSClient{}},
+		Resolver:           testResolver,
+		Logger:             logger.Sugar(),
+	})
+
+	if _, err := r.Reconcile(t.Context(), reconcile.Request{NamespacedName: types.NamespacedName{Name: "test"}}); err != nil {
+		t.Fatal(err)
+	}
+
+	got0 := readTailscaledConfig(t, fc, "peerrelay-test-0-config")
+	if got0.RelayServerPort == nil || *got0.RelayServerPort != 41641 {
+		t.Errorf("replica 0: expected RelayServerPort=41641, got %v", got0.RelayServerPort)
+	}
+	wantEndpoints := []netip.AddrPort{netip.MustParseAddrPort("1.2.3.4:41641")}
+	if !slices.Equal(got0.RelayServerStaticEndpoints, wantEndpoints) {
+		t.Errorf("replica 0: expected RelayServerStaticEndpoints=%v, got %v", wantEndpoints, got0.RelayServerStaticEndpoints)
+	}
+	if got0.Hostname == nil || *got0.Hostname != "test-0" {
+		t.Errorf("replica 0: expected hostname=test-0, got %v", got0.Hostname)
+	}
+
+	got1 := readTailscaledConfig(t, fc, "peerrelay-test-1-config")
+	if got1.RelayServerPort == nil || *got1.RelayServerPort != 41641 {
+		t.Errorf("replica 1: expected RelayServerPort=41641, got %v", got1.RelayServerPort)
+	}
+	// Replica 1's LB has not been provisioned yet, so no static endpoints.
+	if len(got1.RelayServerStaticEndpoints) != 0 {
+		t.Errorf("replica 1: expected no RelayServerStaticEndpoints, got %v", got1.RelayServerStaticEndpoints)
+	}
+}
+
+func readTailscaledConfig(t *testing.T, fc client.Client, secretName string) ipn.ConfigVAlpha {
+	t.Helper()
+
+	var secret corev1.Secret
+	if err := fc.Get(t.Context(), types.NamespacedName{Namespace: tailscaleNamespace, Name: secretName}, &secret); err != nil {
+		t.Fatalf("failed to get config Secret %q: %v", secretName, err)
+	}
+
+	if len(secret.Data) != 1 {
+		t.Fatalf("expected exactly one file in config Secret %q, got %d", secretName, len(secret.Data))
+	}
+
+	var conf ipn.ConfigVAlpha
+	for name, body := range secret.Data {
+		if err := json.Unmarshal(body, &conf); err != nil {
+			t.Fatalf("failed to unmarshal config file %q from Secret %q: %v", name, secretName, err)
+		}
+	}
+
+	return conf
+}
+
+func applyPatchInterceptor() interceptor.Funcs {
+	return interceptor.Funcs{
+		Patch: func(ctx context.Context, cl client.WithWatch, obj client.Object, patch client.Patch, opts ...client.PatchOption) error {
+			if patch.Type() != types.ApplyPatchType {
+				return cl.Patch(ctx, obj, patch, opts...)
+			}
+
+			key := client.ObjectKeyFromObject(obj)
+			existing := obj.DeepCopyObject().(client.Object)
+			if err := cl.Get(ctx, key, existing); err != nil {
+				if !apierrors.IsNotFound(err) {
+					return err
+				}
+
+				return cl.Create(ctx, obj)
+			}
+
+			obj.SetResourceVersion(existing.GetResourceVersion())
+			return cl.Update(ctx, obj)
+		},
+	}
+}
+
+type fakeClientProvider struct {
+	client tsclient.Client
+	err    error
+}
+
+func (p *fakeClientProvider) For(_ string) (tsclient.Client, error) { return p.client, p.err }
+
+type fakeTSClient struct {
+	tsclient.Client
+
+	mu            sync.Mutex
+	keyCalls      []tailscaleclient.CreateKeyRequest
+	deviceDeletes []string
+	nextKey       []string
+}
+
+func (c *fakeTSClient) Keys() tsclient.KeyResource       { return (*fakeKeys)(c) }
+func (c *fakeTSClient) Devices() tsclient.DeviceResource { return (*fakeDevices)(c) }
+
+func (c *fakeTSClient) CreateAuthKeyCalls() []tailscaleclient.CreateKeyRequest {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return slices.Clone(c.keyCalls)
+}
+
+func (c *fakeTSClient) DeviceDeletes() []string {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return slices.Clone(c.deviceDeletes)
+}
+
+type fakeKeys fakeTSClient
+
+func (k *fakeKeys) CreateAuthKey(_ context.Context, req tailscaleclient.CreateKeyRequest) (*tailscaleclient.Key, error) {
+	c := (*fakeTSClient)(k)
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.keyCalls = append(c.keyCalls, req)
+
+	var key string
+	if len(c.nextKey) > 0 {
+		key, c.nextKey = c.nextKey[0], c.nextKey[1:]
+	} else {
+		key = fmt.Sprintf("auth-key-%d", len(c.keyCalls))
+	}
+	return &tailscaleclient.Key{Key: key}, nil
+}
+
+func (k *fakeKeys) List(_ context.Context, _ bool) ([]tailscaleclient.Key, error) { return nil, nil }
+
+type fakeDevices fakeTSClient
+
+func (d *fakeDevices) Delete(_ context.Context, id string) error {
+	c := (*fakeTSClient)(d)
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.deviceDeletes = append(c.deviceDeletes, id)
+	return nil
+}
+
+func (d *fakeDevices) List(_ context.Context, _ ...tailscaleclient.ListDevicesOptions) ([]tailscaleclient.Device, error) {
+	return nil, nil
+}
+
+func (d *fakeDevices) Get(_ context.Context, _ string) (*tailscaleclient.Device, error) {
+	return nil, nil
+}
+
+func TestReconciler_AuthKey_Lifecycle(t *testing.T) {
+	t.Parallel()
+
+	logger, err := zap.NewDevelopment()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	t.Run("mints-key-on-first-reconcile", func(t *testing.T) {
+		pr := &tsapi.PeerRelay{ObjectMeta: metav1.ObjectMeta{Name: "test"}}
+		fc := fake.NewClientBuilder().WithInterceptorFuncs(applyPatchInterceptor()).
+			WithScheme(tsapi.GlobalScheme).
+			WithStatusSubresource(&tsapi.PeerRelay{}).
+			WithObjects(pr).
+			Build()
+
+		tsc := &fakeTSClient{nextKey: []string{"tskey-abc"}}
+		r := peerrelay.NewReconciler(peerrelay.ReconcilerOptions{
+			Client:             fc,
+			TailscaleNamespace: tailscaleNamespace,
+			ProxyImage:         testProxyImage,
+			DefaultTags:        []string{"tag:k8s-peer-relay"},
+			Clients:            &fakeClientProvider{client: tsc},
+			Resolver:           testResolver,
+			Logger:             logger.Sugar(),
+		})
+
+		if _, err := r.Reconcile(t.Context(), reconcile.Request{NamespacedName: types.NamespacedName{Name: "test"}}); err != nil {
+			t.Fatal(err)
+		}
+
+		calls := tsc.CreateAuthKeyCalls()
+		if len(calls) != 1 {
+			t.Fatalf("expected 1 CreateAuthKey call, got %d", len(calls))
+		}
+		gotTags := calls[0].Capabilities.Devices.Create.Tags
+		if !slices.Equal(gotTags, []string{"tag:k8s-peer-relay"}) {
+			t.Errorf("expected default tags, got %v", gotTags)
+		}
+
+		conf := readTailscaledConfig(t, fc, "peerrelay-test-0-config")
+		if conf.AuthKey == nil || *conf.AuthKey != "tskey-abc" {
+			t.Errorf("expected AuthKey=tskey-abc in config, got %v", conf.AuthKey)
+		}
+	})
+
+	t.Run("reuses-existing-key-across-reconciles", func(t *testing.T) {
+		pr := &tsapi.PeerRelay{ObjectMeta: metav1.ObjectMeta{Name: "test"}}
+		fc := fake.NewClientBuilder().WithInterceptorFuncs(applyPatchInterceptor()).
+			WithScheme(tsapi.GlobalScheme).
+			WithStatusSubresource(&tsapi.PeerRelay{}).
+			WithObjects(pr).
+			Build()
+
+		tsc := &fakeTSClient{nextKey: []string{"tskey-first", "tskey-second"}}
+		r := peerrelay.NewReconciler(peerrelay.ReconcilerOptions{
+			Client:             fc,
+			TailscaleNamespace: tailscaleNamespace,
+			ProxyImage:         testProxyImage,
+			DefaultTags:        []string{"tag:k8s-peer-relay"},
+			Clients:            &fakeClientProvider{client: tsc},
+			Resolver:           testResolver,
+			Logger:             logger.Sugar(),
+		})
+
+		if _, err = r.Reconcile(t.Context(), reconcile.Request{NamespacedName: types.NamespacedName{Name: "test"}}); err != nil {
+			t.Fatal(err)
+		}
+		if _, err = r.Reconcile(t.Context(), reconcile.Request{NamespacedName: types.NamespacedName{Name: "test"}}); err != nil {
+			t.Fatal(err)
+		}
+
+		if got := len(tsc.CreateAuthKeyCalls()); got != 1 {
+			t.Errorf("expected 1 CreateAuthKey call across two reconciles, got %d", got)
+		}
+
+		conf := readTailscaledConfig(t, fc, "peerrelay-test-0-config")
+		if conf.AuthKey == nil || *conf.AuthKey != "tskey-first" {
+			t.Errorf("expected AuthKey preserved as tskey-first, got %v", conf.AuthKey)
+		}
+	})
+
+	t.Run("uses-peer-relay-specific-tags", func(t *testing.T) {
+		pr := &tsapi.PeerRelay{
+			ObjectMeta: metav1.ObjectMeta{Name: "test"},
+			Spec:       tsapi.PeerRelaySpec{Tags: tsapi.Tags{"tag:custom"}},
+		}
+
+		fc := fake.NewClientBuilder().WithInterceptorFuncs(applyPatchInterceptor()).
+			WithScheme(tsapi.GlobalScheme).
+			WithStatusSubresource(&tsapi.PeerRelay{}).
+			WithObjects(pr).
+			Build()
+
+		tsc := &fakeTSClient{}
+
+		r := peerrelay.NewReconciler(peerrelay.ReconcilerOptions{
+			Client:             fc,
+			TailscaleNamespace: tailscaleNamespace,
+			ProxyImage:         testProxyImage,
+			DefaultTags:        []string{"tag:k8s-peer-relay"},
+			Clients:            &fakeClientProvider{client: tsc},
+			Resolver:           testResolver,
+			Logger:             logger.Sugar(),
+		})
+
+		if _, err = r.Reconcile(t.Context(), reconcile.Request{NamespacedName: types.NamespacedName{Name: "test"}}); err != nil {
+			t.Fatal(err)
+		}
+
+		calls := tsc.CreateAuthKeyCalls()
+		if len(calls) != 1 {
+			t.Fatalf("expected 1 CreateAuthKey call, got %d", len(calls))
+		}
+		gotTags := calls[0].Capabilities.Devices.Create.Tags
+		if !slices.Equal(gotTags, []string{"tag:custom"}) {
+			t.Errorf("expected pr-specific tags, got %v", gotTags)
+		}
+	})
+}
+
+func TestReconciler_DeletesTailnetDevices(t *testing.T) {
+	t.Parallel()
+
+	logger, err := zap.NewDevelopment()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// stateSecret seeds a Secret shaped like the ones the reconciler pre-creates: parent-resource labels + the
+	// tailscale.com/secret-type=state marker, containing (optionally) a device_id entry as if tailscaled had
+	// written it.
+	stateSecret := func(prName, name string, idx int32, deviceID string) *corev1.Secret {
+		labels := map[string]string{
+			"tailscale.com/managed":              "true",
+			"tailscale.com/parent-resource-type": "peerrelay",
+			"tailscale.com/parent-resource":      prName,
+			"tailscale.com/peer-relay-replica":   fmt.Sprintf("%d", idx),
+			"tailscale.com/secret-type":          "state",
+		}
+		s := &corev1.Secret{
+			ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: tailscaleNamespace, Labels: labels},
+		}
+		if deviceID != "" {
+			s.Data = map[string][]byte{"device_id": []byte(deviceID)}
+		}
+		return s
+	}
+
+	t.Run("full-delete-removes-all-devices-and-state-secrets", func(t *testing.T) {
+		pr := &tsapi.PeerRelay{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:              "test",
+				Finalizers:        []string{"tailscale.com/finalizer"},
+				DeletionTimestamp: new(metav1.Now()),
+			},
+			Spec: tsapi.PeerRelaySpec{Replicas: new(int32(2))},
+		}
+
+		fc := fake.NewClientBuilder().WithInterceptorFuncs(applyPatchInterceptor()).
+			WithScheme(tsapi.GlobalScheme).
+			WithStatusSubresource(&tsapi.PeerRelay{}, &appsv1.StatefulSet{}).
+			WithObjects(
+				pr,
+				stateSecret("test", "peerrelay-test-0", 0, "device-aaa"),
+				stateSecret("test", "peerrelay-test-1", 1, ""), // pod never registered , no device_id
+				stateSecret("other", "peerrelay-other-0", 0, "device-should-not-touch"),
+			).
+			Build()
+
+		tsc := &fakeTSClient{}
+		r := peerrelay.NewReconciler(peerrelay.ReconcilerOptions{
+			Client:             fc,
+			TailscaleNamespace: tailscaleNamespace,
+			ProxyImage:         testProxyImage,
+			DefaultTags:        []string{"tag:test-peer-relay"},
+			Clients:            &fakeClientProvider{client: tsc},
+			Resolver:           testResolver,
+			Logger:             logger.Sugar(),
+		})
+
+		if _, err = r.Reconcile(t.Context(), reconcile.Request{NamespacedName: types.NamespacedName{Name: "test"}}); err != nil {
+			t.Fatal(err)
+		}
+
+		if got, want := tsc.DeviceDeletes(), []string{"device-aaa"}; !slices.Equal(got, want) {
+			t.Errorf("expected Devices().Delete calls %v, got %v", want, got)
+		}
+
+		// Our state Secrets should be gone; the unrelated PeerRelay's state Secret should still be present.
+		for _, name := range []string{"peerrelay-test-0", "peerrelay-test-1"} {
+			var s corev1.Secret
+			if err = fc.Get(t.Context(), types.NamespacedName{Namespace: tailscaleNamespace, Name: name}, &s); !apierrors.IsNotFound(err) {
+				t.Errorf("expected state Secret %q gone, got err=%v", name, err)
+			}
+		}
+		var other corev1.Secret
+		if err = fc.Get(t.Context(), types.NamespacedName{Namespace: tailscaleNamespace, Name: "peerrelay-other-0"}, &other); err != nil {
+			t.Errorf("unexpected: state Secret for other PeerRelay was removed: %v", err)
+		}
+	})
+
+	t.Run("scale-down-removes-devices-for-removed-replicas-only", func(t *testing.T) {
+		pr := &tsapi.PeerRelay{
+			ObjectMeta: metav1.ObjectMeta{Name: "test"},
+			Spec:       tsapi.PeerRelaySpec{Replicas: new(int32(1))},
+		}
+
+		fc := fake.NewClientBuilder().WithInterceptorFuncs(applyPatchInterceptor()).
+			WithScheme(tsapi.GlobalScheme).
+			WithStatusSubresource(&tsapi.PeerRelay{}, &appsv1.StatefulSet{}).
+			WithObjects(
+				pr,
+				stateSecret("test", "peerrelay-test-0", 0, "device-still-here"),
+				stateSecret("test", "peerrelay-test-1", 1, "device-scaled-away-1"),
+				stateSecret("test", "peerrelay-test-2", 2, "device-scaled-away-2"),
+			).
+			Build()
+
+		tsc := &fakeTSClient{}
+		r := peerrelay.NewReconciler(peerrelay.ReconcilerOptions{
+			Client:             fc,
+			TailscaleNamespace: tailscaleNamespace,
+			ProxyImage:         testProxyImage,
+			DefaultTags:        []string{"tag:test-peer-relay"},
+			Clients:            &fakeClientProvider{client: tsc},
+			Resolver:           testResolver,
+			Logger:             logger.Sugar(),
+		})
+
+		if _, err = r.Reconcile(t.Context(), reconcile.Request{NamespacedName: types.NamespacedName{Name: "test"}}); err != nil {
+			t.Fatal(err)
+		}
+
+		got := tsc.DeviceDeletes()
+		slices.Sort(got)
+		want := []string{"device-scaled-away-1", "device-scaled-away-2"}
+		if !slices.Equal(got, want) {
+			t.Errorf("expected Devices().Delete calls %v, got %v", want, got)
+		}
+
+		var kept corev1.Secret
+		if err = fc.Get(t.Context(), types.NamespacedName{Namespace: tailscaleNamespace, Name: "peerrelay-test-0"}, &kept); err != nil {
+			t.Errorf("expected replica 0 state Secret preserved: %v", err)
+		}
+
+		for _, name := range []string{"peerrelay-test-1", "peerrelay-test-2"} {
+			var s corev1.Secret
+			if err = fc.Get(t.Context(), types.NamespacedName{Namespace: tailscaleNamespace, Name: name}, &s); !apierrors.IsNotFound(err) {
+				t.Errorf("expected state Secret %q gone after scale-down, got err=%v", name, err)
+			}
+		}
+	})
+}
+
+func TestReconciler_TailnetUnavailable(t *testing.T) {
+	t.Parallel()
+
+	logger, err := zap.NewDevelopment()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	pr := &tsapi.PeerRelay{
+		ObjectMeta: metav1.ObjectMeta{Name: "test"},
+		Spec:       tsapi.PeerRelaySpec{Tailnet: "missing"},
+	}
+
+	fc := fake.NewClientBuilder().WithInterceptorFuncs(applyPatchInterceptor()).
+		WithScheme(tsapi.GlobalScheme).
+		WithStatusSubresource(&tsapi.PeerRelay{}).
+		WithObjects(pr).
+		Build()
+
+	r := peerrelay.NewReconciler(peerrelay.ReconcilerOptions{
+		Client:             fc,
+		TailscaleNamespace: tailscaleNamespace,
+		ProxyImage:         testProxyImage,
+		DefaultTags:        []string{"tag:test-peer-relay"},
+		Clients:            &fakeClientProvider{err: errors.New("tailnet missing: not ready")},
+		Resolver:           testResolver,
+		Logger:             logger.Sugar(),
+	})
+
+	if _, err = r.Reconcile(t.Context(), reconcile.Request{NamespacedName: types.NamespacedName{Name: "test"}}); err == nil {
+		t.Fatal("expected reconcile to return the tailnet resolver error, got nil")
+	}
+
+	var got tsapi.PeerRelay
+	if err = fc.Get(t.Context(), types.NamespacedName{Name: "test"}, &got); err != nil {
+		t.Fatal(err)
+	}
+
+	cond := readyCondition(&got)
+	if cond.Status != metav1.ConditionFalse {
+		t.Errorf("expected PeerRelayReady=False, got %q", cond.Status)
+	}
+	if cond.Reason != peerrelay.ReasonTailnetUnavailable {
+		t.Errorf("expected reason=%s, got %q", peerrelay.ReasonTailnetUnavailable, cond.Reason)
+	}
+	if !strings.Contains(cond.Message, "not ready") {
+		t.Errorf("expected condition message to include resolver error, got %q", cond.Message)
+	}
+
+	var svcs corev1.ServiceList
+	if err = fc.List(t.Context(), &svcs, client.InNamespace(tailscaleNamespace)); err != nil {
+		t.Fatal(err)
+	}
+	if len(svcs.Items) != 0 {
+		t.Errorf("expected no Services created while tailnet is unavailable, got %d", len(svcs.Items))
+	}
+}
+
+func TestReconciler_AppliesProxyClass(t *testing.T) {
+	t.Parallel()
+
+	logger, err := zap.NewDevelopment()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	pr := &tsapi.PeerRelay{
+		ObjectMeta: metav1.ObjectMeta{Name: "test"},
+		Spec:       tsapi.PeerRelaySpec{ProxyClass: "custom"},
+	}
+
+	pc := &tsapi.ProxyClass{
+		ObjectMeta: metav1.ObjectMeta{Name: "custom"},
+		Spec: tsapi.ProxyClassSpec{
+			StatefulSet: &tsapi.StatefulSet{
+				Labels: tsapi.Labels{
+					"team":                          "networking",
+					"tailscale.com/parent-resource": "hijack-attempt", // must NOT overwrite reconciler-managed value
+				},
+				Annotations: map[string]string{"observability.example.com/scrape": "true"},
+				Pod: &tsapi.Pod{
+					NodeSelector: map[string]string{"pool": "peer-relays"},
+					TailscaleContainer: &tsapi.Container{
+						Resources: corev1.ResourceRequirements{
+							Requests: corev1.ResourceList{corev1.ResourceCPU: resource.MustParse("100m")},
+							Limits:   corev1.ResourceList{corev1.ResourceMemory: resource.MustParse("256Mi")},
+						},
+						Env: []tsapi.Env{{Name: "TS_DEBUG_FIREWALL_MODE", Value: "auto"}},
+					},
+				},
+			},
+		},
+	}
+
+	fc := fake.NewClientBuilder().WithInterceptorFuncs(applyPatchInterceptor()).
+		WithScheme(tsapi.GlobalScheme).
+		WithStatusSubresource(&tsapi.PeerRelay{}, &appsv1.StatefulSet{}).
+		WithObjects(pr, pc).
+		Build()
+
+	r := peerrelay.NewReconciler(peerrelay.ReconcilerOptions{
+		Client:             fc,
+		TailscaleNamespace: tailscaleNamespace,
+		ProxyImage:         testProxyImage,
+		DefaultTags:        []string{"tag:test-peer-relay"},
+		Clients:            &fakeClientProvider{client: &fakeTSClient{}},
+		Resolver:           testResolver,
+		Logger:             logger.Sugar(),
+	})
+
+	if _, err = r.Reconcile(t.Context(), reconcile.Request{NamespacedName: types.NamespacedName{Name: "test"}}); err != nil {
+		t.Fatal(err)
+	}
+
+	var ss appsv1.StatefulSet
+	if err = fc.Get(t.Context(), types.NamespacedName{Namespace: tailscaleNamespace, Name: "peerrelay-test"}, &ss); err != nil {
+		t.Fatal(err)
+	}
+
+	if got := ss.Labels["team"]; got != "networking" {
+		t.Errorf("expected StatefulSet label team=networking, got %q", got)
+	}
+
+	if got := ss.Labels["tailscale.com/parent-resource"]; got != "test" {
+		t.Errorf("expected reconciler-managed parent-resource label preserved as %q, got %q", "test", got)
+	}
+
+	if got := ss.Annotations["observability.example.com/scrape"]; got != "true" {
+		t.Errorf("expected StatefulSet annotation scrape=true, got %q", got)
+	}
+
+	if got := ss.Spec.Template.Spec.NodeSelector["pool"]; got != "peer-relays" {
+		t.Errorf("expected Pod nodeSelector pool=peer-relays, got %q", got)
+	}
+
+	if len(ss.Spec.Template.Spec.Containers) != 1 {
+		t.Fatalf("expected 1 container, got %d", len(ss.Spec.Template.Spec.Containers))
+	}
+
+	c := ss.Spec.Template.Spec.Containers[0]
+	if got, want := c.Resources.Requests[corev1.ResourceCPU], resource.MustParse("100m"); !got.Equal(want) {
+		t.Errorf("expected container CPU request %s, got %s", want.String(), got.String())
+	}
+
+	if got, want := c.Resources.Limits[corev1.ResourceMemory], resource.MustParse("256Mi"); !got.Equal(want) {
+		t.Errorf("expected container memory limit %s, got %s", want.String(), got.String())
+	}
+
+	var foundEnv bool
+	for _, e := range c.Env {
+		if e.Name == "TS_DEBUG_FIREWALL_MODE" && e.Value == "auto" {
+			foundEnv = true
+			break
+		}
+	}
+
+	if !foundEnv {
+		t.Errorf("expected TS_DEBUG_FIREWALL_MODE=auto env, container env is %+v", c.Env)
+	}
+}
diff --git a/k8s-operator/reconciler/peerrelay/service.go b/k8s-operator/reconciler/peerrelay/service.go
new file mode 100644
index 000000000..e8cd7b154
--- /dev/null
+++ b/k8s-operator/reconciler/peerrelay/service.go
@@ -0,0 +1,189 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !plan9
+
+package peerrelay
+
+import (
+	"context"
+	"fmt"
+	"maps"
+	"net/netip"
+	"slices"
+	"strconv"
+	"time"
+
+	"go.uber.org/zap"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/intstr"
+
+	tsapi "tailscale.com/k8s-operator/apis/v1alpha1"
+	"tailscale.com/k8s-operator/reconciler"
+)
+
+const (
+	// labelReplicaIndex stores the replica index of a managed Service so it can be matched back to a specific
+	// peer relay instance.
+	labelReplicaIndex = "tailscale.com/peer-relay-replica"
+
+	// parentTypePeerRelay is the value used for reconciler.LabelParentType on PeerRelay-managed resources.
+	parentTypePeerRelay = "peerrelay"
+
+	// servicePortName names the UDP port exposed by each Service. Mostly cosmetic, but Kubernetes requires a name
+	// once a Service has more than one port; using a stable name keeps the door open for that.
+	servicePortName = "peerrelay"
+
+	// servicePort is the UDP port that each peer relay container will listen on and that the LoadBalancer Service
+	// exposes externally.
+	servicePort = 41641
+
+	annotationEIPAllocations = "service.beta.kubernetes.io/aws-load-balancer-eip-allocations"
+	annotationSubnets        = "service.beta.kubernetes.io/aws-load-balancer-subnets"
+)
+
+// cloudAnnotations are the cloud-provider-specific annotations applied to every generated LoadBalancer Service to
+// ensure the Service is provisioned with a publicly addressable IP rather than a DNS name.
+var cloudAnnotations = map[string]string{
+	// AWS: provision an internet-facing NLB in IP target mode via the AWS Load Balancer Controller.
+	"service.beta.kubernetes.io/aws-load-balancer-type":            "external",
+	"service.beta.kubernetes.io/aws-load-balancer-nlb-target-type": "ip",
+	"service.beta.kubernetes.io/aws-load-balancer-scheme":          "internet-facing",
+	"service.beta.kubernetes.io/aws-load-balancer-ip-address-type": "ipv4",
+
+	// Azure: pin the LB to external.
+	"service.beta.kubernetes.io/azure-load-balancer-internal": "false",
+}
+
+func peerRelayLabels(prName string) map[string]string {
+	return reconciler.Labels(parentTypePeerRelay, prName, "")
+}
+
+func peerRelayServiceLabels(prName string, idx int32) map[string]string {
+	labels := peerRelayLabels(prName)
+	labels[labelReplicaIndex] = strconv.FormatInt(int64(idx), 10)
+	return labels
+}
+
+func resourceName(prName string) string {
+	return "peerrelay-" + prName
+}
+
+func replicaName(prName string, idx int32) string {
+	return fmt.Sprintf("%s-%d", resourceName(prName), idx)
+}
+
+func peerRelayServiceAnnotations(pr *tsapi.PeerRelay, idx int32) map[string]string {
+	annotations := make(map[string]string, len(cloudAnnotations))
+
+	if pr.Spec.Service != nil {
+		maps.Copy(annotations, pr.Spec.Service.Annotations)
+	}
+
+	maps.Copy(annotations, cloudAnnotations)
+
+	// Per-replica AWS pinning always wins over anything in spec.service.annotations or the cloud defaults so users
+	// can rely on spec.aws.elasticIPs being the single source of truth for each replica's EIP + subnet.
+	if pr.Spec.AWS != nil && int(idx) < len(pr.Spec.AWS.ElasticIPs) {
+		eip := pr.Spec.AWS.ElasticIPs[idx]
+		annotations[annotationEIPAllocations] = eip.AllocationID
+		annotations[annotationSubnets] = eip.SubnetID
+	}
+
+	return annotations
+}
+
+func (r *Reconciler) peerRelayService(pr *tsapi.PeerRelay, idx int32) *corev1.Service {
+	name := replicaName(pr.Name, idx)
+
+	return &corev1.Service{
+		TypeMeta: metav1.TypeMeta{
+			APIVersion: "v1",
+			Kind:       "Service",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Name:        name,
+			Namespace:   r.tailscaleNamespace,
+			Labels:      peerRelayServiceLabels(pr.Name, idx),
+			Annotations: peerRelayServiceAnnotations(pr, idx),
+		},
+		Spec: corev1.ServiceSpec{
+			Type: corev1.ServiceTypeLoadBalancer,
+			// The Service targets the specific StatefulSet pod for this replica. The StatefulSet controller
+			// automatically sets this label on each pod.
+			Selector: map[string]string{
+				"statefulset.kubernetes.io/pod-name": name,
+			},
+			Ports: []corev1.ServicePort{
+				{
+					Name:       servicePortName,
+					Protocol:   corev1.ProtocolUDP,
+					Port:       servicePort,
+					TargetPort: intstr.FromInt32(servicePort),
+				},
+			},
+		},
+	}
+}
+
+func replicaIndexFromLabels(labels map[string]string) (int32, bool) {
+	raw, ok := labels[labelReplicaIndex]
+	if !ok {
+		return 0, false
+	}
+
+	n, err := strconv.ParseInt(raw, 10, 32)
+	if err != nil {
+		return 0, false
+	}
+
+	return int32(n), true
+}
+
+func (r *Reconciler) peerRelayEndpoint(ctx context.Context, logger *zap.SugaredLogger, svc *corev1.Service, prev *tsapi.PeerRelayEndpoint) *tsapi.PeerRelayEndpoint {
+	idx, ok := replicaIndexFromLabels(svc.Labels)
+	if !ok {
+		return nil
+	}
+
+	for _, ing := range svc.Status.LoadBalancer.Ingress {
+		if ing.IP != "" {
+			return &tsapi.PeerRelayEndpoint{Replica: idx, Address: ing.IP, Port: servicePort}
+		}
+	}
+
+	// Just return nil if we're not dealing with AWS fun.
+	if _, ok = svc.Annotations[annotationEIPAllocations]; !ok {
+		return nil
+	}
+
+	// If we were not able to obtain an IP address, we fall back to an IPv4 lookup. This is specifically for the case
+	// of AWS where NLB-backed Service resources are only ever given hostnames. We expect users to also provide
+	// an annotation with their elastic IP allocations so that there is only ever 1 IP address behind the hostname, so
+	// we perform a lookup so that the user doesn't also need to provide that IP address.
+	for _, ing := range svc.Status.LoadBalancer.Ingress {
+		if ing.Hostname == "" {
+			continue
+		}
+
+		resolveCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
+		defer cancel()
+
+		addrs, err := r.resolver(resolveCtx, "ip4", ing.Hostname)
+		if err != nil || len(addrs) == 0 {
+			logger.Warnf("failed to resolve LoadBalancer hostname %q for Service %q: %v", ing.Hostname, svc.Name, err)
+			// Preserve the previously-known endpoint (if any) so that a failure here doesn't erase status.endpoints.
+			if prev != nil {
+				return prev
+			}
+
+			continue
+		}
+
+		slices.SortFunc(addrs, netip.Addr.Compare)
+		return &tsapi.PeerRelayEndpoint{Replica: idx, Address: addrs[0].String(), Port: servicePort}
+	}
+
+	return nil
+}
diff --git a/k8s-operator/reconciler/peerrelay/statefulset.go b/k8s-operator/reconciler/peerrelay/statefulset.go
new file mode 100644
index 000000000..ecf0ab854
--- /dev/null
+++ b/k8s-operator/reconciler/peerrelay/statefulset.go
@@ -0,0 +1,101 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !plan9
+
+package peerrelay
+
+import (
+	"context"
+	"fmt"
+	"net/netip"
+
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/types"
+
+	"tailscale.com/ipn"
+	tsapi "tailscale.com/k8s-operator/apis/v1alpha1"
+	"tailscale.com/k8s-operator/reconciler"
+	"tailscale.com/k8s-operator/reconciler/tailscaled"
+	"tailscale.com/kube/kubetypes"
+)
+
+func configSecretName(prName string, idx int32) string {
+	return replicaName(prName, idx) + "-config"
+}
+
+func peerRelayHostname(pr *tsapi.PeerRelay, idx int32) string {
+	prefix := string(pr.Spec.HostnamePrefix)
+	if prefix == "" {
+		prefix = pr.Name
+	}
+	return fmt.Sprintf("%s-%d", prefix, idx)
+}
+
+func peerRelayTailscaledConfig(pr *tsapi.PeerRelay, idx int32, endpoint *tsapi.PeerRelayEndpoint, authKey *string) ipn.ConfigVAlpha {
+	conf := ipn.ConfigVAlpha{
+		Version:         "alpha0",
+		AcceptDNS:       "false",
+		AcceptRoutes:    "false",
+		Locked:          "false",
+		Hostname:        new(peerRelayHostname(pr, idx)),
+		RelayServerPort: new(uint16(servicePort)),
+		AuthKey:         authKey,
+	}
+
+	if endpoint != nil {
+		if addr, err := netip.ParseAddr(endpoint.Address); err == nil {
+			conf.RelayServerStaticEndpoints = []netip.AddrPort{
+				netip.AddrPortFrom(addr, uint16(endpoint.Port)),
+			}
+		}
+	}
+
+	return conf
+}
+
+func (r *Reconciler) peerRelayConfigSecret(pr *tsapi.PeerRelay, idx int32, endpoint *tsapi.PeerRelayEndpoint, authKey *string) (*corev1.Secret, error) {
+	labels := peerRelayServiceLabels(pr.Name, idx)
+	return tailscaled.NewConfigSecret(tailscaled.ConfigSecretOptions{
+		Name:      configSecretName(pr.Name, idx),
+		Namespace: r.tailscaleNamespace,
+		Labels:    labels,
+		Config:    peerRelayTailscaledConfig(pr, idx, endpoint, authKey),
+	})
+}
+
+func (r *Reconciler) peerRelayStatefulSet(pr *tsapi.PeerRelay, replicas int32, pc *tsapi.ProxyClass) *appsv1.StatefulSet {
+	labels := peerRelayLabels(pr.Name)
+	ss := tailscaled.NewStatefulSet(tailscaled.StatefulSetOptions{
+		Name:               resourceName(pr.Name),
+		Namespace:          r.tailscaleNamespace,
+		Labels:             labels,
+		Image:              r.proxyImage,
+		Replicas:           replicas,
+		ServiceAccountName: "proxies",
+		ConfigSecretNameFunc: func(idx int32) string {
+			return configSecretName(pr.Name, idx)
+		},
+	})
+
+	return tailscaled.ApplyProxyClass(ss, pc, managedLabelKeys, nil)
+}
+
+var managedLabelKeys = []string{
+	kubetypes.LabelManaged,
+	reconciler.LabelParentType,
+	reconciler.LabelParentName,
+}
+
+func (r *Reconciler) getProxyClass(ctx context.Context, pr *tsapi.PeerRelay) (*tsapi.ProxyClass, error) {
+	if pr.Spec.ProxyClass == "" {
+		return nil, nil
+	}
+
+	var pc tsapi.ProxyClass
+	if err := r.Get(ctx, types.NamespacedName{Name: pr.Spec.ProxyClass}, &pc); err != nil {
+		return nil, fmt.Errorf("failed to get ProxyClass %q: %w", pr.Spec.ProxyClass, err)
+	}
+	return &pc, nil
+}
diff --git a/k8s-operator/reconciler/reconciler.go b/k8s-operator/reconciler/reconciler.go
index fcad7201e..4453c9f18 100644
--- a/k8s-operator/reconciler/reconciler.go
+++ b/k8s-operator/reconciler/reconciler.go
@@ -8,14 +8,32 @@
 package reconciler
 
 import (
+	"context"
 	"slices"
 
+	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/handler"
+	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+
+	"tailscale.com/kube/kubetypes"
 )
 
 const (
 	// FinalizerName is the common finalizer used across all Tailscale Kubernetes resources.
 	FinalizerName = "tailscale.com/finalizer"
+
+	// LabelParentType identifies which Tailscale CRD kind owns a managed resource. Every resource that a Tailscale
+	// CRD reconciler creates should carry this label alongside LabelParentName.
+	LabelParentType = "tailscale.com/parent-resource-type"
+
+	// LabelParentName identifies the name of the Tailscale CRD that owns a managed resource. Combined with
+	// LabelParentType, this uniquely identifies the parent within its scope.
+	LabelParentName = "tailscale.com/parent-resource"
+
+	// LabelParentNamespace identifies the namespace of the owning Tailscale CRD. It is only stamped when the parent
+	// CRD is namespaced; cluster-scoped parents omit it.
+	LabelParentNamespace = "tailscale.com/parent-resource-ns"
 )
 
 // SetFinalizer adds the finalizer to the resource if not already present.
@@ -37,3 +55,41 @@ func RemoveFinalizer(obj client.Object) {
 	finalizers := obj.GetFinalizers()
 	obj.SetFinalizers(append(finalizers[:idx], finalizers[idx+1:]...))
 }
+
+// Labels returns the standard ownership labels stamped on every resource a Tailscale CRD reconciler creates:
+// tailscale.com/managed=true, plus LabelParentType and LabelParentName. If parentNamespace is non-empty (i.e. the
+// parent CRD is namespaced) it is stamped as LabelParentNamespace; cluster-scoped parents pass "".
+func Labels(parentType, parentName, parentNamespace string) map[string]string {
+	labels := map[string]string{
+		kubetypes.LabelManaged: "true",
+		LabelParentType:        parentType,
+		LabelParentName:        parentName,
+	}
+	if parentNamespace != "" {
+		labels[LabelParentNamespace] = parentNamespace
+	}
+	return labels
+}
+
+// EnqueueForChild returns a handler.MapFunc that enqueues a reconcile.Request for the parent CRD of a managed child
+// resource. It filters by tailscale.com/managed=true and LabelParentType, and derives the request's NamespacedName
+// from LabelParentName plus LabelParentNamespace (blank namespace for cluster-scoped parents). Use it on Watches of
+// child resources so drift or cloud-controller updates propagate to the owning CRD's reconciler.
+func EnqueueForChild(parentType string) handler.MapFunc {
+	return func(_ context.Context, o client.Object) []reconcile.Request {
+		labels := o.GetLabels()
+		if labels[kubetypes.LabelManaged] != "true" || labels[LabelParentType] != parentType {
+			return nil
+		}
+
+		name := labels[LabelParentName]
+		if name == "" {
+			return nil
+		}
+
+		return []reconcile.Request{{NamespacedName: types.NamespacedName{
+			Name:      name,
+			Namespace: labels[LabelParentNamespace],
+		}}}
+	}
+}
diff --git a/k8s-operator/reconciler/reconciler_test.go b/k8s-operator/reconciler/reconciler_test.go
index 2db77e7aa..48cb2f301 100644
--- a/k8s-operator/reconciler/reconciler_test.go
+++ b/k8s-operator/reconciler/reconciler_test.go
@@ -6,11 +6,14 @@
 package reconciler_test
 
 import (
+	"maps"
 	"slices"
 	"testing"
 
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	ctrlreconcile "sigs.k8s.io/controller-runtime/pkg/reconcile"
 
 	"tailscale.com/k8s-operator/reconciler"
 )
@@ -40,3 +43,99 @@ func TestFinalizers(t *testing.T) {
 		t.Fatalf("object still has finalizer %q: %v", reconciler.FinalizerName, object.Finalizers)
 	}
 }
+
+func TestLabels(t *testing.T) {
+	t.Parallel()
+
+	t.Run("cluster-scoped-parent", func(t *testing.T) {
+		got := reconciler.Labels("peerrelay", "test", "")
+		want := map[string]string{
+			"tailscale.com/managed":              "true",
+			"tailscale.com/parent-resource-type": "peerrelay",
+			"tailscale.com/parent-resource":      "test",
+		}
+		if !maps.Equal(got, want) {
+			t.Errorf("expected %v, got %v", want, got)
+		}
+	})
+
+	t.Run("namespaced-parent", func(t *testing.T) {
+		got := reconciler.Labels("connector", "test", "kube-system")
+		want := map[string]string{
+			"tailscale.com/managed":              "true",
+			"tailscale.com/parent-resource-type": "connector",
+			"tailscale.com/parent-resource":      "test",
+			"tailscale.com/parent-resource-ns":   "kube-system",
+		}
+		if !maps.Equal(got, want) {
+			t.Errorf("expected %v, got %v", want, got)
+		}
+	})
+}
+
+func TestEnqueueForChild(t *testing.T) {
+	t.Parallel()
+
+	enqueue := reconciler.EnqueueForChild("peerrelay")
+
+	tests := []struct {
+		name   string
+		labels map[string]string
+		want   []ctrlreconcile.Request
+	}{
+		{
+			name: "matching-cluster-scoped",
+			labels: map[string]string{
+				"tailscale.com/managed":              "true",
+				"tailscale.com/parent-resource-type": "peerrelay",
+				"tailscale.com/parent-resource":      "test",
+			},
+			want: []ctrlreconcile.Request{{NamespacedName: types.NamespacedName{Name: "test"}}},
+		},
+		{
+			name: "matching-namespaced",
+			labels: map[string]string{
+				"tailscale.com/managed":              "true",
+				"tailscale.com/parent-resource-type": "peerrelay",
+				"tailscale.com/parent-resource":      "test",
+				"tailscale.com/parent-resource-ns":   "kube-system",
+			},
+			want: []ctrlreconcile.Request{{NamespacedName: types.NamespacedName{Name: "test", Namespace: "kube-system"}}},
+		},
+		{
+			name: "not-managed",
+			labels: map[string]string{
+				"tailscale.com/parent-resource-type": "peerrelay",
+				"tailscale.com/parent-resource":      "test",
+			},
+		},
+		{
+			name: "wrong-parent-type",
+			labels: map[string]string{
+				"tailscale.com/managed":              "true",
+				"tailscale.com/parent-resource-type": "proxygroup",
+				"tailscale.com/parent-resource":      "test",
+			},
+		},
+		{
+			name: "missing-parent-name",
+			labels: map[string]string{
+				"tailscale.com/managed":              "true",
+				"tailscale.com/parent-resource-type": "peerrelay",
+			},
+		},
+		{
+			name: "no-labels",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			obj := &corev1.Secret{ObjectMeta: metav1.ObjectMeta{Labels: tc.labels}}
+			got := enqueue(t.Context(), obj)
+			if !slices.Equal(got, tc.want) {
+				t.Errorf("expected %v, got %v", tc.want, got)
+			}
+		})
+	}
+}
diff --git a/k8s-operator/reconciler/tailnet/tailnet.go b/k8s-operator/reconciler/tailnet/tailnet.go
index e30bb2170..d0c7432c9 100644
--- a/k8s-operator/reconciler/tailnet/tailnet.go
+++ b/k8s-operator/reconciler/tailnet/tailnet.go
@@ -4,8 +4,8 @@
 //go:build !plan9
 
 // Package tailnet provides reconciliation logic for the Tailnet custom resource definition. It is responsible for
-// ensuring the referenced OAuth credentials are valid and have the required scopes to be able to generate authentication
-// keys, manage devices & manage VIP services.
+// ensuring the referenced credentials (either an OAuth client or a workload identity federation configuration) are
+// valid and have the required scopes to be able to generate authentication keys, manage devices & manage VIP services.
 package tailnet
 
 import (
@@ -17,6 +17,7 @@ import (
 	"time"
 
 	"go.uber.org/zap"
+	authnv1 "k8s.io/api/authentication/v1"
 	corev1 "k8s.io/api/core/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -45,6 +46,7 @@ type (
 		client.Client
 
 		tailscaleNamespace string
+		operatorSAName     string
 		clock              tstime.Clock
 		logger             *zap.SugaredLogger
 		clientFunc         func(*tsapi.Tailnet, *corev1.Secret) tsclient.Client
@@ -59,9 +61,13 @@ type (
 	ReconcilerOptions struct {
 		// The client for interacting with the Kubernetes API.
 		Client client.Client
-		// The namespace the operator is installed in. This reconciler expects Tailnet OAuth credentials to be stored
+		// The namespace the operator is installed in. This reconciler expects Tailnet credentials to be stored
 		// in Secret resources within this namespace.
 		TailscaleNamespace string
+		// The name of the ServiceAccount the operator runs as, in TailscaleNamespace. This is used as the target
+		// ServiceAccount when minting tokens via the Kubernetes TokenRequest API for Tailnets that authenticate
+		// using workload identity federation.
+		OperatorSAName string
 		// Controls which clock to use for performing time-based functions. This is typically modified for use
 		// in tests.
 		Clock tstime.Clock
@@ -92,6 +98,7 @@ func NewReconciler(options ReconcilerOptions) *Reconciler {
 	return &Reconciler{
 		Client:             options.Client,
 		tailscaleNamespace: options.TailscaleNamespace,
+		operatorSAName:     options.OperatorSAName,
 		clock:              options.Clock,
 		logger:             options.Logger.Named(reconcilerName),
 		clientFunc:         options.ClientFunc,
@@ -243,10 +250,11 @@ func (r *Reconciler) createOrUpdate(ctx context.Context, tailnet *tsapi.Tailnet)
 	return reconcile.Result{}, nil
 }
 
-// Constants for OAuth credential fields within the Secret referenced by the Tailnet.
+// Constants for credential fields within the Secret referenced by the Tailnet.
 const (
 	clientIDKey     = "client_id"
 	clientSecretKey = "client_secret"
+	audienceKey     = "audience"
 )
 
 func (r *Reconciler) createClient(tailnet *tsapi.Tailnet, secret *corev1.Secret) (tsclient.Client, error) {
@@ -264,16 +272,61 @@ func (r *Reconciler) createClient(tailnet *tsapi.Tailnet, secret *corev1.Secret)
 		return nil, fmt.Errorf("failed to parse base URL %q: %w", baseURL, err)
 	}
 
+	var auth tailscale.Auth
+
+	clientID := string(secret.Data[clientIDKey])
+	audience := string(secret.Data[audienceKey])
+	clientSecret := string(secret.Data[clientSecretKey])
+
+	switch {
+	case audience != "":
+		// If the audience field is present, we assume workload identity as the authentication method.
+		auth = &tailscale.IdentityFederation{
+			ClientID:    clientID,
+			IDTokenFunc: r.createToken(audience),
+		}
+	case clientSecret != "":
+		// For a client secret, we assume oauth.
+		auth = &tailscale.OAuth{
+			ClientID:     clientID,
+			ClientSecret: clientSecret,
+		}
+	default:
+		// We shouldn't land here as previous functions will have ensured the validity of the secret, but we
+		// error here anyway as we won't know what to do:
+		return nil, errors.New("unable to determine authentication method")
+	}
+
 	return tsclient.Wrap(&tailscale.Client{
 		BaseURL:   base,
 		UserAgent: "tailscale-k8s-operator",
-		Auth: &tailscale.OAuth{
-			ClientID:     string(secret.Data[clientIDKey]),
-			ClientSecret: string(secret.Data[clientSecretKey]),
-		},
+		Auth:      auth,
 	}), nil
 }
 
+func (r *Reconciler) createToken(audience string) func() (string, error) {
+	return func() (string, error) {
+		serviceAccount := &corev1.ServiceAccount{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      r.operatorSAName,
+				Namespace: r.tailscaleNamespace,
+			},
+		}
+
+		tokenRequest := &authnv1.TokenRequest{
+			Spec: authnv1.TokenRequestSpec{
+				Audiences: []string{audience},
+			},
+		}
+
+		if err := r.SubResource("token").Create(context.Background(), serviceAccount, tokenRequest); err != nil {
+			return "", fmt.Errorf("failed to mint service account token for %q in namespace %q: %w", r.operatorSAName, r.tailscaleNamespace, err)
+		}
+
+		return tokenRequest.Status.Token, nil
+	}
+}
+
 func (r *Reconciler) ensurePermissions(ctx context.Context, tsClient tsclient.Client, tailnet *tsapi.Tailnet) bool {
 	// Perform basic list requests here to confirm that the OAuth credentials referenced on the Tailnet resource
 	// can perform the basic operations required for the operator to function. This has a caveat of only performing
@@ -281,15 +334,15 @@ func (r *Reconciler) ensurePermissions(ctx context.Context, tsClient tsclient.Cl
 	// has completely forgotten an entire scope that's required.
 	var errs error
 	if _, err := tsClient.Devices().List(ctx); err != nil {
-		errs = errors.Join(errs, fmt.Errorf("failed to list devices: %w", err))
+		errs = errors.Join(errs, fmt.Errorf("failed to list devices: %w (client may be missing the devices scope)", err))
 	}
 
 	if _, err := tsClient.Keys().List(ctx, false); err != nil {
-		errs = errors.Join(errs, fmt.Errorf("failed to list auth keys: %w", err))
+		errs = errors.Join(errs, fmt.Errorf("failed to list auth keys: %w (client may be missing the keys scope)", err))
 	}
 
 	if _, err := tsClient.VIPServices().List(ctx); err != nil {
-		errs = errors.Join(errs, fmt.Errorf("failed to list tailscale services: %w", err))
+		errs = errors.Join(errs, fmt.Errorf("failed to list tailscale services: %w (client may be missing the services scope)", err))
 	}
 
 	if errs != nil {
@@ -317,8 +370,8 @@ func (r *Reconciler) ensureSecret(tailnet *tsapi.Tailnet, secret *corev1.Secret)
 		message = fmt.Sprintf("Secret %q is empty", secret.Name)
 	case len(secret.Data[clientIDKey]) == 0:
 		message = fmt.Sprintf("Secret %q is missing the client_id field", secret.Name)
-	case len(secret.Data[clientSecretKey]) == 0:
-		message = fmt.Sprintf("Secret %q is missing the client_secret field", secret.Name)
+	case len(secret.Data[clientSecretKey]) == 0 && len(secret.Data[audienceKey]) == 0:
+		message = fmt.Sprintf("Secret %q must contain either a client_secret or an audience field", secret.Name)
 	}
 
 	if message == "" {
diff --git a/k8s-operator/reconciler/tailnet/tailnet_test.go b/k8s-operator/reconciler/tailnet/tailnet_test.go
index 513ed7b84..36a7ea774 100644
--- a/k8s-operator/reconciler/tailnet/tailnet_test.go
+++ b/k8s-operator/reconciler/tailnet/tailnet_test.go
@@ -141,7 +141,7 @@ func TestReconciler_Reconcile(t *testing.T) {
 			},
 		},
 		{
-			Name: "invalid-status-missing-client-secret",
+			Name: "invalid-status-missing-client-secret-and-audience",
 			Request: reconcile.Request{
 				NamespacedName: types.NamespacedName{
 					Name: "test",
@@ -171,7 +171,7 @@ func TestReconciler_Reconcile(t *testing.T) {
 					Type:    string(tsapi.TailnetReady),
 					Status:  metav1.ConditionFalse,
 					Reason:  tailnet.ReasonInvalidSecret,
-					Message: `Secret "test" is missing the client_secret field`,
+					Message: `Secret "test" must contain either a client_secret or an audience field`,
 				},
 			},
 		},
@@ -210,7 +210,7 @@ func TestReconciler_Reconcile(t *testing.T) {
 					Type:    string(tsapi.TailnetReady),
 					Status:  metav1.ConditionFalse,
 					Reason:  tailnet.ReasonInvalidOAuth,
-					Message: `failed to list devices: EOF`,
+					Message: `failed to list devices: EOF (client may be missing the devices scope)`,
 				},
 			},
 		},
@@ -249,7 +249,7 @@ func TestReconciler_Reconcile(t *testing.T) {
 					Type:    string(tsapi.TailnetReady),
 					Status:  metav1.ConditionFalse,
 					Reason:  tailnet.ReasonInvalidOAuth,
-					Message: `failed to list tailscale services: EOF`,
+					Message: `failed to list tailscale services: EOF (client may be missing the services scope)`,
 				},
 			},
 		},
@@ -288,7 +288,7 @@ func TestReconciler_Reconcile(t *testing.T) {
 					Type:    string(tsapi.TailnetReady),
 					Status:  metav1.ConditionFalse,
 					Reason:  tailnet.ReasonInvalidOAuth,
-					Message: `failed to list auth keys: EOF`,
+					Message: `failed to list auth keys: EOF (client may be missing the keys scope)`,
 				},
 			},
 		},
@@ -331,6 +331,45 @@ func TestReconciler_Reconcile(t *testing.T) {
 				},
 			},
 		},
+		{
+			Name: "ready-workload-identity",
+			Request: reconcile.Request{
+				NamespacedName: types.NamespacedName{
+					Name: "default",
+				},
+			},
+			Tailnet: &tsapi.Tailnet{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "default",
+				},
+				Spec: tsapi.TailnetSpec{
+					Credentials: tsapi.TailnetCredentials{
+						SecretName: "test",
+					},
+				},
+			},
+			Secret: &corev1.Secret{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "test",
+					Namespace: "tailscale",
+				},
+				Data: map[string][]byte{
+					"client_id": []byte("test"),
+					"audience":  []byte("https://tailscale.com"),
+				},
+			},
+			ClientFunc: func(_ *tsapi.Tailnet, _ *corev1.Secret) tsclient.Client {
+				return &MockTailnetClient{}
+			},
+			ExpectedConditions: []metav1.Condition{
+				{
+					Type:    string(tsapi.TailnetReady),
+					Status:  metav1.ConditionTrue,
+					Reason:  tailnet.ReasonValid,
+					Message: tailnet.ReasonValid,
+				},
+			},
+		},
 	}
 
 	for _, tc := range tt {
diff --git a/k8s-operator/reconciler/tailscaled/authkey.go b/k8s-operator/reconciler/tailscaled/authkey.go
new file mode 100644
index 000000000..478b8cfa4
--- /dev/null
+++ b/k8s-operator/reconciler/tailscaled/authkey.go
@@ -0,0 +1,56 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !plan9
+
+package tailscaled
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	corev1 "k8s.io/api/core/v1"
+
+	tailscaleclient "tailscale.com/client/tailscale/v2"
+
+	"tailscale.com/ipn"
+	"tailscale.com/k8s-operator/tsclient"
+)
+
+// ClientProvider returns a Tailscale API client for the given tailnet name. A blank name should return the
+// operator's default client.
+type ClientProvider interface {
+	For(tailnet string) (tsclient.Client, error)
+}
+
+// NewAuthKey mints a single-use, preauthorized tailnet auth key with the given tags. The key is intended for one
+// tailscaled pod to consume on first startup; callers should not persist or share it.
+func NewAuthKey(ctx context.Context, client tsclient.Client, tags []string) (string, error) {
+	var caps tailscaleclient.KeyCapabilities
+	caps.Devices.Create.Reusable = false
+	caps.Devices.Create.Preauthorized = true
+	caps.Devices.Create.Tags = tags
+
+	key, err := client.Keys().CreateAuthKey(ctx, tailscaleclient.CreateKeyRequest{Capabilities: caps})
+	if err != nil {
+		return "", fmt.Errorf("failed to create auth key: %w", err)
+	}
+	return key.Key, nil
+}
+
+// AuthKeyFromConfigSecret returns the auth key embedded in the tailscaled config file stored in secret, or nil if
+// none is set. secret is expected to be a Secret produced by NewConfigSecret. The Data map may contain multiple
+// versioned config files (cap-<n>.hujson); the first one to parse successfully and yield a non-empty AuthKey wins.
+func AuthKeyFromConfigSecret(secret *corev1.Secret) *string {
+	for _, body := range secret.Data {
+		var conf ipn.ConfigVAlpha
+		if err := json.Unmarshal(body, &conf); err != nil {
+			continue
+		}
+		if conf.AuthKey != nil && *conf.AuthKey != "" {
+			return conf.AuthKey
+		}
+	}
+	return nil
+}
diff --git a/k8s-operator/reconciler/tailscaled/proxyclass.go b/k8s-operator/reconciler/tailscaled/proxyclass.go
new file mode 100644
index 000000000..cecb93efb
--- /dev/null
+++ b/k8s-operator/reconciler/tailscaled/proxyclass.go
@@ -0,0 +1,115 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !plan9
+
+package tailscaled
+
+import (
+	"slices"
+
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+
+	tsapi "tailscale.com/k8s-operator/apis/v1alpha1"
+)
+
+// ApplyProxyClass overlays the settings in pc onto ss. It's the generic slice of ProxyClass application used by
+// any reconciler that produces a tailscaled StatefulSet (peer relay, connector, proxy group, etc.).
+func ApplyProxyClass(ss *appsv1.StatefulSet, pc *tsapi.ProxyClass, managedLabels, managedAnnotations []string) *appsv1.StatefulSet {
+	if pc == nil || ss == nil || pc.Spec.StatefulSet == nil {
+		return ss
+	}
+
+	if wantsLabels := pc.Spec.StatefulSet.Labels.Parse(); len(wantsLabels) > 0 {
+		ss.ObjectMeta.Labels = mergeProtected(ss.ObjectMeta.Labels, wantsLabels, managedLabels)
+	}
+
+	if wantsAnnots := pc.Spec.StatefulSet.Annotations; len(wantsAnnots) > 0 {
+		ss.ObjectMeta.Annotations = mergeProtected(ss.ObjectMeta.Annotations, wantsAnnots, managedAnnotations)
+	}
+
+	if pc.Spec.StatefulSet.Pod == nil {
+		return ss
+	}
+	wantsPod := pc.Spec.StatefulSet.Pod
+
+	if wantsPodLabels := wantsPod.Labels.Parse(); len(wantsPodLabels) > 0 {
+		ss.Spec.Template.ObjectMeta.Labels = mergeProtected(ss.Spec.Template.ObjectMeta.Labels, wantsPodLabels, managedLabels)
+	}
+
+	if wantsPodAnnots := wantsPod.Annotations; len(wantsPodAnnots) > 0 {
+		ss.Spec.Template.ObjectMeta.Annotations = mergeProtected(ss.Spec.Template.ObjectMeta.Annotations, wantsPodAnnots, managedAnnotations)
+	}
+
+	ss.Spec.Template.Spec.SecurityContext = wantsPod.SecurityContext
+	ss.Spec.Template.Spec.ImagePullSecrets = wantsPod.ImagePullSecrets
+	ss.Spec.Template.Spec.NodeName = wantsPod.NodeName
+	ss.Spec.Template.Spec.NodeSelector = wantsPod.NodeSelector
+	ss.Spec.Template.Spec.Affinity = wantsPod.Affinity
+	ss.Spec.Template.Spec.Tolerations = wantsPod.Tolerations
+	ss.Spec.Template.Spec.PriorityClassName = wantsPod.PriorityClassName
+	ss.Spec.Template.Spec.TopologySpreadConstraints = wantsPod.TopologySpreadConstraints
+
+	if wantsPod.DNSPolicy != nil {
+		ss.Spec.Template.Spec.DNSPolicy = *wantsPod.DNSPolicy
+	}
+
+	if wantsPod.DNSConfig != nil {
+		ss.Spec.Template.Spec.DNSConfig = wantsPod.DNSConfig
+	}
+
+	if wantsPod.TailscaleContainer != nil {
+		for i := range ss.Spec.Template.Spec.Containers {
+			c := &ss.Spec.Template.Spec.Containers[i]
+			if c.Name != containerName {
+				continue
+			}
+
+			applyContainerOverlay(c, wantsPod.TailscaleContainer)
+			break
+		}
+	}
+
+	return ss
+}
+
+func mergeProtected(current, custom map[string]string, protected []string) map[string]string {
+	if custom == nil {
+		custom = make(map[string]string)
+	}
+	for k, v := range current {
+		if slices.Contains(protected, k) {
+			custom[k] = v
+		}
+	}
+	return custom
+}
+
+func applyContainerOverlay(c *corev1.Container, overlay *tsapi.Container) {
+	if overlay.SecurityContext != nil {
+		c.SecurityContext = overlay.SecurityContext
+	}
+
+	if len(overlay.Resources.Requests) > 0 {
+		c.Resources.Requests = overlay.Resources.Requests
+	}
+
+	if len(overlay.Resources.Limits) > 0 {
+		c.Resources.Limits = overlay.Resources.Limits
+	}
+
+	for _, e := range overlay.Env {
+		// Env vars added by ProxyClass are appended; Kubernetes uses the last entry for a duplicate name, so this
+		// lets the user override anything we set (e.g. TS_USERSPACE) without us having to know the full list.
+		c.Env = append(c.Env, corev1.EnvVar{Name: string(e.Name), Value: e.Value})
+	}
+
+	if overlay.Image != "" {
+		c.Image = overlay.Image
+	}
+
+	if overlay.ImagePullPolicy != "" {
+		c.ImagePullPolicy = overlay.ImagePullPolicy
+	}
+}
diff --git a/k8s-operator/reconciler/tailscaled/statefulset.go b/k8s-operator/reconciler/tailscaled/statefulset.go
new file mode 100644
index 000000000..d1b8d0032
--- /dev/null
+++ b/k8s-operator/reconciler/tailscaled/statefulset.go
@@ -0,0 +1,223 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !plan9
+
+// Package tailscaled provides shared building blocks for operator reconcilers that manage StatefulSets running
+// tailscaled pods (peer relays, connectors, proxy groups, etc). Callers describe the workload via StatefulSetOptions
+// / ConfigSecretOptions and this package returns fully-populated *appsv1.StatefulSet and *corev1.Secret objects
+// wired up the same way across the codebase: config-file-driven tailscaled started from a per-replica Secret
+// mounted at /etc/tsconfig/<pod-name>.
+package tailscaled
+
+import (
+	"encoding/json"
+	"fmt"
+
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"tailscale.com/ipn"
+	tsoperator "tailscale.com/k8s-operator"
+	"tailscale.com/kube/kubetypes"
+	"tailscale.com/tailcfg"
+)
+
+const (
+	// ConfigVolumeMountPath is the base directory tailscaled reads config files from. Each pod's config lives at
+	// <ConfigVolumeMountPath>/<POD_NAME>/cap-<version>.hujson.
+	ConfigVolumeMountPath = "/etc/tsconfig"
+
+	// ConfigDirEnvVar is the env var containerboot reads to find the config file directory. It is templated with
+	// $(POD_NAME) so each replica picks its own directory at runtime.
+	ConfigDirEnvVar = "TS_EXPERIMENTAL_VERSIONED_CONFIG_DIR"
+
+	// containerName is the single container inside each pod that runs tailscaled.
+	containerName = "tailscaled"
+)
+
+// StatefulSetOptions describes a StatefulSet of tailscaled pods. The zero value is not valid , Name, Namespace,
+// Image, Labels, and ConfigSecretNameFunc must be set.
+type StatefulSetOptions struct {
+	// Name is the StatefulSet's metadata name; pods will be named <Name>-<ordinal>.
+	Name string
+
+	// Namespace is the namespace the StatefulSet lives in.
+	Namespace string
+
+	// Labels are applied to the StatefulSet, its pod template, and used as the label selector. Callers must
+	// include enough labels to uniquely identify the workload , typically at least tailscale.com/parent-resource
+	// and tailscale.com/parent-resource-type.
+	Labels map[string]string
+
+	// Image is the tailscale container image used for every pod.
+	Image string
+
+	// Replicas is the desired number of pods.
+	Replicas int32
+
+	// ServiceAccountName is the ServiceAccount used by every pod. Must have get/create/patch/update permission on
+	// the per-pod state Secret named after each pod (containerboot's TS_KUBE_SECRET). Defaults to "default" when
+	// unset, which is unlikely to have the needed RBAC.
+	ServiceAccountName string
+
+	// ConfigSecretNameFunc returns the name of the config Secret containing tailscaled config for the given
+	// replica ordinal. Its output is used to build a per-replica volume and mount into the pod at
+	// <ConfigVolumeMountPath>/<Name>-<ordinal>.
+	ConfigSecretNameFunc func(idx int32) string
+}
+
+// NewStatefulSet returns a *appsv1.StatefulSet configured to run tailscaled from per-replica config Secrets.
+// The caller is responsible for setting resource requests/limits, ProxyClass overrides, etc. after the fact.
+func NewStatefulSet(opts StatefulSetOptions) *appsv1.StatefulSet {
+	volumes := make([]corev1.Volume, 0, opts.Replicas)
+	mounts := make([]corev1.VolumeMount, 0, opts.Replicas)
+	for i := int32(0); i < opts.Replicas; i++ {
+		volName := fmt.Sprintf("tailscaledconfig-%d", i)
+		volumes = append(volumes, corev1.Volume{
+			Name: volName,
+			VolumeSource: corev1.VolumeSource{
+				Secret: &corev1.SecretVolumeSource{SecretName: opts.ConfigSecretNameFunc(i)},
+			},
+		})
+		mounts = append(mounts, corev1.VolumeMount{
+			Name:      volName,
+			ReadOnly:  true,
+			MountPath: fmt.Sprintf("%s/%s-%d", ConfigVolumeMountPath, opts.Name, i),
+		})
+	}
+
+	return &appsv1.StatefulSet{
+		TypeMeta: metav1.TypeMeta{
+			APIVersion: "apps/v1",
+			Kind:       "StatefulSet",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      opts.Name,
+			Namespace: opts.Namespace,
+			Labels:    opts.Labels,
+		},
+		Spec: appsv1.StatefulSetSpec{
+			Replicas:    &opts.Replicas,
+			ServiceName: opts.Name,
+			Selector:    &metav1.LabelSelector{MatchLabels: opts.Labels},
+			Template: corev1.PodTemplateSpec{
+				ObjectMeta: metav1.ObjectMeta{Labels: opts.Labels},
+				Spec: corev1.PodSpec{
+					ServiceAccountName: opts.ServiceAccountName,
+					Volumes:            volumes,
+					Containers: []corev1.Container{{
+						Name:         containerName,
+						Image:        opts.Image,
+						VolumeMounts: mounts,
+						Env: []corev1.EnvVar{
+							{
+								Name: "POD_NAME",
+								ValueFrom: &corev1.EnvVarSource{
+									FieldRef: &corev1.ObjectFieldSelector{FieldPath: "metadata.name"},
+								},
+							},
+							{
+								// containerboot picks up the config file matching its own capability version from
+								// this directory.
+								Name:  ConfigDirEnvVar,
+								Value: fmt.Sprintf("%s/$(POD_NAME)", ConfigVolumeMountPath),
+							},
+							{
+								// tailscaled persists device/machine keys in this Secret so a pod restart doesn't
+								// force reauth. Naming it after the pod gives each replica its own state.
+								Name:  "TS_KUBE_SECRET",
+								Value: "$(POD_NAME)",
+							},
+						},
+					}},
+				},
+			},
+		},
+	}
+}
+
+// ConfigSecretOptions describes a single-replica tailscaled config Secret. Name, Namespace, and Config must be
+// set. If CapVersion is 0, tailcfg.CurrentCapabilityVersion is used.
+type ConfigSecretOptions struct {
+	Name       string
+	Namespace  string
+	Labels     map[string]string
+	CapVersion tailcfg.CapabilityVersion
+	Config     ipn.ConfigVAlpha
+}
+
+// NewConfigSecret marshals opts.Config into JSON and returns a *corev1.Secret with the file keyed by
+// tsoperator.TailscaledConfigFileName(opts.CapVersion). The tailscale.com/secret-type=config label is stamped on
+// automatically alongside any caller-provided labels.
+func NewConfigSecret(opts ConfigSecretOptions) (*corev1.Secret, error) {
+	cap := opts.CapVersion
+	if cap == 0 {
+		cap = tailcfg.CurrentCapabilityVersion
+	}
+
+	body, err := json.Marshal(opts.Config)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal tailscaled config: %w", err)
+	}
+
+	labels := make(map[string]string, len(opts.Labels)+1)
+	for k, v := range opts.Labels {
+		labels[k] = v
+	}
+	labels[kubetypes.LabelSecretType] = kubetypes.LabelSecretTypeConfig
+
+	return &corev1.Secret{
+		TypeMeta: metav1.TypeMeta{
+			APIVersion: "v1",
+			Kind:       "Secret",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      opts.Name,
+			Namespace: opts.Namespace,
+			Labels:    labels,
+		},
+		Data: map[string][]byte{
+			tsoperator.TailscaledConfigFileName(cap): body,
+		},
+	}, nil
+}
+
+// StateSecretOptions describes a per-pod tailscaled state Secret. Name must match the pod name (the value
+// containerboot reads from TS_KUBE_SECRET) so that tailscaled can locate it at runtime.
+type StateSecretOptions struct {
+	Name      string
+	Namespace string
+	Labels    map[string]string
+}
+
+// NewStateSecret returns an empty *corev1.Secret to be pre-created for tailscaled's kube state store. Pre-creating it
+// (rather than letting containerboot create it on first run) lets callers stamp ownership labels so cleanup can select
+// state Secrets by label rather than by pod-name convention. The tailscale.com/secret-type=state label is stamped on
+// automatically alongside any caller-provided labels; tailscaled populates the Data on first run.
+func NewStateSecret(opts StateSecretOptions) *corev1.Secret {
+	labels := make(map[string]string, len(opts.Labels)+1)
+	for k, v := range opts.Labels {
+		labels[k] = v
+	}
+	labels[kubetypes.LabelSecretType] = kubetypes.LabelSecretTypeState
+
+	return &corev1.Secret{
+		TypeMeta: metav1.TypeMeta{
+			APIVersion: "v1",
+			Kind:       "Secret",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      opts.Name,
+			Namespace: opts.Namespace,
+			Labels:    labels,
+		},
+	}
+}
+
+// DeviceIDFromStateSecret returns the tailnet device ID that tailscaled recorded in secret, or "" if none. secret
+// should be a state Secret populated by containerboot; the device ID is the value stored under kubetypes.KeyDeviceID.
+func DeviceIDFromStateSecret(secret *corev1.Secret) string {
+	return string(secret.Data[kubetypes.KeyDeviceID])
+}
diff --git a/k8s-operator/utils.go b/k8s-operator/utils.go
index 043a9d7b5..8d1391383 100644
--- a/k8s-operator/utils.go
+++ b/k8s-operator/utils.go
@@ -7,9 +7,16 @@
 package kube
 
 import (
+	"crypto/sha256"
+	"encoding/hex"
 	"fmt"
+	"net/netip"
+	"strconv"
+	"strings"
 
+	"tailscale.com/net/tsaddr"
 	"tailscale.com/tailcfg"
+	"tailscale.com/util/dnsname"
 )
 
 const (
@@ -50,3 +57,54 @@ func CapVerFromFileName(name string) (tailcfg.CapabilityVersion, error) {
 	_, err := fmt.Sscanf(name, "cap-%d.hujson", &cap)
 	return cap, err
 }
+
+// ResolveViaDomain parses an FQDN (with or without trailing dot) as a
+// 4via6 domain in the format "<ipv4-with-hyphens>-via-<siteID>[.domain]"
+// and returns the synthesized IPv6 via address.
+// This borrows heavily from net/dns/resolver.(*Resolver).resolveViaDomain.
+// TODO(beckypauley): consider a refactor of the above to remove duplication.
+func ResolveViaDomain(name string) (netip.Addr, bool) {
+	// The minimum length of a valid 4via6 FQDN i.e. "0-0-0-0-via-X".
+	const minFQDNLength = 13
+	fqdn := strings.TrimSuffix(name, ".")
+	if len(fqdn) < minFQDNLength {
+		return netip.Addr{}, false // too short to be valid
+	}
+	if !strings.Contains(fqdn, "-via-") {
+		return netip.Addr{}, false
+	}
+	firstLabel, domain, _ := strings.Cut(fqdn, ".")
+	if !(domain == "" || dnsname.HasSuffix(domain, "ts.net") || dnsname.HasSuffix(domain, "tailscale.net")) {
+		return netip.Addr{}, false
+	}
+	v4hyphens, siteIDStr, ok := strings.Cut(firstLabel, "-via-")
+	if !ok {
+		return netip.Addr{}, false
+	}
+	ip4Str := strings.ReplaceAll(v4hyphens, "-", ".")
+	ip4, err := netip.ParseAddr(ip4Str)
+	if err != nil || !ip4.Is4() {
+		return netip.Addr{}, false
+	}
+	prefix, err := strconv.ParseUint(siteIDStr, 0, 32)
+	if err != nil {
+		return netip.Addr{}, false
+	}
+	// MapVia will never error when given an IPv4 netip.Prefix.
+	out, _ := tsaddr.MapVia(uint32(prefix), netip.PrefixFrom(ip4, ip4.BitLen()))
+	return out.Addr(), true
+}
+
+// TruncateLabelValue truncates a Kubernetes label value to fit within the
+// 63-character limit. If the value exceeds the limit, it is truncated and a
+// short hash suffix is appended to preserve uniqueness.
+func TruncateLabelValue(val string) string {
+	const maxLen = 63
+	if len(val) <= maxLen {
+		return val
+	}
+	hash := sha256.Sum256([]byte(val))
+	suffix := hex.EncodeToString(hash[:4]) // 8 hex chars
+	truncated := val[:maxLen-len(suffix)-1]
+	return truncated + "-" + suffix
+}
diff --git a/k8s-operator/utils_test.go b/k8s-operator/utils_test.go
new file mode 100644
index 000000000..d46f5e64f
--- /dev/null
+++ b/k8s-operator/utils_test.go
@@ -0,0 +1,78 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !plan9
+
+package kube
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestTruncateLabelValue(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		want  string // empty means expect input unchanged
+	}{
+		{
+			name:  "short-value-unchanged",
+			input: "my-service",
+		},
+		{
+			name:  "exactly-63-chars-unchanged",
+			input: strings.Repeat("a", 63),
+		},
+		{
+			name:  "64-chars-gets-truncated",
+			input: strings.Repeat("a", 64),
+		},
+		{
+			name:  "very-long-value-gets-truncated",
+			input: "tailscale-nginx-clickhouse-o11y-server-https-with-extra-long-suffix-that-exceeds-limit",
+		},
+		{
+			name:  "253-chars-max-k8s-resource-name",
+			input: strings.Repeat("x", 253),
+		},
+		{
+			name:  "empty-string-unchanged",
+			input: "",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := TruncateLabelValue(tt.input)
+			if len(got) > 63 {
+				t.Errorf("TruncateLabelValue(%q) = %q (len %d), exceeds 63 chars", tt.input, got, len(got))
+			}
+			if len(tt.input) <= 63 && got != tt.input {
+				t.Errorf("TruncateLabelValue(%q) = %q, want unchanged input", tt.input, got)
+			}
+			if len(tt.input) > 63 && got == tt.input {
+				t.Errorf("TruncateLabelValue(%q) was not truncated", tt.input)
+			}
+		})
+	}
+}
+
+func TestTruncateLabelValueDeterministic(t *testing.T) {
+	input := strings.Repeat("a", 100)
+	first := TruncateLabelValue(input)
+	for range 10 {
+		got := TruncateLabelValue(input)
+		if got != first {
+			t.Fatalf("non-deterministic: got %q, want %q", got, first)
+		}
+	}
+}
+
+func TestTruncateLabelValueUniqueness(t *testing.T) {
+	// Two inputs sharing a long prefix but differing at the end should produce different outputs.
+	a := strings.Repeat("a", 100) + "-one"
+	b := strings.Repeat("a", 100) + "-two"
+	if TruncateLabelValue(a) == TruncateLabelValue(b) {
+		t.Errorf("collision: %q and %q produce the same truncated label", a, b)
+	}
+}
diff --git a/kube/authkey/authkey.go b/kube/authkey/authkey.go
new file mode 100644
index 000000000..f544a0c81
--- /dev/null
+++ b/kube/authkey/authkey.go
@@ -0,0 +1,122 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !plan9
+
+// Package authkey provides shared logic for handling auth key reissue
+// requests between tailnet clients (containerboot, k8s-proxy) and the
+// operator.
+//
+// When a client fails to authenticate (expired key, single-use key already
+// used), it signals the operator by setting a marker in its state Secret.
+// The operator responds by deleting the old device and issuing a new auth
+// key. The client watches for the new key and restarts to apply it.
+package authkey
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"time"
+
+	"tailscale.com/ipn"
+	"tailscale.com/ipn/conffile"
+	"tailscale.com/kube/kubeapi"
+	"tailscale.com/kube/kubeclient"
+	"tailscale.com/kube/kubetypes"
+)
+
+const (
+	TailscaleContainerFieldManager = "tailscale-container"
+)
+
+// SetReissueAuthKey sets the reissue_authkey marker in the state Secret to
+// signal to the operator that a new auth key is needed. The marker value is
+// the auth key that failed to authenticate.
+func SetReissueAuthKey(ctx context.Context, kc kubeclient.Client, stateSecretName string, authKey string, fieldManager string) error {
+	s := &kubeapi.Secret{
+		Data: map[string][]byte{
+			kubetypes.KeyReissueAuthkey: []byte(authKey),
+		},
+	}
+
+	log.Printf("Requesting a new auth key from operator")
+	return kc.StrategicMergePatchSecret(ctx, stateSecretName, s, fieldManager)
+}
+
+// ClearReissueAuthKey removes the reissue_authkey marker from the state Secret
+// to signal to the operator that we've successfully received the new key.
+func ClearReissueAuthKey(ctx context.Context, kc kubeclient.Client, stateSecretName string, fieldManager string) error {
+	existing, err := kc.GetSecret(ctx, stateSecretName)
+	if err != nil {
+		return fmt.Errorf("error getting state secret: %w", err)
+	}
+
+	s := &kubeapi.Secret{
+		Data: map[string][]byte{
+			kubetypes.KeyReissueAuthkey:        nil,
+			kubetypes.KeyDeviceID:              nil,
+			kubetypes.KeyDeviceFQDN:            nil,
+			kubetypes.KeyDeviceIPs:             nil,
+			string(ipn.MachineKeyStateKey):     nil,
+			string(ipn.CurrentProfileStateKey): nil,
+			string(ipn.KnownProfilesStateKey):  nil,
+		},
+	}
+
+	if profileKey := string(existing.Data[string(ipn.CurrentProfileStateKey)]); profileKey != "" {
+		s.Data[profileKey] = nil
+	}
+
+	return kc.StrategicMergePatchSecret(ctx, stateSecretName, s, fieldManager)
+}
+
+// WaitForAuthKeyReissue polls getAuthKey for a new auth key different from
+// oldAuthKey, returning when one is found or maxWait expires. If notify is
+// non-nil, it is used to wake the loop on config changes; otherwise it falls
+// back to periodic polling. The clearFn callback is called when a new key is
+// detected, to clear the reissue marker from the state Secret.
+func WaitForAuthKeyReissue(ctx context.Context, oldAuthKey string, maxWait time.Duration, getAuthKey func() string, clearFn func(context.Context) error, notify <-chan struct{}) error {
+	log.Printf("Waiting for operator to provide new auth key (max wait: %v)", maxWait)
+
+	ctx, cancel := context.WithTimeout(ctx, maxWait)
+	defer cancel()
+
+	pollInterval := 5 * time.Second
+	pt := time.NewTicker(pollInterval)
+	defer pt.Stop()
+
+	start := time.Now()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return fmt.Errorf("timeout waiting for auth key reissue after %v", maxWait)
+		case <-pt.C:
+		case <-notify:
+		}
+
+		newAuthKey := getAuthKey()
+		if newAuthKey != "" && newAuthKey != oldAuthKey {
+			log.Printf("New auth key received from operator after %v", time.Since(start).Round(time.Second))
+			if err := clearFn(ctx); err != nil {
+				log.Printf("Warning: failed to clear reissue request: %v", err)
+			}
+			return nil
+		}
+
+		if notify == nil {
+			log.Printf("Waiting for new auth key from operator (%v elapsed)", time.Since(start).Round(time.Second))
+		}
+	}
+}
+
+// AuthKeyFromConfig extracts the auth key from a tailscaled config file.
+// Returns empty string if the file cannot be read or contains no auth key.
+func AuthKeyFromConfig(path string) string {
+	if cfg, err := conffile.Load(path); err == nil && cfg.Parsed.AuthKey != nil {
+		return *cfg.Parsed.AuthKey
+	}
+
+	return ""
+}
diff --git a/kube/authkey/authkey_test.go b/kube/authkey/authkey_test.go
new file mode 100644
index 000000000..268bc46d6
--- /dev/null
+++ b/kube/authkey/authkey_test.go
@@ -0,0 +1,124 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !plan9
+
+package authkey
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"tailscale.com/ipn"
+	"tailscale.com/kube/kubeapi"
+	"tailscale.com/kube/kubeclient"
+	"tailscale.com/kube/kubetypes"
+)
+
+func TestSetReissueAuthKey(t *testing.T) {
+	var patched map[string][]byte
+	kc := &kubeclient.FakeClient{
+		StrategicMergePatchSecretImpl: func(ctx context.Context, name string, secret *kubeapi.Secret, _ string) error {
+			patched = secret.Data
+			return nil
+		},
+	}
+
+	err := SetReissueAuthKey(context.Background(), kc, "test-secret", "old-auth-key", TailscaleContainerFieldManager)
+	if err != nil {
+		t.Fatalf("SetReissueAuthKey() error = %v", err)
+	}
+
+	want := map[string][]byte{
+		kubetypes.KeyReissueAuthkey: []byte("old-auth-key"),
+	}
+	if diff := cmp.Diff(want, patched); diff != "" {
+		t.Errorf("SetReissueAuthKey() mismatch (-want +got):\n%s", diff)
+	}
+}
+
+func TestClearReissueAuthKey(t *testing.T) {
+	var patched map[string][]byte
+	kc := &kubeclient.FakeClient{
+		GetSecretImpl: func(ctx context.Context, name string) (*kubeapi.Secret, error) {
+			return &kubeapi.Secret{
+				Data: map[string][]byte{
+					"_current-profile": []byte("profile-abc1"),
+					"profile-abc1":     []byte("some-profile-data"),
+					"_machinekey":      []byte("machine-key-data"),
+				},
+			}, nil
+		},
+		StrategicMergePatchSecretImpl: func(ctx context.Context, name string, secret *kubeapi.Secret, _ string) error {
+			patched = secret.Data
+			return nil
+		},
+	}
+
+	err := ClearReissueAuthKey(context.Background(), kc, "test-secret", TailscaleContainerFieldManager)
+	if err != nil {
+		t.Fatalf("ClearReissueAuthKey() error = %v", err)
+	}
+
+	want := map[string][]byte{
+		kubetypes.KeyReissueAuthkey:        nil,
+		kubetypes.KeyDeviceID:              nil,
+		kubetypes.KeyDeviceFQDN:            nil,
+		kubetypes.KeyDeviceIPs:             nil,
+		string(ipn.MachineKeyStateKey):     nil,
+		string(ipn.CurrentProfileStateKey): nil,
+		string(ipn.KnownProfilesStateKey):  nil,
+		"profile-abc1":                     nil,
+	}
+	if diff := cmp.Diff(want, patched); diff != "" {
+		t.Errorf("ClearReissueAuthKey() mismatch (-want +got):\n%s", diff)
+	}
+}
+
+func TestAuthKeyFromConfig(t *testing.T) {
+	for name, tc := range map[string]struct {
+		configContent string
+		want          string
+	}{
+		"valid_config_with_authkey": {
+			configContent: `{"Version":"alpha0","AuthKey":"test-auth-key"}`,
+			want:          "test-auth-key",
+		},
+		"valid_config_without_authkey": {
+			configContent: `{"Version":"alpha0"}`,
+			want:          "",
+		},
+		"invalid_config": {
+			configContent: `not valid json`,
+			want:          "",
+		},
+		"empty_config": {
+			configContent: ``,
+			want:          "",
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			tmpDir := t.TempDir()
+			configPath := filepath.Join(tmpDir, "config.json")
+
+			if err := os.WriteFile(configPath, []byte(tc.configContent), 0600); err != nil {
+				t.Fatalf("failed to write config file: %v", err)
+			}
+
+			got := AuthKeyFromConfig(configPath)
+			if got != tc.want {
+				t.Errorf("AuthKeyFromConfig() = %q, want %q", got, tc.want)
+			}
+		})
+	}
+
+	t.Run("nonexistent_file", func(t *testing.T) {
+		got := AuthKeyFromConfig("/nonexistent/path/config.json")
+		if got != "" {
+			t.Errorf("AuthKeyFromConfig() = %q, want empty string for nonexistent file", got)
+		}
+	})
+}
diff --git a/kube/certs/certs.go b/kube/certs/certs.go
index 4c8ac88b6..b8e6ccf14 100644
--- a/kube/certs/certs.go
+++ b/kube/certs/certs.go
@@ -7,12 +7,15 @@ package certs
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"net"
 	"slices"
 	"sync"
+	"syscall"
 	"time"
 
+	"tailscale.com/client/local"
 	"tailscale.com/ipn"
 	"tailscale.com/kube/localclient"
 	"tailscale.com/types/logger"
@@ -94,22 +97,72 @@ func (cm *CertManager) EnsureCertLoops(ctx context.Context, sc *ipn.ServeConfig)
 	return nil
 }
 
+// isTransientCertErr reports whether err represents a failure that did not
+// reach the CA (ctx timeout, LocalAPI socket unreachable). Such errors must
+// not advance the loop's retryCount.
+func isTransientCertErr(err error) bool {
+	switch {
+	case errors.Is(err, context.DeadlineExceeded),
+		errors.Is(err, context.Canceled),
+		errors.Is(err, syscall.ECONNREFUSED),
+		errors.Is(err, syscall.ECONNRESET),
+		errors.Is(err, syscall.EHOSTUNREACH),
+		errors.Is(err, syscall.EPIPE):
+		return true
+	}
+	var ne net.Error
+	if errors.As(err, &ne) && ne.Timeout() {
+		return true
+	}
+	return false
+}
+
+// nextRetryInterval picks the wait until the next CertPair attempt:
+//   - success: reset retryCount, normalInterval.
+//   - transient (never reached the CA): retrySchedule[0], no retryCount advance.
+//   - retryAfter > 0: honour it, retryCount still advances.
+//   - other: advance retryCount, walk retrySchedule.
+func nextRetryInterval(err error, retryCount *int, normalInterval, retryAfter time.Duration) time.Duration {
+	switch {
+	case err == nil:
+		*retryCount = 0
+		return normalInterval
+	case isTransientCertErr(err):
+		return retrySchedule[0]
+	}
+	*retryCount++
+	idx := *retryCount - 1
+	if idx >= len(retrySchedule) {
+		idx = len(retrySchedule) - 1
+	}
+	interval := retrySchedule[idx]
+	if retryAfter > 0 {
+		interval = retryAfter
+	}
+	return interval
+}
+
+// retrySchedule is the wait between successive failed issuance attempts,
+// following LE's recommended schedule.
+// https://letsencrypt.org/docs/integration-guide/#retrying-failures
+var retrySchedule = []time.Duration{
+	1 * time.Minute,
+	10 * time.Minute,
+	100 * time.Minute,
+	24 * time.Hour,
+}
+
 // runCertLoop:
 // - calls localAPI certificate endpoint to ensure that certs are issued for the
 // given domain name
 // - calls localAPI certificate endpoint daily to ensure that certs are renewed
-// - if certificate issuance failed retries after an exponential backoff period
-// starting at 1 minute and capped at 24 hours. Reset the backoff once issuance succeeds.
+// - if certificate issuance failed, retries on the schedule defined by
+// [retrySchedule]; resets to the start once issuance succeeds.
 // Note that renewal check also happens when the node receives an HTTPS request and it is possible that certs get
 // renewed at that point. Renewal here is needed to prevent the shared certs from expiry in edge cases where the 'write'
 // replica does not get any HTTPS requests.
-// https://letsencrypt.org/docs/integration-guide/#retrying-failures
 func (cm *CertManager) runCertLoop(ctx context.Context, domain string) {
-	const (
-		normalInterval   = 24 * time.Hour  // regular renewal check
-		initialRetry     = 1 * time.Minute // initial backoff after a failure
-		maxRetryInterval = 24 * time.Hour  // max backoff period
-	)
+	const normalInterval = 24 * time.Hour // regular renewal check
 
 	if err := cm.waitForCertDomain(ctx, domain); err != nil {
 		// Best-effort, log and continue with the issuing loop.
@@ -136,33 +189,15 @@ func (cm *CertManager) runCertLoop(ctx context.Context, domain string) {
 			// node's HTTPS endpoint share the same state/renewal lock mechanism,
 			// so we should not run into redundant issuances during concurrent
 			// renewal checks.
-
-			// An issuance holds a shared lock, so we need to avoid a situation
-			// where other services cannot issue certs because a single one is
-			// holding the lock.
-			ctxT, cancel := context.WithTimeout(ctx, time.Second*300)
+			//
+			// Long enough to cover queue contention behind tailscaled's
+			// shared cert mutex; if it fires, something is wedged.
+			ctxT, cancel := context.WithTimeout(ctx, 30*time.Minute)
 			_, _, err := cm.lc.CertPair(ctxT, domain)
 			cancel()
+			retryAfter, _ := local.RateLimitRetryAfter(err)
+			nextInterval := nextRetryInterval(err, &retryCount, normalInterval, retryAfter)
 			if err != nil {
-				cm.logf("error refreshing certificate for %s: %v", domain, err)
-			}
-			var nextInterval time.Duration
-			// TODO(irbekrm): distinguish between LE rate limit errors and other
-			// error types like transient network errors.
-			if err == nil {
-				retryCount = 0
-				nextInterval = normalInterval
-			} else {
-				retryCount++
-				// Calculate backoff: initialRetry * 2^(retryCount-1)
-				// For retryCount=1: 1min * 2^0 = 1min
-				// For retryCount=2: 1min * 2^1 = 2min
-				// For retryCount=3: 1min * 2^2 = 4min
-				backoff := initialRetry * time.Duration(1<<(retryCount-1))
-				if backoff > maxRetryInterval {
-					backoff = maxRetryInterval
-				}
-				nextInterval = backoff
 				cm.logf("Error refreshing certificate for %s (retry %d): %v. Will retry in %v\n",
 					domain, retryCount, err, nextInterval)
 			}
@@ -171,8 +206,9 @@ func (cm *CertManager) runCertLoop(ctx context.Context, domain string) {
 	}
 }
 
-// waitForCertDomain ensures the requested domain is in the list of allowed
-// domains before issuing the cert for the first time.
+// domains before issuing the cert for the first time. It uses the IPN bus
+// only as a wake-up trigger (Notify.SelfChange) and queries the current
+// cert domains explicitly via [LocalClient.CertDomains].
 func (cm *CertManager) waitForCertDomain(ctx context.Context, domain string) error {
 	w, err := cm.lc.WatchIPNBus(ctx, ipn.NotifyInitialNetMap)
 	if err != nil {
@@ -185,11 +221,14 @@ func (cm *CertManager) waitForCertDomain(ctx context.Context, domain string) err
 		if err != nil {
 			return err
 		}
-		if n.NetMap == nil {
+		if n.SelfChange == nil {
 			continue
 		}
-
-		if slices.Contains(n.NetMap.DNS.CertDomains, domain) {
+		domains, err := cm.lc.CertDomains(ctx)
+		if err != nil {
+			continue
+		}
+		if slices.Contains(domains, domain) {
 			return nil
 		}
 	}
diff --git a/kube/certs/certs_test.go b/kube/certs/certs_test.go
index f3662f6c3..c48fa3647 100644
--- a/kube/certs/certs_test.go
+++ b/kube/certs/certs_test.go
@@ -5,14 +5,16 @@ package certs
 
 import (
 	"context"
+	"errors"
+	"fmt"
 	"log"
+	"syscall"
 	"testing"
 	"time"
 
 	"tailscale.com/ipn"
 	"tailscale.com/kube/localclient"
 	"tailscale.com/tailcfg"
-	"tailscale.com/types/netmap"
 )
 
 // TestEnsureCertLoops tests that the certManager correctly starts and stops
@@ -201,17 +203,11 @@ func TestEnsureCertLoops(t *testing.T) {
 
 			notifyChan := make(chan ipn.Notify)
 			go func() {
+				// SelfChange wakes the cert manager; cert domains are
+				// then fetched via FakeLocalClient.CertDomainsResult.
 				for {
 					notifyChan <- ipn.Notify{
-						NetMap: &netmap.NetworkMap{
-							DNS: tailcfg.DNSConfig{
-								CertDomains: []string{
-									"my-app.tailnetxyz.ts.net",
-									"my-other-app.tailnetxyz.ts.net",
-									"my-apiserver.tailnetxyz.ts.net",
-								},
-							},
-						},
+						SelfChange: &tailcfg.Node{StableID: "test"},
 					}
 				}
 			}()
@@ -220,6 +216,11 @@ func TestEnsureCertLoops(t *testing.T) {
 					FakeIPNBusWatcher: localclient.FakeIPNBusWatcher{
 						NotifyChan: notifyChan,
 					},
+					CertDomainsResult: []string{
+						"my-app.tailnetxyz.ts.net",
+						"my-other-app.tailnetxyz.ts.net",
+						"my-apiserver.tailnetxyz.ts.net",
+					},
 				},
 				logf:      log.Printf,
 				certLoops: make(map[string]context.CancelFunc),
@@ -286,3 +287,57 @@ func TestEnsureCertLoops(t *testing.T) {
 		})
 	}
 }
+
+func TestIsTransientCertErr(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want bool
+	}{
+		{"nil", nil, false},
+		{"deadline", context.DeadlineExceeded, true},
+		{"canceled", context.Canceled, true},
+		{"wrapped_deadline", fmt.Errorf("wrap: %w", context.DeadlineExceeded), true},
+		{"connrefused", fmt.Errorf("dial: %w", syscall.ECONNREFUSED), true},
+		{"connreset", fmt.Errorf("read: %w", syscall.ECONNRESET), true},
+		{"random", errors.New("badNonce"), false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := isTransientCertErr(tt.err); got != tt.want {
+				t.Errorf("isTransientCertErr(%v) = %v, want %v", tt.err, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestNextRetryInterval(t *testing.T) {
+	const normal = 24 * time.Hour
+	tests := []struct {
+		name         string
+		err          error
+		retryAfter   time.Duration
+		startCount   int
+		wantCount    int
+		wantInterval time.Duration
+	}{
+		{"success", nil, 0, 5, 0, normal},
+		{"transient_no_advance", context.DeadlineExceeded, 0, 3, 3, retrySchedule[0]},
+		{"rate_limit_with_hint", errors.New("rate limited"), 17 * time.Minute, 0, 1, 17 * time.Minute},
+		{"rate_limit_no_hint", errors.New("rate limited"), 0, 0, 1, retrySchedule[0]},
+		{"other_advances", errors.New("badNonce"), 0, 0, 1, retrySchedule[0]},
+		{"other_clamps", errors.New("badNonce"), 0, len(retrySchedule) + 3, len(retrySchedule) + 4, retrySchedule[len(retrySchedule)-1]},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			c := tt.startCount
+			got := nextRetryInterval(tt.err, &c, normal, tt.retryAfter)
+			if c != tt.wantCount {
+				t.Errorf("retryCount = %d, want %d", c, tt.wantCount)
+			}
+			if got != tt.wantInterval {
+				t.Errorf("interval = %v, want %v", got, tt.wantInterval)
+			}
+		})
+	}
+}
diff --git a/kube/egressservices/egressservices.go b/kube/egressservices/egressservices.go
index 3828760af..0aeaa9421 100644
--- a/kube/egressservices/egressservices.go
+++ b/kube/egressservices/egressservices.go
@@ -94,6 +94,7 @@ func (p PortMaps) MarshalJSON() ([]byte, error) {
 // services for a proxy identified by the PodIP.
 type Status struct {
 	PodIPv4 string `json:"podIPv4"`
+	PodIPv6 string `json:"podIPv6,omitempty"`
 	// All egress service status keyed by service name.
 	Services map[string]*ServiceStatus `json:"services"`
 }
diff --git a/kube/health/healthz.go b/kube/health/healthz.go
index 53888922b..8909e79a4 100644
--- a/kube/health/healthz.go
+++ b/kube/health/healthz.go
@@ -26,6 +26,7 @@ type Healthz struct {
 	sync.Mutex
 	hasAddrs bool
 	podIPv4  string
+	podIPv6  string
 	logger   logger.Logf
 }
 
@@ -34,7 +35,12 @@ func (h *Healthz) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	defer h.Unlock()
 
 	if h.hasAddrs {
-		w.Header().Add(kubetypes.PodIPv4Header, h.podIPv4)
+		if h.podIPv4 != "" {
+			w.Header().Set(kubetypes.PodIPv4Header, h.podIPv4)
+		}
+		if h.podIPv6 != "" {
+			w.Header().Set(kubetypes.PodIPv6Header, h.podIPv6)
+		}
 		if _, err := w.Write([]byte("ok")); err != nil {
 			http.Error(w, fmt.Sprintf("error writing status: %v", err), http.StatusInternalServerError)
 		}
@@ -65,8 +71,8 @@ func (h *Healthz) MonitorHealth(ctx context.Context, lc *local.Client) error {
 			return err
 		}
 
-		if n.NetMap != nil {
-			h.Update(n.NetMap.SelfNode.Addresses().Len() != 0)
+		if self := n.SelfChange; self != nil {
+			h.Update(len(self.Addresses) != 0)
 		}
 	}
 }
@@ -74,9 +80,10 @@ func (h *Healthz) MonitorHealth(ctx context.Context, lc *local.Client) error {
 // RegisterHealthHandlers registers a simple health handler at /healthz.
 // A containerized tailscale instance is considered healthy if
 // it has at least one tailnet IP address.
-func RegisterHealthHandlers(mux *http.ServeMux, podIPv4 string, logger logger.Logf) *Healthz {
+func RegisterHealthHandlers(mux *http.ServeMux, podIPv4, podIPv6 string, logger logger.Logf) *Healthz {
 	h := &Healthz{
 		podIPv4: podIPv4,
+		podIPv6: podIPv6,
 		logger:  logger,
 	}
 	mux.Handle("GET /healthz", h)
diff --git a/kube/kubeapi/api.go b/kube/kubeapi/api.go
index c3ed1a3b7..f1d7d51a4 100644
--- a/kube/kubeapi/api.go
+++ b/kube/kubeapi/api.go
@@ -94,7 +94,7 @@ type ObjectMeta struct {
 	// Null for lists.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
-	CreationTimestamp time.Time `json:"creationTimestamp,omitempty"`
+	CreationTimestamp time.Time `json:"creationTimestamp"`
 
 	// DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This
 	// field is set by the server when a graceful deletion is requested by the user, and is not
@@ -169,14 +169,14 @@ type Event struct {
 	ObjectMeta `json:"metadata"`
 	Message    string      `json:"message,omitempty"`
 	Reason     string      `json:"reason,omitempty"`
-	Source     EventSource `json:"source,omitempty"` // who is emitting this Event
-	Type       string      `json:"type,omitempty"`   // Normal or Warning
+	Source     EventSource `json:"source"`         // who is emitting this Event
+	Type       string      `json:"type,omitempty"` // Normal or Warning
 	// InvolvedObject is the subject of the Event. `kubectl describe` will, for most object types, display any
 	// currently present cluster Events matching the object (but you probably want to set UID for this to work).
 	InvolvedObject ObjectReference `json:"involvedObject"`
 	Count          int32           `json:"count,omitempty"` // how many times Event was observed
-	FirstTimestamp time.Time       `json:"firstTimestamp,omitempty"`
-	LastTimestamp  time.Time       `json:"lastTimestamp,omitempty"`
+	FirstTimestamp time.Time       `json:"firstTimestamp"`
+	LastTimestamp  time.Time       `json:"lastTimestamp"`
 }
 
 // EventSource includes a subset of fields from corev1.EventSource.
diff --git a/kube/kubetypes/types.go b/kube/kubetypes/types.go
index 9f1b29064..d4653f374 100644
--- a/kube/kubetypes/types.go
+++ b/kube/kubetypes/types.go
@@ -34,6 +34,7 @@ const (
 	MetricProxyGroupIngressCount         = "k8s_proxygroup_ingress_resources"
 	MetricProxyGroupAPIServerCount       = "k8s_proxygroup_kube_apiserver_resources"
 	MetricTailnetCount                   = "k8s_tailnet_resources"
+	MetricPeerRelayCount                 = "k8s_peerrelay_resources"
 
 	// Keys that containerboot writes to state file that can be used to determine its state.
 	// fields set in Tailscale state Secret. These are mostly used by the Tailscale Kubernetes operator to determine
@@ -52,6 +53,8 @@ const (
 
 	// Pod's IPv4 address header key as returned by containerboot health check endpoint.
 	PodIPv4Header string = "Pod-IPv4"
+	// Pod's IPv6 address header key as returned by containerboot health check endpoint.
+	PodIPv6Header string = "Pod-IPv6"
 
 	EgessServicesPreshutdownEP = "/internal-egress-services-preshutdown"
 
@@ -62,6 +65,28 @@ const (
 	LabelSecretTypeState  = "state"
 	LabelSecretTypeCerts  = "certs"
 
+	// ACMEAccountsSecretName is the name of the Secret in the operator
+	// namespace that holds shared ACME account private keys, one field per
+	// tailnet. Sharing one account key across all replicas of every
+	// ProxyGroup attached to a tailnet preserves Let's Encrypt's renewal
+	// exemption (via the ARI "replaces" extension) across pod restarts,
+	// ProxyGroup recreation, and ingress migration.
+	ACMEAccountsSecretName = "tailscale-acme-accounts"
+
+	// ACMEAccountDefaultKey is the field used inside ACMEAccountsSecretName
+	// for the "default" tailnet (i.e., when ProxyGroup.spec.tailnet is empty
+	// and the operator uses its own credentials).
+	ACMEAccountDefaultKey = "_default"
+
+	// ACMEAccountKeySuffix is appended to the tailnet identifier to form a
+	// field name within ACMEAccountsSecretName.
+	ACMEAccountKeySuffix = ".acme-account.key.pem"
+
+	// ACMEAccountsFinalizer blocks accidental deletion of
+	// ACMEAccountsSecretName; losing those keys breaks ARI "replaces"
+	// renewals for every cert in the tailnet. See #18251.
+	ACMEAccountsFinalizer = "tailscale.com/acme-account-protection"
+
 	KubeAPIServerConfigFile                     = "config.hujson"
 	APIServerProxyModeAuth   APIServerProxyMode = "auth"
 	APIServerProxyModeNoAuth APIServerProxyMode = "noauth"
diff --git a/kube/localclient/fake-client.go b/kube/localclient/fake-client.go
index a244ce31a..7ecada113 100644
--- a/kube/localclient/fake-client.go
+++ b/kube/localclient/fake-client.go
@@ -12,9 +12,10 @@ import (
 
 type FakeLocalClient struct {
 	FakeIPNBusWatcher
-	SetServeCalled bool
-	EditPrefsCalls []*ipn.MaskedPrefs
-	GetPrefsResult *ipn.Prefs
+	SetServeCalled    bool
+	EditPrefsCalls    []*ipn.MaskedPrefs
+	GetPrefsResult    *ipn.Prefs
+	CertDomainsResult []string
 }
 
 func (m *FakeLocalClient) SetServeConfig(ctx context.Context, cfg *ipn.ServeConfig) error {
@@ -45,6 +46,10 @@ func (f *FakeLocalClient) CertPair(ctx context.Context, domain string) ([]byte,
 	return nil, nil, fmt.Errorf("CertPair not implemented")
 }
 
+func (f *FakeLocalClient) CertDomains(ctx context.Context) ([]string, error) {
+	return f.CertDomainsResult, nil
+}
+
 type FakeIPNBusWatcher struct {
 	NotifyChan chan ipn.Notify
 }
diff --git a/kube/localclient/local-client.go b/kube/localclient/local-client.go
index b8d40f406..f759568ba 100644
--- a/kube/localclient/local-client.go
+++ b/kube/localclient/local-client.go
@@ -19,6 +19,7 @@ type LocalClient interface {
 	WatchIPNBus(ctx context.Context, mask ipn.NotifyWatchOpt) (IPNBusWatcher, error)
 	SetServeConfig(context.Context, *ipn.ServeConfig) error
 	EditPrefs(ctx context.Context, mp *ipn.MaskedPrefs) (*ipn.Prefs, error)
+	CertDomains(ctx context.Context) ([]string, error)
 	CertIssuer
 }
 
@@ -57,3 +58,7 @@ func (lc *localClient) WatchIPNBus(ctx context.Context, mask ipn.NotifyWatchOpt)
 func (lc *localClient) CertPair(ctx context.Context, domain string) ([]byte, []byte, error) {
 	return lc.lc.CertPair(ctx, domain)
 }
+
+func (lc *localClient) CertDomains(ctx context.Context) ([]string, error) {
+	return lc.lc.CertDomains(ctx)
+}
diff --git a/kube/state/state.go b/kube/state/state.go
index ebedb2f72..220eb439f 100644
--- a/kube/state/state.go
+++ b/kube/state/state.go
@@ -30,19 +30,8 @@ const (
 	keyDeviceFQDN = ipn.StateKey(kubetypes.KeyDeviceFQDN)
 )
 
-// SetInitialKeys sets Pod UID and cap ver and clears tailnet device state
-// keys to help stop the operator using stale tailnet device state.
+// SetInitialKeys sets Pod UID and cap ver.
 func SetInitialKeys(store ipn.StateStore, podUID string) error {
-	// Clear device state keys first so the operator knows if the pod UID
-	// matches, the other values are definitely not stale.
-	for _, key := range []ipn.StateKey{keyDeviceID, keyDeviceFQDN, keyDeviceIPs} {
-		if _, err := store.ReadState(key); err == nil {
-			if err := store.WriteState(key, nil); err != nil {
-				return fmt.Errorf("error writing %q to state store: %w", key, err)
-			}
-		}
-	}
-
 	if err := store.WriteState(keyPodUID, []byte(podUID)); err != nil {
 		return fmt.Errorf("error writing pod UID to state store: %w", err)
 	}
@@ -55,9 +44,9 @@ func SetInitialKeys(store ipn.StateStore, podUID string) error {
 
 // KeepKeysUpdated sets state store keys consistent with containerboot to
 // signal proxy readiness to the operator. It runs until its context is
-// cancelled or it hits an error. The passed in next function is expected to be
-// from a local.IPNBusWatcher that is at least subscribed to
-// ipn.NotifyInitialNetMap.
+// cancelled or it hits an error. It watches the IPN bus for SelfChange
+// notifications (which fire whenever the self node changes) and reads
+// the new self node directly from the notify.
 func KeepKeysUpdated(ctx context.Context, store ipn.StateStore, lc klc.LocalClient) error {
 	w, err := lc.WatchIPNBus(ctx, ipn.NotifyInitialNetMap)
 	if err != nil {
@@ -74,25 +63,26 @@ func KeepKeysUpdated(ctx context.Context, store ipn.StateStore, lc klc.LocalClie
 			}
 			return err
 		}
-		if n.NetMap == nil {
+		self := n.SelfChange
+		if self == nil {
 			continue
 		}
 
-		if deviceID := n.NetMap.SelfNode.StableID(); deephash.Update(&currentDeviceID, &deviceID) {
+		if deviceID := self.StableID; deephash.Update(&currentDeviceID, &deviceID) {
 			if err := store.WriteState(keyDeviceID, []byte(deviceID)); err != nil {
 				return fmt.Errorf("failed to store device ID in state: %w", err)
 			}
 		}
 
-		if fqdn := n.NetMap.SelfNode.Name(); deephash.Update(&currentDeviceFQDN, &fqdn) {
+		if fqdn := self.Name; deephash.Update(&currentDeviceFQDN, &fqdn) {
 			if err := store.WriteState(keyDeviceFQDN, []byte(fqdn)); err != nil {
 				return fmt.Errorf("failed to store device FQDN in state: %w", err)
 			}
 		}
 
-		if addrs := n.NetMap.SelfNode.Addresses(); deephash.Update(&currentDeviceIPs, &addrs) {
+		if addrs := self.Addresses; deephash.Update(&currentDeviceIPs, &addrs) {
 			var deviceIPs []string
-			for _, addr := range addrs.AsSlice() {
+			for _, addr := range addrs {
 				deviceIPs = append(deviceIPs, addr.Addr().String())
 			}
 			deviceIPsValue, err := json.Marshal(deviceIPs)
diff --git a/kube/state/state_test.go b/kube/state/state_test.go
index 9b2ce69be..5c438377e 100644
--- a/kube/state/state_test.go
+++ b/kube/state/state_test.go
@@ -18,7 +18,6 @@ import (
 	klc "tailscale.com/kube/localclient"
 	"tailscale.com/tailcfg"
 	"tailscale.com/types/logger"
-	"tailscale.com/types/netmap"
 )
 
 func TestSetInitialStateKeys(t *testing.T) {
@@ -58,9 +57,9 @@ func TestSetInitialStateKeys(t *testing.T) {
 			expected: map[ipn.StateKey][]byte{
 				keyPodUID:     podUID,
 				keyCapVer:     expectedCapVer,
-				keyDeviceID:   nil,
-				keyDeviceFQDN: nil,
-				keyDeviceIPs:  nil,
+				keyDeviceID:   []byte("existing-device-id"),
+				keyDeviceFQDN: []byte("existing-device-fqdn"),
+				keyDeviceIPs:  []byte(`["1.2.3.4"]`),
 			},
 		},
 	} {
@@ -133,12 +132,10 @@ func TestKeepStateKeysUpdated(t *testing.T) {
 		{
 			name: "authed",
 			notify: ipn.Notify{
-				NetMap: &netmap.NetworkMap{
-					SelfNode: (&tailcfg.Node{
-						StableID:  "TESTCTRL00000001",
-						Name:      "test-node.test.ts.net",
-						Addresses: []netip.Prefix{netip.MustParsePrefix("100.64.0.1/32"), netip.MustParsePrefix("fd7a:115c:a1e0:ab12:4843:cd96:0:1/128")},
-					}).View(),
+				SelfChange: &tailcfg.Node{
+					StableID:  "TESTCTRL00000001",
+					Name:      "test-node.test.ts.net",
+					Addresses: []netip.Prefix{netip.MustParsePrefix("100.64.0.1/32"), netip.MustParsePrefix("fd7a:115c:a1e0:ab12:4843:cd96:0:1/128")},
 				},
 			},
 			expected: []string{
@@ -150,12 +147,10 @@ func TestKeepStateKeysUpdated(t *testing.T) {
 		{
 			name: "updated_fields",
 			notify: ipn.Notify{
-				NetMap: &netmap.NetworkMap{
-					SelfNode: (&tailcfg.Node{
-						StableID:  "TESTCTRL00000001",
-						Name:      "updated.test.ts.net",
-						Addresses: []netip.Prefix{netip.MustParsePrefix("100.64.0.250/32")},
-					}).View(),
+				SelfChange: &tailcfg.Node{
+					StableID:  "TESTCTRL00000001",
+					Name:      "updated.test.ts.net",
+					Addresses: []netip.Prefix{netip.MustParsePrefix("100.64.0.250/32")},
 				},
 			},
 			expected: []string{
diff --git a/licenses/android.md b/licenses/android.md
index 0b8fbe963..bb37ed0b8 100644
--- a/licenses/android.md
+++ b/licenses/android.md
@@ -10,44 +10,44 @@ Client][].  See also the dependencies in the [Tailscale CLI][].
 
 
  - [filippo.io/edwards25519](https://pkg.go.dev/filippo.io/edwards25519) ([BSD-3-Clause](https://github.com/FiloSottile/edwards25519/blob/v1.2.0/LICENSE))
- - [github.com/creachadair/msync/trigger](https://pkg.go.dev/github.com/creachadair/msync/trigger) ([BSD-3-Clause](https://github.com/creachadair/msync/blob/v0.7.1/LICENSE))
+ - [github.com/creachadair/msync/trigger](https://pkg.go.dev/github.com/creachadair/msync/trigger) ([BSD-3-Clause](https://github.com/creachadair/msync/blob/v0.8.1/LICENSE))
  - [github.com/djherbis/times](https://pkg.go.dev/github.com/djherbis/times) ([MIT](https://github.com/djherbis/times/blob/v1.6.0/LICENSE))
  - [github.com/fxamacker/cbor/v2](https://pkg.go.dev/github.com/fxamacker/cbor/v2) ([MIT](https://github.com/fxamacker/cbor/blob/v2.9.0/LICENSE))
  - [github.com/gaissmai/bart](https://pkg.go.dev/github.com/gaissmai/bart) ([MIT](https://github.com/gaissmai/bart/blob/v0.26.1/LICENSE))
- - [github.com/go-json-experiment/json](https://pkg.go.dev/github.com/go-json-experiment/json) ([BSD-3-Clause](https://github.com/go-json-experiment/json/blob/ebf49471dced/LICENSE))
+ - [github.com/go-json-experiment/json](https://pkg.go.dev/github.com/go-json-experiment/json) ([BSD-3-Clause](https://github.com/go-json-experiment/json/blob/d219187c3433/LICENSE))
  - [github.com/golang/groupcache/lru](https://pkg.go.dev/github.com/golang/groupcache/lru) ([Apache-2.0](https://github.com/golang/groupcache/blob/2c02b8208cf8/LICENSE))
  - [github.com/google/btree](https://pkg.go.dev/github.com/google/btree) ([Apache-2.0](https://github.com/google/btree/blob/v1.1.3/LICENSE))
  - [github.com/google/go-tpm](https://pkg.go.dev/github.com/google/go-tpm) ([Apache-2.0](https://github.com/google/go-tpm/blob/v0.9.4/LICENSE))
  - [github.com/hdevalence/ed25519consensus](https://pkg.go.dev/github.com/hdevalence/ed25519consensus) ([BSD-3-Clause](https://github.com/hdevalence/ed25519consensus/blob/v0.2.0/LICENSE))
  - [github.com/huin/goupnp](https://pkg.go.dev/github.com/huin/goupnp) ([BSD-2-Clause](https://github.com/huin/goupnp/blob/v1.3.0/LICENSE))
- - [github.com/insomniacslk/dhcp](https://pkg.go.dev/github.com/insomniacslk/dhcp) ([BSD-3-Clause](https://github.com/insomniacslk/dhcp/blob/8c70d406f6d2/LICENSE))
+ - [github.com/insomniacslk/dhcp](https://pkg.go.dev/github.com/insomniacslk/dhcp) ([BSD-3-Clause](https://github.com/insomniacslk/dhcp/blob/15c9b8791914/LICENSE))
  - [github.com/jellydator/ttlcache/v3](https://pkg.go.dev/github.com/jellydator/ttlcache/v3) ([MIT](https://github.com/jellydator/ttlcache/blob/v3.1.0/LICENSE))
- - [github.com/klauspost/compress](https://pkg.go.dev/github.com/klauspost/compress) ([Apache-2.0](https://github.com/klauspost/compress/blob/v1.18.2/LICENSE))
- - [github.com/klauspost/compress/internal/snapref](https://pkg.go.dev/github.com/klauspost/compress/internal/snapref) ([BSD-3-Clause](https://github.com/klauspost/compress/blob/v1.18.2/internal/snapref/LICENSE))
- - [github.com/klauspost/compress/zstd/internal/xxhash](https://pkg.go.dev/github.com/klauspost/compress/zstd/internal/xxhash) ([MIT](https://github.com/klauspost/compress/blob/v1.18.2/zstd/internal/xxhash/LICENSE.txt))
+ - [github.com/klauspost/compress](https://pkg.go.dev/github.com/klauspost/compress) ([Apache-2.0](https://github.com/klauspost/compress/blob/v1.18.5/LICENSE))
+ - [github.com/klauspost/compress/internal/snapref](https://pkg.go.dev/github.com/klauspost/compress/internal/snapref) ([BSD-3-Clause](https://github.com/klauspost/compress/blob/v1.18.5/internal/snapref/LICENSE))
+ - [github.com/klauspost/compress/zstd/internal/xxhash](https://pkg.go.dev/github.com/klauspost/compress/zstd/internal/xxhash) ([MIT](https://github.com/klauspost/compress/blob/v1.18.5/zstd/internal/xxhash/LICENSE.txt))
  - [github.com/kortschak/wol](https://pkg.go.dev/github.com/kortschak/wol) ([BSD-3-Clause](https://github.com/kortschak/wol/blob/da482cc4850a/LICENSE))
  - [github.com/mdlayher/netlink](https://pkg.go.dev/github.com/mdlayher/netlink) ([MIT](https://github.com/mdlayher/netlink/blob/fbb4dce95f42/LICENSE.md))
  - [github.com/mdlayher/socket](https://pkg.go.dev/github.com/mdlayher/socket) ([MIT](https://github.com/mdlayher/socket/blob/v0.5.0/LICENSE.md))
- - [github.com/pierrec/lz4/v4](https://pkg.go.dev/github.com/pierrec/lz4/v4) ([BSD-3-Clause](https://github.com/pierrec/lz4/blob/v4.1.25/LICENSE))
+ - [github.com/pierrec/lz4/v4](https://pkg.go.dev/github.com/pierrec/lz4/v4) ([BSD-3-Clause](https://github.com/pierrec/lz4/blob/v4.1.26/LICENSE))
  - [github.com/pires/go-proxyproto](https://pkg.go.dev/github.com/pires/go-proxyproto) ([Apache-2.0](https://github.com/pires/go-proxyproto/blob/v0.8.1/LICENSE))
  - [github.com/tailscale/peercred](https://pkg.go.dev/github.com/tailscale/peercred) ([BSD-3-Clause](https://github.com/tailscale/peercred/blob/35a0c7bd7edc/LICENSE))
  - [github.com/tailscale/tailscale-android/libtailscale](https://pkg.go.dev/github.com/tailscale/tailscale-android/libtailscale) ([BSD-3-Clause](https://github.com/tailscale/tailscale-android/blob/HEAD/LICENSE))
- - [github.com/tailscale/wireguard-go](https://pkg.go.dev/github.com/tailscale/wireguard-go) ([MIT](https://github.com/tailscale/wireguard-go/blob/4184faf59e56/LICENSE))
+ - [github.com/tailscale/wireguard-go](https://pkg.go.dev/github.com/tailscale/wireguard-go) ([MIT](https://github.com/tailscale/wireguard-go/blob/ae172d45f0f7/LICENSE))
  - [github.com/tailscale/xnet/webdav](https://pkg.go.dev/github.com/tailscale/xnet/webdav) ([BSD-3-Clause](https://github.com/tailscale/xnet/blob/8497ac4dab2e/LICENSE))
  - [github.com/u-root/uio](https://pkg.go.dev/github.com/u-root/uio) ([BSD-3-Clause](https://github.com/u-root/uio/blob/d2acac8f3701/LICENSE))
  - [github.com/x448/float16](https://pkg.go.dev/github.com/x448/float16) ([MIT](https://github.com/x448/float16/blob/v0.8.4/LICENSE))
  - [go4.org/mem](https://pkg.go.dev/go4.org/mem) ([Apache-2.0](https://github.com/go4org/mem/blob/ae6ca9944745/LICENSE))
  - [go4.org/netipx](https://pkg.go.dev/go4.org/netipx) ([BSD-3-Clause](https://github.com/go4org/netipx/blob/fdeea329fbba/LICENSE))
- - [golang.org/x/crypto](https://pkg.go.dev/golang.org/x/crypto) ([BSD-3-Clause](https://cs.opensource.google/go/x/crypto/+/v0.46.0:LICENSE))
- - [golang.org/x/exp](https://pkg.go.dev/golang.org/x/exp) ([BSD-3-Clause](https://cs.opensource.google/go/x/exp/+/b7579e27:LICENSE))
+ - [golang.org/x/crypto](https://pkg.go.dev/golang.org/x/crypto) ([BSD-3-Clause](https://cs.opensource.google/go/x/crypto/+/v0.52.0:LICENSE))
+ - [golang.org/x/exp](https://pkg.go.dev/golang.org/x/exp) ([BSD-3-Clause](https://cs.opensource.google/go/x/exp/+/746e56fc:LICENSE))
  - [golang.org/x/mobile](https://pkg.go.dev/golang.org/x/mobile) ([BSD-3-Clause](https://cs.opensource.google/go/x/mobile/+/81131f64:LICENSE))
- - [golang.org/x/mod/semver](https://pkg.go.dev/golang.org/x/mod/semver) ([BSD-3-Clause](https://cs.opensource.google/go/x/mod/+/v0.31.0:LICENSE))
- - [golang.org/x/net](https://pkg.go.dev/golang.org/x/net) ([BSD-3-Clause](https://cs.opensource.google/go/x/net/+/v0.48.0:LICENSE))
- - [golang.org/x/sync](https://pkg.go.dev/golang.org/x/sync) ([BSD-3-Clause](https://cs.opensource.google/go/x/sync/+/v0.19.0:LICENSE))
- - [golang.org/x/sys](https://pkg.go.dev/golang.org/x/sys) ([BSD-3-Clause](https://cs.opensource.google/go/x/sys/+/v0.40.0:LICENSE))
- - [golang.org/x/term](https://pkg.go.dev/golang.org/x/term) ([BSD-3-Clause](https://cs.opensource.google/go/x/term/+/v0.38.0:LICENSE))
- - [golang.org/x/text](https://pkg.go.dev/golang.org/x/text) ([BSD-3-Clause](https://cs.opensource.google/go/x/text/+/v0.32.0:LICENSE))
- - [golang.org/x/time/rate](https://pkg.go.dev/golang.org/x/time/rate) ([BSD-3-Clause](https://cs.opensource.google/go/x/time/+/v0.12.0:LICENSE))
- - [golang.org/x/tools](https://pkg.go.dev/golang.org/x/tools) ([BSD-3-Clause](https://cs.opensource.google/go/x/tools/+/ca281cf9:LICENSE))
+ - [golang.org/x/mod/semver](https://pkg.go.dev/golang.org/x/mod/semver) ([BSD-3-Clause](https://cs.opensource.google/go/x/mod/+/v0.35.0:LICENSE))
+ - [golang.org/x/net](https://pkg.go.dev/golang.org/x/net) ([BSD-3-Clause](https://cs.opensource.google/go/x/net/+/v0.55.0:LICENSE))
+ - [golang.org/x/sync](https://pkg.go.dev/golang.org/x/sync) ([BSD-3-Clause](https://cs.opensource.google/go/x/sync/+/v0.20.0:LICENSE))
+ - [golang.org/x/sys](https://pkg.go.dev/golang.org/x/sys) ([BSD-3-Clause](https://cs.opensource.google/go/x/sys/+/v0.45.0:LICENSE))
+ - [golang.org/x/term](https://pkg.go.dev/golang.org/x/term) ([BSD-3-Clause](https://cs.opensource.google/go/x/term/+/v0.43.0:LICENSE))
+ - [golang.org/x/text](https://pkg.go.dev/golang.org/x/text) ([BSD-3-Clause](https://cs.opensource.google/go/x/text/+/v0.37.0:LICENSE))
+ - [golang.org/x/time/rate](https://pkg.go.dev/golang.org/x/time/rate) ([BSD-3-Clause](https://cs.opensource.google/go/x/time/+/v0.15.0:LICENSE))
+ - [golang.org/x/tools](https://pkg.go.dev/golang.org/x/tools) ([BSD-3-Clause](https://cs.opensource.google/go/x/tools/+/v0.44.0:LICENSE))
  - [gvisor.dev/gvisor/pkg](https://pkg.go.dev/gvisor.dev/gvisor/pkg) ([Apache-2.0](https://github.com/google/gvisor/blob/573d5e7127a8/LICENSE))
  - [tailscale.com](https://pkg.go.dev/tailscale.com) ([BSD-3-Clause](https://github.com/tailscale/tailscale/blob/HEAD/LICENSE))
diff --git a/licenses/apple.md b/licenses/apple.md
index fa80ca300..04a2cc447 100644
--- a/licenses/apple.md
+++ b/licenses/apple.md
@@ -12,35 +12,34 @@ See also the dependencies in the [Tailscale CLI][].
 
 
  - [filippo.io/edwards25519](https://pkg.go.dev/filippo.io/edwards25519) ([BSD-3-Clause](https://github.com/FiloSottile/edwards25519/blob/v1.2.0/LICENSE))
- - [github.com/aws/aws-sdk-go-v2](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/v1.41.5/LICENSE.txt))
- - [github.com/aws/aws-sdk-go-v2/config](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/config) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/config/v1.32.5/config/LICENSE.txt))
- - [github.com/aws/aws-sdk-go-v2/credentials](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/credentials) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/credentials/v1.19.5/credentials/LICENSE.txt))
- - [github.com/aws/aws-sdk-go-v2/feature/ec2/imds](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/feature/ec2/imds) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/feature/ec2/imds/v1.18.16/feature/ec2/imds/LICENSE.txt))
- - [github.com/aws/aws-sdk-go-v2/internal/configsources](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/internal/configsources) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/internal/configsources/v1.4.16/internal/configsources/LICENSE.txt))
- - [github.com/aws/aws-sdk-go-v2/internal/endpoints/v2](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/internal/endpoints/v2.7.16/internal/endpoints/v2/LICENSE.txt))
- - [github.com/aws/aws-sdk-go-v2/internal/ini](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/internal/ini) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/internal/ini/v1.8.4/internal/ini/LICENSE.txt))
- - [github.com/aws/aws-sdk-go-v2/internal/sync/singleflight](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/internal/sync/singleflight) ([BSD-3-Clause](https://github.com/aws/aws-sdk-go-v2/blob/v1.41.5/internal/sync/singleflight/LICENSE))
- - [github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/service/internal/accept-encoding/v1.13.4/service/internal/accept-encoding/LICENSE.txt))
- - [github.com/aws/aws-sdk-go-v2/service/internal/presigned-url](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/service/internal/presigned-url/v1.13.16/service/internal/presigned-url/LICENSE.txt))
- - [github.com/aws/aws-sdk-go-v2/service/signin](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/signin) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/service/signin/v1.0.4/service/signin/LICENSE.txt))
+ - [github.com/aws/aws-sdk-go-v2](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/v1.42.1/LICENSE.txt))
+ - [github.com/aws/aws-sdk-go-v2/config](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/config) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/config/v1.32.17/config/LICENSE.txt))
+ - [github.com/aws/aws-sdk-go-v2/credentials](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/credentials) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/credentials/v1.19.16/credentials/LICENSE.txt))
+ - [github.com/aws/aws-sdk-go-v2/feature/ec2/imds](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/feature/ec2/imds) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/feature/ec2/imds/v1.18.23/feature/ec2/imds/LICENSE.txt))
+ - [github.com/aws/aws-sdk-go-v2/internal/configsources](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/internal/configsources) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/internal/configsources/v1.4.30/internal/configsources/LICENSE.txt))
+ - [github.com/aws/aws-sdk-go-v2/internal/endpoints/v2](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/internal/endpoints/v2.7.30/internal/endpoints/v2/LICENSE.txt))
+ - [github.com/aws/aws-sdk-go-v2/internal/sync/singleflight](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/internal/sync/singleflight) ([BSD-3-Clause](https://github.com/aws/aws-sdk-go-v2/blob/v1.42.1/internal/sync/singleflight/LICENSE))
+ - [github.com/aws/aws-sdk-go-v2/internal/v4a](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/internal/v4a) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/internal/v4a/v1.4.24/internal/v4a/LICENSE.txt))
+ - [github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/service/internal/accept-encoding/v1.13.13/service/internal/accept-encoding/LICENSE.txt))
+ - [github.com/aws/aws-sdk-go-v2/service/internal/presigned-url](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/service/internal/presigned-url/v1.13.30/service/internal/presigned-url/LICENSE.txt))
+ - [github.com/aws/aws-sdk-go-v2/service/signin](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/signin) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/service/signin/v1.0.11/service/signin/LICENSE.txt))
  - [github.com/aws/aws-sdk-go-v2/service/ssm](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/ssm) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/service/ssm/v1.45.0/service/ssm/LICENSE.txt))
- - [github.com/aws/aws-sdk-go-v2/service/sso](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/sso) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/service/sso/v1.30.7/service/sso/LICENSE.txt))
- - [github.com/aws/aws-sdk-go-v2/service/ssooidc](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/ssooidc) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/service/ssooidc/v1.35.12/service/ssooidc/LICENSE.txt))
- - [github.com/aws/aws-sdk-go-v2/service/sts](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/sts) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/service/sts/v1.41.5/service/sts/LICENSE.txt))
- - [github.com/aws/smithy-go](https://pkg.go.dev/github.com/aws/smithy-go) ([Apache-2.0](https://github.com/aws/smithy-go/blob/v1.24.2/LICENSE))
- - [github.com/aws/smithy-go/internal/sync/singleflight](https://pkg.go.dev/github.com/aws/smithy-go/internal/sync/singleflight) ([BSD-3-Clause](https://github.com/aws/smithy-go/blob/v1.24.2/internal/sync/singleflight/LICENSE))
+ - [github.com/aws/aws-sdk-go-v2/service/sso](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/sso) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/service/sso/v1.30.17/service/sso/LICENSE.txt))
+ - [github.com/aws/aws-sdk-go-v2/service/ssooidc](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/ssooidc) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/service/ssooidc/v1.35.21/service/ssooidc/LICENSE.txt))
+ - [github.com/aws/aws-sdk-go-v2/service/sts](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/sts) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/service/sts/v1.42.1/service/sts/LICENSE.txt))
+ - [github.com/aws/smithy-go](https://pkg.go.dev/github.com/aws/smithy-go) ([Apache-2.0](https://github.com/aws/smithy-go/blob/v1.27.3/LICENSE))
+ - [github.com/aws/smithy-go/internal/sync/singleflight](https://pkg.go.dev/github.com/aws/smithy-go/internal/sync/singleflight) ([BSD-3-Clause](https://github.com/aws/smithy-go/blob/v1.27.3/internal/sync/singleflight/LICENSE))
  - [github.com/coreos/go-iptables/iptables](https://pkg.go.dev/github.com/coreos/go-iptables/iptables) ([Apache-2.0](https://github.com/coreos/go-iptables/blob/65c67c9f46e6/LICENSE))
  - [github.com/creachadair/msync/trigger](https://pkg.go.dev/github.com/creachadair/msync/trigger) ([BSD-3-Clause](https://github.com/creachadair/msync/blob/v0.8.1/LICENSE))
  - [github.com/digitalocean/go-smbios/smbios](https://pkg.go.dev/github.com/digitalocean/go-smbios/smbios) ([Apache-2.0](https://github.com/digitalocean/go-smbios/blob/390a4f403a8e/LICENSE.md))
  - [github.com/djherbis/times](https://pkg.go.dev/github.com/djherbis/times) ([MIT](https://github.com/djherbis/times/blob/v1.6.0/LICENSE))
  - [github.com/fxamacker/cbor/v2](https://pkg.go.dev/github.com/fxamacker/cbor/v2) ([MIT](https://github.com/fxamacker/cbor/blob/v2.9.0/LICENSE))
  - [github.com/gaissmai/bart](https://pkg.go.dev/github.com/gaissmai/bart) ([MIT](https://github.com/gaissmai/bart/blob/v0.26.1/LICENSE))
- - [github.com/go-json-experiment/json](https://pkg.go.dev/github.com/go-json-experiment/json) ([BSD-3-Clause](https://github.com/go-json-experiment/json/blob/4849db3c2f7e/LICENSE))
- - [github.com/godbus/dbus/v5](https://pkg.go.dev/github.com/godbus/dbus/v5) ([BSD-2-Clause](https://github.com/godbus/dbus/blob/76236955d466/LICENSE))
+ - [github.com/go-json-experiment/json](https://pkg.go.dev/github.com/go-json-experiment/json) ([BSD-3-Clause](https://github.com/go-json-experiment/json/blob/d219187c3433/LICENSE))
+ - [github.com/godbus/dbus/v5](https://pkg.go.dev/github.com/godbus/dbus/v5) ([BSD-2-Clause](https://github.com/godbus/dbus/blob/v5.2.2/LICENSE))
  - [github.com/golang/groupcache/lru](https://pkg.go.dev/github.com/golang/groupcache/lru) ([Apache-2.0](https://github.com/golang/groupcache/blob/2c02b8208cf8/LICENSE))
  - [github.com/google/btree](https://pkg.go.dev/github.com/google/btree) ([Apache-2.0](https://github.com/google/btree/blob/v1.1.3/LICENSE))
  - [github.com/google/nftables](https://pkg.go.dev/github.com/google/nftables) ([Apache-2.0](https://github.com/google/nftables/blob/5e242ec57806/LICENSE))
- - [github.com/google/uuid](https://pkg.go.dev/github.com/google/uuid) ([BSD-3-Clause](https://github.com/google/uuid/blob/v1.6.0/LICENSE))
  - [github.com/hdevalence/ed25519consensus](https://pkg.go.dev/github.com/hdevalence/ed25519consensus) ([BSD-3-Clause](https://github.com/hdevalence/ed25519consensus/blob/v0.2.0/LICENSE))
  - [github.com/huin/goupnp](https://pkg.go.dev/github.com/huin/goupnp) ([BSD-2-Clause](https://github.com/huin/goupnp/blob/v1.3.0/LICENSE))
  - [github.com/illarion/gonotify/v3](https://pkg.go.dev/github.com/illarion/gonotify/v3) ([MIT](https://github.com/illarion/gonotify/blob/v3.0.2/LICENSE))
@@ -48,36 +47,36 @@ See also the dependencies in the [Tailscale CLI][].
  - [github.com/jellydator/ttlcache/v3](https://pkg.go.dev/github.com/jellydator/ttlcache/v3) ([MIT](https://github.com/jellydator/ttlcache/blob/v3.1.0/LICENSE))
  - [github.com/jmespath/go-jmespath](https://pkg.go.dev/github.com/jmespath/go-jmespath) ([Apache-2.0](https://github.com/jmespath/go-jmespath/blob/v0.4.0/LICENSE))
  - [github.com/jsimonetti/rtnetlink](https://pkg.go.dev/github.com/jsimonetti/rtnetlink) ([MIT](https://github.com/jsimonetti/rtnetlink/blob/v1.4.1/LICENSE.md))
- - [github.com/klauspost/compress](https://pkg.go.dev/github.com/klauspost/compress) ([Apache-2.0](https://github.com/klauspost/compress/blob/v1.18.4/LICENSE))
- - [github.com/klauspost/compress/internal/snapref](https://pkg.go.dev/github.com/klauspost/compress/internal/snapref) ([BSD-3-Clause](https://github.com/klauspost/compress/blob/v1.18.4/internal/snapref/LICENSE))
- - [github.com/klauspost/compress/zstd/internal/xxhash](https://pkg.go.dev/github.com/klauspost/compress/zstd/internal/xxhash) ([MIT](https://github.com/klauspost/compress/blob/v1.18.4/zstd/internal/xxhash/LICENSE.txt))
+ - [github.com/klauspost/compress](https://pkg.go.dev/github.com/klauspost/compress) ([Apache-2.0](https://github.com/klauspost/compress/blob/v1.18.5/LICENSE))
+ - [github.com/klauspost/compress/internal/snapref](https://pkg.go.dev/github.com/klauspost/compress/internal/snapref) ([BSD-3-Clause](https://github.com/klauspost/compress/blob/v1.18.5/internal/snapref/LICENSE))
+ - [github.com/klauspost/compress/zstd/internal/xxhash](https://pkg.go.dev/github.com/klauspost/compress/zstd/internal/xxhash) ([MIT](https://github.com/klauspost/compress/blob/v1.18.5/zstd/internal/xxhash/LICENSE.txt))
  - [github.com/kortschak/wol](https://pkg.go.dev/github.com/kortschak/wol) ([BSD-3-Clause](https://github.com/kortschak/wol/blob/da482cc4850a/LICENSE))
  - [github.com/mdlayher/genetlink](https://pkg.go.dev/github.com/mdlayher/genetlink) ([MIT](https://github.com/mdlayher/genetlink/blob/v1.3.2/LICENSE.md))
  - [github.com/mdlayher/netlink](https://pkg.go.dev/github.com/mdlayher/netlink) ([MIT](https://github.com/mdlayher/netlink/blob/fbb4dce95f42/LICENSE.md))
  - [github.com/mdlayher/sdnotify](https://pkg.go.dev/github.com/mdlayher/sdnotify) ([MIT](https://github.com/mdlayher/sdnotify/blob/v1.0.0/LICENSE.md))
  - [github.com/mdlayher/socket](https://pkg.go.dev/github.com/mdlayher/socket) ([MIT](https://github.com/mdlayher/socket/blob/v0.5.0/LICENSE.md))
  - [github.com/mitchellh/go-ps](https://pkg.go.dev/github.com/mitchellh/go-ps) ([MIT](https://github.com/mitchellh/go-ps/blob/v1.0.0/LICENSE.md))
- - [github.com/pierrec/lz4/v4](https://pkg.go.dev/github.com/pierrec/lz4/v4) ([BSD-3-Clause](https://github.com/pierrec/lz4/blob/v4.1.25/LICENSE))
+ - [github.com/pierrec/lz4/v4](https://pkg.go.dev/github.com/pierrec/lz4/v4) ([BSD-3-Clause](https://github.com/pierrec/lz4/blob/v4.1.26/LICENSE))
  - [github.com/pires/go-proxyproto](https://pkg.go.dev/github.com/pires/go-proxyproto) ([Apache-2.0](https://github.com/pires/go-proxyproto/blob/v0.8.1/LICENSE))
- - [github.com/prometheus-community/pro-bing](https://pkg.go.dev/github.com/prometheus-community/pro-bing) ([MIT](https://github.com/prometheus-community/pro-bing/blob/v0.4.0/LICENSE))
  - [github.com/safchain/ethtool](https://pkg.go.dev/github.com/safchain/ethtool) ([Apache-2.0](https://github.com/safchain/ethtool/blob/v0.3.0/LICENSE))
  - [github.com/tailscale/netlink](https://pkg.go.dev/github.com/tailscale/netlink) ([Apache-2.0](https://github.com/tailscale/netlink/blob/4d49adab4de7/LICENSE))
  - [github.com/tailscale/peercred](https://pkg.go.dev/github.com/tailscale/peercred) ([BSD-3-Clause](https://github.com/tailscale/peercred/blob/35a0c7bd7edc/LICENSE))
- - [github.com/tailscale/wireguard-go](https://pkg.go.dev/github.com/tailscale/wireguard-go) ([MIT](https://github.com/tailscale/wireguard-go/blob/4184faf59e56/LICENSE))
+ - [github.com/tailscale/web-client-prebuilt](https://pkg.go.dev/github.com/tailscale/web-client-prebuilt) ([BSD-3-Clause](https://github.com/tailscale/web-client-prebuilt/blob/d4cd19a26976/LICENSE))
+ - [github.com/tailscale/wireguard-go](https://pkg.go.dev/github.com/tailscale/wireguard-go) ([MIT](https://github.com/tailscale/wireguard-go/blob/ae172d45f0f7/LICENSE))
  - [github.com/tailscale/xnet/webdav](https://pkg.go.dev/github.com/tailscale/xnet/webdav) ([BSD-3-Clause](https://github.com/tailscale/xnet/blob/8497ac4dab2e/LICENSE))
  - [github.com/u-root/uio](https://pkg.go.dev/github.com/u-root/uio) ([BSD-3-Clause](https://github.com/u-root/uio/blob/d2acac8f3701/LICENSE))
  - [github.com/vishvananda/netns](https://pkg.go.dev/github.com/vishvananda/netns) ([Apache-2.0](https://github.com/vishvananda/netns/blob/v0.0.5/LICENSE))
  - [github.com/x448/float16](https://pkg.go.dev/github.com/x448/float16) ([MIT](https://github.com/x448/float16/blob/v0.8.4/LICENSE))
  - [go4.org/mem](https://pkg.go.dev/go4.org/mem) ([Apache-2.0](https://github.com/go4org/mem/blob/ae6ca9944745/LICENSE))
  - [go4.org/netipx](https://pkg.go.dev/go4.org/netipx) ([BSD-3-Clause](https://github.com/go4org/netipx/blob/fdeea329fbba/LICENSE))
- - [golang.org/x/crypto](https://pkg.go.dev/golang.org/x/crypto) ([BSD-3-Clause](https://cs.opensource.google/go/x/crypto/+/v0.49.0:LICENSE))
- - [golang.org/x/exp](https://pkg.go.dev/golang.org/x/exp) ([BSD-3-Clause](https://cs.opensource.google/go/x/exp/+/a4bb9ffd:LICENSE))
- - [golang.org/x/net](https://pkg.go.dev/golang.org/x/net) ([BSD-3-Clause](https://cs.opensource.google/go/x/net/+/v0.52.0:LICENSE))
+ - [golang.org/x/crypto](https://pkg.go.dev/golang.org/x/crypto) ([BSD-3-Clause](https://cs.opensource.google/go/x/crypto/+/v0.52.0:LICENSE))
+ - [golang.org/x/exp](https://pkg.go.dev/golang.org/x/exp) ([BSD-3-Clause](https://cs.opensource.google/go/x/exp/+/746e56fc:LICENSE))
+ - [golang.org/x/net](https://pkg.go.dev/golang.org/x/net) ([BSD-3-Clause](https://cs.opensource.google/go/x/net/+/v0.55.0:LICENSE))
  - [golang.org/x/sync](https://pkg.go.dev/golang.org/x/sync) ([BSD-3-Clause](https://cs.opensource.google/go/x/sync/+/v0.20.0:LICENSE))
- - [golang.org/x/sys](https://pkg.go.dev/golang.org/x/sys) ([BSD-3-Clause](https://cs.opensource.google/go/x/sys/+/v0.42.0:LICENSE))
- - [golang.org/x/term](https://pkg.go.dev/golang.org/x/term) ([BSD-3-Clause](https://cs.opensource.google/go/x/term/+/v0.41.0:LICENSE))
- - [golang.org/x/text](https://pkg.go.dev/golang.org/x/text) ([BSD-3-Clause](https://cs.opensource.google/go/x/text/+/v0.35.0:LICENSE))
- - [golang.org/x/time/rate](https://pkg.go.dev/golang.org/x/time/rate) ([BSD-3-Clause](https://cs.opensource.google/go/x/time/+/v0.12.0:LICENSE))
+ - [golang.org/x/sys](https://pkg.go.dev/golang.org/x/sys) ([BSD-3-Clause](https://cs.opensource.google/go/x/sys/+/v0.45.0:LICENSE))
+ - [golang.org/x/term](https://pkg.go.dev/golang.org/x/term) ([BSD-3-Clause](https://cs.opensource.google/go/x/term/+/v0.43.0:LICENSE))
+ - [golang.org/x/text](https://pkg.go.dev/golang.org/x/text) ([BSD-3-Clause](https://cs.opensource.google/go/x/text/+/v0.37.0:LICENSE))
+ - [golang.org/x/time/rate](https://pkg.go.dev/golang.org/x/time/rate) ([BSD-3-Clause](https://cs.opensource.google/go/x/time/+/v0.15.0:LICENSE))
  - [gvisor.dev/gvisor/pkg](https://pkg.go.dev/gvisor.dev/gvisor/pkg) ([Apache-2.0](https://github.com/google/gvisor/blob/573d5e7127a8/LICENSE))
  - [tailscale.com](https://pkg.go.dev/tailscale.com) ([BSD-3-Clause](https://github.com/tailscale/tailscale/blob/HEAD/LICENSE))
 
diff --git a/licenses/tailscale.md b/licenses/tailscale.md
index d5e46e90f..8a9319f8c 100644
--- a/licenses/tailscale.md
+++ b/licenses/tailscale.md
@@ -20,88 +20,90 @@ Some packages may only be included on certain architectures or operating systems
  - [github.com/alexbrainman/sspi](https://pkg.go.dev/github.com/alexbrainman/sspi) ([BSD-3-Clause](https://github.com/alexbrainman/sspi/blob/1a75b4708caa/LICENSE))
  - [github.com/anmitsu/go-shlex](https://pkg.go.dev/github.com/anmitsu/go-shlex) ([MIT](https://github.com/anmitsu/go-shlex/blob/38f4b401e2be/LICENSE))
  - [github.com/atotto/clipboard](https://pkg.go.dev/github.com/atotto/clipboard) ([BSD-3-Clause](https://github.com/atotto/clipboard/blob/v0.1.4/LICENSE))
- - [github.com/aws/aws-sdk-go-v2](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/v1.41.0/LICENSE.txt))
- - [github.com/aws/aws-sdk-go-v2/config](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/config) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/config/v1.29.5/config/LICENSE.txt))
- - [github.com/aws/aws-sdk-go-v2/credentials](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/credentials) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/credentials/v1.17.58/credentials/LICENSE.txt))
- - [github.com/aws/aws-sdk-go-v2/feature/ec2/imds](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/feature/ec2/imds) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/feature/ec2/imds/v1.16.27/feature/ec2/imds/LICENSE.txt))
- - [github.com/aws/aws-sdk-go-v2/internal/configsources](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/internal/configsources) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/internal/configsources/v1.4.16/internal/configsources/LICENSE.txt))
- - [github.com/aws/aws-sdk-go-v2/internal/endpoints/v2](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/internal/endpoints/v2.7.16/internal/endpoints/v2/LICENSE.txt))
- - [github.com/aws/aws-sdk-go-v2/internal/ini](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/internal/ini) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/internal/ini/v1.8.2/internal/ini/LICENSE.txt))
- - [github.com/aws/aws-sdk-go-v2/internal/sync/singleflight](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/internal/sync/singleflight) ([BSD-3-Clause](https://github.com/aws/aws-sdk-go-v2/blob/v1.41.0/internal/sync/singleflight/LICENSE))
- - [github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/service/internal/accept-encoding/v1.13.4/service/internal/accept-encoding/LICENSE.txt))
- - [github.com/aws/aws-sdk-go-v2/service/internal/presigned-url](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/service/internal/presigned-url/v1.13.16/service/internal/presigned-url/LICENSE.txt))
- - [github.com/aws/aws-sdk-go-v2/service/ssm](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/ssm) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/service/ssm/v1.44.7/service/ssm/LICENSE.txt))
- - [github.com/aws/aws-sdk-go-v2/service/sso](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/sso) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/service/sso/v1.24.14/service/sso/LICENSE.txt))
- - [github.com/aws/aws-sdk-go-v2/service/ssooidc](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/ssooidc) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/service/ssooidc/v1.28.13/service/ssooidc/LICENSE.txt))
- - [github.com/aws/aws-sdk-go-v2/service/sts](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/sts) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/service/sts/v1.41.5/service/sts/LICENSE.txt))
- - [github.com/aws/smithy-go](https://pkg.go.dev/github.com/aws/smithy-go) ([Apache-2.0](https://github.com/aws/smithy-go/blob/v1.24.0/LICENSE))
- - [github.com/aws/smithy-go/internal/sync/singleflight](https://pkg.go.dev/github.com/aws/smithy-go/internal/sync/singleflight) ([BSD-3-Clause](https://github.com/aws/smithy-go/blob/v1.24.0/internal/sync/singleflight/LICENSE))
- - [github.com/coder/websocket](https://pkg.go.dev/github.com/coder/websocket) ([ISC](https://github.com/coder/websocket/blob/v1.8.12/LICENSE.txt))
- - [github.com/creachadair/msync/trigger](https://pkg.go.dev/github.com/creachadair/msync/trigger) ([BSD-3-Clause](https://github.com/creachadair/msync/blob/v0.7.1/LICENSE))
+ - [github.com/aws/aws-sdk-go-v2](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/v1.42.1/LICENSE.txt))
+ - [github.com/aws/aws-sdk-go-v2/config](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/config) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/config/v1.32.17/config/LICENSE.txt))
+ - [github.com/aws/aws-sdk-go-v2/credentials](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/credentials) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/credentials/v1.19.16/credentials/LICENSE.txt))
+ - [github.com/aws/aws-sdk-go-v2/feature/ec2/imds](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/feature/ec2/imds) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/feature/ec2/imds/v1.18.23/feature/ec2/imds/LICENSE.txt))
+ - [github.com/aws/aws-sdk-go-v2/internal/configsources](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/internal/configsources) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/internal/configsources/v1.4.30/internal/configsources/LICENSE.txt))
+ - [github.com/aws/aws-sdk-go-v2/internal/endpoints/v2](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/internal/endpoints/v2.7.30/internal/endpoints/v2/LICENSE.txt))
+ - [github.com/aws/aws-sdk-go-v2/internal/sync/singleflight](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/internal/sync/singleflight) ([BSD-3-Clause](https://github.com/aws/aws-sdk-go-v2/blob/v1.42.1/internal/sync/singleflight/LICENSE))
+ - [github.com/aws/aws-sdk-go-v2/internal/v4a](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/internal/v4a) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/internal/v4a/v1.4.24/internal/v4a/LICENSE.txt))
+ - [github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/service/internal/accept-encoding/v1.13.13/service/internal/accept-encoding/LICENSE.txt))
+ - [github.com/aws/aws-sdk-go-v2/service/internal/presigned-url](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/service/internal/presigned-url/v1.13.30/service/internal/presigned-url/LICENSE.txt))
+ - [github.com/aws/aws-sdk-go-v2/service/signin](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/signin) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/service/signin/v1.0.11/service/signin/LICENSE.txt))
+ - [github.com/aws/aws-sdk-go-v2/service/ssm](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/ssm) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/service/ssm/v1.45.0/service/ssm/LICENSE.txt))
+ - [github.com/aws/aws-sdk-go-v2/service/sso](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/sso) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/service/sso/v1.30.17/service/sso/LICENSE.txt))
+ - [github.com/aws/aws-sdk-go-v2/service/ssooidc](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/ssooidc) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/service/ssooidc/v1.35.21/service/ssooidc/LICENSE.txt))
+ - [github.com/aws/aws-sdk-go-v2/service/sts](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/sts) ([Apache-2.0](https://github.com/aws/aws-sdk-go-v2/blob/service/sts/v1.42.1/service/sts/LICENSE.txt))
+ - [github.com/aws/smithy-go](https://pkg.go.dev/github.com/aws/smithy-go) ([Apache-2.0](https://github.com/aws/smithy-go/blob/v1.27.3/LICENSE))
+ - [github.com/aws/smithy-go/internal/sync/singleflight](https://pkg.go.dev/github.com/aws/smithy-go/internal/sync/singleflight) ([BSD-3-Clause](https://github.com/aws/smithy-go/blob/v1.27.3/internal/sync/singleflight/LICENSE))
+ - [github.com/bradfitz/monogok/disklayout](https://pkg.go.dev/github.com/bradfitz/monogok/disklayout) ([BSD-3-Clause](https://github.com/bradfitz/monogok/blob/b1eef977b41f/LICENSE))
+ - [github.com/coder/websocket](https://pkg.go.dev/github.com/coder/websocket) ([ISC](https://github.com/coder/websocket/blob/v1.8.14/LICENSE.txt))
+ - [github.com/creachadair/msync/trigger](https://pkg.go.dev/github.com/creachadair/msync/trigger) ([BSD-3-Clause](https://github.com/creachadair/msync/blob/v0.8.1/LICENSE))
  - [github.com/creack/pty](https://pkg.go.dev/github.com/creack/pty) ([MIT](https://github.com/creack/pty/blob/v1.1.24/LICENSE))
  - [github.com/dblohm7/wingoes](https://pkg.go.dev/github.com/dblohm7/wingoes) ([BSD-3-Clause](https://github.com/dblohm7/wingoes/blob/a09d6be7affa/LICENSE))
  - [github.com/digitalocean/go-smbios/smbios](https://pkg.go.dev/github.com/digitalocean/go-smbios/smbios) ([Apache-2.0](https://github.com/digitalocean/go-smbios/blob/390a4f403a8e/LICENSE.md))
+ - [github.com/diskfs/go-diskfs](https://pkg.go.dev/github.com/diskfs/go-diskfs) ([MIT](https://github.com/diskfs/go-diskfs/blob/v1.9.3/LICENSE))
  - [github.com/djherbis/times](https://pkg.go.dev/github.com/djherbis/times) ([MIT](https://github.com/djherbis/times/blob/v1.6.0/LICENSE))
  - [github.com/fogleman/gg](https://pkg.go.dev/github.com/fogleman/gg) ([MIT](https://github.com/fogleman/gg/blob/v1.3.0/LICENSE.md))
  - [github.com/fxamacker/cbor/v2](https://pkg.go.dev/github.com/fxamacker/cbor/v2) ([MIT](https://github.com/fxamacker/cbor/blob/v2.9.0/LICENSE))
  - [github.com/gaissmai/bart](https://pkg.go.dev/github.com/gaissmai/bart) ([MIT](https://github.com/gaissmai/bart/blob/v0.26.1/LICENSE))
- - [github.com/go-json-experiment/json](https://pkg.go.dev/github.com/go-json-experiment/json) ([BSD-3-Clause](https://github.com/go-json-experiment/json/blob/ebf49471dced/LICENSE))
+ - [github.com/go-json-experiment/json](https://pkg.go.dev/github.com/go-json-experiment/json) ([BSD-3-Clause](https://github.com/go-json-experiment/json/blob/d219187c3433/LICENSE))
  - [github.com/go-ole/go-ole](https://pkg.go.dev/github.com/go-ole/go-ole) ([MIT](https://github.com/go-ole/go-ole/blob/v1.3.0/LICENSE))
- - [github.com/godbus/dbus/v5](https://pkg.go.dev/github.com/godbus/dbus/v5) ([BSD-2-Clause](https://github.com/godbus/dbus/blob/76236955d466/LICENSE))
+ - [github.com/godbus/dbus/v5](https://pkg.go.dev/github.com/godbus/dbus/v5) ([BSD-2-Clause](https://github.com/godbus/dbus/blob/v5.2.2/LICENSE))
  - [github.com/golang/freetype/raster](https://pkg.go.dev/github.com/golang/freetype/raster) ([Unknown](Unknown))
  - [github.com/golang/freetype/truetype](https://pkg.go.dev/github.com/golang/freetype/truetype) ([Unknown](Unknown))
  - [github.com/golang/groupcache/lru](https://pkg.go.dev/github.com/golang/groupcache/lru) ([Apache-2.0](https://github.com/golang/groupcache/blob/2c02b8208cf8/LICENSE))
  - [github.com/google/btree](https://pkg.go.dev/github.com/google/btree) ([Apache-2.0](https://github.com/google/btree/blob/v1.1.3/LICENSE))
  - [github.com/google/uuid](https://pkg.go.dev/github.com/google/uuid) ([BSD-3-Clause](https://github.com/google/uuid/blob/v1.6.0/LICENSE))
  - [github.com/hdevalence/ed25519consensus](https://pkg.go.dev/github.com/hdevalence/ed25519consensus) ([BSD-3-Clause](https://github.com/hdevalence/ed25519consensus/blob/v0.2.0/LICENSE))
- - [github.com/insomniacslk/dhcp](https://pkg.go.dev/github.com/insomniacslk/dhcp) ([BSD-3-Clause](https://github.com/insomniacslk/dhcp/blob/8c70d406f6d2/LICENSE))
+ - [github.com/insomniacslk/dhcp](https://pkg.go.dev/github.com/insomniacslk/dhcp) ([BSD-3-Clause](https://github.com/insomniacslk/dhcp/blob/15c9b8791914/LICENSE))
  - [github.com/jellydator/ttlcache/v3](https://pkg.go.dev/github.com/jellydator/ttlcache/v3) ([MIT](https://github.com/jellydator/ttlcache/blob/v3.1.0/LICENSE))
  - [github.com/jmespath/go-jmespath](https://pkg.go.dev/github.com/jmespath/go-jmespath) ([Apache-2.0](https://github.com/jmespath/go-jmespath/blob/v0.4.0/LICENSE))
  - [github.com/kballard/go-shellquote](https://pkg.go.dev/github.com/kballard/go-shellquote) ([MIT](https://github.com/kballard/go-shellquote/blob/95032a82bc51/LICENSE))
- - [github.com/klauspost/compress](https://pkg.go.dev/github.com/klauspost/compress) ([Apache-2.0](https://github.com/klauspost/compress/blob/v1.18.2/LICENSE))
- - [github.com/klauspost/compress/internal/snapref](https://pkg.go.dev/github.com/klauspost/compress/internal/snapref) ([BSD-3-Clause](https://github.com/klauspost/compress/blob/v1.18.2/internal/snapref/LICENSE))
- - [github.com/klauspost/compress/zstd/internal/xxhash](https://pkg.go.dev/github.com/klauspost/compress/zstd/internal/xxhash) ([MIT](https://github.com/klauspost/compress/blob/v1.18.2/zstd/internal/xxhash/LICENSE.txt))
+ - [github.com/klauspost/compress](https://pkg.go.dev/github.com/klauspost/compress) ([Apache-2.0](https://github.com/klauspost/compress/blob/v1.18.5/LICENSE))
+ - [github.com/klauspost/compress/internal/snapref](https://pkg.go.dev/github.com/klauspost/compress/internal/snapref) ([BSD-3-Clause](https://github.com/klauspost/compress/blob/v1.18.5/internal/snapref/LICENSE))
+ - [github.com/klauspost/compress/zstd/internal/xxhash](https://pkg.go.dev/github.com/klauspost/compress/zstd/internal/xxhash) ([MIT](https://github.com/klauspost/compress/blob/v1.18.5/zstd/internal/xxhash/LICENSE.txt))
  - [github.com/kortschak/wol](https://pkg.go.dev/github.com/kortschak/wol) ([BSD-3-Clause](https://github.com/kortschak/wol/blob/da482cc4850a/LICENSE))
  - [github.com/kr/fs](https://pkg.go.dev/github.com/kr/fs) ([BSD-3-Clause](https://github.com/kr/fs/blob/v0.1.0/LICENSE))
- - [github.com/mattn/go-colorable](https://pkg.go.dev/github.com/mattn/go-colorable) ([MIT](https://github.com/mattn/go-colorable/blob/v0.1.13/LICENSE))
- - [github.com/mattn/go-isatty](https://pkg.go.dev/github.com/mattn/go-isatty) ([MIT](https://github.com/mattn/go-isatty/blob/v0.0.20/LICENSE))
+ - [github.com/mattn/go-colorable](https://pkg.go.dev/github.com/mattn/go-colorable) ([MIT](https://github.com/mattn/go-colorable/blob/v0.1.14/LICENSE))
+ - [github.com/mattn/go-isatty](https://pkg.go.dev/github.com/mattn/go-isatty) ([MIT](https://github.com/mattn/go-isatty/blob/v0.0.22/LICENSE))
  - [github.com/mdlayher/netlink](https://pkg.go.dev/github.com/mdlayher/netlink) ([MIT](https://github.com/mdlayher/netlink/blob/fbb4dce95f42/LICENSE.md))
  - [github.com/mdlayher/socket](https://pkg.go.dev/github.com/mdlayher/socket) ([MIT](https://github.com/mdlayher/socket/blob/v0.5.0/LICENSE.md))
  - [github.com/mitchellh/go-ps](https://pkg.go.dev/github.com/mitchellh/go-ps) ([MIT](https://github.com/mitchellh/go-ps/blob/v1.0.0/LICENSE.md))
  - [github.com/peterbourgon/ff/v3](https://pkg.go.dev/github.com/peterbourgon/ff/v3) ([Apache-2.0](https://github.com/peterbourgon/ff/blob/v3.4.0/LICENSE))
- - [github.com/pierrec/lz4/v4](https://pkg.go.dev/github.com/pierrec/lz4/v4) ([BSD-3-Clause](https://github.com/pierrec/lz4/blob/v4.1.25/LICENSE))
+ - [github.com/pierrec/lz4/v4](https://pkg.go.dev/github.com/pierrec/lz4/v4) ([BSD-3-Clause](https://github.com/pierrec/lz4/blob/v4.1.26/LICENSE))
  - [github.com/pires/go-proxyproto](https://pkg.go.dev/github.com/pires/go-proxyproto) ([Apache-2.0](https://github.com/pires/go-proxyproto/blob/v0.8.1/LICENSE))
  - [github.com/pkg/sftp](https://pkg.go.dev/github.com/pkg/sftp) ([BSD-2-Clause](https://github.com/pkg/sftp/blob/v1.13.6/LICENSE))
- - [github.com/prometheus-community/pro-bing](https://pkg.go.dev/github.com/prometheus-community/pro-bing) ([MIT](https://github.com/prometheus-community/pro-bing/blob/v0.4.0/LICENSE))
  - [github.com/skip2/go-qrcode](https://pkg.go.dev/github.com/skip2/go-qrcode) ([MIT](https://github.com/skip2/go-qrcode/blob/da1b6568686e/LICENSE))
- - [github.com/tailscale/certstore](https://pkg.go.dev/github.com/tailscale/certstore) ([MIT](https://github.com/tailscale/certstore/blob/d3fa0460f47e/LICENSE.md))
+ - [github.com/tailscale/certstore](https://pkg.go.dev/github.com/tailscale/certstore) ([MIT](https://github.com/tailscale/certstore/blob/3638fb84b77d/LICENSE.md))
+ - [github.com/tailscale/gliderssh](https://pkg.go.dev/github.com/tailscale/gliderssh) ([BSD-3-Clause](https://github.com/tailscale/gliderssh/blob/1a0f895faf28/LICENSE))
  - [github.com/tailscale/go-winio](https://pkg.go.dev/github.com/tailscale/go-winio) ([MIT](https://github.com/tailscale/go-winio/blob/c4f33415bf55/LICENSE))
  - [github.com/tailscale/web-client-prebuilt](https://pkg.go.dev/github.com/tailscale/web-client-prebuilt) ([BSD-3-Clause](https://github.com/tailscale/web-client-prebuilt/blob/d4cd19a26976/LICENSE))
  - [github.com/tailscale/wf](https://pkg.go.dev/github.com/tailscale/wf) ([BSD-3-Clause](https://github.com/tailscale/wf/blob/6fbb0a674ee6/LICENSE))
- - [github.com/tailscale/wireguard-go](https://pkg.go.dev/github.com/tailscale/wireguard-go) ([MIT](https://github.com/tailscale/wireguard-go/blob/4184faf59e56/LICENSE))
+ - [github.com/tailscale/wireguard-go](https://pkg.go.dev/github.com/tailscale/wireguard-go) ([MIT](https://github.com/tailscale/wireguard-go/blob/2e01ba5b00f0/LICENSE))
  - [github.com/tailscale/xnet/webdav](https://pkg.go.dev/github.com/tailscale/xnet/webdav) ([BSD-3-Clause](https://github.com/tailscale/xnet/blob/8497ac4dab2e/LICENSE))
  - [github.com/toqueteos/webbrowser](https://pkg.go.dev/github.com/toqueteos/webbrowser) ([MIT](https://github.com/toqueteos/webbrowser/blob/v1.2.0/LICENSE.md))
  - [github.com/u-root/u-root/pkg/termios](https://pkg.go.dev/github.com/u-root/u-root/pkg/termios) ([BSD-3-Clause](https://github.com/u-root/u-root/blob/v0.14.0/LICENSE))
  - [github.com/u-root/uio](https://pkg.go.dev/github.com/u-root/uio) ([BSD-3-Clause](https://github.com/u-root/uio/blob/d2acac8f3701/LICENSE))
  - [github.com/x448/float16](https://pkg.go.dev/github.com/x448/float16) ([MIT](https://github.com/x448/float16/blob/v0.8.4/LICENSE))
- - [go.yaml.in/yaml/v2](https://pkg.go.dev/go.yaml.in/yaml/v2) ([Apache-2.0](https://github.com/yaml/go-yaml/blob/v2.4.2/LICENSE))
+ - [go.yaml.in/yaml/v2](https://pkg.go.dev/go.yaml.in/yaml/v2) ([Apache-2.0](https://github.com/yaml/go-yaml/blob/v2.4.4/LICENSE))
  - [go4.org/mem](https://pkg.go.dev/go4.org/mem) ([Apache-2.0](https://github.com/go4org/mem/blob/ae6ca9944745/LICENSE))
  - [go4.org/netipx](https://pkg.go.dev/go4.org/netipx) ([BSD-3-Clause](https://github.com/go4org/netipx/blob/fdeea329fbba/LICENSE))
- - [golang.org/x/crypto](https://pkg.go.dev/golang.org/x/crypto) ([BSD-3-Clause](https://cs.opensource.google/go/x/crypto/+/v0.46.0:LICENSE))
- - [golang.org/x/exp](https://pkg.go.dev/golang.org/x/exp) ([BSD-3-Clause](https://cs.opensource.google/go/x/exp/+/b7579e27:LICENSE))
- - [golang.org/x/image](https://pkg.go.dev/golang.org/x/image) ([BSD-3-Clause](https://cs.opensource.google/go/x/image/+/v0.27.0:LICENSE))
- - [golang.org/x/net](https://pkg.go.dev/golang.org/x/net) ([BSD-3-Clause](https://cs.opensource.google/go/x/net/+/v0.48.0:LICENSE))
- - [golang.org/x/oauth2](https://pkg.go.dev/golang.org/x/oauth2) ([BSD-3-Clause](https://cs.opensource.google/go/x/oauth2/+/v0.33.0:LICENSE))
- - [golang.org/x/sync](https://pkg.go.dev/golang.org/x/sync) ([BSD-3-Clause](https://cs.opensource.google/go/x/sync/+/v0.19.0:LICENSE))
- - [golang.org/x/sys](https://pkg.go.dev/golang.org/x/sys) ([BSD-3-Clause](https://cs.opensource.google/go/x/sys/+/v0.40.0:LICENSE))
- - [golang.org/x/term](https://pkg.go.dev/golang.org/x/term) ([BSD-3-Clause](https://cs.opensource.google/go/x/term/+/v0.38.0:LICENSE))
- - [golang.org/x/text](https://pkg.go.dev/golang.org/x/text) ([BSD-3-Clause](https://cs.opensource.google/go/x/text/+/v0.32.0:LICENSE))
- - [golang.org/x/time/rate](https://pkg.go.dev/golang.org/x/time/rate) ([BSD-3-Clause](https://cs.opensource.google/go/x/time/+/v0.12.0:LICENSE))
+ - [golang.org/x/crypto](https://pkg.go.dev/golang.org/x/crypto) ([BSD-3-Clause](https://cs.opensource.google/go/x/crypto/+/v0.54.0:LICENSE))
+ - [golang.org/x/exp](https://pkg.go.dev/golang.org/x/exp) ([BSD-3-Clause](https://cs.opensource.google/go/x/exp/+/746e56fc:LICENSE))
+ - [golang.org/x/image](https://pkg.go.dev/golang.org/x/image) ([BSD-3-Clause](https://cs.opensource.google/go/x/image/+/v0.41.0:LICENSE))
+ - [golang.org/x/net](https://pkg.go.dev/golang.org/x/net) ([BSD-3-Clause](https://cs.opensource.google/go/x/net/+/v0.56.0:LICENSE))
+ - [golang.org/x/oauth2](https://pkg.go.dev/golang.org/x/oauth2) ([BSD-3-Clause](https://cs.opensource.google/go/x/oauth2/+/v0.36.0:LICENSE))
+ - [golang.org/x/sync](https://pkg.go.dev/golang.org/x/sync) ([BSD-3-Clause](https://cs.opensource.google/go/x/sync/+/v0.22.0:LICENSE))
+ - [golang.org/x/sys](https://pkg.go.dev/golang.org/x/sys) ([BSD-3-Clause](https://cs.opensource.google/go/x/sys/+/v0.47.0:LICENSE))
+ - [golang.org/x/term](https://pkg.go.dev/golang.org/x/term) ([BSD-3-Clause](https://cs.opensource.google/go/x/term/+/v0.45.0:LICENSE))
+ - [golang.org/x/text](https://pkg.go.dev/golang.org/x/text) ([BSD-3-Clause](https://cs.opensource.google/go/x/text/+/v0.40.0:LICENSE))
+ - [golang.org/x/time/rate](https://pkg.go.dev/golang.org/x/time/rate) ([BSD-3-Clause](https://cs.opensource.google/go/x/time/+/v0.15.0:LICENSE))
  - [golang.zx2c4.com/wintun](https://pkg.go.dev/golang.zx2c4.com/wintun) ([MIT](https://git.zx2c4.com/wintun-go/tree/LICENSE?id=0fa3db229ce2))
  - [golang.zx2c4.com/wireguard/windows/tunnel/winipcfg](https://pkg.go.dev/golang.zx2c4.com/wireguard/windows/tunnel/winipcfg) ([MIT](https://git.zx2c4.com/wireguard-windows/tree/COPYING?h=v0.5.3))
  - [gvisor.dev/gvisor/pkg](https://pkg.go.dev/gvisor.dev/gvisor/pkg) ([Apache-2.0](https://github.com/google/gvisor/blob/573d5e7127a8/LICENSE))
  - [k8s.io/client-go/util/homedir](https://pkg.go.dev/k8s.io/client-go/util/homedir) ([Apache-2.0](https://github.com/kubernetes/client-go/blob/v0.34.0/LICENSE))
  - [sigs.k8s.io/yaml](https://pkg.go.dev/sigs.k8s.io/yaml) ([Apache-2.0](https://github.com/kubernetes-sigs/yaml/blob/v1.6.0/LICENSE))
  - [tailscale.com](https://pkg.go.dev/tailscale.com) ([BSD-3-Clause](https://github.com/tailscale/tailscale/blob/HEAD/LICENSE))
- - [github.com/tailscale/gliderssh](https://pkg.go.dev/github.com/tailscale/gliderssh) ([BSD-3-Clause](https://github.com/tailscale/gliderssh/blob/HEAD/LICENSE))
  - [tailscale.com/tempfork/spf13/cobra](https://pkg.go.dev/tailscale.com/tempfork/spf13/cobra) ([Apache-2.0](https://github.com/tailscale/tailscale/blob/HEAD/tempfork/spf13/cobra/LICENSE.txt))
diff --git a/licenses/windows.md b/licenses/windows.md
index 6329655cc..70bdc5711 100644
--- a/licenses/windows.md
+++ b/licenses/windows.md
@@ -14,12 +14,12 @@ Windows][].  See also the dependencies in the [Tailscale CLI][].
  - [github.com/apenwarr/w32](https://pkg.go.dev/github.com/apenwarr/w32) ([BSD-3-Clause](https://github.com/apenwarr/w32/blob/aa00fece76ab/LICENSE))
  - [github.com/beorn7/perks/quantile](https://pkg.go.dev/github.com/beorn7/perks/quantile) ([MIT](https://github.com/beorn7/perks/blob/v1.0.1/LICENSE))
  - [github.com/cespare/xxhash/v2](https://pkg.go.dev/github.com/cespare/xxhash/v2) ([MIT](https://github.com/cespare/xxhash/blob/v2.3.0/LICENSE.txt))
- - [github.com/coder/websocket](https://pkg.go.dev/github.com/coder/websocket) ([ISC](https://github.com/coder/websocket/blob/v1.8.12/LICENSE.txt))
+ - [github.com/coder/websocket](https://pkg.go.dev/github.com/coder/websocket) ([ISC](https://github.com/coder/websocket/blob/v1.8.14/LICENSE.txt))
  - [github.com/creachadair/msync/trigger](https://pkg.go.dev/github.com/creachadair/msync/trigger) ([BSD-3-Clause](https://github.com/creachadair/msync/blob/v0.8.1/LICENSE))
  - [github.com/dblohm7/wingoes](https://pkg.go.dev/github.com/dblohm7/wingoes) ([BSD-3-Clause](https://github.com/dblohm7/wingoes/blob/b75a8a7d7eb0/LICENSE))
  - [github.com/djherbis/times](https://pkg.go.dev/github.com/djherbis/times) ([MIT](https://github.com/djherbis/times/blob/v1.6.0/LICENSE))
  - [github.com/fxamacker/cbor/v2](https://pkg.go.dev/github.com/fxamacker/cbor/v2) ([MIT](https://github.com/fxamacker/cbor/blob/v2.9.0/LICENSE))
- - [github.com/go-json-experiment/json](https://pkg.go.dev/github.com/go-json-experiment/json) ([BSD-3-Clause](https://github.com/go-json-experiment/json/blob/4849db3c2f7e/LICENSE))
+ - [github.com/go-json-experiment/json](https://pkg.go.dev/github.com/go-json-experiment/json) ([BSD-3-Clause](https://github.com/go-json-experiment/json/blob/d219187c3433/LICENSE))
  - [github.com/golang/groupcache/lru](https://pkg.go.dev/github.com/golang/groupcache/lru) ([Apache-2.0](https://github.com/golang/groupcache/blob/2c02b8208cf8/LICENSE))
  - [github.com/google/btree](https://pkg.go.dev/github.com/google/btree) ([Apache-2.0](https://github.com/google/btree/blob/v1.1.3/LICENSE))
  - [github.com/google/go-cmp/cmp](https://pkg.go.dev/github.com/google/go-cmp/cmp) ([BSD-3-Clause](https://github.com/google/go-cmp/blob/v0.7.0/LICENSE))
@@ -28,9 +28,9 @@ Windows][].  See also the dependencies in the [Tailscale CLI][].
  - [github.com/hdevalence/ed25519consensus](https://pkg.go.dev/github.com/hdevalence/ed25519consensus) ([BSD-3-Clause](https://github.com/hdevalence/ed25519consensus/blob/v0.2.0/LICENSE))
  - [github.com/jellydator/ttlcache/v3](https://pkg.go.dev/github.com/jellydator/ttlcache/v3) ([MIT](https://github.com/jellydator/ttlcache/blob/v3.1.0/LICENSE))
  - [github.com/jsimonetti/rtnetlink](https://pkg.go.dev/github.com/jsimonetti/rtnetlink) ([MIT](https://github.com/jsimonetti/rtnetlink/blob/v1.4.1/LICENSE.md))
- - [github.com/klauspost/compress](https://pkg.go.dev/github.com/klauspost/compress) ([Apache-2.0](https://github.com/klauspost/compress/blob/v1.18.4/LICENSE))
- - [github.com/klauspost/compress/internal/snapref](https://pkg.go.dev/github.com/klauspost/compress/internal/snapref) ([BSD-3-Clause](https://github.com/klauspost/compress/blob/v1.18.4/internal/snapref/LICENSE))
- - [github.com/klauspost/compress/zstd/internal/xxhash](https://pkg.go.dev/github.com/klauspost/compress/zstd/internal/xxhash) ([MIT](https://github.com/klauspost/compress/blob/v1.18.4/zstd/internal/xxhash/LICENSE.txt))
+ - [github.com/klauspost/compress](https://pkg.go.dev/github.com/klauspost/compress) ([Apache-2.0](https://github.com/klauspost/compress/blob/v1.18.5/LICENSE))
+ - [github.com/klauspost/compress/internal/snapref](https://pkg.go.dev/github.com/klauspost/compress/internal/snapref) ([BSD-3-Clause](https://github.com/klauspost/compress/blob/v1.18.5/internal/snapref/LICENSE))
+ - [github.com/klauspost/compress/zstd/internal/xxhash](https://pkg.go.dev/github.com/klauspost/compress/zstd/internal/xxhash) ([MIT](https://github.com/klauspost/compress/blob/v1.18.5/zstd/internal/xxhash/LICENSE.txt))
  - [github.com/mdlayher/netlink](https://pkg.go.dev/github.com/mdlayher/netlink) ([MIT](https://github.com/mdlayher/netlink/blob/fbb4dce95f42/LICENSE.md))
  - [github.com/mdlayher/socket](https://pkg.go.dev/github.com/mdlayher/socket) ([MIT](https://github.com/mdlayher/socket/blob/v0.5.0/LICENSE.md))
  - [github.com/mitchellh/go-ps](https://pkg.go.dev/github.com/mitchellh/go-ps) ([MIT](https://github.com/mitchellh/go-ps/blob/v1.0.0/LICENSE.md))
@@ -39,26 +39,25 @@ Windows][].  See also the dependencies in the [Tailscale CLI][].
  - [github.com/peterbourgon/diskv](https://pkg.go.dev/github.com/peterbourgon/diskv) ([MIT](https://github.com/peterbourgon/diskv/blob/v2.0.1/LICENSE))
  - [github.com/prometheus/client_golang/prometheus](https://pkg.go.dev/github.com/prometheus/client_golang/prometheus) ([Apache-2.0](https://github.com/prometheus/client_golang/blob/v1.23.2/LICENSE))
  - [github.com/prometheus/client_model/go](https://pkg.go.dev/github.com/prometheus/client_model/go) ([Apache-2.0](https://github.com/prometheus/client_model/blob/v0.6.2/LICENSE))
- - [github.com/prometheus/common](https://pkg.go.dev/github.com/prometheus/common) ([Apache-2.0](https://github.com/prometheus/common/blob/v0.67.5/LICENSE))
+ - [github.com/prometheus/common](https://pkg.go.dev/github.com/prometheus/common) ([Apache-2.0](https://github.com/prometheus/common/blob/v0.69.0/LICENSE))
  - [github.com/skip2/go-qrcode](https://pkg.go.dev/github.com/skip2/go-qrcode) ([MIT](https://github.com/skip2/go-qrcode/blob/da1b6568686e/LICENSE))
  - [github.com/tailscale/go-winio](https://pkg.go.dev/github.com/tailscale/go-winio) ([MIT](https://github.com/tailscale/go-winio/blob/c4f33415bf55/LICENSE))
- - [github.com/tailscale/hujson](https://pkg.go.dev/github.com/tailscale/hujson) ([BSD-3-Clause](https://github.com/tailscale/hujson/blob/992244df8c5a/LICENSE))
- - [github.com/tailscale/walk](https://pkg.go.dev/github.com/tailscale/walk) ([BSD-3-Clause](https://github.com/tailscale/walk/blob/963e260a8227/LICENSE))
- - [github.com/tailscale/win](https://pkg.go.dev/github.com/tailscale/win) ([BSD-3-Clause](https://github.com/tailscale/win/blob/f4da2b8ee071/LICENSE))
+ - [github.com/tailscale/hujson](https://pkg.go.dev/github.com/tailscale/hujson) ([BSD-3-Clause](https://github.com/tailscale/hujson/blob/ecc657c15afd/LICENSE))
+ - [github.com/tailscale/walk](https://pkg.go.dev/github.com/tailscale/walk) ([BSD-3-Clause](https://github.com/tailscale/walk/blob/28b80ea70d3b/LICENSE))
+ - [github.com/tailscale/win](https://pkg.go.dev/github.com/tailscale/win) ([BSD-3-Clause](https://github.com/tailscale/win/blob/2d76c33a64c1/LICENSE))
  - [github.com/tailscale/xnet/webdav](https://pkg.go.dev/github.com/tailscale/xnet/webdav) ([BSD-3-Clause](https://github.com/tailscale/xnet/blob/8497ac4dab2e/LICENSE))
  - [github.com/tc-hib/winres](https://pkg.go.dev/github.com/tc-hib/winres) ([0BSD](https://github.com/tc-hib/winres/blob/v0.2.1/LICENSE))
  - [github.com/x448/float16](https://pkg.go.dev/github.com/x448/float16) ([MIT](https://github.com/x448/float16/blob/v0.8.4/LICENSE))
- - [go.yaml.in/yaml/v2](https://pkg.go.dev/go.yaml.in/yaml/v2) ([Apache-2.0](https://github.com/yaml/go-yaml/blob/v2.4.3/LICENSE))
  - [go4.org/mem](https://pkg.go.dev/go4.org/mem) ([Apache-2.0](https://github.com/go4org/mem/blob/ae6ca9944745/LICENSE))
  - [go4.org/netipx](https://pkg.go.dev/go4.org/netipx) ([BSD-3-Clause](https://github.com/go4org/netipx/blob/fdeea329fbba/LICENSE))
- - [golang.org/x/crypto](https://pkg.go.dev/golang.org/x/crypto) ([BSD-3-Clause](https://cs.opensource.google/go/x/crypto/+/v0.49.0:LICENSE))
- - [golang.org/x/exp](https://pkg.go.dev/golang.org/x/exp) ([BSD-3-Clause](https://cs.opensource.google/go/x/exp/+/a4bb9ffd:LICENSE))
- - [golang.org/x/image/bmp](https://pkg.go.dev/golang.org/x/image/bmp) ([BSD-3-Clause](https://cs.opensource.google/go/x/image/+/v0.27.0:LICENSE))
- - [golang.org/x/mod](https://pkg.go.dev/golang.org/x/mod) ([BSD-3-Clause](https://cs.opensource.google/go/x/mod/+/v0.33.0:LICENSE))
- - [golang.org/x/net](https://pkg.go.dev/golang.org/x/net) ([BSD-3-Clause](https://cs.opensource.google/go/x/net/+/v0.52.0:LICENSE))
+ - [golang.org/x/crypto](https://pkg.go.dev/golang.org/x/crypto) ([BSD-3-Clause](https://cs.opensource.google/go/x/crypto/+/v0.52.0:LICENSE))
+ - [golang.org/x/exp](https://pkg.go.dev/golang.org/x/exp) ([BSD-3-Clause](https://cs.opensource.google/go/x/exp/+/746e56fc:LICENSE))
+ - [golang.org/x/image/bmp](https://pkg.go.dev/golang.org/x/image/bmp) ([BSD-3-Clause](https://cs.opensource.google/go/x/image/+/v0.41.0:LICENSE))
+ - [golang.org/x/mod](https://pkg.go.dev/golang.org/x/mod) ([BSD-3-Clause](https://cs.opensource.google/go/x/mod/+/v0.37.0:LICENSE))
+ - [golang.org/x/net](https://pkg.go.dev/golang.org/x/net) ([BSD-3-Clause](https://cs.opensource.google/go/x/net/+/v0.55.0:LICENSE))
  - [golang.org/x/sync](https://pkg.go.dev/golang.org/x/sync) ([BSD-3-Clause](https://cs.opensource.google/go/x/sync/+/v0.20.0:LICENSE))
- - [golang.org/x/sys](https://pkg.go.dev/golang.org/x/sys) ([BSD-3-Clause](https://cs.opensource.google/go/x/sys/+/v0.42.0:LICENSE))
- - [golang.org/x/term](https://pkg.go.dev/golang.org/x/term) ([BSD-3-Clause](https://cs.opensource.google/go/x/term/+/v0.41.0:LICENSE))
+ - [golang.org/x/sys](https://pkg.go.dev/golang.org/x/sys) ([BSD-3-Clause](https://cs.opensource.google/go/x/sys/+/v0.45.0:LICENSE))
+ - [golang.org/x/term](https://pkg.go.dev/golang.org/x/term) ([BSD-3-Clause](https://cs.opensource.google/go/x/term/+/v0.43.0:LICENSE))
  - [golang.zx2c4.com/wintun](https://pkg.go.dev/golang.zx2c4.com/wintun) ([MIT](https://git.zx2c4.com/wintun-go/tree/LICENSE?id=0fa3db229ce2))
  - [golang.zx2c4.com/wireguard/windows/tunnel/winipcfg](https://pkg.go.dev/golang.zx2c4.com/wireguard/windows/tunnel/winipcfg) ([MIT](https://git.zx2c4.com/wireguard-windows/tree/COPYING?h=v0.5.3))
  - [google.golang.org/protobuf](https://pkg.go.dev/google.golang.org/protobuf) ([BSD-3-Clause](https://github.com/protocolbuffers/protobuf-go/blob/v1.36.11/LICENSE))
diff --git a/log/filelogger/log.go b/log/filelogger/log.go
index 268cf1bba..a9ce48555 100644
--- a/log/filelogger/log.go
+++ b/log/filelogger/log.go
@@ -16,6 +16,7 @@ import (
 	"sync"
 	"time"
 
+	"tailscale.com/tstime"
 	"tailscale.com/types/logger"
 )
 
@@ -106,13 +107,8 @@ func (w *logFileWriter) appendToFileLocked(out []byte) {
 	}
 	out = removeDatePrefix(out)
 	if w.f != nil {
-		// RFC3339Nano but with a fixed number (3) of nanosecond digits:
-		const formatPre = "2006-01-02T15:04:05"
-		const formatPost = "Z07:00"
-		fmt.Fprintf(w.f, "%s.%03d%s: %s",
-			now.Format(formatPre),
-			now.Nanosecond()/int(time.Millisecond/time.Nanosecond),
-			now.Format(formatPost),
+		fmt.Fprintf(w.f, "%s: %s",
+			now.Format(tstime.DateTTimeMilliZ),
 			out)
 	}
 }
diff --git a/logpolicy/logpolicy.go b/logpolicy/logpolicy.go
index 7a0027dad..78b3ccc13 100644
--- a/logpolicy/logpolicy.go
+++ b/logpolicy/logpolicy.go
@@ -43,6 +43,7 @@ import (
 	"tailscale.com/net/netknob"
 	"tailscale.com/net/netmon"
 	"tailscale.com/net/netns"
+	"tailscale.com/net/netutil"
 	"tailscale.com/net/netx"
 	"tailscale.com/net/tlsdial"
 	"tailscale.com/paths"
@@ -53,13 +54,15 @@ import (
 	"tailscale.com/util/eventbus"
 	"tailscale.com/util/must"
 	"tailscale.com/util/racebuild"
-	"tailscale.com/util/syspolicy/pkey"
-	"tailscale.com/util/syspolicy/policyclient"
 	"tailscale.com/util/testenv"
 	"tailscale.com/version"
 	"tailscale.com/version/distro"
 )
 
+// GetLogTarget is an optional hook to register a function
+// that returns the log target URL to be used by logpolicy.
+var GetLogTarget feature.Hook[func() string]
+
 var getLogTargetOnce struct {
 	sync.Once
 	v string // URL of logs server, or empty for default
@@ -67,8 +70,12 @@ var getLogTargetOnce struct {
 
 func getLogTarget() string {
 	getLogTargetOnce.Do(func() {
-		envTarget, _ := os.LookupEnv("TS_LOG_TARGET")
-		getLogTargetOnce.v, _ = policyclient.Get().GetString(pkey.LogTarget, envTarget)
+		if f, ok := GetLogTarget.GetOk(); ok {
+			getLogTargetOnce.v = f()
+		}
+		if getLogTargetOnce.v == "" {
+			getLogTargetOnce.v, _ = os.LookupEnv("TS_LOG_TARGET")
+		}
 	})
 
 	return getLogTargetOnce.v
@@ -539,7 +546,18 @@ func (opts Options) init(disableLogging bool) (*logtail.Config, *Policy) {
 		// anyway, no need to add one.
 		lflags = 0
 	}
-	console := log.New(stderrWriter{}, "", lflags)
+	var conWriter io.Writer = stderrWriter{}
+	if buildfeatures.HasSyslog {
+		if f, ok := feature.HookLogSink.GetOk(); ok {
+			if w := f(); w != nil {
+				// Logs are being redirected elsewhere (e.g. to syslog,
+				// which records its own timestamps).
+				conWriter = w
+				lflags = 0
+			}
+		}
+	}
+	console := log.New(conWriter, "", lflags)
 
 	var earlyErrBuf bytes.Buffer
 	earlyLogf := func(format string, a ...any) {
@@ -878,7 +896,7 @@ func (opts TransportOptions) New() http.RoundTripper {
 		opts.NetMon = netmon.NewStatic()
 	}
 	// Start with a copy of http.DefaultTransport and tweak it a bit.
-	tr := http.DefaultTransport.(*http.Transport).Clone()
+	tr := netutil.NewDefaultTransport()
 	if opts.TLSClientConfig != nil {
 		tr.TLSClientConfig = opts.TLSClientConfig.Clone()
 	}
diff --git a/logpolicy/maybe_syspolicy.go b/logpolicy/maybe_syspolicy.go
deleted file mode 100644
index 7cdaabcc7..000000000
--- a/logpolicy/maybe_syspolicy.go
+++ /dev/null
@@ -1,8 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-//go:build !ts_omit_syspolicy
-
-package logpolicy
-
-import _ "tailscale.com/feature/syspolicy"
diff --git a/logtail/config.go b/logtail/config.go
index c504047a3..0ee599905 100644
--- a/logtail/config.go
+++ b/logtail/config.go
@@ -64,4 +64,12 @@ type Config struct {
 	// being included in the logs. The sequence number is incremented for each
 	// log message sent, but is not persisted across process restarts.
 	IncludeProcSequence bool
+
+	// Disabled, if true, causes the returned [Logger] to start in the
+	// disabled state, dropping entries without buffering or uploading
+	// (equivalent to calling [Logger.SetEnabled] with false immediately).
+	// It applies before the internal startup banner is written, so no
+	// log entries are emitted until [Logger.SetEnabled] is called with
+	// true. The process-wide [Disable] kill switch still takes precedence.
+	Disabled bool
 }
diff --git a/logtail/logtail.go b/logtail/logtail.go
index ed3872e79..03bb0f7d7 100644
--- a/logtail/logtail.go
+++ b/logtail/logtail.go
@@ -15,6 +15,7 @@ import (
 	"expvar"
 	"fmt"
 	"io"
+	"iter"
 	"log"
 	mrand "math/rand/v2"
 	"net/http"
@@ -27,6 +28,7 @@ import (
 	"time"
 
 	"github.com/creachadair/msync/trigger"
+	jsonv2 "github.com/go-json-experiment/json"
 	"github.com/go-json-experiment/json/jsontext"
 	"tailscale.com/envknob"
 	"tailscale.com/metrics"
@@ -57,7 +59,10 @@ const lowMemRatio = 4
 // but not too large to be a notable waste of memory if retained forever.
 const bufferSize = 4 << 10
 
-func NewLogger(cfg Config, logf tslogger.Logf) *Logger {
+// newLogger constructs a *Logger from cfg, applying defaults, but does not start
+// the background uploading goroutine. It is shared by [NewLogger] and the
+// stateless [UploadLogs].
+func newLogger(cfg Config) *Logger {
 	if cfg.BaseURL == "" {
 		cfg.BaseURL = "https://" + DefaultHost
 	}
@@ -132,15 +137,166 @@ func NewLogger(cfg Config, logf tslogger.Logf) *Logger {
 	}
 	logger.SetSockstatsLabel(sockstats.LabelLogtailLogger)
 	logger.compressLogs = cfg.CompressLogs
+	logger.disabled.Store(cfg.Disabled)
+
+	return logger
+}
+
+// NewLogger returns a new Logger that splits logs as configured between local
+// logging facilities and uploading to a log server in the background.
+func NewLogger(cfg Config, logf tslogger.Logf) *Logger {
+	logger := newLogger(cfg)
 
 	ctx, cancel := context.WithCancel(context.Background())
 	logger.uploadCancel = cancel
 
 	go logger.uploading(ctx)
-	logger.Write([]byte("logtail started"))
+	if envknob.Bool("TS_DEBUG_LOGTAIL") {
+		logger.Write([]byte("logtail started"))
+	}
 	return logger
 }
 
+// Logtail is the reserved "logtail" metadata member of a [LogEntry].
+//
+// Zero-valued fields are omitted when an entry is uploaded. [UploadLogs] fills
+// in any fields the caller leaves zero from its [Config] (e.g. ClientTime and
+// ProcID), so most callers can leave this empty.
+type Logtail struct {
+	// ClientTime is the time the entry was generated. If zero, [UploadLogs]
+	// fills it with the current time unless Config.SkipClientTime is set.
+	ClientTime time.Time `json:"client_time,omitzero"`
+	// ProcID is an ephemeral process identifier; see Config.IncludeProcID.
+	ProcID uint32 `json:"proc_id,omitzero"`
+	// ProcSeq is an ephemeral per-process sequence number; see
+	// Config.IncludeProcSequence.
+	ProcSeq uint64 `json:"proc_seq,omitzero"`
+}
+
+// LogEntry is a single log entry to be uploaded via [UploadLogs].
+//
+// It marshals to a JSON object whose reserved "logtail" member carries the
+// metadata in Logtail and whose remaining members are taken from Value, which
+// is inlined at the top level alongside "logtail".
+//
+// Value must marshal to a JSON object: T must be a Go struct (or pointer to
+// one), a Go map with a string key, or a [jsontext.Value] holding an object
+// (for example jsontext.Value(`{"text":"hello"}`)). This is enforced when the
+// entry is uploaded, not at compile time. Use T = [jsontext.Value] to mix
+// differently-shaped payloads in a single upload.
+type LogEntry[T any] struct {
+	Logtail Logtail `json:"logtail,omitzero"`
+	// The `inline` tag option was renamed to `embed` in Go 1.27's
+	// encoding/json/v2, but the pinned go-json-experiment module
+	// (used on older Go versions) only knows `inline`. Each
+	// implementation ignores the option it doesn't know, so specify
+	// both until we require Go 1.27 and drop `inline`.
+	//
+	//lint:ignore SA5008 staticcheck doesn't know Go 1.27's `embed` option yet
+	Value T `json:",inline,embed"`
+}
+
+// UploadLogs uploads entries to the log server described by conf and returns
+// once they have all been sent (or an upload fails). It returns the number of
+// entries that were successfully uploaded.
+//
+// It is a stateless alternative to [NewLogger] for callers that just want to
+// push a batch of log entries without the background uploader, ring buffer,
+// stderr echoing, or network-up gating that a [Logger] provides. Each entry is
+// marshaled to JSON, its [Logtail] metadata is filled in from conf where the
+// caller left it zero (honoring conf.SkipClientTime, conf.IncludeProcID, and
+// conf.IncludeProcSequence), and entries are batched up to the server's maximum
+// upload size and POSTed synchronously (compressed when conf.CompressLogs is
+// set).
+//
+// Unlike [Logger], UploadLogs does not retry: if a batch fails to upload it
+// returns the count of entries sent in prior batches and the error immediately,
+// and any remaining entries are not sent. The conf.Stderr and conf.Bus fields
+// are ignored.
+func UploadLogs[T any](ctx context.Context, conf Config, entries iter.Seq[LogEntry[T]]) (int, error) {
+	conf.Stderr = io.Discard // pure uploader: never echo to stderr
+	conf.Bus = nil           // no netmon/eventbus subscription for a one-shot
+	lg := newLogger(conf)
+
+	maxLen := cmp.Or(lg.maxUploadSize, maxSize)
+	if lg.lowMem {
+		maxLen /= lowMemRatio
+	}
+
+	// body accumulates a JSON array of encoded entries: "[e1,e2,...]".
+	// The framing mirrors Logger.drainPending.
+	body := make([]byte, 0, bufferSize) // reused across batches
+	body = append(body, '[')
+
+	// sent counts entries confirmed uploaded; pending counts entries
+	// accumulated in body but not yet uploaded. A successful sendBatch moves
+	// pending into sent.
+	var sent, pending int
+	sendBatch := func() error {
+		if len(body) <= len("[") {
+			return nil
+		}
+		out := bytes.TrimRight(body, ",")
+		out = append(out, ']')
+		origlen := -1 // sentinel value: uncompressed
+		// Don't attempt to compress tiny bodies; not worth the CPU cycles.
+		if lg.compressLogs && len(out) > 256 {
+			zbody := zstdframe.AppendEncode(nil, out,
+				zstdframe.FastestCompression, zstdframe.LowMemory(true))
+			// Only send it compressed if the bandwidth savings are sufficient.
+			if len(out)-len(zbody) > 64 {
+				origlen = len(out)
+				out = zbody
+			}
+		}
+		// upload is synchronous, so it is safe to reuse body's backing array
+		// for the next batch once upload returns.
+		if _, err := lg.upload(ctx, out, origlen); err != nil {
+			return err
+		}
+		body = body[:len("[")]
+		sent += pending
+		pending = 0
+		return nil
+	}
+
+	var procSeq uint64
+	for e := range entries {
+		if err := ctx.Err(); err != nil {
+			return sent, err
+		}
+
+		// Fill in metadata from conf, preserving any caller-set values.
+		if e.Logtail.ClientTime.IsZero() && !lg.skipClientTime {
+			e.Logtail.ClientTime = lg.clock.Now().UTC()
+		}
+		if e.Logtail.ProcID == 0 {
+			e.Logtail.ProcID = lg.procID
+		}
+		procSeq++
+		if lg.includeProcSequence {
+			e.Logtail.ProcSeq = procSeq
+		}
+
+		enc, err := jsonv2.Marshal(e)
+		if err != nil {
+			return sent, fmt.Errorf("logtail: encoding entry %d: %w", procSeq, err)
+		}
+
+		// Flush the current batch before adding an entry that would overflow it.
+		if len(body) > len("[") && len(body)+len(enc) > maxLen {
+			if err := sendBatch(); err != nil {
+				return sent, err
+			}
+		}
+		body = append(body, enc...)
+		body = append(body, ',')
+		pending++
+	}
+	err := sendBatch()
+	return sent, err
+}
+
 // Logger writes logs, splitting them as configured between local
 // logging facilities and uploading to a log server.
 type Logger struct {
@@ -172,6 +328,11 @@ type Logger struct {
 	procID              uint32
 	includeProcSequence bool
 
+	// disabled, when true, causes this logger to drop incoming log entries
+	// without buffering or uploading. It is independent of the process-wide
+	// Disable kill switch, which takes precedence. Toggled by SetEnabled.
+	disabled atomic.Bool
+
 	writeLock    sync.Mutex // guards procSequence, flushTimer, buffer.Write calls
 	procSequence uint64
 	flushTimer   tstime.TimerController // used when flushDelay is >0
@@ -411,7 +572,7 @@ func (lg *Logger) uploading(ctx context.Context) {
 				if retryAfter <= 0 {
 					retryAfter = mrand.N(30*time.Second) + 30*time.Second
 				}
-				tstime.Sleep(ctx, retryAfter)
+				tstime.Sleep(ctx, min(retryAfter, 5*time.Minute)) // ignore absurdly large retryAfter values
 			} else {
 				// Only print a success message after recovery.
 				if numFailures > 0 {
@@ -594,6 +755,15 @@ func Disable() {
 	logtailDisabled.Store(true)
 }
 
+// SetEnabled enables or disables log uploading by lg. When disabled, log
+// entries passed to lg are dropped rather than buffered or uploaded; already
+// buffered entries may still drain. The process-wide [Disable] kill switch
+// takes precedence: if Disable has been called, SetEnabled(true) does not
+// re-enable uploads.
+func (lg *Logger) SetEnabled(enabled bool) {
+	lg.disabled.Store(!enabled)
+}
+
 var debugWakesAndUploads = envknob.RegisterBool("TS_DEBUG_LOGTAIL_WAKES")
 
 // tryDrainWake tries to send to lg.drainWake, to cause an uploading wakeup.
@@ -613,7 +783,7 @@ func (lg *Logger) tryDrainWake() {
 
 func (lg *Logger) sendLocked(jsonBlob []byte) (int, error) {
 	tapSend(jsonBlob)
-	if logtailDisabled.Load() {
+	if logtailDisabled.Load() || lg.disabled.Load() {
 		return len(jsonBlob), nil
 	}
 
@@ -810,7 +980,7 @@ func (lg *Logger) appendTextOrJSONLocked(dst, src []byte, level int) []byte {
 	}
 
 	// Check whether the reserved logtail member occurs in the log data.
-	// If so, it is moved to the the logtail/error member.
+	// If so, it is moved to the logtail/error member.
 	const jsonSeperators = ",:"      // per RFC 8259, section 2
 	const jsonWhitespace = " \n\r\t" // per RFC 8259, section 2
 	var errDetail string
diff --git a/logtail/logtail_omit.go b/logtail/logtail_omit.go
index 21f18c980..6a5957430 100644
--- a/logtail/logtail_omit.go
+++ b/logtail/logtail_omit.go
@@ -7,6 +7,8 @@ package logtail
 
 import (
 	"context"
+	"iter"
+	"time"
 
 	tslogger "tailscale.com/types/logger"
 	"tailscale.com/types/logid"
@@ -18,8 +20,25 @@ type Logger struct{}
 
 type Buffer any
 
+type Logtail struct {
+	ClientTime time.Time `json:"client_time,omitzero"`
+	ProcID     uint32    `json:"proc_id,omitzero"`
+	ProcSeq    uint64    `json:"proc_seq,omitzero"`
+}
+
+type LogEntry[T any] struct {
+	Logtail Logtail `json:"logtail,omitzero"`
+	Value   T       `json:",inline,embed"` // both options; see the non-omit variant in logtail.go
+}
+
+func UploadLogs[T any](ctx context.Context, conf Config, entries iter.Seq[LogEntry[T]]) error {
+	return nil
+}
+
 func Disable() {}
 
+func (*Logger) SetEnabled(enabled bool) {}
+
 func NewLogger(cfg Config, logf tslogger.Logf) *Logger {
 	return &Logger{}
 }
diff --git a/logtail/logtail_test.go b/logtail/logtail_test.go
index 19e1eeb7a..2fe11af48 100644
--- a/logtail/logtail_test.go
+++ b/logtail/logtail_test.go
@@ -7,34 +7,53 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"fmt"
 	"io"
+	"net"
 	"net/http"
-	"net/http/httptest"
+	"os"
+	"slices"
 	"strings"
+	"sync"
 	"testing"
+	"testing/synctest"
 	"time"
 
 	"github.com/go-json-experiment/json/jsontext"
+	"tailscale.com/envknob"
+	"tailscale.com/net/memnet"
 	"tailscale.com/tstest"
 	"tailscale.com/tstime"
 	"tailscale.com/util/eventbus/eventbustest"
 	"tailscale.com/util/must"
 )
 
-func TestFastShutdown(t *testing.T) {
+// TestMain installs a safety net that refuses non-localhost dials for any
+// test in this package. Config.BaseURL defaults to https://log.tailscale.com
+// and Config.HTTPC defaults to http.DefaultClient, so a test that forgets to
+// override either can otherwise silently hit the real logtail server.
+// Tests that need an HTTP server should use memnet (see newTestLogtailServer).
+func TestMain(m *testing.M) {
+	tr := http.DefaultTransport.(*http.Transport)
+	orig := tr.DialContext
+	tr.DialContext = func(ctx context.Context, network, addr string) (net.Conn, error) {
+		host, _, err := net.SplitHostPort(addr)
+		if err == nil && (host == "127.0.0.1" || host == "::1" || host == "localhost") {
+			return orig(ctx, network, addr)
+		}
+		return nil, fmt.Errorf("logtail tests: refusing to dial non-localhost address %q; use memnet or a custom Config.HTTPC", addr)
+	}
+	os.Exit(m.Run())
+}
+
+func TestFastShutdown(t *testing.T) { synctest.Test(t, synctestFastShutdown) }
+
+func synctestFastShutdown(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	cancel()
 
-	testServ := httptest.NewServer(http.HandlerFunc(
-		func(w http.ResponseWriter, r *http.Request) {}))
-	defer testServ.Close()
-
-	logger := NewLogger(Config{
-		BaseURL: testServ.URL,
-		Bus:     eventbustest.NewBus(t),
-	}, t.Logf)
-	err := logger.Shutdown(ctx)
-	if err != nil {
+	_, logger := newTestLogtailServer(t)
+	if err := logger.Shutdown(ctx); err != nil {
 		t.Error(err)
 	}
 }
@@ -43,49 +62,40 @@ func TestFastShutdown(t *testing.T) {
 const logLines = 3
 
 type LogtailTestServer struct {
-	srv      *httptest.Server // Log server
 	uploaded chan []byte
 }
 
-func NewLogtailTestHarness(t *testing.T) (*LogtailTestServer, *Logger) {
-	ts := LogtailTestServer{}
+// newTestLogtailServer wires up an in-memory HTTP server (via memnet) and a
+// *Logger whose HTTPC dials it. Lives inside the caller's synctest bubble so
+// the default FlushDelay and any other fake timers advance automatically.
+func newTestLogtailServer(t *testing.T) (*LogtailTestServer, *Logger) {
+	// Enable the logtail started message
+	envknob.Setenv("TS_DEBUG_LOGTAIL", "1")
 
-	// max channel backlog = 1 "started" + #logLines x "log line" + 1 "closed"
-	ts.uploaded = make(chan []byte, 2+logLines)
+	conf, uploaded := newCaptureServer(t, 0)
+	conf.Bus = eventbustest.NewBus(t)
+	ts := &LogtailTestServer{uploaded: uploaded}
 
-	ts.srv = httptest.NewServer(http.HandlerFunc(
-		func(w http.ResponseWriter, r *http.Request) {
-			body, err := io.ReadAll(r.Body)
-			if err != nil {
-				t.Error("failed to read HTTP request")
-			}
-			ts.uploaded <- body
-		}))
+	logger := NewLogger(conf, t.Logf)
 
-	t.Cleanup(ts.srv.Close)
-
-	logger := NewLogger(Config{
-		BaseURL: ts.srv.URL,
-		Bus:     eventbustest.NewBus(t),
-	}, t.Logf)
-
-	// There is always an initial "logtail started" message
+	// There is always an initial "logtail started" message.
 	body := <-ts.uploaded
 	if !strings.Contains(string(body), "started") {
 		t.Errorf("unknown start logging statement: %q", string(body))
 	}
-
-	return &ts, logger
+	return ts, logger
 }
 
-func TestDrainPendingMessages(t *testing.T) {
-	ts, logger := NewLogtailTestHarness(t)
+func TestDrainPendingMessages(t *testing.T) { synctest.Test(t, synctestDrainPendingMessages) }
+
+func synctestDrainPendingMessages(t *testing.T) {
+	ts, logger := newTestLogtailServer(t)
 
 	for range logLines {
 		logger.Write([]byte("log line"))
 	}
 
-	// all of the "log line" messages usually arrive at once, but poll if needed.
+	// All the "log line" messages usually arrive at once, but poll if needed.
 	var body strings.Builder
 	for i := 0; i <= logLines; i++ {
 		body.WriteString(string(<-ts.uploaded))
@@ -93,17 +103,17 @@ func TestDrainPendingMessages(t *testing.T) {
 		if count == logLines {
 			break
 		}
-		// if we never find count == logLines, the test will eventually time out.
 	}
 
-	err := logger.Shutdown(context.Background())
-	if err != nil {
+	if err := logger.Shutdown(context.Background()); err != nil {
 		t.Error(err)
 	}
 }
 
-func TestEncodeAndUploadMessages(t *testing.T) {
-	ts, logger := NewLogtailTestHarness(t)
+func TestEncodeAndUploadMessages(t *testing.T) { synctest.Test(t, synctestEncodeAndUploadMessages) }
+
+func synctestEncodeAndUploadMessages(t *testing.T) {
+	ts, logger := newTestLogtailServer(t)
 
 	tests := []struct {
 		name string
@@ -144,8 +154,7 @@ func TestEncodeAndUploadMessages(t *testing.T) {
 		}
 	}
 
-	err := logger.Shutdown(context.Background())
-	if err != nil {
+	if err := logger.Shutdown(context.Background()); err != nil {
 		t.Error(err)
 	}
 }
@@ -234,6 +243,258 @@ func unmarshalOne(t *testing.T, body []byte) map[string]any {
 	return entries[0]
 }
 
+// newCaptureServer wires up an in-memory HTTP server (via memnet) that sends
+// each uploaded request body to the returned channel and responds with
+// respStatus (0 means 200 OK), returning a Config whose HTTPC dials it.
+func newCaptureServer(t *testing.T, respStatus int) (Config, chan []byte) {
+	t.Helper()
+	// max channel backlog = 1 "started" + #logLines x "log line" + 1 "closed"
+	uploaded := make(chan []byte, 2+logLines)
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		body, err := io.ReadAll(r.Body)
+		if err != nil {
+			t.Errorf("failed to read HTTP request: %v", err)
+		}
+		uploaded <- body
+		if respStatus != 0 {
+			w.WriteHeader(respStatus)
+		}
+	})
+
+	ln := memnet.Listen("logtail-test:0")
+	httpsrv := &http.Server{Handler: handler}
+	go httpsrv.Serve(ln)
+	t.Cleanup(func() {
+		httpsrv.Close()
+		ln.Close()
+	})
+
+	conf := Config{
+		BaseURL: "http://" + ln.Addr().String(),
+		HTTPC:   &http.Client{Transport: &http.Transport{DialContext: ln.Dial}},
+	}
+	return conf, uploaded
+}
+
+func TestUploadLogs(t *testing.T) {
+	t.Run("InlinesValueAlongsideLogtail", func(t *testing.T) {
+		conf, got := newCaptureServer(t, 0)
+		entries := []LogEntry[jsontext.Value]{
+			{Value: jsontext.Value(`{"text":"first line"}`)},
+			{Value: jsontext.Value(`{"text":"second line","extra":42}`)},
+		}
+		if n, err := UploadLogs(context.Background(), conf, slices.Values(entries)); err != nil {
+			t.Fatal(err)
+		} else if n != len(entries) {
+			t.Errorf("uploaded %d entries, want %d", n, len(entries))
+		}
+
+		var all []map[string]any
+		body := <-got
+		if err := json.Unmarshal(body, &all); err != nil {
+			t.Fatalf("unmarshal %q: %v", body, err)
+		}
+		if len(all) != 2 {
+			t.Fatalf("got %d entries, want 2", len(all))
+		}
+		if got, want := all[0]["text"], "first line"; got != want {
+			t.Errorf("entry 0 text = %v; want %q", got, want)
+		}
+		if got, want := all[1]["text"], "second line"; got != want {
+			t.Errorf("entry 1 text = %v; want %q", got, want)
+		}
+		if got, want := all[1]["extra"], float64(42); got != want {
+			t.Errorf("entry 1 extra = %v; want %v", got, want)
+		}
+		for i, e := range all {
+			lt, ok := e["logtail"].(map[string]any)
+			if !ok {
+				t.Errorf("entry %d missing logtail metadata", i)
+				continue
+			}
+			if _, ok := lt["client_time"]; !ok {
+				t.Errorf("entry %d missing client_time", i)
+			}
+		}
+	})
+
+	t.Run("TypedStructPayload", func(t *testing.T) {
+		conf, got := newCaptureServer(t, 0)
+		type record struct {
+			Text  string `json:"text"`
+			Count int    `json:"count"`
+		}
+		entries := []LogEntry[record]{
+			{Value: record{Text: "hi", Count: 3}},
+		}
+		if n, err := UploadLogs(context.Background(), conf, slices.Values(entries)); err != nil {
+			t.Fatal(err)
+		} else if n != len(entries) {
+			t.Errorf("uploaded %d entries, want %d", n, len(entries))
+		}
+		e := unmarshalOne(t, <-got)
+		if got, want := e["text"], "hi"; got != want {
+			t.Errorf("text = %v; want %q", got, want)
+		}
+		if got, want := e["count"], float64(3); got != want {
+			t.Errorf("count = %v; want %v", got, want)
+		}
+		if _, ok := e["logtail"].(map[string]any); !ok {
+			t.Errorf("missing logtail metadata")
+		}
+	})
+
+	t.Run("MapPayload", func(t *testing.T) {
+		conf, got := newCaptureServer(t, 0)
+		entries := []LogEntry[map[string]any]{
+			{Value: map[string]any{"text": "m", "n": 5}},
+		}
+		if n, err := UploadLogs(context.Background(), conf, slices.Values(entries)); err != nil {
+			t.Fatal(err)
+		} else if n != len(entries) {
+			t.Errorf("uploaded %d entries, want %d", n, len(entries))
+		}
+		e := unmarshalOne(t, <-got)
+		if got, want := e["text"], "m"; got != want {
+			t.Errorf("text = %v; want %q", got, want)
+		}
+		if got, want := e["n"], float64(5); got != want {
+			t.Errorf("n = %v; want %v", got, want)
+		}
+	})
+
+	t.Run("MapWithNamedStringKey", func(t *testing.T) {
+		type label string // ~string key
+		conf, got := newCaptureServer(t, 0)
+		entries := []LogEntry[map[label]int]{
+			{Value: map[label]int{"a": 1, "b": 2}},
+		}
+		if n, err := UploadLogs(context.Background(), conf, slices.Values(entries)); err != nil {
+			t.Fatal(err)
+		} else if n != len(entries) {
+			t.Errorf("uploaded %d entries, want %d", n, len(entries))
+		}
+		e := unmarshalOne(t, <-got)
+		if got, want := e["a"], float64(1); got != want {
+			t.Errorf("a = %v; want %v", got, want)
+		}
+		if got, want := e["b"], float64(2); got != want {
+			t.Errorf("b = %v; want %v", got, want)
+		}
+	})
+
+	t.Run("PointerToStructPayload", func(t *testing.T) {
+		type record struct {
+			Text string `json:"text"`
+		}
+		conf, got := newCaptureServer(t, 0)
+		entries := []LogEntry[*record]{
+			{Value: &record{Text: "ptr"}},
+		}
+		if n, err := UploadLogs(context.Background(), conf, slices.Values(entries)); err != nil {
+			t.Fatal(err)
+		} else if n != len(entries) {
+			t.Errorf("uploaded %d entries, want %d", n, len(entries))
+		}
+		e := unmarshalOne(t, <-got)
+		if got, want := e["text"], "ptr"; got != want {
+			t.Errorf("text = %v; want %q", got, want)
+		}
+	})
+
+	t.Run("NilPointerPayloadOmitsInlinedValue", func(t *testing.T) {
+		type record struct {
+			Text string `json:"text"`
+		}
+		conf, got := newCaptureServer(t, 0)
+		entries := []LogEntry[*record]{
+			{Value: nil},
+		}
+		if n, err := UploadLogs(context.Background(), conf, slices.Values(entries)); err != nil {
+			t.Fatal(err)
+		} else if n != len(entries) {
+			t.Errorf("uploaded %d entries, want %d", n, len(entries))
+		}
+		e := unmarshalOne(t, <-got)
+		if _, ok := e["text"]; ok {
+			t.Errorf("expected no inlined members for nil pointer payload, got %v", e)
+		}
+		if _, ok := e["logtail"].(map[string]any); !ok {
+			t.Errorf("missing logtail metadata")
+		}
+	})
+
+	t.Run("RejectsNon-objectPayload", func(t *testing.T) {
+		conf, _ := newCaptureServer(t, 0)
+		entries := []LogEntry[int]{{Value: 5}}
+		if n, err := UploadLogs(context.Background(), conf, slices.Values(entries)); err == nil {
+			t.Fatal("expected an error marshaling a non-object inline payload")
+		} else if n != 0 {
+			t.Errorf("uploaded %d entries, want 0", n)
+		}
+	})
+
+	t.Run("PreservesCaller-setLogtailFields", func(t *testing.T) {
+		conf, got := newCaptureServer(t, 0)
+		entries := []LogEntry[jsontext.Value]{
+			{Logtail: Logtail{ProcID: 1234}, Value: jsontext.Value(`{"text":"x"}`)},
+		}
+		if n, err := UploadLogs(context.Background(), conf, slices.Values(entries)); err != nil {
+			t.Fatal(err)
+		} else if n != len(entries) {
+			t.Errorf("uploaded %d entries, want %d", n, len(entries))
+		}
+		e := unmarshalOne(t, <-got)
+		lt := e["logtail"].(map[string]any)
+		if got, want := lt["proc_id"], float64(1234); got != want {
+			t.Errorf("proc_id = %v; want %v", got, want)
+		}
+	})
+
+	t.Run("UploadErrorOnNon-200", func(t *testing.T) {
+		conf, _ := newCaptureServer(t, http.StatusInternalServerError)
+		entries := []LogEntry[jsontext.Value]{{Value: jsontext.Value(`{"text":"x"}`)}}
+		if n, err := UploadLogs(context.Background(), conf, slices.Values(entries)); err == nil {
+			t.Fatal("expected an error when the server responds non-200")
+		} else if n != 0 {
+			t.Errorf("uploaded %d entries, want 0", n)
+		}
+	})
+
+	t.Run("IncludesIncrementingProc_seq", func(t *testing.T) {
+		conf, got := newCaptureServer(t, 0)
+		conf.IncludeProcSequence = true
+		entries := []LogEntry[jsontext.Value]{
+			{Value: jsontext.Value(`{"text":"one"}`)},
+			{Value: jsontext.Value(`{"text":"two"}`)},
+			{Value: jsontext.Value(`{"text":"three"}`)},
+		}
+		if n, err := UploadLogs(context.Background(), conf, slices.Values(entries)); err != nil {
+			t.Fatal(err)
+		} else if n != len(entries) {
+			t.Errorf("uploaded %d entries, want %d", n, len(entries))
+		}
+
+		var all []map[string]any
+		if err := json.Unmarshal(<-got, &all); err != nil {
+			t.Fatal(err)
+		}
+		if len(all) != 3 {
+			t.Fatalf("got %d entries, want 3", len(all))
+		}
+		for i, e := range all {
+			lt := e["logtail"].(map[string]any)
+			seq, ok := lt["proc_seq"].(float64)
+			if !ok {
+				t.Fatalf("entry %d missing proc_seq", i)
+			}
+			if int(seq) != i+1 {
+				t.Errorf("entry %d proc_seq = %v; want %d", i, seq, i+1)
+			}
+		}
+	})
+}
+
 type simpleMemBuf struct {
 	Buffer
 	buf bytes.Buffer
@@ -321,6 +582,90 @@ func TestLoggerWriteResult(t *testing.T) {
 	}
 }
 
+type roundTripperFunc func(*http.Request) (*http.Response, error)
+
+func (f roundTripperFunc) RoundTrip(r *http.Request) (*http.Response, error) { return f(r) }
+
+func TestNewLoggerDisabled(t *testing.T) { synctest.Test(t, synctestNewLoggerDisabled) }
+
+func synctestNewLoggerDisabled(t *testing.T) {
+	// When Config.Disabled is true, NewLogger must not emit the usual
+	// "logtail started" banner: the logger should start in the disabled
+	// state before the internal startup write, so nothing ever lands
+	// in the buffer for the upload goroutine to drain.
+	buf := NewMemoryBuffer(100)
+
+	// Any HTTP attempt indicates the banner leaked into the buffer and
+	// the upload goroutine tried to ship it. Report it once (so the
+	// retry spin doesn't drown the log), then block on the request
+	// context so synctest.Wait sees a durable block and Shutdown's
+	// uploadCancel can unblock us cleanly.
+	var once sync.Once
+	httpc := &http.Client{
+		Transport: roundTripperFunc(func(r *http.Request) (*http.Response, error) {
+			once.Do(func() {
+				t.Errorf("unexpected HTTP request while Disabled=true: %s", r.URL)
+			})
+			<-r.Context().Done()
+			return nil, r.Context().Err()
+		}),
+	}
+
+	logger := NewLogger(Config{
+		BaseURL:  "http://logtail.test.invalid",
+		HTTPC:    httpc,
+		Bus:      eventbustest.NewBus(t),
+		Buffer:   buf,
+		Disabled: true,
+	}, t.Logf)
+	defer func() {
+		// Pass an already-cancelled context so Shutdown invokes
+		// uploadCancel immediately; otherwise on the regression path
+		// (Disabled=false) the upload goroutine stays in its retry
+		// loop and synctest.Test never returns.
+		ctx, cancel := context.WithCancel(context.Background())
+		cancel()
+		logger.Shutdown(ctx)
+	}()
+
+	synctest.Wait()
+
+	if back, _ := buf.TryReadLine(); len(back) != 0 {
+		t.Errorf("Disabled logger buffered a startup entry: %q", back)
+	}
+}
+
+func TestLoggerSetEnabled(t *testing.T) {
+	buf := NewMemoryBuffer(100)
+	lg := &Logger{
+		clock:  tstest.NewClock(tstest.ClockOpts{Start: time.Unix(123, 0)}),
+		buffer: buf,
+	}
+
+	if _, err := lg.Write([]byte("enabled1")); err != nil {
+		t.Fatal(err)
+	}
+	if back, _ := buf.TryReadLine(); !strings.Contains(string(back), "enabled1") {
+		t.Fatalf("initial write not buffered; got %q", back)
+	}
+
+	lg.SetEnabled(false)
+	if _, err := lg.Write([]byte("disabled")); err != nil {
+		t.Fatal(err)
+	}
+	if back, _ := buf.TryReadLine(); len(back) != 0 {
+		t.Errorf("write while disabled leaked into buffer: %q", back)
+	}
+
+	lg.SetEnabled(true)
+	if _, err := lg.Write([]byte("enabled2")); err != nil {
+		t.Fatal(err)
+	}
+	if back, _ := buf.TryReadLine(); !strings.Contains(string(back), "enabled2") {
+		t.Errorf("write after re-enable not buffered; got %q", back)
+	}
+}
+
 func TestAppendMetadata(t *testing.T) {
 	var lg Logger
 	lg.clock = tstest.NewClock(tstest.ClockOpts{Start: time.Date(2000, 01, 01, 0, 0, 0, 0, time.UTC)})
diff --git a/maths/ewma.go b/maths/ewma.go
deleted file mode 100644
index 1946081cf..000000000
--- a/maths/ewma.go
+++ /dev/null
@@ -1,72 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-// Package maths contains additional mathematical functions or structures not
-// found in the standard library.
-package maths
-
-import (
-	"math"
-	"time"
-)
-
-// EWMA is an exponentially weighted moving average supporting updates at
-// irregular intervals with at most nanosecond resolution.
-// The zero value will compute a half-life of 1 second.
-// It is not safe for concurrent use.
-// TODO(raggi): de-duplicate with tstime/rate.Value, which has a more complex
-// and synchronized interface and does not provide direct access to the stable
-// value.
-type EWMA struct {
-	value    float64 // current value of the average
-	lastTime int64   // time of last update in unix nanos
-	halfLife float64 // half-life in seconds
-}
-
-// NewEWMA creates a new EWMA with the specified half-life. If halfLifeSeconds
-// is 0, it defaults to 1.
-func NewEWMA(halfLifeSeconds float64) *EWMA {
-	return &EWMA{
-		halfLife: halfLifeSeconds,
-	}
-}
-
-// Update adds a new sample to the average. If t is zero or precedes the last
-// update, the update is ignored.
-func (e *EWMA) Update(value float64, t time.Time) {
-	if t.IsZero() {
-		return
-	}
-	hl := e.halfLife
-	if hl == 0 {
-		hl = 1
-	}
-	tn := t.UnixNano()
-	if e.lastTime == 0 {
-		e.value = value
-		e.lastTime = tn
-		return
-	}
-
-	dt := (time.Duration(tn-e.lastTime) * time.Nanosecond).Seconds()
-	if dt < 0 {
-		// drop out of order updates
-		return
-	}
-
-	// decay = 2^(-dt/halfLife)
-	decay := math.Exp2(-dt / hl)
-	e.value = e.value*decay + value*(1-decay)
-	e.lastTime = tn
-}
-
-// Get returns the current value of the average
-func (e *EWMA) Get() float64 {
-	return e.value
-}
-
-// Reset clears the EWMA to its initial state
-func (e *EWMA) Reset() {
-	e.value = 0
-	e.lastTime = 0
-}
diff --git a/maths/ewma_test.go b/maths/ewma_test.go
deleted file mode 100644
index 9fddf34e1..000000000
--- a/maths/ewma_test.go
+++ /dev/null
@@ -1,178 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-package maths
-
-import (
-	"slices"
-	"testing"
-	"time"
-)
-
-// some real world latency samples.
-var (
-	latencyHistory1 = []int{
-		14, 12, 15, 6, 19, 12, 13, 13, 13, 16, 17, 11, 17, 11, 14, 15, 14, 15,
-		16, 16, 17, 14, 12, 16, 18, 14, 14, 11, 15, 15, 25, 11, 15, 14, 12, 15,
-		13, 12, 13, 15, 11, 13, 15, 14, 14, 15, 12, 15, 18, 12, 15, 22, 12, 13,
-		10, 14, 16, 15, 16, 11, 14, 17, 18, 20, 16, 11, 16, 14, 5, 15, 17, 12,
-		15, 11, 15, 20, 12, 17, 12, 17, 15, 12, 12, 11, 14, 15, 11, 20, 14, 13,
-		11, 12, 13, 13, 11, 13, 11, 15, 13, 13, 14, 12, 11, 12, 12, 14, 11, 13,
-		12, 12, 12, 19, 14, 13, 13, 14, 11, 12, 10, 11, 15, 12, 14, 11, 11, 14,
-		14, 12, 12, 11, 14, 12, 11, 12, 14, 11, 12, 15, 12, 14, 12, 12, 21, 16,
-		21, 12, 16, 9, 11, 16, 14, 13, 14, 12, 13, 16,
-	}
-	latencyHistory2 = []int{
-		18, 20, 21, 21, 20, 23, 18, 18, 20, 21, 20, 19, 22, 18, 20, 20, 19, 21,
-		21, 22, 22, 19, 18, 22, 22, 19, 20, 17, 16, 11, 25, 16, 18, 21, 17, 22,
-		19, 18, 22, 21, 20, 18, 22, 17, 17, 20, 19, 10, 19, 16, 19, 25, 17, 18,
-		15, 20, 21, 20, 23, 22, 22, 22, 19, 22, 22, 17, 22, 20, 20, 19, 21, 22,
-		20, 19, 17, 22, 16, 16, 20, 22, 17, 19, 21, 16, 20, 22, 19, 21, 20, 19,
-		13, 14, 23, 19, 16, 10, 19, 15, 15, 17, 16, 18, 14, 16, 18, 22, 20, 18,
-		18, 21, 15, 19, 18, 19, 18, 20, 17, 19, 21, 19, 20, 19, 20, 20, 17, 14,
-		17, 17, 18, 21, 20, 18, 18, 17, 16, 17, 17, 20, 22, 19, 20, 21, 21, 20,
-		21, 24, 20, 18, 12, 17, 18, 17, 19, 19, 19,
-	}
-)
-
-func TestEWMALatencyHistory(t *testing.T) {
-	type result struct {
-		t time.Time
-		v float64
-		s int
-	}
-
-	for _, latencyHistory := range [][]int{latencyHistory1, latencyHistory2} {
-		startTime := time.Date(2025, 1, 1, 12, 0, 0, 0, time.UTC)
-		halfLife := 30.0
-
-		ewma := NewEWMA(halfLife)
-
-		var results []result
-		sum := 0.0
-		for i, latency := range latencyHistory {
-			t := startTime.Add(time.Duration(i) * time.Second)
-			ewma.Update(float64(latency), t)
-			sum += float64(latency)
-
-			results = append(results, result{t, ewma.Get(), latency})
-		}
-		mean := sum / float64(len(latencyHistory))
-		min := float64(slices.Min(latencyHistory))
-		max := float64(slices.Max(latencyHistory))
-
-		t.Logf("EWMA Latency History (half-life: %.1f seconds):", halfLife)
-		t.Logf("Mean latency: %.2f ms", mean)
-		t.Logf("Range: [%.1f, %.1f]", min, max)
-
-		t.Log("Samples: ")
-		sparkline := []rune("▁▂▃▄▅▆▇█")
-		var sampleLine []rune
-		for _, r := range results {
-			idx := int(((float64(r.s) - min) / (max - min)) * float64(len(sparkline)-1))
-			if idx >= len(sparkline) {
-				idx = len(sparkline) - 1
-			}
-			sampleLine = append(sampleLine, sparkline[idx])
-		}
-		t.Log(string(sampleLine))
-
-		t.Log("EWMA:    ")
-		var ewmaLine []rune
-		for _, r := range results {
-			idx := int(((r.v - min) / (max - min)) * float64(len(sparkline)-1))
-			if idx >= len(sparkline) {
-				idx = len(sparkline) - 1
-			}
-			ewmaLine = append(ewmaLine, sparkline[idx])
-		}
-		t.Log(string(ewmaLine))
-		t.Log("")
-
-		t.Logf("Time       | Sample | Value  | Value - Sample")
-		t.Logf("")
-
-		for _, result := range results {
-			t.Logf("%10s | % 6d | % 5.2f | % 5.2f", result.t.Format("15:04:05"), result.s, result.v, result.v-float64(result.s))
-		}
-
-		// check that all results are greater than the min, and less than the max of the input,
-		// and they're all close to the mean.
-		for _, result := range results {
-			if result.v < float64(min) || result.v > float64(max) {
-				t.Errorf("result %f out of range [%f, %f]", result.v, min, max)
-			}
-
-			if result.v < mean*0.9 || result.v > mean*1.1 {
-				t.Errorf("result %f not close to mean %f", result.v, mean)
-			}
-		}
-	}
-}
-
-func TestHalfLife(t *testing.T) {
-	start := time.Date(2025, 1, 1, 12, 0, 0, 0, time.UTC)
-
-	ewma := NewEWMA(30.0)
-	ewma.Update(10, start)
-	ewma.Update(0, start.Add(30*time.Second))
-
-	if ewma.Get() != 5 {
-		t.Errorf("expected 5, got %f", ewma.Get())
-	}
-
-	ewma.Update(10, start.Add(60*time.Second))
-	if ewma.Get() != 7.5 {
-		t.Errorf("expected 7.5, got %f", ewma.Get())
-	}
-
-	ewma.Update(10, start.Add(90*time.Second))
-	if ewma.Get() != 8.75 {
-		t.Errorf("expected 8.75, got %f", ewma.Get())
-	}
-}
-
-func TestZeroValue(t *testing.T) {
-	start := time.Date(2025, 1, 1, 12, 0, 0, 0, time.UTC)
-
-	var ewma EWMA
-	ewma.Update(10, start)
-	ewma.Update(0, start.Add(time.Second))
-
-	if ewma.Get() != 5 {
-		t.Errorf("expected 5, got %f", ewma.Get())
-	}
-
-	ewma.Update(10, start.Add(2*time.Second))
-	if ewma.Get() != 7.5 {
-		t.Errorf("expected 7.5, got %f", ewma.Get())
-	}
-
-	ewma.Update(10, start.Add(3*time.Second))
-	if ewma.Get() != 8.75 {
-		t.Errorf("expected 8.75, got %f", ewma.Get())
-	}
-}
-
-func TestReset(t *testing.T) {
-	start := time.Date(2025, 1, 1, 12, 0, 0, 0, time.UTC)
-
-	ewma := NewEWMA(30.0)
-	ewma.Update(10, start)
-	ewma.Update(0, start.Add(30*time.Second))
-
-	if ewma.Get() != 5 {
-		t.Errorf("expected 5, got %f", ewma.Get())
-	}
-
-	ewma.Reset()
-
-	if ewma.Get() != 0 {
-		t.Errorf("expected 0, got %f", ewma.Get())
-	}
-
-	ewma.Update(10, start.Add(90*time.Second))
-	if ewma.Get() != 10 {
-		t.Errorf("expected 10, got %f", ewma.Get())
-	}
-}
diff --git a/metrics/multilabelmap_test.go b/metrics/multilabelmap_test.go
index 70554c63e..0fa730992 100644
--- a/metrics/multilabelmap_test.go
+++ b/metrics/multilabelmap_test.go
@@ -86,10 +86,10 @@ metricname{foo="si",bar="si"} 5
 
 func TestMultiLabelMapTypes(t *testing.T) {
 	type LabelTypes struct {
-		S string
-		B bool
-		I int
-		U uint
+		S   string
+		B   bool
+		Int int
+		U   uint
 	}
 
 	m := new(MultiLabelMap[LabelTypes])
@@ -100,7 +100,7 @@ func TestMultiLabelMapTypes(t *testing.T) {
 	m.WritePrometheus(&buf, "metricname")
 	const want = `# TYPE metricname counter
 # HELP metricname some good stuff
-metricname{s="a",b="true",i="-1",u="2"} 3
+metricname{s="a",b="true",int="-1",u="2"} 3
 `
 	if got := buf.String(); got != want {
 		t.Errorf("got %q; want %q", got, want)
diff --git a/misc/add-git-hooks.go b/misc/add-git-hooks.go
new file mode 100644
index 000000000..732816084
--- /dev/null
+++ b/misc/add-git-hooks.go
@@ -0,0 +1,21 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build ignore
+
+// The add-git-hooks program installs git hooks by delegating to
+// githook.Install. See that function's doc for what it does.
+package main
+
+import (
+	"log"
+
+	"tailscale.com/misc/git_hook/githook"
+)
+
+func main() {
+	log.SetFlags(0)
+	if err := githook.Install(); err != nil {
+		log.Fatalf("add-git-hooks: %v", err)
+	}
+}
diff --git a/misc/genreadme/genreadme.go b/misc/genreadme/genreadme.go
new file mode 100644
index 000000000..97a8d9e16
--- /dev/null
+++ b/misc/genreadme/genreadme.go
@@ -0,0 +1,267 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// The genreadme tool generates/updates README.md files in the tailscale repo.
+//
+// # Running
+//
+// From the repo root, run: `./tool/go run ./misc/genreadme` and it will update all
+// the README.md files that are stale in the tree.
+package main
+
+import (
+	"bytes"
+	"errors"
+	"flag"
+	"fmt"
+	"go/parser"
+	"go/token"
+	"io"
+	"io/fs"
+	"log"
+	"os"
+	"path"
+	"path/filepath"
+	"runtime"
+	"strings"
+
+	"github.com/creachadair/taskgroup"
+	"tailscale.com/tempfork/pkgdoc"
+)
+
+// modulePath is the current module's import path, read from go.mod at startup.
+var modulePath string
+
+var skip = map[string]bool{
+	"out": true,
+}
+
+// bkSkip lists directories where the generated file should not mention
+// Buildkite because a deploy workflow is not set up for them.
+var bkSkip = map[string]bool{}
+
+// defaultRoots are the directory trees walked when genreadme is run with
+// no arguments. Add a directory here to opt its package (and any
+// sub-packages) into README.md generation from godoc.
+var defaultRoots = []string{
+	"tsnet",
+}
+
+func main() {
+	flag.Parse()
+	modulePath = readModulePath("go.mod")
+	var roots []string
+	switch flag.NArg() {
+	case 0:
+		roots = defaultRoots
+	case 1:
+		root := flag.Arg(0)
+		root = strings.TrimPrefix(root, "./")
+		root = strings.TrimSuffix(root, "/")
+		roots = []string{root}
+	default:
+		log.Fatalf("Usage: genreadme [dir]")
+	}
+
+	var updateErrs []error
+	g, run := taskgroup.New(func(err error) {
+		updateErrs = append(updateErrs, err)
+	}).Limit(runtime.NumCPU() * 2) // usually I/O bound
+
+	for _, root := range roots {
+		g.Go(func() error {
+			return fs.WalkDir(os.DirFS("."), root, func(path string, d fs.DirEntry, err error) error {
+				if err != nil {
+					return err
+				}
+				if !d.IsDir() {
+					return nil
+				}
+				if skip[path] {
+					return fs.SkipDir
+				}
+				base := filepath.Base(path)
+				if base == "testdata" || (path != "." && base[0] == '.') {
+					return fs.SkipDir
+				}
+				run(func() error {
+					return update(path)
+				})
+				return nil
+			})
+		})
+	}
+	g.Wait()
+	if err := errors.Join(updateErrs...); err != nil {
+		log.Fatal(err)
+	}
+}
+
+func update(dir string) error {
+	readmePath := filepath.Join(dir, "README.md")
+	cur, err := os.ReadFile(readmePath)
+	exists := false
+	if err != nil && !os.IsNotExist(err) {
+		return err
+	}
+	if err == nil {
+		exists = true
+		if !isGenerated(cur) {
+			// Do nothing; a human wrote this file.
+			return nil
+		}
+	}
+
+	newContents, err := getNewContent(dir)
+	if err != nil {
+		return err
+	}
+	if newContents == nil {
+		if exists {
+			log.Printf("Deleting %s ...", readmePath)
+			os.Remove(readmePath)
+		}
+		return nil
+	}
+
+	if bytes.Equal(cur, newContents) {
+		return nil
+	}
+	log.Printf("Writing %s ...", readmePath)
+	return os.WriteFile(readmePath, newContents, 0644)
+}
+
+func getNewContent(dir string) (newContent []byte, err error) {
+	dents, err := os.ReadDir(dir)
+	if err != nil {
+		return nil, err
+	}
+
+	generators := []struct {
+		name      string
+		quickTest func(dir string, dents []fs.DirEntry) bool
+		generate  func(dir string) ([]byte, error)
+	}{
+		{"go", hasGoFiles, genGoDoc},
+	}
+	for _, gen := range generators {
+		if !gen.quickTest(dir, dents) {
+			continue
+		}
+		newContent, err := gen.generate(dir)
+		if newContent == nil && err == nil {
+			// Generator declined to generate, try next
+			continue
+		}
+		return newContent, err
+	}
+	return nil, nil
+}
+
+func genGoDoc(dir string) ([]byte, error) {
+	abs, err := filepath.Abs(dir)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get absolute path for %q: %w", dir, err)
+	}
+	var importPath string
+	if modulePath != "" {
+		importPath = path.Join(modulePath, filepath.ToSlash(dir))
+	}
+	godoc, err := pkgdoc.PackageDoc(abs, importPath)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get package doc for %q: %w", dir, err)
+	}
+	if len(bytes.TrimSpace(godoc)) == 0 {
+		// No godoc; skipping.
+		return nil, nil
+	}
+	isLibrary := bytes.HasPrefix(godoc, []byte("package "))
+	if isLibrary {
+		// Strip the "package X // import Y\n\n" clause emitted for library packages.
+		if i := bytes.Index(godoc, []byte("\n\n")); i != -1 {
+			godoc = godoc[i+2:]
+		}
+	}
+	if len(bytes.TrimSpace(godoc)) == 0 {
+		return nil, nil
+	}
+	var buf bytes.Buffer
+	io.WriteString(&buf, genHeader)
+	fmt.Fprintf(&buf, "\n# %s\n\n", filepath.Base(dir))
+	if isLibrary && importPath != "" {
+		fmt.Fprintf(&buf, "[![Go Reference](https://pkg.go.dev/badge/%s.svg)](https://pkg.go.dev/%s)\n\n", importPath, importPath)
+	}
+	buf.Write(godoc)
+
+	if !bytes.Contains(godoc, []byte("## Deploying")) {
+		deployPath := filepath.Join(dir, "deploy.sh")
+		if _, err := os.Stat(deployPath); err == nil {
+			fmt.Fprint(&buf, "\n## Deploying\n\n")
+			if hasBuildkite(dir) {
+				fmt.Fprintf(&buf,
+					"To deploy, run the https://buildkite.com/tailscale/deploy-%s workflow in Buildkite.\n",
+					filepath.Base(dir),
+				)
+			}
+			fmt.Fprintf(&buf, "To deploy manually, run `./%s` from the repo root.\n\n", deployPath)
+		}
+	}
+	return buf.Bytes(), nil
+}
+
+const genHeader = "<!-- README.md auto-generated by misc/genreadme; DO NOT EDIT. (or remove this line) -->\n"
+
+func isGenerated(b []byte) bool { return bytes.HasPrefix(b, []byte(genHeader)) }
+
+// readModulePath returns the module path declared in the given go.mod file,
+// or "" if it can't be read or parsed.
+func readModulePath(file string) string {
+	b, err := os.ReadFile(file)
+	if err != nil {
+		return ""
+	}
+	for line := range strings.Lines(string(b)) {
+		if rest, ok := strings.CutPrefix(strings.TrimSpace(line), "module "); ok {
+			return strings.Trim(strings.TrimSpace(rest), `"`)
+		}
+	}
+	return ""
+}
+
+func hasBuildkite(dir string) bool {
+	if bkSkip[dir] {
+		return false
+	}
+	_, flyErr := os.Stat(filepath.Join(dir, "fly.toml"))
+	return flyErr != nil
+}
+
+func hasGoFiles(dir string, dents []fs.DirEntry) bool {
+	var fset *token.FileSet
+
+	for _, de := range dents {
+		name := de.Name()
+		if !strings.HasSuffix(name, ".go") ||
+			strings.HasSuffix(name, "_test.go") {
+			continue
+		}
+		if fset == nil {
+			fset = token.NewFileSet()
+		}
+
+		path := filepath.Join(dir, name)
+		f, err := os.Open(path)
+		if err != nil {
+			continue
+		}
+		pkgFile, err := parser.ParseFile(fset, "", f, parser.PackageClauseOnly)
+		f.Close()
+		if err != nil {
+			// skip files with parse errors
+			continue
+		}
+
+		return pkgFile.Name.Name != ""
+	}
+	return false
+}
diff --git a/misc/git_hook/HOOK_VERSION b/misc/git_hook/HOOK_VERSION
deleted file mode 100644
index d00491fd7..000000000
--- a/misc/git_hook/HOOK_VERSION
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/misc/git_hook/README.md b/misc/git_hook/README.md
new file mode 100644
index 000000000..a17cc2c83
--- /dev/null
+++ b/misc/git_hook/README.md
@@ -0,0 +1,44 @@
+# git_hook
+
+Tailscale's git hooks.
+
+The shared logic lives in the `githook/` package and is also imported by
+`tailscale/corp`.
+
+## Install
+
+From the repo root:
+
+    ./tool/go run ./misc/add-git-hooks.go
+
+The script auto-updates in the future.
+
+
+## Large file check
+
+The pre-push hook rejects pushes that add or change any blob over 1.5
+MB, using the same tree diff logic as the check-file-size CI workflow.
+To push a large file intentionally, set an environment variable:
+
+    TS_SKIP_LARGE_FILE_CHECK=1 git push ...
+
+
+## Adding your own hooks
+
+Create an executable `.git/hooks/<hook-name>.local` to chain a custom
+script after a built-in hook. For example, put a custom check in
+`.git/hooks/pre-commit.local` and `chmod +x` it. The local hook runs
+only if the built-in hook succeeds; failure aborts the git operation.
+
+
+## Version bumps
+
+The launcher rebuilds when the installed binary's version differs from
+the concatenation of two files:
+
+* `githook/HOOK_VERSION` (shared): bump when changing anything under
+  `githook/` or `git-hook.go`. Downstream repos pick it up after
+  bumping their `tailscale.com` dependency.
+* `misc/git_hook/HOOK_VERSION` (repo-local, optional): bump to force a
+  rebuild for repo-specific config changes without touching the shared
+  version. This repo does not use one.
diff --git a/misc/git_hook/git-hook.go b/misc/git_hook/git-hook.go
index 89e78b120..c9db5d84c 100644
--- a/misc/git_hook/git-hook.go
+++ b/misc/git_hook/git-hook.go
@@ -1,322 +1,70 @@
 // Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
-// The git-hook command is Tailscale's git hooks. It's built by
-// misc/install-git-hooks.go and installed into .git/hooks
-// as .git/hooks/ts-git-hook, with shell wrappers.
+// The git-hook command is Tailscale's git hook binary, built and
+// installed under .git/hooks/ts-git-hook-bin by the launcher at
+// .git/hooks/ts-git-hook. misc/add-git-hooks.go writes the initial
+// launcher; subsequent HOOK_VERSION bumps trigger self-rebuilds.
 //
 // # Adding your own hooks
 //
-// To add your own hook for one that we have already hooked, create a file named
-// <hook-name>.local in .git/hooks. For example, to add your own pre-commit hook,
-// create .git/hooks/pre-commit.local and make it executable. It will be run after
-// the ts-git-hook, if ts-git-hook executes successfully.
+// To add your own hook alongside one we already hook, create an executable
+// file .git/hooks/<hook-name>.local (e.g. pre-commit.local). It runs after
+// the built-in hook succeeds.
 package main
 
 import (
-	"bufio"
-	"bytes"
-	"crypto/rand"
-	_ "embed"
-	"errors"
 	"fmt"
-	"io"
 	"log"
 	"os"
-	"os/exec"
-	"path/filepath"
-	"strconv"
 	"strings"
 
-	"github.com/fatih/color"
-	"github.com/sourcegraph/go-diff/diff"
-	"golang.org/x/mod/modfile"
+	"tailscale.com/misc/git_hook/githook"
 )
 
+// maxPushBlobSize is the largest new or changed blob allowed in a
+// push. It matches the 1.5 MB limit enforced by the check-file-size CI
+// workflow. Set TS_SKIP_LARGE_FILE_CHECK=1 to override.
+const maxPushBlobSize = 1_500_000
+
+var pushRemotes = []string{
+	"git@github.com:tailscale/tailscale",
+	"git@github.com:tailscale/tailscale.git",
+	"https://github.com/tailscale/tailscale",
+	"https://github.com/tailscale/tailscale.git",
+}
+
+// hooks are the hook names this binary handles. Used by install to
+// write per-hook wrappers; must stay in sync with the dispatcher below.
+var hooks = []string{"pre-commit", "commit-msg", "pre-push"}
+
 func main() {
 	log.SetFlags(0)
 	if len(os.Args) < 2 {
 		return
 	}
 	cmd, args := os.Args[1], os.Args[2:]
+
 	var err error
 	switch cmd {
+	case "version":
+		fmt.Print(strings.TrimSpace(githook.HookVersion) + ":0")
+	case "install":
+		err = githook.WriteHooks(hooks)
 	case "pre-commit":
-		err = preCommit(args)
+		err = githook.CheckForbiddenMarkers()
 	case "commit-msg":
-		err = commitMsg(args)
+		err = githook.AddChangeID(args)
 	case "pre-push":
-		err = prePush(args)
-	case "post-checkout":
-		err = postCheckout(args)
+		err = githook.CheckPrePush(args, githook.PrePushConfig{
+			WatchedRemotes: pushRemotes,
+			MaxBlobSize:    maxPushBlobSize,
+		})
 	}
 	if err != nil {
-		p := log.Fatalf
-		if nfe, ok := err.(nonFatalErr); ok {
-			p = log.Printf
-			err = nfe
-		}
-		p("git-hook: %v: %v", cmd, err)
+		log.Fatalf("git-hook: %v: %v", cmd, err)
 	}
-
-	if err == nil || errors.Is(err, nonFatalErr{}) {
-		err := runLocalHook(cmd, args)
-		if err != nil {
-			log.Fatalf("git-hook: %v", err)
-		}
+	if err := githook.RunLocalHook(cmd, args); err != nil {
+		log.Fatalf("git-hook: %v", err)
 	}
 }
-
-func runLocalHook(hookName string, args []string) error {
-	cmdPath, err := os.Executable()
-	if err != nil {
-		return err
-	}
-	hookDir := filepath.Dir(cmdPath)
-	localHookPath := filepath.Join(hookDir, hookName+".local")
-	if _, err := os.Stat(localHookPath); errors.Is(err, os.ErrNotExist) {
-		return nil
-	} else if err != nil {
-		return fmt.Errorf("checking for local hook: %w", err)
-	}
-
-	cmd := exec.Command(localHookPath, args...)
-	cmd.Stdout = os.Stdout
-	cmd.Stderr = os.Stderr
-	if err := cmd.Run(); err != nil {
-		return fmt.Errorf("running local hook %q: %w", localHookPath, err)
-	}
-	return nil
-}
-
-// pre-commit: "It takes no parameters, and is invoked before
-// obtaining the proposed commit log message and making a
-// commit. Exiting with a non-zero status from this script causes the
-// git commit command to abort before creating a commit."
-//
-// https://git-scm.com/docs/githooks#_pre_commit
-func preCommit(_ []string) error {
-	diffOut, err := exec.Command("git", "diff", "--cached").Output()
-	if err != nil {
-		return fmt.Errorf("Could not get git diff: %w", err)
-	}
-
-	diffs, err := diff.ParseMultiFileDiff(diffOut)
-	if err != nil {
-		return fmt.Errorf("Could not parse diff: %w", err)
-	}
-
-	foundForbidden := false
-	for _, diff := range diffs {
-		for _, hunk := range diff.Hunks {
-			lines := bytes.Split(hunk.Body, []byte{'\n'})
-			for i, line := range lines {
-				if len(line) == 0 || line[0] != '+' {
-					continue
-				}
-				for _, forbidden := range preCommitForbiddenPatterns {
-					if bytes.Contains(line, forbidden) {
-						if !foundForbidden {
-							color.New(color.Bold, color.FgRed, color.Underline).Printf("%s found:\n", forbidden)
-						}
-						// Output file name (dropping the b/ prefix) and line
-						// number so that it can be linkified by terminals.
-						fmt.Printf("%s:%d: %s\n", diff.NewName[2:], int(hunk.NewStartLine)+i, line[1:])
-						foundForbidden = true
-					}
-				}
-			}
-		}
-	}
-	if foundForbidden {
-		return fmt.Errorf("Found forbidden string")
-	}
-
-	return nil
-}
-
-var preCommitForbiddenPatterns = [][]byte{
-	// Use concatenation to avoid including the forbidden literals (and thus
-	// triggering the pre-commit hook).
-	[]byte("NOCOM" + "MIT"),
-	[]byte("DO NOT " + "SUBMIT"),
-}
-
-// https://git-scm.com/docs/githooks#_commit_msg
-func commitMsg(args []string) error {
-	if len(args) != 1 {
-		return errors.New("usage: commit-msg message.txt")
-	}
-	file := args[0]
-	msg, err := os.ReadFile(file)
-	if err != nil {
-		return err
-	}
-	msg = filterCutLine(msg)
-
-	var id [20]byte
-	if _, err := io.ReadFull(rand.Reader, id[:]); err != nil {
-		return fmt.Errorf("could not generate Change-Id: %v", err)
-	}
-	cmdLines := [][]string{
-		// Trim whitespace and comments.
-		{"git", "stripspace", "--strip-comments"},
-		// Add Change-Id trailer.
-		{"git", "interpret-trailers", "--no-divider", "--where=start", "--if-exists", "doNothing", "--trailer", fmt.Sprintf("Change-Id: I%x", id)},
-	}
-	for _, cmdLine := range cmdLines {
-		if len(msg) == 0 {
-			// Don't allow commands to go from empty commit message to non-empty (issue 2205).
-			break
-		}
-		cmd := exec.Command(cmdLine[0], cmdLine[1:]...)
-		cmd.Stdin = bytes.NewReader(msg)
-		msg, err = cmd.CombinedOutput()
-		if err != nil {
-			return fmt.Errorf("failed to run '%v': %w\n%s", cmd, err, msg)
-		}
-	}
-
-	return os.WriteFile(file, msg, 0666)
-}
-
-// pre-push: "this hook is called by git-push and can be used to
-// prevent a push from taking place. The hook is called with two
-// parameters which provide the name and location of the destination
-// remote, if a named remote is not being used both values will be the
-// same.
-//
-// Information about what is to be pushed is provided on the hook's
-// standard input with lines of the form:
-//
-//	<local ref> SP <local sha1> SP <remote ref> SP <remote sha1> LF
-//
-// More: https://git-scm.com/docs/githooks#_pre_push
-func prePush(args []string) error {
-	remoteName, remoteLoc := args[0], args[1]
-	_ = remoteName
-
-	pushes, err := readPushes()
-	if err != nil {
-		return fmt.Errorf("reading pushes: %w", err)
-	}
-
-	switch remoteLoc {
-	case "git@github.com:tailscale/tailscale", "git@github.com:tailscale/tailscale.git",
-		"https://github.com/tailscale/tailscale", "https://github.com/tailscale/tailscale.git":
-		for _, p := range pushes {
-			if p.isDoNotMergeRef() {
-				continue
-			}
-			if err := checkCommit(p.localSHA); err != nil {
-				return fmt.Errorf("not allowing push of %v to %v: %v", p.localSHA, p.remoteRef, err)
-			}
-		}
-	}
-
-	return nil
-}
-
-//go:embed HOOK_VERSION
-var compiledHookVersion string
-
-// post-checkout: "This hook is invoked when a git-checkout[1] or
-// git-switch[1] is run after having updated the worktree. The hook is
-// given three parameters: the ref of the previous HEAD, the ref of
-// the new HEAD (which may or may not have changed), and a flag
-// indicating whether the checkout was a branch checkout (changing
-// branches, flag=1) or a file checkout (retrieving a file from the
-// index, flag=0).
-//
-// More: https://git-scm.com/docs/githooks#_post_checkout
-func postCheckout(_ []string) error {
-	compiled, err := strconv.Atoi(strings.TrimSpace(compiledHookVersion))
-	if err != nil {
-		return fmt.Errorf("couldn't parse compiled-in hook version: %v", err)
-	}
-
-	bs, err := os.ReadFile("misc/git_hook/HOOK_VERSION")
-	if errors.Is(err, os.ErrNotExist) {
-		// Probably checked out a commit that predates the existence
-		// of HOOK_VERSION, don't complain.
-		return nil
-	}
-	actual, err := strconv.Atoi(strings.TrimSpace(string(bs)))
-	if err != nil {
-		return fmt.Errorf("couldn't parse misc/git_hook/HOOK_VERSION: %v", err)
-	}
-
-	if actual > compiled {
-		return nonFatalErr{fmt.Errorf("a newer git hook script is available, please run `./tool/go run ./misc/install-git-hooks.go`")}
-	}
-	return nil
-}
-
-func checkCommit(sha string) error {
-	// Allow people to delete remote refs.
-	if sha == zeroRef {
-		return nil
-	}
-	// Check that go.mod doesn't contain replacements to directories.
-	goMod, err := exec.Command("git", "show", sha+":go.mod").Output()
-	if err != nil {
-		return err
-	}
-	mf, err := modfile.Parse("go.mod", goMod, nil)
-	if err != nil {
-		return fmt.Errorf("failed to parse its go.mod: %v", err)
-	}
-	for _, r := range mf.Replace {
-		if modfile.IsDirectoryPath(r.New.Path) {
-			return fmt.Errorf("go.mod contains replace from %v => %v", r.Old.Path, r.New.Path)
-		}
-	}
-
-	return nil
-}
-
-const zeroRef = "0000000000000000000000000000000000000000"
-
-type push struct {
-	localRef  string // "refs/heads/bradfitz/githooks"
-	localSHA  string // what's being pushed
-	remoteRef string // "refs/heads/bradfitz/githooks", "refs/heads/main"
-	remoteSHA string // old value being replaced, or zeroRef if it doesn't exist
-}
-
-func (p *push) isDoNotMergeRef() bool {
-	return strings.HasSuffix(p.remoteRef, "/DO-NOT-MERGE")
-}
-
-func readPushes() (pushes []push, err error) {
-	bs := bufio.NewScanner(os.Stdin)
-	for bs.Scan() {
-		f := strings.Fields(bs.Text())
-		if len(f) != 4 {
-			return nil, fmt.Errorf("unexpected push line %q", bs.Text())
-		}
-		pushes = append(pushes, push{f[0], f[1], f[2], f[3]})
-	}
-	if err := bs.Err(); err != nil {
-		return nil, err
-	}
-	return pushes, nil
-}
-
-// nonFatalErr is an error wrapper type to indicate that main() should
-// not exit fatally.
-type nonFatalErr struct {
-	error
-}
-
-var gitCutLine = []byte("# ------------------------ >8 ------------------------")
-
-// filterCutLine searches for a git cutline (see above) and filters it and any
-// following lines from the given message.  This is typically produced in a
-// commit message file by `git commit -v`.
-func filterCutLine(msg []byte) []byte {
-	if before, _, ok := bytes.Cut(msg, gitCutLine); ok {
-		return before
-	}
-	return msg
-}
diff --git a/misc/git_hook/githook/HOOK_VERSION b/misc/git_hook/githook/HOOK_VERSION
new file mode 100644
index 000000000..b8626c4cf
--- /dev/null
+++ b/misc/git_hook/githook/HOOK_VERSION
@@ -0,0 +1 @@
+4
diff --git a/misc/git_hook/githook/commit-msg.go b/misc/git_hook/githook/commit-msg.go
new file mode 100644
index 000000000..e75bc79f3
--- /dev/null
+++ b/misc/git_hook/githook/commit-msg.go
@@ -0,0 +1,64 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package githook
+
+import (
+	"bytes"
+	"crypto/rand"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+)
+
+// AddChangeID strips comments from the commit message at args[0] and
+// prepends a random Change-Id trailer.
+//
+// Intended as a commit-msg hook.
+// https://git-scm.com/docs/githooks#_commit_msg
+func AddChangeID(args []string) error {
+	if len(args) != 1 {
+		return errors.New("usage: commit-msg message.txt")
+	}
+	file := args[0]
+	msg, err := os.ReadFile(file)
+	if err != nil {
+		return err
+	}
+	msg = filterCutLine(msg)
+
+	var id [20]byte
+	if _, err := io.ReadFull(rand.Reader, id[:]); err != nil {
+		return fmt.Errorf("could not generate Change-Id: %v", err)
+	}
+	cmdLines := [][]string{
+		{"git", "stripspace", "--strip-comments"},
+		{"git", "interpret-trailers", "--no-divider", "--where=start", "--if-exists", "doNothing", "--trailer", fmt.Sprintf("Change-Id: I%x", id)},
+	}
+	for _, cmdLine := range cmdLines {
+		if len(msg) == 0 {
+			// Don't let commands turn an empty message into a non-empty one (issue 2205).
+			break
+		}
+		cmd := exec.Command(cmdLine[0], cmdLine[1:]...)
+		cmd.Stdin = bytes.NewReader(msg)
+		msg, err = cmd.CombinedOutput()
+		if err != nil {
+			return fmt.Errorf("failed to run %v: %w\n%s", cmd, err, msg)
+		}
+	}
+	return os.WriteFile(file, msg, 0666)
+}
+
+var gitCutLine = []byte("# ------------------------ >8 ------------------------")
+
+// filterCutLine strips a `git commit -v`-style cutline and everything
+// after it from msg.
+func filterCutLine(msg []byte) []byte {
+	if before, _, ok := bytes.Cut(msg, gitCutLine); ok {
+		return before
+	}
+	return msg
+}
diff --git a/misc/git_hook/githook/githook.go b/misc/git_hook/githook/githook.go
new file mode 100644
index 000000000..aa44051fc
--- /dev/null
+++ b/misc/git_hook/githook/githook.go
@@ -0,0 +1,52 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package githook contains the shared implementation of Tailscale's git
+// hooks. The tailscale/tailscale and tailscale/corp repositories each have
+// a thin main package that dispatches to this one, calling individual
+// hook functions with per-repo arguments as needed.
+package githook
+
+import (
+	_ "embed"
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+)
+
+// Launcher is the canonical bytes of launcher.sh. Downstream repos
+// (e.g. tailscale/corp) rely on these bytes at install time.
+//
+//go:embed launcher.sh
+var Launcher []byte
+
+// HookVersion is the shared version of this package and launcher.sh.
+// Bump HOOK_VERSION on any change under this package.
+//
+//go:embed HOOK_VERSION
+var HookVersion string
+
+// RunLocalHook runs an optional user-supplied hook at
+// .git/hooks/<name>.local, if present.
+func RunLocalHook(hookName string, args []string) error {
+	cmdPath, err := os.Executable()
+	if err != nil {
+		return err
+	}
+	localHookPath := filepath.Join(filepath.Dir(cmdPath), hookName+".local")
+	if _, err := os.Stat(localHookPath); errors.Is(err, os.ErrNotExist) {
+		return nil
+	} else if err != nil {
+		return fmt.Errorf("checking for local hook: %w", err)
+	}
+
+	cmd := exec.Command(localHookPath, args...)
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	if err := cmd.Run(); err != nil {
+		return fmt.Errorf("running local hook %q: %w", localHookPath, err)
+	}
+	return nil
+}
diff --git a/misc/git_hook/githook/install.go b/misc/git_hook/githook/install.go
new file mode 100644
index 000000000..9c66e02c4
--- /dev/null
+++ b/misc/git_hook/githook/install.go
@@ -0,0 +1,177 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package githook
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"regexp"
+	"strings"
+)
+
+// Install writes the launcher to .git/hooks/ts-git-hook and runs it
+// once with "version", bootstrapping the binary build and per-hook
+// wrappers. Called from each repo's misc/add-git-hooks.go.
+func Install() error {
+	hookDir, err := findHookDir()
+	if err != nil {
+		return err
+	}
+	target := filepath.Join(hookDir, "ts-git-hook")
+	if err := writeLauncher(target); err != nil {
+		return err
+	}
+
+	// The launcher execs the binary with our arg at the end; we pass
+	// "version" only to trigger the rebuild-if-stale path, and discard
+	// its stdout so the version string doesn't leak to the caller.
+	cmd := exec.Command(target, "version")
+	cmd.Stdout = io.Discard
+	cmd.Stderr = os.Stderr
+	if err := cmd.Run(); err != nil {
+		return fmt.Errorf("initial hook setup failed: %v", err)
+	}
+	return nil
+}
+
+// WriteHooks writes the launcher to .git/hooks/ts-git-hook and a wrapper
+// for each name in hooks to .git/hooks/<name>. Stale wrappers from
+// prior versions (ours, but no longer in hooks) are removed. If a path
+// we are about to write exists and is not one of our wrappers,
+// WriteHooks aborts with an error rather than clobber the user's hook.
+// Called by the binary's "install" handler (after a rebuild) and by
+// Install (initial setup).
+func WriteHooks(hooks []string) error {
+	hookDir, err := findHookDir()
+	if err != nil {
+		return err
+	}
+	if err := writeLauncher(filepath.Join(hookDir, "ts-git-hook")); err != nil {
+		return err
+	}
+	want := make(map[string]bool, len(hooks))
+	for _, h := range hooks {
+		want[h] = true
+	}
+	entries, err := os.ReadDir(hookDir)
+	if err != nil {
+		return fmt.Errorf("reading hooks dir: %v", err)
+	}
+	for _, e := range entries {
+		if e.IsDir() {
+			continue
+		}
+		name := e.Name()
+		path := filepath.Join(hookDir, name)
+		mine, err := isOurWrapper(path)
+		if err != nil {
+			return fmt.Errorf("inspecting %s: %v", path, err)
+		}
+		switch {
+		case want[name] && !mine:
+			return fmt.Errorf("%s exists and is not a ts-git-hook wrapper; "+
+				"move your hook to %s.local (it will be chained after the wrapper) or delete it, then re-run: ./tool/go run ./misc/add-git-hooks.go",
+				path, name)
+		case !want[name] && mine:
+			// Stale wrapper from a prior version (e.g. a hook we used
+			// to install but no longer do).
+			if err := os.Remove(path); err != nil {
+				return fmt.Errorf("removing stale wrapper %s: %v", name, err)
+			}
+		}
+	}
+	for _, h := range hooks {
+		content := fmt.Sprintf(wrapperScript, h)
+		if err := os.WriteFile(filepath.Join(hookDir, h), []byte(content), 0755); err != nil {
+			return fmt.Errorf("writing wrapper for %s: %v", h, err)
+		}
+	}
+	return nil
+}
+
+// isOurWrapper reports whether path is a hook wrapper written by us
+// (in any historical format). Files we will never own (the launcher
+// itself, user-chained .local hooks, git's .sample examples) return
+// false unconditionally and are not read. An I/O error other than
+// "not found" is returned to the caller; a missing file is not an
+// error.
+func isOurWrapper(path string) (bool, error) {
+	name := filepath.Base(path)
+	if name == "ts-git-hook" ||
+		strings.HasSuffix(name, ".local") ||
+		strings.HasSuffix(name, ".sample") {
+		return false, nil
+	}
+	b, err := os.ReadFile(path)
+	if os.IsNotExist(err) {
+		return false, nil
+	}
+	if err != nil {
+		return false, err
+	}
+	return wrapperRE.Match(b), nil
+}
+
+// writeLauncher writes the embedded launcher to target via atomic rename,
+// so a currently-running launcher keeps reading its old inode.
+func writeLauncher(target string) error {
+	dir, name := filepath.Split(target)
+	f, err := os.CreateTemp(dir, name+".*")
+	if err != nil {
+		return fmt.Errorf("creating temp launcher: %v", err)
+	}
+	tmp := f.Name()
+	if _, err := f.Write(Launcher); err != nil {
+		f.Close()
+		os.Remove(tmp)
+		return fmt.Errorf("writing temp launcher: %v", err)
+	}
+	if err := f.Close(); err != nil {
+		os.Remove(tmp)
+		return err
+	}
+	if err := os.Chmod(tmp, 0755); err != nil {
+		os.Remove(tmp)
+		return err
+	}
+	if err := os.Rename(tmp, target); err != nil {
+		os.Remove(tmp)
+		return fmt.Errorf("installing launcher: %v", err)
+	}
+	return nil
+}
+
+func findHookDir() (string, error) {
+	out, err := exec.Command("git", "rev-parse", "--git-path", "hooks").CombinedOutput()
+	if err != nil {
+		return "", fmt.Errorf("finding hooks dir: %v, %s", err, out)
+	}
+	hookDir, err := filepath.Abs(strings.TrimSpace(string(out)))
+	if err != nil {
+		return "", err
+	}
+	fi, err := os.Stat(hookDir)
+	if err != nil {
+		return "", fmt.Errorf("checking hooks dir: %v", err)
+	}
+	if !fi.IsDir() {
+		return "", fmt.Errorf("%s is not a directory", hookDir)
+	}
+	return hookDir, nil
+}
+
+const wrapperScript = `#!/usr/bin/env bash
+exec "$(dirname "${BASH_SOURCE[0]}")/ts-git-hook" %s "$@"
+`
+
+// wrapperRE matches every historical shape of wrapperScript: a tiny
+// bash script that execs a sibling ts-git-hook with a single hook-name
+// argument. The inner quoting of ${BASH_SOURCE[0]} changed between
+// versions, hence the "?s.
+var wrapperRE = regexp.MustCompile(
+	`\A#!/usr/bin/env bash\nexec "\$\(dirname "?\$\{BASH_SOURCE\[0\]\}"?\)/ts-git-hook" [\w-]+ "\$@"\n?\z`,
+)
diff --git a/misc/git_hook/githook/largefiles.go b/misc/git_hook/githook/largefiles.go
new file mode 100644
index 000000000..ca12e5b5c
--- /dev/null
+++ b/misc/git_hook/githook/largefiles.go
@@ -0,0 +1,189 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package githook
+
+import (
+	"bytes"
+	"fmt"
+	"os"
+	"os/exec"
+	"strconv"
+	"strings"
+)
+
+// skipLargeFileCheckEnv is the environment variable that, when set to a
+// non-empty value, permits pushing new or changed blobs larger than the
+// configured maximum size. It matches the "skip-large-file-check" commit
+// message tag honored by the corp check-file-size CI workflow.
+const skipLargeFileCheckEnv = "TS_SKIP_LARGE_FILE_CHECK"
+
+// checkLargeBlobs rejects the push p if it adds or changes any blob
+// larger than maxSize bytes, comparing the tree being pushed against
+// the remote's previous tree (or, for new refs, the merge base with the
+// remote's default branch). The same tree diff logic runs in CI via the
+// check-git-accidental-large-file GitHub Action; this catches mistakes
+// before they permanently bloat the remote repo.
+func checkLargeBlobs(remoteName string, p push, maxSize int64) error {
+	if p.localSHA == zeroRef {
+		// Allow ref deletions.
+		return nil
+	}
+	if os.Getenv(skipLargeFileCheckEnv) != "" {
+		return nil
+	}
+	afterTree, err := treeOf(p.localSHA)
+	if err != nil {
+		return fmt.Errorf("resolving tree of %v: %v", p.localSHA, err)
+	}
+	beforeTree := findBaseTree(remoteName, p)
+	if beforeTree == "" {
+		fmt.Fprintf(os.Stderr, "git-hook: pre-push: no base tree found for %s; skipping large file check\n", p.remoteRef)
+		return nil
+	}
+	large := appendLargeAdditions(nil, beforeTree, afterTree, "", maxSize)
+	if len(large) == 0 {
+		return nil
+	}
+	var sb strings.Builder
+	for _, f := range large {
+		fmt.Fprintf(&sb, "\t%s: %d bytes (%0.1f MiB)\n", f.path, f.size, float64(f.size)/(1<<20))
+	}
+	return fmt.Errorf("push adds files larger than %d bytes:\n%sset %s=1 to push anyway", maxSize, sb.String(), skipLargeFileCheckEnv)
+}
+
+// findBaseTree returns the tree hash to diff the push against, or the
+// empty string if no suitable base is available locally. For updates to
+// an existing remote ref it uses the remote's old commit. For new refs
+// it falls back to the merge base with the remote's default branch.
+func findBaseTree(remoteName string, p push) string {
+	if p.remoteSHA != zeroRef {
+		if tree, err := treeOf(p.remoteSHA); err == nil {
+			return tree
+		}
+	}
+	for _, ref := range []string{
+		"refs/remotes/" + remoteName + "/HEAD",
+		"refs/remotes/" + remoteName + "/main",
+		"refs/remotes/" + remoteName + "/master",
+	} {
+		out, err := exec.Command("git", "merge-base", p.localSHA, ref).Output()
+		if err != nil {
+			continue
+		}
+		if tree, err := treeOf(strings.TrimSpace(string(out))); err == nil {
+			return tree
+		}
+	}
+	return ""
+}
+
+// treeOf resolves a git ref or commit to its tree hash.
+func treeOf(ref string) (string, error) {
+	out, err := exec.Command("git", "rev-parse", "--verify", ref+"^{tree}").Output()
+	if err != nil {
+		return "", err
+	}
+	return strings.TrimSpace(string(out)), nil
+}
+
+// treeEntry is a single entry from git ls-tree.
+type treeEntry struct {
+	mode string
+	typ  string // "blob", "tree", or "commit"
+	hash string
+	size int64 // -1 for non-blob entries
+	name string
+}
+
+// lsTree returns the entries of the given tree object.
+func lsTree(treeHash string) ([]treeEntry, error) {
+	out, err := exec.Command("git", "ls-tree", "-z", "--long", treeHash).Output()
+	if err != nil {
+		return nil, fmt.Errorf("git ls-tree %s: %v", treeHash, err)
+	}
+	var entries []treeEntry
+	for record := range bytes.SplitSeq(out, []byte{0}) {
+		if len(record) == 0 {
+			continue
+		}
+		// Format: "<mode> <type> <hash> <size>\t<name>"
+		metaPart, name, ok := bytes.Cut(record, []byte{'\t'})
+		if !ok {
+			continue
+		}
+		meta := strings.Fields(string(metaPart))
+		if len(meta) != 4 {
+			continue
+		}
+		var size int64 = -1
+		if meta[3] != "-" {
+			size, _ = strconv.ParseInt(meta[3], 10, 64)
+		}
+		entries = append(entries, treeEntry{
+			mode: meta[0],
+			typ:  meta[1],
+			hash: meta[2],
+			size: size,
+			name: string(name),
+		})
+	}
+	return entries, nil
+}
+
+type largeFile struct {
+	path string
+	size int64
+}
+
+// appendLargeAdditions walks two trees and returns dst plus any new or
+// changed blobs exceeding maxSize. If beforeHash is empty, all blobs in
+// afterHash are considered new. Unchanged subtrees are skipped without
+// recursing, so the walk only visits the changed parts of the tree.
+func appendLargeAdditions(dst []largeFile, beforeHash, afterHash, prefix string, maxSize int64) []largeFile {
+	afterEntries, err := lsTree(afterHash)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "git-hook: pre-push: %v\n", err)
+		return dst
+	}
+
+	var beforeByName map[string]treeEntry
+	if beforeHash != "" {
+		beforeEntries, err := lsTree(beforeHash)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "git-hook: pre-push: %v\n", err)
+		}
+		beforeByName = make(map[string]treeEntry, len(beforeEntries))
+		for _, e := range beforeEntries {
+			beforeByName[e.name] = e
+		}
+	}
+
+	for _, ae := range afterEntries {
+		if ae.mode == "160000" {
+			continue // skip submodules
+		}
+
+		be, inBefore := beforeByName[ae.name]
+
+		switch ae.typ {
+		case "tree":
+			if inBefore && be.hash == ae.hash {
+				continue // subtree unchanged
+			}
+			var beforeSub string
+			if inBefore && be.typ == "tree" {
+				beforeSub = be.hash
+			}
+			dst = appendLargeAdditions(dst, beforeSub, ae.hash, prefix+ae.name+"/", maxSize)
+		case "blob":
+			if inBefore && be.hash == ae.hash {
+				continue // blob unchanged
+			}
+			if ae.size > maxSize {
+				dst = append(dst, largeFile{path: prefix + ae.name, size: ae.size})
+			}
+		}
+	}
+	return dst
+}
diff --git a/misc/git_hook/githook/launcher.sh b/misc/git_hook/githook/launcher.sh
new file mode 100755
index 000000000..ba9f67dd9
--- /dev/null
+++ b/misc/git_hook/githook/launcher.sh
@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+# ts-git-hook launcher (installed at .git/hooks/ts-git-hook).
+#
+# Written by misc/add-git-hooks.go from the canonical copy embedded
+# in tailscale.com/misc/git_hook/githook. On every invocation it:
+#
+#   1. Compares the binary's reported version against the shared
+#      githook HOOK_VERSION (resolved via `go list -m tailscale.com`)
+#      plus the repo-local HOOK_VERSION.
+#   2. If stale or missing: rebuilds ts-git-hook-bin and runs
+#      `ts-git-hook-bin install`.
+#   3. Execs the binary with the hook's args.
+set -euo pipefail
+
+REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null)" || {
+  echo "git-hook: not in a git repo" >&2
+  exit 1
+}
+
+HOOK_DIR="$(git -C "$REPO_ROOT" rev-parse --git-path hooks)"
+case "$HOOK_DIR" in
+/*) ;;
+*) HOOK_DIR="$REPO_ROOT/$HOOK_DIR" ;;
+esac
+
+# Windows (Git for Windows / MSYS2) needs .exe suffixes.
+EXE=""
+case "$(uname -s)" in MINGW* | MSYS* | CYGWIN*) EXE=".exe" ;; esac
+
+BINARY="$HOOK_DIR/ts-git-hook-bin$EXE"
+
+GO="$REPO_ROOT/tool/go$EXE"
+if [ ! -x "$GO" ]; then GO=go; fi
+
+OSS_DIR="$(cd "$REPO_ROOT" && GOWORK=off "$GO" list -m -f '{{.Dir}}' tailscale.com 2>/dev/null || true)"
+SHARED_VER="$(cat "$OSS_DIR/misc/git_hook/githook/HOOK_VERSION" 2>/dev/null || echo 0)"
+LOCAL_VER="$(cat "$REPO_ROOT/misc/git_hook/HOOK_VERSION" 2>/dev/null || echo 0)"
+WANT="$SHARED_VER:$LOCAL_VER"
+HAVE="$("$BINARY" version 2>/dev/null || echo none)"
+
+if [ "$WANT" != "$HAVE" ]; then
+  echo "git-hook: rebuilding ts-git-hook-bin..." >&2
+  (cd "$REPO_ROOT" && GOWORK=off "$GO" build -o "$BINARY" ./misc/git_hook) || {
+    echo "git-hook: rebuild failed, run: ./tool/go run ./misc/add-git-hooks.go" >&2
+    exit 1
+  }
+  "$BINARY" install
+fi
+
+exec "$BINARY" "$@"
+
diff --git a/misc/git_hook/githook/pre-commit.go b/misc/git_hook/githook/pre-commit.go
new file mode 100644
index 000000000..30e4f6a9e
--- /dev/null
+++ b/misc/git_hook/githook/pre-commit.go
@@ -0,0 +1,62 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package githook
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"os/exec"
+
+	"github.com/fatih/color"
+	"github.com/sourcegraph/go-diff/diff"
+)
+
+var preCommitForbiddenPatterns = [][]byte{
+	// Concatenation avoids tripping the check on this file.
+	[]byte("NOCOM" + "MIT"),
+	[]byte("DO NOT " + "SUBMIT"),
+}
+
+// CheckForbiddenMarkers scans the staged diff for forbidden markers
+// and returns an error if any are found.
+//
+// Intended as a pre-commit hook.
+// https://git-scm.com/docs/githooks#_pre_commit
+func CheckForbiddenMarkers() error {
+	diffOut, err := exec.Command("git", "diff", "--cached").Output()
+	if err != nil {
+		return fmt.Errorf("could not get git diff: %w", err)
+	}
+
+	diffs, err := diff.ParseMultiFileDiff(diffOut)
+	if err != nil {
+		return fmt.Errorf("could not parse diff: %w", err)
+	}
+
+	foundForbidden := false
+	for _, d := range diffs {
+		for _, hunk := range d.Hunks {
+			lines := bytes.Split(hunk.Body, []byte{'\n'})
+			for i, line := range lines {
+				if len(line) == 0 || line[0] != '+' {
+					continue
+				}
+				for _, forbidden := range preCommitForbiddenPatterns {
+					if bytes.Contains(line, forbidden) {
+						if !foundForbidden {
+							color.New(color.Bold, color.FgRed, color.Underline).Printf("%s found:\n", forbidden)
+						}
+						fmt.Printf("%s:%d: %s\n", d.NewName[2:], int(hunk.NewStartLine)+i, line[1:])
+						foundForbidden = true
+					}
+				}
+			}
+		}
+	}
+	if foundForbidden {
+		return errors.New("found forbidden string")
+	}
+	return nil
+}
diff --git a/misc/git_hook/githook/pre-push.go b/misc/git_hook/githook/pre-push.go
new file mode 100644
index 000000000..b3eeb358d
--- /dev/null
+++ b/misc/git_hook/githook/pre-push.go
@@ -0,0 +1,116 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package githook
+
+import (
+	"bufio"
+	"fmt"
+	"os"
+	"os/exec"
+	"slices"
+	"strings"
+
+	"golang.org/x/mod/modfile"
+)
+
+// PrePushConfig configures CheckPrePush.
+type PrePushConfig struct {
+	// WatchedRemotes are the remote URLs whose pushes are subject to
+	// the go.mod replace check.
+	WatchedRemotes []string
+
+	// AllowedReplaceDirs are the directory-path go.mod replace targets
+	// that are permitted in pushed commits.
+	AllowedReplaceDirs []string
+
+	// MaxBlobSize, if positive, is the largest new or changed blob in
+	// bytes allowed in a push to any remote. Pushes adding larger
+	// blobs are rejected unless the TS_SKIP_LARGE_FILE_CHECK
+	// environment variable is set to a non-empty value.
+	MaxBlobSize int64
+}
+
+// CheckPrePush reads pushes from stdin and validates them per cfg.
+// args is the pre-push hook's argv (remoteName, remoteLoc).
+//
+// Intended as a pre-push hook.
+// https://git-scm.com/docs/githooks#_pre_push
+func CheckPrePush(args []string, cfg PrePushConfig) error {
+	if len(args) < 2 {
+		return fmt.Errorf("pre-push: expected 2 args, got %d", len(args))
+	}
+	remoteName, remoteLoc := args[0], args[1]
+
+	pushes, err := readPushes()
+	if err != nil {
+		return fmt.Errorf("reading pushes: %w", err)
+	}
+	watched := slices.Contains(cfg.WatchedRemotes, remoteLoc)
+	for _, p := range pushes {
+		if watched && !p.isDoNotMergeRef() {
+			if err := checkCommit(p.localSHA, cfg.AllowedReplaceDirs); err != nil {
+				return fmt.Errorf("not allowing push of %v to %v: %v", p.localSHA, p.remoteRef, err)
+			}
+		}
+		if cfg.MaxBlobSize > 0 {
+			if err := checkLargeBlobs(remoteName, p, cfg.MaxBlobSize); err != nil {
+				return fmt.Errorf("not allowing push of %v to %v: %v", p.localSHA, p.remoteRef, err)
+			}
+		}
+	}
+	return nil
+}
+
+func checkCommit(sha string, allowedReplaceDirs []string) error {
+	if sha == zeroRef {
+		// Allow ref deletions.
+		return nil
+	}
+	goMod, err := exec.Command("git", "show", sha+":go.mod").Output()
+	if err != nil {
+		return err
+	}
+	mf, err := modfile.Parse("go.mod", goMod, nil)
+	if err != nil {
+		return fmt.Errorf("failed to parse its go.mod: %v", err)
+	}
+	for _, r := range mf.Replace {
+		if !modfile.IsDirectoryPath(r.New.Path) {
+			continue
+		}
+		allowed := slices.Contains(allowedReplaceDirs, r.New.Path)
+		if !allowed {
+			return fmt.Errorf("go.mod contains replace from %v => %v", r.Old.Path, r.New.Path)
+		}
+	}
+	return nil
+}
+
+const zeroRef = "0000000000000000000000000000000000000000"
+
+type push struct {
+	localRef  string
+	localSHA  string
+	remoteRef string
+	remoteSHA string
+}
+
+func (p *push) isDoNotMergeRef() bool {
+	return strings.HasSuffix(p.remoteRef, "/DO-NOT-MERGE")
+}
+
+func readPushes() (pushes []push, err error) {
+	bs := bufio.NewScanner(os.Stdin)
+	for bs.Scan() {
+		f := strings.Fields(bs.Text())
+		if len(f) != 4 {
+			return nil, fmt.Errorf("unexpected push line %q", bs.Text())
+		}
+		pushes = append(pushes, push{f[0], f[1], f[2], f[3]})
+	}
+	if err := bs.Err(); err != nil {
+		return nil, err
+	}
+	return pushes, nil
+}
diff --git a/misc/install-git-hooks.go b/misc/install-git-hooks.go
deleted file mode 100644
index c66ecb8f8..000000000
--- a/misc/install-git-hooks.go
+++ /dev/null
@@ -1,82 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-//go:build ignore
-
-// The install-git-hooks program installs git hooks.
-//
-// It installs a Go binary at .git/hooks/ts-git-hook and a pre-hook
-// forwarding shell wrapper to .git/hooks/NAME.
-package main
-
-import (
-	"fmt"
-	"log"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"runtime"
-	"strings"
-)
-
-var hooks = []string{
-	"pre-push",
-	"pre-commit",
-	"commit-msg",
-	"post-checkout",
-}
-
-func fatalf(format string, a ...any) {
-	log.SetFlags(0)
-	log.Fatalf("install-git-hooks: "+format, a...)
-}
-
-func main() {
-	out, err := exec.Command("git", "rev-parse", "--git-common-dir").CombinedOutput()
-	if err != nil {
-		fatalf("finding git dir: %v, %s", err, out)
-	}
-	gitDir := strings.TrimSpace(string(out))
-
-	hookDir := filepath.Join(gitDir, "hooks")
-	if fi, err := os.Stat(hookDir); err != nil {
-		fatalf("checking hooks dir: %v", err)
-	} else if !fi.IsDir() {
-		fatalf("%s is not a directory", hookDir)
-	}
-
-	buildOut, err := exec.Command(goBin(), "build",
-		"-o", filepath.Join(hookDir, "ts-git-hook"+exe()),
-		"./misc/git_hook").CombinedOutput()
-	if err != nil {
-		log.Fatalf("go build git-hook: %v, %s", err, buildOut)
-	}
-
-	for _, hook := range hooks {
-		content := fmt.Sprintf(hookScript, hook)
-		file := filepath.Join(hookDir, hook)
-		// Install the hook. If it already exists, overwrite it, in case there's
-		// been changes.
-		if err := os.WriteFile(file, []byte(content), 0755); err != nil {
-			fatalf("%v", err)
-		}
-	}
-}
-
-const hookScript = `#!/usr/bin/env bash
-exec "$(dirname ${BASH_SOURCE[0]})/ts-git-hook" %s "$@"
-`
-
-func goBin() string {
-	if p, err := exec.LookPath("go"); err == nil {
-		return p
-	}
-	return "go"
-}
-
-func exe() string {
-	if runtime.GOOS == "windows" {
-		return ".exe"
-	}
-	return ""
-}
diff --git a/net/art/table.go b/net/art/table.go
index 447a56b39..43862f7c6 100644
--- a/net/art/table.go
+++ b/net/art/table.go
@@ -553,10 +553,7 @@ func computePrefixSplit(a, b netip.Prefix) (lastCommon netip.Prefix, aStride, bS
 		panic("computePrefixSplit called with mismatched address families")
 	}
 
-	minPrefixLen := a.Bits()
-	if b.Bits() < minPrefixLen {
-		minPrefixLen = b.Bits()
-	}
+	minPrefixLen := min(b.Bits(), a.Bits())
 
 	commonBits := commonBits(a.Addr(), b.Addr(), minPrefixLen)
 	// We want to know how many 8-bit strides are shared between a and
diff --git a/net/bakedroots/bakedroots.go b/net/bakedroots/bakedroots.go
index 70d947c6b..84978995f 100644
--- a/net/bakedroots/bakedroots.go
+++ b/net/bakedroots/bakedroots.go
@@ -15,13 +15,11 @@ import (
 
 // Get returns the baked-in roots.
 //
-// As of 2025-01-21, this includes only the LetsEncrypt ISRG Root X1 & X2 roots.
+// As of 2026-07-20, this includes only the LetsEncrypt ISRG roots:
+// the Generation X roots (X1 & X2) and the Generation Y roots (YE & YR).
 func Get() *x509.CertPool {
 	roots.once.Do(func() {
-		roots.parsePEM(append(
-			[]byte(letsEncryptX1),
-			letsEncryptX2...,
-		))
+		roots.parsePEM([]byte(letsEncryptX1 + letsEncryptX2 + letsEncryptYE + letsEncryptYR))
 	})
 	return roots.p
 }
@@ -145,3 +143,63 @@ tL4ndQavEi51mI38AjEAi/V3bNTIZargCyzuFJ0nN6T5U6VR5CmD1/iQMVtCnwr1
 /q4AaOeMSQ+2b1tbFfLn
 -----END CERTIFICATE-----
 `
+
+// letsEncryptYE is the ISRG Root YE, part of LetsEncrypt's
+// "Generation Y" hierarchy announced 2025-11-24.
+//
+// Subject: C = US, O = ISRG, CN = Root YE
+// Key type: ECDSA P-384
+// Validity: 2025-09-03 to 2045-09-02
+const letsEncryptYE = `
+-----BEGIN CERTIFICATE-----
+MIIB2TCCAWCgAwIBAgIRAKQCa6LvbHwg1AR+XmWmk4AwCgYIKoZIzj0EAwMwLjEL
+MAkGA1UEBhMCVVMxDTALBgNVBAoTBElTUkcxEDAOBgNVBAMTB1Jvb3QgWUUwHhcN
+MjUwOTAzMDAwMDAwWhcNNDUwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsG
+A1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZRTB2MBAGByqGSM49AgEGBSuBBAAi
+A2IABDwS/6vhrcVqcbBo+wgdI3fwn9x7DNJJOY/lTOti0vkwuRN87RhEhTH17E7X
+yFjWsPYhIPt/wzOqxTd2b+4ZJNy9ID04YywF9U5zasDVyGSNErVNtz8uSGh5izW8
+7j77GaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O
+BBYEFKPIJlqOoUzQNWP8myPIOq5W809WMAoGCCqGSM49BAMDA2cAMGQCMHhMr8N9
+LdL1VQKs9BdV81r76eXRB6mtjuNjzk6/lBsPNToWLTDzGYgtQKO1jl63uAIwGV7m
+onyF377c+MM1oqVNs17sgu7F9YKZwgLmVbeOMDbKAXHtKMDLbiGllCcs8f47
+-----END CERTIFICATE-----
+`
+
+// letsEncryptYR is the ISRG Root YR, part of LetsEncrypt's
+// "Generation Y" hierarchy announced 2025-11-24.
+//
+// Subject: C = US, O = ISRG, CN = Root YR
+// Key type: RSA 4096
+// Validity: 2025-09-03 to 2045-09-02
+const letsEncryptYR = `
+-----BEGIN CERTIFICATE-----
+MIIFKTCCAxGgAwIBAgIRAOxGNJNgz0sP+KmC2Tqpyj0wDQYJKoZIhvcNAQELBQAw
+LjELMAkGA1UEBhMCVVMxDTALBgNVBAoTBElTUkcxEDAOBgNVBAMTB1Jvb3QgWVIw
+HhcNMjUwOTAzMDAwMDAwWhcNNDUwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzEN
+MAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZUjCCAiIwDQYJKoZIhvcNAQEB
+BQADggIPADCCAgoCggIBANvGJnN78CTJdWL3+eGfsLN5TrNBJs+VH9hRXqRbwxu9
+sGNiB0BD1fcOxbSUQCJIM1xE13Db+5Cw1w0s0EBYsvuIP/6joF0w8cuImbgR1OGg
+YbSQ4OpzI+DG8SGuTlcE873OCS+kh3srlo6vl43M5OJg4Aeo1sfHp6kTJDoIiFBN
+JAY+OKfX/FUvYKuhjT+no49lmqmupSBI5PkBQiqrEGtWU5uxU/cQWHGu8jSjFBzn
+ZqvbNPLMXMLFxCb3WTfrJBXXjqvWG+v4bjzxjjeAtOlU7qarRDvNOyAuQYLln904
+M+faKx8hnLCpJ15ZqaEgcNlY+9MMWcC5yvL2A2j3l9+2buggZX+dOE91zYmIdawT
+vSZuVvlbRrAlLxIB6pwMBjneXCjYQ8+3BCCjssbSNpZU3hTcBDdhfAlEDlYr6pEa
+tnMdmDT5BqnKC92bd0EhM1fbLHioLccLCuievT8ZkPhZrq7Mii7gNXAcUEAR8+lz
+Yal+9zTg7C5DALyVOeG/CqfRAMn1KSHCR0NSA6P8tn/mGRlnCct5rtVCLnVySVpU
+6H1qGg3DgTOuskf8eahTMiYbI5ezPJmO5ertalskQ1utp74+eDy92PI4ftHKTbq9
+IWhH4YZKh3WnJEIt+oQvlYZbY8tpEroKrFB6PFGzrJIDRyts4HqvuH52RFj2zv/B
+AgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1Ud
+DgQWBBTe51tg0CJtQCh9Pw0B/qS1UrRRlDANBgkqhkiG9w0BAQsFAAOCAgEAWHnf
+713Bdkq7t5yN2dNIgQakUb94X9WuyhMEHHkgx4oDpSUlnG0w4g94MoqaEUE31ZjR
+LU7L5LD1g9ujFHTQu8AD215AHMVQFbm6j8hQxdXHAzDajFNQnOlDJrLjzIx176oy
+AjvUtejZx2NNmdb5fd0WGVGsCdoAJ3N8ozo7ajE8t6vfxStZb4BQ9WYJGHUDrv2N
+i5tJF6CNiPnlzs3BUfECRbE4JSk+jvy8+VoGiFE8qsH/j78x2fjgQhAQFV7P7Zxy
+dBTZ1wEkNpZNW2qnaK1SKBLa+xf6E06YRIq5uaI+HWH8SY1y5VbRgzq40EKg3yxP
+06fz+uYAUIFJoLNfhwRCc3Q6pQVuMX3yAjHAes4gk4moGcLQ5p7HAh39yeylZc1J
+41sx/jKwLIkPE6Rr1Nf4pxdsxf9SA4yOEiAkDgq04DVxn8hgYFdUtBCuiuVC2heA
+EiqVEa+8QZjuw8Gj0EbHXcRd1nInvGqRS1o9Is7YBdQN57X1AYveGBNNqjICSb7c
+awuw1EawTDrs13VUlJVEsbQ0/O/1aaV73mCdOQ8azqL2KTv1Ewu1xbquE2S+kdQU
+To9TUwat3wUA6cwXh1EfpS/3fJ0aGah5hdpRyoCLDlsSn8tkrjMfFFX0viC+GxHc
+sI1ANRYvqSFC2X1VRZfDg+wD6E21BccmifG4yWc=
+-----END CERTIFICATE-----
+`
diff --git a/net/bakedroots/bakedroots_test.go b/net/bakedroots/bakedroots_test.go
index 12a656d4e..a5a6193e1 100644
--- a/net/bakedroots/bakedroots_test.go
+++ b/net/bakedroots/bakedroots_test.go
@@ -4,16 +4,23 @@
 package bakedroots
 
 import (
+	"crypto/tls"
+	"flag"
+	"io"
+	"net/http"
 	"slices"
 	"testing"
+	"time"
+
+	"tailscale.com/util/cibuild"
 )
 
 func TestBakedInRoots(t *testing.T) {
 	ResetForTest(t, nil)
 	p := Get()
 	got := p.Subjects()
-	if len(got) != 2 {
-		t.Errorf("subjects = %v; want 2", len(got))
+	if len(got) != 4 {
+		t.Errorf("subjects = %v; want 4", len(got))
 	}
 
 	// TODO(bradfitz): is there a way to easily make this test prettier without
@@ -25,8 +32,49 @@ func TestBakedInRoots(t *testing.T) {
 	want := []string{
 		"0O1\v0\t\x06\x03U\x04\x06\x13\x02US1)0'\x06\x03U\x04\n\x13 Internet Security Research Group1\x150\x13\x06\x03U\x04\x03\x13\fISRG Root X1",
 		"0O1\v0\t\x06\x03U\x04\x06\x13\x02US1)0'\x06\x03U\x04\n\x13 Internet Security Research Group1\x150\x13\x06\x03U\x04\x03\x13\fISRG Root X2",
+		"0.1\v0\t\x06\x03U\x04\x06\x13\x02US1\r0\v\x06\x03U\x04\n\x13\x04ISRG1\x100\x0e\x06\x03U\x04\x03\x13\aRoot YE",
+		"0.1\v0\t\x06\x03U\x04\x06\x13\x02US1\r0\v\x06\x03U\x04\n\x13\x04ISRG1\x100\x0e\x06\x03U\x04\x03\x13\aRoot YR",
 	}
 	if !slices.Equal(name, want) {
 		t.Errorf("subjects = %q; want %q", name, want)
 	}
 }
+
+var runLiveLetsEncryptTest = flag.Bool("run-live-lets-encrypt-test", cibuild.On(),
+	"run tests that hit LetsEncrypt's live test-certs endpoints over the network")
+
+// TestLiveLetsEncrypt verifies that the baked-in roots alone (without any
+// system roots) are sufficient to validate the certificate chains served by
+// LetsEncrypt's per-root test endpoints.
+func TestLiveLetsEncrypt(t *testing.T) {
+	if !*runLiveLetsEncryptTest {
+		t.Skip("skipping live network test; set --run-live-lets-encrypt-test to run")
+	}
+	ResetForTest(t, nil)
+
+	for _, host := range []string{
+		"valid.ye.test-certs.letsencrypt.org",
+		"valid.yr.test-certs.letsencrypt.org",
+		"valid.x2.test-certs.letsencrypt.org",
+		"valid.x1.test-certs.letsencrypt.org",
+	} {
+		t.Run(host, func(t *testing.T) {
+			c := &http.Client{
+				Timeout: 30 * time.Second,
+				Transport: &http.Transport{
+					DisableKeepAlives: true,
+					TLSClientConfig: &tls.Config{
+						RootCAs: Get(), // baked-in roots only; no system roots
+					},
+				},
+			}
+			res, err := c.Get("https://" + host + "/")
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer res.Body.Close()
+			io.Copy(io.Discard, res.Body)
+			t.Logf("status: %v", res.Status)
+		})
+	}
+}
diff --git a/net/batching/conn_default.go b/net/batching/conn_default.go
index 77c4c8b6a..922a6a358 100644
--- a/net/batching/conn_default.go
+++ b/net/batching/conn_default.go
@@ -6,11 +6,12 @@
 package batching
 
 import (
+	"tailscale.com/control/controlknobs"
 	"tailscale.com/types/nettype"
 )
 
 // TryUpgradeToConn is no-op on all platforms except linux.
-func TryUpgradeToConn(pconn nettype.PacketConn, _ string, _ int, _ string) nettype.PacketConn {
+func TryUpgradeToConn(pconn nettype.PacketConn, _ string, _ int, _ string, _ *controlknobs.Knobs) nettype.PacketConn {
 	return pconn
 }
 
diff --git a/net/batching/conn_linux.go b/net/batching/conn_linux.go
index ea11f439a..f094f4b65 100644
--- a/net/batching/conn_linux.go
+++ b/net/batching/conn_linux.go
@@ -20,6 +20,8 @@ import (
 	"golang.org/x/net/ipv4"
 	"golang.org/x/net/ipv6"
 	"golang.org/x/sys/unix"
+	"tailscale.com/control/controlknobs"
+	"tailscale.com/envknob"
 	"tailscale.com/hostinfo"
 	"tailscale.com/net/neterror"
 	"tailscale.com/net/packet"
@@ -58,6 +60,12 @@ type linuxBatchingConn struct {
 	txOffload          atomic.Bool // supports UDP GSO or similar
 	sendBatchPool      sync.Pool
 	rxqOverflowsMetric *clientmetric.Metric
+	// neverGSOEqualTail, when non-nil and true, enables a sentinel-tail
+	// workaround in the UDP GSO TX path. It points at a
+	// [controlknobs.Knobs.NeverGSOEqualTail] field so the value can be
+	// toggled live via the control plane without requiring a socket rebind.
+	// It is read once per write at the top of [linuxBatchingConn.WriteBatchTo].
+	neverGSOEqualTail *atomic.Bool
 
 	// readOpMu guards read operations that must perform accounting against
 	// rxqOverflows in single-threaded fashion. There are no concurrent usages
@@ -105,6 +113,12 @@ const (
 	maxIPv6PayloadLen = 1<<16 - 1 - 8
 )
 
+// neverGSOEqualTailSentinelPayload is appended to UDP GSO packet batches under
+// certain conditions in order to workaround Linux kernel UDP GSO bugs. In the
+// case of magicsock, 0x07 is handled as WireGuard, and wireguard-go silently
+// drops the packet as it's less than [device.MinMessageSize].
+var neverGSOEqualTailSentinelPayload = []byte{0x07}
+
 // coalesceMessages iterates 'buffs', setting and coalescing them in 'msgs'
 // where possible while maintaining datagram order.
 //
@@ -118,20 +132,44 @@ const (
 //
 // All msgs[i].Buffers[0] are preceded by a Geneve header (geneve) if geneve.VNI.IsSet().
 //
+// neverGSOEqualTail, when true, enables the sentinel-tail workaround. It is
+// loaded by the caller and passed in so a single coalesceMessages call sees a
+// consistent value even if the underlying control knob flips concurrently.
+//
 // TODO(illotum) explore MSG_ZEROCOPY for large writes (>10KB).
-func (c *linuxBatchingConn) coalesceMessages(addr *net.UDPAddr, geneve packet.GeneveHeader, buffs [][]byte, msgs []ipv6.Message, offset int) int {
+func (c *linuxBatchingConn) coalesceMessages(addr *net.UDPAddr, geneve packet.GeneveHeader, buffs [][]byte, msgs []ipv6.Message, offset int, neverGSOEqualTail bool) int {
 	var (
-		base         = -1 // index of msg we are currently coalescing into
-		gsoSize      int  // segmentation size of msgs[base]
-		dgramCnt     int  // number of dgrams coalesced into msgs[base]
-		endBatch     bool // tracking flag to start a new batch on next iteration of buffs
-		coalescedLen int  // bytes coalesced into msgs[base]
+		base                     = -1 // index of msg we are currently coalescing into
+		gsoSize                  int  // segmentation size of msgs[base]
+		dgramCnt                 int  // number of dgrams coalesced into msgs[base]
+		endBatchDueToSmallerTail bool // tracking flag to start a new batch on next iteration of buffs
+		coalescedLen             int  // bytes coalesced into msgs[base]
 	)
 	maxPayloadLen := maxIPv4PayloadLen
 	if addr.IP.To4() == nil {
 		maxPayloadLen = maxIPv6PayloadLen
 	}
+	maxDatagramsPerGSOBatch := udpSegmentMaxDatagrams
+	if neverGSOEqualTail {
+		// If neverGSOEqualTail is set we might end up appending a sentinel 1-byte
+		// payload, so we must leave space in our accounting.
+		maxDatagramsPerGSOBatch -= 1
+		maxPayloadLen -= len(neverGSOEqualTailSentinelPayload)
+	}
 	vniIsSet := geneve.VNI.IsSet()
+
+	maybeAppendSentinelTail := func() {
+		if !neverGSOEqualTail || endBatchDueToSmallerTail {
+			// If neverGSOEqualTail is unset we should never append a sentinel
+			// payload as we are running on an unaffected kernel. Or, if we
+			// already have a smaller-than-GSO sized tail, there is no need, since
+			// the kernel bug we are avoiding only triggers when all fragments
+			// are equal in length.
+			return
+		}
+		msgs[base].Buffers = append(msgs[base].Buffers, neverGSOEqualTailSentinelPayload)
+	}
+
 	for i, buff := range buffs {
 		if vniIsSet {
 			geneve.Encode(buff)
@@ -140,32 +178,48 @@ func (c *linuxBatchingConn) coalesceMessages(addr *net.UDPAddr, geneve packet.Ge
 		}
 		if i > 0 {
 			msgLen := len(buff)
+			// okToCoalesceWithSentinel ensures we never coalesce if a sentinel
+			// 1-byte payload might be required, but gsoSize (or more specifically
+			// UDP payload length) is also 1. The whole point of appending a sentinel
+			// 1-byte payload is to append a smaller-than-GSO tail.
+			//
+			// This is defensive as a 1-byte payload, at the time of writing
+			// (2026-05-28), is unlikely to occur. The smallest WireGuard
+			// message size is 32 bytes ([device.MinMessageSize]), and the
+			// [disco.Message] header is 62 bytes.
+			//
+			// It's also overly conservative as it checks for msgLen == 1, but a
+			// msgLen of 1 on the tail where gsoSize is greater would also be fine.
+			okToCoalesceWithSentinel := !neverGSOEqualTail || msgLen > len(neverGSOEqualTailSentinelPayload)
 			if msgLen+coalescedLen <= maxPayloadLen &&
 				msgLen <= gsoSize &&
-				dgramCnt < udpSegmentMaxDatagrams &&
-				!endBatch {
+				dgramCnt < maxDatagramsPerGSOBatch &&
+				!endBatchDueToSmallerTail &&
+				okToCoalesceWithSentinel {
 				// msgs[base].Buffers[0] is set to buff[i] when a new base is set.
 				// This appends a struct iovec element in the underlying struct msghdr (scatter-gather).
 				msgs[base].Buffers = append(msgs[base].Buffers, buff)
-				if i == len(buffs)-1 {
-					setGSOSizeInControl(&msgs[base].OOB, uint16(gsoSize))
-				}
 				dgramCnt++
 				coalescedLen += msgLen
 				if msgLen < gsoSize {
 					// A smaller than gsoSize packet on the tail is legal, but
 					// it must end the batch.
-					endBatch = true
+					endBatchDueToSmallerTail = true
+				}
+				if i == len(buffs)-1 {
+					maybeAppendSentinelTail()
+					setGSOSizeInControl(&msgs[base].OOB, uint16(gsoSize))
 				}
 				continue
 			}
 		}
 		if dgramCnt > 1 {
+			maybeAppendSentinelTail()
 			setGSOSizeInControl(&msgs[base].OOB, uint16(gsoSize))
 		}
 		// Reset prior to incrementing base since we are preparing to start a
 		// new potential batch.
-		endBatch = false
+		endBatchDueToSmallerTail = false
 		base++
 		gsoSize = len(buff)
 		msgs[base].OOB = msgs[base].OOB[:0]
@@ -197,6 +251,27 @@ func (c *linuxBatchingConn) putSendBatch(batch *sendBatch) {
 	c.sendBatchPool.Put(batch)
 }
 
+// appendSentinelTailBatchSizeThreshold represents the minimum batch size
+// required to enter [linuxBatchingConn.coalesceMessages] when
+// [linuxBatchingConn.neverGSOEqualTail] is set. If the batch of packets is less
+// than this value, and neverGSOEqualTail is set, we avoid UDP GSO altogether.
+// Appending a sentinel packet, regardless of size, is still overhead on sender,
+// middle network, and receiver.
+//
+// Coalescing (UDP GSO) greatly improves performance for sender (and receiver if
+// they support UDP GRO), but there are diminishing returns if batches are small.
+// We attempt to balance these diminishing returns against the introduction of
+// dead-weight sentinel packets.
+//
+// The initial value of 8 is a power of 2, and in the worst case leads to 6%
+// payload overhead if the batch is made up of minimum-sized WireGuard transport
+// messages (empty payload keepalives). Worst case is unlikely.
+//
+// 8 * (20 bytes IPv4 header + 8 byte UDP header + 32 byte WG message) = 480 bytes
+// sentinel tail is 20 byte IPv4 header + 8 byte UDP header + 1 byte payload = 29 bytes
+// 29/480 = 0.060...
+const appendSentinelTailBatchSizeThreshold = 8
+
 func (c *linuxBatchingConn) WriteBatchTo(buffs [][]byte, addr netip.AddrPort, geneve packet.GeneveHeader, offset int) error {
 	batch := c.getSendBatch()
 	defer c.putSendBatch(batch)
@@ -210,23 +285,31 @@ func (c *linuxBatchingConn) WriteBatchTo(buffs [][]byte, addr netip.AddrPort, ge
 		batch.ua.IP = batch.ua.IP[:4]
 	}
 	batch.ua.Port = int(addr.Port())
+	// Load the control knob once per write so a single call sees a consistent
+	// value even if the knob flips concurrently.
+	neverGSOEqualTail := c.neverGSOEqualTail != nil && c.neverGSOEqualTail.Load()
 	var (
 		n       int
 		retried bool
 	)
 retry:
-	if c.txOffload.Load() {
-		n = c.coalesceMessages(batch.ua, geneve, buffs, batch.msgs, offset)
+	if c.txOffload.Load() && (!neverGSOEqualTail || len(buffs) >= appendSentinelTailBatchSizeThreshold) {
+		n = c.coalesceMessages(batch.ua, geneve, buffs, batch.msgs, offset, neverGSOEqualTail)
 	} else {
+		mutableOffset := offset // don't mutate offset across retries
 		vniIsSet := geneve.VNI.IsSet()
 		if vniIsSet {
-			offset -= packet.GeneveFixedHeaderLength
+			mutableOffset -= packet.GeneveFixedHeaderLength
 		}
 		for i := range buffs {
 			if vniIsSet {
 				geneve.Encode(buffs[i])
 			}
-			batch.msgs[i].Buffers[0] = buffs[i][offset:]
+			batch.msgs[i].Buffers[0] = buffs[i][mutableOffset:]
+			// Buffers length may be > 1 (scatter-gather) if we passed through
+			// coalesceMessages during a first pass, and landed here as part of
+			// goto retry.
+			batch.msgs[i].Buffers = batch.msgs[i].Buffers[:1]
 			batch.msgs[i].Addr = batch.ua
 			batch.msgs[i].OOB = batch.msgs[i].OOB[:0]
 		}
@@ -425,18 +508,29 @@ func tryEnableRXQOverflowsCounter(pconn nettype.PacketConn) (enabled bool) {
 }
 
 // tryEnableUDPOffload attempts to enable the UDP_GRO socket option on pconn,
-// and returns two booleans indicating TX and RX UDP offload support.
-func tryEnableUDPOffload(pconn nettype.PacketConn) (hasTX bool, hasRX bool) {
+// and returns two booleans indicating TX and RX UDP offload support. If knobs
+// is non-nil, UDP GSO and/or UDP GRO may be disabled via control-plane node
+// attributes.
+func tryEnableUDPOffload(pconn nettype.PacketConn, knobs *controlknobs.Knobs) (hasTX bool, hasRX bool) {
+	disableGSO := envknob.Bool("TS_DEBUG_DISABLE_UDP_GSO") ||
+		(knobs != nil && knobs.DisableUDPGSO.Load())
+	disableGRO := envknob.Bool("TS_DEBUG_DISABLE_UDP_GRO") ||
+		(knobs != nil && knobs.DisableUDPGRO.Load())
 	if c, ok := pconn.(*net.UDPConn); ok {
 		rc, err := c.SyscallConn()
 		if err != nil {
 			return
 		}
 		err = rc.Control(func(fd uintptr) {
-			_, errSyscall := syscall.GetsockoptInt(int(fd), unix.IPPROTO_UDP, unix.UDP_SEGMENT)
-			hasTX = errSyscall == nil
-			errSyscall = syscall.SetsockoptInt(int(fd), unix.IPPROTO_UDP, unix.UDP_GRO, 1)
-			hasRX = errSyscall == nil
+			var errSyscall error
+			if !disableGSO {
+				_, errSyscall = syscall.GetsockoptInt(int(fd), unix.IPPROTO_UDP, unix.UDP_SEGMENT)
+				hasTX = errSyscall == nil
+			}
+			if !disableGRO {
+				errSyscall = syscall.SetsockoptInt(int(fd), unix.IPPROTO_UDP, unix.UDP_GRO, 1)
+				hasRX = errSyscall == nil
+			}
 		})
 		if err != nil {
 			return false, false
@@ -512,8 +606,9 @@ func getRXQOverflowsMetric(name string) *clientmetric.Metric {
 // pconn to a [Conn] if appropriate. A batch size of [IdealBatchSize] is
 // suggested for the best performance. If len(rxqOverflowsMetricName) is
 // nonzero, then read ops will propagate the SO_RXQ_OVFL control message counter
-// to a clientmetric with the supplied name.
-func TryUpgradeToConn(pconn nettype.PacketConn, network string, batchSize int, rxqOverflowsMetricName string) nettype.PacketConn {
+// to a clientmetric with the supplied name. If knobs is non-nil, UDP GSO
+// and/or UDP GRO may be disabled via control-plane node attributes.
+func TryUpgradeToConn(pconn nettype.PacketConn, network string, batchSize int, rxqOverflowsMetricName string, knobs *controlknobs.Knobs) nettype.PacketConn {
 	if runtime.GOOS != "linux" {
 		// Exclude Android.
 		return pconn
@@ -521,7 +616,8 @@ func TryUpgradeToConn(pconn nettype.PacketConn, network string, batchSize int, r
 	if network != "udp4" && network != "udp6" {
 		return pconn
 	}
-	if strings.HasPrefix(hostinfo.GetOSVersion(), "2.") {
+	osVer := hostinfo.GetOSVersion()
+	if strings.HasPrefix(osVer, "2.") {
 		// recvmmsg/sendmmsg were added in 2.6.33, but we support down to
 		// 2.6.32 for old NAS devices. See https://github.com/tailscale/tailscale/issues/6807.
 		// As a cheap heuristic: if the Linux kernel starts with "2", just
@@ -563,8 +659,11 @@ func TryUpgradeToConn(pconn nettype.PacketConn, network string, batchSize int, r
 		panic("bogus network")
 	}
 	var txOffload bool
-	txOffload, b.rxOffload = tryEnableUDPOffload(uc)
+	txOffload, b.rxOffload = tryEnableUDPOffload(uc, knobs)
 	b.txOffload.Store(txOffload)
+	if knobs != nil {
+		b.neverGSOEqualTail = &knobs.NeverGSOEqualTail
+	}
 	if len(rxqOverflowsMetricName) > 0 && tryEnableRXQOverflowsCounter(uc) {
 		// Don't register the metric unless the socket option has been
 		// successfully set, otherwise we will report a misleading zero value
diff --git a/net/batching/conn_linux_test.go b/net/batching/conn_linux_test.go
index fa4eef33c..633e5d607 100644
--- a/net/batching/conn_linux_test.go
+++ b/net/batching/conn_linux_test.go
@@ -5,9 +5,14 @@ package batching
 
 import (
 	"encoding/binary"
+	"errors"
 	"io"
 	"math"
 	"net"
+	"net/netip"
+	"os"
+	"sync"
+	"sync/atomic"
 	"testing"
 	"unsafe"
 
@@ -15,6 +20,7 @@ import (
 	"github.com/tailscale/wireguard-go/conn"
 	"golang.org/x/net/ipv6"
 	"golang.org/x/sys/unix"
+	"tailscale.com/net/neterror"
 	"tailscale.com/net/packet"
 )
 
@@ -140,8 +146,6 @@ func Test_linuxBatchingConn_splitCoalescedMessages(t *testing.T) {
 }
 
 func Test_linuxBatchingConn_coalesceMessages(t *testing.T) {
-	c := &linuxBatchingConn{}
-
 	withGeneveSpace := func(len, cap int) []byte {
 		return make([]byte, len+packet.GeneveFixedHeaderLength, cap+packet.GeneveFixedHeaderLength)
 	}
@@ -152,13 +156,17 @@ func Test_linuxBatchingConn_coalesceMessages(t *testing.T) {
 	geneve.VNI.Set(1)
 
 	cases := []struct {
-		name   string
-		buffs  [][]byte
-		geneve packet.GeneveHeader
+		name              string
+		buffs             [][]byte
+		geneve            packet.GeneveHeader
+		neverGSOEqualTail bool
 		// Each wantLens slice corresponds to the Buffers of a single coalesced message,
 		// and each int is the expected length of the corresponding Buffer[i].
 		wantLens [][]int
 		wantGSO  []int
+		// wantSentinelAtTail[i], when true, asserts that the tail entry of
+		// msgs[i].Buffers is the shared neverGSOEqualTailSentinelPayload slice.
+		wantSentinelAtTail []bool
 	}{
 		{
 			name: "one-message-no-coalesce",
@@ -257,10 +265,113 @@ func Test_linuxBatchingConn_coalesceMessages(t *testing.T) {
 			wantLens: [][]int{{2 + packet.GeneveFixedHeaderLength, 2 + packet.GeneveFixedHeaderLength, 2 + packet.GeneveFixedHeaderLength}},
 			wantGSO:  []int{2 + packet.GeneveFixedHeaderLength},
 		},
+		{
+			name: "two-equal-len-coalesce-neverGSOEqualTail-appends-sentinel",
+			buffs: [][]byte{
+				withGeneveSpace(3, 3),
+				withGeneveSpace(3, 3),
+			},
+			neverGSOEqualTail:  true,
+			wantLens:           [][]int{{3, 3, len(neverGSOEqualTailSentinelPayload)}},
+			wantGSO:            []int{3},
+			wantSentinelAtTail: []bool{true},
+		},
+		{
+			name: "two-equal-len-coalesce-neverGSOEqualTail-vni-isSet-appends-sentinel",
+			buffs: [][]byte{
+				withGeneveSpace(3, 3+packet.GeneveFixedHeaderLength),
+				withGeneveSpace(3, 3),
+			},
+			geneve:             geneve,
+			neverGSOEqualTail:  true,
+			wantLens:           [][]int{{3 + packet.GeneveFixedHeaderLength, 3 + packet.GeneveFixedHeaderLength, len(neverGSOEqualTailSentinelPayload)}},
+			wantGSO:            []int{3 + packet.GeneveFixedHeaderLength},
+			wantSentinelAtTail: []bool{true},
+		},
+		{
+			name: "two-unequal-len-coalesce-neverGSOEqualTail-smaller-tail-no-sentinel",
+			buffs: [][]byte{
+				withGeneveSpace(3, 3),
+				withGeneveSpace(2, 2),
+			},
+			neverGSOEqualTail: true,
+			wantLens:          [][]int{{3, 2}},
+			wantGSO:           []int{3},
+		},
+		{
+			name: "one-byte-tail-neverGSOEqualTail-not-coalesced",
+			// okToCoalesceWithSentinel is false when msgLen == 1 and
+			// neverGSOEqualTail is set; the 1-byte tail is split into
+			// its own non-coalesced singleton msg.
+			buffs: [][]byte{
+				withGeneveSpace(2, 2),
+				withGeneveSpace(1, 1),
+			},
+			neverGSOEqualTail: true,
+			wantLens:          [][]int{{2}, {1}},
+			wantGSO:           []int{0, 0},
+		},
+		{
+			name: "one-byte-tail-neverGSOEqualTail-vni-isSet-coalesced",
+			// With vniIsSet, msgLen always includes the Geneve header, so
+			// okToCoalesceWithSentinel is true even for "1-byte payloads".
+			// The naturally smaller tail short-circuits the sentinel.
+			buffs: [][]byte{
+				withGeneveSpace(2, 2+packet.GeneveFixedHeaderLength),
+				withGeneveSpace(1, 1),
+			},
+			geneve:            geneve,
+			neverGSOEqualTail: true,
+			wantLens:          [][]int{{2 + packet.GeneveFixedHeaderLength, 1 + packet.GeneveFixedHeaderLength}},
+			wantGSO:           []int{2 + packet.GeneveFixedHeaderLength},
+		},
+		{
+			name: "batch-boundary-sentinel-appended-on-prior-batch-neverGSOEqualTail",
+			// The 4th buff (length 5) is larger than gsoSize=3 so it
+			// closes the first batch. The first batch has dgramCnt > 1 and
+			// no smaller tail, so the sentinel is appended before starting
+			// the new batch.
+			buffs: [][]byte{
+				withGeneveSpace(3, 3),
+				withGeneveSpace(3, 3),
+				withGeneveSpace(3, 3),
+				withGeneveSpace(5, 5),
+			},
+			neverGSOEqualTail:  true,
+			wantLens:           [][]int{{3, 3, 3, len(neverGSOEqualTailSentinelPayload)}, {5}},
+			wantGSO:            []int{3, 0},
+			wantSentinelAtTail: []bool{true, false},
+		},
+		{
+			name: "single-buff-neverGSOEqualTail-no-sentinel",
+			// Only one datagram, no GSO happening, no sentinel.
+			buffs: [][]byte{
+				withGeneveSpace(3, 3),
+			},
+			neverGSOEqualTail: true,
+			wantLens:          [][]int{{3}},
+			wantGSO:           []int{0},
+		},
+		{
+			name: "equal-len-then-smaller-tail-then-equal-neverGSOEqualTail",
+			// The smaller tail ends the first batch with no sentinel
+			// (variation already provided), then a second singleton batch
+			// is started for the trailing equal-length buff.
+			buffs: [][]byte{
+				withGeneveSpace(3, 3),
+				withGeneveSpace(3, 3),
+				withGeneveSpace(2, 2),
+				withGeneveSpace(3, 3),
+			},
+			neverGSOEqualTail: true,
+			wantLens:          [][]int{{3, 3, 2}, {3}},
+			wantGSO:           []int{3, 0},
+		},
 	}
 
 	for _, tt := range cases {
 		t.Run(tt.name, func(t *testing.T) {
+			c := &linuxBatchingConn{}
 			addr := &net.UDPAddr{
 				IP:   net.ParseIP("127.0.0.1"),
 				Port: 1,
@@ -270,7 +381,7 @@ func Test_linuxBatchingConn_coalesceMessages(t *testing.T) {
 				msgs[i].Buffers = make([][]byte, 1)
 				msgs[i].OOB = make([]byte, controlMessageSize)
 			}
-			got := c.coalesceMessages(addr, tt.geneve, tt.buffs, msgs, packet.GeneveFixedHeaderLength)
+			got := c.coalesceMessages(addr, tt.geneve, tt.buffs, msgs, packet.GeneveFixedHeaderLength, tt.neverGSOEqualTail)
 			if got != len(tt.wantLens) {
 				t.Fatalf("got len %d want: %d", got, len(tt.wantLens))
 			}
@@ -288,6 +399,15 @@ func Test_linuxBatchingConn_coalesceMessages(t *testing.T) {
 					}
 				}
 
+				wantSentinel := i < len(tt.wantSentinelAtTail) && tt.wantSentinelAtTail[i]
+				if wantSentinel {
+					tail := msgs[i].Buffers[len(msgs[i].Buffers)-1]
+					if len(tail) != len(neverGSOEqualTailSentinelPayload) ||
+						&tail[0] != &neverGSOEqualTailSentinelPayload[0] {
+						t.Errorf("msgs[%d] tail buffer is not neverGSOEqualTailSentinelPayload", i)
+					}
+				}
+
 				// coalesceMessages calls setGSOSizeInControl, which uses a cmsg
 				// type of UDP_SEGMENT, and getGSOSizeInControl scans for a cmsg
 				// type of UDP_GRO. Therefore, we have to use the lower-level
@@ -309,6 +429,156 @@ func Test_linuxBatchingConn_coalesceMessages(t *testing.T) {
 	}
 }
 
+// fakeBatchWriter is an xnetBatchReaderWriter that records the Buffers length
+// of each message handed to WriteBatch, and optionally fails the first call
+// with an error that triggers neterror.ShouldDisableUDPGSO.
+type fakeBatchWriter struct {
+	gotBuffersLen [][]int // Buffers len of each msg, per WriteBatch call
+	failFirst     bool
+}
+
+func (f *fakeBatchWriter) ReadBatch([]ipv6.Message, int) (int, error) { return 0, nil }
+
+func (f *fakeBatchWriter) WriteBatch(msgs []ipv6.Message, _ int) (int, error) {
+	snap := make([]int, len(msgs))
+	for i := range msgs {
+		snap[i] = len(msgs[i].Buffers)
+	}
+	f.gotBuffersLen = append(f.gotBuffersLen, snap)
+	if f.failFirst && len(f.gotBuffersLen) == 1 {
+		return 0, &os.SyscallError{Syscall: "sendmmsg", Err: unix.EIO}
+	}
+	return len(msgs), nil
+}
+
+// Test_linuxBatchingConn_WriteBatchTo_resetsBuffersOnGSORetry verifies that
+// when a coalesced (scatter-gather) write fails and triggers the GSO-disable
+// goto retry, the non-coalesce retry pass resets each message's Buffers back to
+// length 1 rather than leaving stale iovecs appended by coalesceMessages.
+func Test_linuxBatchingConn_WriteBatchTo_resetsBuffersOnGSORetry(t *testing.T) {
+	uc, err := net.ListenUDP("udp4", nil) // only for pc.LocalAddr() in the error path
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer uc.Close()
+
+	xpc := &fakeBatchWriter{failFirst: true}
+	c := &linuxBatchingConn{
+		pc:  uc,
+		xpc: xpc,
+		sendBatchPool: sync.Pool{New: func() any {
+			ua := &net.UDPAddr{IP: make([]byte, 16)}
+			msgs := make([]ipv6.Message, 8)
+			for i := range msgs {
+				msgs[i].Buffers = make([][]byte, 1)
+				msgs[i].Addr = ua
+				msgs[i].OOB = make([]byte, controlMessageSize)
+			}
+			return &sendBatch{ua: ua, msgs: msgs}
+		}},
+	}
+	c.txOffload.Store(true) // force the coalesce path on the first pass
+
+	// Two equal-length buffs coalesce into a single msg whose Buffers grows
+	// to len 2 (scatter-gather) on the first pass.
+	buffs := [][]byte{make([]byte, 32), make([]byte, 32)}
+
+	err = c.WriteBatchTo(buffs, netip.MustParseAddrPort("127.0.0.1:1"), packet.GeneveHeader{}, 0)
+
+	// The retry path always returns ErrUDPGSODisabled wrapping the retry's
+	// result (nil here).
+	if _, ok := errors.AsType[neterror.ErrUDPGSODisabled](err); !ok {
+		t.Fatalf("got %v, want ErrUDPGSODisabled", err)
+	}
+	if len(xpc.gotBuffersLen) != 2 {
+		t.Fatalf("got %d WriteBatch calls, want 2", len(xpc.gotBuffersLen))
+	}
+	// First (coalesced) call: one msg with 2 iovecs — confirms the precondition
+	// that coalesceMessages grew Buffers past length 1.
+	if got := xpc.gotBuffersLen[0]; len(got) != 1 || got[0] != 2 {
+		t.Fatalf("first call buffers = %v, want [2]", got)
+	}
+	// Retry (non-coalesce) call: sends one msg per buff...
+	if got := len(xpc.gotBuffersLen[1]); got != len(buffs) {
+		t.Fatalf("retry call sent %d msgs, want %d", got, len(buffs))
+	}
+	// ...and the fix must have reset every msg's Buffers back to len 1.
+	for i, n := range xpc.gotBuffersLen[1] {
+		if n != 1 {
+			t.Errorf("retry msg[%d] Buffers len = %d, want 1", i, n)
+		}
+	}
+}
+
+// Test_linuxBatchingConn_WriteBatchTo_offsetStableOnNonCoalesceRetry verifies
+// that the Geneve header offset adjustment in the non-coalesce path is derived
+// fresh from the original offset on each pass, rather than accumulating across a
+// goto retry. The non-coalesce branch runs on both passes when neverGSOEqualTail
+// is set and the batch is small enough to skip coalescing: the first pass fails
+// with an error that disables GSO, and the retry re-enters the same branch.
+// Since callers pass offset == GeneveFixedHeaderLength, a stale (accumulating)
+// offset would underflow to -GeneveFixedHeaderLength and panic on buffs[i][-8:].
+func Test_linuxBatchingConn_WriteBatchTo_offsetStableOnNonCoalesceRetry(t *testing.T) {
+	uc, err := net.ListenUDP("udp4", nil) // only for pc.LocalAddr() in the error path
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer uc.Close()
+
+	xpc := &fakeBatchWriter{failFirst: true}
+	c := &linuxBatchingConn{
+		pc:  uc,
+		xpc: xpc,
+		sendBatchPool: sync.Pool{New: func() any {
+			ua := &net.UDPAddr{IP: make([]byte, 16)}
+			msgs := make([]ipv6.Message, appendSentinelTailBatchSizeThreshold)
+			for i := range msgs {
+				msgs[i].Buffers = make([][]byte, 1)
+				msgs[i].Addr = ua
+				msgs[i].OOB = make([]byte, controlMessageSize)
+			}
+			return &sendBatch{ua: ua, msgs: msgs}
+		}},
+	}
+	c.txOffload.Store(true)
+	// neverGSOEqualTail set + a sub-threshold batch forces the non-coalesce
+	// path while txOffload is still enabled, so the GSO-disable retry re-enters
+	// the non-coalesce branch a second time.
+	var neverGSOEqualTail atomic.Bool
+	neverGSOEqualTail.Store(true)
+	c.neverGSOEqualTail = &neverGSOEqualTail
+
+	// VNI set so the non-coalesce branch performs the offset -= GeneveFixedHeaderLength
+	// adjustment; offset == GeneveFixedHeaderLength as the production caller requires.
+	geneve := packet.GeneveHeader{Protocol: packet.GeneveProtocolWireGuard}
+	geneve.VNI.Set(1)
+	offset := packet.GeneveFixedHeaderLength
+
+	// Stay below appendSentinelTailBatchSizeThreshold so coalescing is skipped
+	// and we take the non-coalesce branch on both passes.
+	const nBuffs = appendSentinelTailBatchSizeThreshold - 1
+	buffs := make([][]byte, nBuffs)
+	for i := range buffs {
+		buffs[i] = make([]byte, 32)
+	}
+
+	// Must not panic: each pass recomputes the offset from the original.
+	err = c.WriteBatchTo(buffs, netip.MustParseAddrPort("127.0.0.1:1"), geneve, offset)
+
+	if _, ok := errors.AsType[neterror.ErrUDPGSODisabled](err); !ok {
+		t.Fatalf("got %v, want ErrUDPGSODisabled", err)
+	}
+	if len(xpc.gotBuffersLen) != 2 {
+		t.Fatalf("got %d WriteBatch calls, want 2 (initial + retry)", len(xpc.gotBuffersLen))
+	}
+	// Both passes take the non-coalesce branch: one msg per buff, no coalescing.
+	for call, got := range xpc.gotBuffersLen {
+		if len(got) != len(buffs) {
+			t.Errorf("call %d sent %d msgs, want %d", call, len(got), len(buffs))
+		}
+	}
+}
+
 func TestMinReadBatchMsgsLen(t *testing.T) {
 	// So long as magicsock uses [Conn], and [wireguard-go/conn.Bind] API is
 	// shaped for wireguard-go to control packet memory, these values should be
diff --git a/net/dns/config.go b/net/dns/config.go
index 0b09fe1a8..da19e7035 100644
--- a/net/dns/config.go
+++ b/net/dns/config.go
@@ -61,6 +61,14 @@ type Config struct {
 	// OnlyIPv6, if true, uses the IPv6 service IP (for MagicDNS)
 	// instead of the IPv4 version (100.100.100.100).
 	OnlyIPv6 bool
+	// MagicDNSHostsUnrouted is whether MagicDNS host records are
+	// served on demand via [resolver.MagicDNSHosts] (so are not
+	// listed in Hosts) without being covered by any Routes entry;
+	// that is, MagicDNS domain routing is off. It preserves the
+	// effect the node records had when they were listed in Hosts:
+	// hasHostsWithoutSplitDNSRoutes reports true, keeping quad-100
+	// in the OS resolver path so the names still resolve.
+	MagicDNSHostsUnrouted bool
 }
 
 var magicDNSDualStack = envknob.RegisterBool("TS_DEBUG_MAGIC_DNS_DUAL_STACK")
@@ -127,8 +135,13 @@ func (c Config) hasDefaultIPResolversOnly() bool {
 // hasHostsWithoutSplitDNSRoutes reports whether c contains any Host entries
 // that aren't covered by a SplitDNS route suffix.
 func (c Config) hasHostsWithoutSplitDNSRoutes() bool {
-	// TODO(bradfitz): this could be more efficient, but we imagine
-	// the number of SplitDNS routes and/or hosts will be small.
+	if c.MagicDNSHostsUnrouted {
+		return true
+	}
+	// Hosts is small here on most platforms: per-node records are
+	// served via [resolver.MagicDNSHosts] (accounted for above), so
+	// only control's DNS.ExtraRecords remain. On Windows it still
+	// carries every node's records for the hosts-file path.
 	for host := range c.Hosts {
 		if !c.hasSplitDNSRouteForHost(host) {
 			return true
diff --git a/net/dns/direct.go b/net/dns/direct.go
index ec2e42e75..82ddc9012 100644
--- a/net/dns/direct.go
+++ b/net/dns/direct.go
@@ -26,8 +26,10 @@ import (
 
 	"tailscale.com/feature"
 	"tailscale.com/health"
+	"tailscale.com/hostinfo"
 	"tailscale.com/net/dns/resolvconffile"
 	"tailscale.com/net/tsaddr"
+	"tailscale.com/types/lazy"
 	"tailscale.com/types/logger"
 	"tailscale.com/util/dnsname"
 	"tailscale.com/util/eventbus"
@@ -277,6 +279,9 @@ func (m *directManager) rename(old, new string) error {
 	if !m.renameBroken {
 		err := m.fs.Rename(old, new)
 		if err == nil {
+			if new == resolvConf {
+				m.relabelResolvConf()
+			}
 			return nil
 		}
 		if runtime.GOOS == "linux" && distro.Get() == distro.Synology {
@@ -309,9 +314,55 @@ func (m *directManager) rename(old, new string) error {
 			return fmt.Errorf("remove of %q failed (%w) and so did truncate: %v", old, err, err2)
 		}
 	}
+	if new == resolvConf {
+		m.relabelResolvConf()
+	}
 	return nil
 }
 
+var restoreconPath lazy.SyncValue[string] // path to restorecon, or "" if absent
+
+// relabelResolvConf restores the policy-default SELinux context on
+// /etc/resolv.conf. Best effort: only runs when SELinux is enforcing. See:
+//
+//	https://github.com/tailscale/tailscale/issues/20149.
+func (m *directManager) relabelResolvConf() {
+	if runtime.GOOS != "linux" {
+		return
+	}
+	restorecon := restoreconPath.Get(func() string {
+		p, _ := exec.LookPath("restorecon")
+		return p
+	})
+	if restorecon == "" {
+		return
+	}
+	if !hostinfo.IsSELinuxEnforcing() {
+		// Clear any prior warning, e.g. if SELinux was turned off at runtime
+		// with setenforce(8) since the last failure.
+		m.health.SetHealthy(selinuxRelabelWarnable)
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	// m.fs may be rooted at a test prefix; restorecon needs the real path.
+	actualPath := m.fs.ActualPath(resolvConf)
+	if out, err := exec.CommandContext(ctx, restorecon, actualPath).CombinedOutput(); err != nil {
+		m.logf("dns: restorecon of %q failed: %v, output: %s", actualPath, err, bytes.TrimSpace(out))
+		m.health.SetUnhealthy(selinuxRelabelWarnable, nil)
+	} else {
+		m.health.SetHealthy(selinuxRelabelWarnable)
+	}
+}
+
+var selinuxRelabelWarnable = health.Register(&health.Warnable{
+	Code:     "resolv-conf-relabel-failed",
+	Severity: health.SeverityMedium,
+	Title:    "DNS configuration issue",
+	Text:     health.StaticMessage("Failed to restore the SELinux label on /etc/resolv.conf; DNS may break when other services manage the file. See https://github.com/tailscale/tailscale/issues/20149"),
+})
+
 // setWant sets the expected contents of /etc/resolv.conf, if any.
 //
 // A value of nil means no particular value is expected.
@@ -442,7 +493,9 @@ func (m *directManager) runFileWatcher() {
 	if !ok {
 		return
 	}
-	if err := watchFile(m.ctx, "/etc/", resolvConf, m.checkForFileTrample); err != nil {
+	dir := m.fs.ActualPath(filepath.Dir(resolvConf))
+	file := m.fs.ActualPath(resolvConf)
+	if err := watchFile(m.ctx, dir, file, m.checkForFileTrample); err != nil {
 		// This is all best effort for now, so surface warnings to users.
 		m.logf("dns: inotify: %s", err)
 	}
@@ -597,6 +650,19 @@ type wholeFileFS interface {
 	ReadFile(name string) ([]byte, error)
 	Remove(name string) error
 	Rename(oldName, newName string) error
+	// ActualPath returns the real filesystem path for the given absolute
+	// logical path. All other methods in this interface accept logical
+	// paths (like "/etc/resolv.conf") and translate them internally;
+	// ActualPath exposes that same translation for callers that need
+	// the real path for use outside the interface (e.g. setting up an
+	// inotify watch on the correct directory).
+	//
+	// For directFS with an empty prefix (production), the input is
+	// returned unchanged ("/etc" → "/etc"). For directFS with a test
+	// prefix like "/tmp/test123", the prefix is joined
+	// ("/etc" → "/tmp/test123/etc"). For wslFS the input is returned
+	// unchanged, since paths are passed through to wsl.exe as-is.
+	ActualPath(name string) string
 	Stat(name string) (isRegular bool, err error)
 	Truncate(name string) error
 	WriteFile(name string, contents []byte, perm os.FileMode) error
@@ -613,6 +679,8 @@ type directFS struct {
 
 func (fs directFS) path(name string) string { return filepath.Join(fs.prefix, name) }
 
+func (fs directFS) ActualPath(name string) string { return fs.path(name) }
+
 func (fs directFS) Stat(name string) (isRegular bool, err error) {
 	fi, err := os.Stat(fs.path(name))
 	if err != nil {
diff --git a/net/dns/direct_linux_test.go b/net/dns/direct_linux_test.go
index 8199b41f3..c053db178 100644
--- a/net/dns/direct_linux_test.go
+++ b/net/dns/direct_linux_test.go
@@ -7,21 +7,19 @@ package dns
 
 import (
 	"context"
-	"fmt"
 	"net/netip"
 	"os"
 	"path/filepath"
 	"testing"
 	"testing/synctest"
-
-	"github.com/illarion/gonotify/v3"
+	"time"
 
 	"tailscale.com/util/dnsname"
 	"tailscale.com/util/eventbus/eventbustest"
 )
 
 func TestDNSTrampleRecovery(t *testing.T) {
-	HookWatchFile.Set(watchFile)
+	t.Cleanup(HookWatchFile.SetForTest(watchFile))
 	synctest.Test(t, func(t *testing.T) {
 		tmp := t.TempDir()
 		if err := os.MkdirAll(filepath.Join(tmp, "etc"), 0700); err != nil {
@@ -77,33 +75,20 @@ search ts.net ts-dns.test
 	})
 }
 
-// watchFile is generally copied from linuxtrample, but cancels the context
-// after the first call to cb() after the first trample to end the test.
+// watchFile is a test implementation of the file watcher that uses a timer
+// instead of inotify. Real inotify (gonotify.NewDirWatcher) creates goroutines
+// that block on real syscalls, which don't work inside synctest's fake-time
+// bubble. Instead, we use a one-shot timer that synctest.Wait() will advance,
+// triggering a callback to check for file trampling.
 func watchFile(ctx context.Context, dir, filename string, cb func()) error {
-	ctx, cancel := context.WithCancel(ctx)
-	defer cancel()
-
-	const events = gonotify.IN_ATTRIB |
-		gonotify.IN_CLOSE_WRITE |
-		gonotify.IN_CREATE |
-		gonotify.IN_DELETE |
-		gonotify.IN_MODIFY |
-		gonotify.IN_MOVE
-
-	watcher, err := gonotify.NewDirWatcher(ctx, events, dir)
-	if err != nil {
-		return fmt.Errorf("NewDirWatcher: %w", err)
-	}
-
-	for {
-		select {
-		case event := <-watcher.C:
-			if event.Name == filename {
-				cb()
-				cancel()
-			}
-		case <-ctx.Done():
-			return ctx.Err()
-		}
+	timer := time.NewTimer(time.Millisecond)
+	defer timer.Stop()
+	select {
+	case <-ctx.Done():
+		return ctx.Err()
+	case <-timer.C:
+		cb()
 	}
+	<-ctx.Done()
+	return ctx.Err()
 }
diff --git a/net/dns/dns_clone.go b/net/dns/dns_clone.go
index 32765ceb4..64294db12 100644
--- a/net/dns/dns_clone.go
+++ b/net/dns/dns_clone.go
@@ -33,8 +33,19 @@ func (src *Config) Clone() *Config {
 	}
 	if dst.Routes != nil {
 		dst.Routes = map[dnsname.FQDN][]*dnstype.Resolver{}
-		for k := range src.Routes {
-			dst.Routes[k] = append([]*dnstype.Resolver{}, src.Routes[k]...)
+		for k, sv := range src.Routes {
+			if sv == nil {
+				dst.Routes[k] = nil
+				continue
+			}
+			dst.Routes[k] = make([]*dnstype.Resolver, len(sv))
+			for i := range sv {
+				if sv[i] == nil {
+					dst.Routes[k][i] = nil
+				} else {
+					dst.Routes[k][i] = sv[i].Clone()
+				}
+			}
 		}
 	}
 	dst.SearchDomains = append(src.SearchDomains[:0:0], src.SearchDomains...)
@@ -50,13 +61,14 @@ func (src *Config) Clone() *Config {
 
 // A compilation failure here means this code must be regenerated, with the command at the top of this file.
 var _ConfigCloneNeedsRegeneration = Config(struct {
-	AcceptDNS        bool
-	DefaultResolvers []*dnstype.Resolver
-	Routes           map[dnsname.FQDN][]*dnstype.Resolver
-	SearchDomains    []dnsname.FQDN
-	Hosts            map[dnsname.FQDN][]netip.Addr
-	SubdomainHosts   set.Set[dnsname.FQDN]
-	OnlyIPv6         bool
+	AcceptDNS             bool
+	DefaultResolvers      []*dnstype.Resolver
+	Routes                map[dnsname.FQDN][]*dnstype.Resolver
+	SearchDomains         []dnsname.FQDN
+	Hosts                 map[dnsname.FQDN][]netip.Addr
+	SubdomainHosts        set.Set[dnsname.FQDN]
+	OnlyIPv6              bool
+	MagicDNSHostsUnrouted bool
 }{})
 
 // Clone duplicates src into dst and reports whether it succeeded.
diff --git a/net/dns/dns_view.go b/net/dns/dns_view.go
index 70cb89dca..4d54c2613 100644
--- a/net/dns/dns_view.go
+++ b/net/dns/dns_view.go
@@ -139,16 +139,26 @@ func (v ConfigView) SubdomainHosts() views.Map[dnsname.FQDN, struct{}] {
 
 // OnlyIPv6, if true, uses the IPv6 service IP (for MagicDNS)
 // instead of the IPv4 version (100.100.100.100).
-func (v ConfigView) OnlyIPv6() bool           { return v.ж.OnlyIPv6 }
-func (v ConfigView) Equal(v2 ConfigView) bool { return v.ж.Equal(v2.ж) }
+func (v ConfigView) OnlyIPv6() bool { return v.ж.OnlyIPv6 }
+
+// MagicDNSHostsUnrouted is whether MagicDNS host records are
+// served on demand via [resolver.MagicDNSHosts] (so are not
+// listed in Hosts) without being covered by any Routes entry;
+// that is, MagicDNS domain routing is off. It preserves the
+// effect the node records had when they were listed in Hosts:
+// hasHostsWithoutSplitDNSRoutes reports true, keeping quad-100
+// in the OS resolver path so the names still resolve.
+func (v ConfigView) MagicDNSHostsUnrouted() bool { return v.ж.MagicDNSHostsUnrouted }
+func (v ConfigView) Equal(v2 ConfigView) bool    { return v.ж.Equal(v2.ж) }
 
 // A compilation failure here means this code must be regenerated, with the command at the top of this file.
 var _ConfigViewNeedsRegeneration = Config(struct {
-	AcceptDNS        bool
-	DefaultResolvers []*dnstype.Resolver
-	Routes           map[dnsname.FQDN][]*dnstype.Resolver
-	SearchDomains    []dnsname.FQDN
-	Hosts            map[dnsname.FQDN][]netip.Addr
-	SubdomainHosts   set.Set[dnsname.FQDN]
-	OnlyIPv6         bool
+	AcceptDNS             bool
+	DefaultResolvers      []*dnstype.Resolver
+	Routes                map[dnsname.FQDN][]*dnstype.Resolver
+	SearchDomains         []dnsname.FQDN
+	Hosts                 map[dnsname.FQDN][]netip.Addr
+	SubdomainHosts        set.Set[dnsname.FQDN]
+	OnlyIPv6              bool
+	MagicDNSHostsUnrouted bool
 }{})
diff --git a/net/dns/manager.go b/net/dns/manager.go
index 8daa13cbc..b34c5b632 100644
--- a/net/dns/manager.go
+++ b/net/dns/manager.go
@@ -33,6 +33,7 @@ import (
 	"tailscale.com/util/eventbus"
 	"tailscale.com/util/slicesx"
 	"tailscale.com/util/syspolicy/policyclient"
+	"tailscale.com/version"
 )
 
 var (
@@ -131,6 +132,16 @@ func (m *Manager) Resolver() *resolver.Resolver {
 	return m.resolver
 }
 
+// ProbeLocks acquires and releases the manager's internal mutexes.
+func (m *Manager) ProbeLocks() {
+	m.mu.Lock()
+	m.mu.Unlock()
+
+	if r := m.Resolver(); r != nil {
+		r.ProbeLocks()
+	}
+}
+
 // RecompileDNSConfig recompiles the last attempted DNS configuration, which has
 // the side effect of re-querying the OS's interface nameservers.  This should be used
 // on platforms where the interface nameservers can change.  Darwin, for example,
@@ -366,13 +377,19 @@ func (m *Manager) compileConfig(cfg Config) (rcfg resolver.Config, ocfg OSConfig
 	// This bool is used in a couple of places below to implement this
 	// workaround.
 	isWindows := m.goos == "windows"
-	isApple := (m.goos == "darwin" || m.goos == "ios")
-	if len(cfg.singleResolverSet()) > 0 && m.os.SupportsSplitDNS() && !isWindows && !isApple {
-		// Split DNS configuration requested, where all split domains
-		// go to the same resolvers. We can let the OS do it.
-		ocfg.Nameservers = toIPsOnly(cfg.singleResolverSet())
-		ocfg.MatchDomains = cfg.matchDomains()
-		return rcfg, ocfg, nil
+	isIOS := m.goos == "ios"
+	supportsSplitDNS := m.os.SupportsSplitDNS()
+	// Sandboxed macOS builds use NetworkExtension DNS settings, not
+	// tailscaled's /etc/resolver configurator, so keep the Apple workaround.
+	appleSplitDNSWorkaround := isIOS || (m.goos == "darwin" && isSandboxedMacOS())
+	if supportsSplitDNS && !isWindows && !appleSplitDNSWorkaround {
+		if srs := toIPsOnly(cfg.singleResolverSet()); len(srs) > 0 {
+			// Split DNS configuration requested, where all split domains
+			// go to the same resolvers. We can let the OS do it.
+			ocfg.Nameservers = srs
+			ocfg.MatchDomains = cfg.matchDomains()
+			return rcfg, ocfg, nil
+		}
 	}
 
 	// Split DNS configuration with either multiple upstream routes,
@@ -381,63 +398,62 @@ func (m *Manager) compileConfig(cfg Config) (rcfg resolver.Config, ocfg OSConfig
 	rcfg.Routes = routes
 	ocfg.Nameservers = cfg.serviceIPs(m.knobs)
 
-	var baseCfg *OSConfig // base config; non-nil if/when known
+	if supportsSplitDNS && !appleSplitDNSWorkaround {
+		ocfg.MatchDomains = cfg.matchDomains()
+		return rcfg, ocfg, nil
+	}
 
-	// Even though Apple devices can do split DNS, they don't provide a way to
+	// Even though iOS devices can do split DNS, they don't provide a way to
 	// selectively answer ExtraRecords, and ignore other DNS traffic. As a
 	// workaround, we read the existing default resolver configuration and use
 	// that as the forwarder for all DNS traffic that quad-100 doesn't handle.
-	if isApple || !m.os.SupportsSplitDNS() {
-		// If the OS can't do native split-dns, read out the underlying
-		// resolver config and blend it into our config.  On apple platforms, [OSConfigurator.GetBaseConfig]
-		// has a tendency to temporarily fail if called immediately following
-		// an interface change.  These failures should be retried if/when the OS
-		// indicates that the DNS configuration has changed via [RecompileDNSConfig].
-		cfg, err := m.os.GetBaseConfig()
-		if err == nil {
-			baseCfg = &cfg
-		} else if (isApple || isNoopManager(m.os)) && err == ErrGetBaseConfigNotSupported {
+	//
+	// If the OS can't do native split-DNS, read out the underlying resolver
+	// config and blend it into our config. On iOS, [OSConfigurator.GetBaseConfig]
+	// has a tendency to temporarily fail if called immediately following an
+	// interface change. These failures should be retried if/when the OS indicates
+	// that the DNS configuration has changed via [RecompileDNSConfig].
+	base, err := m.os.GetBaseConfig()
+	if err != nil {
+		if (isIOS || isNoopManager(m.os)) && err == ErrGetBaseConfigNotSupported {
 			// Expected when using noopManager (userspace networking) or on
-			// certain iOS/macOS builds. Continue without base config.
-		} else {
-			m.health.SetUnhealthy(osConfigurationReadWarnable, health.Args{health.ArgError: err.Error()})
-			return resolver.Config{}, OSConfig{}, err
+			// certain iOS builds. Continue without base config.
+			m.health.SetHealthy(osConfigurationReadWarnable)
+			ocfg.MatchDomains = cfg.matchDomains()
+			return rcfg, ocfg, nil
 		}
-		m.health.SetHealthy(osConfigurationReadWarnable)
+		m.health.SetUnhealthy(osConfigurationReadWarnable, health.Args{health.ArgError: err.Error()})
+		return resolver.Config{}, OSConfig{}, err
 	}
+	m.health.SetHealthy(osConfigurationReadWarnable)
 
-	if baseCfg == nil {
-		// If there was no base config, then we need to fallback to SplitDNS mode.
-		ocfg.MatchDomains = cfg.matchDomains()
-	} else {
-		// On iOS only (for now), check if all route names point to resources inside the tailnet.
-		// If so, we can set those names as MatchDomains to enable a split DNS configuration
-		// which will help preserve battery life.
-		// Because on iOS MatchDomains must equal SearchDomains, we cannot do this when
-		// we have any Routes outside the tailnet. Otherwise when app connectors are enabled,
-		// a query for 'work-laptop' might lead to search domain expansion, resolving
-		// as 'work-laptop.aws.com' for example.
-		if m.goos == "ios" && rcfg.RoutesRequireNoCustomResolvers() {
-			if !m.disableSplitDNSOptimization() {
-				for r := range rcfg.Routes {
-					ocfg.MatchDomains = append(ocfg.MatchDomains, r)
-				}
-			} else {
-				m.logf("iOS split DNS is disabled by nodeattr")
+	// On iOS only (for now), check if all route names point to resources inside the tailnet.
+	// If so, we can set those names as MatchDomains to enable a split DNS configuration
+	// which will help preserve battery life.
+	// Because on iOS MatchDomains must equal SearchDomains, we cannot do this when
+	// we have any Routes outside the tailnet. Otherwise when app connectors are enabled,
+	// a query for 'work-laptop' might lead to search domain expansion, resolving
+	// as 'work-laptop.aws.com' for example.
+	if isIOS && rcfg.RoutesRequireNoCustomResolvers() {
+		if !m.disableSplitDNSOptimization() {
+			for r := range rcfg.Routes {
+				ocfg.MatchDomains = append(ocfg.MatchDomains, r)
 			}
+		} else {
+			m.logf("iOS split DNS is disabled by nodeattr")
 		}
-		var defaultRoutes []*dnstype.Resolver
-		for _, ip := range baseCfg.Nameservers {
-			defaultRoutes = append(defaultRoutes, &dnstype.Resolver{Addr: ip.String()})
-		}
-		rcfg.Routes["."] = defaultRoutes
-		// Append base config search domains, but only if not already present.
-		// This prevents duplicates when GetBaseConfig() reads back domains that
-		// Tailscale itself previously wrote to resolv.conf.
-		for _, domain := range baseCfg.SearchDomains {
-			if !slices.Contains(ocfg.SearchDomains, domain) {
-				ocfg.SearchDomains = append(ocfg.SearchDomains, domain)
-			}
+	}
+	var defaultRoutes []*dnstype.Resolver
+	for _, ip := range base.Nameservers {
+		defaultRoutes = append(defaultRoutes, &dnstype.Resolver{Addr: ip.String()})
+	}
+	rcfg.Routes["."] = defaultRoutes
+	// Append base config search domains, but only if not already present.
+	// This prevents duplicates when GetBaseConfig() reads back domains that
+	// Tailscale itself previously wrote to resolv.conf.
+	for _, domain := range base.SearchDomains {
+		if !slices.Contains(ocfg.SearchDomains, domain) {
+			ocfg.SearchDomains = append(ocfg.SearchDomains, domain)
 		}
 	}
 
@@ -448,6 +464,8 @@ func (m *Manager) disableSplitDNSOptimization() bool {
 	return m.knobs != nil && m.knobs.DisableSplitDNSWhenNoCustomResolvers.Load()
 }
 
+var isSandboxedMacOS = version.IsSandboxedMacOS
+
 // toIPsOnly returns only the IP portion of dnstype.Resolver.
 // Only safe to use if the resolvers slice has been cleared of
 // DoH or custom-port entries with something like hasDefaultIPResolversOnly.
@@ -504,7 +522,7 @@ const (
 	maxReqSizeTCP = 4096
 )
 
-// TrampleDNS is an an event indicating we detected that DNS config was
+// TrampleDNS is an event indicating we detected that DNS config was
 // overwritten by another process.
 type TrampleDNS struct {
 	LastTrample       time.Time
diff --git a/net/dns/manager_darwin.go b/net/dns/manager_darwin.go
index bb590aa4e..a93a131f6 100644
--- a/net/dns/manager_darwin.go
+++ b/net/dns/manager_darwin.go
@@ -5,7 +5,12 @@ package dns
 
 import (
 	"bytes"
+	"fmt"
+	"io/fs"
 	"os"
+	"os/exec"
+	"strconv"
+	"strings"
 
 	"go4.org/mem"
 	"tailscale.com/control/controlknobs"
@@ -22,20 +27,31 @@ import (
 //
 // The health tracker, bus and the knobs may be nil and are ignored on this platform.
 func NewOSConfigurator(logf logger.Logf, _ *health.Tracker, _ *eventbus.Bus, _ policyclient.Client, _ *controlknobs.Knobs, ifName string) (OSConfigurator, error) {
-	return &darwinConfigurator{logf: logf, ifName: ifName}, nil
+	return &darwinConfigurator{
+		logf:           logf,
+		ifName:         ifName,
+		resolverDir:    "/etc/resolver",
+		resolvConfPath: "/etc/resolv.conf",
+		runScutil:      runScutil,
+	}, nil
 }
 
 // darwinConfigurator is the tailscaled-on-macOS DNS OS configurator that
 // maintains the Split DNS nameserver entries pointing MagicDNS DNS suffixes
 // to 100.100.100.100 using the macOS /etc/resolver/$SUFFIX files.
 type darwinConfigurator struct {
-	logf   logger.Logf
-	ifName string
+	logf           logger.Logf
+	ifName         string
+	resolverDir    string // default "/etc/resolver"
+	resolvConfPath string // default "/etc/resolv.conf"
+	runScutil      func(script string) (output string, err error)
 }
 
 func (c *darwinConfigurator) Close() error {
-	c.removeResolverFiles(func(domain string) bool { return true })
-	return nil
+	if err := c.removeGlobalDNS(); err != nil {
+		return err
+	}
+	return c.removeResolverFiles(func(domain string) bool { return true })
 }
 
 func (c *darwinConfigurator) SupportsSplitDNS() bool {
@@ -43,6 +59,16 @@ func (c *darwinConfigurator) SupportsSplitDNS() bool {
 }
 
 func (c *darwinConfigurator) SetDNS(cfg OSConfig) error {
+	if len(cfg.Nameservers) > 0 && len(cfg.MatchDomains) == 0 {
+		if err := c.setGlobalDNS(cfg); err != nil {
+			return err
+		}
+		return c.removeResolverFiles(func(domain string) bool { return true })
+	}
+	if err := c.removeGlobalDNS(); err != nil {
+		return err
+	}
+
 	var buf bytes.Buffer
 	buf.WriteString(macResolverFileHeader)
 	for _, ip := range cfg.Nameservers {
@@ -51,10 +77,16 @@ func (c *darwinConfigurator) SetDNS(cfg OSConfig) error {
 		buf.WriteString("\n")
 	}
 
-	if err := os.MkdirAll("/etc/resolver", 0755); err != nil {
+	if err := os.MkdirAll(c.resolverDir, 0755); err != nil {
 		return err
 	}
 
+	root, err := os.OpenRoot(c.resolverDir)
+	if err != nil {
+		return err
+	}
+	defer root.Close()
+
 	var keep map[string]bool
 
 	// Add a dummy file to /etc/resolver with a "search ..." directive if we have
@@ -70,7 +102,7 @@ func (c *darwinConfigurator) SetDNS(cfg OSConfig) error {
 			sbuf.WriteString(string(d.WithoutTrailingDot()))
 		}
 		sbuf.WriteString("\n")
-		if err := os.WriteFile("/etc/resolver/"+searchFile, sbuf.Bytes(), 0644); err != nil {
+		if err := root.WriteFile(searchFile, sbuf.Bytes(), 0644); err != nil {
 			return err
 		}
 	}
@@ -78,15 +110,117 @@ func (c *darwinConfigurator) SetDNS(cfg OSConfig) error {
 	for _, d := range cfg.MatchDomains {
 		fileBase := string(d.WithoutTrailingDot())
 		mak.Set(&keep, fileBase, true)
-		fullPath := "/etc/resolver/" + fileBase
 
-		if err := os.WriteFile(fullPath, buf.Bytes(), 0644); err != nil {
+		if !isValidResolverFileName(fileBase) {
+			c.logf("[unexpected] invalid resolver domain %q with slashes or colons", fileBase)
+			return fmt.Errorf("invalid resolver domain %q: must not contain slashes or colons", fileBase)
+		}
+
+		if err := root.WriteFile(fileBase, buf.Bytes(), 0644); err != nil {
 			return err
 		}
 	}
 	return c.removeResolverFiles(func(domain string) bool { return !keep[domain] })
 }
 
+// macOSGlobalDNSKey is a stable synthetic SystemConfiguration service key for
+// tailscaled's global DNS resolver. The UUID does not identify a real network
+// service; it just gives tailscaled one well-known dynamic-store location to
+// set and later remove.
+const macOSGlobalDNSKey = "State:/Network/Service/FF457792-79C0-4A25-8392-D875BBEACCA6/DNS"
+
+// setGlobalDNS installs cfg.Nameservers as a default resolver using
+// SystemConfiguration's dynamic store. /etc/resolver is only a split-DNS
+// mechanism; it cannot express a primary resolver.
+func (c *darwinConfigurator) setGlobalDNS(cfg OSConfig) error {
+	var script strings.Builder
+	script.WriteString("d.init\n")
+	script.WriteString("d.add SearchOrder # 100000\n")
+	script.WriteString("d.add ServerAddresses *")
+	for _, ip := range cfg.Nameservers {
+		script.WriteByte(' ')
+		script.WriteString(ip.String())
+	}
+	script.WriteByte('\n')
+	// An empty SupplementalMatchDomains entry makes this a default resolver.
+	script.WriteString("d.add SupplementalMatchDomains * \"\"\n")
+	if len(cfg.SearchDomains) > 0 {
+		script.WriteString("d.add SearchDomains *")
+		for _, fqdn := range cfg.SearchDomains {
+			script.WriteByte(' ')
+			writeScutilString(&script, fqdn.WithoutTrailingDot())
+		}
+		script.WriteByte('\n')
+	}
+	script.WriteString("set ")
+	script.WriteString(macOSGlobalDNSKey)
+	script.WriteString("\nquit\n")
+
+	out, err := c.runScutilScript(script.String())
+	if err != nil {
+		return err
+	}
+	out = strings.TrimSpace(out)
+	if out != "" {
+		return fmt.Errorf("scutil set %s: %s", macOSGlobalDNSKey, out)
+	}
+	return nil
+}
+
+func (c *darwinConfigurator) removeGlobalDNS() error {
+	script := "remove " + macOSGlobalDNSKey + "\nquit\n"
+	out, err := c.runScutilScript(script)
+	if err != nil {
+		return err
+	}
+	out = strings.TrimSpace(out)
+	if out == "" || out == "No such key" {
+		return nil
+	}
+	return fmt.Errorf("scutil remove %s: %s", macOSGlobalDNSKey, out)
+}
+
+func (c *darwinConfigurator) runScutilScript(script string) (string, error) {
+	run := c.runScutil
+	if run == nil {
+		run = runScutil
+	}
+	return run(script)
+}
+
+func runScutil(script string) (string, error) {
+	cmd := exec.Command("/usr/sbin/scutil")
+	cmd.Stdin = strings.NewReader(script)
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		return "", fmt.Errorf("scutil: %w: %s", err, strings.TrimSpace(string(out)))
+	}
+	return string(out), nil
+}
+
+func writeScutilString(b *strings.Builder, v string) {
+	if v == "" || strings.ContainsAny(v, " \t\n\"") {
+		b.WriteString(strconv.Quote(v))
+		return
+	}
+	b.WriteString(v)
+}
+
+func isValidResolverFileName(name string) bool {
+	// Verify that the filename doesn't contain any characters that
+	// might cause issues when used as a filename; os.Root is a
+	// defense against path traversal, but prefer a nice error here
+	// if we can. These aren't valid for domain names anyway.
+	if strings.Contains(name, "/") || strings.Contains(name, "\\") {
+		return false
+	}
+
+	if strings.Contains(name, ":") {
+		return false
+	}
+	return true
+}
+
 // GetBaseConfig returns the current OS DNS configuration, extracting it from /etc/resolv.conf.
 // We should really be using the SystemConfiguration framework to get this information, as this
 // is not a stable public API, and is provided mostly as a compatibility effort with Unix
@@ -95,9 +229,9 @@ func (c *darwinConfigurator) SetDNS(cfg OSConfig) error {
 func (c *darwinConfigurator) GetBaseConfig() (OSConfig, error) {
 	cfg := OSConfig{}
 
-	resolvConf, err := resolvconffile.ParseFile("/etc/resolv.conf")
+	resolvConf, err := resolvconffile.ParseFile(c.resolvConfPath)
 	if err != nil {
-		c.logf("failed to parse /etc/resolv.conf: %v", err)
+		c.logf("failed to parse %s: %v", c.resolvConfPath, err)
 		return cfg, ErrGetBaseConfigNotSupported
 	}
 
@@ -113,7 +247,7 @@ func (c *darwinConfigurator) GetBaseConfig() (OSConfig, error) {
 
 	if len(cfg.Nameservers) == 0 {
 		// Log a warning in case we couldn't find any nameservers in /etc/resolv.conf.
-		c.logf("no nameservers found in /etc/resolv.conf, DNS resolution might fail")
+		c.logf("no nameservers found in %s, DNS resolution might fail", c.resolvConfPath)
 	}
 
 	return cfg, nil
@@ -124,13 +258,19 @@ const macResolverFileHeader = "# Added by tailscaled\n"
 // removeResolverFiles deletes all files in /etc/resolver for which the shouldDelete
 // func returns true.
 func (c *darwinConfigurator) removeResolverFiles(shouldDelete func(domain string) bool) error {
-	dents, err := os.ReadDir("/etc/resolver")
+	root, err := os.OpenRoot(c.resolverDir)
 	if os.IsNotExist(err) {
 		return nil
 	}
 	if err != nil {
 		return err
 	}
+	defer root.Close()
+
+	dents, err := fs.ReadDir(root.FS(), ".")
+	if err != nil {
+		return err
+	}
 	for _, de := range dents {
 		if !de.Type().IsRegular() {
 			continue
@@ -139,8 +279,7 @@ func (c *darwinConfigurator) removeResolverFiles(shouldDelete func(domain string
 		if !shouldDelete(name) {
 			continue
 		}
-		fullPath := "/etc/resolver/" + name
-		contents, err := os.ReadFile(fullPath)
+		contents, err := root.ReadFile(name)
 		if err != nil {
 			if os.IsNotExist(err) { // race?
 				continue
@@ -150,7 +289,7 @@ func (c *darwinConfigurator) removeResolverFiles(shouldDelete func(domain string
 		if !mem.HasPrefix(mem.B(contents), mem.S(macResolverFileHeader)) {
 			continue
 		}
-		if err := os.Remove(fullPath); err != nil {
+		if err := root.Remove(name); err != nil {
 			return err
 		}
 	}
diff --git a/net/dns/manager_darwin_test.go b/net/dns/manager_darwin_test.go
new file mode 100644
index 000000000..98af98002
--- /dev/null
+++ b/net/dns/manager_darwin_test.go
@@ -0,0 +1,288 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package dns
+
+import (
+	"errors"
+	"maps"
+	"net/netip"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+	"testing"
+
+	"tailscale.com/types/logger"
+	"tailscale.com/util/dnsname"
+)
+
+func newTestConfigurator(t *testing.T) *darwinConfigurator {
+	t.Helper()
+	dir := t.TempDir()
+
+	resolvConf := filepath.Join(dir, "resolv.conf")
+	if err := os.WriteFile(resolvConf, []byte("nameserver 8.8.8.8\n"), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	resolverDir := filepath.Join(dir, "resolvers")
+	if err := os.Mkdir(resolverDir, 0755); err != nil {
+		t.Fatal(err)
+	}
+
+	return &darwinConfigurator{
+		logf:           logger.Discard,
+		ifName:         "utun99",
+		resolverDir:    resolverDir,
+		resolvConfPath: resolvConf,
+		runScutil:      func(string) (string, error) { return "No such key\n", nil },
+	}
+}
+
+func TestSetDNS(t *testing.T) {
+	c := newTestConfigurator(t)
+
+	tests := []struct {
+		name         string
+		cfg          OSConfig
+		fileContents map[string]string // path -> expected file contents
+	}{
+		{
+			name: "basic",
+			cfg: OSConfig{
+				Nameservers:  []netip.Addr{netip.MustParseAddr("100.100.100.100")},
+				MatchDomains: []dnsname.FQDN{"example.com.", "ts.net."},
+			},
+			fileContents: map[string]string{
+				"example.com": macResolverFileHeader + "nameserver 100.100.100.100\n",
+				"ts.net":      macResolverFileHeader + "nameserver 100.100.100.100\n",
+			},
+		},
+		{
+			name: "SearchDomains",
+			cfg: OSConfig{
+				Nameservers:   []netip.Addr{netip.MustParseAddr("100.100.100.100")},
+				SearchDomains: []dnsname.FQDN{"tail1234.ts.net."},
+				MatchDomains:  []dnsname.FQDN{"ts.net."},
+			},
+			fileContents: map[string]string{
+				"ts.net":           macResolverFileHeader + "nameserver 100.100.100.100\n",
+				"search.tailscale": macResolverFileHeader + "search tail1234.ts.net\n",
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if err := c.SetDNS(tt.cfg); err != nil {
+				t.Fatalf("SetDNS failed: %v", err)
+			}
+
+			// We want only the expected files in the resolverDir,
+			// and nothing else.
+			files, err := os.ReadDir(c.resolverDir)
+			if err != nil {
+				t.Fatalf("reading resolver directory: %v", err)
+			}
+
+			var fileNames []string
+			for _, f := range files {
+				fileNames = append(fileNames, f.Name())
+			}
+
+			if len(files) != len(tt.fileContents) {
+				t.Fatalf("expected %d resolver files, got %d\ngot:  %v\nwant: %v",
+					len(tt.fileContents), len(files),
+					fileNames, slices.Collect(maps.Keys(tt.fileContents)),
+				)
+			}
+
+			// Check each file's contents.
+			for domain, expected := range tt.fileContents {
+				path := filepath.Join(c.resolverDir, domain)
+				data, err := os.ReadFile(path)
+				if err != nil {
+					t.Fatalf("reading resolver file %q: %v", domain, err)
+				}
+				if string(data) != expected {
+					t.Errorf("resolver file %q contents mismatch:\ngot:  %q\nwant: %q", domain, string(data), expected)
+				}
+			}
+		})
+	}
+}
+
+func TestSetDNSGlobal(t *testing.T) {
+	c := newTestConfigurator(t)
+
+	// Start with split DNS files present, so this test verifies that switching
+	// to a global resolver cleans up stale /etc/resolver state.
+	if err := c.SetDNS(OSConfig{
+		Nameservers:   []netip.Addr{netip.MustParseAddr("100.100.100.100")},
+		SearchDomains: []dnsname.FQDN{"tail1234.ts.net."},
+		MatchDomains:  []dnsname.FQDN{"ts.net."},
+	}); err != nil {
+		t.Fatalf("setting initial split DNS config failed: %v", err)
+	}
+	unmanaged := filepath.Join(c.resolverDir, "other.conf")
+	if err := os.WriteFile(unmanaged, []byte("# not ours\nnameserver 8.8.8.8\n"), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	var gotScripts []string
+	c.runScutil = func(script string) (string, error) {
+		gotScripts = append(gotScripts, script)
+		return "", nil
+	}
+
+	cfg := OSConfig{
+		Nameservers: []netip.Addr{
+			netip.MustParseAddr("100.100.100.100"),
+			netip.MustParseAddr("fd7a:115c:a1e0::53"),
+		},
+		SearchDomains: []dnsname.FQDN{"tail1234.ts.net."},
+	}
+	if err := c.SetDNS(cfg); err != nil {
+		t.Fatalf("SetDNS failed: %v", err)
+	}
+
+	wantScript := strings.Join([]string{
+		"d.init",
+		"d.add SearchOrder # 100000",
+		"d.add ServerAddresses * 100.100.100.100 fd7a:115c:a1e0::53",
+		`d.add SupplementalMatchDomains * ""`,
+		"d.add SearchDomains * tail1234.ts.net",
+		"set " + macOSGlobalDNSKey,
+		"quit",
+		"",
+	}, "\n")
+	if !slices.Equal(gotScripts, []string{wantScript}) {
+		t.Errorf("scutil scripts mismatch:\ngot:\n%s\nwant:\n%s", strings.Join(gotScripts, "\n---\n"), wantScript)
+	}
+
+	files, err := os.ReadDir(c.resolverDir)
+	if err != nil {
+		t.Fatalf("reading resolver directory: %v", err)
+	}
+	var fileNames []string
+	for _, f := range files {
+		fileNames = append(fileNames, f.Name())
+	}
+	if !slices.Equal(fileNames, []string{"other.conf"}) {
+		t.Fatalf("expected only unmanaged resolver file after global DNS config, got %v", fileNames)
+	}
+}
+
+func TestSetDNSSplitRemovesGlobal(t *testing.T) {
+	c := newTestConfigurator(t)
+
+	// Start with global DNS configured, so this test verifies the stale global
+	// dynamic-store key is removed when switching back to split DNS.
+	c.runScutil = func(script string) (string, error) {
+		return "", nil
+	}
+	if err := c.SetDNS(OSConfig{
+		Nameservers: []netip.Addr{netip.MustParseAddr("100.100.100.100")},
+	}); err != nil {
+		t.Fatalf("setting initial global DNS config failed: %v", err)
+	}
+
+	var gotScripts []string
+	c.runScutil = func(script string) (string, error) {
+		gotScripts = append(gotScripts, script)
+		return "", nil
+	}
+
+	cfg := OSConfig{
+		Nameservers:  []netip.Addr{netip.MustParseAddr("100.100.100.100")},
+		MatchDomains: []dnsname.FQDN{"ts.net."},
+	}
+	if err := c.SetDNS(cfg); err != nil {
+		t.Fatalf("SetDNS failed: %v", err)
+	}
+
+	wantScript := "remove " + macOSGlobalDNSKey + "\nquit\n"
+	if !slices.Equal(gotScripts, []string{wantScript}) {
+		t.Errorf("scutil scripts mismatch:\ngot:\n%s\nwant:\n%s", strings.Join(gotScripts, "\n---\n"), wantScript)
+	}
+
+	const wantFile = macResolverFileHeader + "nameserver 100.100.100.100\n"
+	gotFile, err := os.ReadFile(filepath.Join(c.resolverDir, "ts.net"))
+	if err != nil {
+		t.Fatalf("reading split resolver file: %v", err)
+	}
+	if string(gotFile) != wantFile {
+		t.Errorf("split resolver file contents mismatch:\ngot:  %q\nwant: %q", string(gotFile), wantFile)
+	}
+}
+
+func TestSetDNS_PathTraversal(t *testing.T) {
+	c := newTestConfigurator(t)
+
+	// Use a simple path traversal that tries to escape the resolver
+	// directory. With the previously-vulnerable code (os.WriteFile with string
+	// concatenation), this writes to the parent directory. With the
+	// fix (os.Root), this is rejected.
+	traversals := []dnsname.FQDN{
+		"../evil.",
+		"../../evil.",
+		"sub/../../evil.",
+	}
+
+	for _, traversal := range traversals {
+		cfg := OSConfig{
+			Nameservers:  []netip.Addr{netip.MustParseAddr("100.100.100.100")},
+			MatchDomains: []dnsname.FQDN{traversal},
+		}
+
+		if err := c.SetDNS(cfg); err == nil {
+			t.Errorf("SetDNS with MatchDomain %q should have failed, but succeeded", traversal)
+		}
+	}
+
+	// Verify no file named "evil" was written in the parent of resolverDir.
+	parent := filepath.Dir(c.resolverDir)
+	if fileExists(filepath.Join(parent, "evil")) {
+		t.Fatal("file 'evil' was written to parent directory via path traversal")
+	}
+}
+
+func TestRemoveResolverFiles(t *testing.T) {
+	c := newTestConfigurator(t)
+
+	// Write a tailscale-managed file.
+	managed := filepath.Join(c.resolverDir, "ts.net")
+	if err := os.WriteFile(managed, []byte(macResolverFileHeader+"nameserver 100.100.100.100\n"), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	// Write a non-tailscale file that should be left alone.
+	unmanaged := filepath.Join(c.resolverDir, "other.conf")
+	if err := os.WriteFile(unmanaged, []byte("# not ours\nnameserver 8.8.8.8\n"), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	// Remove all resolver files and verify that only the managed one is removed.
+	if err := c.removeResolverFiles(func(domain string) bool { return true }); err != nil {
+		t.Fatal(err)
+	}
+
+	if fileExists(managed) {
+		t.Error("managed file should have been removed")
+	}
+	if !fileExists(unmanaged) {
+		t.Error("unmanaged file should still exist")
+	}
+}
+
+func fileExists(path string) bool {
+	_, err := os.Stat(path)
+	if errors.Is(err, os.ErrNotExist) {
+		return false
+	} else if err == nil {
+		return true
+	}
+
+	panic("unexpected error checking file existence: " + err.Error())
+}
diff --git a/net/dns/manager_linux_test.go b/net/dns/manager_linux_test.go
index a108a3297..c3c99307a 100644
--- a/net/dns/manager_linux_test.go
+++ b/net/dns/manager_linux_test.go
@@ -316,6 +316,7 @@ func (m memFS) Stat(name string) (isRegular bool, err error) {
 func (m memFS) Chmod(name string, mode os.FileMode) error { panic("TODO") }
 func (m memFS) Rename(oldName, newName string) error      { panic("TODO") }
 func (m memFS) Remove(name string) error                  { panic("TODO") }
+func (m memFS) ActualPath(name string) string             { return name }
 func (m memFS) ReadFile(name string) ([]byte, error) {
 	v, ok := m[name]
 	if !ok {
diff --git a/net/dns/manager_test.go b/net/dns/manager_test.go
index 8a67aca5c..b10c89056 100644
--- a/net/dns/manager_test.go
+++ b/net/dns/manager_test.go
@@ -187,14 +187,15 @@ func TestManager(t *testing.T) {
 	// reasonable to make this unsupported as well, in which case
 	// these tests will need tweaking.
 	tests := []struct {
-		name  string
-		in    Config
-		split bool
-		bs    OSConfig
-		os    OSConfig
-		knobs *controlknobs.Knobs
-		rs    resolver.Config
-		goos  string // empty means "linux"
+		name           string
+		in             Config
+		split          bool
+		bs             OSConfig
+		os             OSConfig
+		knobs          *controlknobs.Knobs
+		rs             resolver.Config
+		goos           string // empty means "linux"
+		sandboxedMacOS bool
 	}{
 		{
 			name: "empty",
@@ -450,6 +451,32 @@ func TestManager(t *testing.T) {
 				MatchDomains:  fqdns("corp.com"),
 			},
 		},
+		{
+			// Sandboxed macOS app builds use NetworkExtension DNS settings, not
+			// tailscaled's /etc/resolver configurator, so they keep the older
+			// Apple base-config behavior.
+			name: "routes-split-sandboxed-darwin",
+			in: Config{
+				Routes:        upstreams("corp.com", "2.2.2.2"),
+				SearchDomains: fqdns("tailscale.com", "universe.tf"),
+			},
+			split: true,
+			bs: OSConfig{
+				Nameservers:   mustIPs("8.8.8.8"),
+				SearchDomains: fqdns("coffee.shop"),
+			},
+			os: OSConfig{
+				Nameservers:   serviceAddr46,
+				SearchDomains: fqdns("tailscale.com", "universe.tf", "coffee.shop"),
+			},
+			rs: resolver.Config{
+				Routes: upstreams(
+					".", "8.8.8.8",
+					"corp.com.", "2.2.2.2"),
+			},
+			goos:           "darwin",
+			sandboxedMacOS: true,
+		},
 		{
 			name: "routes-multi",
 			in: Config{
@@ -495,25 +522,23 @@ func TestManager(t *testing.T) {
 			goos: "linux",
 		},
 		{
-			// The `routes-multi-split-linux` test case above on Darwin should NOT result in a split
-			// DNS configuration.
-			// Check that MatchDomains is empty. Due to Apple limitations, we cannot set MatchDomains
-			// without those domains also being SearchDomains.
-			name: "routes-multi-does-not-split-on-darwin",
+			// The `routes-multi-split-linux` test case above should match on
+			// macOS, where tailscaled configures split DNS via /etc/resolver.
+			name: "routes-multi-split-darwin",
 			in: Config{
 				Routes: upstreams(
 					"corp.com", "2.2.2.2",
 					"bigco.net", "3.3.3.3"),
 				SearchDomains: fqdns("tailscale.com", "universe.tf"),
 			},
-			split: false,
+			split: true,
 			os: OSConfig{
 				Nameservers:   serviceAddr46,
 				SearchDomains: fqdns("tailscale.com", "universe.tf"),
+				MatchDomains:  fqdns("bigco.net", "corp.com"),
 			},
 			rs: resolver.Config{
 				Routes: upstreams(
-					".", "",
 					"corp.com.", "2.2.2.2",
 					"bigco.net.", "3.3.3.3"),
 			},
@@ -593,10 +618,9 @@ func TestManager(t *testing.T) {
 			goos: "linux",
 		},
 		{
-			// The `magic-split` test case above on Darwin should NOT result in a split DNS configuration.
-			// Check that MatchDomains is empty. Due to Apple limitations, we cannot set MatchDomains
-			// without those domains also being SearchDomains.
-			name: "magic-split-does-not-split-on-darwin",
+			// The `magic-split` test case above should match on macOS, where
+			// tailscaled configures split DNS via /etc/resolver.
+			name: "magic-split-darwin",
 			in: Config{
 				Hosts: hosts(
 					"dave.ts.com.", "1.2.3.4",
@@ -604,13 +628,13 @@ func TestManager(t *testing.T) {
 				Routes:        upstreams("ts.com", ""),
 				SearchDomains: fqdns("tailscale.com", "universe.tf"),
 			},
-			split: false,
+			split: true,
 			os: OSConfig{
 				Nameservers:   serviceAddr46,
 				SearchDomains: fqdns("tailscale.com", "universe.tf"),
+				MatchDomains:  fqdns("ts.com"),
 			},
 			rs: resolver.Config{
-				Routes: upstreams(".", ""),
 				Hosts: hosts(
 					"dave.ts.com.", "1.2.3.4",
 					"bradfitz.ts.com.", "2.3.4.5"),
@@ -698,11 +722,9 @@ func TestManager(t *testing.T) {
 			goos: "linux",
 		},
 		{
-			// The `routes-magic-split-linux` test case above on Darwin should NOT result in a
-			// split DNS configuration.
-			// Check that MatchDomains is empty. Due to Apple limitations, we cannot set MatchDomains
-			// without those domains also being SearchDomains.
-			name: "routes-magic-does-not-split-on-darwin",
+			// The `routes-magic-split-linux` test case above should match on
+			// macOS, where tailscaled configures split DNS via /etc/resolver.
+			name: "routes-magic-split-darwin",
 			in: Config{
 				Routes: upstreams(
 					"corp.com", "2.2.2.2",
@@ -716,12 +738,10 @@ func TestManager(t *testing.T) {
 			os: OSConfig{
 				Nameservers:   serviceAddr46,
 				SearchDomains: fqdns("tailscale.com", "universe.tf"),
+				MatchDomains:  fqdns("corp.com", "ts.com"),
 			},
 			rs: resolver.Config{
-				Routes: upstreams(
-					".", "",
-					"corp.com.", "2.2.2.2",
-				),
+				Routes: upstreams("corp.com.", "2.2.2.2"),
 				Hosts: hosts(
 					"dave.ts.com.", "1.2.3.4",
 					"bradfitz.ts.com.", "2.3.4.5"),
@@ -866,9 +886,9 @@ func TestManager(t *testing.T) {
 			goos: "ios",
 		},
 		{
-			// on darwin, verify that with the same config as in ios-use-split-dns-when-no-custom-resolvers,
-			// MatchDomains are NOT set.
-			name: "darwin-dont-use-split-dns-when-no-custom-resolvers",
+			// macOS should match Linux here. iOS remains special-cased above
+			// for battery-life behavior.
+			name: "darwin-use-split-dns-when-no-custom-resolvers",
 			in: Config{
 				Routes:        upstreams("ts.net", "199.247.155.52", "optimistic-display.ts.net", ""),
 				SearchDomains: fqdns("optimistic-display.ts.net"),
@@ -877,12 +897,10 @@ func TestManager(t *testing.T) {
 			os: OSConfig{
 				Nameservers:   serviceAddr46,
 				SearchDomains: fqdns("optimistic-display.ts.net"),
+				MatchDomains:  fqdns("optimistic-display.ts.net", "ts.net"),
 			},
 			rs: resolver.Config{
-				Routes: upstreams(
-					".", "",
-					"ts.net", "199.247.155.52",
-				),
+				Routes:       upstreams("ts.net", "199.247.155.52"),
 				LocalDomains: fqdns("optimistic-display.ts.net."),
 			},
 			goos: "darwin",
@@ -957,6 +975,23 @@ func TestManager(t *testing.T) {
 			},
 			goos: "windows",
 		},
+		{
+			// Regression test for #19834
+			name: "single-doh-splitdns-no-magicdns",
+			in: Config{
+				Routes: upstreams(
+					"example.com", "http://100.101.102.103:1234/dns-query"),
+			},
+			split: true,
+			os: OSConfig{
+				Nameservers:  serviceAddr46,
+				MatchDomains: fqdns("example.com"),
+			},
+			rs: resolver.Config{
+				Routes: upstreams("example.com.", "http://100.101.102.103:1234/dns-query"),
+			},
+			goos: "linux",
+		},
 	}
 
 	trIP := cmp.Transformer("ipStr", func(ip netip.Addr) string { return ip.String() })
@@ -969,6 +1004,7 @@ func TestManager(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
+			tstest.Replace(t, &isSandboxedMacOS, func() bool { return test.sandboxedMacOS })
 			f := fakeOSConfigurator{
 				SplitDNS:   test.split,
 				BaseConfig: test.bs,
diff --git a/net/dns/manager_windows.go b/net/dns/manager_windows.go
index 1e412b2d2..71f7011c3 100644
--- a/net/dns/manager_windows.go
+++ b/net/dns/manager_windows.go
@@ -8,6 +8,7 @@ import (
 	"bytes"
 	"errors"
 	"fmt"
+	"io/fs"
 	"maps"
 	"net/netip"
 	"os"
@@ -77,7 +78,7 @@ func NewOSConfigurator(logf logger.Logf, health *health.Tracker, bus *eventbus.B
 	}
 
 	var err error
-	if ret.unregisterPolicyChangeCb, err = polc.RegisterChangeCallback(ret.sysPolicyChanged); err != nil {
+	if ret.unregisterPolicyChangeCb, err = polc.RegisterChangeCallback("", ret.sysPolicyChanged); err != nil {
 		logf("error registering policy change callback: %v", err) // non-fatal
 	}
 
@@ -146,7 +147,7 @@ func (m *windowsManager) setSplitDNS(resolvers []netip.Addr, domains []dnsname.F
 		return fmt.Errorf("Split DNS unsupported on this Windows version")
 	}
 
-	defer m.nrptDB.Refresh()
+	defer m.nrptDB.NotifyPolicyChanged()
 	if len(resolvers) == 0 {
 		return m.nrptDB.DelAllRuleKeys()
 	}
@@ -246,7 +247,13 @@ func (m *windowsManager) setHosts(hosts []*HostEntry) error {
 	}
 	hostsFile := filepath.Join(systemDir, "drivers", "etc", "hosts")
 	b, err := os.ReadFile(hostsFile)
-	if err != nil {
+	switch {
+	case err == nil:
+		// Continue.
+	case errors.Is(err, fs.ErrNotExist):
+		// Non-fatal, we'll just create a new hosts file.
+		m.logf("failed to read the hosts file: %v", err)
+	default:
 		return err
 	}
 	outB, err := setTailscaleHosts(m.logf, b, hosts)
diff --git a/net/dns/manager_windows_test.go b/net/dns/manager_windows_test.go
index d1c65ed2b..ed994c30c 100644
--- a/net/dns/manager_windows_test.go
+++ b/net/dns/manager_windows_test.go
@@ -85,23 +85,23 @@ func TestHostFileChanged(t *testing.T) {
 }
 
 func TestManagerWindowsLocal(t *testing.T) {
-	if !isWindows10OrBetter() || !winutil.IsCurrentProcessElevated() {
-		t.Skipf("test requires running as elevated user on Windows 10+")
+	if !winutil.IsCurrentProcessLocalSystem() {
+		t.Skipf("test requires running as LocalSystem on Windows 10+")
 	}
 
 	runTest(t, true)
 }
 
 func TestManagerWindowsGP(t *testing.T) {
-	if !isWindows10OrBetter() || !winutil.IsCurrentProcessElevated() {
-		t.Skipf("test requires running as elevated user on Windows 10+")
+	if !winutil.IsCurrentProcessLocalSystem() {
+		t.Skipf("test requires running as LocalSystem on Windows 10+")
 	}
 
 	checkGPNotificationsWork(t)
 
-	// Make sure group policy is refreshed before this test exits but after we've
+	// Make sure group policy is current before this test exits but after we've
 	// cleaned everything else up.
-	defer gp.RefreshMachinePolicy(true)
+	defer gp.NotifyMachinePolicyChange()
 
 	err := createFakeGPKey()
 	if err != nil {
@@ -113,8 +113,8 @@ func TestManagerWindowsGP(t *testing.T) {
 }
 
 func TestManagerWindowsGPCopy(t *testing.T) {
-	if !isWindows10OrBetter() || !winutil.IsCurrentProcessElevated() {
-		t.Skipf("test requires running as elevated user on Windows 10+")
+	if !winutil.IsCurrentProcessLocalSystem() {
+		t.Skipf("test requires running as LocalSystem on Windows 10+")
 	}
 
 	checkGPNotificationsWork(t)
@@ -179,9 +179,9 @@ func TestManagerWindowsGPCopy(t *testing.T) {
 		t.Fatalf("regWatcher.watch: %v\n", err)
 	}
 
-	err = gp.RefreshMachinePolicy(true)
+	err = gp.NotifyMachinePolicyChange()
 	if err != nil {
-		t.Fatalf("testDoRefresh: %v\n", err)
+		t.Fatalf("NotifyMachinePolicyChange: %v\n", err)
 	}
 
 	err = regWatcher.wait()
@@ -203,9 +203,9 @@ func TestManagerWindowsGPCopy(t *testing.T) {
 		t.Fatalf("regWatcher.watch: %v\n", err)
 	}
 
-	err = gp.RefreshMachinePolicy(true)
+	err = gp.NotifyMachinePolicyChange()
 	if err != nil {
-		t.Fatalf("testDoRefresh: %v\n", err)
+		t.Fatalf("NotifyMachinePolicyChange: %v\n", err)
 	}
 
 	err = regWatcher.wait()
@@ -236,13 +236,13 @@ func checkGPNotificationsWork(t *testing.T) {
 	}
 	defer trk.Close()
 
-	err = gp.RefreshMachinePolicy(true)
+	err = gp.NotifyMachinePolicyChange()
 	if err != nil {
-		t.Fatalf("RefreshPolicyEx error: %v\n", err)
+		t.Fatalf("NotifyMachinePolicyChange error: %v\n", err)
 	}
 
 	timeout := uint32(10000) // Milliseconds
-	if !trk.DidRefreshTimeout(timeout) {
+	if !trk.DidGroupPolicyChangeTimeout(timeout) {
 		t.Skipf("GP notifications are not working on this machine\n")
 	}
 }
@@ -338,8 +338,8 @@ func runTest(t *testing.T, isLocal bool) {
 		}
 		validateRegistry(t, regBaseValidate, caseDomains)
 		ensureNoRulesInSubkey(t, regBaseEnsure)
-		if !isLocal && !trk.DidRefresh(true) {
-			t.Fatalf("DidRefresh false, want true\n")
+		if !isLocal && !trk.DidGroupPolicyChange(true) {
+			t.Fatalf("DidGroupPolicyChange false, want true\n")
 		}
 	}
 
@@ -347,10 +347,6 @@ func runTest(t *testing.T, isLocal bool) {
 		runCase(n)
 	}
 
-	if isLocal && trk.DidRefresh(false) {
-		t.Errorf("DidRefresh true, want false\n")
-	}
-
 	t.Logf("Test case: nil resolver\n")
 	err = mgr.setSplitDNS(nil, domains)
 	if err != nil {
@@ -573,7 +569,7 @@ var (
 )
 
 // gpNotificationTracker registers with the Windows policy engine and receives
-// notifications when policy refreshes occur.
+// notifications when policy change notifications occur.
 type gpNotificationTracker struct {
 	event windows.Handle
 }
@@ -602,7 +598,7 @@ func newGPNotificationTracker() (*gpNotificationTracker, error) {
 	return &gpNotificationTracker{evt}, nil
 }
 
-func (trk *gpNotificationTracker) DidRefresh(isExpected bool) bool {
+func (trk *gpNotificationTracker) DidGroupPolicyChange(isExpected bool) bool {
 	// If we're not expecting a refresh event, then we need to use a timeout.
 	timeout := uint32(1000) // 1 second (in milliseconds)
 	if isExpected {
@@ -610,10 +606,10 @@ func (trk *gpNotificationTracker) DidRefresh(isExpected bool) bool {
 		timeout = windows.INFINITE
 	}
 
-	return trk.DidRefreshTimeout(timeout)
+	return trk.DidGroupPolicyChangeTimeout(timeout)
 }
 
-func (trk *gpNotificationTracker) DidRefreshTimeout(timeout uint32) bool {
+func (trk *gpNotificationTracker) DidGroupPolicyChangeTimeout(timeout uint32) bool {
 	waitCode, _ := windows.WaitForSingleObject(trk.event, timeout)
 	return waitCode == windows.WAIT_OBJECT_0
 }
@@ -625,6 +621,8 @@ func (trk *gpNotificationTracker) Close() error {
 	return nil
 }
 
+const dnsBaseGP = `SOFTWARE\Policies\Microsoft\Windows NT\DNSClient`
+
 type regKeyWatcher struct {
 	keyGP registry.Key
 	evtGP windows.Handle
diff --git a/net/dns/nrpt_windows.go b/net/dns/nrpt_windows.go
index 6d9cf71b7..2ad404485 100644
--- a/net/dns/nrpt_windows.go
+++ b/net/dns/nrpt_windows.go
@@ -7,7 +7,6 @@ import (
 	"fmt"
 	"strings"
 	"sync"
-	"sync/atomic"
 
 	"golang.org/x/sys/windows"
 	"golang.org/x/sys/windows/registry"
@@ -19,7 +18,6 @@ import (
 )
 
 const (
-	dnsBaseGP     = `SOFTWARE\Policies\Microsoft\Windows NT\DNSClient`
 	nrptBaseLocal = `SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig`
 	nrptBaseGP    = `SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig`
 
@@ -53,13 +51,12 @@ const (
 // nrptRuleDatabase encapsulates access to the Windows Name Resolution Policy
 // Table (NRPT).
 type nrptRuleDatabase struct {
-	logf               logger.Logf
-	watcher            *gp.ChangeWatcher
-	isGPRefreshPending atomic.Bool
-	mu                 sync.Mutex // protects the fields below
-	ruleIDs            []string
-	isGPDirty          bool
-	writeAsGP          bool
+	logf      logger.Logf
+	watcher   *gp.ChangeWatcher
+	mu        sync.Mutex // protects the fields below
+	ruleIDs   []string
+	isGPDirty bool
+	writeAsGP bool
 }
 
 func newNRPTRuleDatabase(logf logger.Logf) *nrptRuleDatabase {
@@ -141,6 +138,12 @@ func (db *nrptRuleDatabase) detectWriteAsGP() {
 	writeAsGP = len(gpSubkeyMap) > 0
 }
 
+func regKeyHasNoValues(ki *registry.KeyInfo) bool {
+	// Either the key has no values, or there is one value: an empty default value.
+	return ki.ValueCount == 0 ||
+		ki.ValueCount == 1 && ki.MaxValueNameLen == 0 && ki.MaxValueLen == 0
+}
+
 // DelAllRuleKeys removes any and all NRPT rules that are owned by Tailscale.
 func (db *nrptRuleDatabase) DelAllRuleKeys() error {
 	db.mu.Lock()
@@ -171,7 +174,7 @@ func (db *nrptRuleDatabase) delRuleKeys(nrptRuleIDs []string) error {
 		keyNameGP := nrptBaseGP + `\` + rid
 		err := registry.DeleteKey(registry.LOCAL_MACHINE, keyNameGP)
 		if err == nil {
-			// If this deleted subkey existed under the GP key, we will need to refresh.
+			// If this deleted subkey existed under the GP key, we will need to notify.
 			db.isGPDirty = true
 		} else if err != registry.ErrNotExist {
 			db.logf("Error deleting NRPT rule key %q: %v", keyNameGP, err)
@@ -193,8 +196,8 @@ func (db *nrptRuleDatabase) delRuleKeys(nrptRuleIDs []string) error {
 	return registry.DeleteKey(registry.LOCAL_MACHINE, nrptBaseGP)
 }
 
-// isPolicyConfigSubkeyEmpty returns true if and only if the nrptBaseGP exists
-// and does not contain any values or subkeys.
+// isPolicyConfigSubkeyEmpty returns whether the nrptBaseGP exists and does not
+// contain any values or subkeys.
 func isPolicyConfigSubkeyEmpty() (bool, error) {
 	subKey, err := registry.OpenKey(registry.LOCAL_MACHINE, nrptBaseGP, registry.READ)
 	if err != nil {
@@ -210,7 +213,7 @@ func isPolicyConfigSubkeyEmpty() (bool, error) {
 		return false, err
 	}
 
-	return (ki.ValueCount == 0 && ki.SubKeyCount == 0), nil
+	return regKeyHasNoValues(ki) && ki.SubKeyCount == 0, nil
 }
 
 func (db *nrptRuleDatabase) WriteSplitDNSConfig(servers []string, domains []dnsname.FQDN) error {
@@ -277,26 +280,22 @@ func (db *nrptRuleDatabase) WriteSplitDNSConfig(servers []string, domains []dnsn
 	return nil
 }
 
-// Refresh notifies the Windows group policy engine when policies have changed.
-func (db *nrptRuleDatabase) Refresh() {
+// NotifyPolicyChanged notifies the Windows group policy engine when policies have changed.
+func (db *nrptRuleDatabase) NotifyPolicyChanged() {
 	db.mu.Lock()
 	defer db.mu.Unlock()
 
-	db.refreshLocked()
+	db.notifyPolicyChangedLocked()
 }
 
-func (db *nrptRuleDatabase) refreshLocked() {
+func (db *nrptRuleDatabase) notifyPolicyChangedLocked() {
 	if !db.isGPDirty {
 		return
 	}
 
-	// Record that we are about to initiate a refresh.
-	// (*nrptRuleDatabase).watchForGPChanges() checks this value to avoid false
-	// positives.
-	db.isGPRefreshPending.Store(true)
-
-	if err := gp.RefreshMachinePolicy(true); err != nil {
-		db.logf("RefreshMachinePolicy failed: %v", err)
+	db.logf("Calling NotifyMachinePolicyChange")
+	if err := gp.NotifyMachinePolicyChange(); err != nil {
+		db.logf("NotifyMachinePolicyChange failed: %v", err)
 		return
 	}
 
@@ -355,12 +354,7 @@ func writeNRPTValues(key registry.Key, servers string, doms []string) error {
 
 func (db *nrptRuleDatabase) watchForGPChanges() {
 	watchHandler := func() {
-		// Do not invoke detectWriteAsGP when we ourselves were responsible for
-		// initiating the group policy refresh.
-		if db.isGPRefreshPending.CompareAndSwap(true, false) {
-			return
-		}
-		db.logf("Computer group policies refreshed, reconfiguring NRPT rule database.")
+		db.logf("Received machine group policy change notification. Reconfiguring NRPT rule database.")
 		db.detectWriteAsGP()
 	}
 
@@ -380,8 +374,8 @@ func (db *nrptRuleDatabase) watchForGPChanges() {
 // db.mu must already be locked.
 func (db *nrptRuleDatabase) updateGroupPoliciesLocked(writeAsGP bool) {
 	// Since we're updating the group policy NRPT table, we need
-	// to refresh once this updateGroupPoliciesLocked is done.
-	defer db.refreshLocked()
+	// to notify once this updateGroupPoliciesLocked is done.
+	defer db.notifyPolicyChangedLocked()
 
 	for _, id := range db.ruleIDs {
 		if writeAsGP {
diff --git a/net/dns/publicdns/publicdns.go b/net/dns/publicdns/publicdns.go
index 3666bd778..fe4d1caa6 100644
--- a/net/dns/publicdns/publicdns.go
+++ b/net/dns/publicdns/publicdns.go
@@ -7,15 +7,11 @@ package publicdns
 
 import (
 	"bytes"
-	"encoding/binary"
 	"encoding/hex"
 	"fmt"
-	"log"
-	"math/big"
 	"net/netip"
 	"slices"
 	"sort"
-	"strconv"
 	"strings"
 	"sync"
 
@@ -60,12 +56,15 @@ func DoHEndpointFromIP(ip netip.Addr) (dohBase string, dohOnly bool, ok bool) {
 		return sb.String(), true, true
 	}
 
-	// Control D DoH URLs are of the form "https://dns.controld.com/8yezwenugs"
-	// where the path component is represented by 8 bytes (7-14) of the IPv6 address in base36
-	if controlDv6RangeA.Contains(ip) || controlDv6RangeB.Contains(ip) {
-		path := big.NewInt(0).SetBytes(ip.AsSlice()[6:14]).Text(36)
-		return controlDBase + path, true, true
-	}
+	// Control D's free anycast resolvers (freedns.controld.com/pN) are the only
+	// Control D addresses that serve DoH; they're registered as exact entries in
+	// dohOfIP (see populate) and are handled by the lookup above.
+	//
+	// The ID-encoded addresses in the 2606:1a40::/48 ranges (customer resolver ID
+	// base36-encoded into the address) are legacy plaintext-DNS (port 53) endpoints
+	// that refuse DoH on :443, so we deliberately don't upgrade them to DoH here:
+	// they fall through and are used as ordinary port-53 resolvers. Premium DoH is
+	// only reachable via the dns.controld.com/<id> URL path (see DoHIPsOfBase).
 
 	return "", false, false
 }
@@ -126,15 +125,12 @@ func DoHIPsOfBase(dohBase string) []netip.Addr {
 			}
 		}
 	}
-	if pathStr, ok := strings.CutPrefix(dohBase, controlDBase); ok {
-		if i := strings.IndexFunc(pathStr, isSlashOrQuestionMark); i != -1 {
-			pathStr = pathStr[:i]
-		}
+	if strings.HasPrefix(dohBase, controlDBase) {
 		return []netip.Addr{
 			controlDv4One,
 			controlDv4Two,
-			controlDv6Gen(controlDv6RangeA.Addr(), pathStr),
-			controlDv6Gen(controlDv6RangeB.Addr(), pathStr),
+			controlDv6One,
+			controlDv6Two,
 		}
 	}
 	return nil
@@ -330,6 +326,8 @@ var (
 	controlDv6RangeB = netip.MustParsePrefix("2606:1a40:1::/48")
 	controlDv4One    = netip.MustParseAddr("76.76.2.22")
 	controlDv4Two    = netip.MustParseAddr("76.76.10.22")
+	controlDv6One    = netip.MustParseAddr("2606:1a40::22")
+	controlDv6Two    = netip.MustParseAddr("2606:1a40:1::22")
 )
 
 // nextDNSv6Gen generates a NextDNS IPv6 address from the upper 8 bytes in the
@@ -343,23 +341,6 @@ func nextDNSv6Gen(ip netip.Addr, id []byte) netip.Addr {
 	return netip.AddrFrom16(a)
 }
 
-// controlDv6Gen generates a Control D IPv6 address from provided ip and id.
-//
-// The id is taken from the DoH query path component and represents a unique resolver configuration.
-// e.g. https://dns.controld.com/hyq3ipr2ct
-func controlDv6Gen(ip netip.Addr, id string) netip.Addr {
-	b := make([]byte, 8)
-	decoded, err := strconv.ParseUint(id, 36, 64)
-	if err != nil {
-		log.Printf("controlDv6Gen: failed to parse id %q: %v", id, err)
-	}
-	binary.BigEndian.PutUint64(b, decoded)
-	a := ip.AsSlice()
-	copy(a[6:14], b)
-	addr, _ := netip.AddrFromSlice(a)
-	return addr
-}
-
 // IPIsDoHOnlyServer reports whether ip is a DNS server that should only use
 // DNS-over-HTTPS (not regular port 53 DNS).
 func IPIsDoHOnlyServer(ip netip.Addr) bool {
diff --git a/net/dns/publicdns/publicdns_test.go b/net/dns/publicdns/publicdns_test.go
index 4f494930b..5c3031fab 100644
--- a/net/dns/publicdns/publicdns_test.go
+++ b/net/dns/publicdns/publicdns_test.go
@@ -28,6 +28,46 @@ func TestInit(t *testing.T) {
 	}
 }
 
+func TestDoHEndpointFromIP(t *testing.T) {
+	tests := []struct {
+		name     string
+		ip       string
+		wantBase string
+		wantOnly bool
+		wantOK   bool
+	}{
+		// Control D free anycast resolvers (freedns.controld.com/pN) serve DoH
+		// and are dual-stack (also speak port 53), so dohOnly is false.
+		{"controld_free_v6_p0", "2606:1a40::", "https://freedns.controld.com/p0", false, true},
+		{"controld_free_v6_p1", "2606:1a40:1::1", "https://freedns.controld.com/p1", false, true},
+		{"controld_free_v4_p1", "76.76.2.1", "https://freedns.controld.com/p1", false, true},
+		{"controld_free_v4_family", "76.76.10.4", "https://freedns.controld.com/family", false, true},
+
+		// ID-encoded addresses in the Control D /48 ranges are legacy
+		// plaintext-DNS (port 53) endpoints that refuse DoH, so they must not be
+		// upgraded to DoH; DoHEndpointFromIP reports them as unknown.
+		{"controld_id_encoded_a", "2606:1a40:0:0:0:1234:5678:9abc", "", false, false},
+		{"controld_id_encoded_b", "2606:1a40:1:0:0:1234:5678:9abc", "", false, false},
+		// The premium anycast address has no resolver ID in the bare IP, so it
+		// can't be mapped to a DoH URL here either.
+		{"controld_premium_anycast", "2606:1a40::22", "", false, false},
+
+		// A well-known dual-stack DoH server upgrades but isn't dohOnly.
+		{"google_v4", "8.8.8.8", "https://dns.google/dns-query", false, true},
+		// A NextDNS ID-encoded address is DoH-only.
+		{"nextdns_v6", "2a07:a8c0::c3:a884", "https://dns.nextdns.io/c3a884", true, true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			base, only, ok := DoHEndpointFromIP(netip.MustParseAddr(tt.ip))
+			if base != tt.wantBase || only != tt.wantOnly || ok != tt.wantOK {
+				t.Errorf("DoHEndpointFromIP(%s) = (%q, %v, %v); want (%q, %v, %v)",
+					tt.ip, base, only, ok, tt.wantBase, tt.wantOnly, tt.wantOK)
+			}
+		})
+	}
+}
+
 func TestDoHV6(t *testing.T) {
 	tests := []struct {
 		in      string
@@ -121,8 +161,8 @@ func TestDoHIPsOfBase(t *testing.T) {
 			want: ips(
 				"76.76.2.22",
 				"76.76.10.22",
-				"2606:1a40:0:6:7b5b:5949:35ad:0",
-				"2606:1a40:1:6:7b5b:5949:35ad:0",
+				"2606:1a40::22",
+				"2606:1a40:1::22",
 			),
 		},
 		{
@@ -130,8 +170,8 @@ func TestDoHIPsOfBase(t *testing.T) {
 			want: ips(
 				"76.76.2.22",
 				"76.76.10.22",
-				"2606:1a40:0:ffff:ffff:ffff:ffff:0",
-				"2606:1a40:1:ffff:ffff:ffff:ffff:0",
+				"2606:1a40::22",
+				"2606:1a40:1::22",
 			),
 		},
 		{
@@ -139,8 +179,8 @@ func TestDoHIPsOfBase(t *testing.T) {
 			want: ips(
 				"76.76.2.22",
 				"76.76.10.22",
-				"2606:1a40:0:6:7b5b:5949:35ad:0",
-				"2606:1a40:1:6:7b5b:5949:35ad:0",
+				"2606:1a40::22",
+				"2606:1a40:1::22",
 			),
 		},
 	}
diff --git a/net/dns/resolver/forwarder.go b/net/dns/resolver/forwarder.go
index ed7ff78f7..bd1245ad1 100644
--- a/net/dns/resolver/forwarder.go
+++ b/net/dns/resolver/forwarder.go
@@ -13,6 +13,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"maps"
 	"net"
 	"net/http"
 	"net/netip"
@@ -41,8 +42,10 @@ import (
 	"tailscale.com/types/dnstype"
 	"tailscale.com/types/logger"
 	"tailscale.com/types/nettype"
+	"tailscale.com/types/views"
 	"tailscale.com/util/cloudenv"
 	"tailscale.com/util/dnsname"
+	"tailscale.com/util/mak"
 	"tailscale.com/util/race"
 	"tailscale.com/version"
 )
@@ -324,6 +327,19 @@ type forwarder struct {
 	// resolver lookup.
 	cloudHostFallback []resolverAndDelay
 
+	// schemes are the collection of registered URI scheme names that
+	// dynamically decide which resolver to use at the time of each query. The
+	// key is the scheme (the portion before the first `:`) and the value is a
+	// handler that determines where the current query should be sent.
+	// Use schemeCacheLocked() to get the current contents that can continue to
+	// be accessed once mu is released. This allows the (much more common)
+	// resolver code path to avoid repeated locking and unlocking.
+	// When modified, call invalidateSchemeCacheLocked() before unlocking mu.
+	schemes map[string]CustomSchemeHandler
+	// schemeCache is an immutable copy of schemes. Do not read directly,
+	// use schemeCacheLocked() which will regenerate its contents as needed.
+	schemeCache views.Map[string, CustomSchemeHandler]
+
 	// acceptDNS tracks the CorpDNS pref (--accept-dns)
 	// This lets us skip health warnings if the forwarder receives inbound
 	// queries directly - but we didn't configure it with any upstream resolvers.
@@ -331,6 +347,11 @@ type forwarder struct {
 	acceptDNS bool
 }
 
+func (f *forwarder) probeLocks() {
+	f.mu.Lock()
+	f.mu.Unlock()
+}
+
 func newForwarder(logf logger.Logf, netMon *netmon.Monitor, linkSel ForwardLinkSelector, dialer *tsdial.Dialer, health *health.Tracker, knobs *controlknobs.Knobs) *forwarder {
 	if !buildfeatures.HasDNS {
 		return nil
@@ -996,15 +1017,66 @@ func (f *forwarder) sendTCP(ctx context.Context, fq *forwardQuery, rr resolverAn
 	return out, nil
 }
 
+// applySchemes resolves any custom-scheme entries in rrs using the provided
+// scheme handlers, returning the resulting slice. Entries whose handler returns
+// an error or empty string are dropped. Entries with no registered scheme pass
+// through unchanged. If schemes is nil, rrs is returned as-is.
+func applySchemes(logf logger.Logf, rrs []resolverAndDelay, schemes views.Map[string, CustomSchemeHandler]) []resolverAndDelay {
+	if schemes.IsNil() {
+		return rrs
+	}
+	var result []resolverAndDelay
+	for i, rr := range rrs {
+		scheme, _, hasColon := strings.Cut(rr.name.Addr, ":")
+		handler, isCustom := schemes.GetOk(scheme)
+		if !hasColon || !isCustom {
+			if result != nil {
+				result = append(result, rr)
+			}
+			continue
+		}
+		// Avoid making a results slice in the common case where there
+		// are no custom scheme resolvers.
+		if result == nil {
+			result = make([]resolverAndDelay, i, len(rrs))
+			copy(result, rrs)
+		}
+		newAddr, err := handler(rr.name.Addr)
+		if err != nil {
+			logf("error from custom scheme handler, skipping resolver : %v", err)
+		}
+		if err != nil || newAddr == "" {
+			continue
+		}
+		newResolver := *rr.name
+		newResolver.Addr = newAddr
+		result = append(result, resolverAndDelay{name: &newResolver, startDelay: rr.startDelay})
+	}
+	// If we didn't have any custom schemes, return the original rrs.
+	if result == nil {
+		return rrs
+	}
+	return result
+}
+
 // resolvers returns the resolvers to use for domain.
 func (f *forwarder) resolvers(domain dnsname.FQDN) []resolverAndDelay {
 	f.mu.Lock()
 	routes := f.routes
 	cloudHostFallback := f.cloudHostFallback
+	schemes := f.schemeCacheLocked()
 	f.mu.Unlock()
+
 	for _, route := range routes {
-		if route.Suffix == "." || route.Suffix.Contains(domain) {
-			return route.Resolvers
+		if route.Suffix != "." && !route.Suffix.Contains(domain) {
+			continue
+		}
+		resolved := applySchemes(f.logf, route.Resolvers, schemes)
+		// If scheme resolution filtered out all resolvers from a non-empty
+		// route, fall through to the next matching route. If the resolvers
+		// were configured to be empty allow resolved to be empty.
+		if len(resolved) > 0 || len(route.Resolvers) == 0 {
+			return resolved
 		}
 	}
 	return cloudHostFallback // or nil if no fallback
@@ -1021,6 +1093,39 @@ func (f *forwarder) GetUpstreamResolvers(name dnsname.FQDN) []*dnstype.Resolver
 	return upstreamResolvers
 }
 
+// RegisterCustomScheme adds a [CustomSchemeHandler] that is called to provide
+// an updated address when a [dnstype.Resolver.Addr] uses that scheme.
+func (f *forwarder) RegisterCustomScheme(scheme string, h CustomSchemeHandler) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if _, ok := f.schemes[scheme]; ok {
+		return fmt.Errorf("scheme %q already registered", scheme)
+	}
+	f.invalidateSchemeCacheLocked()
+	mak.Set(&f.schemes, scheme, h)
+	return nil
+}
+
+// invalidateSchemeCacheLocked clears f.schemeCache so that it will be rebuilt
+// on the next call to f.schemeCacheLocked().
+func (f *forwarder) invalidateSchemeCacheLocked() {
+	f.schemeCache = views.Map[string, CustomSchemeHandler]{}
+}
+
+// schemeCacheLocked returns an immutable copy of f.schemes that can be used
+// after mu is unlocked.
+func (f *forwarder) schemeCacheLocked() views.Map[string, CustomSchemeHandler] {
+	if !f.schemeCache.IsNil() {
+		return f.schemeCache
+	}
+	if f.schemes == nil {
+		return f.schemeCache // returns a nil view
+	}
+	// Regenerate the cache
+	f.schemeCache = views.MapOf(maps.Clone(f.schemes))
+	return f.schemeCache
+}
+
 // forwardQuery is information and state about a forwarded DNS query that's
 // being sent to 1 or more upstreams.
 //
@@ -1094,10 +1199,11 @@ func (f *forwarder) forwardWithDestChan(ctx context.Context, query packet, respo
 	if len(resolvers) == 0 {
 		resolvers = f.resolvers(domain)
 		if len(resolvers) == 0 {
+			// No upstream resolver for this name isn't a forwarder failure:
+			// it's split DNS / a name we weren't asked to handle. Count it
+			// rather than raising dnsForwarderFailing, which is reserved for
+			// resolvers we found but couldn't reach. See tailscale/tailscale#19931.
 			metricDNSFwdErrorNoUpstream.Add(1)
-			if f.acceptDNS {
-				f.health.SetUnhealthy(dnsForwarderFailing, health.Args{health.ArgDNSServers: ""})
-			}
 			f.logf("no upstream resolvers set, returning SERVFAIL")
 
 			res, err := servfailResponse(query)
@@ -1243,8 +1349,7 @@ func (f *forwarder) forwardWithDestChan(ctx context.Context, query packet, respo
 
 			// If we haven't got an error or a successful response,
 			// include all resolvers in the error message so we can
-			// at least see what what servers we're trying to
-			// query.
+			// at least see what servers we're trying to query.
 			var resolverAddrs []string
 			for _, rr := range resolvers {
 				resolverAddrs = append(resolverAddrs, rr.name.Addr)
diff --git a/net/dns/resolver/forwarder_test.go b/net/dns/resolver/forwarder_test.go
index faaaa9f3c..7aca3d061 100644
--- a/net/dns/resolver/forwarder_test.go
+++ b/net/dns/resolver/forwarder_test.go
@@ -12,6 +12,7 @@ import (
 	"io"
 	"net"
 	"net/netip"
+	"os"
 	"reflect"
 	"slices"
 	"strings"
@@ -23,10 +24,12 @@ import (
 	dns "golang.org/x/net/dns/dnsmessage"
 	"tailscale.com/control/controlknobs"
 	"tailscale.com/health"
+	"tailscale.com/net/dns/publicdns"
 	"tailscale.com/net/netmon"
 	"tailscale.com/net/tsdial"
 	"tailscale.com/tstest"
 	"tailscale.com/types/dnstype"
+	"tailscale.com/util/dnsname"
 	"tailscale.com/util/eventbus/eventbustest"
 )
 
@@ -143,9 +146,19 @@ func TestResolversWithDelays(t *testing.T) {
 			want: o("https://dns.nextdns.io/c3a884"),
 		},
 		{
-			name: "controld-ipv6-expand",
+			// ID-encoded Control D addresses are legacy port-53-only
+			// endpoints (see #20433); they must not be upgraded to DoH and
+			// instead pass through as ordinary port-53 resolvers.
+			name: "controld-ipv6-id-encoded-not-doh",
 			in:   q("2606:1a40:0:6:7b5b:5949:35ad:0"),
-			want: o("https://dns.controld.com/hyq3ipr2ct"),
+			want: o("2606:1a40:0:6:7b5b:5949:35ad:0"),
+		},
+		{
+			// The free anycast resolvers (freedns.controld.com/pN) do serve
+			// DoH and are upgraded.
+			name: "controld-free-anycast-doh",
+			in:   q("2606:1a40::1"),
+			want: o("https://freedns.controld.com/p1", "2606:1a40::1+0.5s"),
 		},
 		{
 			name: "controld-doh-input",
@@ -225,6 +238,84 @@ func TestGetKnownDoHClientForProvider(t *testing.T) {
 	t.Logf("Got: %+v", res)
 }
 
+// TestControlDPremiumDoHLive exercises the real DoH dial path against Control D's
+// live infrastructure for a premium resolver, to confirm end-to-end that we use
+// reachable DoH endpoints (see ESC-30: we previously synthesized per-resolver
+// IPv6 addresses that only speak plaintext DNS on port 53 and refuse :443).
+//
+// It is disabled by default and only runs when TS_TEST_CONTROLD_RESOLVER_ID is
+// set to a Control D premium resolver ID (the path component of a
+// https://dns.controld.com/<id> DoH URL). For example:
+//
+//	TS_TEST_CONTROLD_RESOLVER_ID=abc123 go test ./net/dns/resolver/ \
+//	    -run TestControlDPremiumDoHLive -v
+//
+// To reproduce the pre-fix failure, temporarily revert DoHIPsOfBase to return
+// the controlDv6Gen-synthesized addresses: on an IPv6-only network this test
+// then fails with a connection error instead of a successful response.
+func TestControlDPremiumDoHLive(t *testing.T) {
+	id := os.Getenv("TS_TEST_CONTROLD_RESOLVER_ID")
+	if id == "" {
+		t.Skip("set TS_TEST_CONTROLD_RESOLVER_ID=<premium resolver id> to run")
+	}
+
+	logf := tstest.WhileTestRunningLogger(t)
+	bus := eventbustest.NewBus(t)
+	netMon, err := netmon.New(bus, logf)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var dialer tsdial.Dialer
+	dialer.SetNetMon(netMon)
+	dialer.SetBus(bus)
+	fwd := newForwarder(logf, netMon, nil, &dialer, health.NewTracker(bus), nil)
+
+	urlBase := "https://dns.controld.com/" + id
+	c, ok := fwd.getKnownDoHClientForProvider(urlBase)
+	if !ok {
+		t.Fatalf("no known DoH client for %q", urlBase)
+	}
+	t.Logf("dialing DoH IPs: %v", publicdns.DoHIPsOfBase(urlBase))
+
+	// Build an A query for example.com.
+	builder := dns.NewBuilder(nil, dns.Header{RecursionDesired: true})
+	builder.StartQuestions()
+	if err := builder.Question(dns.Question{
+		Name:  dns.MustNewName("example.com."),
+		Type:  dns.TypeA,
+		Class: dns.ClassINET,
+	}); err != nil {
+		t.Fatal(err)
+	}
+	query, err := builder.Finish()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	defer cancel()
+
+	res, err := fwd.sendDoH(ctx, urlBase, c, query)
+	if err != nil {
+		t.Fatalf("sendDoH: %v", err)
+	}
+	if rcode := getRCode(res); rcode != dns.RCodeSuccess {
+		t.Fatalf("got rcode %v, want success", rcode)
+	}
+
+	var p dns.Parser
+	if _, err := p.Start(res); err != nil {
+		t.Fatalf("parsing response: %v", err)
+	}
+	if err := p.SkipAllQuestions(); err != nil {
+		t.Fatalf("skipping questions: %v", err)
+	}
+	if _, err := p.AnswerHeader(); err != nil {
+		t.Fatalf("no answers returned: %v", err)
+	}
+	t.Logf("ControlD premium DoH query for example.com succeeded (%d bytes)", len(res))
+}
+
 func BenchmarkNameFromQuery(b *testing.B) {
 	builder := dns.NewBuilder(nil, dns.Header{})
 	builder.StartQuestions()
@@ -670,10 +761,7 @@ func makeResponseOfSize(tb testing.TB, domain string, targetSize int, includeOPT
 	if includeOPT {
 		baseSize += 11 // OPT record adds ~11 bytes
 	}
-	estimatedRecords := (targetSize - baseSize) / bytesPerRecord
-	if estimatedRecords < 1 {
-		estimatedRecords = 1
-	}
+	estimatedRecords := max((targetSize-baseSize)/bytesPerRecord, 1)
 
 	// Start with estimated records and adjust
 	txtLen := 200
@@ -740,10 +828,7 @@ func makeResponseOfSize(tb testing.TB, domain string, targetSize int, includeOPT
 			// If we need too many records, increase TXT length instead
 			txtLen = 255         // Max single TXT string length
 			bytesPerRecord = 280 // Adjusted estimate
-			estimatedRecords = (targetSize - baseSize) / bytesPerRecord
-			if estimatedRecords < 1 {
-				estimatedRecords = 1
-			}
+			estimatedRecords = max((targetSize-baseSize)/bytesPerRecord, 1)
 		}
 	}
 
@@ -1385,3 +1470,188 @@ func TestForwarderHealthOnContextExpiry(t *testing.T) {
 		})
 	}
 }
+
+// TestForwarderHealthNoUpstreamResolvers verifies that a query with no upstream
+// resolver never raises dnsForwarderFailing, regardless of acceptDNS; that
+// warning is reserved for resolvers we found but couldn't reach (see
+// TestForwarderHealthOnContextExpiry). See tailscale/tailscale#19931.
+func TestForwarderHealthNoUpstreamResolvers(t *testing.T) {
+	const domain = "no-resolver.example.com."
+
+	for _, acceptDNS := range []bool{true, false} {
+		t.Run(fmt.Sprintf("acceptDNS=%v", acceptDNS), func(t *testing.T) {
+			request := makeTestRequest(t, domain, dns.TypeA, 0)
+			logf := tstest.WhileTestRunningLogger(t)
+			bus := eventbustest.NewBus(t)
+			netMon, err := netmon.New(bus, logf)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			var dialer tsdial.Dialer
+			dialer.SetNetMon(netMon)
+			dialer.SetBus(bus)
+
+			ht := health.NewTracker(bus)
+			fwd := newForwarder(logf, netMon, nil, &dialer, ht, nil)
+			fwd.acceptDNS = acceptDNS
+			// No routes are configured, so the forwarder has no upstream
+			// resolver for the query and returns SERVFAIL.
+
+			rpkt := packet{
+				bs:     request,
+				family: "udp",
+				addr:   netip.MustParseAddrPort("127.0.0.1:12345"),
+			}
+			// Buffered so the SERVFAIL response can be sent without a reader.
+			responseChan := make(chan packet, 1)
+
+			if err := fwd.forwardWithDestChan(context.Background(), rpkt, responseChan); err != nil {
+				t.Fatalf("forwardWithDestChan: %v", err)
+			}
+
+			if ht.IsUnhealthy(dnsForwarderFailing) {
+				t.Error("dnsForwarderFailing was raised for a query with no upstream resolver; want healthy")
+			}
+		})
+	}
+}
+
+func TestResolversCustomScheme(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name      string
+		domain    dnsname.FQDN
+		schemes   map[string]CustomSchemeHandler
+		routes    map[dnsname.FQDN][]*dnstype.Resolver
+		wantAddrs []string
+	}{
+		{
+			name:    "no-custom-scheme",
+			domain:  "example.com.",
+			schemes: map[string]CustomSchemeHandler{},
+			routes: map[dnsname.FQDN][]*dnstype.Resolver{
+				"example.com.": {
+					{Addr: "192.168.1.1:53"},
+					{Addr: "192.168.1.2:53"},
+				},
+			},
+			wantAddrs: []string{"192.168.1.1:53", "192.168.1.2:53"},
+		},
+		{
+			name:   "single-custom-scheme",
+			domain: "example.com.",
+			schemes: map[string]CustomSchemeHandler{
+				"myscheme": func(string) (string, error) { return "1.2.3.4:53", nil },
+			},
+			routes: map[dnsname.FQDN][]*dnstype.Resolver{
+				"example.com.": {{Addr: "myscheme:customKey"}},
+			},
+			wantAddrs: []string{"1.2.3.4:53"},
+		},
+		{
+			name:   "with-other-resolvers",
+			domain: "example.com.",
+			schemes: map[string]CustomSchemeHandler{
+				"myscheme": func(key string) (string, error) { return "1.2.3.4:53", nil },
+			},
+			routes: map[dnsname.FQDN][]*dnstype.Resolver{
+				"example.com.": {
+					{Addr: "192.168.1.1:53"},
+					{Addr: "myscheme:customKey"},
+					{Addr: "192.168.1.2:53"},
+				},
+			},
+			wantAddrs: []string{"192.168.1.1:53", "1.2.3.4:53", "192.168.1.2:53"},
+		},
+		{
+			name:   "multiple-custom-schemes",
+			domain: "example.com.",
+			schemes: map[string]CustomSchemeHandler{
+				"schemeOne": func(string) (string, error) { return "1.2.3.4:53", nil },
+				"schemeTwo": func(string) (string, error) { return "5.6.7.8:53", nil },
+			},
+			routes: map[dnsname.FQDN][]*dnstype.Resolver{
+				"example.com.": {
+					{Addr: "schemeOne:customKey"},
+					{Addr: "schemeTwo:customKey"},
+				},
+			},
+			wantAddrs: []string{"1.2.3.4:53", "5.6.7.8:53"},
+		},
+		{
+			name:   "empty-string-means-no-resolver",
+			domain: "example.com.",
+			schemes: map[string]CustomSchemeHandler{
+				"myscheme": func(string) (string, error) { return "", nil },
+			},
+			routes: map[dnsname.FQDN][]*dnstype.Resolver{
+				"example.com.": {
+					{Addr: "192.168.1.1:53"},
+					{Addr: "myscheme:customKey"},
+				},
+			},
+			wantAddrs: []string{"192.168.1.1:53"},
+		},
+		{
+			name:   "error-means-no-resolver",
+			domain: "example.com.",
+			schemes: map[string]CustomSchemeHandler{
+				"myscheme": func(string) (string, error) { return "", fmt.Errorf("handler error") },
+			},
+			routes: map[dnsname.FQDN][]*dnstype.Resolver{
+				"example.com.": {
+					{Addr: "192.168.1.1:53"},
+					{Addr: "myscheme:customKey"},
+				},
+			},
+			wantAddrs: []string{"192.168.1.1:53"},
+		},
+		{
+			// If the best-matching route yields no resolvers after scheme
+			// resolution, fall through to the next matching route.
+			name:   "empty-scheme-result-falls-through-to-next-matching-route",
+			domain: "example.com.",
+			schemes: map[string]CustomSchemeHandler{
+				"myscheme": func(string) (string, error) { return "", nil },
+			},
+			routes: map[dnsname.FQDN][]*dnstype.Resolver{
+				"example.com.": {{Addr: "myscheme:customKey"}},
+				".":            {{Addr: "192.168.1.1:53"}},
+			},
+			wantAddrs: []string{"192.168.1.1:53"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			logf := tstest.WhileTestRunningLogger(t)
+			bus := eventbustest.NewBus(t)
+			netMon, err := netmon.New(bus, logf)
+			if err != nil {
+				t.Fatal(err)
+			}
+			var dialer tsdial.Dialer
+			dialer.SetNetMon(netMon)
+			dialer.SetBus(bus)
+
+			fwd := newForwarder(logf, netMon, nil, &dialer, health.NewTracker(bus), nil)
+			for scheme, handler := range tt.schemes {
+				if err := fwd.RegisterCustomScheme(scheme, handler); err != nil {
+					t.Fatal(err)
+				}
+			}
+
+			fwd.setRoutes(tt.routes, false)
+
+			got := fwd.resolvers(tt.domain)
+			var gotAddrs []string
+			for _, r := range got {
+				gotAddrs = append(gotAddrs, r.name.Addr)
+			}
+			if !slices.Equal(gotAddrs, tt.wantAddrs) {
+				t.Errorf("got %v, want %v", gotAddrs, tt.wantAddrs)
+			}
+		})
+	}
+}
diff --git a/net/dns/resolver/tsdns.go b/net/dns/resolver/tsdns.go
index 01f0c8a63..f447539f7 100644
--- a/net/dns/resolver/tsdns.go
+++ b/net/dns/resolver/tsdns.go
@@ -229,6 +229,53 @@ type Resolver struct {
 	hostToIP       map[dnsname.FQDN][]netip.Addr
 	ipToHost       map[netip.Addr]dnsname.FQDN
 	subdomainHosts set.Set[dnsname.FQDN]
+	magicHosts     MagicDNSHosts // or nil if none installed
+}
+
+// MagicDNSHosts is a live source of MagicDNS host records, installed
+// via [Resolver.SetMagicDNSHosts].
+//
+// It replaces the per-node entries of [Config.Hosts]: instead of the
+// caller pushing a full snapshot of every node's name and addresses
+// into the resolver on every (possibly incremental) netmap change,
+// the resolver pulls the answer for one name on demand from the
+// caller's live indexes. [Config.Hosts] remains for control's
+// DNS.ExtraRecords entries, which are few, and is consulted first.
+//
+// Implementations must be safe for concurrent use and cheap: the
+// methods are called on the DNS query serving path. Name lookups are
+// case-insensitive: the resolver passes lowercase names, but
+// implementations must not rely on that.
+type MagicDNSHosts interface {
+	// LookupHost returns the IPs to answer for the node with the
+	// given MagicDNS FQDN, and whether the name is known. It returns
+	// all answerable IPs regardless of record type; the resolver
+	// filters them by the query's type, and a known name with no IPs
+	// of the query's family is "name exists, no records", not
+	// NXDOMAIN.
+	LookupHost(dnsname.FQDN) (ips []netip.Addr, ok bool)
+
+	// LookupPTR returns the MagicDNS FQDN of the node that owns
+	// the given Tailscale IP, and whether the IP is known.
+	LookupPTR(netip.Addr) (_ dnsname.FQDN, ok bool)
+
+	// SubdomainHost reports whether fqdn names a node with the
+	// [tailcfg.NodeAttrDNSSubdomainResolve] attribute, whose
+	// subdomains all resolve to the node's own addresses.
+	SubdomainHost(dnsname.FQDN) bool
+}
+
+// SetMagicDNSHosts installs the live MagicDNS host source consulted
+// by forward and reverse MagicDNS lookups that miss [Config.Hosts].
+// It is expected to be called once, before the resolver serves
+// queries.
+func (r *Resolver) SetMagicDNSHosts(h MagicDNSHosts) {
+	if !buildfeatures.HasDNS {
+		return
+	}
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.magicHosts = h
 }
 
 type ForwardLinkSelector interface {
@@ -266,6 +313,16 @@ func New(logf logger.Logf, linkSel ForwardLinkSelector, dialer *tsdial.Dialer, h
 
 func (r *Resolver) TestOnlySetHook(hook func(Config)) { r.saveConfigForTests = hook }
 
+// ProbeLocks acquires and releases the resolver's internal mutexes.
+func (r *Resolver) ProbeLocks() {
+	r.mu.Lock()
+	r.mu.Unlock()
+
+	if r.forwarder != nil {
+		r.forwarder.probeLocks()
+	}
+}
+
 func (r *Resolver) SetConfig(cfg Config) error {
 	if !buildfeatures.HasDNS {
 		return nil
@@ -293,6 +350,18 @@ func (r *Resolver) SetConfig(cfg Config) error {
 	return nil
 }
 
+// CustomSchemeHandler takes a URI (retrieved from [dnstype.Resolver.Addr]) and
+// returns an updated URI to use for the current query. The result is only valid
+// for right now and may change over time.
+type CustomSchemeHandler func(addr string) (newAddr string, err error)
+
+// RegisterCustomScheme adds a [CustomSchemaHandler] that is called to provide
+// an updated address to the forwarder when a [dnstype.Resolver.Addr] uses that
+// scheme.
+func (r *Resolver) RegisterCustomScheme(scheme string, h CustomSchemeHandler) error {
+	return r.forwarder.RegisterCustomScheme(scheme, h)
+}
+
 // Close shuts down the resolver and ensures poll goroutines have exited.
 // The Resolver cannot be used again after Close is called.
 func (r *Resolver) Close() {
@@ -660,15 +729,23 @@ func (r *Resolver) resolveLocal(domain dnsname.FQDN, typ dns.Type) (netip.Addr,
 	hosts := r.hostToIP
 	localDomains := r.localDomains
 	subdomainHosts := r.subdomainHosts
+	magicHosts := r.magicHosts
 	r.mu.Unlock()
 
 	addrs, found := hosts[domain]
+	if !found && magicHosts != nil {
+		addrs, found = magicHosts.LookupHost(domain)
+	}
 	if !found {
 		for parent := domain.Parent(); parent != ""; parent = parent.Parent() {
 			if subdomainHosts.Contains(parent) {
 				addrs, found = hosts[parent]
 				break
 			}
+			if magicHosts != nil && magicHosts.SubdomainHost(parent) {
+				addrs, found = magicHosts.LookupHost(parent)
+				break
+			}
 		}
 	}
 	if !found {
@@ -741,23 +818,16 @@ func (r *Resolver) resolveLocal(domain dnsname.FQDN, typ dns.Type) (netip.Addr,
 }
 
 // resolveViaDomain synthesizes an IP address for quad-A DNS requests of the form
-// `<IPv4-address-with-hypens-instead-of-dots>-via-<siteid>[.*]`. Two prior formats that
-// didn't pan out (due to a Chrome issue and DNS search ndots issues) were
-// `<IPv4-address>.via-<X>` and the older `via-<X>.<IPv4-address>`,
-// where X is a decimal, or hex-encoded number with a '0x' prefix.
+// `<IPv4-address-with-hypens-instead-of-dots>-via-<siteid>[.*]`.
+// For example: "192-168-1-2-via-7" or "192-168-1-2-via-7.foo.ts.net."
 //
 // This exists as a convenient mapping into Tailscales 'Via Range'.
 //
 // It returns a zero netip.Addr and true to indicate a successful response with
 // an empty answers section if the specified domain is a valid Tailscale 4via6
 // domain, but the request type is neither quad-A nor ALL.
-//
-// TODO(maisem/bradfitz/tom): `<IPv4-address>.via-<X>` was introduced
-// (2022-06-02) to work around an issue in Chrome where it would treat
-// "http://via-1.1.2.3.4" as a search string instead of a URL. We should rip out
-// the old format in early 2023.
-func (r *Resolver) resolveViaDomain(domain dnsname.FQDN, typ dns.Type) (netip.Addr, bool) {
-	fqdn := string(domain.WithoutTrailingDot())
+func (r *Resolver) resolveViaDomain(dnsName dnsname.FQDN, typ dns.Type) (netip.Addr, bool) {
+	fqdn := string(dnsName.WithoutTrailingDot())
 	switch typ {
 	case dns.TypeA, dns.TypeAAAA, dns.TypeALL:
 		// For Type A requests, we should return a successful response
@@ -771,45 +841,23 @@ func (r *Resolver) resolveViaDomain(domain dnsname.FQDN, typ dns.Type) (netip.Ad
 	default:
 		return netip.Addr{}, false
 	}
-	if len(fqdn) < len("via-X.0.0.0.0") {
+	if len(fqdn) < len("0-0-0-0-via-0") {
 		return netip.Addr{}, false // too short to be valid
 	}
 
-	var siteID string
-	var ip4Str string
-	switch {
-	case strings.Contains(fqdn, "-via-"):
-		// Format number 3: "192-168-1-2-via-7" or "192-168-1-2-via-7.foo.ts.net."
-		// Third time's a charm. The earlier two formats follow after this block.
-		firstLabel, domain, _ := strings.Cut(fqdn, ".") // "192-168-1-2-via-7"
-		if !(domain == "" || dnsname.HasSuffix(domain, "ts.net") || dnsname.HasSuffix(domain, "tailscale.net")) {
-			return netip.Addr{}, false
-		}
-		v4hyphens, suffix, ok := strings.Cut(firstLabel, "-via-")
-		if !ok {
-			return netip.Addr{}, false
-		}
-		siteID = suffix
-		ip4Str = strings.ReplaceAll(v4hyphens, "-", ".")
-	case strings.HasPrefix(fqdn, "via-"):
-		firstDot := strings.Index(fqdn, ".")
-		if firstDot < 0 {
-			return netip.Addr{}, false // missing dot delimiters
-		}
-		siteID = fqdn[len("via-"):firstDot]
-		ip4Str = fqdn[firstDot+1:]
-	default:
-		lastDot := strings.LastIndex(fqdn, ".")
-		if lastDot < 0 {
-			return netip.Addr{}, false // missing dot delimiters
-		}
-		suffix := fqdn[lastDot+1:]
-		if !strings.HasPrefix(suffix, "via-") {
-			return netip.Addr{}, false
-		}
-		siteID = suffix[len("via-"):]
-		ip4Str = fqdn[:lastDot]
+	if !strings.Contains(fqdn, "-via-") {
+		return netip.Addr{}, false // not a 4via6 domain
 	}
+	firstLabel, domain, _ := strings.Cut(fqdn, ".") // "192-168-1-2-via-7"
+	if !(domain == "" || dnsname.HasSuffix(domain, "ts.net") || dnsname.HasSuffix(domain, "tailscale.net")) {
+		return netip.Addr{}, false
+	}
+	v4hyphens, suffix, ok := strings.Cut(firstLabel, "-via-")
+	if !ok {
+		return netip.Addr{}, false
+	}
+	siteID := suffix
+	ip4Str := strings.ReplaceAll(v4hyphens, "-", ".")
 
 	ip4, err := netip.ParseAddr(ip4Str)
 	if err != nil {
@@ -872,6 +920,9 @@ func (r *Resolver) fqdnForIPLocked(ip netip.Addr, name dnsname.FQDN) (dnsname.FQ
 	}
 
 	ret, ok := r.ipToHost[ip]
+	if !ok && r.magicHosts != nil {
+		ret, ok = r.magicHosts.LookupPTR(ip)
+	}
 	if !ok {
 		for _, suffix := range r.localDomains {
 			if suffix.Contains(name) {
diff --git a/net/dns/resolver/tsdns_test.go b/net/dns/resolver/tsdns_test.go
index 381ceedb4..98727dd4f 100644
--- a/net/dns/resolver/tsdns_test.go
+++ b/net/dns/resolver/tsdns_test.go
@@ -390,12 +390,8 @@ func TestResolveLocal(t *testing.T) {
 		{"ns-nxdomain", "test3.ipn.dev.", dns.TypeNS, netip.Addr{}, dns.RCodeNameError},
 		{"onion-domain", "footest.onion.", dns.TypeA, netip.Addr{}, dns.RCodeNameError},
 		{"magicdns", dnsSymbolicFQDN, dns.TypeA, netip.MustParseAddr("100.100.100.100"), dns.RCodeSuccess},
-		{"via_hex", dnsname.FQDN("via-0xff.1.2.3.4."), dns.TypeAAAA, netip.MustParseAddr("fd7a:115c:a1e0:b1a:0:ff:1.2.3.4"), dns.RCodeSuccess},
-		{"via_dec", dnsname.FQDN("via-1.10.0.0.1."), dns.TypeAAAA, netip.MustParseAddr("fd7a:115c:a1e0:b1a:0:1:10.0.0.1"), dns.RCodeSuccess},
-		{"x_via_hex", dnsname.FQDN("4.3.2.1.via-0xff."), dns.TypeAAAA, netip.MustParseAddr("fd7a:115c:a1e0:b1a:0:ff:4.3.2.1"), dns.RCodeSuccess},
-		{"x_via_dec", dnsname.FQDN("1.0.0.10.via-1."), dns.TypeAAAA, netip.MustParseAddr("fd7a:115c:a1e0:b1a:0:1:1.0.0.10"), dns.RCodeSuccess},
 		{"via_invalid", dnsname.FQDN("via-."), dns.TypeAAAA, netip.Addr{}, dns.RCodeRefused},
-		{"via_invalid_2", dnsname.FQDN("2.3.4.5.via-."), dns.TypeAAAA, netip.Addr{}, dns.RCodeRefused},
+		{"via_invalid_2", dnsname.FQDN("2-3-4-5-via-."), dns.TypeAAAA, netip.Addr{}, dns.RCodeRefused},
 
 		// Hyphenated 4via6 format.
 		// Without any suffix domain:
@@ -480,6 +476,111 @@ func TestResolveLocalSubdomain(t *testing.T) {
 	}
 }
 
+// fakeMagicDNSHosts is a MagicDNSHosts for tests, serving from fixed maps.
+type fakeMagicDNSHosts struct {
+	hosts     map[dnsname.FQDN][]netip.Addr
+	subdomain set.Set[dnsname.FQDN]
+	ptr       map[netip.Addr]dnsname.FQDN
+}
+
+func (f fakeMagicDNSHosts) LookupHost(fqdn dnsname.FQDN) (ips []netip.Addr, ok bool) {
+	ips, ok = f.hosts[fqdn]
+	return ips, ok
+}
+
+func (f fakeMagicDNSHosts) LookupPTR(ip netip.Addr) (_ dnsname.FQDN, ok bool) {
+	name, ok := f.ptr[ip]
+	return name, ok
+}
+
+func (f fakeMagicDNSHosts) SubdomainHost(fqdn dnsname.FQDN) bool {
+	return f.subdomain.Contains(fqdn)
+}
+
+// Tests forward, subdomain, and reverse resolution served on demand
+// via the MagicDNSHosts hook, and that entries pushed via Config.Hosts
+// take precedence over the hook.
+func TestResolveLocalMagicDNSHosts(t *testing.T) {
+	r := newResolver(t)
+	defer r.Close()
+
+	r.SetConfig(Config{
+		Hosts: map[dnsname.FQDN][]netip.Addr{
+			"extra.ipn.dev.": {netip.MustParseAddr("100.100.1.1")},
+			"both.ipn.dev.":  {netip.MustParseAddr("100.100.2.2")},
+		},
+		LocalDomains: []dnsname.FQDN{"ipn.dev.", "64.100.in-addr.arpa."},
+	})
+	node4 := netip.MustParseAddr("100.64.0.7")
+	node6 := netip.MustParseAddr("fd7a:115c:a1e0::7")
+	r.SetMagicDNSHosts(fakeMagicDNSHosts{
+		hosts: map[dnsname.FQDN][]netip.Addr{
+			"node.ipn.dev.":   {node4, node6},
+			"v4only.ipn.dev.": {node4},
+			"subber.ipn.dev.": {node4},
+			"both.ipn.dev.":   {netip.MustParseAddr("100.100.9.9")}, // masked by Config.Hosts
+		},
+		subdomain: set.Of[dnsname.FQDN]("subber.ipn.dev."),
+		ptr:       map[netip.Addr]dnsname.FQDN{node4: "node.ipn.dev."},
+	})
+
+	tests := []struct {
+		name  string
+		qname dnsname.FQDN
+		qtype dns.Type
+		ip    netip.Addr
+		code  dns.RCode
+	}{
+		{"hook-ipv4", "node.ipn.dev.", dns.TypeA, node4, dns.RCodeSuccess},
+		{"hook-ipv6", "node.ipn.dev.", dns.TypeAAAA, node6, dns.RCodeSuccess},
+		// A known name with no records of the queried family is
+		// "name exists, no records", not NXDOMAIN.
+		{"hook-no-ipv6", "v4only.ipn.dev.", dns.TypeAAAA, netip.Addr{}, dns.RCodeSuccess},
+		{"hook-nxdomain", "gone.ipn.dev.", dns.TypeA, netip.Addr{}, dns.RCodeNameError},
+		{"hook-foreign", "google.com.", dns.TypeA, netip.Addr{}, dns.RCodeRefused},
+		{"hook-subdomain", "foo.subber.ipn.dev.", dns.TypeA, node4, dns.RCodeSuccess},
+		{"hook-subdomain-deep", "bar.foo.subber.ipn.dev.", dns.TypeA, node4, dns.RCodeSuccess},
+		{"hook-subdomain-no-cap", "foo.node.ipn.dev.", dns.TypeA, netip.Addr{}, dns.RCodeNameError},
+		// Config.Hosts entries (control's ExtraRecords) are
+		// consulted before the hook.
+		{"config-hosts", "extra.ipn.dev.", dns.TypeA, netip.MustParseAddr("100.100.1.1"), dns.RCodeSuccess},
+		{"config-hosts-precedence", "both.ipn.dev.", dns.TypeA, netip.MustParseAddr("100.100.2.2"), dns.RCodeSuccess},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ip, code := r.resolveLocal(tt.qname, tt.qtype)
+			if code != tt.code {
+				t.Errorf("code = %v; want %v", code, tt.code)
+			}
+			if ip != tt.ip {
+				t.Errorf("ip = %v; want %v", ip, tt.ip)
+			}
+		})
+	}
+
+	revTests := []struct {
+		name string
+		q    dnsname.FQDN
+		want dnsname.FQDN
+		code dns.RCode
+	}{
+		{"hook-ptr", "7.0.64.100.in-addr.arpa.", "node.ipn.dev.", dns.RCodeSuccess},
+		{"hook-ptr-nxdomain", "8.0.64.100.in-addr.arpa.", "", dns.RCodeNameError},
+		{"hook-ptr-foreign", "5.4.3.2.in-addr.arpa.", "", dns.RCodeRefused},
+	}
+	for _, tt := range revTests {
+		t.Run(tt.name, func(t *testing.T) {
+			name, code := r.resolveLocalReverse(tt.q)
+			if code != tt.code {
+				t.Errorf("code = %v; want %v", code, tt.code)
+			}
+			if name != tt.want {
+				t.Errorf("name = %v; want %v", name, tt.want)
+			}
+		})
+	}
+}
+
 func TestResolveLocalReverse(t *testing.T) {
 	r := newResolver(t)
 	defer r.Close()
diff --git a/net/dns/utf.go b/net/dns/utf.go
index b18cdebb4..cd10d6fce 100644
--- a/net/dns/utf.go
+++ b/net/dns/utf.go
@@ -28,10 +28,7 @@ func maybeUnUTF16(bs []byte) []byte {
 		// Can't be complete UTF-16.
 		return bs
 	}
-	checkLen := 20
-	if len(bs) < checkLen {
-		checkLen = len(bs)
-	}
+	checkLen := min(len(bs), 20)
 	zeroOff := bytes.IndexByte(bs[:checkLen], 0)
 	if zeroOff == -1 {
 		return bs
diff --git a/net/dns/wsl_windows.go b/net/dns/wsl_windows.go
index 1b93142f5..b0e62170b 100644
--- a/net/dns/wsl_windows.go
+++ b/net/dns/wsl_windows.go
@@ -148,6 +148,8 @@ type wslFS struct {
 	distro string
 }
 
+func (fs wslFS) ActualPath(name string) string { return name }
+
 func (fs wslFS) Stat(name string) (isRegular bool, err error) {
 	err = wslRun(fs.cmd("test", "-f", name))
 	if ee, _ := err.(*exec.ExitError); ee != nil {
diff --git a/net/dnscache/dnscache.go b/net/dnscache/dnscache.go
index 830091724..6aac8e7f6 100644
--- a/net/dnscache/dnscache.go
+++ b/net/dnscache/dnscache.go
@@ -14,6 +14,7 @@ import (
 	"net"
 	"net/netip"
 	"runtime"
+	"strconv"
 	"sync"
 	"sync/atomic"
 	"time"
@@ -24,7 +25,6 @@ import (
 	"tailscale.com/types/logger"
 	"tailscale.com/util/cloudenv"
 	"tailscale.com/util/singleflight"
-	"tailscale.com/util/slicesx"
 	"tailscale.com/util/testenv"
 )
 
@@ -422,24 +422,21 @@ func (d *dialer) DialContext(ctx context.Context, network, address string) (retC
 		}
 	}()
 
-	ip, ip6, allIPs, err := d.dnsCache.LookupIP(ctx, host)
+	ip, _, allIPs, err := d.dnsCache.LookupIP(ctx, host)
 	if err != nil {
 		return nil, fmt.Errorf("failed to resolve %q: %w", host, err)
 	}
-	i4s := v4addrs(allIPs)
-	if len(i4s) < 2 {
+
+	// If we only have one candidate, just dial that, no matter what the
+	// address family is.
+	if len(allIPs) == 1 {
 		d.dnsCache.dlogf("dialing %s, %s for %s", network, ip, address)
-		c, err := dc.dialOne(ctx, ip.Unmap())
-		if err == nil || ctx.Err() != nil || !ip6.IsValid() {
-			return c, err
-		}
-		// Fall back to trying IPv6.
-		return dc.dialOne(ctx, ip6)
+		return dc.dialOne(ctx, ip.Unmap())
 	}
 
-	// Multiple IPv4 candidates, and 0+ IPv6.
-	ipsToTry := append(i4s, v6addrs(allIPs)...)
-	return dc.raceDial(ctx, ipsToTry)
+	// If we have multiple candidates, across address families, use happy
+	// eyeballs to find a connection.
+	return dc.raceDial(ctx, allIPs)
 }
 
 func (d *dialer) shouldTryBootstrap(ctx context.Context, err error, dc *dialCall) bool {
@@ -555,16 +552,6 @@ const fallbackDelay = 300 * time.Millisecond
 // raceDial tries to dial port on each ip in ips, starting a new race
 // dial every fallbackDelay apart, returning whichever completes first.
 func (dc *dialCall) raceDial(ctx context.Context, ips []netip.Addr) (net.Conn, error) {
-	ctx, cancel := context.WithCancel(ctx)
-	defer cancel()
-
-	type res struct {
-		c   net.Conn
-		err error
-	}
-	resc := make(chan res)           // must be unbuffered
-	failBoost := make(chan struct{}) // best effort send on dial failure
-
 	// Remove IPs that we tried & failed to dial previously
 	// (such as when we're being called after a dnsfallback lookup and get
 	// the same results)
@@ -572,96 +559,20 @@ func (dc *dialCall) raceDial(ctx context.Context, ips []netip.Addr) (net.Conn, e
 	if len(ips) == 0 {
 		return nil, errors.New("no IPs")
 	}
-
-	// Partition candidate list and then merge such that an IPv6 address is
-	// in the first spot if present, and then addresses are interleaved.
-	// This ensures that we're trying an IPv6 address first, then
-	// alternating between v4 and v6 in case one of the two networks is
-	// broken.
-	var iv4, iv6 []netip.Addr
-	for _, ip := range ips {
-		if ip.Is6() {
-			iv6 = append(iv6, ip)
-		} else {
-			iv4 = append(iv4, ip)
-		}
+	port, err := strconv.ParseUint(dc.port, 10, 16)
+	if err != nil {
+		return nil, fmt.Errorf("invalid port %q: %w", dc.port, err)
 	}
-	ips = slicesx.Interleave(iv6, iv4)
-
-	go func() {
-		for i, ip := range ips {
-			if i != 0 {
-				timer := time.NewTimer(fallbackDelay)
-				select {
-				case <-timer.C:
-				case <-failBoost:
-					timer.Stop()
-				case <-ctx.Done():
-					timer.Stop()
-					return
-				}
-			}
-			go func(ip netip.Addr) {
-				c, err := dc.dialOne(ctx, ip)
-				if err != nil {
-					// Best effort wake-up a pending dial.
-					// e.g. IPv4 dials failing quickly on an IPv6-only system.
-					// In that case we don't want to wait 300ms per IPv4 before
-					// we get to the IPv6 addresses.
-					select {
-					case failBoost <- struct{}{}:
-					default:
-					}
-				}
-				select {
-				case resc <- res{c, err}:
-				case <-ctx.Done():
-					if c != nil {
-						c.Close()
-					}
-				}
-			}(ip)
-		}
-	}()
-
-	var firstErr error
-	var fails int
-	for {
-		select {
-		case r := <-resc:
-			if r.c != nil {
-				return r.c, nil
-			}
-			fails++
-			if firstErr == nil {
-				firstErr = r.err
-			}
-			if fails == len(ips) {
-				return nil, firstErr
-			}
-		case <-ctx.Done():
-			return nil, ctx.Err()
-		}
+	addrs := make([]netip.AddrPort, len(ips))
+	for i, ip := range ips {
+		addrs[i] = netip.AddrPortFrom(ip, uint16(port))
 	}
-}
-
-func v4addrs(aa []netip.Addr) (ret []netip.Addr) {
-	for _, a := range aa {
-		a = a.Unmap()
-		if a.Is4() {
-			ret = append(ret, a)
-		}
-	}
-	return ret
-}
-
-func v6addrs(aa []netip.Addr) (ret []netip.Addr) {
-	for _, a := range aa {
-		if a.Is6() && !a.Is4In6() {
-			ret = append(ret, a)
-		}
-	}
-	return ret
+	return netx.RaceDial(ctx, addrs, func(ctx context.Context, network, address string) (net.Conn, error) {
+		c, err := dc.d.fwd(ctx, network, address)
+		ipp, _ := netip.ParseAddrPort(address)
+		dc.noteDialResult(ipp.Addr(), err)
+		return c, err
+	}, fallbackDelay)
 }
 
 // TLSDialer is like Dialer but returns a func suitable for using with net/http.Transport.DialTLSContext.
diff --git a/net/dnsfallback/dnsfallback.go b/net/dnsfallback/dnsfallback.go
index 546712776..1d74826d9 100644
--- a/net/dnsfallback/dnsfallback.go
+++ b/net/dnsfallback/dnsfallback.go
@@ -30,6 +30,7 @@ import (
 	"tailscale.com/health"
 	"tailscale.com/net/netmon"
 	"tailscale.com/net/netns"
+	"tailscale.com/net/netutil"
 	"tailscale.com/net/tlsdial"
 	"tailscale.com/tailcfg"
 	"tailscale.com/types/logger"
@@ -133,7 +134,7 @@ func lookup(ctx context.Context, host string, logf logger.Logf, ht *health.Track
 // ht may be nil.
 func bootstrapDNSMap(ctx context.Context, serverName string, serverIP netip.Addr, queryName string, logf logger.Logf, ht *health.Tracker, netMon *netmon.Monitor) (dnsMap, error) {
 	dialer := netns.NewDialer(logf, netMon)
-	tr := http.DefaultTransport.(*http.Transport).Clone()
+	tr := netutil.NewDefaultTransport()
 	tr.DisableKeepAlives = true // This transport is meant to be used once.
 	tr.Proxy = feature.HookProxyFromEnvironment.GetOrNil()
 	tr.DialContext = func(ctx context.Context, netw, addr string) (net.Conn, error) {
diff --git a/net/netcheck/captiveportal.go b/net/netcheck/captiveportal.go
deleted file mode 100644
index 310e98ce7..000000000
--- a/net/netcheck/captiveportal.go
+++ /dev/null
@@ -1,55 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-//go:build !ts_omit_captiveportal
-
-package netcheck
-
-import (
-	"context"
-	"time"
-
-	"tailscale.com/net/captivedetection"
-	"tailscale.com/tailcfg"
-)
-
-func init() {
-	hookStartCaptivePortalDetection.Set(startCaptivePortalDetection)
-}
-
-func startCaptivePortalDetection(ctx context.Context, rs *reportState, dm *tailcfg.DERPMap, preferredDERP int) (done <-chan struct{}, stop func()) {
-	c := rs.c
-
-	// NOTE(andrew): we can't simply add this goroutine to the
-	// `NewWaitGroupChan` below, since we don't wait for that
-	// waitgroup to finish when exiting this function and thus get
-	// a data race.
-	ch := make(chan struct{})
-
-	tmr := time.AfterFunc(c.captivePortalDelay(), func() {
-		defer close(ch)
-		d := captivedetection.NewDetector(c.logf)
-		found := d.Detect(ctx, c.NetMon, dm, preferredDERP)
-		rs.report.CaptivePortal.Set(found)
-	})
-
-	stop = func() {
-		// Don't cancel our captive portal check if we're
-		// explicitly doing a verbose netcheck.
-		if c.Verbose {
-			return
-		}
-
-		if tmr.Stop() {
-			// Stopped successfully; need to close the
-			// signal channel ourselves.
-			close(ch)
-			return
-		}
-
-		// Did not stop; do nothing and it'll finish by itself
-		// and close the signal channel.
-	}
-
-	return ch, stop
-}
diff --git a/net/netcheck/netcheck.go b/net/netcheck/netcheck.go
index a64c358c5..a3f7fe31a 100644
--- a/net/netcheck/netcheck.go
+++ b/net/netcheck/netcheck.go
@@ -45,6 +45,7 @@ import (
 	"tailscale.com/types/views"
 	"tailscale.com/util/clientmetric"
 	"tailscale.com/util/mak"
+	"tailscale.com/util/testenv"
 )
 
 // Debugging and experimentation tweakables.
@@ -232,8 +233,7 @@ type Client struct {
 	ForcePreferredDERP int
 
 	// For tests
-	testEnoughRegions      int
-	testCaptivePortalDelay time.Duration
+	testEnoughRegions int
 
 	mu       syncs.Mutex           // guards following
 	nextFull bool                  // do a full region scan, even if last != nil
@@ -256,14 +256,6 @@ func (c *Client) enoughRegions() int {
 	return 3
 }
 
-func (c *Client) captivePortalDelay() time.Duration {
-	if c.testCaptivePortalDelay > 0 {
-		return c.testCaptivePortalDelay
-	}
-	// Chosen semi-arbitrarily
-	return 200 * time.Millisecond
-}
-
 func (c *Client) logf(format string, a ...any) {
 	if c.Logf != nil {
 		c.Logf(format, a...)
@@ -787,7 +779,15 @@ func (c *Client) SetForcePreferredDERP(region int) {
 	c.ForcePreferredDERP = region
 }
 
-var hookStartCaptivePortalDetection feature.Hook[func(ctx context.Context, rs *reportState, dm *tailcfg.DERPMap, preferredDERP int) (<-chan struct{}, func())]
+// HookStartCaptivePortalDetection, if set, is called by GetReport to
+// asynchronously start captive portal detection during a full (non-incremental)
+// netcheck. It is set at init time by the optional
+// tailscale.com/feature/captiveportal/netcheckhook package.
+//
+// The returned done channel is closed when detection has finished (and
+// setCaptivePortal has been called with the result, if it ran); the returned
+// stop function cancels a detection that has not yet started.
+var HookStartCaptivePortalDetection feature.Hook[func(ctx context.Context, c *Client, dm *tailcfg.DERPMap, preferredDERP int, setCaptivePortal func(bool)) (done <-chan struct{}, stop func())]
 
 // GetReport gets a report. The 'opts' argument is optional and can be nil.
 // Callers are discouraged from passing a ctx with an arbitrary deadline as this
@@ -852,7 +852,7 @@ func (c *Client) GetReport(ctx context.Context, dm *tailcfg.DERPMap, opts *GetRe
 	}
 
 	doFull := false
-	if c.nextFull || now.Sub(c.lastFull) > 5*time.Minute {
+	if c.nextFull || now.Sub(c.lastFull) > fullReportInterval {
 		doFull = true
 	}
 	// If the last report had a captive portal and reported no UDP access,
@@ -914,8 +914,11 @@ func (c *Client) GetReport(ctx context.Context, dm *tailcfg.DERPMap, opts *GetRe
 	captivePortalDone := syncs.ClosedChan()
 	captivePortalStop := func() {}
 	if buildfeatures.HasCaptivePortal && !rs.incremental && !onlySTUN {
-		start := hookStartCaptivePortalDetection.Get()
-		captivePortalDone, captivePortalStop = start(ctx, rs, dm, preferredDERP)
+		if start, ok := HookStartCaptivePortalDetection.GetOk(); ok {
+			captivePortalDone, captivePortalStop = start(ctx, c, dm, preferredDERP, func(found bool) {
+				rs.report.CaptivePortal.Set(found)
+			})
+		}
 	}
 
 	wg := syncs.NewWaitGroupChan()
@@ -1025,7 +1028,7 @@ func (c *Client) finishAndStoreReport(rs *reportState, dm *tailcfg.DERPMap) *Rep
 	report := rs.report.Clone()
 	rs.mu.Unlock()
 
-	c.addReportHistoryAndSetPreferredDERP(rs, report, dm.View())
+	c.addReportHistoryAndSetPreferredDERP(rs, report, dm.View(), c.timeNow())
 	c.logConciseReport(report, dm)
 
 	return report
@@ -1328,6 +1331,12 @@ func (c *Client) timeNow() time.Time {
 }
 
 const (
+	// fullReportInterval is the maximum time between full netcheck reports.
+	// Once this long has elapsed since the last full report, the next GetReport
+	// re-probes every DERP region rather than only the home and fastest regions
+	// (see GetReport). It also informs retention window for report history
+	// (c.prev).
+	fullReportInterval = 5 * time.Minute
 	// preferredDERPAbsoluteDiff specifies the minimum absolute difference
 	// in latencies between two DERP regions that would cause a node to
 	// switch its PreferredDERP ("home DERP"). This ensures that if a node
@@ -1352,9 +1361,29 @@ const (
 	PreferredDERPKeepAliveTimeout = 2 * derp.KeepAlive
 )
 
+// addReportAndPruneExpired adds r to the set of recent Reports, and drops
+// reports that are outside of the retention window.
+func (c *Client) addReportAndPruneExpired(now time.Time, r *Report) {
+	if c.prev == nil {
+		c.prev = map[time.Time]*Report{}
+	}
+	r.Now = now.UTC()
+	c.prev[now] = r
+	c.last = r
+
+	// maxAge is the retention window for report history, based on fullReportInterval
+	// to make sure that at least one full report is always retained.
+	const maxAge = fullReportInterval + ReportTimeout
+	for t := range c.prev {
+		if now.Sub(t) > maxAge {
+			delete(c.prev, t)
+		}
+	}
+}
+
 // addReportHistoryAndSetPreferredDERP adds r to the set of recent Reports
 // and mutates r.PreferredDERP to contain the best recent one.
-func (c *Client) addReportHistoryAndSetPreferredDERP(rs *reportState, r *Report, dm tailcfg.DERPMapView) {
+func (c *Client) addReportHistoryAndSetPreferredDERP(rs *reportState, r *Report, dm tailcfg.DERPMapView, now time.Time) {
 	c.mu.Lock()
 	defer c.mu.Unlock()
 
@@ -1362,30 +1391,11 @@ func (c *Client) addReportHistoryAndSetPreferredDERP(rs *reportState, r *Report,
 	if c.last != nil {
 		prevDERP = c.last.PreferredDERP
 	}
-	if c.prev == nil {
-		c.prev = map[time.Time]*Report{}
-	}
-	now := c.timeNow()
-	r.Now = now.UTC()
-	c.prev[now] = r
-	c.last = r
 
-	const maxAge = 5 * time.Minute
-
-	// region ID => its best recent latency in last maxAge
-	bestRecent := map[int]time.Duration{}
-
-	for t, pr := range c.prev {
-		if now.Sub(t) > maxAge {
-			delete(c.prev, t)
-			continue
-		}
-		for regionID, d := range pr.RegionLatency {
-			if bd, ok := bestRecent[regionID]; !ok || d < bd {
-				bestRecent[regionID] = d
-			}
-		}
-	}
+	// Add report to history, enforce retention window, then take the best (lowest)
+	// latency seen per region across what remains.
+	c.addReportAndPruneExpired(now, r)
+	bestRecent := c.bestRecentLatencyLocked()
 
 	// Scale each region's best latency by any provided scores from the
 	// DERPMap, for use in comparison below.
@@ -1480,6 +1490,38 @@ func (c *Client) addReportHistoryAndSetPreferredDERP(rs *reportState, r *Report,
 	}
 }
 
+// bestRecentLatencyLocked returns the lowest latency seen per DERP region across
+// the reports currently retained in history (c.prev), keyed by region ID. These
+// latencies are used for determining preferred DERP and suggesting an exit node.
+func (c *Client) bestRecentLatencyLocked() map[int]time.Duration {
+	best := make(map[int]time.Duration)
+	for _, pr := range c.prev {
+		for regionID, d := range pr.RegionLatency {
+			if bd, ok := best[regionID]; !ok || d < bd {
+				best[regionID] = d
+			}
+		}
+	}
+	return best
+}
+
+// RecentRegionLatency returns the lowest latency seen per DERP region over the
+// recent history window, keyed by region ID.
+func (c *Client) RecentRegionLatency() map[int]time.Duration {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return c.bestRecentLatencyLocked()
+}
+
+// AddReportHistoryForTest records r in the client's recent-report history
+// (prev/last) as if GetReport had produced it at time now, and recomputes
+// r.PreferredDERP from that history.
+func (c *Client) AddReportHistoryForTest(dm *tailcfg.DERPMap, r *Report, now time.Time) {
+	testenv.AssertInTest()
+	rs := &reportState{c: c, start: now}
+	c.addReportHistoryAndSetPreferredDERP(rs, r, dm.View(), now)
+}
+
 func updateLatency(m map[int]time.Duration, regionID int, d time.Duration) {
 	if prev, ok := m[regionID]; !ok || d < prev {
 		m[regionID] = d
diff --git a/net/netcheck/netcheck_test.go b/net/netcheck/netcheck_test.go
index 0fd3460fa..70c07aacd 100644
--- a/net/netcheck/netcheck_test.go
+++ b/net/netcheck/netcheck_test.go
@@ -468,7 +468,7 @@ func TestAddReportHistoryAndSetPreferredDERP(t *testing.T) {
 			for _, s := range tt.steps {
 				fakeTime = fakeTime.Add(s.after)
 				rs.start = fakeTime.Add(-100 * time.Millisecond)
-				c.addReportHistoryAndSetPreferredDERP(rs, s.r, dm.View())
+				c.addReportHistoryAndSetPreferredDERP(rs, s.r, dm.View(), fakeTime)
 			}
 			lastReport := tt.steps[len(tt.steps)-1].r
 			if got, want := len(c.prev), tt.wantPrevLen; got != want {
@@ -481,6 +481,61 @@ func TestAddReportHistoryAndSetPreferredDERP(t *testing.T) {
 	}
 }
 
+// TestRecentReportsRetainFullNetcheck confirms that the recent-report history
+// (c.prev) always retains at least one full netcheck report, so
+// RecentRegionLatency covers every DERP region even when the most recent
+// reports are incremental.
+func TestRecentReportsRetainFullNetcheck(t *testing.T) {
+	dm := &tailcfg.DERPMap{
+		Regions: map[int]*tailcfg.DERPRegion{
+			1: {RegionID: 1},
+			2: {RegionID: 2},
+			3: {RegionID: 3},
+		},
+	}
+	allRegions := []int{1, 2, 3}
+	incrementalRegions := []int{1, 2} // home + fastest; never includes region 3
+
+	var now time.Time
+	c := &Client{TimeNow: func() time.Time { return now }}
+
+	mkReport := func(regions []int) *Report {
+		r := &Report{RegionLatency: map[int]time.Duration{}}
+		for _, rid := range regions {
+			r.RegionLatency[rid] = 10 * time.Millisecond
+		}
+		return r
+	}
+
+	// Run one netcheck per minute for an hour, spanning many full-report
+	// intervals.
+	const tick = time.Minute
+	start := time.Unix(1700000000, 0)
+	var lastFull time.Time // zero => first report is full, as in GetReport
+	for i := range 60 {
+		now = start.Add(time.Duration(i) * tick)
+
+		// Mirror GetReport's full-vs-incremental decision.
+		doFull := now.Sub(lastFull) > fullReportInterval
+		regions := incrementalRegions
+		if doFull {
+			regions = allRegions
+			lastFull = now
+		}
+		c.addReportHistoryAndSetPreferredDERP(&reportState{c: c, start: now}, mkReport(regions), dm.View(), now)
+
+		// Recent latency must always cover every region, which is only
+		// possible while a full report remains in c.prev.
+		got := c.RecentRegionLatency()
+		for _, rid := range allRegions {
+			if _, ok := got[rid]; !ok {
+				t.Fatalf("after report %d at +%s (full=%v): region %d missing from RecentRegionLatency %v; no full report retained in c.prev",
+					i, now.Sub(start), doFull, rid, got)
+			}
+		}
+	}
+}
+
 func TestMakeProbePlan(t *testing.T) {
 	// basicMap has 5 regions. each region has a number of nodes
 	// equal to the region number (1 has 1a, 2 has 2a and 2b, etc.)
diff --git a/net/netkernelconf/netkernelconf_linux.go b/net/netkernelconf/netkernelconf_linux.go
index b8c165ac5..9157d21c4 100644
--- a/net/netkernelconf/netkernelconf_linux.go
+++ b/net/netkernelconf/netkernelconf_linux.go
@@ -48,7 +48,7 @@ func CheckUDPGROForwarding(tunInterface, defaultRouteInterface string) (warn, er
 	}
 	defaultHasRxWant, ok := defaultFeatures[rxWantFeature]
 	if !ok {
-		// unlikely the feature is nonexistant with txFeature in the TUN driver
+		// unlikely the feature is nonexistent with txFeature in the TUN driver
 		// being added to the kernel later than rxWantFeature, but let's be sure
 		return nil, nil
 	}
diff --git a/net/netmon/interfaces_android.go b/net/netmon/interfaces_android.go
index 2cd7f23f6..1bd22db8e 100644
--- a/net/netmon/interfaces_android.go
+++ b/net/netmon/interfaces_android.go
@@ -4,10 +4,8 @@
 package netmon
 
 import (
-	"bytes"
 	"log"
 	"net/netip"
-	"os/exec"
 	"sync/atomic"
 
 	"go4.org/mem"
@@ -19,6 +17,7 @@ import (
 
 var (
 	lastKnownDefaultRouteIfName syncs.AtomicValue[string]
+	lastKnownDefaultGateway     syncs.AtomicValue[string]
 )
 
 var procNetRoutePath = "/proc/net/route"
@@ -42,123 +41,99 @@ ens18   00000000        0100000A        0003    0       0       0       00000000
 ens18   0000000A        00000000        0001    0       0       0       0000FFFF        0       0       0
 */
 func likelyHomeRouterIPAndroid() (ret netip.Addr, myIP netip.Addr, ok bool) {
-	if procNetRouteErr.Load() {
-		// If we failed to read /proc/net/route previously, don't keep trying.
-		return likelyHomeRouterIPHelper()
-	}
-	lineNum := 0
-	var f []mem.RO
-	for lr := range lineiter.File(procNetRoutePath) {
-		line, err := lr.Value()
-		if err != nil {
-			procNetRouteErr.Store(true)
-			return likelyHomeRouterIP()
-		}
-
-		lineNum++
-		if lineNum == 1 {
-			// Skip header line.
-			continue
-		}
-		if lineNum > maxProcNetRouteRead {
-			break
-		}
-		f = mem.AppendFields(f[:0], mem.B(line))
-		if len(f) < 4 {
-			continue
-		}
-		gwHex, flagsHex := f[2], f[3]
-		flags, err := mem.ParseUint(flagsHex, 16, 16)
-		if err != nil {
-			continue // ignore error, skip line and keep going
-		}
-		if flags&(unix.RTF_UP|unix.RTF_GATEWAY) != unix.RTF_UP|unix.RTF_GATEWAY {
-			continue
-		}
-		ipu32, err := mem.ParseUint(gwHex, 16, 32)
-		if err != nil {
-			continue // ignore error, skip line and keep going
-		}
-		ip := netaddr.IPv4(byte(ipu32), byte(ipu32>>8), byte(ipu32>>16), byte(ipu32>>24))
-		if ip.IsPrivate() {
-			ret = ip
-			break
+	if gwStr := lastKnownDefaultGateway.Load(); gwStr != "" {
+		if ip, err := netip.ParseAddr(gwStr); err == nil {
+			return ip, netip.Addr{}, true
 		}
 	}
-	if ret.IsValid() {
-		// Try to get the local IP of the interface associated with
-		// this route to short-circuit finding the IP associated with
-		// this gateway. This isn't fatal if it fails.
-		if len(f) > 0 && !disableLikelyHomeRouterIPSelf() {
-			ForeachInterface(func(ni Interface, pfxs []netip.Prefix) {
-				// Ensure this is the same interface
-				if !f[0].EqualString(ni.Name) {
-					return
-				}
+	// Fall back to /proc/net/route for early startup before
+	// NetworkChangeCallback has fired, or if the cached gateway
+	// was empty (e.g., cellular with no private gateway).
+	if !procNetRouteErr.Load() {
+		lineNum := 0
+		var f []mem.RO
+		for lr := range lineiter.File(procNetRoutePath) {
+			line, err := lr.Value()
+			if err != nil {
+				procNetRouteErr.Store(true)
+				return likelyHomeRouterIP()
+			}
 
-				// Find the first IPv4 address and use it.
-				for _, pfx := range pfxs {
-					if addr := pfx.Addr(); addr.Is4() {
-						myIP = addr
-						break
+			lineNum++
+			if lineNum == 1 {
+				// Skip header line.
+				continue
+			}
+			if lineNum > maxProcNetRouteRead {
+				break
+			}
+			f = mem.AppendFields(f[:0], mem.B(line))
+			if len(f) < 4 {
+				continue
+			}
+			gwHex, flagsHex := f[2], f[3]
+			flags, err := mem.ParseUint(flagsHex, 16, 16)
+			if err != nil {
+				continue // ignore error, skip line and keep going
+			}
+			if flags&(unix.RTF_UP|unix.RTF_GATEWAY) != unix.RTF_UP|unix.RTF_GATEWAY {
+				continue
+			}
+			ipu32, err := mem.ParseUint(gwHex, 16, 32)
+			if err != nil {
+				continue // ignore error, skip line and keep going
+			}
+			ip := netaddr.IPv4(byte(ipu32), byte(ipu32>>8), byte(ipu32>>16), byte(ipu32>>24))
+			if ip.IsPrivate() {
+				ret = ip
+				break
+			}
+		}
+		if ret.IsValid() {
+			// Try to get the local IP of the interface associated with
+			// this route to short-circuit finding the IP associated with
+			// this gateway. This isn't fatal if it fails.
+			if len(f) > 0 && !disableLikelyHomeRouterIPSelf() {
+				ForeachInterface(func(ni Interface, pfxs []netip.Prefix) {
+					// Ensure this is the same interface
+					if !f[0].EqualString(ni.Name) {
+						return
 					}
-				}
-			})
-		}
 
-		return ret, myIP, true
-	}
-	if lineNum >= maxProcNetRouteRead {
-		// If we went over our line limit without finding an answer, assume
-		// we're a big fancy Linux router (or at least not a home system)
-		// and set the error bit so we stop trying this in the future (and wasting CPU).
-		// See https://github.com/tailscale/tailscale/issues/7621.
-		//
-		// Remember that "likelyHomeRouterIP" exists purely to find the port
-		// mapping service (UPnP, PMP, PCP) often present on a home router. If we hit
-		// the route (line) limit without finding an answer, we're unlikely to ever
-		// find one in the future.
-		procNetRouteErr.Store(true)
+					// Find the first IPv4 address and use it.
+					for _, pfx := range pfxs {
+						if addr := pfx.Addr(); addr.Is4() {
+							myIP = addr
+							break
+						}
+					}
+				})
+			}
+
+			return ret, myIP, true
+		}
+		if lineNum >= maxProcNetRouteRead {
+			// If we went over our line limit without finding an answer, assume
+			// we're a big fancy Linux router (or at least not a home system)
+			// and set the error bit so we stop trying this in the future (and wasting CPU).
+			// See https://github.com/tailscale/tailscale/issues/7621.
+			//
+			// Remember that "likelyHomeRouterIP" exists purely to find the port
+			// mapping service (UPnP, PMP, PCP) often present on a home router. If we hit
+			// the route (line) limit without finding an answer, we're unlikely to ever
+			// find one in the future.
+			procNetRouteErr.Store(true)
+		}
 	}
 	return netip.Addr{}, netip.Addr{}, false
 }
 
-// Android apps don't have permission to read /proc/net/route, at
-// least on Google devices and the Android emulator.
-func likelyHomeRouterIPHelper() (ret netip.Addr, _ netip.Addr, ok bool) {
-	cmd := exec.Command("/system/bin/ip", "route", "show", "table", "0")
-	out, err := cmd.StdoutPipe()
-	if err != nil {
-		return
+// UpdateLastKnownDefaultGateway is called by libtailscale in the Android app when
+// the connectivity manager provides an updated default gateway IP from LinkProperties.
+func UpdateLastKnownDefaultGateway(ipStr string) {
+	if old := lastKnownDefaultGateway.Swap(ipStr); old != ipStr {
+		log.Printf("defaultgateway: update from Android, gateway = %s (was %s)", ipStr, old)
 	}
-	if err := cmd.Start(); err != nil {
-		log.Printf("interfaces: running /system/bin/ip: %v", err)
-		return
-	}
-	// Search for line like "default via 10.0.2.2 dev radio0 table 1016 proto static mtu 1500 "
-	for lr := range lineiter.Reader(out) {
-		line, err := lr.Value()
-		if err != nil {
-			break
-		}
-		const pfx = "default via "
-		if !mem.HasPrefix(mem.B(line), mem.S(pfx)) {
-			continue
-		}
-		line = line[len(pfx):]
-		sp := bytes.IndexByte(line, ' ')
-		if sp == -1 {
-			continue
-		}
-		ipb := line[:sp]
-		if ip, err := netip.ParseAddr(string(ipb)); err == nil && ip.Is4() {
-			ret = ip
-			log.Printf("interfaces: found Android default route %v", ip)
-		}
-	}
-	cmd.Process.Kill()
-	cmd.Wait()
-	return ret, netip.Addr{}, ret.IsValid()
 }
 
 // UpdateLastKnownDefaultRouteInterface is called by libtailscale in the Android app when
diff --git a/net/netmon/netmon.go b/net/netmon/netmon.go
index a7120cdd3..46b5de37c 100644
--- a/net/netmon/netmon.go
+++ b/net/netmon/netmon.go
@@ -267,7 +267,7 @@ func (cd *ChangeDelta) AnyInterfaceUp() bool {
 
 // isInterestingInterfaceChange reports whether any interfaces have changed in a meaningful way.
 // This excludes interfaces that are not interesting per IsInterestingInterface and
-// filters out changes to interface IPs that that are uninteresting (e.g. link-local addresses).
+// filters out changes to interface IPs that are uninteresting (e.g. link-local addresses).
 func (cd *ChangeDelta) isInterestingInterfaceChange() bool {
 	// If there is no old state, everything is considered changed.
 	if cd.old == nil {
@@ -418,6 +418,12 @@ func (m *Monitor) InterfaceState() *State {
 	return m.ifState
 }
 
+// ProbeLocks acquires and releases the monitor's internal mutex.
+func (m *Monitor) ProbeLocks() {
+	m.mu.Lock()
+	m.mu.Unlock()
+}
+
 func (m *Monitor) interfaceStateUncached() (*State, error) {
 	return getState(tsIfProps.tsIfName())
 }
diff --git a/net/netmon/netmon_darwin.go b/net/netmon/netmon_darwin.go
index 588cbf616..d63ee6028 100644
--- a/net/netmon/netmon_darwin.go
+++ b/net/netmon/netmon_darwin.go
@@ -150,6 +150,17 @@ func (m *darwinRouteMon) skipInterfaceAddrMessage(msg *route.InterfaceAddrMessag
 }
 
 func (m *darwinRouteMon) skipRouteMessage(msg *route.RouteMessage) bool {
+	// RTM_MISS fires on every failed route lookup (no matching entry in the
+	// routing table). It scales with traffic volume, not network-state
+	// changes, and is never the leading signal for a topology change: route
+	// withdrawals emit RTM_DELETE synchronously before any subsequent lookup
+	// can miss. Letting these through causes netmon to report spurious
+	// link changes, which trigger a re-STUN/netcheck loop when a probe
+	// destination is unreachable (e.g. IPv6 DERP probes on a network with
+	// no IPv6 default route), as each failed probe emits another RTM_MISS.
+	if msg.Type == unix.RTM_MISS {
+		return true
+	}
 	if ip := ipOfAddr(addrType(msg.Addrs, unix.RTAX_DST)); ip.IsLinkLocalUnicast() {
 		// Skip those like:
 		// dst = fe80::b476:66ff:fe30:c8f6%15
diff --git a/net/netmon/netmon_darwin_test.go b/net/netmon/netmon_darwin_test.go
index e57b5ca84..690c1152c 100644
--- a/net/netmon/netmon_darwin_test.go
+++ b/net/netmon/netmon_darwin_test.go
@@ -9,6 +9,7 @@ import (
 	"testing"
 
 	"golang.org/x/net/route"
+	"golang.org/x/sys/unix"
 )
 
 func TestIssue1416RIB(t *testing.T) {
@@ -25,3 +26,31 @@ func TestIssue1416RIB(t *testing.T) {
 	}
 	t.Logf("Got: %#v", msgs)
 }
+
+func TestSkipRouteMessage(t *testing.T) {
+	m := &darwinRouteMon{logf: t.Logf}
+	dst := &route.Inet6Addr{IP: [16]byte{0x26, 0x07}} // 2607:: (global unicast)
+	tests := []struct {
+		name string
+		msg  *route.RouteMessage
+		want bool
+	}{
+		{
+			name: "rtm_miss",
+			msg:  &route.RouteMessage{Type: unix.RTM_MISS, Addrs: []route.Addr{unix.RTAX_DST: dst}},
+			want: true,
+		},
+		{
+			name: "rtm_add",
+			msg:  &route.RouteMessage{Type: unix.RTM_ADD, Addrs: []route.Addr{unix.RTAX_DST: dst}},
+			want: false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := m.skipRouteMessage(tt.msg); got != tt.want {
+				t.Errorf("skipRouteMessage = %v; want %v", got, tt.want)
+			}
+		})
+	}
+}
diff --git a/net/netns/netns_darwin.go b/net/netns/netns_darwin.go
index e5d01542e..844128dda 100644
--- a/net/netns/netns_darwin.go
+++ b/net/netns/netns_darwin.go
@@ -85,7 +85,7 @@ func getInterfaceIndex(logf logger.Logf, netMon *netmon.Monitor, address string)
 		// Preferentially choose the OS's view of the default if index.  Due to the way darwin sets the delegated
 		// interface on tunnel creation only, it is possible for netmon to have a stale view of the default and
 		// netmon's view is often temporarily wrong during network transitions, or for us to not have the
-		// the the oses view of the defaultIf yet.
+		// the oses view of the defaultIf yet.
 		if osIferr == nil {
 			idx = osIf.InterfaceIndex
 			errOut = nil
diff --git a/net/netutil/ip_forward.go b/net/netutil/ip_forward.go
index bc0f1961d..fd434a2d3 100644
--- a/net/netutil/ip_forward.go
+++ b/net/netutil/ip_forward.go
@@ -6,10 +6,10 @@ package netutil
 import (
 	"bytes"
 	"fmt"
+	"io"
 	"net/netip"
 	"os"
 	"os/exec"
-	"path/filepath"
 	"runtime"
 	"strconv"
 	"strings"
@@ -198,7 +198,10 @@ const (
 // sysctl (which on Linux just reads from /proc/sys anyway).
 func ipForwardingEnabledLinux(p protocol, iface string) (bool, error) {
 	k := ipForwardSysctlKey(slashFormat, p, iface)
-	bs, err := os.ReadFile(filepath.Join("/proc/sys", k))
+	// Open k under /proc/sys with os.OpenInRoot so a ".." or symlinked
+	// component in the interface name can't read outside /proc/sys. It's
+	// openat-based, so it's also TOCTOU-resistant. See https://go.dev/blog/osroot.
+	f, err := os.OpenInRoot("/proc/sys", k)
 	if err != nil {
 		if os.IsNotExist(err) {
 			// If IPv6 is disabled, sysctl keys like "net.ipv6.conf.all.forwarding" just don't
@@ -213,6 +216,11 @@ func ipForwardingEnabledLinux(p protocol, iface string) (bool, error) {
 		}
 		return false, err
 	}
+	defer f.Close()
+	bs, err := io.ReadAll(f)
+	if err != nil {
+		return false, err
+	}
 
 	val, err := strconv.ParseInt(string(bytes.TrimSpace(bs)), 10, 32)
 	if err != nil {
diff --git a/net/netutil/netutil.go b/net/netutil/netutil.go
index 138829885..e765138d0 100644
--- a/net/netutil/netutil.go
+++ b/net/netutil/netutil.go
@@ -8,10 +8,40 @@ import (
 	"bufio"
 	"io"
 	"net"
+	"net/http"
+	"time"
 
 	"tailscale.com/syncs"
 )
 
+// NewDefaultTransport returns a new *http.Transport configured identically to
+// the Go standard library's http.DefaultTransport.
+//
+// Unlike http.DefaultTransport.(*http.Transport).Clone(), it does not panic
+// when a program has replaced http.DefaultTransport with a RoundTripper that
+// is not a *http.Transport. In the common case (the global is still the
+// standard *http.Transport) it returns a clone of it, preserving the existing
+// behavior exactly; otherwise it returns a fresh transport mirroring the
+// stdlib defaults.
+func NewDefaultTransport() *http.Transport {
+	if tr, ok := http.DefaultTransport.(*http.Transport); ok {
+		return tr.Clone()
+	}
+	// Values copied verbatim from net/http's DefaultTransport.
+	return &http.Transport{
+		Proxy: http.ProxyFromEnvironment,
+		DialContext: (&net.Dialer{
+			Timeout:   30 * time.Second,
+			KeepAlive: 30 * time.Second,
+		}).DialContext,
+		ForceAttemptHTTP2:     true,
+		MaxIdleConns:          100,
+		IdleConnTimeout:       90 * time.Second,
+		TLSHandshakeTimeout:   10 * time.Second,
+		ExpectContinueTimeout: 1 * time.Second,
+	}
+}
+
 // NewOneConnListener returns a net.Listener that returns c on its
 // first Accept and EOF thereafter.
 //
diff --git a/net/netutil/netutil_test.go b/net/netutil/netutil_test.go
index 2c40d8d9e..f0e32349c 100644
--- a/net/netutil/netutil_test.go
+++ b/net/netutil/netutil_test.go
@@ -6,8 +6,10 @@ package netutil
 import (
 	"io"
 	"net"
+	"net/http"
 	"runtime"
 	"testing"
+	"time"
 )
 
 type conn struct {
@@ -53,6 +55,59 @@ func TestOneConnListener(t *testing.T) {
 	}
 }
 
+// roundTripperFunc is an http.RoundTripper that is not a *http.Transport,
+// used to exercise the fallback path of NewDefaultTransport.
+type roundTripperFunc func(*http.Request) (*http.Response, error)
+
+func (f roundTripperFunc) RoundTrip(r *http.Request) (*http.Response, error) { return f(r) }
+
+func TestNewDefaultTransport(t *testing.T) {
+	// Standard case: http.DefaultTransport is still a *http.Transport, so we
+	// get a clone of it with the stdlib defaults.
+	tr := NewDefaultTransport()
+	if tr == nil {
+		t.Fatal("got nil transport")
+	}
+	if got, want := tr.MaxIdleConns, 100; got != want {
+		t.Errorf("MaxIdleConns = %d; want %d", got, want)
+	}
+	if got, want := tr.IdleConnTimeout, 90*time.Second; got != want {
+		t.Errorf("IdleConnTimeout = %v; want %v", got, want)
+	}
+	if !tr.ForceAttemptHTTP2 {
+		t.Error("ForceAttemptHTTP2 = false; want true")
+	}
+
+	// Regression case: an application has replaced http.DefaultTransport with
+	// a RoundTripper that is not a *http.Transport. NewDefaultTransport must
+	// not panic and must still return a usable transport with stdlib defaults.
+	orig := http.DefaultTransport
+	defer func() { http.DefaultTransport = orig }()
+	http.DefaultTransport = roundTripperFunc(func(*http.Request) (*http.Response, error) {
+		return nil, nil
+	})
+
+	tr = NewDefaultTransport()
+	if tr == nil {
+		t.Fatal("got nil transport on fallback path")
+	}
+	if got, want := tr.MaxIdleConns, 100; got != want {
+		t.Errorf("fallback MaxIdleConns = %d; want %d", got, want)
+	}
+	if got, want := tr.IdleConnTimeout, 90*time.Second; got != want {
+		t.Errorf("fallback IdleConnTimeout = %v; want %v", got, want)
+	}
+	if !tr.ForceAttemptHTTP2 {
+		t.Error("fallback ForceAttemptHTTP2 = false; want true")
+	}
+	if tr.DialContext == nil {
+		t.Error("fallback DialContext = nil; want non-nil")
+	}
+	if tr.Proxy == nil {
+		t.Error("fallback Proxy = nil; want non-nil")
+	}
+}
+
 func TestIPForwardingEnabledLinux(t *testing.T) {
 	if runtime.GOOS != "linux" {
 		t.Skipf("skipping on %s", runtime.GOOS)
@@ -64,4 +119,28 @@ func TestIPForwardingEnabledLinux(t *testing.T) {
 	if got {
 		t.Errorf("got true; want false")
 	}
+
+	// The global keys and the per-interface keys for each interface on
+	// the machine should all be readable without error, whatever their
+	// values.
+	for _, p := range []protocol{ipv4, ipv6} {
+		on, err := ipForwardingEnabledLinux(p, "")
+		if err != nil {
+			t.Errorf("global (proto %v): %v", p, err)
+		}
+		t.Logf("global (proto %v) = %v", p, on)
+	}
+	ifaces, err := net.Interfaces()
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, iface := range ifaces {
+		for _, p := range []protocol{ipv4, ipv6} {
+			on, err := ipForwardingEnabledLinux(p, iface.Name)
+			if err != nil {
+				t.Errorf("%s (proto %v): %v", iface.Name, p, err)
+			}
+			t.Logf("%s (proto %v) = %v", iface.Name, p, on)
+		}
+	}
 }
diff --git a/net/netutil/routes.go b/net/netutil/routes.go
index 26f2de97c..510572b6d 100644
--- a/net/netutil/routes.go
+++ b/net/netutil/routes.go
@@ -13,7 +13,11 @@ import (
 	"tailscale.com/net/tsaddr"
 )
 
-func validateViaPrefix(ipp netip.Prefix) error {
+// ValidateViaPrefix checks that the IP prefix is a valid 4via6 route.
+// It verifies that the prefix is in the Tailscale via range, has a prefix
+// length between /96 and /128, and that the embedded site ID is in the
+// range 0–65535.
+func ValidateViaPrefix(ipp netip.Prefix) error {
 	if !tsaddr.IsViaPrefix(ipp) {
 		return fmt.Errorf("%v is not a 4-in-6 prefix", ipp)
 	}
@@ -51,7 +55,7 @@ func CalcAdvertiseRoutes(advertiseRoutes string, advertiseDefaultRoute bool) ([]
 				return nil, fmt.Errorf("%s has non-address bits set; expected %s", ipp, ipp.Masked())
 			}
 			if tsaddr.IsViaPrefix(ipp) {
-				if err := validateViaPrefix(ipp); err != nil {
+				if err := ValidateViaPrefix(ipp); err != nil {
 					return nil, err
 				}
 			}
diff --git a/net/netx/racedial.go b/net/netx/racedial.go
new file mode 100644
index 000000000..ce08baac0
--- /dev/null
+++ b/net/netx/racedial.go
@@ -0,0 +1,96 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package netx
+
+import (
+	"context"
+	"net"
+	"net/netip"
+	"time"
+
+	"tailscale.com/util/slicesx"
+)
+
+// RaceDial races TCP connect attempts across addrs using a
+// happy-eyeballs-style staggered approach: a new dial is started every
+// fallbackDelay, and the first successful connection wins. Losers are
+// cancelled and their connections closed. If all dials fail, the first
+// error is returned.
+//
+// Addresses are interleaved v6-first so that IPv6 is preferred but both
+// families are tried promptly. The dial func is always called with
+// network "tcp".
+func RaceDial(ctx context.Context, addrs []netip.AddrPort, dial DialFunc, fallbackDelay time.Duration) (net.Conn, error) {
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	var v4, v6 []netip.AddrPort
+	for _, a := range addrs {
+		if a.Addr().Is6() {
+			v6 = append(v6, a)
+		} else {
+			v4 = append(v4, a)
+		}
+	}
+	ordered := slicesx.Interleave(v6, v4)
+
+	type result struct {
+		c   net.Conn
+		err error
+	}
+	resc := make(chan result)           // unbuffered: senders sync with collector
+	failBoost := make(chan struct{}, 1) // wake the launcher when a dial fails fast
+
+	go func() {
+		for i, addr := range ordered {
+			if i > 0 {
+				t := time.NewTimer(fallbackDelay)
+				select {
+				case <-t.C:
+				case <-failBoost:
+					t.Stop()
+				case <-ctx.Done():
+					t.Stop()
+					return
+				}
+			}
+			go func() {
+				c, err := dial(ctx, "tcp", addr.String())
+				if err != nil {
+					select {
+					case failBoost <- struct{}{}:
+					default:
+					}
+				}
+				select {
+				case resc <- result{c, err}:
+				case <-ctx.Done():
+					if c != nil {
+						c.Close()
+					}
+				}
+			}()
+		}
+	}()
+
+	var firstErr error
+	var nFailed int
+	for {
+		select {
+		case r := <-resc:
+			if r.err == nil {
+				return r.c, nil
+			}
+			if firstErr == nil {
+				firstErr = r.err
+			}
+			nFailed++
+			if nFailed >= len(ordered) {
+				return nil, firstErr
+			}
+		case <-ctx.Done():
+			return nil, ctx.Err()
+		}
+	}
+}
diff --git a/net/netx/racedial_test.go b/net/netx/racedial_test.go
new file mode 100644
index 000000000..5e91cc4f7
--- /dev/null
+++ b/net/netx/racedial_test.go
@@ -0,0 +1,133 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package netx
+
+import (
+	"context"
+	"errors"
+	"net"
+	"net/netip"
+	"testing"
+	"testing/synctest"
+	"time"
+)
+
+type fakeConn struct{ net.Conn }
+
+func (fakeConn) Close() error { return nil }
+
+var (
+	v4Addr1 = netip.MustParseAddrPort("192.0.2.1:443")
+	v4Addr2 = netip.MustParseAddrPort("192.0.2.2:443")
+	v6Addr1 = netip.MustParseAddrPort("[2001:db8::1]:443")
+	v6Addr2 = netip.MustParseAddrPort("[2001:db8::2]:443")
+)
+
+func TestRaceDialFirstWins(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		addrs := []netip.AddrPort{v6Addr1, v4Addr1, v6Addr2}
+		t0 := time.Now()
+		conn, err := RaceDial(context.Background(), addrs,
+			func(ctx context.Context, network, address string) (net.Conn, error) {
+				return fakeConn{}, nil
+			},
+			300*time.Millisecond,
+		)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if conn == nil {
+			t.Fatal("expected non-nil conn")
+		}
+		conn.Close()
+		if d := time.Since(t0); d != 0 {
+			t.Fatalf("took %v; first dial wins immediately so no time should pass", d)
+		}
+	})
+}
+
+func TestRaceDialAllFail(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		addrs := []netip.AddrPort{v4Addr1, v6Addr1}
+		want := errors.New("dial failed")
+		t0 := time.Now()
+		_, err := RaceDial(context.Background(), addrs,
+			func(ctx context.Context, network, address string) (net.Conn, error) {
+				return nil, want
+			},
+			300*time.Millisecond,
+		)
+		if err == nil {
+			t.Fatal("expected error")
+		}
+		if !errors.Is(err, want) {
+			t.Fatalf("got %v; want %v", err, want)
+		}
+		if d := time.Since(t0); d != 0 {
+			t.Fatalf("took %v; failBoost should skip all delays", d)
+		}
+	})
+}
+
+func TestRaceDialCancelledContext(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		ctx, cancel := context.WithCancel(context.Background())
+		cancel()
+		t0 := time.Now()
+		_, err := RaceDial(ctx, []netip.AddrPort{v4Addr1},
+			func(ctx context.Context, network, address string) (net.Conn, error) {
+				<-ctx.Done()
+				return nil, ctx.Err()
+			},
+			300*time.Millisecond,
+		)
+		if !errors.Is(err, context.Canceled) {
+			t.Fatalf("got %v; want context.Canceled", err)
+		}
+		if d := time.Since(t0); d != 0 {
+			t.Fatalf("took %v; pre-cancelled context should resolve immediately", d)
+		}
+	})
+}
+
+func TestRaceDialInterleaving(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		var order []string
+		addrs := []netip.AddrPort{v4Addr1, v4Addr2, v6Addr1, v6Addr2}
+		t0 := time.Now()
+		RaceDial(context.Background(), addrs,
+			func(ctx context.Context, network, address string) (net.Conn, error) {
+				order = append(order, address)
+				return nil, errors.New("fail")
+			},
+			300*time.Millisecond,
+		)
+		if len(order) != 4 {
+			t.Fatalf("expected 4 dials, got %d", len(order))
+		}
+		ipp, _ := netip.ParseAddrPort(order[0])
+		if !ipp.Addr().Is6() {
+			t.Errorf("first dial should be v6, got %v", order[0])
+		}
+		if d := time.Since(t0); d != 0 {
+			t.Fatalf("took %v; failBoost should skip all delays", d)
+		}
+	})
+}
+
+func TestRaceDialFailBoost(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		addrs := []netip.AddrPort{v6Addr1, v4Addr1, v6Addr2}
+		t0 := time.Now()
+		RaceDial(context.Background(), addrs,
+			func(ctx context.Context, network, address string) (net.Conn, error) {
+				return nil, errors.New("fail")
+			},
+			time.Hour, // absurdly long; failBoost bypasses it
+		)
+		if d := time.Since(t0); d >= time.Second {
+			t.Fatalf("took %v; failBoost should have bypassed the hour-long delay", d)
+		}
+	})
+}
diff --git a/net/packet/header.go b/net/packet/header.go
index 44b99e520..c761e64eb 100644
--- a/net/packet/header.go
+++ b/net/packet/header.go
@@ -45,7 +45,7 @@ type HeaderChecksummer interface {
 	Header
 
 	// WriteCheck writes the correct checksum into buf, which should
-	// be be the already-marshalled header and payload.
+	// be the already-marshalled header and payload.
 	WriteChecksum(buf []byte)
 }
 
diff --git a/net/packet/icmp.go b/net/packet/icmp.go
index 8f9cd0e2b..0e0b1a641 100644
--- a/net/packet/icmp.go
+++ b/net/packet/icmp.go
@@ -7,6 +7,7 @@ import (
 	crand "crypto/rand"
 
 	"encoding/binary"
+	"net/netip"
 )
 
 // ICMPEchoPayload generates a new random ID/Sequence pair, and returns a uint32
@@ -26,3 +27,64 @@ func ICMPEchoPayload(payload []byte) (idSeq uint32, buf []byte) {
 
 	return
 }
+
+// icmpDestUnreachableUnusedLen is the number of unused bytes that both ICMPv4
+// and ICMPv6 "Destination Unreachable" messages have between header and bits
+// from the invoking packet.
+const icmpDestUnreachableUnusedLen = 4
+const minIPv6MTU = 1280 // RFC 2460, section 5
+
+// GenerateICMPHostUnreachable builds an ICMPv4 or ICMPv6 "Destination
+// Unreachable" message according to RFC 792 and RFC 4443, section 3.1.
+// from and to must both be of the same address family; otherwise
+// GenerateICMPHostUnreachable returns nil.
+func GenerateICMPHostUnreachable(from, to netip.Addr, invoking *Parsed) []byte {
+	buf := invoking.Buffer()
+	switch {
+	case from.Is4() && to.Is4():
+		// RFC 792
+		//     0                   1                   2                   3
+		//  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+		// +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+		// |     Type      |     Code      |          Checksum             |
+		// +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+		// |                             unused                            |
+		// +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+		// |      Internet Header + 64 bits of Original Data Datagram      |
+		// +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+		ipHeaderLen := len(buf) - len(invoking.Transport())
+		return Generate(ICMP4Header{
+			IP4Header: IP4Header{Src: from, Dst: to},
+			Type:      ICMP4Unreachable,
+			Code:      ICMP4HostUnreachable,
+		}, icmpDestUnreachablePayload(buf, ipHeaderLen+8))
+	case from.Is6() && to.Is6():
+		// RFC 4443, section 3.1
+		//        0                   1                   2                   3
+		//  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+		// +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+		// |     Type      |     Code      |          Checksum             |
+		// +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+		// |                             Unused                            |
+		// +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+		// |                    As much of invoking packet                 |
+		// +                as possible without the ICMPv6 packet          +
+		// |                exceeding the minimum IPv6 MTU                 |
+		maxOrig := minIPv6MTU - (ICMP6Header{}).Len() - icmpDestUnreachableUnusedLen
+		return Generate(ICMP6Header{
+			IP6Header: IP6Header{Src: from, Dst: to},
+			Type:      ICMP6Unreachable,
+			Code:      ICMP6AddressUnreachable,
+		}, icmpDestUnreachablePayload(buf, maxOrig))
+	default:
+		return nil
+	}
+}
+
+// icmpDestUnreachablePayload composes the payload for an ICMP "Destination Unreachable" packet.
+func icmpDestUnreachablePayload(orig []byte, maxOrig int) []byte {
+	n := min(len(orig), maxOrig)
+	payload := make([]byte, icmpDestUnreachableUnusedLen+n)
+	copy(payload[icmpDestUnreachableUnusedLen:], orig[:n])
+	return payload
+}
diff --git a/net/packet/icmp4.go b/net/packet/icmp4.go
index 492a0e9df..8749e91ab 100644
--- a/net/packet/icmp4.go
+++ b/net/packet/icmp4.go
@@ -49,6 +49,10 @@ type ICMP4Code uint8
 
 const (
 	ICMP4NoCode ICMP4Code = 0
+
+	// ICMP4HostUnreachable is the code used with ICMP4Unreachable to
+	// indicate that the destination host could not be reached.
+	ICMP4HostUnreachable ICMP4Code = 1
 )
 
 // ICMP4Header is an IPv4+ICMPv4 header.
diff --git a/net/packet/icmp6.go b/net/packet/icmp6.go
index a91db53c9..faa45c853 100644
--- a/net/packet/icmp6.go
+++ b/net/packet/icmp6.go
@@ -52,6 +52,11 @@ type ICMP6Code uint8
 
 const (
 	ICMP6NoCode ICMP6Code = 0
+
+	// ICMP6AddressUnreachable is the code used with ICMP6Unreachable to
+	// indicate that the destination address could not be reached. It is
+	// the IPv6 equivalent of ICMP4HostUnreachable.
+	ICMP6AddressUnreachable ICMP6Code = 3
 )
 
 // ICMP6Header is an IPv4+ICMPv4 header.
diff --git a/net/packet/icmp_test.go b/net/packet/icmp_test.go
new file mode 100644
index 000000000..52265a56e
--- /dev/null
+++ b/net/packet/icmp_test.go
@@ -0,0 +1,190 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package packet
+
+import (
+	"bytes"
+	"net/netip"
+	"testing"
+
+	"tailscale.com/types/ipproto"
+)
+
+func TestGenerateICMPHostUnreachable(t *testing.T) {
+	const (
+		clientPort = 1234
+		serverPort = 80
+	)
+
+	makeInvokingPacket := func(src, dst netip.Addr, payloadLen int) *Parsed {
+		udpPayload := bytes.Repeat([]byte("x"), payloadLen)
+		var invoking []byte
+		if dst.Is6() {
+			invoking = Generate(UDP6Header{
+				IP6Header: IP6Header{Src: src, Dst: dst},
+				SrcPort:   clientPort,
+				DstPort:   serverPort,
+			}, udpPayload)
+		} else {
+			invoking = Generate(UDP4Header{
+				IP4Header: IP4Header{Src: src, Dst: dst},
+				SrcPort:   clientPort,
+				DstPort:   serverPort,
+			}, udpPayload)
+		}
+		var invokingPacket Parsed
+		invokingPacket.Decode(invoking)
+		return &invokingPacket
+	}
+
+	maxEmbeddedV4Length := 28 // IP header (20) + 64 bits (8) of original data datagram
+	// As much of the packet as fits in min IPv6 MTU, which is
+	// 1280 - 40 (IPv6 header) - 4 (ICMPv6 header) - 4 (unused).
+	maxEmbeddedV6Length := minIPv6MTU - 40 - 4 - 4
+
+	tests := []struct {
+		name           string
+		invokingPacket *Parsed
+		wantProto      ipproto.Proto
+		wantType       uint8
+		wantCode       uint8
+		fitsWhole      bool
+	}{
+		{
+			name: "ipv4-fits-whole",
+			invokingPacket: makeInvokingPacket(
+				netip.MustParseAddr("100.70.0.1"),
+				netip.MustParseAddr("10.64.0.2"),
+				0,
+			),
+			wantProto: ipproto.ICMPv4,
+			wantType:  uint8(ICMP4Unreachable),
+			wantCode:  uint8(ICMP4HostUnreachable),
+			fitsWhole: true,
+		},
+		{
+			name: "ipv4-truncated-to-ip-header-plus-8",
+			invokingPacket: makeInvokingPacket(
+				netip.MustParseAddr("100.70.0.1"),
+				netip.MustParseAddr("10.64.0.2"),
+				100,
+			),
+			wantProto: ipproto.ICMPv4,
+			wantType:  uint8(ICMP4Unreachable),
+			wantCode:  uint8(ICMP4HostUnreachable),
+		},
+		{
+			name: "ipv6-fits-whole",
+			invokingPacket: makeInvokingPacket(
+				netip.MustParseAddr("fd7a:115c:a1e0::1"),
+				netip.MustParseAddr("fd7a:115c:a1e0::2"),
+				5,
+			),
+			wantProto: ipproto.ICMPv6,
+			wantType:  uint8(ICMP6Unreachable),
+			wantCode:  uint8(ICMP6AddressUnreachable),
+			fitsWhole: true,
+		},
+		{
+			name: "ipv6-truncated-to-min-mtu",
+			invokingPacket: makeInvokingPacket(
+				netip.MustParseAddr("fd7a:115c:a1e0::1"),
+				netip.MustParseAddr("fd7a:115c:a1e0::2"),
+				minIPv6MTU*2,
+			),
+			wantProto: ipproto.ICMPv6,
+			wantType:  uint8(ICMP6Unreachable),
+			wantCode:  uint8(ICMP6AddressUnreachable),
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			iDst := tt.invokingPacket.Dst.Addr()
+			iSrc := tt.invokingPacket.Src.Addr()
+			// Error message's src is invoking dst and vice-versa.
+			raw := GenerateICMPHostUnreachable(iDst, iSrc, tt.invokingPacket)
+			if raw == nil {
+				t.Fatal("GenerateICMPHostUnreachable returned nil")
+			}
+
+			var p Parsed
+			p.Decode(raw)
+
+			if !p.IsError() {
+				t.Fatal("wanted an ICMP error")
+			}
+			if got := p.IPProto; got != tt.wantProto {
+				t.Errorf("proto: got %v, want %v", got, tt.wantProto)
+			}
+			if want, got := iDst, p.Src.Addr(); want != got {
+				t.Errorf("src: got %v, want %v", got, want)
+			}
+			if want, got := iSrc, p.Dst.Addr(); want != got {
+				t.Errorf("dst: got %v, want %v", got, want)
+			}
+			var gotType, gotCode uint8
+			if iDst.Is6() {
+				h := p.ICMP6Header()
+				gotType, gotCode = uint8(h.Type), uint8(h.Code)
+			} else {
+				h := p.ICMP4Header()
+				gotType, gotCode = uint8(h.Type), uint8(h.Code)
+			}
+			if gotType != tt.wantType || gotCode != tt.wantCode {
+				t.Errorf("type/code: got %d/%d, want %d/%d", gotType, gotCode, tt.wantType, tt.wantCode)
+			}
+
+			// The ICMP body must be a 4-byte zeroed "unused" field followed by
+			// the embedded invoking packet.
+			body := p.Payload()
+			if len(body) < icmpDestUnreachableUnusedLen {
+				t.Fatalf("ICMP body too short: %d bytes", len(body))
+			}
+			if unused := body[:icmpDestUnreachableUnusedLen]; !bytes.Equal(unused, make([]byte, icmpDestUnreachableUnusedLen)) {
+				t.Errorf("unused field: got % x, want all zero", unused)
+			}
+			embedded := body[icmpDestUnreachableUnusedLen:]
+			if !bytes.HasPrefix(tt.invokingPacket.b, embedded) {
+				t.Errorf("embedded packet is not a prefix of the invoking packet:\n embedded=% x\n orig=% x", embedded, tt.invokingPacket.b[:min(len(tt.invokingPacket.b), len(embedded))])
+			}
+			if !tt.fitsWhole {
+				// embedded should be truncated to the max
+				wantLen := maxEmbeddedV4Length
+				if iSrc.Is6() {
+					wantLen = maxEmbeddedV6Length
+				}
+				if len(embedded) != wantLen {
+					t.Errorf("embedded length: got %d, want %d (orig %d)", len(embedded), wantLen, len(tt.invokingPacket.b))
+				}
+			} else {
+				// should decode to the invoking packet
+				var orig Parsed
+				orig.Decode(embedded)
+				if got := orig.IPProto; got != ipproto.UDP {
+					t.Errorf("embedded proto: got %v, want UDP", got)
+				}
+				if want, got := netip.AddrPortFrom(iSrc, clientPort), orig.Src; want != got {
+					t.Errorf("embedded src: got %v, want %v", got, want)
+				}
+				if want, got := netip.AddrPortFrom(iDst, serverPort), orig.Dst; want != got {
+					t.Errorf("embedded dst: got %v, want %v", got, want)
+				}
+			}
+		})
+	}
+}
+
+func TestGenerateICMPHostUnreachableMixedFamily(t *testing.T) {
+	v4 := netip.MustParseAddr("100.70.0.1")
+	v6 := netip.MustParseAddr("fd7a:115c:a1e0::1")
+
+	var empty Parsed
+	if got := GenerateICMPHostUnreachable(v4, v6, &empty); got != nil {
+		t.Errorf("mixed family: got % x, want nil", got)
+	}
+	if got := GenerateICMPHostUnreachable(netip.Addr{}, v4, &empty); got != nil {
+		t.Errorf("invalid from: got % x, want nil", got)
+	}
+}
diff --git a/net/packet/packet.go b/net/packet/packet.go
index b41e0dcd9..204b16767 100644
--- a/net/packet/packet.go
+++ b/net/packet/packet.go
@@ -17,8 +17,23 @@ import (
 const unknown = ipproto.Unknown
 
 // RFC1858: prevent overlapping fragment attacks.
+//
+// The bound is sized for IPv4 (max IPv4 header + basic TCP header) but is
+// intentionally reused by decode6 for IPv6 fragments. It is conservative for
+// IPv6, whose fragments carry no per-fragment IP header, so it only ever
+// rejects more later fragments as Unknown, never fewer.
 const minFragBlks = (60 + 20) / 8 // max IPv4 header + basic TCP header in fragment blocks (8 bytes each)
 
+// ip6FragHeader is the IANA protocol number for the IPv6 Fragment extension
+// header ("IPv6-Frag"). It appears as the base header's Next Header value on a
+// fragmented packet; decode6 steps over it to reach the real sub-protocol.
+// This is distinct from ipproto.Fragment (0xFF), our internal sentinel for a
+// non-first fragment whose sub-protocol header is not present.
+const ip6FragHeader ipproto.Proto = 44
+
+// ip6FragHeaderLength is the length of the IPv6 Fragment extension header.
+const ip6FragHeaderLength = 8
+
 type TCPFlag uint8
 
 const (
@@ -272,19 +287,25 @@ func (q *Parsed) decode6(b []byte) {
 	q.Src = withIP(q.Src, srcIP)
 	q.Dst = withIP(q.Dst, dstIP)
 
-	// We don't support any IPv6 extension headers. Don't try to
-	// be clever. Therefore, the IP subprotocol always starts at
-	// byte 40.
+	// The IP subprotocol normally begins right after the 40-byte IPv6
+	// header. The one extension header we parse is the Fragment header
+	// (Next Header 44): a host source-fragmenting a datagram larger than
+	// the tun MTU emits these, and RFC 8200 section 4.5 requires the
+	// receiver to reassemble them, so we must let them through. For the
+	// first fragment we step over the fragment header and read the real
+	// sub-protocol's ports exactly as decode4 does; later fragments are
+	// marked ipproto.Fragment and passed through by the filter.
 	//
-	// Note that this means we don't support fragmentation in
-	// IPv6. This is fine, because IPv6 strongly mandates that you
-	// should not fragment, which makes fragmentation on the open
-	// internet extremely uncommon.
-	//
-	// This also means we don't support IPSec headers (AH/ESP), or
-	// IPv6 jumbo frames. Those will get marked Unknown and
-	// dropped.
+	// We still don't parse any other extension headers (hop-by-hop,
+	// routing, destination options) or IPSec headers (AH/ESP), nor a
+	// Fragment header that isn't the base header's immediate Next Header.
+	// Those get marked Unknown and dropped.
 	q.subofs = 40
+	if q.IPProto == ip6FragHeader {
+		if !q.decode6Fragment(b) {
+			return
+		}
+	}
 	sub := b[q.subofs:]
 	sub = sub[:len(sub):len(sub)] // help the compiler do bounds check elimination
 
@@ -341,6 +362,49 @@ func (q *Parsed) decode6(b []byte) {
 	}
 }
 
+// decode6Fragment parses the IPv6 Fragment extension header at q.subofs in b
+// (q.subofs is the 40-byte base header length when called). It reports whether
+// decode6 should continue into the sub-protocol switch: true only for the
+// first fragment, where q.subofs and q.IPProto have been advanced to the real
+// transport header so its ports get parsed like an unfragmented packet. For
+// later or malformed fragments it sets q.IPProto itself (ipproto.Fragment to
+// pass through, or unknown to drop) and returns false.
+func (q *Parsed) decode6Fragment(b []byte) (continueDecode bool) {
+	// The fragment header is 8 bytes: Next Header, Reserved, a 13-bit
+	// Fragment Offset (in 8-byte blocks) plus a More-Fragments flag, and a
+	// 32-bit Identification.
+	if len(b) < q.subofs+ip6FragHeaderLength {
+		q.IPProto = unknown
+		return false
+	}
+	frag := b[q.subofs:]
+	nextHdr := ipproto.Proto(frag[0])
+	fragOfs := binary.BigEndian.Uint16(frag[2:4]) >> 3
+
+	// Step over the fragment header. The real sub-protocol (first fragment)
+	// or the continued payload (later fragments) begins here.
+	q.subofs += ip6FragHeaderLength
+
+	if fragOfs == 0 {
+		// First fragment: decode the real sub-protocol's header so the
+		// filter can match on its ports. The switch in decode6 performs
+		// the per-protocol bounds checks, including rejecting a first
+		// fragment too short to hold the transport header.
+		q.IPProto = nextHdr
+		return true
+	}
+
+	// Later fragment: there's no sub-protocol header to read. Reject offsets
+	// small enough to overlap the transport header (RFC 1858, same guard as
+	// decode4); otherwise pass it through as a fragment.
+	if fragOfs < minFragBlks {
+		q.IPProto = unknown
+		return false
+	}
+	q.IPProto = ipproto.Fragment
+	return false
+}
+
 func (q *Parsed) IP4Header() IP4Header {
 	if q.IPVersion != 4 {
 		panic("IP4Header called on non-IPv4 Parsed")
diff --git a/net/packet/packet_test.go b/net/packet/packet_test.go
index 4dbf88009..0153fdb64 100644
--- a/net/packet/packet_test.go
+++ b/net/packet/packet_test.go
@@ -232,6 +232,165 @@ var udp6RequestDecode = Parsed{
 	Dst:       mustIPPort("[2607:f8b0:400a:809::200e]:443"),
 }
 
+// First fragment of a source-fragmented UDP datagram over IPv6.
+//
+// The base header's next-header is 44 (IPv6 Fragment extension header),
+// which carries the real upper-layer protocol (UDP) and the fragment
+// offset (0 here, with the More-Fragments flag set). Like decode4's
+// first-fragment handling, decode6 should reach past the 8-byte fragment
+// header and parse the transport ports.
+var udp6FirstFragmentBuffer = []byte{
+	// IPv6 header up to hop limit. Next header = 44 (Fragment), payload len = 24.
+	0x60, 0x00, 0x00, 0x00, 0x00, 0x18, 0x2c, 0x40,
+	// Src addr
+	0x20, 0x01, 0x05, 0x59, 0xbc, 0x13, 0x54, 0x00, 0x17, 0x49, 0x46, 0x28, 0x39, 0x34, 0x0e, 0x1b,
+	// Dst addr
+	0x26, 0x07, 0xf8, 0xb0, 0x40, 0x0a, 0x08, 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x20, 0x0e,
+	// Fragment extension header (8 bytes):
+	// NextHeader=UDP(0x11), Reserved, FragmentOffset=0 + M flag, Identification.
+	0x11, 0x00, 0x00, 0x01, 0xde, 0xad, 0xbe, 0xef,
+	// UDP header
+	0xd4, 0x04, 0x01, 0xbb, 0x00, 0x29, 0x96, 0x84,
+	// Payload (start of the datagram, carried by the first fragment)
+	0x5c, 0x06, 0xae, 0x85, 0x02, 0xf5, 0xdb, 0x90,
+}
+
+var udp6FirstFragmentDecode = Parsed{
+	b:       udp6FirstFragmentBuffer,
+	subofs:  48, // 40-byte IPv6 header + 8-byte fragment extension header
+	dataofs: 56, // subofs + 8-byte UDP header
+	length:  len(udp6FirstFragmentBuffer),
+
+	IPVersion: 6,
+	IPProto:   UDP,
+	Src:       mustIPPort("[2001:559:bc13:5400:1749:4628:3934:e1b]:54276"),
+	Dst:       mustIPPort("[2607:f8b0:400a:809::200e]:443"),
+}
+
+// A non-first fragment over IPv6: it carries a fragment header at a
+// nonzero offset and no transport header, so its ports are unknown. Like
+// decode4, decode6 should classify it as ipproto.Fragment so the filter's
+// pre() pass-through path accepts it.
+var udp6NonFirstFragmentBuffer = []byte{
+	// IPv6 header up to hop limit. Next header = 44 (Fragment), payload len = 16.
+	0x60, 0x00, 0x00, 0x00, 0x00, 0x10, 0x2c, 0x40,
+	// Src addr
+	0x20, 0x01, 0x05, 0x59, 0xbc, 0x13, 0x54, 0x00, 0x17, 0x49, 0x46, 0x28, 0x39, 0x34, 0x0e, 0x1b,
+	// Dst addr
+	0x26, 0x07, 0xf8, 0xb0, 0x40, 0x0a, 0x08, 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x20, 0x0e,
+	// Fragment extension header (8 bytes):
+	// NextHeader=UDP(0x11), Reserved, FragmentOffset=185 (0x05c8>>3) + M=0, Identification.
+	0x11, 0x00, 0x05, 0xc8, 0xde, 0xad, 0xbe, 0xef,
+	// Payload continuation (no transport header in a non-first fragment)
+	0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61,
+}
+
+var udp6NonFirstFragmentDecode = Parsed{
+	b:       udp6NonFirstFragmentBuffer,
+	subofs:  48, // past the fragment extension header, at the continued payload
+	dataofs: 0,  // no sub-protocol header present
+	length:  len(udp6NonFirstFragmentBuffer),
+
+	IPVersion: 6,
+	IPProto:   Fragment,
+	Src:       mustIPPort("[2001:559:bc13:5400:1749:4628:3934:e1b]:0"),
+	Dst:       mustIPPort("[2607:f8b0:400a:809::200e]:0"),
+}
+
+// A first fragment (offset 0) truncated before the full transport header,
+// so the ports can't be read. Like decode4's tcp4ShortFragment case, this
+// must be rejected as Unknown rather than guessed at: a stateless filter
+// that trusted such a fragment could be bypassed by a follow-up fragment
+// that supplies the rest of the header (RFC 1858).
+var udp6ShortFirstFragmentBuffer = []byte{
+	// IPv6 header. Next header = 44 (Fragment), payload len = 12.
+	0x60, 0x00, 0x00, 0x00, 0x00, 0x0c, 0x2c, 0x40,
+	// Src addr
+	0x20, 0x01, 0x05, 0x59, 0xbc, 0x13, 0x54, 0x00, 0x17, 0x49, 0x46, 0x28, 0x39, 0x34, 0x0e, 0x1b,
+	// Dst addr
+	0x26, 0x07, 0xf8, 0xb0, 0x40, 0x0a, 0x08, 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x20, 0x0e,
+	// Fragment extension header: NextHeader=UDP, Reserved, Offset=0 + M=1, Identification.
+	0x11, 0x00, 0x00, 0x01, 0xde, 0xad, 0xbe, 0xef,
+	// Truncated UDP header: only 4 of the required 8 bytes.
+	0xd4, 0x04, 0x01, 0xbb,
+}
+
+var udp6ShortFirstFragmentDecode = Parsed{
+	b:       udp6ShortFirstFragmentBuffer,
+	subofs:  48, // header walk reaches past the fragment header...
+	dataofs: 0,  // ...but the transport header is incomplete, so it's unknown
+	length:  len(udp6ShortFirstFragmentBuffer),
+
+	IPVersion: 6,
+	IPProto:   Unknown,
+	Src:       mustIPPort("[2001:559:bc13:5400:1749:4628:3934:e1b]:0"),
+	Dst:       mustIPPort("[2607:f8b0:400a:809::200e]:0"),
+}
+
+// A non-first fragment whose offset is small enough that its bytes could
+// overlap the transport header on reassembly. Mirrors decode4's
+// ipv4SmallOffsetFragment: reject as Unknown to prevent overlapping-fragment
+// firewall bypass (RFC 1858), rather than passing it through as Fragment.
+var udp6SmallOffsetFragmentBuffer = []byte{
+	// IPv6 header. Next header = 44 (Fragment), payload len = 16.
+	0x60, 0x00, 0x00, 0x00, 0x00, 0x10, 0x2c, 0x40,
+	// Src addr
+	0x20, 0x01, 0x05, 0x59, 0xbc, 0x13, 0x54, 0x00, 0x17, 0x49, 0x46, 0x28, 0x39, 0x34, 0x0e, 0x1b,
+	// Dst addr
+	0x26, 0x07, 0xf8, 0xb0, 0x40, 0x0a, 0x08, 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x20, 0x0e,
+	// Fragment extension header: NextHeader=UDP, Reserved,
+	// Offset=1 block (8 bytes, below the safe minimum) + M=0, Identification.
+	0x11, 0x00, 0x00, 0x08, 0xde, 0xad, 0xbe, 0xef,
+	// Payload continuation that could overlap the transport header.
+	0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61,
+}
+
+var udp6SmallOffsetFragmentDecode = Parsed{
+	b:       udp6SmallOffsetFragmentBuffer,
+	subofs:  48,
+	dataofs: 0,
+	length:  len(udp6SmallOffsetFragmentBuffer),
+
+	IPVersion: 6,
+	IPProto:   Unknown,
+	Src:       mustIPPort("[2001:559:bc13:5400:1749:4628:3934:e1b]:0"),
+	Dst:       mustIPPort("[2607:f8b0:400a:809::200e]:0"),
+}
+
+// A first fragment reachable only through a chained extension header: the base
+// header's Next Header is Hop-by-Hop Options (0), which then chains to the
+// Fragment header. decode6 only parses the Fragment header when it is the
+// base header's immediate Next Header, so it must classify this as Unknown
+// rather than walking the chain. This locks in that scoping decision so a
+// future change can't silently start (mis)parsing chained headers.
+var udp6ChainedFragmentBuffer = []byte{
+	// IPv6 header. Next header = 0 (Hop-by-Hop Options), payload len = 24.
+	0x60, 0x00, 0x00, 0x00, 0x00, 0x18, 0x00, 0x40,
+	// Src addr
+	0x20, 0x01, 0x05, 0x59, 0xbc, 0x13, 0x54, 0x00, 0x17, 0x49, 0x46, 0x28, 0x39, 0x34, 0x0e, 0x1b,
+	// Dst addr
+	0x26, 0x07, 0xf8, 0xb0, 0x40, 0x0a, 0x08, 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x20, 0x0e,
+	// Hop-by-Hop Options header (8 bytes): NextHeader=44 (Fragment),
+	// HdrExtLen=0, followed by PadN option padding.
+	0x2c, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00, 0x00,
+	// Fragment extension header: NextHeader=UDP, Reserved, Offset=0 + M=1, Identification.
+	0x11, 0x00, 0x00, 0x01, 0xde, 0xad, 0xbe, 0xef,
+	// UDP header (unreachable: decoder stops at the unhandled Hop-by-Hop header).
+	0xd4, 0x04, 0x01, 0xbb, 0x00, 0x18, 0x00, 0x00,
+}
+
+var udp6ChainedFragmentDecode = Parsed{
+	b:       udp6ChainedFragmentBuffer,
+	subofs:  40, // base header only; the Hop-by-Hop header is not parsed
+	dataofs: 0,
+	length:  len(udp6ChainedFragmentBuffer),
+
+	IPVersion: 6,
+	IPProto:   Unknown,
+	Src:       mustIPPort("[2001:559:bc13:5400:1749:4628:3934:e1b]:0"),
+	Dst:       mustIPPort("[2607:f8b0:400a:809::200e]:0"),
+}
+
 var udp4ReplyBuffer = []byte{
 	// IP header up to checksum
 	0x45, 0x00, 0x00, 0x29, 0x21, 0x52, 0x00, 0x00, 0x40, 0x11, 0x49, 0x5f,
@@ -567,6 +726,11 @@ func TestDecode(t *testing.T) {
 		{"ipv4_tsmp", ipv4TSMPBuffer, ipv4TSMPDecode},
 		{"ipv4_sctp", sctpBuffer, sctpDecode},
 		{"ipv4_frag", tcp4MediumFragmentBuffer, tcp4MediumFragmentDecode},
+		{"ipv6_frag_first", udp6FirstFragmentBuffer, udp6FirstFragmentDecode},
+		{"ipv6_frag_nonfirst", udp6NonFirstFragmentBuffer, udp6NonFirstFragmentDecode},
+		{"ipv6_frag_short_first", udp6ShortFirstFragmentBuffer, udp6ShortFirstFragmentDecode},
+		{"ipv6_frag_small_offset", udp6SmallOffsetFragmentBuffer, udp6SmallOffsetFragmentDecode},
+		{"ipv6_frag_chained", udp6ChainedFragmentBuffer, udp6ChainedFragmentDecode},
 		{"ipv4_fragtooshort", tcp4ShortFragmentBuffer, tcp4ShortFragmentDecode},
 		{"ipv4_short_first_fragment", ipv4ShortFirstFragmentBuffer, ipv4ShortFirstFragmentDecode},
 		{"ipv4_small_offset_fragment", ipv4SmallOffsetFragmentBuffer, ipv4SmallOffsetFragmentDecode},
diff --git a/net/packet/tsmp.go b/net/packet/tsmp.go
index ad1db311a..182121eef 100644
--- a/net/packet/tsmp.go
+++ b/net/packet/tsmp.go
@@ -29,7 +29,7 @@ const minTSMPSize = 7 // the rejected body is 7 bytes
 // On the wire, after the IP header, it's currently 7 or 8 bytes:
 //   - '!'
 //   - IPProto byte (IANA protocol number: TCP or UDP)
-//   - 'A' or 'S' (RejectedDueToACLs, RejectedDueToShieldsUp)
+//   - byte stating rejection reason (see [TailscaleRejectReason] for valid values)
 //   - srcPort big endian uint16
 //   - dstPort big endian uint16
 //   - [optional] byte of flag bits:
@@ -63,19 +63,20 @@ func (rh TailscaleRejectedHeader) String() string {
 	return fmt.Sprintf("TSMP-reject-flow{%s %s > %s}: %s", rh.Proto, rh.Src, rh.Dst, rh.Reason)
 }
 
+// TSMPType is the type byte of a TSMP message. It follows the IPv4 or IPv6 header.
 type TSMPType uint8
 
 const (
-	// TSMPTypeRejectedConn is the type byte for a TailscaleRejectedHeader.
+	// TSMPTypeRejectedConn is the type byte for a [TailscaleRejectedHeader].
 	TSMPTypeRejectedConn TSMPType = '!'
 
-	// TSMPTypePing is the type byte for a TailscalePingRequest.
+	// TSMPTypePing is the type byte for a [TSMPPingRequest].
 	TSMPTypePing TSMPType = 'p'
 
-	// TSMPTypePong is the type byte for a TailscalePongResponse.
+	// TSMPTypePong is the type byte for a [TSMPPongReply].
 	TSMPTypePong TSMPType = 'o'
 
-	// TSPMTypeDiscoAdvertisement is the type byte for sending disco keys
+	// TSMPTypeDiscoAdvertisement is the type byte for a [TSMPDiscoKeyAdvertisement].
 	TSMPTypeDiscoAdvertisement TSMPType = 'a'
 )
 
@@ -101,6 +102,11 @@ const (
 	// RejectedDueToHostFirewall means that the target host's
 	// firewall is blocking the traffic.
 	RejectedDueToHostFirewall TailscaleRejectReason = 'W'
+
+	// RejectedDueToUnknownAppConnectorTransitIP means that the connector host has no real IP
+	// mapping that matches the provided transit IP for this client, so the
+	// connector has no destination to forward the connection to.
+	RejectedDueToUnknownAppConnectorTransitIP TailscaleRejectReason = 'T'
 )
 
 func (r TailscaleRejectReason) String() string {
@@ -113,6 +119,8 @@ func (r TailscaleRejectReason) String() string {
 		return "host-ip-forwarding-unavailable"
 	case RejectedDueToHostFirewall:
 		return "host-firewall"
+	case RejectedDueToUnknownAppConnectorTransitIP:
+		return "app-connector-transit-ip-unknown"
 	}
 	return fmt.Sprintf("0x%02x", byte(r))
 }
diff --git a/net/ping/ping.go b/net/ping/ping.go
index de79da51c..42d381c73 100644
--- a/net/ping/ping.go
+++ b/net/ping/ping.go
@@ -29,8 +29,10 @@ import (
 )
 
 const (
-	v4Type = "ip4:icmp"
-	v6Type = "ip6:icmp"
+	v4Type    = "ip4:icmp"
+	v6Type    = "ip6:icmp"
+	v4UDPType = "udp4" // unprivileged datagram-oriented ICMPv4
+	v6UDPType = "udp6" // unprivileged datagram-oriented ICMPv6
 )
 
 type response struct {
@@ -54,12 +56,30 @@ type ListenPacketer interface {
 // A new instance should be created for each concurrent set of ping requests;
 // this type should not be reused.
 type Pinger struct {
+	// options that must be set before the first call to Send
+
+	// Unprivileged, when set, makes the Pinger use non-privileged
+	// datagram-oriented ICMP sockets ("udp4"/"udp6") opened via
+	// golang.org/x/net/icmp.ListenPacket instead of raw ICMP sockets
+	// ("ip4:icmp"/"ip6:icmp") opened via the configured ListenPacketer.
+	//
+	// Unprivileged mode is supported on macOS, iOS, and Linux (subject to
+	// the /proc/sys/net/ipv4/ping_group_range sysctl). When set, the
+	// ListenPacketer passed to New is ignored and the kernel rewrites the
+	// outgoing ICMP echo ID to match the socket; replies are matched by
+	// sequence number and echo data only.
+	//
+	// Must be set before the first call to Send.
+	Unprivileged bool
+
+	Verbose bool        // verbose logging
+	Logf    logger.Logf // optional logging function; if nil, logs to the standard logger
+
 	lp ListenPacketer
 
 	// closed guards against send incrementing the waitgroup concurrently with close.
-	closed  atomic.Bool
-	Logf    logger.Logf
-	Verbose bool
+	closed atomic.Bool
+
 	timeNow func() time.Time
 	id      uint16 // uint16 per RFC 792
 	wg      sync.WaitGroup
@@ -95,7 +115,17 @@ func (p *Pinger) mkconn(ctx context.Context, typ, addr string) (net.PacketConn,
 		return nil, net.ErrClosed
 	}
 
-	c, err := p.lp.ListenPacket(ctx, typ, addr)
+	var c net.PacketConn
+	var err error
+	if p.Unprivileged {
+		// icmp.ListenPacket on "udp4"/"udp6" opens a datagram-oriented
+		// ICMP socket that does not require elevated privileges. The
+		// returned *icmp.PacketConn implements net.PacketConn and, on
+		// Darwin/iOS, strips the IPv4 header on read via IP_STRIPHDR.
+		c, err = icmp.ListenPacket(typ, addr)
+	} else {
+		c, err = p.lp.ListenPacket(ctx, typ, addr)
+	}
 	if err != nil {
 		return nil, err
 	}
@@ -125,7 +155,7 @@ func (p *Pinger) getConn(ctx context.Context, typ string) (net.PacketConn, error
 	}
 
 	var addr = "0.0.0.0"
-	if typ == v6Type {
+	if typ == v6Type || typ == v6UDPType {
 		addr = "::"
 	}
 	c, err := p.mkconn(ctx, typ, addr)
@@ -216,9 +246,9 @@ func (p *Pinger) handleResponse(buf []byte, now time.Time, typ string) {
 	// and IPv6.
 	var icmpType icmp.Type
 	switch typ {
-	case v4Type:
+	case v4Type, v4UDPType:
 		icmpType = ipv4.ICMPTypeEchoReply
-	case v6Type:
+	case v6Type, v6UDPType:
 		icmpType = ipv6.ICMPTypeEchoReply
 	default:
 		p.vlogf("handleResponse: unknown icmp.Type")
@@ -243,7 +273,10 @@ func (p *Pinger) handleResponse(buf []byte, now time.Time, typ string) {
 	}
 
 	// We assume we sent this if the ID in the response is ours.
-	if uint16(resp.ID) != p.id {
+	// In unprivileged ICMP DGRAM mode the kernel rewrites the ID to match
+	// the socket, so the value we set on the way out is not what comes
+	// back; rely on sequence and data matching instead.
+	if !p.Unprivileged && uint16(resp.ID) != p.id {
 		p.vlogf("handleResponse: wanted ID=%d; got %d", p.id, resp.ID)
 		return
 	}
@@ -294,14 +327,30 @@ func (p *Pinger) Send(ctx context.Context, dest net.Addr, data []byte) (time.Dur
 	}
 	if ap.Is6() {
 		icmpType = ipv6.ICMPTypeEchoRequest
-		conn, err = p.getConn(ctx, v6Type)
+		typ := v6Type
+		if p.Unprivileged {
+			typ = v6UDPType
+		}
+		conn, err = p.getConn(ctx, typ)
 	} else {
-		conn, err = p.getConn(ctx, v4Type)
+		typ := v4Type
+		if p.Unprivileged {
+			typ = v4UDPType
+		}
+		conn, err = p.getConn(ctx, typ)
 	}
 	if err != nil {
 		return 0, err
 	}
 
+	// In unprivileged ICMP DGRAM mode (icmp.ListenPacket on "udp4"/"udp6"),
+	// the kernel requires a *net.UDPAddr destination for WriteTo even though
+	// the wire packet is ICMP.
+	writeDst := dest
+	if p.Unprivileged {
+		writeDst = &net.UDPAddr{IP: ap.AsSlice(), Zone: ap.Zone()}
+	}
+
 	m := icmp.Message{
 		Type: icmpType,
 		Code: 0,
@@ -324,7 +373,7 @@ func (p *Pinger) Send(ctx context.Context, dest net.Addr, data []byte) (time.Dur
 	p.mu.Unlock()
 
 	start := p.timeNow()
-	n, err := conn.WriteTo(b, dest)
+	n, err := conn.WriteTo(b, writeDst)
 	if err != nil {
 		return 0, err
 	} else if n != len(b) {
diff --git a/net/routecheck/log.go b/net/routecheck/log.go
new file mode 100644
index 000000000..0a92cefe9
--- /dev/null
+++ b/net/routecheck/log.go
@@ -0,0 +1,32 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package routecheck
+
+import (
+	"log"
+
+	"tailscale.com/envknob"
+)
+
+// Debugging tweakable.
+var debugRoutecheck = envknob.RegisterBool("TS_DEBUG_ROUTECHECK")
+
+// Logf calls [Client.Logf] to print to a logger.
+// Arguments are handled in the manner of fmt.Printf.
+func (c *Client) logf(format string, a ...any) {
+	if c.Logf != nil {
+		c.Logf(format, a...)
+	} else {
+		log.Printf(format, a...)
+	}
+}
+
+// Vlogf calls [Client.Logf] to print to a logger, only when in debug mode,
+// which is when the TS_DEBUG_ROUTECHECK environment variable is set.
+// Arguments are handled in the manner of fmt.Printf.
+func (c *Client) vlogf(format string, a ...any) {
+	if c.Verbose || debugRoutecheck() {
+		c.logf(format, a...)
+	}
+}
diff --git a/net/routecheck/peernode/doc.go b/net/routecheck/peernode/doc.go
new file mode 100644
index 000000000..fab5d5c6f
--- /dev/null
+++ b/net/routecheck/peernode/doc.go
@@ -0,0 +1,5 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package peernode contains constants that describe a peer node in the routecheck report.
+package peernode
diff --git a/net/routecheck/peernode/reachability.go b/net/routecheck/peernode/reachability.go
new file mode 100644
index 000000000..04052c0e0
--- /dev/null
+++ b/net/routecheck/peernode/reachability.go
@@ -0,0 +1,39 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package peernode
+
+import "fmt"
+
+// Reachability reports whether a peer node is reachable.
+type Reachability int
+
+const (
+	// Unknown is a peer node whose reachability is unknown.
+	// This peer is new and we have yet to probe it.
+	Unknown Reachability = iota
+	// Reachable is a peer node that is reachable from this node.
+	Reachable
+	// Unreachable is a peer node that is unreachable from this node.
+	// This peer is not responding to probes.
+	Unreachable
+)
+
+// String implements [fmt.Stringer].
+func (r Reachability) String() string {
+	switch r {
+	case Unknown:
+		return "Unknown"
+	case Reachable:
+		return "Reachable"
+	case Unreachable:
+		return "Unreachable"
+	default:
+		panic(fmt.Sprintf("unknown %#v", r))
+	}
+}
+
+// IsReachable reports if r is [Reachable].
+func (r Reachability) IsReachable() bool {
+	return r == Reachable
+}
diff --git a/net/routecheck/probe.go b/net/routecheck/probe.go
new file mode 100644
index 000000000..16e425848
--- /dev/null
+++ b/net/routecheck/probe.go
@@ -0,0 +1,297 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package routecheck
+
+import (
+	"cmp"
+	"context"
+	"iter"
+	"net/netip"
+	"slices"
+	"time"
+
+	"golang.org/x/sync/errgroup"
+	"tailscale.com/ipn/ipnstate"
+	"tailscale.com/net/traffic"
+	"tailscale.com/syncs"
+	"tailscale.com/tailcfg"
+	"tailscale.com/tsconst"
+	"tailscale.com/util/clientmetric"
+	"tailscale.com/util/mak"
+)
+
+var (
+	metricPing          = clientmetric.NewCounter("routecheck_ping")
+	metricPingError     = clientmetric.NewCounter("routecheck_ping_error")
+	metricPingReachable = clientmetric.NewCounter("routecheck_ping_reachable")
+	metricPingTimeout   = clientmetric.NewCounter("routecheck_ping_timeout")
+	metricProbe         = clientmetric.NewCounter("routecheck_probe")
+)
+
+// DefaultTimeout is the default time allowed for a response
+// before a peer is considered unreachable.
+const DefaultTimeout = tsconst.DefaultPingTimeout
+
+type probed struct {
+	tailcfg.NodeView
+	addr   netip.Addr
+	routes []netip.Prefix
+}
+
+func (c *Client) probe(ctx context.Context, nodes iter.Seq[probed], limit int, timeout time.Duration) (*Report, error) {
+	metricProbe.Add(1)
+
+	g, ctx := errgroup.WithContext(ctx)
+	if limit > 0 {
+		g.SetLimit(limit)
+	}
+
+	var mu syncs.Mutex
+	r := &Report{}
+
+	timestampProbe := func(n probed) {
+		mu.Lock()
+		defer mu.Unlock()
+		mak.Set(&r.LastProbed, n.ID(), time.Now())
+	}
+
+	markReachable := func(n probed) {
+		mu.Lock()
+		defer mu.Unlock()
+		nid := n.ID()
+		if _, ok := r.Reachable[nid]; !ok {
+			mak.Set(&r.Reachable, nid, Node{
+				ID:     nid,
+				Name:   n.Name(),
+				Addr:   n.addr,
+				Routes: n.routes,
+			})
+		}
+	}
+
+	// TODO(sfllaw): Since the nodes are sorted by priority,
+	// where earlier nodes have high traffic-steering scores,
+	// it should be possible to deprioritize or skip probes
+	// if there are already enough responses for a particular resource.
+	// This optimization has not been implemented yet, so all nodes are probed.
+	for n := range nodes {
+		// WireGuard-only nodes are assumed to be reachable, since
+		// we don’t want to probe nodes that don’t understand Disco pings.
+		//
+		// We could establish a WireGuard session to probe them,
+		// which would allow us to exclude nodes that won’t respond,
+		// but all the other nodes would hold unnecessary session state.
+		// This would be incredibly rude and could potentially DDOS them.
+		//
+		// TODO(sfllaw): Add a mechanism to mark a node as unreachable
+		// because it fails of establish a new WireGuard connection.
+		if n.IsWireGuardOnly() {
+			timestampProbe(n)
+			markReachable(n)
+			continue
+		}
+
+		g.Go(func() error {
+			metricPing.Add(1)
+
+			// We record the timestamp of each node’s latest probe
+			// so we can probe in incremental batches
+			// and to limit the rate that any given node is pinged.
+			//
+			// TODO(sfllaw): We currently record the timestamp
+			// but haven’t implemented batching or rate-limiting yet.
+			defer timestampProbe(n)
+
+			// TODO(sfllaw): Why did we choose Disco ping instead of TSMP ping?
+			// After all, a TSMP ping proves that the peer Tailscale node is there
+			// and that both nodes know each other’s WireGuard keys,
+			// while a Disco ping only proves that the peer can be found using DERP.
+			// However, TSMP is wrapped in a long-lived WireGuard connection,
+			// which is too expensive when generating a reachability report.
+			// Although different nodes theoretically could share the same Disco key,
+			// in practice there is a 1:1 mapping between a Disco key and a node key.
+			//
+			// TODO(#19670): WireGuard establishes connections with a single round-trip,
+			// so there is no existing way to confirm that a WireGuard connection
+			// can be established without burdening the peer with lingering state.
+			// WireGuard could be extended with a special `handshake_initiation`
+			// that only verifies that a connection could be established,
+			// requesting this with a sentinel in `handshake_initiation.mac2`.
+			// The peer would send a valid but stateless `handshake_response`,
+			// using a random ephemeral_private key and not record any state.
+			// See https://www.wireguard.com/protocol/.
+			switch pong, err := c.ping(ctx, n.addr, tailcfg.PingDisco, timeout); {
+			case err == context.DeadlineExceeded:
+				// Ping timed out, so assume that the node is unreachable.
+				c.vlogf("ping %s (%s): timed out", n.addr, n.ID())
+				metricPingTimeout.Add(1)
+				return nil
+			case err != nil:
+				// Returning an error would cancel the errgroup.
+				c.vlogf("ping %s (%s): error: %v", n.addr, n.ID(), err)
+				metricPingError.Add(1)
+				return nil
+			case pong == nil:
+				c.vlogf("ping %s (%s): error: no response", n.addr, n.ID())
+				metricPingError.Add(1)
+				return nil
+			default:
+				if pong.Err != "" {
+					c.vlogf("ping %s (%s): result: %f ms (err: %v)",
+						n.addr, n.ID(), pong.LatencySeconds*1000, pong.Err)
+				} else {
+					c.vlogf("ping %s (%s): result: %f ms",
+						n.addr, n.ID(), pong.LatencySeconds*1000)
+				}
+				metricPingReachable.Add(1)
+			}
+
+			markReachable(n)
+			return nil
+		})
+	}
+	g.Wait()
+	r.Done = time.Now()
+	return r, nil
+}
+
+// Probe actively probes the sequence of nodes and returns a reachability [Report].
+// If limit is positive, it limits the number of concurrent active probes;
+// a limit of zero will ping every node at once.
+// A peer is considered unreachable if it doesn’t respond within the timeout.
+//
+// This function will probe nodes in order, so better candidates should be
+// sorted earlier in the sequence. This function may use ordering to skip some probes
+// if it has discovered enough reachable peers.
+//
+// A node’s IPv4 address is preferred, if the current node also supports IPv4.
+// A node’s IPv6 is only probed when the current node only supports IPv6.
+// In 2026, IPv4 is still more common and more likely to work properly.
+func (c *Client) Probe(ctx context.Context, nodes iter.Seq[tailcfg.NodeView], limit int, timeout time.Duration) (*Report, error) {
+	can4, can6 := supportsIPVersions(c.nb.NodeBackend().Self())
+	if !can4 && !can6 {
+		return nil, nil
+	}
+	// TODO(sfllaw): Probes should fall back to IPv6, if the IPv4 probe times out
+	// and IPv6 is also supported by the current node.
+	addrFor := addrPicker(can4, can6)
+
+	var dsts iter.Seq[probed] = func(yield func(probed) bool) {
+		for n := range nodes {
+			// Probe one of the tailnet addresses.
+			addr := addrFor(n)
+			if !addr.IsValid() {
+				continue // No valid addresses.
+			}
+			if !yield(probed{
+				NodeView: n,
+				addr:     addr,
+				routes:   routes(n),
+			}) {
+				return
+			}
+		}
+	}
+
+	return c.probe(ctx, dsts, limit, timeout)
+}
+
+// ProbeAllHARouters actively probes all High Availability routers in parallel
+// and returns a [Report] that identifies which of these routers are reachable.
+// If limit is positive, it limits the number of concurrent active probes;
+// a limit of zero will ping every candidate at once.
+// A peer is considered unreachable if it doesn’t respond within the timeout.
+func (c *Client) ProbeAllHARouters(ctx context.Context, limit int, timeout time.Duration) (*Report, error) {
+	nm, err := c.waitForNetMap(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	// When a prefix is routed by multiple nodes, we probe those nodes.
+	// There is no point to probing a router when it is the only choice.
+	// These nodes are referred to a High Availability (HA) routers.
+	var nodes []tailcfg.NodeView
+	for _, rs := range c.RoutersByPrefix() {
+		if len(rs) <= 1 {
+			continue
+		}
+		nodes = append(nodes, rs...) // Note: this introduces duplicates.
+	}
+
+	// Sort by Node.ID and deduplicate to avoid double-probing.
+	slices.SortFunc(nodes, func(a, b tailcfg.NodeView) int {
+		return cmp.Compare(a.ID(), b.ID())
+	})
+	nodes = slices.CompactFunc(nodes, func(a, b tailcfg.NodeView) bool {
+		return a.ID() == b.ID()
+	})
+
+	// Each node should probe starting with the highest scoring node.
+	// We use rendezvous hashing to break ties in a consistent manner
+	// while still preventing swarming.
+	ss := traffic.ScoresFor(nm.SelfNode.ID(), nodes)
+	ss.SortNodes(nodes)
+
+	return c.Probe(ctx, slices.Values(nodes), limit, timeout)
+}
+
+// Ping returns the result of a ping to the peer handling the given IP.
+// It returns a [context.DeadlineExceeded] error if the peer doesn’t respond within the timeout.
+func (c *Client) ping(ctx context.Context, ip netip.Addr, pingType tailcfg.PingType, timeout time.Duration) (*ipnstate.PingResult, error) {
+	ctx, cancel := context.WithTimeout(ctx, timeout)
+	defer cancel()
+
+	ch := make(chan *ipnstate.PingResult, 1)
+	c.pinger.Ping(ip, pingType, 0, func(pr *ipnstate.PingResult) {
+		select {
+		case ch <- pr:
+		default:
+		}
+	})
+	select {
+	case pr := <-ch:
+		return pr, nil
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	}
+}
+
+// SupportsIPVersions reports whether n supports IPv4 or IPv6.
+func supportsIPVersions(n tailcfg.NodeView) (can4, can6 bool) {
+	if !n.Valid() {
+		return false, false
+	}
+	for _, ip := range n.Addresses().All() {
+		addr := ip.Addr()
+		if addr.Is4() {
+			can4 = true
+		} else if addr.Is6() {
+			can6 = true
+		}
+		if can4 && can6 {
+			break
+		}
+	}
+	return can4, can6
+}
+
+func addrPicker(can4, can6 bool) func(n tailcfg.NodeView) netip.Addr {
+	// TODO(sfllaw): Picking just the one address is a little brittle
+	// because this picks just one address and there’s no fallback facility.
+	// [Client.Probe] is the caller that will need refactoring.
+	return func(n tailcfg.NodeView) netip.Addr {
+		var zero netip.Addr
+		for _, ip := range n.Addresses().All() {
+			// Find a compatible IP address.
+			addr := ip.Addr()
+			if can4 && addr.Is4() {
+				return addr
+			}
+			if can6 && addr.Is6() {
+				return addr
+			}
+		}
+		return zero
+	}
+}
diff --git a/net/routecheck/report.go b/net/routecheck/report.go
new file mode 100644
index 000000000..afbe126c3
--- /dev/null
+++ b/net/routecheck/report.go
@@ -0,0 +1,166 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package routecheck
+
+import (
+	"cmp"
+	"iter"
+	"maps"
+	"net/netip"
+	"slices"
+	"time"
+
+	jsonv2 "github.com/go-json-experiment/json"
+	"github.com/go-json-experiment/json/jsontext"
+	jsonv1 "github.com/go-json-experiment/json/v1"
+
+	"tailscale.com/net/routecheck/peernode"
+	"tailscale.com/tailcfg"
+	"tailscale.com/util/clientmetric"
+	"tailscale.com/util/mak"
+)
+
+var (
+	metricReport = clientmetric.NewCounter("routecheck_report")
+)
+
+// Report returns the latest reachability report.
+// It returns nil if a report isn’t available, which happens during initialization.
+func (c *Client) Report() *Report {
+	metricReport.Add(1)
+	return c.report.Load()
+}
+
+// Report contains the result of a single routecheck.
+type Report struct {
+	// Done is the time when the report was finished.
+	Done time.Time `json:"done"`
+
+	// Reachable is the set of nodes that were reachable from the current host
+	// when this report was compiled. Missing nodes may or may not be reachable.
+	Reachable NodeSet `json:"reachable"`
+
+	// LastProbed tracks the last time a given node was probed.
+	// This is used to rate-limit reachability probing, so an entry’s
+	// presence doesn’t imply that it is reachable.
+	LastProbed map[tailcfg.NodeID]time.Time `json:"-"` // not marshaled
+}
+
+// IsReachable reports whether a peer is reachable by the current node.
+func (rp Report) IsReachable(id tailcfg.NodeID) peernode.Reachability {
+	// TODO(sfllaw): We should actually track all routers and consider the
+	// absence of a router in the report as it being recently added for
+	// consideration, so it is unknown. Then we should positively track
+	// whether a node was reachable or not.
+	_, k := rp.Reachable[id]
+	if k {
+		return peernode.Reachable
+	}
+	return peernode.Unknown
+}
+
+// RoutablePrefixes returns a map of routable network prefixes associated with
+// each prefix’s routers that were reachable by the current host,
+// at the time the report was finished.
+// Each slice of routers are ordered by their node ID.
+//
+// Note: Fallback routes are not supported by design. If a subnet prefix
+// contained within another more general prefix has no reachable routers,
+// traffic is still sent to one of those unreachable routers.
+// Routers for the general prefix aren’t candidates. See tailscale/tailscale#18550.
+func (rp Report) RoutablePrefixes() RoutablePrefixes {
+	var out map[netip.Prefix][]Node
+	for _, n := range rp.Reachable {
+		for _, p := range n.Routes {
+			mak.Set(&out, p, append(out[p], n))
+		}
+	}
+	for p := range out {
+		slices.SortFunc(out[p], Node.Compare)
+	}
+	return out
+}
+
+// Node represents a node in the reachability report.
+type Node struct {
+	ID tailcfg.NodeID `json:"id"`
+
+	// Name is the FQDN of the node.
+	// It is also the MagicDNS name for the node.
+	// It has a trailing dot.
+	// e.g. "host.tail-scale.ts.net."
+	Name string `json:"name"`
+
+	// Addr is the IP address that was probed.
+	Addr netip.Addr `json:"addr"`
+
+	// Routes are the subnets that the node will route.
+	Routes []netip.Prefix `json:"routes"`
+}
+
+// Compare returns an integer comparing two nodes, ordered by their node ID.
+// The result will be 0 if n.ID == n2.ID, -1 if n.ID < n2.ID, and +1 if n.ID > n2.ID.
+func (n Node) Compare(n2 Node) int {
+	return cmp.Compare(n.ID, n2.ID)
+}
+
+// NodeSet is a set of nodes keyed by node ID, so duplicates are easily detected.
+// To prevent stuttering, it marshals itself as a JSON array, sorted by node ID.
+type NodeSet map[tailcfg.NodeID]Node
+
+var (
+	_ jsonv1.Marshaler       = &NodeSet{}
+	_ jsonv1.Unmarshaler     = &NodeSet{}
+	_ jsonv2.MarshalerTo     = &NodeSet{}
+	_ jsonv2.UnmarshalerFrom = &NodeSet{}
+)
+
+// MarshalJSONTo implements [jsonv2.MarshalerTo].
+func (ns NodeSet) MarshalJSONTo(enc *jsontext.Encoder) error {
+	nodes := slices.SortedFunc(maps.Values(ns), Node.Compare)
+	return jsonv2.MarshalEncode(enc, nodes)
+}
+
+// UnmarshalJSONFrom implements [jsonv2.UnmarshalerFrom].
+func (ns *NodeSet) UnmarshalJSONFrom(dec *jsontext.Decoder) error {
+	var nodes []Node
+	if err := jsonv2.UnmarshalDecode(dec, &nodes); err != nil {
+		return err
+	}
+	if *ns == nil {
+		*ns = make(NodeSet, len(nodes))
+	}
+	for _, n := range nodes {
+		(*ns)[n.ID] = n
+	}
+	return nil
+}
+
+// MarshalJSON implements [jsonv1.Marshaler].
+func (ns *NodeSet) MarshalJSON() ([]byte, error) {
+	return jsonv2.Marshal(ns, jsonv1.DefaultOptionsV1())
+}
+
+// UnmarshalJSON implements [jsonv1.Unmarshaler].
+func (ns *NodeSet) UnmarshalJSON(b []byte) error {
+	return jsonv2.Unmarshal(b, ns, jsonv1.DefaultOptionsV1())
+
+}
+
+// RoutablePrefixes is a map of routers,
+// keyed by the network prefix for which they route.
+type RoutablePrefixes map[netip.Prefix][]Node
+
+// Sorted returns an iterator over the map of routers,
+// ordered by the network prefix as described in [netip.Prefix.Compare].
+func (rt RoutablePrefixes) Sorted() iter.Seq2[netip.Prefix, []Node] {
+	return func(yield func(netip.Prefix, []Node) bool) {
+		prefixes := slices.SortedFunc(maps.Keys(rt), netip.Prefix.Compare)
+		for _, p := range prefixes {
+			if !yield(p, rt[p]) {
+				return
+			}
+		}
+	}
+}
diff --git a/net/routecheck/routecheck.go b/net/routecheck/routecheck.go
new file mode 100644
index 000000000..5195b12b7
--- /dev/null
+++ b/net/routecheck/routecheck.go
@@ -0,0 +1,364 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package routecheck performs status checks for routes from the current host.
+package routecheck
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/netip"
+	"sync/atomic"
+	"time"
+
+	"tailscale.com/envknob"
+	"tailscale.com/ipn/ipnstate"
+	"tailscale.com/net/netmon"
+	"tailscale.com/tailcfg"
+	"tailscale.com/types/logger"
+	"tailscale.com/types/netmap"
+	"tailscale.com/util/clientmetric"
+	"tailscale.com/util/mak"
+)
+
+var (
+	metricNeedsRefresh = clientmetric.NewCounter("routecheck_needs_refresh")
+	metricRefresh      = clientmetric.NewCounter("routecheck_refresh")
+)
+
+// DebugForceClientSideReachabilityRoutecheck reports whether routecheck should be forced on or off.
+// If the TS_DEBUG_FORCE_CLIENT_SIDE_REACHABILITY_ROUTECHECK environment variable is true,
+// then routecheck is forced on. If it is false, then routecheck is forced off.
+// If unset, then the client respects the client-side-reachability and
+// client-side-reachability-routecheck node attributes.
+var DebugForceClientSideReachabilityRoutecheck = envknob.RegisterOptBool("TS_DEBUG_FORCE_CLIENT_SIDE_REACHABILITY_ROUTECHECK")
+
+// IsEnabled reports whether routecheck probing has been enabled for this client.
+func IsEnabled(self tailcfg.NodeView) bool {
+	if v, ok := DebugForceClientSideReachabilityRoutecheck().Get(); ok {
+		return v // forced
+	}
+	if !self.Valid() {
+		return false
+	}
+	// TODO(sfllaw): We intend to eventually enable this behaviour by default.
+	return self.HasCap(tailcfg.NodeAttrClientSideReachability) &&
+		self.HasCap(tailcfg.NodeAttrClientSideReachabilityRouteCheck)
+}
+
+// Client generates Reports describing the result of both passive and active
+// reachability probing.
+type Client struct {
+	// Verbose enables verbose logging.
+	Verbose bool
+
+	// Logf optionally specifies where to log to.
+	// If nil, log.Printf is used.
+	Logf logger.Logf
+
+	// These elements are read-only after initialization.
+	nb     NodeBackender
+	nm     NetMapper
+	pinger Pinger
+	ctx    context.Context
+	cancel context.CancelFunc
+
+	// needsRefresh is sent a message by [Client.NeedsRefresh]
+	// to signal that a new report is needed.
+	// This message is received by the goroutine spawned by [Client.Start]
+	// which probes the appropriate routers to compile a new [Client.report].
+	// This channel doesn’t need to be closed because the goroutine is canceled by ctx.
+	needsRefresh chan struct{}
+	report       atomic.Pointer[Report] // needsRefresh signals that this needs refreshing
+
+	// HasNetMap is a channel that can be closed to wake up goroutines
+	// waiting for the netmap received after connecting to the control plane.
+	// This channel gets swapped out for a new one whenever it is closed,
+	// to handle disconnecting and reconnecting to the control plane.
+	hasNetMap atomic.Pointer[chan struct{}]
+}
+
+// NetMapper is the interface that returns the current [netmap.NetworkMap].
+type NetMapper interface {
+	// NetMapNoPeers returns the latest cached network map received from
+	// controlclient WITHOUT a freshly-built Peers slice.
+	//
+	// On a tailnet with frequent peer churn the cached netmap's Peers slice
+	// can be stale relative to the live per-node-backend peers map; non-Peers
+	// fields (SelfNode, DNS, PacketFilter, capabilities, ...) are always
+	// current. Use this for any caller that does not need to iterate Peers,
+	// since it's O(1) regardless of tailnet size.
+	//
+	// Returns nil if no network map has been received yet.
+	NetMapNoPeers() *netmap.NetworkMap
+
+	// NetMapWithPeers returns the latest network map with the Peers slice
+	// populated.
+	//
+	// Currently this is the same as [LocalBackend.NetMapNoPeers]: the cached
+	// netmap's Peers slice may be stale relative to the live per-node-backend
+	// peers map. A follow-up change will switch this method to return a
+	// freshly-built netmap with up-to-date Peers, at O(N) cost per call.
+	// Callers that genuinely need the up-to-date peer set should use this
+	// method (and document why) so the upcoming change reaches them.
+	//
+	// Returns nil if no network map has been received yet.
+	NetMapWithPeers() *netmap.NetworkMap
+}
+
+// NodeBackender is the interface that returns the current [NodeBackend].
+type NodeBackender interface {
+	NodeBackend() NodeBackend
+}
+
+// NodeBackend is an interface to query the current node and its peers.
+//
+// It is not a snapshot in time but is locked to a particular node.
+type NodeBackend interface {
+	// Self returns the current node.
+	Self() tailcfg.NodeView
+
+	// Peers returns all the current peers.
+	Peers() []tailcfg.NodeView
+}
+
+// Pinger is the interface that wraps the [tailscale.com/ipn/ipnlocal.LocalBackend.Ping] method.
+type Pinger interface {
+	Ping(ip netip.Addr, pingType tailcfg.PingType, size int, cb func(*ipnstate.PingResult))
+}
+
+// NewClient returns a client that probes its peers using this LocalBackend.
+func NewClient(ctx context.Context, logf logger.Logf, nb NodeBackender, nm NetMapper, pinger Pinger) (*Client, error) {
+	if nb == nil {
+		return nil, errors.New("NodeBackender must be set")
+	}
+	if nm == nil {
+		return nil, errors.New("NetMapper must be set")
+	}
+	if pinger == nil {
+		return nil, errors.New("Pinger must be set")
+	}
+
+	ctx, cancel := context.WithCancel(ctx)
+	c := &Client{
+		Logf:   logf,
+		nb:     nb,
+		nm:     nm,
+		pinger: pinger,
+		ctx:    ctx,
+		cancel: cancel,
+
+		needsRefresh: make(chan struct{}, 1), // debounce using buffer of 1
+	}
+	c.hasNetMap.Store(new(make(chan struct{})))
+	return c, nil
+}
+
+// NotifyNetMapAvailable wakes up goroutines that have been waiting for the
+// non-nil network map that the control plane sends after reconnecting.
+func (c *Client) NotifyNetMapAvailable() {
+	if nm := c.nm.NetMapNoPeers(); nm == nil {
+		return // client disconnected
+	}
+	var nextCh *chan struct{}
+	for {
+		ch := c.hasNetMap.Load()
+		if ch == nil || *ch == nil {
+			return // Client has been Closed
+		}
+
+		if nextCh == nil {
+			nextCh = new(make(chan struct{})) // prepare for next non-nil netmap
+		}
+		if c.hasNetMap.CompareAndSwap(ch, nextCh) {
+			close(*ch)
+			return
+		}
+	}
+}
+
+func (c *Client) waitForNetMap(ctx context.Context) (*netmap.NetworkMap, error) {
+	for {
+		ch := c.hasNetMap.Load()
+		if ch == nil || *ch == nil {
+			return nil, errors.New("routecheck client closed")
+		}
+
+		if nm := c.nm.NetMapNoPeers(); nm != nil {
+			return nm, nil
+		}
+
+		select {
+		case <-c.ctx.Done(): // closed
+			return nil, c.ctx.Err()
+		case <-ctx.Done():
+			return nil, ctx.Err()
+		case <-*ch: // woken up by NotifyNetMapAvailable
+		}
+	}
+}
+
+// Refresh generates and returns a new reachability report, after caching it in [Client.Report].
+// A peer is considered unreachable if it doesn’t respond within the timeout.
+// If the cached Client.Report is newer than the report that it just generated,
+// Refresh will return the cached report instead of clobbering it report.
+func (c *Client) Refresh(ctx context.Context, timeout time.Duration) (*Report, error) {
+	metricRefresh.Add(1)
+	c.vlogf("refreshing report")
+	r, err := c.ProbeAllHARouters(ctx, 5, timeout)
+	if err != nil {
+		return nil, fmt.Errorf("error refreshing routers: %w", err)
+	}
+	for {
+		saved := c.report.Load()
+		if saved != nil && !saved.Done.Before(r.Done) {
+			return saved, nil // don’t clobber newer reports
+		}
+		if c.report.CompareAndSwap(saved, r) { // retry if a concurrent Refresh stored first
+			c.vlogf("saved new report at %v", r.Done)
+			return r, nil
+		}
+	}
+}
+
+// NeedsRefresh signals the need for a [Client.Refresh] to probe for a new report,
+// which will be done in the background by [Client.Start].
+func (c *Client) NeedsRefresh() {
+	if !IsEnabled(c.nb.NodeBackend().Self()) {
+		return
+	}
+
+	select {
+	case c.needsRefresh <- struct{}{}:
+		metricNeedsRefresh.Add(1)
+		c.vlogf("report needs refresh")
+	default:
+		// needsRefresh has already been raised, so debounce.
+	}
+}
+
+// NeedsIncrRefresh signals the need for an incremental probe for a new report,
+// because routers have been added, modified, or removed,
+// which will be done in the background by [Client.Start].
+func (c *Client) NeedsIncrRefresh(added, modified, removed []tailcfg.NodeID) {
+	// TODO(sfllaw): Currently, this refreshes everything.
+	c.NeedsRefresh()
+}
+
+// WatchForNetMonRebind watches the network monitor
+// for a signal that the sockets need to be rebound,
+// which implies that the cached report needs to be refreshed.
+// See [netmon.ChangeDelta.RebindLikelyRequired].
+func (c *Client) WatchForNetMonRebind(delta netmon.ChangeDelta) {
+	if delta.RebindLikelyRequired {
+		c.NeedsRefresh()
+	}
+}
+
+// Start runs periodic probes that compile routecheck reports.
+// Use [Client.Close] to stop probing.
+// Returns an error if the client has already been closed.
+func (c *Client) Start() error {
+	if c.ctx.Err() != nil {
+		return c.ctx.Err()
+	}
+
+	needsBootstrap := true
+	for {
+		select {
+		case <-c.needsRefresh:
+			nm := c.nm.NetMapWithPeers()
+			if nm == nil {
+				// There is no netmap: clear the cached report.
+				c.report.Store(nil)
+				needsBootstrap = true
+				continue
+			}
+
+			if needsBootstrap {
+				r := c.bootstrap(nm)
+				c.report.Store(r)
+				needsBootstrap = false
+			}
+
+			// TODO(sfllaw): Examine the shape of the overlapping
+			// routers and only probe if the routing table has
+			// changed sufficiently. For instance, a new router has
+			// come online or a router has been removed or a set of
+			// routers no longer overlap.
+			if _, err := c.Refresh(c.ctx, DefaultTimeout); err != nil {
+				c.logf("%v", err)
+			}
+		case <-c.ctx.Done(): // closed
+			return nil
+		}
+	}
+}
+
+// bootstrap assumes that nodes that are connected to the control plane are reachable,
+// while waiting for the first probe to finish.
+//
+// This function requires a netmap with peers.
+func (c *Client) bootstrap(nm *netmap.NetworkMap) *Report {
+	if nm == nil {
+		return nil
+	}
+
+	can4, can6 := supportsIPVersions(c.nb.NodeBackend().Self())
+	if !can4 && !can6 {
+		return nil
+	}
+	addrFor := addrPicker(can4, can6)
+
+	var r Report
+	for _, nodes := range GroupRoutersByPrefix(nm.Peers) {
+		if len(nodes) <= 1 {
+			continue // Not an overlapping router
+		}
+
+		// TODO(sfllaw): Instead of trusting the Node.Online flag,
+		// which actually represents whether the node is connected
+		// to the control plane and not that it is reachable,
+		// we should cache reachability alongside the cached netmap
+		// long enough to survive a restart or a brief disconnection.
+		for _, n := range nodes {
+			if !n.Online().Get() {
+				continue // Not connected to the control plane.
+			}
+
+			addr := addrFor(n)
+			if !addr.IsValid() {
+				continue // No valid addresses.
+			}
+
+			mak.Set(&r.Reachable, n.ID(), Node{
+				ID:     n.ID(),
+				Name:   n.Name(),
+				Addr:   addr,
+				Routes: routes(n),
+			})
+		}
+	}
+	r.Done = time.Now()
+	c.vlogf("bootstrapped report from netmap at %v", r.Done)
+	return &r
+}
+
+// Close immediately stops all active probes.
+func (c *Client) Close() error {
+	if c == nil {
+		return nil
+	}
+
+	if c.cancel != nil {
+		c.cancel()
+	}
+
+	hasNetMap := c.hasNetMap.Swap(nil) // clear before waking anything up
+	if hasNetMap != nil && *hasNetMap != nil {
+		close(*hasNetMap) // wake waitForNetMap
+	}
+
+	return nil
+}
diff --git a/net/routecheck/routecheck_test.go b/net/routecheck/routecheck_test.go
new file mode 100644
index 000000000..26148190e
--- /dev/null
+++ b/net/routecheck/routecheck_test.go
@@ -0,0 +1,620 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package routecheck_test
+
+import (
+	"context"
+	"fmt"
+	"maps"
+	"net/netip"
+	"slices"
+	"sync/atomic"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	gcmp "github.com/google/go-cmp/cmp"
+	gcmpopts "github.com/google/go-cmp/cmp/cmpopts"
+
+	"tailscale.com/ipn/ipnstate"
+	"tailscale.com/net/routecheck"
+	"tailscale.com/net/tsaddr"
+	"tailscale.com/tailcfg"
+	"tailscale.com/types/netmap"
+	"tailscale.com/util/mak"
+	"tailscale.com/util/set"
+)
+
+func TestRefresh(t *testing.T) {
+	for _, tt := range []struct {
+		name  string
+		init  bool // true before the netmap has been loaded
+		peers []tailcfg.NodeView
+		gone  []tailcfg.NodeID // cannot ping these nodes
+		want  []tailcfg.NodeID // Report.Reachable nodes
+	}{
+		{
+			name: "wait-for-netmap",
+			init: true,
+			peers: []tailcfg.NodeView{
+				makeNode(11, withName("exit11"), withExitRoutes()),
+				makeNode(12, withName("exit12"), withExitRoutes()),
+			},
+			want: []tailcfg.NodeID{11, 12},
+		},
+		{
+			name:  "no-peers",
+			peers: []tailcfg.NodeView{},
+			want:  []tailcfg.NodeID{},
+		},
+		{
+			name: "no-routers",
+			peers: []tailcfg.NodeView{
+				makeNode(1, withName("peer1")),
+			},
+			want: []tailcfg.NodeID{},
+		},
+		{
+			name: "no-choice",
+			peers: []tailcfg.NodeView{
+				makeNode(11, withName("exit11"), withExitRoutes()),
+				makeNode(21, withName("subnet21"),
+					withRoutes(netip.MustParsePrefix("192.168.1.0/24")),
+					withRoutes(netip.MustParsePrefix("2002:c000:0100::/48"))),
+			},
+			want: []tailcfg.NodeID{},
+		},
+		{
+			name: "all-good",
+			peers: []tailcfg.NodeView{
+				makeNode(11, withName("exit11"), withExitRoutes()),
+				makeNode(12, withName("exit12"), withExitRoutes()),
+				makeNode(21, withName("subnet21"),
+					withRoutes(netip.MustParsePrefix("192.168.1.0/24")),
+					withRoutes(netip.MustParsePrefix("2002:c000:0100::/48"))),
+				makeNode(22, withName("subnet22"),
+					withRoutes(netip.MustParsePrefix("192.168.1.0/24")),
+					withRoutes(netip.MustParsePrefix("2002:c000:0100::/48"))),
+			},
+			want: []tailcfg.NodeID{11, 12, 21, 22},
+		},
+		{
+			name: "none-good",
+			peers: []tailcfg.NodeView{
+				makeNode(11, withName("exit11"), withExitRoutes()),
+				makeNode(12, withName("exit12"), withExitRoutes()),
+				makeNode(21, withName("subnet21"),
+					withRoutes(netip.MustParsePrefix("192.168.1.0/24")),
+					withRoutes(netip.MustParsePrefix("2002:c000:0100::/48"))),
+				makeNode(22, withName("subnet22"),
+					withRoutes(netip.MustParsePrefix("192.168.1.0/24")),
+					withRoutes(netip.MustParsePrefix("2002:c000:0100::/48"))),
+			},
+			gone: []tailcfg.NodeID{11, 12, 21, 22},
+			want: []tailcfg.NodeID{},
+		},
+		{
+			name: "some-good",
+			peers: []tailcfg.NodeView{
+				makeNode(11, withName("exit11"), withExitRoutes()),
+				makeNode(12, withName("exit12"), withExitRoutes()),
+				makeNode(21, withName("subnet21"),
+					withRoutes(netip.MustParsePrefix("192.168.1.0/24")),
+					withRoutes(netip.MustParsePrefix("2002:c000:0100::/48"))),
+				makeNode(22, withName("subnet22"),
+					withRoutes(netip.MustParsePrefix("192.168.1.0/24")),
+					withRoutes(netip.MustParsePrefix("2002:c000:0100::/48"))),
+			},
+			gone: []tailcfg.NodeID{11, 22},
+			want: []tailcfg.NodeID{12, 21},
+		},
+	} {
+		makeDB := func(nodes []tailcfg.NodeView) map[tailcfg.NodeID]routecheck.Node {
+			if len(nodes) == 0 {
+				return nil
+			}
+			db := make(map[tailcfg.NodeID]routecheck.Node)
+			for _, n := range nodes {
+				db[n.ID()] = routecheck.Node{
+					ID:     n.ID(),
+					Name:   n.Name(),
+					Addr:   n.Addresses().At(0).Addr(),
+					Routes: n.AllowedIPs().AsSlice()[2:],
+				}
+			}
+			return db
+		}
+		cmpDiff := func(want, got any) string {
+			return gcmp.Diff(want, got,
+				gcmpopts.EquateComparable(netip.Addr{}, netip.Prefix{}))
+		}
+
+		t.Run(tt.name, func(t *testing.T) {
+			synctest.Test(t, func(t *testing.T) {
+				self := makeNode(99, withName("self"))
+				var b *stubBackend
+				if !tt.init {
+					b = newStubBackend(self, tt.peers,
+						withGone(t, tt.gone...))
+				} else {
+					// The backend is initialized without a NetMap,
+					// which gets “retrieved” after a delay.
+					b = newStubBackend(self, tt.peers,
+						withGone(t, tt.gone...),
+						withDelay(t, 10*time.Second))
+				}
+				t.Cleanup(func() { b.Close() })
+				c, err := routecheck.NewClient(t.Context(), t.Logf, b, b, b)
+				if err != nil {
+					t.Fatalf("unexpected error: %v", err)
+				}
+
+				if tt.init {
+					// This callback simulates the delay between
+					// connecting to the backend and receiving the NetMap.
+					donef := func() { c.NotifyNetMapAvailable() }
+					b.donef.Store(&donef)
+				}
+
+				before := time.Now()
+				got, err := c.Refresh(t.Context(), routecheck.DefaultTimeout)
+				if err != nil {
+					t.Fatalf("unexpected error: %v", err)
+				}
+				after := time.Now() // synctest will freeze time.
+
+				peers := makeDB(tt.peers)
+				want := &routecheck.Report{
+					Done: after,
+				}
+				for _, nid := range tt.want {
+					mak.Set(&want.Reachable, nid, peers[nid])
+				}
+
+				for _, nodes := range c.RoutersByPrefix() {
+					if len(nodes) <= 1 {
+						continue // no choice
+					}
+					for _, n := range nodes {
+						ts := before
+						if tt.init {
+							ts = after // waiting for netmap
+						}
+						if slices.Contains(tt.gone, n.ID()) {
+							ts = after // ping timed out
+						}
+						mak.Set(&want.LastProbed, n.ID(), ts)
+					}
+				}
+
+				if diff := cmpDiff(want, got); diff != "" {
+					t.Errorf("-want +got:\n%s", diff)
+				}
+			})
+		})
+	}
+}
+
+func TestRefreshNewerReport(t *testing.T) {
+	cmpDiff := func(want, got any) string {
+		return gcmp.Diff(want, got,
+			gcmpopts.EquateComparable(netip.Addr{}, netip.Prefix{}))
+	}
+	peers := []tailcfg.NodeView{
+		makeNode(11, withName("exit11"), withExitRoutes()),
+		makeNode(12, withName("exit12"), withExitRoutes()),
+		makeNode(21, withName("subnet21"),
+			withRoutes(netip.MustParsePrefix("192.168.1.0/24")),
+			withRoutes(netip.MustParsePrefix("2002:c000:0100::/48"))),
+		makeNode(22, withName("subnet22"),
+			withRoutes(netip.MustParsePrefix("192.168.1.0/24")),
+			withRoutes(netip.MustParsePrefix("2002:c000:0100::/48"))),
+	}
+	synctest.Test(t, func(t *testing.T) {
+		self := makeNode(99, withName("self"))
+
+		// This is the “older” report where all the peers are online
+		// that we expect to get clobbered.
+		b := newStubBackend(self, peers)
+		t.Cleanup(func() { b.Close() })
+		c, err := routecheck.NewClient(t.Context(), t.Logf, b, b, b)
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		older, err := c.Refresh(t.Context(), routecheck.DefaultTimeout)
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+
+		// This is the “newer” report where some of the peers are online.
+		// Run this one before the actual test and fake its Done time.
+		time.Sleep(1 * time.Minute)
+		b.gone = set.Of(tailcfg.NodeID(11), tailcfg.NodeID(22))
+		newer, err := c.Refresh(t.Context(), routecheck.DefaultTimeout)
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if !older.Done.Before(newer.Done) {
+			t.Errorf("newer report didn’t clobber older")
+		}
+		newer.Done = newer.Done.Add(1 * time.Hour)
+
+		// Check that newer reports don’t get clobbered
+		// by simulating a run that happened between older and newer
+		// where only one node went offline.
+		b.gone = set.Of(tailcfg.NodeID(11))
+		between, err := c.Refresh(t.Context(), routecheck.DefaultTimeout)
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if diff := cmpDiff(between, newer); diff != "" {
+			t.Errorf("newer report was clobbered, -newer +between:\n%s", diff)
+		}
+	})
+}
+
+func TestRoutersByPrefix(t *testing.T) {
+	type routersByPrefix map[netip.Prefix][]tailcfg.NodeID
+	simplify := func(rs routecheck.RoutersByPrefix) routersByPrefix {
+		out := make(routersByPrefix, len(rs))
+		for p, ns := range rs {
+			for _, n := range ns {
+				out[p] = append(out[p], n.ID())
+			}
+			slices.Sort(out[p])
+		}
+		return out
+	}
+
+	for _, tt := range []struct {
+		name  string
+		peers []tailcfg.NodeView
+		want  routersByPrefix
+	}{
+		{
+			name:  "no-peers",
+			peers: []tailcfg.NodeView{},
+			want:  routersByPrefix{},
+		},
+		{
+			name: "no-routers",
+			peers: []tailcfg.NodeView{
+				makeNode(1, withName("peer1")),
+			},
+			want: routersByPrefix{},
+		},
+		{
+			name: "one-exit-node",
+			peers: []tailcfg.NodeView{
+				makeNode(1, withName("peer1")),
+				makeNode(11, withName("exit11"), withExitRoutes()),
+			},
+			want: routersByPrefix{
+				netip.MustParsePrefix("0.0.0.0/0"): {11},
+				netip.MustParsePrefix("::/0"):      {11},
+			},
+		},
+		{
+			name: "overlapping-exit-nodes",
+			peers: []tailcfg.NodeView{
+				makeNode(1, withName("peer1")),
+				makeNode(11, withName("exit11"), withExitRoutes()),
+				makeNode(12, withName("exit12"), withExitRoutes()),
+			},
+			want: routersByPrefix{
+				netip.MustParsePrefix("0.0.0.0/0"): {11, 12},
+				netip.MustParsePrefix("::/0"):      {11, 12},
+			},
+		},
+		{
+			name: "one-subnet-router",
+			peers: []tailcfg.NodeView{
+				makeNode(1, withName("peer1")),
+				makeNode(21, withName("subnet21"),
+					withRoutes(netip.MustParsePrefix("192.168.1.0/24")),
+					withRoutes(netip.MustParsePrefix("2002:c000:0100::/48"))),
+			},
+			want: routersByPrefix{
+				netip.MustParsePrefix("192.168.1.0/24"):      {21},
+				netip.MustParsePrefix("2002:c000:0100::/48"): {21},
+			},
+		},
+		{
+			name: "overlapping-subnet-routers",
+			peers: []tailcfg.NodeView{
+				makeNode(1, withName("peer1")),
+				makeNode(21, withName("subnet21"),
+					withRoutes(netip.MustParsePrefix("192.168.1.0/24")),
+					withRoutes(netip.MustParsePrefix("2002:c000:0100::/48"))),
+				makeNode(22, withName("subnet22"),
+					withRoutes(netip.MustParsePrefix("192.168.1.0/24")),
+					withRoutes(netip.MustParsePrefix("2002:c000:0100::/48"))),
+			},
+			want: routersByPrefix{
+				netip.MustParsePrefix("192.168.1.0/24"):      {21, 22},
+				netip.MustParsePrefix("2002:c000:0100::/48"): {21, 22},
+			},
+		},
+		{
+			name: "disjoint-subnet-routers",
+			peers: []tailcfg.NodeView{
+				makeNode(1, withName("peer1")),
+				makeNode(21, withName("subnet21"),
+					withRoutes(netip.MustParsePrefix("192.168.1.0/24")),
+					withRoutes(netip.MustParsePrefix("2002:c000:0100::/48"))),
+				makeNode(22, withName("subnet22"),
+					withRoutes(netip.MustParsePrefix("192.168.2.0/24")),
+					withRoutes(netip.MustParsePrefix("2002:c000:0200::/48"))),
+			},
+			want: routersByPrefix{
+				netip.MustParsePrefix("192.168.1.0/24"):      {21},
+				netip.MustParsePrefix("2002:c000:0100::/48"): {21},
+				netip.MustParsePrefix("192.168.2.0/24"):      {22},
+				netip.MustParsePrefix("2002:c000:0200::/48"): {22},
+			},
+		},
+		{
+			name: "multiple-routes",
+			peers: []tailcfg.NodeView{
+				makeNode(1, withName("peer1")),
+				makeNode(21, withName("subnet21"),
+					withRoutes(netip.MustParsePrefix("192.168.1.0/24")),
+					withRoutes(netip.MustParsePrefix("2002:c000:0100::/48")),
+					withRoutes(netip.MustParsePrefix("192.168.2.0/24")),
+					withRoutes(netip.MustParsePrefix("2002:c000:0200::/48"))),
+				makeNode(22, withName("subnet22"),
+					withRoutes(netip.MustParsePrefix("192.168.2.0/24")),
+					withRoutes(netip.MustParsePrefix("2002:c000:0200::/48")),
+					withRoutes(netip.MustParsePrefix("192.168.3.0/24")),
+					withRoutes(netip.MustParsePrefix("2002:c000:0300::/48"))),
+				makeNode(23, withName("subnet23"),
+					withRoutes(netip.MustParsePrefix("192.168.3.0/24")),
+					withRoutes(netip.MustParsePrefix("2002:c000:0300::/48")),
+					withRoutes(netip.MustParsePrefix("192.168.4.0/24")),
+					withRoutes(netip.MustParsePrefix("2002:c000:0400::/48"))),
+			},
+			want: routersByPrefix{
+				netip.MustParsePrefix("192.168.1.0/24"):      {21},
+				netip.MustParsePrefix("2002:c000:0100::/48"): {21},
+				netip.MustParsePrefix("192.168.2.0/24"):      {21, 22},
+				netip.MustParsePrefix("2002:c000:0200::/48"): {21, 22},
+				netip.MustParsePrefix("192.168.3.0/24"):      {22, 23},
+				netip.MustParsePrefix("2002:c000:0300::/48"): {22, 23},
+				netip.MustParsePrefix("192.168.4.0/24"):      {23},
+				netip.MustParsePrefix("2002:c000:0400::/48"): {23},
+			},
+		},
+		{
+			name: "both-exit-nodes-and-routers",
+			peers: []tailcfg.NodeView{
+				makeNode(1, withName("peer1")),
+				makeNode(11, withName("exit11"), withExitRoutes()),
+				makeNode(12, withName("exit12"), withExitRoutes()),
+				makeNode(21, withName("subnet21"),
+					withRoutes(netip.MustParsePrefix("192.168.1.0/24")),
+					withRoutes(netip.MustParsePrefix("2002:c000:0100::/48")),
+					withRoutes(netip.MustParsePrefix("192.168.2.0/24")),
+					withRoutes(netip.MustParsePrefix("2002:c000:0200::/48"))),
+				makeNode(22, withName("subnet22"),
+					withRoutes(netip.MustParsePrefix("192.168.2.0/24")),
+					withRoutes(netip.MustParsePrefix("2002:c000:0200::/48")),
+					withRoutes(netip.MustParsePrefix("192.168.3.0/24")),
+					withRoutes(netip.MustParsePrefix("2002:c000:0300::/48"))),
+			},
+			want: routersByPrefix{
+				netip.MustParsePrefix("0.0.0.0/0"):           {11, 12},
+				netip.MustParsePrefix("::/0"):                {11, 12},
+				netip.MustParsePrefix("192.168.1.0/24"):      {21},
+				netip.MustParsePrefix("2002:c000:0100::/48"): {21},
+				netip.MustParsePrefix("192.168.2.0/24"):      {21, 22},
+				netip.MustParsePrefix("2002:c000:0200::/48"): {21, 22},
+				netip.MustParsePrefix("192.168.3.0/24"):      {22},
+				netip.MustParsePrefix("2002:c000:0300::/48"): {22},
+			},
+		},
+		{
+			name: "mixed-nodes",
+			peers: []tailcfg.NodeView{
+				makeNode(1, withName("peer1")),
+				makeNode(31, withName("router31"),
+					withExitRoutes(),
+					withRoutes(netip.MustParsePrefix("192.168.1.0/24")),
+					withRoutes(netip.MustParsePrefix("2002:c000:0100::/48")),
+					withRoutes(netip.MustParsePrefix("192.168.2.0/24")),
+					withRoutes(netip.MustParsePrefix("2002:c000:0200::/48"))),
+				makeNode(32, withName("router32"),
+					withExitRoutes(),
+					withRoutes(netip.MustParsePrefix("192.168.2.0/24")),
+					withRoutes(netip.MustParsePrefix("2002:c000:0200::/48")),
+					withRoutes(netip.MustParsePrefix("192.168.3.0/24")),
+					withRoutes(netip.MustParsePrefix("2002:c000:0300::/48"))),
+			},
+			want: routersByPrefix{
+				netip.MustParsePrefix("0.0.0.0/0"):           {31, 32},
+				netip.MustParsePrefix("::/0"):                {31, 32},
+				netip.MustParsePrefix("192.168.1.0/24"):      {31},
+				netip.MustParsePrefix("2002:c000:0100::/48"): {31},
+				netip.MustParsePrefix("192.168.2.0/24"):      {31, 32},
+				netip.MustParsePrefix("2002:c000:0200::/48"): {31, 32},
+				netip.MustParsePrefix("192.168.3.0/24"):      {32},
+				netip.MustParsePrefix("2002:c000:0300::/48"): {32},
+			},
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			self := makeNode(99, withName("self"))
+			b := newStubBackend(self, tt.peers)
+			t.Cleanup(func() { b.Close() })
+			c, err := routecheck.NewClient(t.Context(), t.Logf, b, b, b)
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+
+			got := simplify(c.RoutersByPrefix())
+			if !maps.EqualFunc(got, tt.want, slices.Equal) {
+				t.Errorf("got %+v, want %+v", got, tt.want)
+			}
+		})
+	}
+
+}
+
+type nodeOptFunc func(*tailcfg.Node)
+
+func makeNode(id tailcfg.NodeID, opts ...nodeOptFunc) tailcfg.NodeView {
+	addresses := []netip.Prefix{
+		netip.MustParsePrefix(fmt.Sprintf("192.168.0.%d/32", id)),
+		netip.MustParsePrefix(fmt.Sprintf("fd7a:115c:a1e0::%d/128", id)),
+	}
+	node := &tailcfg.Node{
+		ID:                id,
+		StableID:          tailcfg.StableNodeID(fmt.Sprintf("stable%d", id)),
+		Name:              fmt.Sprintf("node%d", id),
+		Online:            new(true),
+		MachineAuthorized: true,
+		HomeDERP:          int(id),
+		Addresses:         addresses,
+		AllowedIPs:        addresses,
+	}
+	for _, opt := range opts {
+		opt(node)
+	}
+	return node.View()
+}
+
+func withExitRoutes() nodeOptFunc {
+	return withRoutes(tsaddr.ExitRoutes()...)
+}
+
+func withName(name string) nodeOptFunc {
+	return func(n *tailcfg.Node) {
+		n.Name = name
+	}
+}
+
+func withRoutes(routes ...netip.Prefix) nodeOptFunc {
+	return func(n *tailcfg.Node) {
+		n.AllowedIPs = append(n.AllowedIPs, routes...)
+	}
+}
+
+var _ routecheck.NodeBackender = &stubBackend{}
+var _ routecheck.NodeBackend = &stubBackend{}
+var _ routecheck.NetMapper = &stubBackend{}
+var _ routecheck.Pinger = &stubBackend{}
+
+type stubBackend struct {
+	self  tailcfg.NodeView
+	peers []tailcfg.NodeView
+	gone  set.Set[tailcfg.NodeID]
+
+	delay  context.Context
+	cancel context.CancelFunc
+
+	donef atomic.Pointer[func()]
+}
+
+type backendOptFunc func(*stubBackend)
+
+func newStubBackend(self tailcfg.NodeView, peers []tailcfg.NodeView, opts ...backendOptFunc) *stubBackend {
+	if !self.Valid() {
+		panic("invalid self")
+	}
+
+	delay, cancel := context.WithTimeout(context.Background(), 0) // No delay
+	b := &stubBackend{
+		self:   self,
+		peers:  slices.Clone(peers),
+		delay:  delay,
+		cancel: cancel,
+	}
+	for _, opt := range opts {
+		opt(b)
+	}
+	return b
+}
+
+func (b *stubBackend) Close() error {
+	if b.cancel != nil {
+		b.cancel()
+	}
+	return nil
+}
+
+func (b *stubBackend) NetMapNoPeers() *netmap.NetworkMap {
+	if b.delay.Err() == nil {
+		// Simulate the delay between startup and receiving the NetMap.
+		return nil
+	}
+	return &netmap.NetworkMap{
+		SelfNode: b.self,
+		Peers:    nil, // No peers.
+	}
+}
+
+func (b *stubBackend) NetMapWithPeers() *netmap.NetworkMap {
+	nm := b.NetMapNoPeers()
+	if nm != nil {
+		nm.Peers = b.peers
+	}
+	return nm
+}
+
+func (nb *stubBackend) NodeBackend() routecheck.NodeBackend {
+	return nb
+}
+
+func (nb *stubBackend) Self() tailcfg.NodeView {
+	return nb.self
+}
+
+func (nb *stubBackend) Peers() []tailcfg.NodeView {
+	return nb.peers
+}
+
+func (b *stubBackend) Ping(ip netip.Addr, pingType tailcfg.PingType, size int, cb func(*ipnstate.PingResult)) {
+	// Does the IP address match one of the peers’ addresses?
+	for _, n := range b.peers {
+		for _, a := range n.Addresses().All() {
+			if a.Addr() != ip {
+				continue
+			}
+
+			if b.gone.Contains(n.ID()) {
+				continue
+			}
+
+			go cb(&ipnstate.PingResult{
+				IP:             ip.String(),
+				NodeIP:         ip.String(),
+				NodeName:       n.Name(),
+				LatencySeconds: 0.01,
+			})
+		}
+	}
+}
+
+func withDelay(t *testing.T, d time.Duration) backendOptFunc {
+	return func(b *stubBackend) {
+		t.Helper()
+		var stopf func() bool
+		ctx, cancel := context.WithTimeout(t.Context(), d)
+		stopf = context.AfterFunc(ctx, func() {
+			if donef := b.donef.Load(); donef != nil {
+				(*donef)()
+			}
+			cancel()
+			stopf()
+		})
+		b.delay = ctx
+	}
+}
+
+func withGone(t *testing.T, gone ...tailcfg.NodeID) backendOptFunc {
+	return func(b *stubBackend) {
+		t.Helper()
+		b.gone = set.SetOf(gone)
+	}
+
+}
diff --git a/net/routecheck/routes.go b/net/routecheck/routes.go
new file mode 100644
index 000000000..af9f4b5f3
--- /dev/null
+++ b/net/routecheck/routes.go
@@ -0,0 +1,56 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package routecheck
+
+import (
+	"net/netip"
+
+	"tailscale.com/tailcfg"
+	"tailscale.com/types/views"
+	"tailscale.com/util/mak"
+)
+
+// RoutersByPrefix represents a map of nodes grouped by the subnet that they route.
+// Nodes that route for /0 prefixes are exit nodes, their subnet is the Internet.
+// The result omits any prefix that is one of a node’s local addresses.
+//
+// Note: Fallback routes are not supported by design. If a subnet prefix
+// contained within another more general prefix has no reachable routers,
+// traffic is still sent to one of those unreachable routers.
+// Routers for the general prefix aren’t candidates. See tailscale/tailscale#18550.
+type RoutersByPrefix map[netip.Prefix][]tailcfg.NodeView
+
+// RoutersByPrefix returns a map of nodes grouped by the subnet that they route.
+// See [RoutersByPrefix] for more detail.
+func (c *Client) RoutersByPrefix() RoutersByPrefix {
+	return GroupRoutersByPrefix(c.nb.NodeBackend().Peers())
+}
+
+// GroupRoutersByPrefix returns a map of nodes grouped by the subnet that they route.
+// See [RoutersByPrefix] for more detail.
+func GroupRoutersByPrefix(nodes []tailcfg.NodeView) RoutersByPrefix {
+	var routers RoutersByPrefix
+	for _, n := range nodes {
+		for _, pfx := range routes(n) {
+			mak.Set(&routers, pfx, append(routers[pfx], n))
+		}
+	}
+	return routers
+}
+
+// Routes returns a slice of subnets that the given node will route.
+// If the node is an exit node, the result will contain at least one /0 prefix.
+// If the node is a subnet router, the result will contain a smaller prefix.
+// The result omits any prefix that is one of the node’s local addresses.
+func routes(n tailcfg.NodeView) []netip.Prefix {
+	var routes []netip.Prefix
+	for _, pfx := range n.AllowedIPs().All() {
+		// Routers never forward their own local addresses.
+		if views.SliceContains(n.Addresses(), pfx) {
+			continue
+		}
+		routes = append(routes, pfx)
+	}
+	return routes
+}
diff --git a/net/routemanager/fortest.go b/net/routemanager/fortest.go
new file mode 100644
index 000000000..079c78ff6
--- /dev/null
+++ b/net/routemanager/fortest.go
@@ -0,0 +1,23 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package routemanager
+
+import "tailscale.com/util/testenv"
+
+// forTest is an unexported type to hide the test-only methods on
+// [RouteManager] from godoc.
+type forTest struct{ rm *RouteManager }
+
+// ForTest returns a handle to test-only methods on rm. The resulting
+// type is unexported to make it very obvious in godoc that this is
+// not stable API. This method panics if called outside of tests,
+// which also centralizes all must-be-in-tests validation.
+func (rm *RouteManager) ForTest() forTest {
+	testenv.AssertInTest()
+	return forTest{rm}
+}
+
+// PeerCount returns the number of peers currently tracked. Callers
+// must serialize it with mutations like any other write-path access.
+func (f forTest) PeerCount() int { return len(f.rm.peers) }
diff --git a/net/routemanager/routemanager.go b/net/routemanager/routemanager.go
new file mode 100644
index 000000000..b7afe741b
--- /dev/null
+++ b/net/routemanager/routemanager.go
@@ -0,0 +1,1045 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package routemanager tracks which peers own which IP prefixes and
+// incrementally derives the routing data structures used by the rest
+// of the system: a table mapping destination IP to the outbound peer,
+// and the set of routes to program into the operating system's
+// routing table.
+//
+// Updates are transactional: callers open a [Mutation] with
+// [RouteManager.Begin], stage operations, and call [Mutation.Commit]
+// to publish new snapshots. The published snapshots are immutable
+// bart tables that share memory with their predecessors, so readers
+// (notably the wireguard-go data plane) can hold and read them
+// without locks. At most one [Mutation] may be active at a time,
+// and the caller is responsible for synchronizing them.
+package routemanager
+
+import (
+	"net/netip"
+	"slices"
+	"sync"
+	"sync/atomic"
+
+	"github.com/gaissmai/bart"
+	"tailscale.com/net/tsaddr"
+	"tailscale.com/tailcfg"
+	"tailscale.com/types/key"
+	"tailscale.com/types/logger"
+	"tailscale.com/types/views"
+	"tailscale.com/util/mak"
+	"tailscale.com/util/set"
+)
+
+// peerView is the subset of a peer's netmap state that affects
+// routing. It is intentionally much narrower than tailcfg.NodeView so
+// the RouteManager can be driven and tested without full netmap
+// nodes; UpsertPeer converts from tailcfg.NodeView.
+type peerView struct {
+	// ID is the peer's node ID. It is the peer's identity within
+	// the RouteManager.
+	ID tailcfg.NodeID
+
+	// Key is the peer's WireGuard public key. It is what gets
+	// published into the data-path tables, so per-packet readers
+	// need no NodeID-to-key translation.
+	Key key.NodePublic
+
+	// Jailed is whether the peer is restricted from initiating
+	// connections to this node, in which case the data plane
+	// applies its more restrictive jailed packet filter to the
+	// peer's traffic.
+	Jailed bool
+
+	// MasqAddr4 and MasqAddr6 are the addresses the peer knows
+	// this node as, per address family, if they differ from this
+	// node's native addresses. The data plane masquerades (NATs)
+	// traffic to and from the peer accordingly. An invalid address
+	// means no masquerading for that family.
+	MasqAddr4, MasqAddr6 netip.Addr
+
+	// SelfAddrs are the peer's own addresses (its CGNAT IPv4 /32,
+	// if any, and its Tailscale ULA IPv6 /128) plus any other
+	// single Tailscale IPs it routes for, such as VIP service
+	// addresses. They are routable regardless of Prefs.RouteAll.
+	SelfAddrs []netip.Prefix
+
+	// Routes are the peer's advertised routes: subnet routes and,
+	// for exit-node candidates, the 0.0.0.0/0 and ::/0 exit routes.
+	Routes []netip.Prefix
+}
+
+// PeerRoute is the payload of the outbound table: the attributes the
+// data plane needs when handling a packet to or from one of the
+// peer's prefixes. All prefixes contributed by a peer share a single
+// interned *PeerRoute, and a new one is allocated whenever the
+// attributes change, so published snapshots stay immutable and
+// pointer identity doubles as a change check.
+type PeerRoute struct {
+	// Key is the peer's WireGuard public key.
+	Key key.NodePublic
+
+	// Jailed, MasqAddr4, and MasqAddr6 mirror the fields of the
+	// same names in peerView.
+	Jailed               bool
+	MasqAddr4, MasqAddr6 netip.Addr
+}
+
+// routeAttrs returns the peer's attributes as published in the
+// outbound table.
+func (p peerView) routeAttrs() PeerRoute {
+	return PeerRoute{
+		Key:       p.Key,
+		Jailed:    p.Jailed,
+		MasqAddr4: p.MasqAddr4,
+		MasqAddr6: p.MasqAddr6,
+	}
+}
+
+// hasDataPlaneAttrs reports whether the peer has any attributes that
+// require per-packet attention from the tun-layer data plane.
+func (p peerView) hasDataPlaneAttrs() bool {
+	return p.Jailed || p.MasqAddr4.IsValid() || p.MasqAddr6.IsValid()
+}
+
+// Prefs is the subset of ipn.Prefs that affects routing.
+type Prefs struct {
+	// ExitNodeID is the node ID of the peer selected as this
+	// node's exit node, or zero if no exit node is selected or the
+	// selected exit node does not resolve to a current peer.
+	// (Callers resolve ipn.Prefs's stable node ID to a NodeID.)
+	ExitNodeID tailcfg.NodeID
+
+	// ExitNodeSelected is whether the prefs select any exit node at
+	// all, even one that doesn't resolve to a current peer (in which
+	// case ExitNodeID is zero). When set, the exit routes are always
+	// in the OS route set: with a resolved exit node they carry its
+	// traffic, and without one they blackhole internet traffic
+	// rather than let it escape to the local network, per the
+	// [tailscale.com/ipn.Prefs.ExitNodeID] docs. MDM's "auto:any"
+	// placeholder relies on the blackhole while an exit node is
+	// still being chosen.
+	ExitNodeSelected bool
+
+	// RouteAll is whether advertised subnet routes (non-exit
+	// routes) from peers are accepted.
+	RouteAll bool
+}
+
+// TailnetConfig is tailnet-global and environment-derived
+// configuration that affects routing.
+type TailnetConfig struct {
+	// DisableIPv4 is whether the tailnet has disabled IPv4 self
+	// addresses. If set, peers' IPv4 self addresses are ignored.
+	DisableIPv4 bool
+
+	// OneCGNAT is whether the OS route set should collapse peers'
+	// CGNAT IPv4 self addresses into the single CGNAT /10 route
+	// rather than per-peer /32s. The decision is made by the
+	// caller (it depends on platform and interface state); the
+	// RouteManager just applies it.
+	OneCGNAT bool
+}
+
+// cgnatThreshold is the number of distinct CGNAT self-address routes
+// above which the OS route set collapses them into the single CGNAT
+// /10, even without TailnetConfig.OneCGNAT.
+const cgnatThreshold = 10_000
+
+// contribKind is a bit vector that describes how a peer contributes a
+// prefix: as one of its own addresses, as an advertised route, or
+// both.
+type contribKind uint8
+
+const (
+	kindSelf contribKind = 1 << iota
+	kindRoute
+
+	// kindExtra marks a prefix from the extra allowed IPs set via
+	// [Mutation.SetExtraAllowedIPs]. Extra prefixes appear in the
+	// outbound table and in [RouteManager.PeerAllowedIPs], but
+	// never in the OS route set.
+	kindExtra
+)
+
+// scoreKey identifies a per-(node, prefix) score.
+type scoreKey struct {
+	id  tailcfg.NodeID
+	pfx netip.Prefix
+}
+
+// RouteManager tracks peers' addresses and advertised routes and
+// derives the routing snapshots.
+//
+// The snapshot accessors (Outbound, OSRoutes) may be called
+// concurrently from any goroutine. Mutations must be serialized by
+// the caller: Begin, then stage operations, then Commit (or Discard),
+// before the next Begin. Commit panics if it detects overlapping
+// mutations.
+type RouteManager struct {
+	logf  logger.Logf
+	txGen atomic.Uint64
+
+	outbound atomic.Pointer[bart.Table[*PeerRoute]]
+	osRoutes atomic.Pointer[bart.Lite]
+
+	// attrPeers counts the current peers with data-plane attributes
+	// (jailed or masquerade addresses). It backs
+	// [RouteManager.HasDataPlaneAttrs].
+	attrPeers atomic.Int64
+
+	// mu guards the working state below. Commit holds it while
+	// applying staged operations and PeerAllowedIPs holds it while
+	// reading, so reads cannot race a concurrent Commit. Mutations
+	// are additionally serialized by callers (see Begin).
+	mu sync.Mutex
+
+	peers    map[tailcfg.NodeID]peerView
+	routes   map[tailcfg.NodeID]*PeerRoute
+	byPrefix map[netip.Prefix]map[tailcfg.NodeID]contribKind
+	scores   map[scoreKey]int
+	extras   map[tailcfg.NodeID][]netip.Prefix
+	prefs    Prefs
+	cfg      TailnetConfig
+
+	// cgnatPfxs and ulaPfxs are the prefixes currently eligible
+	// for the OS route set that are single CGNAT IPv4 addresses or
+	// single Tailscale ULA IPv6 addresses, respectively. They feed
+	// the coarse-route decisions.
+	cgnatPfxs set.Set[netip.Prefix]
+	ulaPfxs   set.Set[netip.Prefix]
+
+	// coarseCGNAT is whether the OS route set currently contains
+	// the single CGNAT /10 instead of per-peer /32s.
+	coarseCGNAT bool
+}
+
+// New returns a new RouteManager with empty snapshots.
+func New(logf logger.Logf) *RouteManager {
+	if logf == nil {
+		logf = logger.Discard
+	}
+	rm := &RouteManager{
+		logf:      logf,
+		peers:     make(map[tailcfg.NodeID]peerView),
+		routes:    make(map[tailcfg.NodeID]*PeerRoute),
+		byPrefix:  make(map[netip.Prefix]map[tailcfg.NodeID]contribKind),
+		scores:    make(map[scoreKey]int),
+		cgnatPfxs: make(set.Set[netip.Prefix]),
+		ulaPfxs:   make(set.Set[netip.Prefix]),
+	}
+	rm.outbound.Store(&bart.Table[*PeerRoute]{})
+	rm.osRoutes.Store(&bart.Lite{})
+	return rm
+}
+
+// Outbound returns the current destination-IP-to-peer table. The
+// returned table and the PeerRoutes it points to are immutable;
+// callers must not modify them.
+func (rm *RouteManager) Outbound() *bart.Table[*PeerRoute] {
+	return rm.outbound.Load()
+}
+
+// OSRoutes returns the current set of prefixes to program into the
+// OS routing table. The returned table is immutable; callers must not
+// modify it.
+func (rm *RouteManager) OSRoutes() *bart.Lite {
+	return rm.osRoutes.Load()
+}
+
+// HasDataPlaneAttrs reports whether any current peer has data-plane
+// attributes (jailed or masquerade addresses), that is, whether the
+// tun-layer data plane needs the outbound table for per-packet NAT
+// rewrites and jailed-filter selection. When it reports false, the
+// data plane can skip those per-packet lookups entirely.
+func (rm *RouteManager) HasDataPlaneAttrs() bool {
+	return rm.attrPeers.Load() > 0
+}
+
+// PeerAllowedIPs returns the prefixes from which the given peer is
+// currently allowed to originate traffic: its self addresses, its
+// advertised subnet routes when Prefs.RouteAll is set, the exit
+// routes when it is the selected exit node, and its extra allowed
+// IPs (see [Mutation.SetExtraAllowedIPs]). It returns ok=false if
+// the peer is unknown or currently contributes no prefixes; such a
+// peer should not exist in the WireGuard device at all.
+//
+// The result is sorted, so identical routing state yields identical
+// slices (letting callers cheaply detect no-op updates).
+//
+// Unlike the snapshot accessors, PeerAllowedIPs reads the working
+// state. An internal mutex makes it safe to call concurrently with
+// Commit.
+func (rm *RouteManager) PeerAllowedIPs(id tailcfg.NodeID) (pfxs []netip.Prefix, ok bool) {
+	rm.mu.Lock()
+	defer rm.mu.Unlock()
+	return rm.peerAllowedIPsLocked(id)
+}
+
+// peerAllowedIPsLocked implements [RouteManager.PeerAllowedIPs].
+// rm.mu must be held.
+func (rm *RouteManager) peerAllowedIPsLocked(id tailcfg.NodeID) (pfxs []netip.Prefix, ok bool) {
+	p, ok := rm.peers[id]
+	if !ok {
+		return nil, false
+	}
+	for pfx, kind := range rm.contribs(p) {
+		if rm.eligible(id, pfx, kind) {
+			pfxs = append(pfxs, pfx)
+		}
+	}
+	if len(pfxs) == 0 {
+		return nil, false
+	}
+	tsaddr.SortPrefixes(pfxs)
+	return pfxs, true
+}
+
+// Result describes what a Commit changed.
+type Result struct {
+	// PeersUpserted is the number of UpsertPeer operations applied.
+	PeersUpserted int
+	// PeersRemoved is the number of RemovePeer operations that
+	// removed a known peer.
+	PeersRemoved int
+	// ScoresChanged is the number of SetScore operations that
+	// changed a stored score.
+	ScoresChanged int
+	// ExtrasChanged is whether the commit changed the extra
+	// allowed IPs.
+	ExtrasChanged bool
+	// PrefsChanged is whether the commit changed the prefs.
+	PrefsChanged bool
+	// TailnetCfgChanged is whether the commit changed the tailnet config.
+	TailnetCfgChanged bool
+
+	// OutboundChanged and OSRoutesChanged report whether each
+	// output snapshot actually changed contents.
+	OutboundChanged bool
+	OSRoutesChanged bool
+
+	// Outbound and OSRoutes are the fresh snapshot pointers, or
+	// nil for any that didn't change.
+	Outbound *bart.Table[*PeerRoute]
+	OSRoutes *bart.Lite
+
+	// AllowedIPs describes the peers whose allowed source prefixes
+	// changed in this commit. The map is nil when no peer's allowed
+	// prefixes changed.
+	AllowedIPs PeersWithRouteChanges
+}
+
+// PeersWithRouteChanges maps the public key of each peer whose
+// allowed source prefixes changed to its new sorted prefix list, as
+// [RouteManager.PeerAllowedIPs] would now return it.
+//
+// A nil value means the peer no longer has any allowed prefixes,
+// because it was removed or now contributes nothing; consumers
+// should treat such peers as deleted. When a peer's key changes, the
+// old key maps to nil and the new key to the peer's prefixes.
+type PeersWithRouteChanges map[key.NodePublic][]netip.Prefix
+
+type opKind uint8
+
+const (
+	opUpsert opKind = iota
+	opRemove
+	opPrefs
+	opConfig
+	opScore
+	opExtras
+)
+
+type stagedOp struct {
+	kind   opKind
+	peer   peerView                          // for opUpsert
+	id     tailcfg.NodeID                    // for opRemove, opScore
+	pfx    netip.Prefix                      // for opScore
+	score  int                               // for opScore
+	prefs  Prefs                             // for opPrefs
+	cfg    TailnetConfig                     // for opConfig
+	extras map[tailcfg.NodeID][]netip.Prefix // for opExtras
+}
+
+// Mutation is an open transaction against a RouteManager. Operations
+// are staged in order and applied atomically by Commit. A Mutation
+// must not be used after Commit or Discard.
+type Mutation struct {
+	rm   *RouteManager
+	gen  uint64
+	done bool
+	ops  []stagedOp
+}
+
+// Begin starts a mutation. Callers must serialize Begin/Commit pairs;
+// overlapping mutations cause Commit to panic.
+func (rm *RouteManager) Begin() *Mutation {
+	return &Mutation{rm: rm, gen: rm.txGen.Load()}
+}
+
+func (m *Mutation) checkOpen() {
+	if m.done {
+		panic("routemanager: use of finished Mutation")
+	}
+}
+
+// UpsertPeer stages an add or update of a peer. The peer's prefixes
+// come solely from n.AllowedIPs: entries that are single Tailscale
+// IPs (the peer's own addresses, or VIP service addresses it hosts)
+// or that appear in n.Addresses count as self addresses and are
+// always routable; the rest are treated as its advertised routes
+// (subnet routes and, for exit-node candidates, the /0 exit routes).
+func (m *Mutation) UpsertPeer(n tailcfg.NodeView) {
+	m.upsertPeer(peerViewOf(n))
+}
+
+// peerViewOf reduces a tailcfg.NodeView to the routing-relevant
+// peerView.
+//
+// Peers we cannot communicate with (expired, or predating both DERP
+// and disco) contribute no prefixes. They remain tracked by ID and key
+// so that a later update can make them routable again. AllowedIPs is
+// the sole source of prefixes; an address absent from AllowedIPs is
+// not routable. For the self-vs-route split,
+// single Tailscale IPs are never subnets, so a VIP service address
+// hosted by the peer lands in SelfAddrs and stays routable without
+// Prefs.RouteAll.
+func peerViewOf(n tailcfg.NodeView) peerView {
+	pv := peerView{
+		ID:        n.ID(),
+		Key:       n.Key(),
+		Jailed:    n.IsJailed(),
+		MasqAddr4: n.SelfNodeV4MasqAddrForThisPeer().Get(),
+		MasqAddr6: n.SelfNodeV6MasqAddrForThisPeer().Get(),
+	}
+	if n.Expired() {
+		return pv
+	}
+	if n.DiscoKey().IsZero() && n.HomeDERP() == 0 && !n.IsWireGuardOnly() {
+		return pv
+	}
+	for _, aip := range n.AllowedIPs().All() {
+		isSelf := aip.IsSingleIP() && tsaddr.IsTailscaleIP(aip.Addr()) ||
+			views.SliceContains(n.Addresses(), aip)
+		if isSelf {
+			pv.SelfAddrs = append(pv.SelfAddrs, aip)
+		} else {
+			pv.Routes = append(pv.Routes, aip)
+		}
+	}
+	return pv
+}
+
+// upsertPeer stages an add or update of a peer from an
+// already-reduced view.
+func (m *Mutation) upsertPeer(p peerView) {
+	m.checkOpen()
+	m.ops = append(m.ops, stagedOp{kind: opUpsert, peer: p})
+}
+
+// RemovePeer stages the removal of a peer.
+func (m *Mutation) RemovePeer(id tailcfg.NodeID) {
+	m.checkOpen()
+	m.ops = append(m.ops, stagedOp{kind: opRemove, id: id})
+}
+
+// SetPrefs stages a prefs update.
+func (m *Mutation) SetPrefs(p Prefs) {
+	m.checkOpen()
+	m.ops = append(m.ops, stagedOp{kind: opPrefs, prefs: p})
+}
+
+// SetTailnetConfig stages a tailnet config update.
+func (m *Mutation) SetTailnetConfig(c TailnetConfig) {
+	m.checkOpen()
+	m.ops = append(m.ops, stagedOp{kind: opConfig, cfg: c})
+}
+
+// SetScore stages a score update for the given peer and prefix.
+// Scores are used to pick the outbound peer when multiple peers
+// advertise the same prefix: highest score wins, with ties broken in
+// a consistent manner. The default score is zero. Scores for a peer
+// are dropped when the peer is removed.
+//
+// The plan is for feature/routecheck to do the route probing
+// (reachability, latency, whatnot) and tweak the scores in some way,
+// with details TBD. And as of 2026-07-10, the server never sends two
+// nodes with the same AllowedIP CIDR anyway. But that will be
+// changing and this code is preparing for that, letting the client
+// make the decision about which of multiple peer candidates to use
+// for a given route.
+func (m *Mutation) SetScore(id tailcfg.NodeID, pfx netip.Prefix, score int) {
+	m.checkOpen()
+	m.ops = append(m.ops, stagedOp{kind: opScore, id: id, pfx: normalizePrefix(pfx), score: score})
+}
+
+// SetExtraAllowedIPs stages a wholesale replacement of the extra
+// allowed IPs: additional prefixes, keyed by node ID, that each peer
+// may originate traffic from and that outbound traffic to should be
+// sent to that peer. Extra prefixes appear in the outbound table and
+// in [RouteManager.PeerAllowedIPs], but never in the OS route set.
+// (In Tailscale they carry the conn25 extension's Transit IPs, which
+// must reach WireGuard but not the OS routing table.)
+//
+// An entry for an unknown node ID is retained and takes effect if a
+// peer with that ID is later upserted. Entries are dropped only by a
+// later SetExtraAllowedIPs that omits them, not by peer removal.
+//
+// The caller must not mutate extras or its values after the call, and
+// each prefix list must be in a stable order across calls so that
+// unchanged entries are detected as no-ops.
+func (m *Mutation) SetExtraAllowedIPs(extras map[tailcfg.NodeID][]netip.Prefix) {
+	m.checkOpen()
+	m.ops = append(m.ops, stagedOp{kind: opExtras, extras: extras})
+}
+
+// Discard abandons the mutation without applying any staged
+// operations.
+func (m *Mutation) Discard() {
+	m.checkOpen()
+	m.done = true
+	m.ops = nil
+}
+
+// Commit applies the staged operations, publishes any changed
+// snapshots, and reports what changed.
+//
+// Commit panics if this Mutation overlapped another Begin/Commit,
+// which indicates a caller bug: callers are required to serialize
+// mutations.
+func (m *Mutation) Commit() Result {
+	m.checkOpen()
+	m.done = true
+	rm := m.rm
+	if !rm.txGen.CompareAndSwap(m.gen, m.gen+1) {
+		panic("routemanager: concurrent Begin/Commit detected: caller must serialize mutations")
+	}
+	rm.mu.Lock()
+	defer rm.mu.Unlock()
+
+	if len(m.ops) == 0 {
+		// Nothing was staged, so nothing can have changed; return
+		// before allocating any of the diff-tracking state below.
+		return Result{}
+	}
+
+	var res Result
+	dirty := make(set.Set[netip.Prefix])
+	fullRebuild := false
+
+	// before records each affected peer's key and allowed prefixes
+	// as of the start of the commit, so Result.AllowedIPs can be
+	// computed by comparison afterwards. Each peer is snapshotted
+	// the first time an op touches it (or on the first prefs or
+	// config change, which can affect every peer), which is always
+	// before any of its state has been mutated.
+	type peerBefore struct {
+		key     key.NodePublic
+		pfxs    []netip.Prefix // nil if the peer had no allowed prefixes
+		existed bool
+	}
+	var before map[tailcfg.NodeID]peerBefore
+	snapshot := func(id tailcfg.NodeID) {
+		if _, ok := before[id]; ok {
+			return
+		}
+		var pb peerBefore
+		if p, ok := rm.peers[id]; ok {
+			pb.existed = true
+			pb.key = p.Key
+			pb.pfxs, _ = rm.peerAllowedIPsLocked(id)
+		}
+		mak.Set(&before, id, pb)
+	}
+	// TODO(bradfitz): snapshotting all peers on any prefs or tailnet
+	// config change is a temporary lazy hack that makes those commits
+	// O(all peers). Each such change only affects a knowable subset:
+	// an exit node change affects only the old and new exit node, and
+	// a RouteAll change affects only the peers currently contributing
+	// non-self routes, which we could track incrementally. We
+	// shouldn't need O(all peers) work here except once at startup.
+	snapshotAll := func() {
+		for id := range rm.peers {
+			snapshot(id)
+		}
+	}
+
+	for _, op := range m.ops {
+		switch op.kind {
+		case opUpsert:
+			snapshot(op.peer.ID)
+			rm.applyUpsert(op.peer, dirty)
+			res.PeersUpserted++
+		case opRemove:
+			snapshot(op.id)
+			if rm.applyRemove(op.id, dirty) {
+				res.PeersRemoved++
+			}
+		case opPrefs:
+			if rm.prefs != op.prefs {
+				snapshotAll()
+				rm.prefs = op.prefs
+				res.PrefsChanged = true
+				fullRebuild = true
+			}
+		case opConfig:
+			if rm.cfg != op.cfg {
+				snapshotAll()
+				rm.cfg = op.cfg
+				res.TailnetCfgChanged = true
+				fullRebuild = true
+			}
+		case opScore:
+			sk := scoreKey{op.id, op.pfx}
+			old, had := rm.scores[sk]
+			if op.score == 0 {
+				if had {
+					delete(rm.scores, sk)
+					res.ScoresChanged++
+					dirty.Add(op.pfx)
+				}
+			} else if !had || old != op.score {
+				rm.scores[sk] = op.score
+				res.ScoresChanged++
+				dirty.Add(op.pfx)
+			}
+		case opExtras:
+			for id := range rm.extras {
+				snapshot(id)
+			}
+			for id := range op.extras {
+				snapshot(id)
+			}
+			if rm.applyExtras(op.extras, dirty) {
+				res.ExtrasChanged = true
+			}
+		}
+	}
+
+	if fullRebuild {
+		rm.rebuildAll(&res)
+	} else if len(dirty) > 0 {
+		rm.applyDirty(dirty, &res)
+	}
+
+	// Diff each snapshotted peer's allowed prefixes against the
+	// final working state to populate Result.AllowedIPs. Both
+	// sides are sorted, so slices.Equal detects no-ops.
+	for id, was := range before {
+		now, _ := rm.peerAllowedIPsLocked(id)
+		p, exists := rm.peers[id]
+		switch {
+		case !exists:
+			if was.pfxs != nil {
+				mak.Set(&res.AllowedIPs, was.key, nil) // nil signals deletion; see Result.AllowedIPs
+			}
+		case was.existed && was.key != p.Key:
+			if was.pfxs != nil {
+				mak.Set(&res.AllowedIPs, was.key, nil) // nil signals deletion; see Result.AllowedIPs
+			}
+			if now != nil {
+				mak.Set(&res.AllowedIPs, p.Key, now)
+			}
+		default:
+			if !slices.Equal(was.pfxs, now) {
+				mak.Set(&res.AllowedIPs, p.Key, now)
+			}
+		}
+	}
+	return res
+}
+
+// normalizePrefix unmaps a 4-in-6 prefix address and masks off any
+// non-address bits.
+func normalizePrefix(p netip.Prefix) netip.Prefix {
+	return netip.PrefixFrom(p.Addr().Unmap(), p.Bits()).Masked()
+}
+
+// contribs returns the normalized per-prefix contributions of p,
+// skipping (with a log message) any prefix that arrives with
+// non-address bits set, mirroring the defensive check in
+// ipnlocal.peerRoutes. It includes the peer's extra allowed IPs,
+// except for peers that contribute no addresses or routes of their
+// own (expired or otherwise non-communicable peers).
+func (rm *RouteManager) contribs(p peerView) map[netip.Prefix]contribKind {
+	c := make(map[netip.Prefix]contribKind, len(p.SelfAddrs)+len(p.Routes))
+	add := func(pfx netip.Prefix, kind contribKind) {
+		pfx = netip.PrefixFrom(pfx.Addr().Unmap(), pfx.Bits())
+		if mm := pfx.Masked(); pfx != mm {
+			rm.logf("routemanager: prefix %s from %s has non-address bits set; expected %s; skipping", pfx, p.Key.ShortString(), mm)
+			return
+		}
+		c[pfx] |= kind
+	}
+	for _, pfx := range p.SelfAddrs {
+		add(pfx, kindSelf)
+	}
+	for _, pfx := range p.Routes {
+		add(pfx, kindRoute)
+	}
+	if len(c) > 0 {
+		for _, pfx := range rm.extras[p.ID] {
+			add(pfx, kindExtra)
+		}
+	}
+	return c
+}
+
+// applyExtras replaces the extra allowed IPs with newExtras, updating
+// working state and dirty for every peer whose extras changed. It
+// reports whether anything changed.
+func (rm *RouteManager) applyExtras(newExtras map[tailcfg.NodeID][]netip.Prefix, dirty set.Set[netip.Prefix]) (changed bool) {
+	apply := func(id tailcfg.NodeID, pfxs []netip.Prefix) {
+		if slices.Equal(rm.extras[id], pfxs) {
+			return
+		}
+		changed = true
+		p, exists := rm.peers[id]
+		if !exists {
+			rm.updateExtras(id, pfxs)
+			return
+		}
+		oldC := rm.contribs(p)
+		rm.updateExtras(id, pfxs)
+		newC := rm.contribs(p)
+		for pfx, kind := range oldC {
+			if newC[pfx] != kind {
+				rm.dropContrib(id, pfx)
+				dirty.Add(pfx)
+			}
+		}
+		for pfx, kind := range newC {
+			if oldC[pfx] != kind {
+				rm.addContrib(id, pfx, kind)
+				dirty.Add(pfx)
+			}
+		}
+	}
+	for id := range rm.extras {
+		if _, ok := newExtras[id]; !ok {
+			apply(id, nil)
+		}
+	}
+	for id, pfxs := range newExtras {
+		apply(id, pfxs)
+	}
+	return changed
+}
+
+// updateExtras stores or deletes the extras entry for id.
+func (rm *RouteManager) updateExtras(id tailcfg.NodeID, pfxs []netip.Prefix) {
+	if len(pfxs) == 0 {
+		delete(rm.extras, id)
+	} else {
+		mak.Set(&rm.extras, id, pfxs)
+	}
+}
+
+// applyUpsert updates working state for an upserted peer, adding any
+// affected prefixes to dirty.
+func (rm *RouteManager) applyUpsert(p peerView, dirty set.Set[netip.Prefix]) {
+	newC := rm.contribs(p)
+	old, had := rm.peers[p.ID]
+	attrsChanged := had && old.routeAttrs() != p.routeAttrs()
+	if !had || attrsChanged {
+		// Intern a fresh PeerRoute rather than mutating the old
+		// one, which published snapshots may still reference.
+		rm.routes[p.ID] = new(p.routeAttrs())
+	}
+	if had && old.hasDataPlaneAttrs() {
+		rm.attrPeers.Add(-1)
+	}
+	if p.hasDataPlaneAttrs() {
+		rm.attrPeers.Add(1)
+	}
+	if had {
+		oldC := rm.contribs(old)
+		for pfx, kind := range oldC {
+			if newC[pfx] != kind {
+				rm.dropContrib(p.ID, pfx)
+				dirty.Add(pfx)
+			} else if attrsChanged {
+				dirty.Add(pfx)
+			}
+		}
+		for pfx, kind := range newC {
+			if oldC[pfx] != kind {
+				rm.addContrib(p.ID, pfx, kind)
+				dirty.Add(pfx)
+			}
+		}
+	} else {
+		for pfx, kind := range newC {
+			rm.addContrib(p.ID, pfx, kind)
+			dirty.Add(pfx)
+		}
+	}
+	rm.peers[p.ID] = p
+}
+
+// applyRemove updates working state for a removed peer, adding its
+// prefixes to dirty. It reports whether the peer was known.
+func (rm *RouteManager) applyRemove(id tailcfg.NodeID, dirty set.Set[netip.Prefix]) bool {
+	old, had := rm.peers[id]
+	if !had {
+		return false
+	}
+	for pfx := range rm.contribs(old) {
+		rm.dropContrib(id, pfx)
+		dirty.Add(pfx)
+	}
+	delete(rm.peers, id)
+	delete(rm.routes, id)
+	if old.hasDataPlaneAttrs() {
+		rm.attrPeers.Add(-1)
+	}
+	for sk := range rm.scores {
+		if sk.id == id {
+			delete(rm.scores, sk)
+		}
+	}
+	return true
+}
+
+func (rm *RouteManager) addContrib(id tailcfg.NodeID, pfx netip.Prefix, kind contribKind) {
+	nodes := rm.byPrefix[pfx]
+	if nodes == nil {
+		nodes = make(map[tailcfg.NodeID]contribKind)
+		rm.byPrefix[pfx] = nodes
+	}
+	nodes[id] = kind
+}
+
+func (rm *RouteManager) dropContrib(id tailcfg.NodeID, pfx netip.Prefix) {
+	nodes := rm.byPrefix[pfx]
+	delete(nodes, id)
+	if len(nodes) == 0 {
+		delete(rm.byPrefix, pfx)
+	}
+}
+
+// eligible reports whether id's contribution of pfx (of the given
+// kind) should be reflected in the outbound table and in the peer's
+// allowed source prefixes, per current prefs and tailnet config.
+// Extra allowed IPs are always eligible here, but are excluded from
+// the OS route set by [RouteManager.desiredFor].
+func (rm *RouteManager) eligible(id tailcfg.NodeID, pfx netip.Prefix, kind contribKind) bool {
+	if kind&kindSelf != 0 {
+		if !(pfx.Addr().Is4() && rm.cfg.DisableIPv4) {
+			return true
+		}
+	}
+	if kind&kindRoute != 0 {
+		if tsaddr.IsExitRoute(pfx) {
+			return rm.prefs.ExitNodeID != 0 && id == rm.prefs.ExitNodeID
+		}
+		return rm.prefs.RouteAll
+	}
+	return kind&kindExtra != 0
+}
+
+// desiredFor computes the desired output state for pfx from the
+// current working state: the outbound winner (nil if the prefix has
+// no outbound winner) and whether the prefix belongs in the OS route
+// set.
+func (rm *RouteManager) desiredFor(pfx netip.Prefix) (out *PeerRoute, os bool) {
+	var bestID tailcfg.NodeID
+	var bestScore int
+	for id, kind := range rm.byPrefix[pfx] {
+		if !rm.eligible(id, pfx, kind) {
+			continue
+		}
+		if rm.eligible(id, pfx, kind&^kindExtra) {
+			os = true
+		}
+		sc := rm.scores[scoreKey{id, pfx}]
+		if out == nil || sc > bestScore || (sc == bestScore && id < bestID) {
+			bestID, bestScore = id, sc
+			out = rm.routes[id]
+		}
+	}
+	return out, os
+}
+
+// osClass classifies a prefix for the OS route set.
+type osClass uint8
+
+const (
+	osPlain osClass = iota // installed as-is when eligible
+	osCGNAT                // single CGNAT IPv4 addr; subject to /10 coarsening
+	osULA                  // single Tailscale ULA IPv6 addr; always coarsened
+)
+
+func classify(pfx netip.Prefix) osClass {
+	if !pfx.IsSingleIP() {
+		return osPlain
+	}
+	if pfx.Addr().Is4() && tsaddr.CGNATRange().Contains(pfx.Addr()) {
+		return osCGNAT
+	}
+	if pfx.Addr().Is6() && tsaddr.TailscaleULARange().Contains(pfx.Addr()) {
+		return osULA
+	}
+	return osPlain
+}
+
+func (rm *RouteManager) cgnatThreshold() int {
+	if rm.cfg.OneCGNAT {
+		return 1
+	}
+	return cgnatThreshold
+}
+
+// tableSet returns a table derived from t, in which pfx's presence
+// matches want, reporting whether the result table differs from t.
+func tableSet(t *bart.Lite, pfx netip.Prefix, want bool) (*bart.Lite, bool) {
+	has := t.Get(pfx)
+	if has == want {
+		return t, false
+	}
+	if want {
+		return t.InsertPersist(pfx), true
+	}
+	return t.DeletePersist(pfx), true
+}
+
+// applyDirty incrementally updates the output snapshots for the dirty
+// prefixes and publishes any that changed.
+func (rm *RouteManager) applyDirty(dirty set.Set[netip.Prefix], res *Result) {
+	out := rm.outbound.Load()
+	osr := rm.osRoutes.Load()
+	var outChanged, osChanged bool
+
+	var cgnatDirty []netip.Prefix
+	for pfx := range dirty {
+		want, wantOS := rm.desiredFor(pfx)
+		if rm.prefs.ExitNodeSelected && tsaddr.IsExitRoute(pfx) {
+			// The exit routes stay in the OS route set as long as an
+			// exit node is selected, even with no eligible
+			// contributor, to blackhole rather than leak internet
+			// traffic. See [Prefs.ExitNodeSelected].
+			wantOS = true
+		}
+
+		if cur, ok := out.Get(pfx); (want != nil) != ok || (ok && cur != want) {
+			if want != nil {
+				out = out.InsertPersist(pfx, want)
+			} else {
+				out = out.DeletePersist(pfx)
+			}
+			outChanged = true
+		}
+
+		switch classify(pfx) {
+		case osULA:
+			if wantOS {
+				rm.ulaPfxs.Add(pfx)
+			} else {
+				rm.ulaPfxs.Delete(pfx)
+			}
+		case osCGNAT:
+			if wantOS {
+				rm.cgnatPfxs.Add(pfx)
+			} else {
+				rm.cgnatPfxs.Delete(pfx)
+			}
+			cgnatDirty = append(cgnatDirty, pfx)
+		case osPlain:
+			var ch bool
+			osr, ch = tableSet(osr, pfx, wantOS)
+			osChanged = osChanged || ch
+		}
+	}
+
+	var ch bool
+	osr, ch = tableSet(osr, tsaddr.TailscaleULARange(), len(rm.ulaPfxs) > 0)
+	osChanged = osChanged || ch
+
+	wantCoarse := len(rm.cgnatPfxs) > rm.cgnatThreshold()
+	if wantCoarse != rm.coarseCGNAT {
+		rm.coarseCGNAT = wantCoarse
+		for pfx := range rm.cgnatPfxs {
+			osr, ch = tableSet(osr, pfx, !wantCoarse)
+			osChanged = osChanged || ch
+		}
+		osr, ch = tableSet(osr, tsaddr.CGNATRange(), wantCoarse)
+		osChanged = osChanged || ch
+	}
+	for _, pfx := range cgnatDirty {
+		osr, ch = tableSet(osr, pfx, !rm.coarseCGNAT && rm.cgnatPfxs.Contains(pfx))
+		osChanged = osChanged || ch
+	}
+
+	rm.publish(out, outChanged, osr, osChanged, res)
+}
+
+// rebuildAll recomputes the output snapshots from scratch and
+// publishes those that changed. It runs on prefs or tailnet config
+// changes, where O(number of prefixes) work is acceptable.
+func (rm *RouteManager) rebuildAll(res *Result) {
+	out := &bart.Table[*PeerRoute]{}
+	osr := &bart.Lite{}
+	clear(rm.cgnatPfxs)
+	clear(rm.ulaPfxs)
+
+	var plain []netip.Prefix
+	for pfx := range rm.byPrefix {
+		want, wantOS := rm.desiredFor(pfx)
+		if want == nil {
+			continue
+		}
+		out.Insert(pfx, want)
+		if !wantOS {
+			continue
+		}
+		switch classify(pfx) {
+		case osULA:
+			rm.ulaPfxs.Add(pfx)
+		case osCGNAT:
+			rm.cgnatPfxs.Add(pfx)
+		case osPlain:
+			plain = append(plain, pfx)
+		}
+	}
+
+	for _, pfx := range plain {
+		osr.Insert(pfx)
+	}
+	if rm.prefs.ExitNodeSelected {
+		// Blackhole (or carry) internet traffic while any exit node
+		// is selected, resolved or not. See [Prefs.ExitNodeSelected].
+		for _, pfx := range tsaddr.ExitRoutes() {
+			osr.Insert(pfx)
+		}
+	}
+	if len(rm.ulaPfxs) > 0 {
+		osr.Insert(tsaddr.TailscaleULARange())
+	}
+	rm.coarseCGNAT = len(rm.cgnatPfxs) > rm.cgnatThreshold()
+	if rm.coarseCGNAT {
+		osr.Insert(tsaddr.CGNATRange())
+	} else {
+		for pfx := range rm.cgnatPfxs {
+			osr.Insert(pfx)
+		}
+	}
+
+	rm.publish(out, !out.Equal(rm.outbound.Load()),
+		osr, !osr.Equal(rm.osRoutes.Load()), res)
+}
+
+// publish stores the changed snapshots and records them in res.
+func (rm *RouteManager) publish(out *bart.Table[*PeerRoute], outChanged bool,
+	osr *bart.Lite, osChanged bool, res *Result) {
+	if outChanged {
+		rm.outbound.Store(out)
+		res.OutboundChanged = true
+		res.Outbound = out
+	}
+	if osChanged {
+		rm.osRoutes.Store(osr)
+		res.OSRoutesChanged = true
+		res.OSRoutes = osr
+	}
+}
diff --git a/net/routemanager/routemanager_test.go b/net/routemanager/routemanager_test.go
new file mode 100644
index 000000000..6b7c2c917
--- /dev/null
+++ b/net/routemanager/routemanager_test.go
@@ -0,0 +1,942 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package routemanager
+
+import (
+	"net/netip"
+	"reflect"
+	"slices"
+	"testing"
+
+	"tailscale.com/net/tsaddr"
+	"tailscale.com/tailcfg"
+	"tailscale.com/types/key"
+	"tailscale.com/util/set"
+)
+
+var (
+	k1 = key.NewNode().Public()
+	k2 = key.NewNode().Public()
+	k3 = key.NewNode().Public()
+)
+
+func pfx(s string) netip.Prefix { return netip.MustParsePrefix(s) }
+func addr(s string) netip.Addr  { return netip.MustParseAddr(s) }
+
+// peer1 is a basic peer with self addresses only.
+func peer1() peerView {
+	return peerView{
+		ID:  1,
+		Key: k1,
+		SelfAddrs: []netip.Prefix{
+			pfx("100.64.0.1/32"),
+			pfx("fd7a:115c:a1e0::1/128"),
+		},
+	}
+}
+
+func peer2() peerView {
+	return peerView{
+		ID:  2,
+		Key: k2,
+		SelfAddrs: []netip.Prefix{
+			pfx("100.64.0.2/32"),
+			pfx("fd7a:115c:a1e0::2/128"),
+		},
+	}
+}
+
+// commit applies fn within a single mutation and returns the Result.
+func commit(rm *RouteManager, fn func(*Mutation)) Result {
+	m := rm.Begin()
+	fn(m)
+	return m.Commit()
+}
+
+func wantOutbound(t *testing.T, rm *RouteManager, ip string, want key.NodePublic, wantOK bool) {
+	t.Helper()
+	got, ok := rm.Outbound().Lookup(addr(ip))
+	if ok != wantOK || (ok && got.Key != want) {
+		var gotKey key.NodePublic
+		if got != nil {
+			gotKey = got.Key
+		}
+		t.Errorf("Outbound lookup %s = %v, %v; want %v, %v", ip, gotKey.ShortString(), ok, want.ShortString(), wantOK)
+	}
+}
+
+func wantOSRoutes(t *testing.T, rm *RouteManager, want ...string) {
+	t.Helper()
+	wantSet := make(set.Set[netip.Prefix])
+	for _, s := range want {
+		wantSet.Add(pfx(s))
+	}
+	got := make(set.Set[netip.Prefix])
+	for p := range rm.OSRoutes().All() {
+		got.Add(p)
+	}
+	if !got.Equal(wantSet) {
+		t.Errorf("OSRoutes = %v; want %v", got.Slice(), wantSet.Slice())
+	}
+}
+
+func TestSelfAddrs(t *testing.T) {
+	rm := New(t.Logf)
+	res := commit(rm, func(m *Mutation) { m.upsertPeer(peer1()) })
+
+	if res.PeersUpserted != 1 {
+		t.Errorf("PeersUpserted = %d; want 1", res.PeersUpserted)
+	}
+	if !res.OutboundChanged || !res.OSRoutesChanged {
+		t.Errorf("changed flags = %v/%v; want all true", res.OutboundChanged, res.OSRoutesChanged)
+	}
+	if res.Outbound == nil || res.OSRoutes == nil {
+		t.Error("Result snapshot pointers should be non-nil when changed")
+	}
+
+	wantOutbound(t, rm, "100.64.0.1", k1, true)
+	wantOutbound(t, rm, "fd7a:115c:a1e0::1", k1, true)
+	wantOutbound(t, rm, "100.64.0.2", key.NodePublic{}, false)
+	// Individual CGNAT /32 (below threshold) plus the coarse ULA range.
+	wantOSRoutes(t, rm, "100.64.0.1/32", "fd7a:115c:a1e0::/48")
+}
+
+func TestRemovePeer(t *testing.T) {
+	rm := New(t.Logf)
+	commit(rm, func(m *Mutation) { m.upsertPeer(peer1()) })
+	res := commit(rm, func(m *Mutation) { m.RemovePeer(1) })
+
+	if res.PeersRemoved != 1 {
+		t.Errorf("PeersRemoved = %d; want 1", res.PeersRemoved)
+	}
+	wantOutbound(t, rm, "100.64.0.1", key.NodePublic{}, false)
+	wantOSRoutes(t, rm)
+	if rm.ForTest().PeerCount() != 0 {
+		t.Errorf("PeerCount = %d; want 0", rm.ForTest().PeerCount())
+	}
+
+	// Removing an unknown peer is a no-op.
+	res = commit(rm, func(m *Mutation) { m.RemovePeer(42) })
+	if res.PeersRemoved != 0 || res.OutboundChanged {
+		t.Errorf("remove of unknown peer: %+v", res)
+	}
+}
+
+func TestExitNodeGating(t *testing.T) {
+	rm := New(t.Logf)
+	exitPeer := peer1()
+	exitPeer.Routes = tsaddr.ExitRoutes()
+	commit(rm, func(m *Mutation) { m.upsertPeer(exitPeer) })
+
+	// Not selected: no /0 entries anywhere.
+	wantOutbound(t, rm, "8.8.8.8", key.NodePublic{}, false)
+	wantOSRoutes(t, rm, "100.64.0.1/32", "fd7a:115c:a1e0::/48")
+
+	// Select it as exit node.
+	res := commit(rm, func(m *Mutation) { m.SetPrefs(Prefs{ExitNodeID: 1}) })
+	if !res.PrefsChanged || !res.OutboundChanged || !res.OSRoutesChanged {
+		t.Errorf("select exit node: %+v", res)
+	}
+	wantOutbound(t, rm, "8.8.8.8", k1, true)
+	wantOutbound(t, rm, "2001:db8::1", k1, true)
+	wantOSRoutes(t, rm, "100.64.0.1/32", "fd7a:115c:a1e0::/48", "0.0.0.0/0", "::/0")
+
+	// Deselect: /0s vanish.
+	commit(rm, func(m *Mutation) { m.SetPrefs(Prefs{}) })
+	wantOutbound(t, rm, "8.8.8.8", key.NodePublic{}, false)
+	wantOSRoutes(t, rm, "100.64.0.1/32", "fd7a:115c:a1e0::/48")
+
+	// Selecting a peer that doesn't advertise /0s adds nothing.
+	commit(rm, func(m *Mutation) {
+		m.upsertPeer(peer2())
+		m.SetPrefs(Prefs{ExitNodeID: 2})
+	})
+	wantOutbound(t, rm, "8.8.8.8", key.NodePublic{}, false)
+}
+
+func TestRouteAll(t *testing.T) {
+	rm := New(t.Logf)
+	p := peer1()
+	p.Routes = []netip.Prefix{pfx("10.0.0.0/24")}
+	commit(rm, func(m *Mutation) { m.upsertPeer(p) })
+
+	// Subnet routes ignored until RouteAll.
+	wantOutbound(t, rm, "10.0.0.5", key.NodePublic{}, false)
+	wantOSRoutes(t, rm, "100.64.0.1/32", "fd7a:115c:a1e0::/48")
+
+	commit(rm, func(m *Mutation) { m.SetPrefs(Prefs{RouteAll: true}) })
+	wantOutbound(t, rm, "10.0.0.5", k1, true)
+	wantOSRoutes(t, rm, "100.64.0.1/32", "fd7a:115c:a1e0::/48", "10.0.0.0/24")
+
+	commit(rm, func(m *Mutation) { m.SetPrefs(Prefs{}) })
+	wantOutbound(t, rm, "10.0.0.5", key.NodePublic{}, false)
+}
+
+func TestSharedSubnetRoute(t *testing.T) {
+	rm := New(t.Logf)
+	route := pfx("10.0.0.0/24")
+	pa, pb := peer1(), peer2()
+	pa.Routes = []netip.Prefix{route}
+	pb.Routes = []netip.Prefix{route}
+	commit(rm, func(m *Mutation) {
+		m.upsertPeer(pa)
+		m.upsertPeer(pb)
+		m.SetPrefs(Prefs{RouteAll: true})
+	})
+
+	// Tie on score: lowest NodeID wins outbound.
+	wantOutbound(t, rm, "10.0.0.5", k1, true)
+
+	// Raise peer 2's score: outbound flips, OS routes unchanged.
+	res := commit(rm, func(m *Mutation) { m.SetScore(2, route, 100) })
+	if res.ScoresChanged != 1 || !res.OutboundChanged || res.OSRoutesChanged {
+		t.Errorf("score change: %+v", res)
+	}
+	wantOutbound(t, rm, "10.0.0.5", k2, true)
+
+	// Setting the same score again is a no-op.
+	res = commit(rm, func(m *Mutation) { m.SetScore(2, route, 100) })
+	if res.ScoresChanged != 0 || res.OutboundChanged {
+		t.Errorf("same score: %+v", res)
+	}
+
+	// Resetting the score to zero restores the NodeID tie-break.
+	res = commit(rm, func(m *Mutation) { m.SetScore(2, route, 0) })
+	if res.ScoresChanged != 1 || !res.OutboundChanged {
+		t.Errorf("score reset: %+v", res)
+	}
+	wantOutbound(t, rm, "10.0.0.5", k1, true)
+
+	// Resetting an already-absent score is a no-op.
+	res = commit(rm, func(m *Mutation) { m.SetScore(2, route, 0) })
+	if res.ScoresChanged != 0 {
+		t.Errorf("absent score reset: %+v", res)
+	}
+
+	// Restore peer 2 as winner for the removal test below.
+	commit(rm, func(m *Mutation) { m.SetScore(2, route, 100) })
+	wantOutbound(t, rm, "10.0.0.5", k2, true)
+
+	// Removing the winner falls back to the other advertiser.
+	commit(rm, func(m *Mutation) { m.RemovePeer(2) })
+	wantOutbound(t, rm, "10.0.0.5", k1, true)
+
+	// Peer 2's score was dropped on removal: re-adding it ties again
+	// and peer 1 wins by lower NodeID.
+	commit(rm, func(m *Mutation) { m.upsertPeer(pb) })
+	wantOutbound(t, rm, "10.0.0.5", k1, true)
+}
+
+func TestOneCGNAT(t *testing.T) {
+	rm := New(t.Logf)
+	commit(rm, func(m *Mutation) {
+		m.SetTailnetConfig(TailnetConfig{OneCGNAT: true})
+		m.upsertPeer(peer1())
+	})
+	// One CGNAT addr: not above threshold (1 > 1 is false), so
+	// still individual, mirroring ipnlocal.peerRoutes.
+	wantOSRoutes(t, rm, "100.64.0.1/32", "fd7a:115c:a1e0::/48")
+
+	// Second CGNAT addr crosses the threshold: collapse to /10.
+	res := commit(rm, func(m *Mutation) { m.upsertPeer(peer2()) })
+	if !res.OSRoutesChanged {
+		t.Errorf("crossing threshold: %+v", res)
+	}
+	wantOSRoutes(t, rm, "100.64.0.0/10", "fd7a:115c:a1e0::/48")
+
+	// Hot-path tables stay exact regardless of OS coarsening.
+	wantOutbound(t, rm, "100.64.0.2", k2, true)
+	wantOutbound(t, rm, "100.64.0.3", key.NodePublic{}, false)
+
+	// Dropping back below the threshold un-coarsens.
+	commit(rm, func(m *Mutation) { m.RemovePeer(2) })
+	wantOSRoutes(t, rm, "100.64.0.1/32", "fd7a:115c:a1e0::/48")
+}
+
+// TestFullRebuildWhileCoarse exercises the full-rebuild path (a prefs
+// change) while CGNAT coarsening is already active.
+func TestFullRebuildWhileCoarse(t *testing.T) {
+	rm := New(t.Logf)
+	commit(rm, func(m *Mutation) {
+		m.SetTailnetConfig(TailnetConfig{OneCGNAT: true})
+		m.upsertPeer(peer1())
+		m.upsertPeer(peer2())
+	})
+	wantOSRoutes(t, rm, "100.64.0.0/10", "fd7a:115c:a1e0::/48")
+
+	res := commit(rm, func(m *Mutation) { m.SetPrefs(Prefs{RouteAll: true}) })
+	if !res.PrefsChanged || res.OSRoutesChanged {
+		t.Errorf("prefs change while coarse: %+v", res)
+	}
+	wantOSRoutes(t, rm, "100.64.0.0/10", "fd7a:115c:a1e0::/48")
+	wantOutbound(t, rm, "100.64.0.2", k2, true)
+}
+
+// TestSingleIPPlainRoute checks that a single-IP route outside the
+// CGNAT and ULA ranges is programmed individually, not coarsened.
+func TestSingleIPPlainRoute(t *testing.T) {
+	rm := New(t.Logf)
+	p := peer1()
+	p.Routes = []netip.Prefix{pfx("192.0.2.7/32")}
+	commit(rm, func(m *Mutation) {
+		m.upsertPeer(p)
+		m.SetPrefs(Prefs{RouteAll: true})
+	})
+	wantOutbound(t, rm, "192.0.2.7", k1, true)
+	wantOSRoutes(t, rm, "100.64.0.1/32", "fd7a:115c:a1e0::/48", "192.0.2.7/32")
+}
+
+func TestDisableIPv4(t *testing.T) {
+	rm := New(t.Logf)
+	commit(rm, func(m *Mutation) {
+		m.SetTailnetConfig(TailnetConfig{DisableIPv4: true})
+		m.upsertPeer(peer1())
+	})
+	wantOutbound(t, rm, "100.64.0.1", key.NodePublic{}, false)
+	wantOutbound(t, rm, "fd7a:115c:a1e0::1", k1, true)
+	wantOSRoutes(t, rm, "fd7a:115c:a1e0::/48")
+}
+
+func TestKeyRotation(t *testing.T) {
+	rm := New(t.Logf)
+	commit(rm, func(m *Mutation) { m.upsertPeer(peer1()) })
+
+	rotated := peer1()
+	rotated.Key = k3
+	res := commit(rm, func(m *Mutation) { m.upsertPeer(rotated) })
+	if !res.OutboundChanged || res.OSRoutesChanged {
+		t.Errorf("key rotation: %+v", res)
+	}
+	wantOutbound(t, rm, "100.64.0.1", k3, true)
+}
+
+// TestPeerRouteAttrs checks that the data-plane attributes (jailed,
+// masquerade addresses) are published in the outbound table, that
+// changing only an attribute republishes the peer's prefixes, and
+// that previously published snapshots keep the old attributes.
+func TestPeerRouteAttrs(t *testing.T) {
+	rm := New(t.Logf)
+	commit(rm, func(m *Mutation) { m.upsertPeer(peer1()) })
+
+	pr, ok := rm.Outbound().Lookup(addr("100.64.0.1"))
+	if !ok || pr.Jailed || pr.MasqAddr4.IsValid() || pr.MasqAddr6.IsValid() {
+		t.Fatalf("initial attrs = %+v, %v; want unjailed, no masq", pr, ok)
+	}
+	if rm.HasDataPlaneAttrs() {
+		t.Error("HasDataPlaneAttrs = true with no jailed or masqueraded peers")
+	}
+	oldOut := rm.Outbound()
+
+	jailed := peer1()
+	jailed.Jailed = true
+	jailed.MasqAddr4 = addr("100.99.0.1")
+	res := commit(rm, func(m *Mutation) { m.upsertPeer(jailed) })
+	if !res.OutboundChanged || res.OSRoutesChanged {
+		t.Errorf("attr change: %+v", res)
+	}
+	if res.AllowedIPs != nil {
+		t.Errorf("attr change reported AllowedIPs %v; attrs must not affect allowed prefixes", res.AllowedIPs)
+	}
+	pr, ok = rm.Outbound().Lookup(addr("100.64.0.1"))
+	if !ok || !pr.Jailed || pr.MasqAddr4 != addr("100.99.0.1") || pr.Key != k1 {
+		t.Fatalf("updated attrs = %+v, %v", pr, ok)
+	}
+	if !rm.HasDataPlaneAttrs() {
+		t.Error("HasDataPlaneAttrs = false with a jailed peer")
+	}
+	if pr, ok := oldOut.Lookup(addr("100.64.0.1")); !ok || pr.Jailed {
+		t.Errorf("old snapshot attrs = %+v, %v; want original unjailed entry", pr, ok)
+	}
+
+	// An identical re-upsert is a no-op.
+	res = commit(rm, func(m *Mutation) { m.upsertPeer(jailed) })
+	if res.OutboundChanged {
+		t.Errorf("identical attrs re-upsert changed outbound: %+v", res)
+	}
+	if !rm.HasDataPlaneAttrs() {
+		t.Error("HasDataPlaneAttrs = false after identical re-upsert of a jailed peer")
+	}
+
+	// Removing the peer drops its data-plane attributes.
+	commit(rm, func(m *Mutation) { m.RemovePeer(1) })
+	if rm.HasDataPlaneAttrs() {
+		t.Error("HasDataPlaneAttrs = true after removing the only jailed peer")
+	}
+}
+
+func TestNoopCommit(t *testing.T) {
+	rm := New(t.Logf)
+	commit(rm, func(m *Mutation) { m.upsertPeer(peer1()) })
+
+	res := commit(rm, func(m *Mutation) { m.upsertPeer(peer1()) })
+	if res.OutboundChanged || res.OSRoutesChanged {
+		t.Errorf("identical re-upsert changed tables: %+v", res)
+	}
+	if res.Outbound != nil || res.OSRoutes != nil {
+		t.Error("Result snapshot pointers should be nil when unchanged")
+	}
+	if res.PeersUpserted != 1 {
+		t.Errorf("PeersUpserted = %d; want 1", res.PeersUpserted)
+	}
+
+	// Same prefs again: no rebuild reported.
+	commit(rm, func(m *Mutation) { m.SetPrefs(Prefs{RouteAll: true}) })
+	res = commit(rm, func(m *Mutation) { m.SetPrefs(Prefs{RouteAll: true}) })
+	if res.PrefsChanged {
+		t.Errorf("identical prefs reported changed: %+v", res)
+	}
+
+	// An empty mutation commits fine.
+	res = commit(rm, func(m *Mutation) {})
+	if !reflect.DeepEqual(res, Result{}) {
+		t.Errorf("empty commit: %+v", res)
+	}
+}
+
+func TestUnmaskedPrefixSkipped(t *testing.T) {
+	rm := New(t.Logf)
+	p := peer1()
+	p.Routes = []netip.Prefix{netip.PrefixFrom(addr("10.0.0.5"), 24)} // non-address bits set
+	commit(rm, func(m *Mutation) {
+		m.upsertPeer(p)
+		m.SetPrefs(Prefs{RouteAll: true})
+	})
+	wantOutbound(t, rm, "10.0.0.5", key.NodePublic{}, false)
+}
+
+func TestSnapshotImmutability(t *testing.T) {
+	rm := New(t.Logf)
+	commit(rm, func(m *Mutation) { m.upsertPeer(peer1()) })
+	oldOut := rm.Outbound()
+
+	commit(rm, func(m *Mutation) { m.RemovePeer(1) })
+
+	// The old snapshot still sees the removed peer.
+	if _, ok := oldOut.Lookup(addr("100.64.0.1")); !ok {
+		t.Error("old outbound snapshot lost entry after later commit")
+	}
+	// And the new one doesn't.
+	wantOutbound(t, rm, "100.64.0.1", key.NodePublic{}, false)
+}
+
+func TestDiscard(t *testing.T) {
+	rm := New(t.Logf)
+	m := rm.Begin()
+	m.upsertPeer(peer1())
+	m.Discard()
+	if rm.ForTest().PeerCount() != 0 {
+		t.Error("discarded mutation was applied")
+	}
+	// A new mutation works after a discard.
+	commit(rm, func(m *Mutation) { m.upsertPeer(peer1()) })
+	if rm.ForTest().PeerCount() != 1 {
+		t.Error("commit after discard failed")
+	}
+}
+
+func TestConcurrentMutationPanics(t *testing.T) {
+	rm := New(t.Logf)
+	m1 := rm.Begin()
+	m2 := rm.Begin()
+	m1.upsertPeer(peer1())
+	m1.Commit()
+
+	defer func() {
+		if recover() == nil {
+			t.Error("overlapping Commit did not panic")
+		}
+	}()
+	m2.Commit()
+}
+
+func TestFinishedMutationPanics(t *testing.T) {
+	rm := New(t.Logf)
+	m := rm.Begin()
+	m.Commit()
+	defer func() {
+		if recover() == nil {
+			t.Error("op on finished Mutation did not panic")
+		}
+	}()
+	m.upsertPeer(peer1())
+}
+
+func TestPeerModifyRoutes(t *testing.T) {
+	rm := New(t.Logf)
+	p := peer1()
+	p.Routes = []netip.Prefix{pfx("10.0.0.0/24")}
+	commit(rm, func(m *Mutation) {
+		m.upsertPeer(p)
+		m.SetPrefs(Prefs{RouteAll: true})
+	})
+	wantOutbound(t, rm, "10.0.0.5", k1, true)
+
+	// Swap the advertised route for another.
+	p.Routes = []netip.Prefix{pfx("192.168.1.0/24")}
+	res := commit(rm, func(m *Mutation) { m.upsertPeer(p) })
+	if !res.OutboundChanged {
+		t.Errorf("route swap: %+v", res)
+	}
+	wantOutbound(t, rm, "10.0.0.5", key.NodePublic{}, false)
+	wantOutbound(t, rm, "192.168.1.5", k1, true)
+	wantOSRoutes(t, rm, "100.64.0.1/32", "fd7a:115c:a1e0::/48", "192.168.1.0/24")
+}
+
+// BenchmarkUpsertOnePeer measures the cost of a single-peer mutation
+// against a manager already tracking many peers, the case the
+// incremental design exists for.
+func BenchmarkUpsertOnePeer(b *testing.B) {
+	rm := New(nil)
+	m := rm.Begin()
+	for i := range 10_000 {
+		id := tailcfg.NodeID(i + 1)
+		m.upsertPeer(peerView{
+			ID:  id,
+			Key: key.NewNode().Public(),
+			SelfAddrs: []netip.Prefix{
+				netip.PrefixFrom(netip.AddrFrom4([4]byte{100, 64, byte(i >> 8), byte(i)}), 32),
+			},
+		})
+	}
+	m.Commit()
+
+	p := peerView{
+		ID:        99_999,
+		Key:       key.NewNode().Public(),
+		SelfAddrs: []netip.Prefix{pfx("100.100.1.1/32")},
+	}
+	b.ReportAllocs()
+	for i := 0; b.Loop(); i++ {
+		p.SelfAddrs[0] = netip.PrefixFrom(netip.AddrFrom4([4]byte{100, 100, byte(i >> 8), byte(i)}), 32)
+		m := rm.Begin()
+		m.upsertPeer(p)
+		m.Commit()
+	}
+}
+
+func TestUpsertPeerNodeView(t *testing.T) {
+	rm := New(t.Logf)
+	n := &tailcfg.Node{
+		ID:       1,
+		Key:      k1,
+		HomeDERP: 1,
+		Addresses: []netip.Prefix{
+			pfx("100.64.0.1/32"),
+			pfx("fd7a:115c:a1e0::1/128"),
+		},
+		AllowedIPs: []netip.Prefix{
+			pfx("100.64.0.1/32"),
+			pfx("fd7a:115c:a1e0::1/128"),
+			pfx("10.0.0.0/24"),
+			pfx("0.0.0.0/0"),
+			pfx("::/0"),
+		},
+		IsJailed:                      true,
+		SelfNodeV4MasqAddrForThisPeer: new(addr("100.99.0.5")),
+	}
+	commit(rm, func(m *Mutation) { m.UpsertPeer(n.View()) })
+
+	// The data-plane attributes are carried through from the node.
+	if pr, ok := rm.Outbound().Lookup(addr("100.64.0.1")); !ok || !pr.Jailed || pr.MasqAddr4 != addr("100.99.0.5") || pr.MasqAddr6.IsValid() {
+		t.Errorf("attrs = %+v, %v; want jailed with v4 masq only", pr, ok)
+	}
+
+	// Self addresses are live immediately; the subnet route and the
+	// exit routes were classified as routes and stay gated by prefs.
+	wantOutbound(t, rm, "100.64.0.1", k1, true)
+	wantOutbound(t, rm, "10.0.0.5", key.NodePublic{}, false)
+	wantOutbound(t, rm, "8.8.8.8", key.NodePublic{}, false)
+
+	commit(rm, func(m *Mutation) { m.SetPrefs(Prefs{RouteAll: true, ExitNodeID: 1}) })
+	wantOutbound(t, rm, "10.0.0.5", k1, true)
+	wantOutbound(t, rm, "8.8.8.8", k1, true)
+}
+
+// TestUpsertPeerNodeViewVIPService checks that a single Tailscale IP
+// in a peer's AllowedIPs but not in its Addresses (such as a VIP
+// service address hosted by the peer) is classified as a self address
+// and stays routable without Prefs.RouteAll, mirroring nmcfg's
+// cidrIsSubnet.
+func TestUpsertPeerNodeViewVIPService(t *testing.T) {
+	rm := New(t.Logf)
+	n := &tailcfg.Node{
+		ID:       1,
+		Key:      k1,
+		HomeDERP: 1,
+		Addresses: []netip.Prefix{
+			pfx("100.64.0.1/32"),
+		},
+		AllowedIPs: []netip.Prefix{
+			pfx("100.64.0.1/32"),
+			pfx("100.100.5.5/32"),  // VIP service address
+			pfx("192.168.1.99/32"), // single non-Tailscale IP: a subnet route
+			pfx("10.0.0.0/24"),
+		},
+	}
+	commit(rm, func(m *Mutation) { m.UpsertPeer(n.View()) })
+
+	// With RouteAll off, the node address and the VIP service address
+	// are routable, but the subnet routes are not.
+	wantOutbound(t, rm, "100.64.0.1", k1, true)
+	wantOutbound(t, rm, "100.100.5.5", k1, true)
+	wantOutbound(t, rm, "192.168.1.99", key.NodePublic{}, false)
+	wantOutbound(t, rm, "10.0.0.5", key.NodePublic{}, false)
+	wantOSRoutes(t, rm, "100.64.0.1/32", "100.100.5.5/32")
+
+	commit(rm, func(m *Mutation) { m.SetPrefs(Prefs{RouteAll: true}) })
+	wantOutbound(t, rm, "192.168.1.99", k1, true)
+	wantOutbound(t, rm, "10.0.0.5", k1, true)
+}
+
+// TestUpsertPeerNodeViewEmptyAllowedIPs checks that AllowedIPs is
+// the sole source of prefixes: a peer whose AllowedIPs is empty is
+// not routable even if it has addresses, matching nmcfg.WGCfg.
+func TestUpsertPeerNodeViewEmptyAllowedIPs(t *testing.T) {
+	rm := New(t.Logf)
+	n := &tailcfg.Node{
+		ID:        1,
+		Key:       k1,
+		HomeDERP:  1,
+		Addresses: []netip.Prefix{pfx("100.64.0.1/32")},
+	}
+	commit(rm, func(m *Mutation) { m.UpsertPeer(n.View()) })
+	wantOutbound(t, rm, "100.64.0.1", key.NodePublic{}, false)
+	wantOSRoutes(t, rm)
+	if _, ok := rm.PeerAllowedIPs(1); ok {
+		t.Error("PeerAllowedIPs = ok; want !ok for peer with no AllowedIPs")
+	}
+}
+
+// TestUpsertPeerNodeViewIneligible checks that peers we cannot
+// communicate with (expired, or predating both DERP and disco) are
+// tracked but contribute no prefixes, mirroring nmcfg.WGCfg's peer
+// filtering, and that a later update restores them.
+func TestUpsertPeerNodeViewIneligible(t *testing.T) {
+	base := func() *tailcfg.Node {
+		return &tailcfg.Node{
+			ID:        1,
+			Key:       k1,
+			HomeDERP:  1,
+			Addresses: []netip.Prefix{pfx("100.64.0.1/32")},
+			AllowedIPs: []netip.Prefix{
+				pfx("100.64.0.1/32"),
+			},
+		}
+	}
+
+	for _, tc := range []struct {
+		name string
+		mod  func(*tailcfg.Node)
+	}{
+		{"expired", func(n *tailcfg.Node) { n.Expired = true }},
+		{"noDERPOrDisco", func(n *tailcfg.Node) { n.HomeDERP = 0 }},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			rm := New(t.Logf)
+			n := base()
+			tc.mod(n)
+			commit(rm, func(m *Mutation) { m.UpsertPeer(n.View()) })
+			wantOutbound(t, rm, "100.64.0.1", key.NodePublic{}, false)
+			wantOSRoutes(t, rm)
+			if _, ok := rm.PeerAllowedIPs(1); ok {
+				t.Error("PeerAllowedIPs = ok; want !ok for ineligible peer")
+			}
+
+			// An update that clears the condition restores the peer.
+			commit(rm, func(m *Mutation) { m.UpsertPeer(base().View()) })
+			wantOutbound(t, rm, "100.64.0.1", k1, true)
+		})
+	}
+}
+
+// wantChangedAllowedIPs checks res.AllowedIPs against want, where
+// want maps each expected key to its expected new prefixes (nil for
+// "no allowed prefixes").
+func wantChangedAllowedIPs(t *testing.T, res Result, want map[key.NodePublic][]string) {
+	t.Helper()
+	wantMap := make(PeersWithRouteChanges)
+	for k, ss := range want {
+		var pfxs []netip.Prefix
+		for _, s := range ss {
+			pfxs = append(pfxs, pfx(s))
+		}
+		tsaddr.SortPrefixes(pfxs)
+		wantMap[k] = pfxs
+	}
+	if len(want) == 0 {
+		if res.AllowedIPs != nil {
+			t.Errorf("Result.AllowedIPs = %v; want nil", res.AllowedIPs)
+		}
+		return
+	}
+	if !reflect.DeepEqual(res.AllowedIPs, wantMap) {
+		t.Errorf("Result.AllowedIPs = %v; want %v", res.AllowedIPs, wantMap)
+	}
+}
+
+func TestResultAllowedIPs(t *testing.T) {
+	rm := New(t.Logf)
+
+	// A new peer appears in the map with its prefixes.
+	res := commit(rm, func(m *Mutation) { m.upsertPeer(peer1()) })
+	wantChangedAllowedIPs(t, res, map[key.NodePublic][]string{
+		k1: {"100.64.0.1/32", "fd7a:115c:a1e0::1/128"},
+	})
+
+	// An identical re-upsert reports nothing.
+	res = commit(rm, func(m *Mutation) { m.upsertPeer(peer1()) })
+	wantChangedAllowedIPs(t, res, nil)
+
+	// Add a second peer advertising a subnet route and the exit
+	// routes; with default prefs only its self addresses count.
+	p2 := peer2()
+	p2.Routes = []netip.Prefix{pfx("10.0.0.0/24"), pfx("0.0.0.0/0"), pfx("::/0")}
+	res = commit(rm, func(m *Mutation) { m.upsertPeer(p2) })
+	wantChangedAllowedIPs(t, res, map[key.NodePublic][]string{
+		k2: {"100.64.0.2/32", "fd7a:115c:a1e0::2/128"},
+	})
+
+	// RouteAll adds the subnet route to peer 2 only; peer 1 has no
+	// routes, so it does not appear.
+	res = commit(rm, func(m *Mutation) { m.SetPrefs(Prefs{RouteAll: true}) })
+	wantChangedAllowedIPs(t, res, map[key.NodePublic][]string{
+		k2: {"100.64.0.2/32", "fd7a:115c:a1e0::2/128", "10.0.0.0/24"},
+	})
+
+	// Selecting peer 2 as exit node adds the /0s to it only.
+	res = commit(rm, func(m *Mutation) { m.SetPrefs(Prefs{RouteAll: true, ExitNodeID: 2}) })
+	wantChangedAllowedIPs(t, res, map[key.NodePublic][]string{
+		k2: {"100.64.0.2/32", "fd7a:115c:a1e0::2/128", "10.0.0.0/24", "0.0.0.0/0", "::/0"},
+	})
+
+	// Deselecting removes them again.
+	res = commit(rm, func(m *Mutation) { m.SetPrefs(Prefs{RouteAll: true}) })
+	wantChangedAllowedIPs(t, res, map[key.NodePublic][]string{
+		k2: {"100.64.0.2/32", "fd7a:115c:a1e0::2/128", "10.0.0.0/24"},
+	})
+
+	// A score change affects only the outbound winner, not any
+	// peer's allowed prefixes.
+	res = commit(rm, func(m *Mutation) { m.SetScore(2, pfx("10.0.0.0/24"), 100) })
+	wantChangedAllowedIPs(t, res, nil)
+
+	// A key rotation reports the old key with no prefixes and the
+	// new key with the peer's prefixes.
+	rotated := peer1()
+	rotated.Key = k3
+	res = commit(rm, func(m *Mutation) { m.upsertPeer(rotated) })
+	wantChangedAllowedIPs(t, res, map[key.NodePublic][]string{
+		k1: nil,
+		k3: {"100.64.0.1/32", "fd7a:115c:a1e0::1/128"},
+	})
+
+	// A removed peer reports its key with no prefixes.
+	res = commit(rm, func(m *Mutation) { m.RemovePeer(2) })
+	wantChangedAllowedIPs(t, res, map[key.NodePublic][]string{
+		k2: nil,
+	})
+
+	// A prefs change combined with an upsert of a brand-new peer in
+	// the same commit reports both correctly: peer 1 gains nothing
+	// from RouteAll going away (it has no routes), and the new peer
+	// appears with its prefixes.
+	p4 := peerView{
+		ID:        4,
+		Key:       key.NewNode().Public(),
+		SelfAddrs: []netip.Prefix{pfx("100.64.0.4/32")},
+	}
+	res = commit(rm, func(m *Mutation) {
+		m.SetPrefs(Prefs{})
+		m.upsertPeer(p4)
+	})
+	wantChangedAllowedIPs(t, res, map[key.NodePublic][]string{
+		p4.Key: {"100.64.0.4/32"},
+	})
+}
+
+func TestPeerAllowedIPs(t *testing.T) {
+	rm := New(t.Logf)
+	p := peer1()
+	p.Routes = []netip.Prefix{pfx("10.0.0.0/24"), pfx("0.0.0.0/0"), pfx("::/0")}
+	commit(rm, func(m *Mutation) { m.upsertPeer(p) })
+
+	wantAllowed := func(want ...string) {
+		t.Helper()
+		var wantPfxs []netip.Prefix
+		for _, s := range want {
+			wantPfxs = append(wantPfxs, pfx(s))
+		}
+		tsaddr.SortPrefixes(wantPfxs)
+		got, ok := rm.PeerAllowedIPs(1)
+		if len(want) == 0 {
+			if ok {
+				t.Errorf("PeerAllowedIPs = %v; want !ok", got)
+			}
+			return
+		}
+		if !ok || !slices.Equal(got, wantPfxs) {
+			t.Errorf("PeerAllowedIPs = %v, %v; want %v", got, ok, wantPfxs)
+		}
+	}
+
+	// Default prefs: self addresses only.
+	wantAllowed("100.64.0.1/32", "fd7a:115c:a1e0::1/128")
+
+	// RouteAll adds the subnet route but not the exit routes.
+	commit(rm, func(m *Mutation) { m.SetPrefs(Prefs{RouteAll: true}) })
+	wantAllowed("100.64.0.1/32", "fd7a:115c:a1e0::1/128", "10.0.0.0/24")
+
+	// Selecting the peer as exit node adds the /0s.
+	commit(rm, func(m *Mutation) { m.SetPrefs(Prefs{RouteAll: true, ExitNodeID: 1}) })
+	wantAllowed("100.64.0.1/32", "fd7a:115c:a1e0::1/128", "10.0.0.0/24", "0.0.0.0/0", "::/0")
+
+	// Unknown peers report !ok.
+	if _, ok := rm.PeerAllowedIPs(42); ok {
+		t.Error("PeerAllowedIPs(42) = ok; want !ok")
+	}
+
+	// A removed peer reports !ok.
+	commit(rm, func(m *Mutation) { m.RemovePeer(1) })
+	wantAllowed()
+}
+
+func TestExtraAllowedIPs(t *testing.T) {
+	rm := New(t.Logf)
+	commit(rm, func(m *Mutation) { m.upsertPeer(peer1()) })
+
+	// Extras appear in the outbound table and in PeerAllowedIPs,
+	// but not in the OS route set, even for prefixes (like the
+	// CGNAT one here) whose class would otherwise be coarsened.
+	res := commit(rm, func(m *Mutation) {
+		m.SetExtraAllowedIPs(map[tailcfg.NodeID][]netip.Prefix{
+			1: {pfx("fe80::1234/128"), pfx("100.100.100.100/32")},
+		})
+	})
+	if !res.ExtrasChanged {
+		t.Error("ExtrasChanged = false; want true")
+	}
+	wantChangedAllowedIPs(t, res, map[key.NodePublic][]string{
+		k1: {"100.64.0.1/32", "fd7a:115c:a1e0::1/128", "fe80::1234/128", "100.100.100.100/32"},
+	})
+	wantOutbound(t, rm, "fe80::1234", k1, true)
+	wantOutbound(t, rm, "100.100.100.100", k1, true)
+	wantOSRoutes(t, rm, "100.64.0.1/32", "fd7a:115c:a1e0::/48")
+
+	// An identical re-set is a no-op.
+	res = commit(rm, func(m *Mutation) {
+		m.SetExtraAllowedIPs(map[tailcfg.NodeID][]netip.Prefix{
+			1: {pfx("fe80::1234/128"), pfx("100.100.100.100/32")},
+		})
+	})
+	if res.ExtrasChanged || res.OutboundChanged || res.AllowedIPs != nil {
+		t.Errorf("no-op re-set changed something: %+v", res)
+	}
+
+	// Replacing the set drops the old prefixes and adds the new one.
+	res = commit(rm, func(m *Mutation) {
+		m.SetExtraAllowedIPs(map[tailcfg.NodeID][]netip.Prefix{
+			1: {pfx("fe80::5678/128")},
+		})
+	})
+	wantChangedAllowedIPs(t, res, map[key.NodePublic][]string{
+		k1: {"100.64.0.1/32", "fd7a:115c:a1e0::1/128", "fe80::5678/128"},
+	})
+	wantOutbound(t, rm, "fe80::1234", key.NodePublic{}, false)
+	wantOutbound(t, rm, "fe80::5678", k1, true)
+
+	// Clearing the set removes the remaining extra.
+	res = commit(rm, func(m *Mutation) { m.SetExtraAllowedIPs(nil) })
+	wantChangedAllowedIPs(t, res, map[key.NodePublic][]string{
+		k1: {"100.64.0.1/32", "fd7a:115c:a1e0::1/128"},
+	})
+	wantOutbound(t, rm, "fe80::5678", key.NodePublic{}, false)
+}
+
+func TestExtraAllowedIPsPeerLifecycle(t *testing.T) {
+	rm := New(t.Logf)
+
+	// Extras for a peer that doesn't exist yet have no visible
+	// effect until the peer is upserted.
+	res := commit(rm, func(m *Mutation) {
+		m.SetExtraAllowedIPs(map[tailcfg.NodeID][]netip.Prefix{
+			1: {pfx("fe80::1234/128")},
+		})
+	})
+	if !res.ExtrasChanged || res.OutboundChanged || res.AllowedIPs != nil {
+		t.Errorf("extras for unknown peer: %+v", res)
+	}
+	wantOutbound(t, rm, "fe80::1234", key.NodePublic{}, false)
+
+	res = commit(rm, func(m *Mutation) { m.upsertPeer(peer1()) })
+	wantChangedAllowedIPs(t, res, map[key.NodePublic][]string{
+		k1: {"100.64.0.1/32", "fd7a:115c:a1e0::1/128", "fe80::1234/128"},
+	})
+	wantOutbound(t, rm, "fe80::1234", k1, true)
+
+	// Removing the peer removes its extras from the tables, but the
+	// stored entry survives and re-applies if the peer comes back.
+	res = commit(rm, func(m *Mutation) { m.RemovePeer(1) })
+	wantChangedAllowedIPs(t, res, map[key.NodePublic][]string{k1: nil})
+	wantOutbound(t, rm, "fe80::1234", key.NodePublic{}, false)
+
+	commit(rm, func(m *Mutation) { m.upsertPeer(peer1()) })
+	wantOutbound(t, rm, "fe80::1234", k1, true)
+
+	// A non-communicable peer (no addresses or routes) contributes
+	// no prefixes at all, including its extras.
+	res = commit(rm, func(m *Mutation) { m.upsertPeer(peerView{ID: 1, Key: k1}) })
+	wantChangedAllowedIPs(t, res, map[key.NodePublic][]string{k1: nil})
+	wantOutbound(t, rm, "fe80::1234", key.NodePublic{}, false)
+
+	// Extras survive a prefs-driven full rebuild.
+	commit(rm, func(m *Mutation) { m.upsertPeer(peer1()) })
+	commit(rm, func(m *Mutation) { m.SetPrefs(Prefs{RouteAll: true}) })
+	wantOutbound(t, rm, "fe80::1234", k1, true)
+	wantOSRoutes(t, rm, "100.64.0.1/32", "fd7a:115c:a1e0::/48")
+}
+
+// Tests that the exit routes stay in the OS route set whenever an
+// exit node is selected, even one that resolves to no current peer
+// (Prefs.ExitNodeSelected with a zero ExitNodeID), so internet
+// traffic is blackholed rather than escaping to the local network.
+// This mirrors the long-standing behavior documented on
+// ipn.Prefs.ExitNodeID and relied on by MDM's "auto:any" placeholder.
+func TestExitNodeBlackhole(t *testing.T) {
+	rm := New(t.Logf)
+	exitPeer := peer1()
+	exitPeer.Routes = tsaddr.ExitRoutes()
+	commit(rm, func(m *Mutation) { m.upsertPeer(exitPeer) })
+
+	// No exit node selected: no default routes, no outbound winner.
+	wantOSRoutes(t, rm, "100.64.0.1/32", "fd7a:115c:a1e0::/48")
+	wantOutbound(t, rm, "8.8.8.8", key.NodePublic{}, false)
+
+	// A resolved exit node carries the default routes.
+	commit(rm, func(m *Mutation) {
+		m.SetPrefs(Prefs{ExitNodeID: 1, ExitNodeSelected: true})
+	})
+	wantOSRoutes(t, rm, "100.64.0.1/32", "fd7a:115c:a1e0::/48", "0.0.0.0/0", "::/0")
+	wantOutbound(t, rm, "8.8.8.8", k1, true)
+
+	// An unresolved exit node (nonexistent, or not yet resolved)
+	// keeps the default routes with no outbound winner: a blackhole.
+	commit(rm, func(m *Mutation) {
+		m.SetPrefs(Prefs{ExitNodeID: 0, ExitNodeSelected: true})
+	})
+	wantOSRoutes(t, rm, "100.64.0.1/32", "fd7a:115c:a1e0::/48", "0.0.0.0/0", "::/0")
+	wantOutbound(t, rm, "8.8.8.8", key.NodePublic{}, false)
+
+	// Removing the exit-capable peer while still selected keeps the
+	// blackhole in place via the incremental path.
+	commit(rm, func(m *Mutation) {
+		m.SetPrefs(Prefs{ExitNodeID: 1, ExitNodeSelected: true})
+	})
+	commit(rm, func(m *Mutation) { m.RemovePeer(1) })
+	wantOSRoutes(t, rm, "0.0.0.0/0", "::/0")
+	wantOutbound(t, rm, "8.8.8.8", key.NodePublic{}, false)
+
+	// Deselecting the exit node removes the default routes.
+	commit(rm, func(m *Mutation) { m.SetPrefs(Prefs{}) })
+	wantOSRoutes(t, rm)
+}
diff --git a/net/speedtest/speedtest.go b/net/speedtest/speedtest.go
index 8b887a8ef..4cd67a410 100644
--- a/net/speedtest/speedtest.go
+++ b/net/speedtest/speedtest.go
@@ -24,7 +24,7 @@ const (
 // conduct the test.
 type config struct {
 	Version      int           `json:"version"`
-	TestDuration time.Duration `json:"time,format:nano"`
+	TestDuration time.Duration `json:"time"` // int64 nanoseconds; no jsonv2 format tag (tailscale/tailscale#20528)
 	Direction    Direction     `json:"direction"`
 }
 
diff --git a/net/stun/stun.go b/net/stun/stun.go
index 7d75e79b8..24c11e147 100644
--- a/net/stun/stun.go
+++ b/net/stun/stun.go
@@ -211,8 +211,8 @@ func ParseResponse(b []byte) (tID TxID, addr netip.AddrPort, err error) {
 	var fallbackAddr netip.AddrPort
 
 	// Read through the attributes.
-	// The the addr+port reported by XOR-MAPPED-ADDRESS
-	// as the canonical value. If the attribute is not
+	// The addr+port reported by XOR-MAPPED-ADDRESS
+	// is the canonical value. If the attribute is not
 	// present but the STUN server responds with
 	// MAPPED-ADDRESS we fall back to it.
 	if err := foreachAttr(b, func(attrType uint16, attr []byte) error {
diff --git a/net/traffic/traffic.go b/net/traffic/traffic.go
new file mode 100644
index 000000000..c6ef7e19d
--- /dev/null
+++ b/net/traffic/traffic.go
@@ -0,0 +1,134 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package traffic contains helpers for evaluating traffic steering scores and
+// picking appropriate nodes.
+package traffic
+
+import (
+	"cmp"
+	"encoding/binary"
+	"hash/fnv"
+	"iter"
+	"maps"
+	"slices"
+
+	"tailscale.com/tailcfg"
+	"tailscale.com/util/mak"
+)
+
+// Score is a node’s traffic score, where any int could be a valid score.
+// A higher traffic score suggests that the client should prefer that peer
+// over one with a lower traffic score.
+type Score int
+
+// Scores is a memoization cache for the traffic scores of the current node’s peers.
+type Scores struct {
+	self tailcfg.NodeID
+	hash NodeHasher
+
+	scores map[tailcfg.NodeID]Score
+}
+
+// ScoresFor returns a new [Scores] cache for the current node’s ID,
+// after scoring the peer nodes and adding these scores to the cache.
+func ScoresFor(self tailcfg.NodeID, peers []tailcfg.NodeView) Scores {
+	ss := Scores{
+		self: self,
+		hash: MakeRendezvousHasher(self),
+	}
+	ss.ScorePeers(peers)
+	return ss
+}
+
+// IsValid reports whether ss has been initialized with the current node ID.
+func (ss Scores) IsValid() bool {
+	return !ss.self.IsZero()
+}
+
+// Score scores the given peer node and returns it after adding the score to the cache.
+func (ss *Scores) Score(n tailcfg.NodeView) Score {
+	id := n.ID()
+	if s, ok := ss.scores[id]; ok {
+		return s
+	}
+
+	var s Score
+	if hi := n.Hostinfo(); hi.Valid() {
+		if loc := hi.Location(); loc.Valid() {
+			s = Score(loc.Priority())
+		}
+	}
+	mak.Set(&ss.scores, id, s)
+	return s
+}
+
+// ScorePeers scores the peer nodes and adds these scores to the cache.
+func (ss *Scores) ScorePeers(peers []tailcfg.NodeView) {
+	if len(peers) == 0 {
+		return
+	}
+	if ss.scores == nil {
+		ss.scores = make(map[tailcfg.NodeID]Score, len(peers))
+	}
+	for _, n := range peers {
+		ss.Score(n)
+	}
+}
+
+// All returns an iterator over the scores for every peer in the cache.
+// The iteration order is not specified and is not guaranteed to be the same
+// from one call to the next.
+func (ss Scores) All() iter.Seq2[tailcfg.NodeID, Score] {
+	return maps.All(ss.scores)
+}
+
+// SortNodes sorts the slice of nodes in descending order of [Scores.Score],
+// using rendezvous hashing to break ties when both nodes have the same score.
+// After sorting, the zeroth element is the preferred node.
+func (ss Scores) SortNodes(nodes []tailcfg.NodeView) {
+	slices.SortFunc(nodes, func(a, b tailcfg.NodeView) int {
+		c := cmp.Compare(ss.Score(b), ss.Score(a)) // Highest score first.
+		if c == 0 {
+			return ss.hash.Compare(b.ID(), a.ID()) // Descending order.
+		}
+		return c
+	})
+}
+
+// NodeHasher returns a 64-bit hash of a node ID.
+type NodeHasher func(tailcfg.NodeID) uint64
+
+// MakeRendezvousHasher returns a function that hashes a node ID to a uint64.
+// https://en.wikipedia.org/wiki/Rendezvous_hashing
+func MakeRendezvousHasher(seed tailcfg.NodeID) NodeHasher {
+	en := binary.BigEndian
+	return func(n tailcfg.NodeID) uint64 {
+		var b [16]byte
+		en.PutUint64(b[:], uint64(seed))
+		en.PutUint64(b[8:], uint64(n))
+
+		// FNV-1a is more modern and distributes bits more evenly,
+		// so it is recommended by the designers.
+		//
+		// Note that we don’t use a global hasher and h.Reset
+		// because this closure could be called concurrently.
+		// This is cheap because hash/fnv doesn’t need to allocate.
+		h := fnv.New64a()
+		h.Write(b[:])
+		return h.Sum64()
+	}
+}
+
+// Compare compares the node ID hashes of peers a and b, using the same convention as [cmp.Compare].
+// Since h is seeded with the current node’s ID, the ordering between a and b will remain stable
+// for this node; but the order may flip for when h is seeded for another node.
+// This function should return zero, if and only if a and b have the same node ID.
+func (h NodeHasher) Compare(a, b tailcfg.NodeID) int {
+	c := cmp.Compare(h(a), h(b))
+	if c == 0 {
+		// In the unlikely event of a hash collision, compare the actual IDs.
+		return cmp.Compare(a, b)
+	}
+	return c
+}
diff --git a/net/traffic/traffic_test.go b/net/traffic/traffic_test.go
new file mode 100644
index 000000000..4f0cbbf90
--- /dev/null
+++ b/net/traffic/traffic_test.go
@@ -0,0 +1,214 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package traffic_test
+
+import (
+	"maps"
+	"math/rand/v2"
+	"slices"
+	"testing"
+
+	gocmp "github.com/google/go-cmp/cmp"
+	"tailscale.com/net/traffic"
+	"tailscale.com/tailcfg"
+)
+
+// WantScores is a convenience alias for the type of [traffic.Score.scores].
+type wantScores = map[tailcfg.NodeID]traffic.Score
+
+var scoresCases = []struct {
+	name  string
+	peers []*tailcfg.Node
+	want  wantScores
+}{
+	{
+		name:  "none",
+		peers: nil,
+		want:  wantScores{},
+	},
+	{
+		name: "no-scores",
+		peers: []*tailcfg.Node{
+			{ID: 37},
+			{ID: 42},
+		},
+		want: wantScores{
+			37: 0,
+			42: 0,
+		},
+	},
+	{
+		name: "mixed-scores",
+		peers: []*tailcfg.Node{
+			{ID: 37},
+			{
+				ID: 42,
+				Hostinfo: (&tailcfg.Hostinfo{
+					Location: &tailcfg.Location{Priority: 1},
+				}).View(),
+			},
+		},
+		want: wantScores{
+			37: 0,
+			42: 1,
+		},
+	},
+}
+
+func TestScoreOne(t *testing.T) {
+	for _, tc := range scoresCases {
+		if len(tc.peers) == 0 {
+			continue
+		}
+		t.Run(tc.name, func(t *testing.T) {
+			selfID := tailcfg.NodeID(1)
+			ss := traffic.ScoresFor(selfID, nil)
+			for _, n := range tc.peers {
+				want := tc.want[n.ID]
+				score := ss.Score(n.View())
+				if score != want {
+					t.Errorf("initial Score for nodeid:%d: score %d, want %d", n.ID, score, want)
+				}
+				score = ss.Score(n.View())
+				if score != want {
+					t.Errorf("subsequent Score for nodeid:%d: score %d, want %d", n.ID, score, want)
+				}
+			}
+			got := maps.Collect(ss.All())
+			if diff := gocmp.Diff(tc.want, got); diff != "" {
+				t.Errorf("-want +got:\n%s", diff)
+			}
+		})
+	}
+}
+
+func TestScoreMany(t *testing.T) {
+	for _, tc := range scoresCases {
+		t.Run(tc.name, func(t *testing.T) {
+			selfID := tailcfg.NodeID(1)
+			var peers []tailcfg.NodeView
+			for _, n := range tc.peers {
+				peers = append(peers, n.View())
+			}
+
+			t.Run("ScoresFor", func(t *testing.T) {
+				ss := traffic.ScoresFor(selfID, peers)
+				got := maps.Collect(ss.All())
+				if diff := gocmp.Diff(tc.want, got); diff != "" {
+					t.Errorf("-want +got:\n%s", diff)
+				}
+			})
+
+			t.Run("ScorePeers", func(t *testing.T) {
+				ss := traffic.ScoresFor(selfID, nil)
+				ss.ScorePeers(peers)
+				got := maps.Collect(ss.All())
+				if diff := gocmp.Diff(tc.want, got); diff != "" {
+					t.Errorf("-want +got:\n%s", diff)
+				}
+			})
+		})
+	}
+}
+
+func FuzzNodeHasherCompare(f *testing.F) {
+	for _, seed := range [][]uint64{
+		{0, 0, 0},
+		{1, 1, 1},
+		{1, 10, 11},
+		{1, 11, 10},
+		{2, 10, 11},
+	} {
+		selfID, aID, bID := seed[0], seed[1], seed[2]
+		f.Add(selfID, aID, bID)
+	}
+	f.Fuzz(func(t *testing.T, selfID, aID, bID uint64) {
+		t.Logf("selfID %d, aID %d, bID %d", selfID, aID, bID)
+		h := traffic.MakeRendezvousHasher(tailcfg.NodeID(selfID))
+		a, b := tailcfg.NodeID(aID), tailcfg.NodeID(bID)
+		c := h.Compare(a, b)
+		if c == 0 && a != b {
+			t.Fatalf("got %d: expected different hashes because a ≠ b, ", c)
+		}
+		if cc := h.Compare(a, b); c != cc {
+			t.Fatalf("c %d, cc %d: expected matching values", c, cc)
+		}
+		if d := h.Compare(b, a); c != -d {
+			t.Fatalf("c %d, d %d: expected inverse values", c, d)
+		}
+	})
+}
+
+// FuzzSortNodes tests that nodes are sorted such that every node
+// with an equal score has an equal chance of being first.
+func FuzzSortNodes(f *testing.F) {
+	nodeIDs := func(nodes []tailcfg.NodeView) []tailcfg.NodeID {
+		nids := make([]tailcfg.NodeID, len(nodes))
+		for i, n := range nodes {
+			nids[i] = n.ID()
+		}
+		return nids
+	}
+
+	for _, seed := range [][]uint64{
+		{0, 0},
+		{1, 2},
+		{37, 42},
+		{5376970906336561236, 2417489263451880030},
+	} {
+		f.Add(seed[0], seed[1])
+	}
+	f.Fuzz(func(t *testing.T, seed1, seed2 uint64) {
+		t.Logf("using random seeds %d %d", seed1, seed2)
+		rnd := rand.New(rand.NewPCG(seed1, seed2))
+
+		wantScore := traffic.Score(rnd.IntN(2000))
+
+		// Create a reasonably large tailnet, between 20 and 40 nodes.
+		// If the number of nodes is too small, the chances of one node
+		// getting ranked best becomes non-trivial.
+		nodes := make([]tailcfg.NodeView, rnd.IntN(20)+20)
+		for i := range len(nodes) {
+			n := tailcfg.Node{
+				ID: tailcfg.NodeID(rnd.Int64()),
+				Hostinfo: (&tailcfg.Hostinfo{
+					Location: &tailcfg.Location{
+						Priority: int(wantScore),
+					},
+				}).View(),
+			}
+			nodes[i] = n.View()
+		}
+		t.Logf("node ids: %v", nodeIDs(nodes))
+
+		// All scores should be the same.
+		ss := traffic.ScoresFor(nodes[0].ID(), nodes)
+		for _, n := range nodes {
+			s := ss.Score(n)
+			if s != wantScore {
+				t.Errorf("%s: score %d, want %d", n.ID(), s, wantScore)
+			}
+		}
+
+		// Sort nodes from the point-of-view of each node and ensure that
+		// every node is equally represented by ensuring one node isn’t
+		// sorted highest too often.
+		best := make(map[tailcfg.NodeID][]tailcfg.NodeID, len(nodes))
+		for i := range len(nodes) {
+			peers := slices.Clone(nodes)
+			selfID := peers[i].ID()
+			ss := traffic.ScoresFor(selfID, peers)
+			ss.SortNodes(peers)
+			t.Logf("self %s, sorted %v", selfID, nodeIDs(peers))
+			bestID := peers[0].ID()
+			best[bestID] = append(best[bestID], selfID)
+		}
+		for nid, selfIDs := range best {
+			if count := len(selfIDs); count > len(nodes)/2 {
+				t.Errorf("%s is best too frequently: %d", nid, selfIDs)
+				t.Fatalf("best map: %v", best)
+			}
+		}
+	})
+}
diff --git a/net/tsaddr/tsaddr.go b/net/tsaddr/tsaddr.go
index 1eac9eb77..52f9d4d11 100644
--- a/net/tsaddr/tsaddr.go
+++ b/net/tsaddr/tsaddr.go
@@ -7,6 +7,7 @@ package tsaddr
 import (
 	"encoding/binary"
 	"errors"
+	"iter"
 	"net/netip"
 	"slices"
 	"sync"
@@ -69,6 +70,7 @@ const (
 // IsTailscaleIP reports whether IP is an IP address in a range that
 // Tailscale assigns from.
 func IsTailscaleIP(ip netip.Addr) bool {
+	ip = ip.Unmap()
 	if ip.Is4() {
 		return IsTailscaleIPv4(ip)
 	}
@@ -77,6 +79,7 @@ func IsTailscaleIP(ip netip.Addr) bool {
 
 // IsTailscaleIPv4 reports whether an IPv4 IP is an IP address that
 // Tailscale assigns from.
+// It will always return false if ip is an "IPv4-mapped IPv6 address".
 func IsTailscaleIPv4(ip netip.Addr) bool {
 	return CGNATRange().Contains(ip) && !ChromeOSVMRange().Contains(ip)
 }
@@ -317,3 +320,24 @@ func MapVia(siteID uint32, v4 netip.Prefix) (via netip.Prefix, err error) {
 	copy(a[12:], ip4a[:])
 	return netip.PrefixFrom(netip.AddrFrom16(a), v4.Bits()+64+32), nil
 }
+
+// FirstTailscaleAddrs returns the first Tailscale IPv4 address and
+// the first Tailscale IPv6 address among the addresses of addrs'
+// prefixes, if any. The addrs sequence is typically a node's own
+// address list, either a slice (via [slices.All]) or a view (via
+// [views.Slice.All]).
+func FirstTailscaleAddrs(addrs iter.Seq2[int, netip.Prefix]) (a4, a6 netip.Addr) {
+	for _, pfx := range addrs {
+		a := pfx.Addr()
+		switch {
+		case a.Is4() && !a4.IsValid() && IsTailscaleIP(a):
+			a4 = a
+		case a.Is6() && !a6.IsValid() && IsTailscaleIP(a):
+			a6 = a
+		}
+		if a4.IsValid() && a6.IsValid() {
+			break
+		}
+	}
+	return a4, a6
+}
diff --git a/net/tsaddr/tsaddr_test.go b/net/tsaddr/tsaddr_test.go
index ac5a07fff..fa88f3351 100644
--- a/net/tsaddr/tsaddr_test.go
+++ b/net/tsaddr/tsaddr_test.go
@@ -5,6 +5,7 @@ package tsaddr
 
 import (
 	"net/netip"
+	"slices"
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
@@ -249,6 +250,12 @@ func TestIsTailscaleIPv4(t *testing.T) {
 			in:   netip.MustParseAddr("100.115.92.157"),
 			want: false,
 		},
+		{
+			// IsTailscaleIPv4 does not unmap, so an IPv4-mapped IPv6 form of a
+			// CGNAT address is not an IPv4 address and must return false.
+			in:   netip.AddrFrom16(netip.MustParseAddr("100.67.19.57").As16()),
+			want: false,
+		},
 	}
 	for _, tt := range tests {
 		if got := IsTailscaleIPv4(tt.in); got != tt.want {
@@ -283,6 +290,16 @@ func TestIsTailscaleIP(t *testing.T) {
 			in:   netip.MustParseAddr("100.115.92.157"),
 			want: false,
 		},
+		{
+			// IPv4-mapped IPv6 form of a CGNAT address is still a Tailscale IP.
+			in:   netip.MustParseAddr("::ffff:100.67.19.57"),
+			want: true,
+		},
+		{
+			// IPv4-mapped IPv6 form of a non-Tailscale address.
+			in:   netip.MustParseAddr("::ffff:10.10.10.10"),
+			want: false,
+		},
 	}
 	for _, tt := range tests {
 		if got := IsTailscaleIP(tt.in); got != tt.want {
@@ -290,3 +307,27 @@ func TestIsTailscaleIP(t *testing.T) {
 		}
 	}
 }
+
+func TestFirstTailscaleAddrs(t *testing.T) {
+	pfx := func(s string) netip.Prefix { return netip.MustParsePrefix(s) }
+	addr := func(s string) netip.Addr { return netip.MustParseAddr(s) }
+	tests := []struct {
+		name  string
+		in    []netip.Prefix
+		want4 netip.Addr
+		want6 netip.Addr
+	}{
+		{"empty", nil, netip.Addr{}, netip.Addr{}},
+		{"both", []netip.Prefix{pfx("100.64.0.1/32"), pfx("fd7a:115c:a1e0::1/128")}, addr("100.64.0.1"), addr("fd7a:115c:a1e0::1")},
+		{"first-of-each", []netip.Prefix{pfx("100.64.0.1/32"), pfx("100.64.0.2/32"), pfx("fd7a:115c:a1e0::1/128"), pfx("fd7a:115c:a1e0::2/128")}, addr("100.64.0.1"), addr("fd7a:115c:a1e0::1")},
+		{"non-tailscale-skipped", []netip.Prefix{pfx("192.168.1.1/32"), pfx("2001:db8::1/128"), pfx("100.64.0.9/32")}, addr("100.64.0.9"), netip.Addr{}},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got4, got6 := FirstTailscaleAddrs(slices.All(tt.in))
+			if got4 != tt.want4 || got6 != tt.want6 {
+				t.Errorf("FirstTailscaleAddrs = %v, %v; want %v, %v", got4, got6, tt.want4, tt.want6)
+			}
+		})
+	}
+}
diff --git a/net/tsdial/dnsmap.go b/net/tsdial/dnsmap.go
index d7204463f..4c2815966 100644
--- a/net/tsdial/dnsmap.go
+++ b/net/tsdial/dnsmap.go
@@ -4,80 +4,21 @@
 package tsdial
 
 import (
-	"context"
 	"errors"
 	"fmt"
 	"net"
-	"net/netip"
 	"strconv"
 	"strings"
-
-	"tailscale.com/types/netmap"
-	"tailscale.com/util/dnsname"
 )
 
-// dnsMap maps MagicDNS names (both base + FQDN) to their first IP.
-// It must not be mutated once created.
-//
-// Example keys are "foo.domain.tld.beta.tailscale.net" and "foo",
-// both without trailing dots, and both always lowercase.
-type dnsMap map[string]netip.Addr
-
-// canonMapKey canonicalizes its input s to be a dnsMap map key.
+// canonMapKey canonicalizes its input s to be a MagicDNS lookup key:
+// lowercase with no trailing dot.
 func canonMapKey(s string) string {
 	return strings.ToLower(strings.TrimSuffix(s, "."))
 }
 
-func dnsMapFromNetworkMap(nm *netmap.NetworkMap) dnsMap {
-	if nm == nil {
-		return nil
-	}
-	ret := make(dnsMap)
-	suffix := nm.MagicDNSSuffix()
-	have4 := false
-	addrs := nm.GetAddresses()
-	if name := nm.SelfName(); name != "" && addrs.Len() > 0 {
-		ip := addrs.At(0).Addr()
-		ret[canonMapKey(name)] = ip
-		if dnsname.HasSuffix(name, suffix) {
-			ret[canonMapKey(dnsname.TrimSuffix(name, suffix))] = ip
-		}
-		for _, p := range addrs.All() {
-			if p.Addr().Is4() {
-				have4 = true
-			}
-		}
-	}
-	for _, p := range nm.Peers {
-		if p.Name() == "" {
-			continue
-		}
-		for _, pfx := range p.Addresses().All() {
-			ip := pfx.Addr()
-			if ip.Is4() && !have4 {
-				continue
-			}
-			ret[canonMapKey(p.Name())] = ip
-			if dnsname.HasSuffix(p.Name(), suffix) {
-				ret[canonMapKey(dnsname.TrimSuffix(p.Name(), suffix))] = ip
-			}
-			break
-		}
-	}
-	for _, rec := range nm.DNS.ExtraRecords {
-		if rec.Type != "" {
-			continue
-		}
-		ip, err := netip.ParseAddr(rec.Value)
-		if err != nil {
-			continue
-		}
-		ret[canonMapKey(rec.Name)] = ip
-	}
-	return ret
-}
-
-// errUnresolved is a sentinel error returned by dnsMap.resolveMemory.
+// errUnresolved is a sentinel error returned when a hostname is not
+// resolvable via MagicDNS.
 var errUnresolved = errors.New("address well formed but not resolved")
 
 func splitHostPort(addr string) (host string, port uint16, err error) {
@@ -91,30 +32,3 @@ func splitHostPort(addr string) (host string, port uint16, err error) {
 	}
 	return host, uint16(port16), nil
 }
-
-// Resolve resolves addr into an IP:port using first the MagicDNS contents
-// of m, else using the system resolver.
-//
-// The error is [exactly] errUnresolved if the addr is a name that isn't known
-// in the map.
-func (m dnsMap) resolveMemory(ctx context.Context, network, addr string) (_ netip.AddrPort, err error) {
-	host, port, err := splitHostPort(addr)
-	if err != nil {
-		// addr malformed or invalid port.
-		return netip.AddrPort{}, err
-	}
-	if ip, err := netip.ParseAddr(host); err == nil {
-		// addr was literal ip:port.
-		return netip.AddrPortFrom(ip, port), nil
-	}
-
-	// Host is not an IP, so assume it's a DNS name.
-
-	// Try MagicDNS first, otherwise a real DNS lookup.
-	ip := m[canonMapKey(host)]
-	if ip.IsValid() {
-		return netip.AddrPortFrom(ip, port), nil
-	}
-
-	return netip.AddrPort{}, errUnresolved
-}
diff --git a/net/tsdial/dnsmap_test.go b/net/tsdial/dnsmap_test.go
deleted file mode 100644
index b2a50fa0c..000000000
--- a/net/tsdial/dnsmap_test.go
+++ /dev/null
@@ -1,125 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-package tsdial
-
-import (
-	"net/netip"
-	"reflect"
-	"testing"
-
-	"tailscale.com/tailcfg"
-	"tailscale.com/types/netmap"
-)
-
-func nodeViews(v []*tailcfg.Node) []tailcfg.NodeView {
-	nv := make([]tailcfg.NodeView, len(v))
-	for i, n := range v {
-		nv[i] = n.View()
-	}
-	return nv
-}
-
-func TestDNSMapFromNetworkMap(t *testing.T) {
-	pfx := netip.MustParsePrefix
-	ip := netip.MustParseAddr
-	tests := []struct {
-		name string
-		nm   *netmap.NetworkMap
-		want dnsMap
-	}{
-		{
-			name: "self",
-			nm: &netmap.NetworkMap{
-				SelfNode: (&tailcfg.Node{
-					Name: "foo.tailnet.",
-					Addresses: []netip.Prefix{
-						pfx("100.102.103.104/32"),
-						pfx("100::123/128"),
-					},
-				}).View(),
-			},
-			want: dnsMap{
-				"foo":         ip("100.102.103.104"),
-				"foo.tailnet": ip("100.102.103.104"),
-			},
-		},
-		{
-			name: "self_and_peers",
-			nm: &netmap.NetworkMap{
-				SelfNode: (&tailcfg.Node{
-					Name: "foo.tailnet.",
-					Addresses: []netip.Prefix{
-						pfx("100.102.103.104/32"),
-						pfx("100::123/128"),
-					},
-				}).View(),
-				Peers: []tailcfg.NodeView{
-					(&tailcfg.Node{
-						Name: "a.tailnet",
-						Addresses: []netip.Prefix{
-							pfx("100.0.0.201/32"),
-							pfx("100::201/128"),
-						},
-					}).View(),
-					(&tailcfg.Node{
-						Name: "b.tailnet",
-						Addresses: []netip.Prefix{
-							pfx("100::202/128"),
-						},
-					}).View(),
-				},
-			},
-			want: dnsMap{
-				"foo":         ip("100.102.103.104"),
-				"foo.tailnet": ip("100.102.103.104"),
-				"a":           ip("100.0.0.201"),
-				"a.tailnet":   ip("100.0.0.201"),
-				"b":           ip("100::202"),
-				"b.tailnet":   ip("100::202"),
-			},
-		},
-		{
-			name: "self_has_v6_only",
-			nm: &netmap.NetworkMap{
-				SelfNode: (&tailcfg.Node{
-					Name: "foo.tailnet.",
-					Addresses: []netip.Prefix{
-						pfx("100::123/128"),
-					},
-				}).View(),
-				Peers: nodeViews([]*tailcfg.Node{
-					{
-						Name: "a.tailnet",
-						Addresses: []netip.Prefix{
-							pfx("100.0.0.201/32"),
-							pfx("100::201/128"),
-						},
-					},
-					{
-						Name: "b.tailnet",
-						Addresses: []netip.Prefix{
-							pfx("100::202/128"),
-						},
-					},
-				}),
-			},
-			want: dnsMap{
-				"foo":         ip("100::123"),
-				"foo.tailnet": ip("100::123"),
-				"a":           ip("100::201"),
-				"a.tailnet":   ip("100::201"),
-				"b":           ip("100::202"),
-				"b.tailnet":   ip("100::202"),
-			},
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := dnsMapFromNetworkMap(tt.nm)
-			if !reflect.DeepEqual(got, tt.want) {
-				t.Errorf("mismatch:\n got %v\nwant %v\n", got, tt.want)
-			}
-		})
-	}
-}
diff --git a/net/tsdial/tsdial.go b/net/tsdial/tsdial.go
index ebbafa52b..ea2ddc632 100644
--- a/net/tsdial/tsdial.go
+++ b/net/tsdial/tsdial.go
@@ -12,6 +12,7 @@ import (
 	"net/http"
 	"net/netip"
 	"runtime"
+	"slices"
 	"strings"
 	"sync"
 	"sync/atomic"
@@ -19,17 +20,18 @@ import (
 	"time"
 
 	"github.com/gaissmai/bart"
+	"tailscale.com/envknob"
 	"tailscale.com/feature"
 	"tailscale.com/feature/buildfeatures"
 	"tailscale.com/net/dnscache"
 	"tailscale.com/net/netknob"
 	"tailscale.com/net/netmon"
 	"tailscale.com/net/netns"
+	"tailscale.com/net/netutil"
 	"tailscale.com/net/netx"
 	"tailscale.com/net/tsaddr"
 	"tailscale.com/syncs"
 	"tailscale.com/types/logger"
-	"tailscale.com/types/netmap"
 	"tailscale.com/util/clientmetric"
 	"tailscale.com/util/eventbus"
 	"tailscale.com/util/mak"
@@ -87,9 +89,16 @@ type Dialer struct {
 
 	routes atomic.Pointer[bart.Table[bool]] // or nil if UserDial should not use routes. `true` indicates routes that point into the Tailscale interface
 
+	// resolveMagicDNS, if non-nil, resolves a MagicDNS hostname (short
+	// name or FQDN, without trailing dot, lowercased) to an IP address.
+	// The network parameter ("tcp", "tcp4", "tcp6", "udp", "udp4",
+	// "udp6") constrains the address family of the result. The normal
+	// implementation is [ipnlocal.LocalBackend.resolveMagicDNS],
+	// installed at construction time. It is read without holding mu.
+	resolveMagicDNS atomic.Pointer[func(hostname, network string) (_ netip.Addr, ok bool)]
+
 	mu               syncs.Mutex
 	closed           bool
-	dns              dnsMap
 	tunName          string // tun device name
 	netMon           *netmon.Monitor
 	netMonUnregister func()
@@ -133,6 +142,12 @@ func (d *Dialer) TUNName() string {
 	return d.tunName
 }
 
+// ProbeLocks acquires and releases the dialer's internal mutex.
+func (d *Dialer) ProbeLocks() {
+	d.mu.Lock()
+	d.mu.Unlock()
+}
+
 // SetExitDNSDoH sets (or clears) the exit node DNS DoH server base URL to use.
 // The doh URL should contain the scheme, authority, and path, but without
 // a '?' and/or query parameters.
@@ -348,28 +363,55 @@ func (d *Dialer) PeerDialControlFunc() func(network, address string, c syscall.R
 	return peerDialControlFunc(d)
 }
 
-// SetNetMap sets the current network map and notably, the DNS names
-// in its DNS configuration.
-func (d *Dialer) SetNetMap(nm *netmap.NetworkMap) {
-	m := dnsMapFromNetworkMap(nm)
-
-	d.mu.Lock()
-	defer d.mu.Unlock()
-	d.dns = m
+// SetResolveMagicDNS installs a callback that resolves MagicDNS hostnames
+// to IP addresses for UserDial.
+func (d *Dialer) SetResolveMagicDNS(fn func(hostname, network string) (_ netip.Addr, ok bool)) {
+	if fn == nil {
+		d.resolveMagicDNS.Store(nil)
+		return
+	}
+	d.resolveMagicDNS.Store(&fn)
 }
 
-// userDialResolve resolves addr as if a user initiating the dial. (e.g. from a
-// SOCKS or HTTP outbound proxy)
-func (d *Dialer) userDialResolve(ctx context.Context, network, addr string) (netip.AddrPort, error) {
+// resolveAddr tries to resolve addr (a "host:port" string) via MagicDNS.
+// The network parameter ("tcp", "tcp4", "tcp6", etc.) constrains the
+// address family. It returns errUnresolved if the hostname is not a
+// known MagicDNS name.
+func (d *Dialer) resolveAddr(_ context.Context, network, addr string) (netip.AddrPort, error) {
+	host, port, err := splitHostPort(addr)
+	if err != nil {
+		return netip.AddrPort{}, err
+	}
+	if ip, err := netip.ParseAddr(host); err == nil {
+		return netip.AddrPortFrom(ip, port), nil
+	}
+	if fn := d.resolveMagicDNS.Load(); fn != nil {
+		if ip, ok := (*fn)(canonMapKey(host), network); ok {
+			return netip.AddrPortFrom(ip, port), nil
+		}
+	}
+	return netip.AddrPort{}, errUnresolved
+}
+
+// userDialResolveAll resolves addr as if a user initiating the dial.
+// (e.g. from a SOCKS or HTTP outbound proxy.)
+//
+// It returns all candidate addresses so that the caller can apply
+// happy eyeballs across address families. The returned slice is
+// non-empty on a nil-error return.
+func (d *Dialer) userDialResolveAll(ctx context.Context, network, addr string) ([]netip.AddrPort, error) {
 	d.mu.Lock()
-	dns := d.dns
 	exitDNSDoH := d.exitDNSDoHBase
 	d.mu.Unlock()
 
 	// MagicDNS or otherwise baked into the NetworkMap? Try that first.
-	ipp, err := dns.resolveMemory(ctx, network, addr)
+	// Tailnet names have one IP each, so there's nothing to race.
+	ipp, err := d.resolveAddr(ctx, network, addr)
 	if err != errUnresolved {
-		return ipp, err
+		if err != nil {
+			return nil, err
+		}
+		return []netip.AddrPort{ipp}, nil
 	}
 
 	// Otherwise, hit the network.
@@ -379,7 +421,7 @@ func (d *Dialer) userDialResolve(ctx context.Context, network, addr string) (net
 	host, port, err := splitHostPort(addr)
 	if err != nil {
 		// addr is malformed.
-		return netip.AddrPort{}, err
+		return nil, err
 	}
 
 	var r net.Resolver
@@ -396,16 +438,53 @@ func (d *Dialer) userDialResolve(ctx context.Context, network, addr string) (net
 	}
 
 	ips, err := r.LookupIP(ctx, ipNetOfNetwork(network), host)
+	if err != nil {
+		return nil, err
+	}
+	out := make([]netip.AddrPort, 0, len(ips))
+	for _, stdIP := range ips {
+		ip, ok := netip.AddrFromSlice(stdIP)
+		if !ok {
+			continue
+		}
+		out = append(out, netip.AddrPortFrom(ip.Unmap(), port))
+	}
+	if len(out) == 0 {
+		return nil, fmt.Errorf("DNS lookup returned no results for %q", host)
+	}
+	if debugPreferIPv6() {
+		slices.SortStableFunc(out, func(a, b netip.AddrPort) int {
+			a6 := a.Addr().Is6()
+			b6 := b.Addr().Is6()
+			if a6 == b6 {
+				return 0
+			}
+			if a6 {
+				return -1
+			}
+			return 1
+		})
+	}
+	return out, nil
+}
+
+// userDialResolve resolves addr and returns the first candidate.
+// It is for callers that don't perform happy-eyeballs (notably
+// [Dialer.UserDialPlan], which only needs to classify one IP).
+func (d *Dialer) userDialResolve(ctx context.Context, network, addr string) (netip.AddrPort, error) {
+	ipps, err := d.userDialResolveAll(ctx, network, addr)
 	if err != nil {
 		return netip.AddrPort{}, err
 	}
-	if len(ips) == 0 {
-		return netip.AddrPort{}, fmt.Errorf("DNS lookup returned no results for %q", host)
-	}
-	ip, _ := netip.AddrFromSlice(ips[0])
-	return netip.AddrPortFrom(ip.Unmap(), port), nil
+	return ipps[0], nil
 }
 
+// debugPreferIPv6 forces userDialResolveAll to sort AAAA results before
+// A results, reproducing the failure mode where a client on an IPv6-capable
+// host picks an unreachable AAAA address through an IPv4-only exit node.
+// Used by TestExitNodeV4Only to exercise the happy-eyeballs fallback.
+var debugPreferIPv6 = envknob.RegisterBool("TS_DEBUG_PREFER_IPV6_USERDIAL")
+
 // ipNetOfNetwork returns "ip", "ip4", or "ip6" corresponding
 // to the input value of "tcp", "tcp4", "udp6" etc network
 // names.
@@ -479,11 +558,33 @@ func (d *Dialer) SystemDial(ctx context.Context, network, addr string) (net.Conn
 
 // UserDial connects to the provided network address as if a user were
 // initiating the dial. (e.g. from a SOCKS or HTTP outbound proxy)
+//
+// For TCP, if the name resolves to multiple addresses, UserDial races
+// connect attempts across address families with a happy-eyeballs delay
+// and returns the first one that succeeds. This lets dual-stack names
+// work via an exit node whose egress is single-family without the
+// caller needing to know which family the exit node can reach.
 func (d *Dialer) UserDial(ctx context.Context, network, addr string) (net.Conn, error) {
-	ipp, err := d.userDialResolve(ctx, network, addr)
+	ipps, err := d.userDialResolveAll(ctx, network, addr)
 	if err != nil {
 		return nil, err
 	}
+
+	// Happy eyeballs is a no-op (and undefined) for UDP; there's no
+	// connect to race.
+	if len(ipps) == 1 || strings.HasPrefix(network, "udp") {
+		return d.dialOneUser(ctx, network, ipps[0])
+	}
+	// Family filtering for "tcp4"/"tcp6" is already handled by
+	// userDialResolveAll (via ipNetOfNetwork), so ipps only contains
+	// addresses of the requested family by this point.
+	return d.raceDialUser(ctx, ipps)
+}
+
+// dialOneUser dials ipp using the appropriate transport for a user
+// dial (netstack, peer dialer, system dialer, or std dialer) based
+// on what kind of address ipp is.
+func (d *Dialer) dialOneUser(ctx context.Context, network string, ipp netip.AddrPort) (net.Conn, error) {
 	if d.UseNetstackForIP != nil && d.UseNetstackForIP(ipp.Addr()) {
 		if d.NetstackDialTCP == nil || d.NetstackDialUDP == nil {
 			return nil, errors.New("Dialer not initialized correctly")
@@ -515,6 +616,51 @@ func (d *Dialer) UserDial(ctx context.Context, network, addr string) (net.Conn,
 	return stdDialer.DialContext(ctx, network, ipp.String())
 }
 
+// userDialFallbackDelay is the happy-eyeballs gap between starting
+// successive connect attempts. 300ms matches Go's net.Dialer default
+// and the value used by net/dnscache.
+const userDialFallbackDelay = 300 * time.Millisecond
+
+// raceDialUser races connect attempts across ipps with a happy-eyeballs
+// fallback delay, returning the first to succeed. Losers are cancelled
+// and any conns they produce are closed. If all fail, the first error
+// is returned.
+func (d *Dialer) raceDialUser(ctx context.Context, ipps []netip.AddrPort) (net.Conn, error) {
+	return netx.RaceDial(ctx, ipps,
+		func(ctx context.Context, network, address string) (net.Conn, error) {
+			return d.dialOneUser(ctx, network, netip.MustParseAddrPort(address))
+		},
+		userDialFallbackDelay,
+	)
+}
+
+// UserDialPlan resolves addr and reports whether the dialer would
+// handle it via Tailscale. If viaTailscale is false, the resolved
+// address is not a Tailscale route and the caller may dial it directly.
+//
+// Warning: there is a TOCTOU race if addr contains a DNS name and the
+// caller subsequently passes the same DNS name to [Dialer.UserDial], as DNS
+// may resolve differently the second time. Callers who want to only
+// dial over Tailscale should call [Dialer.UserDial] with the returned
+// ipp.String() (an IP:port) rather than the original DNS name.
+func (d *Dialer) UserDialPlan(ctx context.Context, network, addr string) (ipp netip.AddrPort, viaTailscale bool, err error) {
+	ipp, err = d.userDialResolve(ctx, network, addr)
+	if err != nil {
+		return netip.AddrPort{}, false, err
+	}
+	if d.UseNetstackForIP != nil && d.UseNetstackForIP(ipp.Addr()) {
+		return ipp, true, nil
+	}
+	if routes := d.routes.Load(); routes != nil {
+		isTailscaleRoute, _ := routes.Lookup(ipp.Addr())
+		return ipp, isTailscaleRoute, nil
+	}
+	if version.IsMacGUIVariant() && tsaddr.IsTailscaleIP(ipp.Addr()) {
+		return ipp, true, nil
+	}
+	return ipp, false, nil
+}
+
 // dialPeerAPI connects to a Tailscale peer's peerapi over TCP.
 //
 // network must a "tcp" type, and addr must be an ip:port. Name resolution
@@ -569,7 +715,7 @@ func (d *Dialer) PeerAPIHTTPClient() *http.Client {
 		panic("unreachable")
 	}
 	d.peerClientOnce.Do(func() {
-		t := http.DefaultTransport.(*http.Transport).Clone()
+		t := netutil.NewDefaultTransport()
 		t.Dial = nil
 		t.DialContext = d.dialPeerAPI
 		// Do not use the environment proxy for PeerAPI.
diff --git a/net/tsdial/tsdial_test.go b/net/tsdial/tsdial_test.go
new file mode 100644
index 000000000..c8868ab36
--- /dev/null
+++ b/net/tsdial/tsdial_test.go
@@ -0,0 +1,234 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package tsdial
+
+import (
+	"context"
+	"errors"
+	"net"
+	"net/netip"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/gaissmai/bart"
+)
+
+func TestUserDialPlan(t *testing.T) {
+	tests := []struct {
+		name           string
+		addr           string
+		routes         map[netip.Prefix]bool // nil means no routes configured
+		useNetstackFor func(netip.Addr) bool // nil means not set
+		wantVia        bool
+		wantAddr       netip.AddrPort
+	}{
+		{
+			name:     "loopback_no_routes",
+			addr:     "127.0.0.1:8080",
+			wantVia:  false,
+			wantAddr: netip.MustParseAddrPort("127.0.0.1:8080"),
+		},
+		{
+			name:     "loopback_v6_no_routes",
+			addr:     "[::1]:8080",
+			wantVia:  false,
+			wantAddr: netip.MustParseAddrPort("[::1]:8080"),
+		},
+		{
+			name: "tailscale_ip_in_routes",
+			addr: "100.64.1.1:22",
+			routes: map[netip.Prefix]bool{
+				netip.MustParsePrefix("100.64.0.0/10"): true,
+			},
+			wantVia:  true,
+			wantAddr: netip.MustParseAddrPort("100.64.1.1:22"),
+		},
+		{
+			name: "non_tailscale_ip_in_local_routes",
+			addr: "10.0.0.5:80",
+			routes: map[netip.Prefix]bool{
+				netip.MustParsePrefix("100.64.0.0/10"): true,
+				netip.MustParsePrefix("10.0.0.0/8"):    false, // local route
+			},
+			wantVia:  false,
+			wantAddr: netip.MustParseAddrPort("10.0.0.5:80"),
+		},
+		{
+			name: "loopback_with_routes_configured",
+			addr: "127.0.0.1:3000",
+			routes: map[netip.Prefix]bool{
+				netip.MustParsePrefix("100.64.0.0/10"): true,
+			},
+			wantVia:  false,
+			wantAddr: netip.MustParseAddrPort("127.0.0.1:3000"),
+		},
+		{
+			name: "netstack_for_ip",
+			addr: "100.100.100.100:53",
+			useNetstackFor: func(ip netip.Addr) bool {
+				return ip == netip.MustParseAddr("100.100.100.100")
+			},
+			wantVia:  true,
+			wantAddr: netip.MustParseAddrPort("100.100.100.100:53"),
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			d := &Dialer{}
+			if tt.routes != nil {
+				rt := &bart.Table[bool]{}
+				for pfx, v := range tt.routes {
+					rt.Insert(pfx, v)
+				}
+				d.routes.Store(rt)
+			}
+			d.UseNetstackForIP = tt.useNetstackFor
+
+			ipp, viaTailscale, err := d.UserDialPlan(context.Background(), "tcp", tt.addr)
+			if err != nil {
+				t.Fatalf("UserDialPlan: %v", err)
+			}
+			if viaTailscale != tt.wantVia {
+				t.Errorf("viaTailscale = %v, want %v", viaTailscale, tt.wantVia)
+			}
+			if ipp != tt.wantAddr {
+				t.Errorf("addr = %v, want %v", ipp, tt.wantAddr)
+			}
+		})
+	}
+}
+
+// TestRaceDialUserFallback covers the core happy-eyeballs scenario:
+// the first family (e.g. AAAA via an IPv4-only exit node) fails to
+// connect, and the second family succeeds. The fallback delay should
+// not be required because the failing dial wakes the launcher via
+// failBoost.
+func TestRaceDialUserFallback(t *testing.T) {
+	v6 := netip.MustParseAddrPort("[2001:db8::1]:80")
+	v4 := netip.MustParseAddrPort("192.0.2.1:80")
+
+	var v4Calls, v6Calls atomic.Int32
+	d := &Dialer{
+		UseNetstackForIP: func(netip.Addr) bool { return true },
+		NetstackDialTCP: func(ctx context.Context, ipp netip.AddrPort) (net.Conn, error) {
+			if ipp.Addr().Is6() {
+				v6Calls.Add(1)
+				return nil, errors.New("simulated v6 unreachable")
+			}
+			v4Calls.Add(1)
+			c, _ := net.Pipe()
+			return c, nil
+		},
+		NetstackDialUDP: func(context.Context, netip.AddrPort) (net.Conn, error) {
+			t.Fatal("UDP dialer should not be called for TCP race")
+			return nil, nil
+		},
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	t0 := time.Now()
+	c, err := d.raceDialUser(ctx, []netip.AddrPort{v6, v4})
+	elapsed := time.Since(t0)
+	if err != nil {
+		t.Fatalf("raceDialUser: %v", err)
+	}
+	defer c.Close()
+
+	if v6Calls.Load() != 1 {
+		t.Errorf("v6 dial attempts = %d, want 1", v6Calls.Load())
+	}
+	if v4Calls.Load() != 1 {
+		t.Errorf("v4 dial attempts = %d, want 1", v4Calls.Load())
+	}
+	// We allow up to the fallback delay; with failBoost the v4 attempt
+	// should kick off as soon as v6 fails, well under the timer.
+	if elapsed >= userDialFallbackDelay {
+		t.Errorf("race took %v; expected failBoost to short-circuit the %v delay",
+			elapsed, userDialFallbackDelay)
+	}
+}
+
+// TestRaceDialUserAllFail verifies that when every candidate fails,
+// raceDialUser returns the first error rather than hanging.
+func TestRaceDialUserAllFail(t *testing.T) {
+	ipps := []netip.AddrPort{
+		netip.MustParseAddrPort("[2001:db8::1]:80"),
+		netip.MustParseAddrPort("192.0.2.1:80"),
+	}
+	d := &Dialer{
+		UseNetstackForIP: func(netip.Addr) bool { return true },
+		NetstackDialTCP: func(_ context.Context, ipp netip.AddrPort) (net.Conn, error) {
+			return nil, errors.New("nope: " + ipp.String())
+		},
+		NetstackDialUDP: func(context.Context, netip.AddrPort) (net.Conn, error) { return nil, nil },
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	_, err := d.raceDialUser(ctx, ipps)
+	if err == nil {
+		t.Fatal("raceDialUser returned nil error; want error")
+	}
+}
+
+// TestRaceDialUserCancelsLosers verifies that once one dial succeeds,
+// any other in-flight dial is cancelled and any conn it eventually
+// produces is closed (rather than leaked).
+func TestRaceDialUserCancelsLosers(t *testing.T) {
+	v6 := netip.MustParseAddrPort("[2001:db8::1]:80")
+	v4 := netip.MustParseAddrPort("192.0.2.1:80")
+
+	// v6 blocks until its context is cancelled, then returns a conn we
+	// must verify is closed.
+	closed := make(chan struct{})
+	d := &Dialer{
+		UseNetstackForIP: func(netip.Addr) bool { return true },
+		NetstackDialTCP: func(ctx context.Context, ipp netip.AddrPort) (net.Conn, error) {
+			if ipp.Addr().Is6() {
+				<-ctx.Done()
+				a, b := net.Pipe()
+				go func() {
+					<-closed
+					b.Close()
+				}()
+				return &closingPipeConn{Conn: a, closed: closed}, nil
+			}
+			c, _ := net.Pipe()
+			return c, nil
+		},
+		NetstackDialUDP: func(context.Context, netip.AddrPort) (net.Conn, error) { return nil, nil },
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	c, err := d.raceDialUser(ctx, []netip.AddrPort{v6, v4})
+	if err != nil {
+		t.Fatalf("raceDialUser: %v", err)
+	}
+	defer c.Close()
+
+	select {
+	case <-closed:
+	case <-time.After(2 * time.Second):
+		t.Fatal("loser conn was not closed within 2s")
+	}
+}
+
+type closingPipeConn struct {
+	net.Conn
+	closed chan struct{}
+}
+
+func (c *closingPipeConn) Close() error {
+	select {
+	case <-c.closed:
+		// already closed
+	default:
+		close(c.closed)
+	}
+	return c.Conn.Close()
+}
diff --git a/net/tstun/wrap.go b/net/tstun/wrap.go
index 1b28eb157..e63dccd49 100644
--- a/net/tstun/wrap.go
+++ b/net/tstun/wrap.go
@@ -9,7 +9,6 @@ import (
 	"io"
 	"net/netip"
 	"os"
-	"reflect"
 	"runtime"
 	"slices"
 	"strings"
@@ -28,6 +27,7 @@ import (
 	"tailscale.com/feature/buildfeatures"
 	"tailscale.com/net/packet"
 	"tailscale.com/net/packet/checksum"
+	"tailscale.com/net/routemanager"
 	"tailscale.com/net/tsaddr"
 	"tailscale.com/syncs"
 	"tailscale.com/tstime/mono"
@@ -111,8 +111,7 @@ type Wrapper struct {
 	// you might need to add an align64 field here.
 	lastActivityAtomic mono.Time // time of last send or receive
 
-	destIPActivity syncs.AtomicValue[map[netip.Addr]func()]
-	discoKey       syncs.AtomicValue[key.DiscoPublic]
+	discoKey syncs.AtomicValue[key.DiscoPublic]
 
 	// timeNow, if non-nil, will be used to obtain the current time.
 	timeNow func() time.Time
@@ -204,6 +203,11 @@ type Wrapper struct {
 	// false otherwise.
 	OnICMPEchoResponseReceived func(*packet.Parsed) bool
 
+	// OnUnmappedTransitIPMessage, if non-nil, is called when a TSMP message is
+	// received indicating that a packet was rejected by a connector due to a
+	// missing transit IP->real IP mapping.
+	OnUnmappedTransitIPMessage func(packet.TailscaleRejectedHeader)
+
 	// PeerAPIPort, if non-nil, returns the peerapi port that's
 	// running for the given IP address.
 	PeerAPIPort func(netip.Addr) (port uint16, ok bool)
@@ -340,16 +344,6 @@ func (t *Wrapper) now() time.Time {
 	return time.Now()
 }
 
-// SetDestIPActivityFuncs sets a map of funcs to run per packet
-// destination (the map keys).
-//
-// The map ownership passes to the Wrapper. It must be non-nil.
-func (t *Wrapper) SetDestIPActivityFuncs(m map[netip.Addr]func()) {
-	if buildfeatures.HasLazyWG {
-		t.destIPActivity.Store(m)
-	}
-}
-
 // SetDiscoKey sets the current discovery key.
 //
 // It is only used for filtering out bogus traffic when network
@@ -571,31 +565,9 @@ func (pc *peerConfigTable) dnat(p *packet.Parsed) {
 	}
 }
 
-// findV4 returns the first Tailscale IPv4 address in addrs.
-func findV4(addrs []netip.Prefix) netip.Addr {
-	for _, ap := range addrs {
-		a := ap.Addr()
-		if a.Is4() && tsaddr.IsTailscaleIP(a) {
-			return a
-		}
-	}
-	return netip.Addr{}
-}
-
-// findV6 returns the first Tailscale IPv6 address in addrs.
-func findV6(addrs []netip.Prefix) netip.Addr {
-	for _, ap := range addrs {
-		a := ap.Addr()
-		if a.Is6() && tsaddr.IsTailscaleIP(a) {
-			return a
-		}
-	}
-	return netip.Addr{}
-}
-
-// peerConfigTable contains configuration for individual peers and related
-// information necessary to perform peer-specific operations.  It should be
-// treated as immutable.
+// peerConfigTable contains the per-peer route attributes and related
+// information necessary to perform peer-specific operations. It should
+// be treated as immutable.
 //
 // The nil value is a valid configuration.
 type peerConfigTable struct {
@@ -608,57 +580,17 @@ type peerConfigTable struct {
 	// inbound packet is IPv6.
 	nativeAddr4, nativeAddr6 netip.Addr
 
-	// byIP contains configuration for each peer, indexed by a peer's IP
-	// address(es).
-	byIP bart.Table[*peerConfig]
-
-	// masqAddrCounts is a count of peers by MasqueradeAsIP.
-	// TODO? for logging
-	masqAddrCounts map[netip.Addr]int
-}
-
-// peerConfig is the configuration for a single peer.
-type peerConfig struct {
-	// dstMasqAddr{4,6} are the addresses that should be used as the
-	// source address when masquerading packets to this peer (i.e.
-	// SNAT). If an address is not valid, the packet should not be
-	// masqueraded for that address family.
-	dstMasqAddr4 netip.Addr
-	dstMasqAddr6 netip.Addr
-
-	// jailed is whether this peer is "jailed" (i.e. is restricted from being
-	// able to initiate connections to this node). This is the case for shared
-	// nodes.
-	jailed bool
+	// byIP maps a peer's IP addresses and routed prefixes to the
+	// peer's route attributes. It is a shared immutable snapshot
+	// from [routemanager.RouteManager.Outbound].
+	byIP *bart.Table[*routemanager.PeerRoute]
 }
 
 func (c *peerConfigTable) String() string {
 	if c == nil {
 		return "peerConfigTable(nil)"
 	}
-	var b strings.Builder
-	b.WriteString("peerConfigTable{")
-	fmt.Fprintf(&b, "nativeAddr4: %v, ", c.nativeAddr4)
-	fmt.Fprintf(&b, "nativeAddr6: %v, ", c.nativeAddr6)
-
-	// TODO: figure out how to iterate/debug/print c.byIP
-
-	b.WriteString("}")
-
-	return b.String()
-}
-
-func (c *peerConfig) String() string {
-	if c == nil {
-		return "peerConfig(nil)"
-	}
-	var b strings.Builder
-	b.WriteString("peerConfig{")
-	fmt.Fprintf(&b, "dstMasqAddr4: %v, ", c.dstMasqAddr4)
-	fmt.Fprintf(&b, "dstMasqAddr6: %v, ", c.dstMasqAddr6)
-	fmt.Fprintf(&b, "jailed: %v}", c.jailed)
-
-	return b.String()
+	return fmt.Sprintf("peerConfigTable{nativeAddr4: %v, nativeAddr6: %v}", c.nativeAddr4, c.nativeAddr6)
 }
 
 // mapDstIP returns the destination IP to use for a packet to dst.
@@ -681,10 +613,10 @@ func (pc *peerConfigTable) mapDstIP(src, oldDst netip.Addr) netip.Addr {
 		return oldDst
 	}
 
-	if oldDst.Is4() && pc.nativeAddr4.IsValid() && c.dstMasqAddr4 == oldDst {
+	if oldDst.Is4() && pc.nativeAddr4.IsValid() && c.MasqAddr4 == oldDst {
 		return pc.nativeAddr4
 	}
-	if oldDst.Is6() && pc.nativeAddr6.IsValid() && c.dstMasqAddr6 == oldDst {
+	if oldDst.Is6() && pc.nativeAddr6.IsValid() && c.MasqAddr6 == oldDst {
 		return pc.nativeAddr6
 	}
 	return oldDst
@@ -714,105 +646,17 @@ func (pc *peerConfigTable) selectSrcIP(oldSrc, dst netip.Addr) netip.Addr {
 
 	// Perform SNAT based on the address family and whether we have a valid
 	// addr.
-	if oldSrc.Is4() && c.dstMasqAddr4.IsValid() {
-		return c.dstMasqAddr4
+	if oldSrc.Is4() && c.MasqAddr4.IsValid() {
+		return c.MasqAddr4
 	}
-	if oldSrc.Is6() && c.dstMasqAddr6.IsValid() {
-		return c.dstMasqAddr6
+	if oldSrc.Is6() && c.MasqAddr6.IsValid() {
+		return c.MasqAddr6
 	}
 
 	// No SNAT; use old src
 	return oldSrc
 }
 
-// peerConfigTableFromWGConfig generates a peerConfigTable from nm. If NAT is
-// not required, and no additional configuration is present, it returns nil.
-func peerConfigTableFromWGConfig(wcfg *wgcfg.Config) *peerConfigTable {
-	if wcfg == nil {
-		return nil
-	}
-
-	nativeAddr4 := findV4(wcfg.Addresses)
-	nativeAddr6 := findV6(wcfg.Addresses)
-	if !nativeAddr4.IsValid() && !nativeAddr6.IsValid() {
-		return nil
-	}
-
-	ret := &peerConfigTable{
-		nativeAddr4:    nativeAddr4,
-		nativeAddr6:    nativeAddr6,
-		masqAddrCounts: make(map[netip.Addr]int),
-	}
-
-	// When using an exit node that requires masquerading, we need to
-	// fill out the routing table with all peers not just the ones that
-	// require masquerading.
-	exitNodeRequiresMasq := false // true if using an exit node and it requires masquerading
-	for _, p := range wcfg.Peers {
-		isExitNode := slices.Contains(p.AllowedIPs, tsaddr.AllIPv4()) || slices.Contains(p.AllowedIPs, tsaddr.AllIPv6())
-		if isExitNode {
-			hasMasqAddr := false ||
-				(p.V4MasqAddr != nil && p.V4MasqAddr.IsValid()) ||
-				(p.V6MasqAddr != nil && p.V6MasqAddr.IsValid())
-			if hasMasqAddr {
-				exitNodeRequiresMasq = true
-			}
-			break
-		}
-	}
-
-	byIPSize := 0
-	for i := range wcfg.Peers {
-		p := &wcfg.Peers[i]
-
-		// Build a routing table that configures DNAT (i.e. changing
-		// the V4MasqAddr/V6MasqAddr for a given peer to the current
-		// peer's v4/v6 IP).
-		var addrToUse4, addrToUse6 netip.Addr
-		if p.V4MasqAddr != nil && p.V4MasqAddr.IsValid() {
-			addrToUse4 = *p.V4MasqAddr
-			ret.masqAddrCounts[addrToUse4]++
-		}
-		if p.V6MasqAddr != nil && p.V6MasqAddr.IsValid() {
-			addrToUse6 = *p.V6MasqAddr
-			ret.masqAddrCounts[addrToUse6]++
-		}
-
-		// If the exit node requires masquerading, set the masquerade
-		// addresses to our native addresses.
-		if exitNodeRequiresMasq {
-			if !addrToUse4.IsValid() && nativeAddr4.IsValid() {
-				addrToUse4 = nativeAddr4
-			}
-			if !addrToUse6.IsValid() && nativeAddr6.IsValid() {
-				addrToUse6 = nativeAddr6
-			}
-		}
-
-		if !addrToUse4.IsValid() && !addrToUse6.IsValid() && !p.IsJailed {
-			// NAT not required for this peer.
-			continue
-		}
-
-		// Use the same peer configuration for each address of the peer.
-		pc := &peerConfig{
-			dstMasqAddr4: addrToUse4,
-			dstMasqAddr6: addrToUse6,
-			jailed:       p.IsJailed,
-		}
-
-		// Insert an entry into our routing table for each allowed IP.
-		for _, ip := range p.AllowedIPs {
-			ret.byIP.Insert(ip, pc)
-			byIPSize++
-		}
-	}
-	if byIPSize == 0 && len(ret.masqAddrCounts) == 0 {
-		return nil
-	}
-	return ret
-}
-
 func (pc *peerConfigTable) inboundPacketIsJailed(p *packet.Parsed) bool {
 	if pc == nil {
 		return false
@@ -821,7 +665,7 @@ func (pc *peerConfigTable) inboundPacketIsJailed(p *packet.Parsed) bool {
 	if !ok {
 		return false
 	}
-	return c.jailed
+	return c.Jailed
 }
 
 func (pc *peerConfigTable) outboundPacketIsJailed(p *packet.Parsed) bool {
@@ -832,7 +676,7 @@ func (pc *peerConfigTable) outboundPacketIsJailed(p *packet.Parsed) bool {
 	if !ok {
 		return false
 	}
-	return c.jailed
+	return c.Jailed
 }
 
 // SetIPer is the interface expected to be implemented by the TAP implementation
@@ -842,16 +686,53 @@ type SetIPer interface {
 	SetIP(ipV4, ipV6 netip.Addr) error
 }
 
-// SetWGConfig is called when a new NetworkMap is received.
+// SetWGConfig is called when a new NetworkMap is received. Its only
+// remaining job is updating the TAP device's IP addresses; the
+// per-peer route attributes arrive via [Wrapper.SetPeerRoutes].
 func (t *Wrapper) SetWGConfig(wcfg *wgcfg.Config) {
 	if t.isTAP {
 		if sip, ok := t.tdev.(SetIPer); ok {
-			sip.SetIP(findV4(wcfg.Addresses), findV6(wcfg.Addresses))
+			sip.SetIP(tsaddr.FirstTailscaleAddrs(slices.All(wcfg.Addresses)))
 		}
 	}
-	cfg := peerConfigTableFromWGConfig(wcfg)
+}
+
+// SetPeerRoutes is called whenever this node's Tailscale addresses or
+// the route manager's outbound table change. native4 and native6 are
+// this node's own Tailscale addresses, and routes maps each peer's
+// addresses and routed prefixes to its route attributes.
+//
+// A nil routes table disables all per-packet peer processing (NAT
+// rewrites and jailed-filter selection); callers pass nil when no
+// current peer has any such attributes, which keeps the common
+// per-packet path to a nil check.
+//
+// Unchanged values are a cheap no-op, so callers can call it
+// unconditionally whenever the inputs might have changed: the routes
+// table is an immutable snapshot whose pointer identity means its
+// contents are unchanged.
+func (t *Wrapper) SetPeerRoutes(native4, native6 netip.Addr, routes *bart.Table[*routemanager.PeerRoute]) {
+	var cfg *peerConfigTable
+	if routes != nil && (native4.IsValid() || native6.IsValid()) {
+		if old := t.peerConfig.Load(); old != nil &&
+			old.byIP == routes && old.nativeAddr4 == native4 && old.nativeAddr6 == native6 {
+			return
+		}
+		cfg = &peerConfigTable{
+			nativeAddr4: native4,
+			nativeAddr6: native6,
+			byIP:        routes,
+		}
+	} else if t.peerConfig.Load() == nil {
+		// Uninstalling (cfg stays nil) over an already-nil config;
+		// skip the Swap and its transition logging below.
+		return
+	}
 	old := t.peerConfig.Swap(cfg)
-	if !reflect.DeepEqual(old, cfg) {
+	// Log only on nil-ness or native address transitions; the routes
+	// table changes with every routing update and is too chatty to log.
+	if (old == nil) != (cfg == nil) ||
+		(old != nil && (old.nativeAddr4 != cfg.nativeAddr4 || old.nativeAddr6 != cfg.nativeAddr6)) {
 		t.logf("peer config: %v", cfg)
 	}
 }
@@ -880,6 +761,14 @@ func (t *Wrapper) filterPacketOutboundToWireGuard(p *packet.Parsed, pc *peerConf
 		}
 	}
 
+	// TSMP traffic should only originate from tailscaled, not from the host
+	// itself.
+	if p.IPProto == ipproto.TSMP {
+		t.limitedLogf("[unexpected] received TSMP out packet over tstun; dropping")
+		metricPacketOutDropTSMP.Add(1)
+		return filter.DropSilently, gro
+	}
+
 	// Issue 1526 workaround: if we sent disco packets over
 	// Tailscale from ourselves, then drop them, as that shouldn't
 	// happen unless a networking stack is confused, as it seems
@@ -956,6 +845,15 @@ func (t *Wrapper) IdleDuration() time.Duration {
 	return mono.Since(t.lastActivityAtomic.LoadAtomic())
 }
 
+// ProbeLocks acquires and releases Wrapper's internal mutexes.
+func (t *Wrapper) ProbeLocks() {
+	t.bufferConsumedMu.Lock()
+	t.bufferConsumedMu.Unlock()
+
+	t.outboundMu.Lock()
+	t.outboundMu.Unlock()
+}
+
 func (t *Wrapper) awaitStart() {
 	for {
 		select {
@@ -997,13 +895,6 @@ func (t *Wrapper) Read(buffs [][]byte, sizes []int, offset int) (int, error) {
 	for _, data := range res.data {
 		p.Decode(data[res.dataOffset:])
 
-		if buildfeatures.HasLazyWG {
-			if m := t.destIPActivity.Load(); m != nil {
-				if fn := m[p.Dst.Addr()]; fn != nil {
-					fn()
-				}
-			}
-		}
 		if buildfeatures.HasCapture && captHook != nil {
 			captHook(packet.FromLocal, t.now(), p.Buffer(), p.CaptureMeta)
 		}
@@ -1105,7 +996,10 @@ func invertGSOChecksum(pkt []byte, gso netstack_GSO) {
 	pkt[at+1] = ^pkt[at+1]
 }
 
-// injectedRead handles injected reads, which bypass filters.
+// injectedRead handles injected reads. Injected packets bypass the outbound
+// filter rules, but UDP/SCTP flow state is still recorded via
+// [filter.Filter.UpdateOutboundFlowState] so inbound replies are admitted by
+// [filter.Filter.RunIn].
 func (t *Wrapper) injectedRead(res tunInjectedRead, outBuffs [][]byte, sizes []int, offset int) (n int, err error) {
 	var gso netstack_GSO
 
@@ -1132,18 +1026,52 @@ func (t *Wrapper) injectedRead(res tunInjectedRead, outBuffs [][]byte, sizes []i
 	defer parsedPacketPool.Put(p)
 	p.Decode(pkt)
 
-	invertGSOChecksum(pkt, gso)
-	pc.snat(p)
-	invertGSOChecksum(pkt, gso)
-
-	if buildfeatures.HasLazyWG {
-		if m := t.destIPActivity.Load(); m != nil {
-			if fn := m[p.Dst.Addr()]; fn != nil {
-				fn()
-			}
+	// Record reverse-flow connection-tracking state for this outbound packet so
+	// that inbound replies are admitted by the filter. Injected packets bypass
+	// the regular RunOut path that records this state for UDP/SCTP flows; doing
+	// it here keeps userspace-networking and tsnet UDP replies from being
+	// dropped as "no matching rule". This must run before SNAT so the tracked
+	// tuple matches what RunIn sees after DNAT on the inbound side. Select
+	// between the normal and jailed filters the same way
+	// filterPacketOutboundToWireGuard does, so jailed peers (e.g. Mullvad exit
+	// nodes) record state on the filter that will run on the reply. See #14229
+	// and #20064.
+	if !t.disableFilter {
+		var filt *filter.Filter
+		if pc.outboundPacketIsJailed(p) {
+			filt = t.jailedFilter.Load()
+		} else {
+			filt = t.filter.Load()
+		}
+		if filt != nil {
+			filt.UpdateOutboundFlowState(p)
 		}
 	}
 
+	invertGSOChecksum(pkt, gso)
+	// Check if this is a packet for conn25-style app connectors,
+	// and perform the necessary NAT. The main case that requires
+	// NAT from netstack toward WireGuard is an SNAT on return traffic
+	// from the target application on the internet, translating
+	// the original server's source IP to the TransitIP.
+	// The hook can also perform DNAT for client-originated traffic,
+	// translating the destination MagicIP to a TransitIP, and rejects
+	// MagicIPs that have not been approved for the client.
+	//
+	// Normal non-connector traffic is forwarded unmodified.
+	//
+	// Cross-tailnet conn25 app connector connections are not supported,
+	// so at most one of this hook and the following pc.snat should modify the packet.
+	if t.PreFilterPacketOutboundToWireGuardAppConnectorIntercept != nil {
+		if r := t.PreFilterPacketOutboundToWireGuardAppConnectorIntercept(p, t); r.IsDrop() {
+			metricPacketOut.Add(1)
+			metricPacketOutDrop.Add(1)
+			return 0, nil
+		}
+	}
+	pc.snat(p)
+	invertGSOChecksum(pkt, gso)
+
 	if res.packet != nil {
 		var gsoOptions tun.GSOOptions
 		gsoOptions, err = stackGSOToTunGSO(pkt, gso)
@@ -1177,7 +1105,8 @@ func (t *Wrapper) filterPacketInboundFromWireGuard(p *packet.Parsed, captHook pa
 			t.injectOutboundPong(p, pingReq)
 			return filter.DropSilently, gro
 		} else if discoKeyAdvert, ok := p.AsTSMPDiscoAdvertisement(); ok {
-			if buildfeatures.HasCacheNetMap && envknob.BoolDefaultTrue("TS_USE_CACHED_NETMAP") {
+			if buildfeatures.HasCacheNetMap && envknob.BoolDefaultTrue("TS_USE_CACHED_NETMAP") &&
+				!discoKeyAdvert.Key.IsZero() {
 				t.discoKeyAdvertisementPub.Publish(events.DiscoKeyAdvertisement{
 					Src: discoKeyAdvert.Src,
 					Key: discoKeyAdvert.Key,
@@ -1188,6 +1117,12 @@ func (t *Wrapper) filterPacketInboundFromWireGuard(p *packet.Parsed, captHook pa
 			if f := t.OnTSMPPongReceived; f != nil {
 				f(data)
 			}
+		} else if data, ok := p.AsTailscaleRejectedHeader(); ok {
+			if data.Reason == packet.RejectedDueToUnknownAppConnectorTransitIP {
+				if f := t.OnUnmappedTransitIPMessage; f != nil {
+					f(data)
+				}
+			}
 		}
 	}
 
@@ -1506,7 +1441,8 @@ func (t *Wrapper) injectOutboundPong(pp *packet.Parsed, req packet.TSMPPingReque
 // InjectOutbound makes the Wrapper device behave as if a packet
 // with the given contents was sent to the network.
 // It does not block, but takes ownership of the packet.
-// The injected packet will not pass through outbound filters.
+// The injected packet will not pass through outbound filter rules,
+// but UDP/SCTP flow state is recorded so inbound replies are admitted.
 // Injecting an empty packet is a no-op.
 func (t *Wrapper) InjectOutbound(pkt []byte) error {
 	if len(pkt) > MaxPacketSize {
@@ -1579,6 +1515,7 @@ var (
 	metricPacketOutDrop          = clientmetric.NewCounter("tstun_out_to_wg_drop")
 	metricPacketOutDropFilter    = clientmetric.NewCounter("tstun_out_to_wg_drop_filter")
 	metricPacketOutDropSelfDisco = clientmetric.NewCounter("tstun_out_to_wg_drop_self_disco")
+	metricPacketOutDropTSMP      = clientmetric.NewCounter("tstun_out_to_wg_drop_tsmp")
 )
 
 func (t *Wrapper) InstallCaptureHook(cb packet.CaptureCallback) {
diff --git a/net/tstun/wrap_linux.go b/net/tstun/wrap_linux.go
index a4e76de5a..bb193266f 100644
--- a/net/tstun/wrap_linux.go
+++ b/net/tstun/wrap_linux.go
@@ -15,22 +15,26 @@ import (
 	"gvisor.dev/gvisor/pkg/tcpip"
 	"gvisor.dev/gvisor/pkg/tcpip/checksum"
 	"gvisor.dev/gvisor/pkg/tcpip/header"
+	"tailscale.com/control/controlknobs"
 	"tailscale.com/envknob"
 	"tailscale.com/net/tsaddr"
 )
 
 // SetLinkFeaturesPostUp configures link features on t based on select TS_TUN_
-// environment variables and OS feature tests. Callers should ensure t is
-// up prior to calling, otherwise OS feature tests may be inconclusive.
-func (t *Wrapper) SetLinkFeaturesPostUp() {
+// environment variables, control-plane node attributes (via knobs, which may be
+// nil), and OS feature tests. Callers should ensure t is up prior to calling,
+// otherwise OS feature tests may be inconclusive.
+func (t *Wrapper) SetLinkFeaturesPostUp(knobs *controlknobs.Knobs) {
 	if t.isTAP || runtime.GOOS == "android" {
 		return
 	}
 	if groDev, ok := t.tdev.(tun.GRODevice); ok {
-		if envknob.Bool("TS_TUN_DISABLE_UDP_GRO") {
+		if envknob.Bool("TS_TUN_DISABLE_UDP_GRO") ||
+			(knobs != nil && knobs.DisableTUNUDPGRO.Load()) {
 			groDev.DisableUDPGRO()
 		}
-		if envknob.Bool("TS_TUN_DISABLE_TCP_GRO") {
+		if envknob.Bool("TS_TUN_DISABLE_TCP_GRO") ||
+			(knobs != nil && knobs.DisableTUNTCPGRO.Load()) {
 			groDev.DisableTCPGRO()
 		}
 		err := probeTCPGRO(groDev)
@@ -42,6 +46,31 @@ func (t *Wrapper) SetLinkFeaturesPostUp() {
 	}
 }
 
+// ApplyGROKnobs applies the [tailcfg.NodeAttrDisableTUNUDPGRO] and
+// [tailcfg.NodeAttrDisableTUNTCPGRO] knob values (via knobs, which must be
+// non-nil) to t's underlying device. It is intended to be called when a
+// control-plane node attribute change is detected after [SetLinkFeaturesPostUp]
+// has already run.
+//
+// Note: wireguard-go's GRO disablement is one-way (sticky); ApplyGROKnobs can
+// move TUN UDP/TCP GRO from enabled to disabled, but the reverse requires a
+// client restart.
+func (t *Wrapper) ApplyGROKnobs(knobs *controlknobs.Knobs) {
+	if t.isTAP || runtime.GOOS == "android" || knobs == nil {
+		return
+	}
+	groDev, ok := t.tdev.(tun.GRODevice)
+	if !ok {
+		return
+	}
+	if knobs.DisableTUNUDPGRO.Load() {
+		groDev.DisableUDPGRO()
+	}
+	if knobs.DisableTUNTCPGRO.Load() {
+		groDev.DisableTCPGRO()
+	}
+}
+
 func probeTCPGRO(dev tun.GRODevice) error {
 	ipPort := netip.MustParseAddrPort(tsaddr.TailscaleServiceIPString + ":0")
 	fingerprint := []byte("tailscale-probe-tun-gro")
diff --git a/net/tstun/wrap_noop.go b/net/tstun/wrap_noop.go
index 8f5b62d0c..319649c55 100644
--- a/net/tstun/wrap_noop.go
+++ b/net/tstun/wrap_noop.go
@@ -5,4 +5,8 @@
 
 package tstun
 
-func (t *Wrapper) SetLinkFeaturesPostUp() {}
+import "tailscale.com/control/controlknobs"
+
+func (t *Wrapper) SetLinkFeaturesPostUp(_ *controlknobs.Knobs) {}
+
+func (t *Wrapper) ApplyGROKnobs(_ *controlknobs.Knobs) {}
diff --git a/net/tstun/wrap_test.go b/net/tstun/wrap_test.go
index 57b300513..76edf7563 100644
--- a/net/tstun/wrap_test.go
+++ b/net/tstun/wrap_test.go
@@ -18,6 +18,7 @@ import (
 	"unicode"
 	"unsafe"
 
+	"github.com/gaissmai/bart"
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/tailscale/wireguard-go/tun/tuntest"
@@ -28,6 +29,8 @@ import (
 	"tailscale.com/disco"
 	"tailscale.com/net/netaddr"
 	"tailscale.com/net/packet"
+	"tailscale.com/net/packet/checksum"
+	"tailscale.com/net/routemanager"
 	"tailscale.com/tstest"
 	"tailscale.com/tstime/mono"
 	"tailscale.com/types/ipproto"
@@ -41,7 +44,6 @@ import (
 	"tailscale.com/util/usermetric"
 	"tailscale.com/wgengine/filter"
 	"tailscale.com/wgengine/netstack/gro"
-	"tailscale.com/wgengine/wgcfg"
 )
 
 func udp4(src, dst string, sport, dport uint16) []byte {
@@ -458,6 +460,71 @@ func TestFilter(t *testing.T) {
 	assertMetricPackets(t, "outACL", 0, metricOutboundDroppedPacketsACL)
 }
 
+// TestInjectOutboundRecordsUDPFlowState verifies that an injected outbound UDP
+// packet (as produced by netstack on userspace-networking / tsnet / SOCKS5
+// callers) records reverse-flow state so that the matching inbound reply is
+// admitted by the inbound filter, even when no explicit ACL rule covers the
+// reply. See tailscale/tailscale#14229 and tailscale/tailscale#20064.
+func TestInjectOutboundRecordsUDPFlowState(t *testing.T) {
+	bus := eventbustest.NewBus(t)
+	chtun, tun := newChannelTUN(t.Logf, bus, true) // secure: install filter
+	defer tun.Close()
+
+	// 53 isn't in setfilter's allowed inbound port range (89-90), so a reply
+	// from 5.6.7.8:53 → 1.2.3.4:<port> is only admissible via reverse-flow
+	// state recorded by the prior outbound packet.
+	const localPort, peerPort = 33333, 53
+	const localIP, peerIP = "1.2.3.4", "5.6.7.8"
+
+	// Inject a UDP packet outbound. Run in a goroutine since
+	// InjectOutbound blocks on the unbuffered vectorOutbound channel
+	// until Read drains it.
+	go func() {
+		if err := tun.InjectOutbound(udp4(localIP, peerIP, localPort, peerPort)); err != nil {
+			t.Errorf("InjectOutbound: %v", err)
+		}
+	}()
+
+	// Drain the injected packet via Read. This drives injectedRead, which
+	// is what records the reverse-flow tuple in filter state.
+	var buf [MaxPacketSize]byte
+	sizes := make([]int, 1)
+	if n, err := tun.Read([][]byte{buf[:]}, sizes, 0); err != nil {
+		t.Fatalf("Read: %v", err)
+	} else if n != 1 {
+		t.Fatalf("Read returned %d packets, want 1", n)
+	}
+
+	// Now simulate the inbound UDP reply. Without flow-state tracking on the
+	// injected outbound path, the inbound filter has no matching rule and
+	// drops the reply silently. With tracking, it should be delivered.
+	replyPkt := udp4(peerIP, localIP, peerPort, localPort)
+
+	// tun.Write blocks writing to chtun.Inbound when the filter accepts the
+	// packet, so drain Inbound concurrently and confirm delivery there.
+	delivered := make(chan []byte, 1)
+	go func() {
+		select {
+		case got := <-chtun.Inbound:
+			delivered <- got
+		case <-tun.closed:
+		}
+	}()
+
+	if _, err := tun.Write([][]byte{replyPkt}, 0); err != nil {
+		t.Fatalf("Write: %v", err)
+	}
+
+	select {
+	case got := <-delivered:
+		if !bytes.Equal(got, replyPkt) {
+			t.Errorf("delivered packet mismatch")
+		}
+	case <-time.After(5 * time.Second):
+		t.Fatal("inbound UDP reply was dropped by filter; injected outbound did not record flow state")
+	}
+}
+
 func assertMetricPackets(t *testing.T, metricName string, want, got int64) {
 	t.Helper()
 	if want != got {
@@ -644,22 +711,43 @@ func TestFilterDiscoLoop(t *testing.T) {
 }
 
 // TODO(andrew-d): refactor this test to no longer use addrFam, after #11945
-// removed it in peerConfigFromWGConfig
 func TestPeerCfg_NAT(t *testing.T) {
-	node := func(ip, masqIP netip.Addr, otherAllowedIPs ...netip.Prefix) wgcfg.Peer {
-		p := wgcfg.Peer{
-			PublicKey: key.NewNode().Public(),
-			AllowedIPs: []netip.Prefix{
-				netip.PrefixFrom(ip, ip.BitLen()),
-			},
+	type testPeer struct {
+		pr   *routemanager.PeerRoute
+		pfxs []netip.Prefix
+	}
+	node := func(ip, masqIP netip.Addr, otherAllowedIPs ...netip.Prefix) testPeer {
+		pr := &routemanager.PeerRoute{Key: key.NewNode().Public()}
+		switch {
+		case masqIP.Is4():
+			pr.MasqAddr4 = masqIP
+		case masqIP.Is6():
+			pr.MasqAddr6 = masqIP
 		}
-		if masqIP.Is4() {
-			p.V4MasqAddr = new(masqIP)
+		return testPeer{
+			pr:   pr,
+			pfxs: append([]netip.Prefix{netip.PrefixFrom(ip, ip.BitLen())}, otherAllowedIPs...),
+		}
+	}
+	// peerCfgTable builds the peerConfigTable under test from peers,
+	// as SetPeerRoutes would from the route manager's outbound table.
+	// A nil peers means no table, matching an uninstalled config.
+	peerCfgTable := func(selfNativeIP netip.Addr, peers []testPeer) *peerConfigTable {
+		if peers == nil {
+			return nil
+		}
+		pcfg := &peerConfigTable{byIP: &bart.Table[*routemanager.PeerRoute]{}}
+		if selfNativeIP.Is4() {
+			pcfg.nativeAddr4 = selfNativeIP
 		} else {
-			p.V6MasqAddr = new(masqIP)
+			pcfg.nativeAddr6 = selfNativeIP
 		}
-		p.AllowedIPs = append(p.AllowedIPs, otherAllowedIPs...)
-		return p
+		for _, p := range peers {
+			for _, pfx := range p.pfxs {
+				pcfg.byIP.Insert(pfx, p.pr)
+			}
+		}
+		return pcfg
 	}
 	test := func(addrFam ipproto.Version) {
 		var (
@@ -668,7 +756,6 @@ func TestPeerCfg_NAT(t *testing.T) {
 			selfNativeIP = netip.MustParseAddr("100.64.0.1")
 			selfEIP1     = netip.MustParseAddr("100.64.1.1")
 			selfEIP2     = netip.MustParseAddr("100.64.1.2")
-			selfAddrs    = []netip.Prefix{netip.PrefixFrom(selfNativeIP, selfNativeIP.BitLen())}
 
 			peer1IP = netip.MustParseAddr("100.64.0.2")
 			peer2IP = netip.MustParseAddr("100.64.0.3")
@@ -683,7 +770,6 @@ func TestPeerCfg_NAT(t *testing.T) {
 			selfNativeIP = netip.MustParseAddr("fd7a:115c:a1e0::a")
 			selfEIP1 = netip.MustParseAddr("fd7a:115c:a1e0::1a")
 			selfEIP2 = netip.MustParseAddr("fd7a:115c:a1e0::1b")
-			selfAddrs = []netip.Prefix{netip.PrefixFrom(selfNativeIP, selfNativeIP.BitLen())}
 
 			peer1IP = netip.MustParseAddr("fd7a:115c:a1e0::b")
 			peer2IP = netip.MustParseAddr("fd7a:115c:a1e0::c")
@@ -703,13 +789,13 @@ func TestPeerCfg_NAT(t *testing.T) {
 
 		tests := []struct {
 			name    string
-			wcfg    *wgcfg.Config
+			peers   []testPeer                // nil means no config at all
 			snatMap map[netip.Addr]netip.Addr // dst -> src
 			dnat    []dnatTest
 		}{
 			{
-				name: "no-cfg",
-				wcfg: nil,
+				name:  "no-cfg",
+				peers: nil,
 				snatMap: map[netip.Addr]netip.Addr{
 					peer1IP:  selfNativeIP,
 					peer2IP:  selfNativeIP,
@@ -723,12 +809,9 @@ func TestPeerCfg_NAT(t *testing.T) {
 			},
 			{
 				name: "single-peer-requires-nat",
-				wcfg: &wgcfg.Config{
-					Addresses: selfAddrs,
-					Peers: []wgcfg.Peer{
-						node(peer1IP, noIP),
-						node(peer2IP, selfEIP2),
-					},
+				peers: []testPeer{
+					node(peer1IP, noIP),
+					node(peer2IP, selfEIP2),
 				},
 				snatMap: map[netip.Addr]netip.Addr{
 					peer1IP:  selfNativeIP,
@@ -744,12 +827,9 @@ func TestPeerCfg_NAT(t *testing.T) {
 			},
 			{
 				name: "multiple-peers-require-nat",
-				wcfg: &wgcfg.Config{
-					Addresses: selfAddrs,
-					Peers: []wgcfg.Peer{
-						node(peer1IP, selfEIP1),
-						node(peer2IP, selfEIP2),
-					},
+				peers: []testPeer{
+					node(peer1IP, selfEIP1),
+					node(peer2IP, selfEIP2),
 				},
 				snatMap: map[netip.Addr]netip.Addr{
 					peer1IP:  selfEIP1,
@@ -765,12 +845,9 @@ func TestPeerCfg_NAT(t *testing.T) {
 			},
 			{
 				name: "multiple-peers-require-nat-with-subnet",
-				wcfg: &wgcfg.Config{
-					Addresses: selfAddrs,
-					Peers: []wgcfg.Peer{
-						node(peer1IP, selfEIP1),
-						node(peer2IP, selfEIP2, subnet),
-					},
+				peers: []testPeer{
+					node(peer1IP, selfEIP1),
+					node(peer2IP, selfEIP2, subnet),
 				},
 				snatMap: map[netip.Addr]netip.Addr{
 					peer1IP:  selfEIP1,
@@ -786,12 +863,9 @@ func TestPeerCfg_NAT(t *testing.T) {
 			},
 			{
 				name: "multiple-peers-require-nat-with-default-route",
-				wcfg: &wgcfg.Config{
-					Addresses: selfAddrs,
-					Peers: []wgcfg.Peer{
-						node(peer1IP, selfEIP1),
-						node(peer2IP, selfEIP2, exitRoute),
-					},
+				peers: []testPeer{
+					node(peer1IP, selfEIP1),
+					node(peer2IP, selfEIP2, exitRoute),
 				},
 				snatMap: map[netip.Addr]netip.Addr{
 					peer1IP:  selfEIP1,
@@ -807,12 +881,9 @@ func TestPeerCfg_NAT(t *testing.T) {
 			},
 			{
 				name: "no-nat",
-				wcfg: &wgcfg.Config{
-					Addresses: selfAddrs,
-					Peers: []wgcfg.Peer{
-						node(peer1IP, noIP),
-						node(peer2IP, noIP),
-					},
+				peers: []testPeer{
+					node(peer1IP, noIP),
+					node(peer2IP, noIP),
 				},
 				snatMap: map[netip.Addr]netip.Addr{
 					peer1IP:  selfNativeIP,
@@ -828,12 +899,9 @@ func TestPeerCfg_NAT(t *testing.T) {
 			},
 			{
 				name: "exit-node-require-nat-peer-doesnt",
-				wcfg: &wgcfg.Config{
-					Addresses: selfAddrs,
-					Peers: []wgcfg.Peer{
-						node(peer1IP, noIP),
-						node(peer2IP, selfEIP2, exitRoute),
-					},
+				peers: []testPeer{
+					node(peer1IP, noIP),
+					node(peer2IP, selfEIP2, exitRoute),
 				},
 				snatMap: map[netip.Addr]netip.Addr{
 					peer1IP:  selfNativeIP,
@@ -850,7 +918,7 @@ func TestPeerCfg_NAT(t *testing.T) {
 
 		for _, tc := range tests {
 			t.Run(fmt.Sprintf("%v/%v", addrFam, tc.name), func(t *testing.T) {
-				pcfg := peerConfigTableFromWGConfig(tc.wcfg)
+				pcfg := peerCfgTable(selfNativeIP, tc.peers)
 				for peer, want := range tc.snatMap {
 					if got := pcfg.selectSrcIP(selfNativeIP, peer); got != want {
 						t.Errorf("selectSrcIP[%v]: got %v; want %v", peer, got, want)
@@ -1055,3 +1123,149 @@ func TestInterceptOrdering(t *testing.T) {
 		t.Errorf("got number of intercepts run in Read(): %d; want: %d", seq, numOutboundIntercepts)
 	}
 }
+
+func TestInjectedReadCallsAppConnectorHook(t *testing.T) {
+	var called bool
+	hook := func(p *packet.Parsed, _ *Wrapper) filter.Response {
+		called = true
+		checksum.UpdateSrcAddr(p, netip.MustParseAddr("169.254.0.1"))
+		return filter.Accept
+	}
+
+	bus := eventbustest.NewBus(t)
+	_, tun := newFakeTUN(t.Logf, bus, false)
+	tun.PreFilterPacketOutboundToWireGuardAppConnectorIntercept = hook
+	tun.Start()
+	defer tun.Close()
+
+	if err := tun.InjectOutbound(udp4("145.53.32.10", "100.25.63.57", 80, 12345)); err != nil {
+		t.Fatalf("InjectOutbound error: %v", err)
+	}
+
+	var buf [MaxPacketSize]byte
+	sizes := make([]int, 1)
+	tun.Read([][]byte{buf[:]}, sizes, 0)
+
+	if !called {
+		t.Error("app connector hook was not called in InjectOutbound")
+	}
+
+	wantPkt := udp4("169.254.0.1", "100.25.63.57", 80, 12345)
+	gotPkt := buf[:sizes[0]]
+	if !bytes.Equal(wantPkt, gotPkt) {
+		t.Errorf("packet mismatch\nwant:\t% x\ngot:\t% x", wantPkt, gotPkt)
+	}
+}
+
+// Tests SetPeerRoutes's fast path: unchanged inputs (including the
+// nil-table case) must not replace the stored config, relying on the
+// routes table's immutable-snapshot pointer identity, so callers can
+// call it unconditionally on every routing update.
+func TestSetPeerRoutesFastPath(t *testing.T) {
+	bus := eventbustest.NewBus(t)
+	_, tun := newFakeTUN(t.Logf, bus, false)
+	defer tun.Close()
+
+	// Installing nil over nil is a no-op.
+	tun.SetPeerRoutes(netip.Addr{}, netip.Addr{}, nil)
+	if got := tun.peerConfig.Load(); got != nil {
+		t.Fatalf("peerConfig after nil install = %v; want nil", got)
+	}
+
+	native4 := netip.MustParseAddr("100.64.0.1")
+	native6 := netip.MustParseAddr("fd7a:115c:a1e0::1")
+	routes := &bart.Table[*routemanager.PeerRoute]{}
+	routes.Insert(netip.MustParsePrefix("100.64.0.2/32"), &routemanager.PeerRoute{Jailed: true})
+
+	tun.SetPeerRoutes(native4, native6, routes)
+	installed := tun.peerConfig.Load()
+	if installed == nil {
+		t.Fatal("peerConfig = nil; want non-nil")
+	}
+
+	// Same inputs: the stored config must be untouched.
+	tun.SetPeerRoutes(native4, native6, routes)
+	if got := tun.peerConfig.Load(); got != installed {
+		t.Errorf("peerConfig replaced on unchanged inputs")
+	}
+
+	// A new snapshot pointer installs a new config.
+	routes2 := routes.InsertPersist(netip.MustParsePrefix("100.64.0.3/32"), &routemanager.PeerRoute{Jailed: true})
+	tun.SetPeerRoutes(native4, native6, routes2)
+	second := tun.peerConfig.Load()
+	if second == installed {
+		t.Error("peerConfig not replaced on changed routes table")
+	}
+
+	// Changed native address installs a new config too.
+	tun.SetPeerRoutes(netip.MustParseAddr("100.64.0.9"), native6, routes2)
+	if got := tun.peerConfig.Load(); got == second {
+		t.Error("peerConfig not replaced on changed native address")
+	}
+
+	// Dropping back to nil works and is then a stable no-op.
+	tun.SetPeerRoutes(netip.Addr{}, netip.Addr{}, nil)
+	if got := tun.peerConfig.Load(); got != nil {
+		t.Fatalf("peerConfig after uninstall = %v; want nil", got)
+	}
+	tun.SetPeerRoutes(netip.Addr{}, netip.Addr{}, nil)
+	if got := tun.peerConfig.Load(); got != nil {
+		t.Fatalf("peerConfig after second uninstall = %v; want nil", got)
+	}
+}
+
+// Drop empty TSMPDiscoAdvert packets inbound via wireguard.
+func TestFilterDropEmptyTSMPDiscoAdvertInbound(t *testing.T) {
+	var memLog tstest.MemLogger
+	tw := &Wrapper{logf: memLog.Logf, limitedLogf: memLog.Logf}
+	ipHdr := packet.IP4Header{
+		IPProto: ipproto.TSMP,
+		Src:     netaddr.IPv4(1, 2, 3, 4),
+		Dst:     netaddr.IPv4(5, 6, 7, 8),
+	}
+	tsmpPayload := make([]byte, 33)
+	tsmpPayload[0] = byte(packet.TSMPTypeDiscoAdvertisement)
+	pkt := make([]byte, ipHdr.Len()+len(tsmpPayload))
+	ipHdr.Marshal(pkt)
+	copy(pkt[ipHdr.Len():], tsmpPayload)
+
+	pp := new(packet.Parsed)
+	pp.Decode(pkt)
+	got, _ := tw.filterPacketInboundFromWireGuard(pp, nil, nil, nil)
+	if got != filter.DropSilently {
+		t.Errorf("got %v; want DropSilently", got)
+	}
+}
+
+// Drop TSMP packets from ourselves.
+func TestFilterDropTSMP(t *testing.T) {
+	var memLog tstest.MemLogger
+	tw := &Wrapper{logf: memLog.Logf, limitedLogf: memLog.Logf}
+	ipHdr := packet.IP4Header{
+		IPProto: ipproto.TSMP,
+		Src:     netaddr.IPv4(1, 2, 3, 4),
+		Dst:     netaddr.IPv4(5, 6, 7, 8),
+	}
+	tsmpPayload := make([]byte, 33)
+	tsmpPayload[0] = byte(packet.TSMPTypeDiscoAdvertisement)
+	pkt := make([]byte, ipHdr.Len()+len(tsmpPayload))
+	ipHdr.Marshal(pkt)
+	copy(pkt[ipHdr.Len():], tsmpPayload)
+
+	wantMetric := metricPacketOutDropTSMP.Value() + 1
+
+	pp := new(packet.Parsed)
+	pp.Decode(pkt)
+	got, _ := tw.filterPacketOutboundToWireGuard(pp, nil, nil)
+	if got != filter.DropSilently {
+		t.Errorf("got %v; want DropSilently", got)
+	}
+	if got, want := memLog.String(), "[unexpected] received TSMP out packet over tstun; dropping\n"; got != want {
+		t.Errorf("log output mismatch\n got: %q\nwant: %q\n", got, want)
+	}
+
+	if metricPacketOutDropTSMP.Value() != wantMetric {
+		t.Errorf("expected metric\n got: %d\nwant: %d\n",
+			metricPacketOutDropTSMP.Value(), wantMetric)
+	}
+}
diff --git a/net/udprelay/server.go b/net/udprelay/server.go
index 3b0f72989..9052873b0 100644
--- a/net/udprelay/server.go
+++ b/net/udprelay/server.go
@@ -25,6 +25,7 @@ import (
 	"go4.org/mem"
 	"golang.org/x/crypto/blake2s"
 	"golang.org/x/net/ipv6"
+	"tailscale.com/control/controlknobs"
 	"tailscale.com/disco"
 	"tailscale.com/net/batching"
 	"tailscale.com/net/netaddr"
@@ -83,6 +84,7 @@ type Server struct {
 	metrics             *metrics
 	netMon              *netmon.Monitor
 	cloudInfo           *cloudinfo.CloudInfo // used to query cloud metadata services
+	controlKnobs        *controlknobs.Knobs  // or nil
 
 	mu                  sync.Mutex                      // guards the following fields
 	macSecrets          views.Slice[[blake2s.Size]byte] // [0] is most recent, max 2 elements
@@ -376,8 +378,8 @@ const (
 // port selection is left up to the host networking stack. If
 // onlyStaticAddrPorts is true, then dynamic addr:port discovery will be
 // disabled, and only addr:port's set via [Server.SetStaticAddrPorts] will be
-// used. Metrics must be non-nil.
-func NewServer(logf logger.Logf, port uint16, onlyStaticAddrPorts bool, metrics *usermetric.Registry) (s *Server, err error) {
+// used. Metrics must be non-nil. knobs may be nil.
+func NewServer(logf logger.Logf, port uint16, onlyStaticAddrPorts bool, metrics *usermetric.Registry, knobs *controlknobs.Knobs) (s *Server, err error) {
 	s = &Server{
 		logf:                  logf,
 		disco:                 key.NewDisco(),
@@ -388,6 +390,7 @@ func NewServer(logf logger.Logf, port uint16, onlyStaticAddrPorts bool, metrics
 		serverEndpointByDisco: make(map[key.SortedPairOfDiscoPublic]*serverEndpoint),
 		nextVNI:               minVNI,
 		cloudInfo:             cloudinfo.New(logf),
+		controlKnobs:          knobs,
 	}
 	s.discoPublic = s.disco.Public()
 	s.metrics = registerMetrics(metrics)
@@ -689,7 +692,7 @@ func (s *Server) bindSockets(desiredPort uint16) error {
 					break SocketsLoop
 				}
 			}
-			pc := batching.TryUpgradeToConn(uc, network, batching.IdealBatchSize, "udprelay_rxq_overflows")
+			pc := batching.TryUpgradeToConn(uc, network, batching.IdealBatchSize, "udprelay_rxq_overflows", s.controlKnobs)
 			bc, ok := pc.(batching.Conn)
 			if !ok {
 				bc = &singlePacketConn{uc}
diff --git a/net/udprelay/server_test.go b/net/udprelay/server_test.go
index 00b9c2423..6ba52db7b 100644
--- a/net/udprelay/server_test.go
+++ b/net/udprelay/server_test.go
@@ -214,7 +214,7 @@ func TestServer(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			reg := new(usermetric.Registry)
 			deregisterMetrics()
-			server, err := NewServer(t.Logf, 0, true, reg)
+			server, err := NewServer(t.Logf, 0, true, reg, nil)
 			if err != nil {
 				t.Fatal(err)
 			}
diff --git a/pkgdoc_test.go b/pkgdoc_test.go
index 60b2d4856..d0f0d66bd 100644
--- a/pkgdoc_test.go
+++ b/pkgdoc_test.go
@@ -4,6 +4,7 @@
 package tailscaleroot
 
 import (
+	"go/ast"
 	"go/parser"
 	"go/token"
 	"os"
@@ -13,6 +14,17 @@ import (
 	"testing"
 )
 
+func hasIgnoreBuildTag(f *ast.File) bool {
+	for _, cg := range f.Comments {
+		for _, c := range cg.List {
+			if c.Text == "//go:build ignore" {
+				return true
+			}
+		}
+	}
+	return false
+}
+
 func TestPackageDocs(t *testing.T) {
 	switch runtime.GOOS {
 	case "darwin", "linux":
@@ -26,8 +38,11 @@ func TestPackageDocs(t *testing.T) {
 		if err != nil {
 			return err
 		}
-		if fi.Mode().IsDir() && path == ".git" {
-			return filepath.SkipDir // No documentation lives in .git
+		if fi.Mode().IsDir() && path != "." && strings.HasPrefix(filepath.Base(path), ".") {
+			return filepath.SkipDir // No documentation lives in dot directories (.git, .claude, etc)
+		}
+		if fi.Mode().IsDir() && filepath.Base(path) == "testdata" {
+			return filepath.SkipDir // testdata is ignored by the go tool; not real packages
 		}
 		if fi.Mode().IsRegular() && strings.HasSuffix(path, ".go") {
 			if strings.HasSuffix(path, "_test.go") {
@@ -48,6 +63,9 @@ func TestPackageDocs(t *testing.T) {
 		if err != nil {
 			t.Fatalf("failed to ParseFile %q: %v", fileName, err)
 		}
+		if hasIgnoreBuildTag(f) {
+			continue
+		}
 		dir := filepath.Dir(fileName)
 		if _, ok := byDir[dir]; !ok {
 			byDir[dir] = nil
@@ -61,14 +79,8 @@ func TestPackageDocs(t *testing.T) {
 		}
 	}
 	for dir, ff := range byDir {
-		switch dir {
-		case "tstest/integration/vms":
-			// This package has a couple go:build ignore commands and this test doesn't
-			// handle parsing those. Just allowlist that package for now (2024-07-10).
-			continue
-		}
 		if len(ff) > 1 {
-			t.Logf("multiple files with package doc in %s: %q", dir, ff)
+			t.Errorf("multiple files with package doc in %s: %q", dir, ff)
 		}
 		if len(ff) == 0 {
 			if strings.HasPrefix(dir, "gokrazy/") {
diff --git a/portlist/netstat.go b/portlist/netstat.go
index de625afb5..c6a944cd6 100644
--- a/portlist/netstat.go
+++ b/portlist/netstat.go
@@ -26,10 +26,7 @@ func parsePort(s mem.RO) int {
 	// a.b.c.d.1234 or [a:b:c:d].1234
 	i2 := mem.LastIndexByte(s, '.')
 
-	i := i1
-	if i2 > i {
-		i = i2
-	}
+	i := max(i2, i1)
 	if i < 0 {
 		// no match; weird
 		return -1
diff --git a/posture/serialnumber_stub.go b/posture/serialnumber_stub.go
index e040aacfb..6df9b4079 100644
--- a/posture/serialnumber_stub.go
+++ b/posture/serialnumber_stub.go
@@ -12,6 +12,7 @@ package posture
 
 import (
 	"errors"
+	"fmt"
 
 	"tailscale.com/types/logger"
 	"tailscale.com/util/syspolicy/policyclient"
@@ -19,5 +20,5 @@ import (
 
 // GetSerialNumber returns client machine serial number(s).
 func GetSerialNumbers(polc policyclient.Client, _ logger.Logf) ([]string, error) {
-	return nil, errors.New("not implemented")
+	return nil, fmt.Errorf("not implemented: %w", errors.ErrUnsupported)
 }
diff --git a/prober/derp.go b/prober/derp.go
index dadda6fce..07208c4cd 100644
--- a/prober/derp.go
+++ b/prober/derp.go
@@ -36,6 +36,7 @@ import (
 	"tailscale.com/derp"
 	"tailscale.com/derp/derphttp"
 	"tailscale.com/net/netmon"
+	"tailscale.com/net/netutil"
 	"tailscale.com/net/stun"
 	"tailscale.com/net/tstun"
 	"tailscale.com/syncs"
@@ -1210,7 +1211,7 @@ func newConn(ctx context.Context, dm *tailcfg.DERPMap, n *tailcfg.DERPNode, isPr
 var httpOrFileClient = &http.Client{Transport: httpOrFileTransport()}
 
 func httpOrFileTransport() http.RoundTripper {
-	tr := http.DefaultTransport.(*http.Transport).Clone()
+	tr := netutil.NewDefaultTransport()
 	tr.RegisterProtocol("file", http.NewFileTransport(http.Dir("/")))
 	return tr
 }
diff --git a/prober/http.go b/prober/http.go
index 144ed3fb5..5ae527ac3 100644
--- a/prober/http.go
+++ b/prober/http.go
@@ -6,28 +6,73 @@ package prober
 import (
 	"bytes"
 	"context"
+	"expvar"
 	"fmt"
 	"io"
+	"net"
 	"net/http"
+	"net/netip"
+	"time"
+
+	"github.com/prometheus/client_golang/prometheus"
+	"tailscale.com/net/netutil"
 )
 
 const maxHTTPBody = 4 << 20 // MiB
 
+// NewProbeTransport returns a fresh *http.Transport for a single probe run (so
+// we never reuse a past connection).
+//
+// If dialAddr is valid (its zero value means "no override"), every connection is
+// dialed to dialAddr instead of resolving the request URL's host, while SNI, the
+// Host header, and TLS certificate validation continue to derive from the URL
+// host. This is the HTTP analog of TLSWithIP: it lets a probe target a specific
+// backend that serves a given hostname (e.g. one particular Funnel ingress node).
+//
+// Custom probe classes that dial a specific backend should use this rather than
+// reconstructing the dial override, so the SNI/Host/cert semantics stay
+// identical across probes.
+func NewProbeTransport(dialAddr netip.AddrPort) *http.Transport {
+	tr := netutil.NewDefaultTransport()
+	if dialAddr.IsValid() {
+		dst := dialAddr.String()
+		// Reuse the transport's own dialer (preserving its Timeout/KeepAlive and
+		// any future tuning); only substitute the dial target so connections go
+		// to dialAddr instead of the resolved URL host.
+		dial := tr.DialContext
+		tr.DialContext = func(ctx context.Context, network, _ string) (net.Conn, error) {
+			return dial(ctx, network, dst)
+		}
+	}
+	return tr
+}
+
 // HTTP returns a ProbeClass that healthchecks an HTTP URL.
 //
 // The probe function sends a GET request for url, expects an HTTP 200
 // response, and verifies that want is present in the response
 // body.
 func HTTP(url, wantText string) ProbeClass {
+	return httpProbe(url, netip.AddrPort{}, wantText)
+}
+
+// HTTPWithDialAddr is like HTTP, but dials dialAddr (an ip:port) instead of the
+// URL's host. SNI, the Host header, and TLS certificate validation still use the
+// URL host, so this probes a specific backend serving the URL's hostname.
+func HTTPWithDialAddr(url string, dialAddr netip.AddrPort, wantText string) ProbeClass {
+	return httpProbe(url, dialAddr, wantText)
+}
+
+func httpProbe(url string, dialAddr netip.AddrPort, wantText string) ProbeClass {
 	return ProbeClass{
 		Probe: func(ctx context.Context) error {
-			return probeHTTP(ctx, url, []byte(wantText))
+			return probeHTTP(ctx, url, []byte(wantText), dialAddr)
 		},
 		Class: "http",
 	}
 }
 
-func probeHTTP(ctx context.Context, url string, want []byte) error {
+func probeHTTP(ctx context.Context, url string, want []byte, dialAddr netip.AddrPort) error {
 	req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
 	if err != nil {
 		return fmt.Errorf("constructing request: %w", err)
@@ -35,7 +80,7 @@ func probeHTTP(ctx context.Context, url string, want []byte) error {
 
 	// Get a completely new transport each time, so we don't reuse a
 	// past connection.
-	tr := http.DefaultTransport.(*http.Transport).Clone()
+	tr := NewProbeTransport(dialAddr)
 	defer tr.CloseIdleConnections()
 	c := &http.Client{
 		Transport: tr,
@@ -66,3 +111,88 @@ func probeHTTP(ctx context.Context, url string, want []byte) error {
 
 	return nil
 }
+
+// HTTPBandwidth returns a ProbeClass that downloads size bytes from url and
+// records how long the transfer took, for bandwidth measurement. It issues a
+// GET, expects an HTTP 200 response, and reads size bytes from the body.
+//
+// Because the transfer is measured at the receiver (this prober reads and times
+// the body it pulls), the recorded byte count and duration are exact even on a
+// truncated response. This probe does not carry a direction label; callers that
+// run it alongside an upload probe can attach one at registration time (e.g.
+// Labels{"direction": "down"}).
+//
+// size must be positive. A non-positive size reads nothing from the body, so
+// the probe records a zero-byte transfer and trivially succeeds.
+func HTTPBandwidth(url string, size int64) ProbeClass {
+	return httpBandwidthProbe(url, size, netip.AddrPort{})
+}
+
+// HTTPBandwidthWithDialAddr is like HTTPBandwidth, but dials dialAddr (an
+// ip:port) instead of the URL's host, while SNI/Host/cert validation still use
+// the URL host. It measures download bandwidth from a specific backend serving
+// the URL's hostname.
+func HTTPBandwidthWithDialAddr(url string, size int64, dialAddr netip.AddrPort) ProbeClass {
+	return httpBandwidthProbe(url, size, dialAddr)
+}
+
+func httpBandwidthProbe(url string, size int64, dialAddr netip.AddrPort) ProbeClass {
+	var transferTimeSeconds expvar.Float
+	var totalBytesTransferred expvar.Float
+	return ProbeClass{
+		Probe: func(ctx context.Context) error {
+			return probeHTTPBandwidth(ctx, url, size, dialAddr, &transferTimeSeconds, &totalBytesTransferred)
+		},
+		Class:   "http_bw",
+		Metrics: HTTPBandwidthMetrics(size, &transferTimeSeconds, &totalBytesTransferred),
+	}
+}
+
+// HTTPBandwidthMetrics returns the Metrics function for an "http_bw" bandwidth
+// probe, exposing the configured payload size and the running transfer
+// time/bytes accumulators. It is shared so probes that measure bandwidth
+// differently (e.g. a receiver-reported upload probe) still emit an identical
+// metric set and can be compared under a common direction label.
+func HTTPBandwidthMetrics(size int64, transferTimeSeconds, totalBytesTransferred *expvar.Float) func(prometheus.Labels) []prometheus.Metric {
+	return func(lb prometheus.Labels) []prometheus.Metric {
+		return []prometheus.Metric{
+			prometheus.MustNewConstMetric(prometheus.NewDesc("http_bw_probe_size_bytes", "Payload size of the bandwidth prober", nil, lb), prometheus.GaugeValue, float64(size)),
+			prometheus.MustNewConstMetric(prometheus.NewDesc("http_bw_transfer_time_seconds_total", "Time it took to transfer data", nil, lb), prometheus.CounterValue, transferTimeSeconds.Value()),
+			prometheus.MustNewConstMetric(prometheus.NewDesc("http_bw_bytes_total", "Amount of data transferred", nil, lb), prometheus.CounterValue, totalBytesTransferred.Value()),
+		}
+	}
+}
+
+func probeHTTPBandwidth(ctx context.Context, url string, size int64, dialAddr netip.AddrPort, transferTimeSeconds, totalBytesTransferred *expvar.Float) error {
+	req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
+	if err != nil {
+		return fmt.Errorf("constructing request: %w", err)
+	}
+
+	// Get a completely new transport each time, so we don't reuse a
+	// past connection.
+	tr := NewProbeTransport(dialAddr)
+	defer tr.CloseIdleConnections()
+	c := &http.Client{
+		Transport: tr,
+	}
+
+	resp, err := c.Do(req)
+	if err != nil {
+		return fmt.Errorf("fetching %q: %w", url, err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != 200 {
+		return fmt.Errorf("fetching %q: status code %d, want 200", url, resp.StatusCode)
+	}
+	start := time.Now()
+	n, err := io.CopyN(io.Discard, resp.Body, size)
+	// Measure transfer time and bytes transferred irrespective of whether
+	// it succeeded or failed.
+	transferTimeSeconds.Add(time.Since(start).Seconds())
+	totalBytesTransferred.Add(float64(n))
+	if err != nil {
+		return fmt.Errorf("reading body of %q: %w", url, err)
+	}
+	return nil
+}
diff --git a/prober/http_test.go b/prober/http_test.go
new file mode 100644
index 000000000..544565de2
--- /dev/null
+++ b/prober/http_test.go
@@ -0,0 +1,189 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package prober
+
+import (
+	"context"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/prometheus/client_golang/prometheus"
+	dto "github.com/prometheus/client_model/go"
+)
+
+// zeroReader is an io.Reader that yields an unlimited stream of zero bytes, used
+// to generate fixed-size test payloads via io.CopyN.
+type zeroReader struct{}
+
+func (zeroReader) Read(p []byte) (int, error) {
+	clear(p)
+	return len(p), nil
+}
+
+// metricValue extracts the numeric value of the (gauge or counter) metric whose
+// descriptor contains name from a slice returned by a ProbeClass.Metrics call.
+func metricValue(t *testing.T, metrics []prometheus.Metric, name string) float64 {
+	t.Helper()
+	for _, m := range metrics {
+		if !strings.Contains(m.Desc().String(), name) {
+			continue
+		}
+		var dm dto.Metric
+		if err := m.Write(&dm); err != nil {
+			t.Fatalf("writing metric %q: %v", name, err)
+		}
+		switch {
+		case dm.Counter != nil:
+			return dm.Counter.GetValue()
+		case dm.Gauge != nil:
+			return dm.Gauge.GetValue()
+		default:
+			t.Fatalf("metric %q is neither counter nor gauge", name)
+		}
+	}
+	t.Fatalf("metric %q not found", name)
+	return 0
+}
+
+func TestHTTPBandwidth(t *testing.T) {
+	const size = 1 << 20 // 1 MiB
+
+	mux := http.NewServeMux()
+	// /download writes exactly `size` zero bytes.
+	mux.HandleFunc("/download", func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		io.CopyN(w, zeroReader{}, size)
+	})
+	// /bad returns a non-200 status.
+	mux.HandleFunc("/bad", func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusInternalServerError)
+	})
+	// /short writes fewer than `size` bytes for a download.
+	mux.HandleFunc("/short", func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		io.CopyN(w, zeroReader{}, size/2)
+	})
+
+	srv := httptest.NewServer(mux)
+	defer srv.Close()
+
+	for _, tc := range []struct {
+		name    string
+		path    string
+		size    int64
+		wantErr bool
+	}{
+		{name: "download_ok", path: "/download", size: size},
+		{name: "download_non200", path: "/bad", size: size, wantErr: true},
+		{name: "download_truncated", path: "/short", size: size, wantErr: true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			pc := HTTPBandwidth(srv.URL+tc.path, tc.size)
+
+			if got, want := pc.Class, "http_bw"; got != want {
+				t.Errorf("Class = %q, want %q", got, want)
+			}
+
+			ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+			defer cancel()
+			err := pc.Probe(ctx)
+			if tc.wantErr {
+				if err == nil {
+					t.Fatalf("Probe() = nil, want error")
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("Probe() = %v, want nil", err)
+			}
+
+			// On success, the Metrics callback should return the expected
+			// descriptors.
+			if pc.Metrics == nil {
+				t.Fatal("Metrics callback is nil")
+			}
+			metrics := pc.Metrics(prometheus.Labels{})
+			transferTime := func() float64 {
+				return metricValue(t, metrics, "http_bw_transfer_time_seconds_total")
+			}
+			wantDescs := map[string]bool{
+				"http_bw_probe_size_bytes":            false,
+				"http_bw_transfer_time_seconds_total": false,
+				"http_bw_bytes_total":                 false,
+			}
+			for _, m := range metrics {
+				if m == nil {
+					t.Fatal("got nil metric")
+				}
+				desc := m.Desc().String()
+				for name := range wantDescs {
+					if strings.Contains(desc, name) {
+						wantDescs[name] = true
+					}
+				}
+			}
+			for name, seen := range wantDescs {
+				if !seen {
+					t.Errorf("metric %q not emitted", name)
+				}
+			}
+
+			// On a successful transfer the recorded byte count should equal the
+			// full payload size, and the transfer should take a positive,
+			// finite amount of time.
+			if got := metricValue(t, metrics, "http_bw_bytes_total"); got != float64(tc.size) {
+				t.Errorf("http_bw_bytes_total = %v, want %v", got, tc.size)
+			}
+			// The transfer time counter accumulates across Probe calls.
+			// At 1 MiB over loopback a zero reading means the timing logic
+			// is broken, but retry a few times.
+			if transferTime() <= 0 {
+				const retries = 3
+				for range retries {
+					if err := pc.Probe(ctx); err != nil {
+						t.Fatalf("Probe() = %v, want nil", err)
+					}
+					metrics = pc.Metrics(prometheus.Labels{})
+					if transferTime() > 0 {
+						break
+					}
+				}
+				if transferTime() <= 0 {
+					t.Fatalf("http_bw_transfer_time_seconds_total = 0 after %d attempts, want > 0", retries+1)
+				}
+			}
+		})
+	}
+}
+
+// TestHTTPWithDialAddr verifies that the dial-address override sends the
+// connection to dialAddr while the URL host still drives the Host header (and,
+// for HTTPS, SNI/cert validation). The URL host here is an unresolvable name, so
+// the probe can only succeed if the dial override is honored.
+func TestHTTPWithDialAddr(t *testing.T) {
+	const wantHost = "funnel-host.invalid"
+	var gotHost string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotHost = r.Host
+		io.WriteString(w, "ok")
+	}))
+	defer srv.Close()
+
+	dialAddr := srv.Listener.Addr().(*net.TCPAddr).AddrPort()
+	pc := HTTPWithDialAddr("http://"+wantHost+"/probe", dialAddr, "ok")
+
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+	if err := pc.Probe(ctx); err != nil {
+		t.Fatalf("Probe() = %v, want nil", err)
+	}
+	if gotHost != wantHost {
+		t.Errorf("server saw Host %q, want %q (URL host should drive the Host header)", gotHost, wantHost)
+	}
+}
diff --git a/prober/prober_test.go b/prober/prober_test.go
index 14b75d5b5..80c85ccb5 100644
--- a/prober/prober_test.go
+++ b/prober/prober_test.go
@@ -205,11 +205,14 @@ func TestProberConcurrency(t *testing.T) {
 	p.Run("foo", time.Second, nil, pfunc)
 	waitActiveProbes(t, p, clk, 1)
 
-	for range 50 {
-		clk.Advance(time.Second)
-	}
-
+	// The fake ticker drops ticks when the probe loop goroutine isn't
+	// already blocked on its channel (buffer of one, non-blocking send),
+	// so advancing the clock in a tight loop doesn't guarantee that the
+	// loop observes enough ticks to start three concurrent probe runs.
+	// Instead, advance the clock inside the polling loop so ticks keep
+	// firing until all three probe goroutines have started.
 	if err := tstest.WaitFor(convergenceTimeout, func() error {
+		clk.Advance(time.Second)
 		if got, want := ran.Load(), int64(3); got != want {
 			return fmt.Errorf("expected %d probes to run concurrently, got %d", want, got)
 		}
diff --git a/pull-toolchain.sh b/pull-toolchain.sh
index effeca669..8f34129c6 100755
--- a/pull-toolchain.sh
+++ b/pull-toolchain.sh
@@ -46,15 +46,15 @@ if [ "${TS_GO_NEXT:-}" != "1" ]; then
     fi
 fi
 
-# Only update go.toolchain.version and go.toolchain.rev.sri for the main toolchain,
+# Only update go.toolchain.version and flakehashes.json for the main toolchain,
 # skipping it if TS_GO_NEXT=1. Those two files are only used by Nix, and as of 2026-01-26
 # don't yet support TS_GO_NEXT=1 with flake.nix or in our corp CI.
 if [ "${TS_GO_NEXT:-}" != "1" ]; then
     ./tool/go version 2>/dev/null | awk '{print $3}' | sed 's/^go//' > go.toolchain.version
     ./tool/go mod edit -go "$(cat go.toolchain.version)"
-    ./update-flake.sh
+    ./tool/go run ./tool/updateflakes
 fi
 
-if [ -n "$(git diff-index --name-only HEAD -- "$go_toolchain_rev_file" go.toolchain.next.rev go.toolchain.rev.sri go.toolchain.version)" ]; then
+if [ -n "$(git diff-index --name-only HEAD -- "$go_toolchain_rev_file" go.toolchain.next.rev flakehashes.json go.toolchain.version)" ]; then
     echo "pull-toolchain.sh: changes imported. Use git commit to make them permanent." >&2
 fi
diff --git a/release/dist/qnap/files/scripts/build-qpkg.sh b/release/dist/qnap/files/scripts/build-qpkg.sh
index d478bfe6b..61786ead8 100755
--- a/release/dist/qnap/files/scripts/build-qpkg.sh
+++ b/release/dist/qnap/files/scripts/build-qpkg.sh
@@ -4,17 +4,9 @@ set -eu
 
 # Clean up folders and files created during build.
 function cleanup() {
-    rm -rf /Tailscale/$ARCH
-    rm -f /Tailscale/sed*
-    rm -f /Tailscale/qpkg.cfg
-
-    # If this build was signed, a .qpkg.codesigning file will be created as an
-    # artifact of the build
-    # (see https://github.com/qnap-dev/qdk2/blob/93ac75c76941b90ee668557f7ce01e4b23881054/QDK_2.x/bin/qbuild#L992).
-    #
-    # go/client-release doesn't seem to need these, so we delete them here to
-    # avoid uploading them to pkgs.tailscale.com.
-    rm -f /out/*.qpkg.codesigning
+	rm -rf /Tailscale/$ARCH
+	rm -f /Tailscale/sed*
+	rm -f /Tailscale/qpkg.cfg
 }
 trap cleanup EXIT
 
@@ -22,6 +14,6 @@ mkdir -p /Tailscale/$ARCH
 cp /tailscaled /Tailscale/$ARCH/tailscaled
 cp /tailscale /Tailscale/$ARCH/tailscale
 
-sed "s/\$QPKG_VER/$TSTAG-$QNAPTAG/g" /Tailscale/qpkg.cfg.in > /Tailscale/qpkg.cfg
+sed "s/\$QPKG_VER/$TSTAG-$QNAPTAG/g" /Tailscale/qpkg.cfg.in >/Tailscale/qpkg.cfg
 
 qbuild --root /Tailscale --build-arch $ARCH --build-dir /out
diff --git a/release/dist/qnap/pkgs.go b/release/dist/qnap/pkgs.go
index 1d69b3eaf..b505b1ac0 100644
--- a/release/dist/qnap/pkgs.go
+++ b/release/dist/qnap/pkgs.go
@@ -118,7 +118,16 @@ func (t *target) buildQPKG(b *dist.Build, qnapBuilds *qnapBuilds, inner *innerPk
 		return nil, fmt.Errorf("docker run %v: %s", err, out)
 	}
 
-	return []string{filePath, filePath + ".md5"}, nil
+	ret := []string{filePath, filePath + ".md5"}
+	// If the build was signed, a .codesigning file is produced containing
+	// the last 32 characters of the base64-encoded CMS signature. This is
+	// used by pkgserve to populate <signature> entries in the QNAP
+	// repository XML.
+	codesigning := filePath + ".codesigning"
+	if _, err := os.Stat(codesigning); err == nil {
+		ret = append(ret, codesigning)
+	}
+	return ret, nil
 }
 
 type qnapBuildsMemoizeKey struct{}
diff --git a/release/dist/synology/targets.go b/release/dist/synology/targets.go
index 2f0851055..2683ed3c9 100644
--- a/release/dist/synology/targets.go
+++ b/release/dist/synology/targets.go
@@ -9,10 +9,6 @@ var v5Models = []string{
 	"armv5",
 	"88f6281",
 	"88f6282",
-	// hi3535 is actually an armv7 under the hood, but with no
-	// hardware floating point. To the Go compiler, that means it's an
-	// armv5.
-	"hi3535",
 }
 
 var v7Models = []string{
@@ -26,6 +22,13 @@ var v7Models = []string{
 	"monaco",
 }
 
+// These models are actually armv7 under the hood, but with no hardware
+// floating point. To the Go compiler, that means we previously treated
+// them as GOARM=5 just to get softfloat, but nowadays we can do GOARM=7,softfloat.
+var v7SoftModels = []string{
+	"hi3535", // https://github.com/tailscale/tailscale/issues/6860
+}
+
 func Targets(forPackageCenter bool, signer dist.Signer) []dist.Target {
 	var ret []dist.Target
 	for _, dsmVersion := range []struct {
@@ -105,6 +108,20 @@ func Targets(forPackageCenter bool, signer dist.Signer) []dist.Target {
 				signer:        signer,
 			})
 		}
+		for _, v7SoftArch := range v7SoftModels {
+			ret = append(ret, &target{
+				filenameArch:    v7SoftArch,
+				dsmMajorVersion: dsmVersion.major,
+				dsmMinorVersion: dsmVersion.minor,
+				goenv: map[string]string{
+					"GOOS":   "linux",
+					"GOARCH": "arm",
+					"GOARM":  "7,softfloat",
+				},
+				packageCenter: forPackageCenter,
+				signer:        signer,
+			})
+		}
 	}
 	return ret
 }
diff --git a/safesocket/safesocket_darwin.go b/safesocket/safesocket_darwin.go
index aa67baaf8..98b879844 100644
--- a/safesocket/safesocket_darwin.go
+++ b/safesocket/safesocket_darwin.go
@@ -323,11 +323,11 @@ func readMacosSameUserProof() (port int, token string, err error) {
 		subStr := []byte(".tailscale.ipn.macos/sameuserproof-")
 		for bs.Scan() {
 			line := bs.Bytes()
-			i := bytes.Index(line, subStr)
-			if i == -1 {
+			_, after, ok := bytes.Cut(line, subStr)
+			if !ok {
 				continue
 			}
-			f := strings.SplitN(string(line[i+len(subStr):]), "-", 2)
+			f := strings.SplitN(string(after), "-", 2)
 			if len(f) != 2 {
 				continue
 			}
diff --git a/safesocket/safesocket_js.go b/safesocket/safesocket_js.go
index 746fea511..0807885a8 100644
--- a/safesocket/safesocket_js.go
+++ b/safesocket/safesocket_js.go
@@ -5,15 +5,22 @@ package safesocket
 
 import (
 	"context"
+	"fmt"
 	"net"
+	"sync/atomic"
 
 	"github.com/akutz/memconn"
 )
 
 const memName = "Tailscale-IPN"
 
+// memSeq ensures each IPN instance in the same WASM process gets a distinct
+// memconn address, so concurrent instances do not conflict on the registry.
+var memSeq atomic.Int64
+
 func listen(path string) (net.Listener, error) {
-	return memconn.Listen("memu", memName)
+	name := fmt.Sprintf("%s-%d", memName, memSeq.Add(1))
+	return memconn.Listen("memu", name)
 }
 
 func connect(ctx context.Context, _ string) (net.Conn, error) {
diff --git a/safeweb/http.go b/safeweb/http.go
index d52412bd3..a2f48b965 100644
--- a/safeweb/http.go
+++ b/safeweb/http.go
@@ -19,7 +19,7 @@
 // package. The application must template the CSRF token into its forms using
 // the [TemplateField] and [TemplateTag] APIs. Applications that are served in a
 // secure context (over HTTPS) should also set the SecureContext field to true
-// to ensure that the the CSRF cookies are marked as Secure.
+// to ensure that the CSRF cookies are marked as Secure.
 //
 // In addition, browser routes will also have the following applied:
 //   - Content-Security-Policy header that disallows inline scripts, framing, and third party resources.
diff --git a/scripts/installer.sh b/scripts/installer.sh
index 2c15ea657..97ccac08e 100755
--- a/scripts/installer.sh
+++ b/scripts/installer.sh
@@ -55,7 +55,7 @@ main() {
 		VERSION_MAJOR="${VERSION_ID:-}"
 		VERSION_MAJOR="${VERSION_MAJOR%%.*}"
 		case "$ID" in
-			ubuntu|pop|neon|zorin|tuxedo)
+			ubuntu|pop|neon|tuxedo)
 				OS="ubuntu"
 				if [ "${UBUNTU_CODENAME:-}" != "" ]; then
 				    VERSION="$UBUNTU_CODENAME"
@@ -266,7 +266,7 @@ main() {
 				VERSION="leap/$VERSION_ID"
 				PACKAGETYPE="zypper"
 				;;
-			opensuse-tumbleweed)
+			opensuse-tumbleweed|opensuse-slowroll)
 				OS="opensuse"
 				VERSION="tumbleweed"
 				PACKAGETYPE="zypper"
@@ -336,6 +336,16 @@ main() {
 				VERSION="$VERSION_MAJOR"
 				PACKAGETYPE="tdnf"
 				;;
+			zorin)
+				OS="ubuntu"
+				VERSION="$UBUNTU_CODENAME"
+				PACKAGETYPE="apt"
+				if [ "$VERSION_MAJOR" -lt 16 ]; then
+					APT_KEY_TYPE="legacy"
+				else
+					APT_KEY_TYPE="keyring"
+				fi
+				;;
 			steamos)
 				echo "To install Tailscale on SteamOS, please follow the instructions here:"
 				echo "https://github.com/tailscale-dev/deck-tailscale"
@@ -343,7 +353,7 @@ main() {
 				;;
 			kde-linux)
 				echo "The maintainers of KDE Linux provide documentation on multiple ways to install Tailscale. These instructions are not officially supported by Tailscale:"
-				echo "https://kde.org/linux/docs/more-software/#tailscale"
+				echo "https://linux.kde.org/docs/more-software/#tailscale"
 				exit 1
 				;;
 
@@ -524,7 +534,6 @@ main() {
 	[ "$VERSION" != "" ] && OSVERSION="$OSVERSION $VERSION"
 
 	# Prepare package name with optional version
-	PACKAGE_NAME="tailscale"
 	if [ -n "$TAILSCALE_VERSION" ]; then
 		echo "Installing Tailscale $TAILSCALE_VERSION for $OSVERSION, using method $PACKAGETYPE"
 	else
diff --git a/sessionrecording/connect.go b/sessionrecording/connect.go
index 6135688ca..6154c4e8d 100644
--- a/sessionrecording/connect.go
+++ b/sessionrecording/connect.go
@@ -18,6 +18,7 @@ import (
 	"sync/atomic"
 	"time"
 
+	"tailscale.com/net/netutil"
 	"tailscale.com/net/netx"
 	"tailscale.com/tailcfg"
 	"tailscale.com/util/httpm"
@@ -38,6 +39,9 @@ const (
 // in tests.
 var uploadAckWindow = 30 * time.Second
 
+// idleConnTimeout is the idle timeout for connections to the recorder.
+var idleConnTimeout = 30 * time.Second
+
 // ConnectToRecorder connects to the recorder at any of the provided addresses.
 // It returns the first successful response, or a multierr if all attempts fail.
 //
@@ -233,6 +237,7 @@ func connectV1(ctx context.Context, hc *http.Client, ap netip.AddrPort) (io.Writ
 	// errChan is used to indicate the result of the request.
 	errChan := make(chan error, 1)
 	go func() {
+		defer hc.CloseIdleConnections()
 		defer close(errChan)
 		resp, err := hc.Do(req)
 		if err != nil {
@@ -291,6 +296,7 @@ func connectV2(ctx context.Context, hc *http.Client, ap netip.AddrPort) (io.Writ
 	acks := make(chan int64)
 	// Read acks from the response and send them to the acks channel.
 	go func() {
+		defer hc.CloseIdleConnections()
 		defer close(errChan)
 		defer close(acks)
 		defer resp.Body.Close()
@@ -380,7 +386,7 @@ func (u *readCounter) Read(buf []byte) (int, error) {
 // clientHTTP1 returns a claassic http.Client with a per-dial context. It uses
 // dialCtx and adds a 5s timeout to it.
 func clientHTTP1(dialCtx context.Context, dial netx.DialFunc) *http.Client {
-	tr := http.DefaultTransport.(*http.Transport).Clone()
+	tr := netutil.NewDefaultTransport()
 	tr.DialContext = func(ctx context.Context, network, addr string) (net.Conn, error) {
 		perAttemptCtx, cancel := context.WithTimeout(ctx, perDialAttemptTimeout)
 		defer cancel()
@@ -393,6 +399,7 @@ func clientHTTP1(dialCtx context.Context, dial netx.DialFunc) *http.Client {
 		}()
 		return dial(perAttemptCtx, network, addr)
 	}
+	tr.IdleConnTimeout = idleConnTimeout
 	return &http.Client{Transport: tr}
 }
 
@@ -417,6 +424,7 @@ func clientHTTP2(dialCtx context.Context, dial netx.DialFunc) *http.Client {
 				}()
 				return dial(perAttemptCtx, network, addr)
 			},
+			IdleConnTimeout: idleConnTimeout,
 		},
 	}
 }
diff --git a/shell.nix b/shell.nix
index 17720bb3d..c7aa98323 100644
--- a/shell.nix
+++ b/shell.nix
@@ -16,4 +16,4 @@
 ) {
   src =  ./.;
 }).shellNix
-# nix-direnv cache busting line: sha256-aZkUnWyQokNw+lxut9Fak3CazmwYE4tXILhzfK4jeK4=
+# nix-direnv cache busting line: sha256-5ClQ5fSyEHUlhPtZI0ir8ddQRXSnqOG5VIJ3KjWtXmw=
diff --git a/ssh/tailssh/accept_env.go b/ssh/tailssh/accept_env.go
index 6354d41d7..64f979c2a 100644
--- a/ssh/tailssh/accept_env.go
+++ b/ssh/tailssh/accept_env.go
@@ -9,6 +9,17 @@ import (
 	"strings"
 )
 
+// isDangerousEnvVar reports whether the given environment variable name
+// is unconditionally prohibited from being forwarded, regardless of
+// acceptEnv policy. This prevents privilege escalation via dynamic
+// linker environment variables (e.g. LD_PRELOAD, LD_LIBRARY_PATH,
+// DYLD_INSERT_LIBRARIES) even when a wildcard acceptEnv pattern like
+// "*" is configured.
+func isDangerousEnvVar(name string) bool {
+	upper := strings.ToUpper(name)
+	return strings.HasPrefix(upper, "LD_") || strings.HasPrefix(upper, "DYLD_")
+}
+
 // filterEnv filters a passed in environ string slice (a slice with strings
 // representing environment variables in the form "key=value") based on
 // the supplied slice of acceptEnv values.
@@ -18,6 +29,10 @@ import (
 //
 // acceptEnv values may contain * and ? wildcard characters which match against
 // zero or one or more characters and a single character respectively.
+//
+// Certain dangerous environment variables (such as those controlling the
+// dynamic linker) are always rejected regardless of the acceptEnv policy.
+// See isDangerousEnvVar.
 func filterEnv(acceptEnv []string, environ []string) ([]string, error) {
 	var acceptedPairs []string
 
@@ -32,6 +47,12 @@ func filterEnv(acceptEnv []string, environ []string) ([]string, error) {
 			return nil, fmt.Errorf(`invalid environment variable: %q. Variables must be in "KEY=VALUE" format`, envPair)
 		}
 
+		// Always reject dangerous environment variables that could
+		// enable privilege escalation, regardless of acceptEnv policy.
+		if isDangerousEnvVar(variableName) {
+			continue
+		}
+
 		// Short circuit if we have a direct match between the environment
 		// variable and an AcceptEnv value.
 		if slices.Contains(acceptEnv, variableName) {
diff --git a/ssh/tailssh/accept_env_test.go b/ssh/tailssh/accept_env_test.go
index fef13877a..bf37c581e 100644
--- a/ssh/tailssh/accept_env_test.go
+++ b/ssh/tailssh/accept_env_test.go
@@ -10,6 +10,39 @@ import (
 	"github.com/google/go-cmp/cmp"
 )
 
+func TestIsDangerousEnvVar(t *testing.T) {
+	tests := []struct {
+		name      string
+		dangerous bool
+	}{
+		{"LD_PRELOAD", true},
+		{"LD_LIBRARY_PATH", true},
+		{"LD_AUDIT", true},
+		{"LD_DEBUG", true},
+		{"LD_PROFILE", true},
+		{"ld_preload", true},
+		{"DYLD_INSERT_LIBRARIES", true},
+		{"DYLD_LIBRARY_PATH", true},
+		{"DYLD_FRAMEWORK_PATH", true},
+		{"dyld_insert_libraries", true},
+		{"TERM", false},
+		{"LANG", false},
+		{"LC_ALL", false},
+		{"PATH", false},
+		{"HOME", false},
+		{"LDFLAGS", false},
+		{"MY_LD_PRELOAD", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := isDangerousEnvVar(tt.name); got != tt.dangerous {
+				t.Errorf("isDangerousEnvVar(%q) = %v, want %v", tt.name, got, tt.dangerous)
+			}
+		})
+	}
+}
+
 func TestMatchAcceptEnvPattern(t *testing.T) {
 	testCases := []struct {
 		pattern string
@@ -135,6 +168,42 @@ func TestFilterEnv(t *testing.T) {
 			expectedFiltered: nil,
 			wantErrMessage:   `invalid environment variable: "FOOBAR". Variables must be in "KEY=VALUE" format`,
 		},
+		{
+			name:             "ld-preload-rejected-with-wildcard",
+			acceptEnv:        []string{"*"},
+			environ:          []string{"LD_PRELOAD=/tmp/evil.so", "TERM=xterm"},
+			expectedFiltered: []string{"TERM=xterm"},
+		},
+		{
+			name:             "ld-vars-rejected-with-wildcard",
+			acceptEnv:        []string{"*"},
+			environ:          []string{"LD_PRELOAD=/tmp/evil.so", "LD_LIBRARY_PATH=/tmp", "LD_AUDIT=/tmp/audit.so", "SAFE_VAR=ok"},
+			expectedFiltered: []string{"SAFE_VAR=ok"},
+		},
+		{
+			name:             "ld-vars-rejected-with-explicit-match",
+			acceptEnv:        []string{"LD_PRELOAD", "LD_LIBRARY_PATH"},
+			environ:          []string{"LD_PRELOAD=/tmp/evil.so", "LD_LIBRARY_PATH=/tmp"},
+			expectedFiltered: nil,
+		},
+		{
+			name:             "ld-vars-rejected-with-prefix-pattern",
+			acceptEnv:        []string{"LD_*"},
+			environ:          []string{"LD_PRELOAD=/tmp/evil.so", "LD_LIBRARY_PATH=/tmp"},
+			expectedFiltered: nil,
+		},
+		{
+			name:             "ld-vars-case-insensitive",
+			acceptEnv:        []string{"*"},
+			environ:          []string{"ld_preload=/tmp/evil.so", "Ld_Library_Path=/tmp", "SAFE=ok"},
+			expectedFiltered: []string{"SAFE=ok"},
+		},
+		{
+			name:             "dyld-vars-rejected",
+			acceptEnv:        []string{"*"},
+			environ:          []string{"DYLD_INSERT_LIBRARIES=/tmp/evil.dylib", "DYLD_LIBRARY_PATH=/tmp", "TERM=xterm"},
+			expectedFiltered: []string{"TERM=xterm"},
+		},
 	}
 
 	for _, tc := range testCases {
diff --git a/ssh/tailssh/incubator.go b/ssh/tailssh/incubator.go
index c20b18d3e..48c65e8e5 100644
--- a/ssh/tailssh/incubator.go
+++ b/ssh/tailssh/incubator.go
@@ -202,7 +202,7 @@ func (ss *sshSession) newIncubatorCommand(logf logger.Logf) (cmd *exec.Cmd, err
 		incubatorArgs = append(incubatorArgs, "--is-selinux-enforcing")
 	}
 
-	nm := ss.conn.srv.lb.NetMap()
+	nm := ss.conn.srv.lb.NetMapNoPeers()
 	forceV1Behavior := nm.HasCap(tailcfg.NodeAttrSSHBehaviorV1) && !nm.HasCap(tailcfg.NodeAttrSSHBehaviorV2)
 	if forceV1Behavior {
 		incubatorArgs = append(incubatorArgs, "--force-v1-behavior")
diff --git a/ssh/tailssh/incubator_plan9.go b/ssh/tailssh/incubator_plan9.go
index 69112635f..8d0031413 100644
--- a/ssh/tailssh/incubator_plan9.go
+++ b/ssh/tailssh/incubator_plan9.go
@@ -92,7 +92,7 @@ func (ss *sshSession) newIncubatorCommand(logf logger.Logf) (cmd *exec.Cmd, err
 		"--tty-name=",     // updated in-place by startWithPTY
 	}
 
-	nm := ss.conn.srv.lb.NetMap()
+	nm := ss.conn.srv.lb.NetMapNoPeers()
 	forceV1Behavior := nm.HasCap(tailcfg.NodeAttrSSHBehaviorV1) && !nm.HasCap(tailcfg.NodeAttrSSHBehaviorV2)
 	if forceV1Behavior {
 		incubatorArgs = append(incubatorArgs, "--force-v1-behavior")
diff --git a/ssh/tailssh/listen.go b/ssh/tailssh/listen.go
new file mode 100644
index 000000000..8c98127f2
--- /dev/null
+++ b/ssh/tailssh/listen.go
@@ -0,0 +1,136 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build (linux && !android) || (darwin && !ios) || freebsd || openbsd || plan9
+
+package tailssh
+
+import (
+	"errors"
+	"net"
+	"net/netip"
+	"sync"
+
+	gliderssh "github.com/tailscale/gliderssh"
+	"tailscale.com/ipn/ipnlocal"
+	"tailscale.com/types/logger"
+)
+
+func init() {
+	ipnlocal.HookListenSSH.Set(listenSSH)
+}
+
+// listenSSH wraps rawLn with an SSH server that resolves Tailscale peer
+// identity for each connection. The returned listener's Accept yields
+// *Session values (as net.Conn).
+func listenSSH(rawLn net.Listener, lb *ipnlocal.LocalBackend, logf logger.Logf) (net.Listener, error) {
+	hostKeys, err := getHostKeys(lb.TailscaleVarRoot(), logf)
+	if err != nil {
+		return nil, err
+	}
+	signers := make([]gliderssh.Signer, len(hostKeys))
+	for i, k := range hostKeys {
+		signers[i] = k
+	}
+
+	sl := &sshListener{
+		rawLn:    rawLn,
+		sessions: make(chan net.Conn, 16),
+		done:     make(chan struct{}),
+	}
+
+	sshSrv := &gliderssh.Server{
+		HostSigners: signers,
+		Handler: func(sess gliderssh.Session) {
+			srcAddr := sess.RemoteAddr().String()
+			ipp, err := netip.ParseAddrPort(srcAddr)
+			if err != nil {
+				logf("listenSSH: bad remote addr %q: %v", srcAddr, err)
+				sess.Exit(1)
+				return
+			}
+			node, userProfile, ok := lb.WhoIs("tcp", ipp)
+			if !ok {
+				logf("listenSSH: WhoIs failed for %v", srcAddr)
+				sess.Exit(1)
+				return
+			}
+
+			done := make(chan struct{})
+			s := newSession(sess, peerIdentity{
+				Node:        node,
+				UserProfile: userProfile,
+			}, done)
+
+			// Send the session to the listener. If the listener is
+			// closed, drop the session.
+			select {
+			case sl.sessions <- s:
+			case <-sl.done:
+				sess.Exit(1)
+				return
+			}
+
+			// Block until the consumer is done with the session.
+			select {
+			case <-done:
+			case <-sess.Context().Done():
+			case <-sl.done:
+			}
+		},
+	}
+
+	go func() {
+		if err := sshSrv.Serve(rawLn); err != nil {
+			// Serve returns when the listener is closed. Only log
+			// unexpected errors.
+			select {
+			case <-sl.done:
+			default:
+				logf("listenSSH: Serve error: %v", err)
+			}
+		}
+		sl.Close()
+	}()
+
+	return sl, nil
+}
+
+// sshListener is a net.Listener that yields *Session values from its Accept
+// method. It wraps a raw TCP listener with an SSH server.
+type sshListener struct {
+	rawLn     net.Listener
+	sessions  chan net.Conn
+	done      chan struct{}
+	closeOnce sync.Once
+}
+
+// Accept returns the next SSH session as a net.Conn. The returned value can
+// be type-asserted to *Session.
+func (sl *sshListener) Accept() (net.Conn, error) {
+	select {
+	case s, ok := <-sl.sessions:
+		if !ok {
+			return nil, errors.New("listener closed")
+		}
+		return s, nil
+	case <-sl.done:
+		return nil, errors.New("listener closed")
+	}
+}
+
+// Close closes the underlying raw listener and signals all pending sessions
+// to terminate.
+func (sl *sshListener) Close() error {
+	var err error
+	sl.closeOnce.Do(func() {
+		close(sl.done)
+		err = sl.rawLn.Close()
+	})
+	return err
+}
+
+// Addr returns the address of the underlying raw listener.
+func (sl *sshListener) Addr() net.Addr {
+	return sl.rawLn.Addr()
+}
diff --git a/ssh/tailssh/privs_test.go b/ssh/tailssh/privs_test.go
index 7ddc9c861..bd483e2b4 100644
--- a/ssh/tailssh/privs_test.go
+++ b/ssh/tailssh/privs_test.go
@@ -20,6 +20,7 @@ import (
 	"syscall"
 	"testing"
 
+	"tailscale.com/tstest"
 	"tailscale.com/types/logger"
 )
 
@@ -71,9 +72,7 @@ func TestDoDropPrivileges(t *testing.T) {
 		os.Exit(0)
 	}
 
-	if os.Getuid() != 0 {
-		t.Skip("test only works when run as root")
-	}
+	tstest.RequireRoot(t)
 
 	rerunSelf := func(t *testing.T, input SubprocInput) []byte {
 		fpath := filepath.Join(t.TempDir(), "out.json")
diff --git a/ssh/tailssh/session.go b/ssh/tailssh/session.go
new file mode 100644
index 000000000..c19ae7bd4
--- /dev/null
+++ b/ssh/tailssh/session.go
@@ -0,0 +1,210 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build (linux && !android) || (darwin && !ios) || freebsd || openbsd || plan9
+
+package tailssh
+
+import (
+	"context"
+	"errors"
+	"io"
+	"maps"
+	"net"
+	"sync"
+	"time"
+
+	gliderssh "github.com/tailscale/gliderssh"
+	"tailscale.com/tailcfg"
+)
+
+var errNoDeadline = errors.New("tailssh.Session: deadlines not supported")
+
+// Signal represents an SSH signal (e.g. "INT", "TERM").
+type Signal = gliderssh.Signal
+
+// Pty represents a PTY request and configuration.
+type Pty struct {
+	// Term is the TERM environment variable value.
+	Term string
+
+	// Window is the initial window size.
+	Window Window
+
+	// Modes are the RFC 4254 terminal modes as opcode/value pairs.
+	Modes map[uint8]uint32
+}
+
+// Window represents the size of a PTY window.
+type Window struct {
+	Width        int // columns
+	Height       int // rows
+	WidthPixels  int // width in pixels
+	HeightPixels int // height in pixels
+}
+
+// peerIdentity contains the Tailscale identity of the connecting SSH peer.
+type peerIdentity struct {
+	Node        tailcfg.NodeView // node connecting
+	UserProfile tailcfg.UserProfile
+}
+
+// Session wraps a gliderlabs gliderssh.Session with Tailscale peer identity
+// information. It implements net.Conn so callers that only need Read/Write/Close
+// can use it directly. Callers that need SSH-specific functionality can
+// type-assert from the net.Conn returned by the listener's Accept.
+type Session struct {
+	// sess is the underlying gliderlabs SSH session.
+	sess gliderssh.Session
+
+	// peer is the Tailscale identity of the remote peer.
+	peer peerIdentity
+
+	// done is closed when the session handler should return,
+	// unblocking the gliderlabs handler goroutine.
+	doneOnce sync.Once // guards close(done)
+	done     chan struct{}
+}
+
+// newSession creates a new Session wrapping the given gliderlabs session and
+// peer identity. The done channel is closed by the session consumer to signal
+// that the handler goroutine may return.
+func newSession(sess gliderssh.Session, peer peerIdentity, done chan struct{}) *Session {
+	return &Session{
+		sess: sess,
+		peer: peer,
+		done: done,
+	}
+}
+
+// Read reads from the SSH channel (stdin from the client).
+func (s *Session) Read(p []byte) (int, error) {
+	return s.sess.Read(p)
+}
+
+// Write writes to the SSH channel (stdout to the client).
+func (s *Session) Write(p []byte) (int, error) {
+	return s.sess.Write(p)
+}
+
+// Close signals the session handler to return and closes the underlying channel.
+func (s *Session) Close() error {
+	s.doneOnce.Do(func() { close(s.done) })
+	return nil
+}
+
+// RemoteAddr returns the net.Addr of the client side of the connection.
+func (s *Session) RemoteAddr() net.Addr {
+	return s.sess.RemoteAddr()
+}
+
+// LocalAddr returns the net.Addr of the server side of the connection.
+func (s *Session) LocalAddr() net.Addr {
+	return s.sess.LocalAddr()
+}
+
+// SetDeadline is not supported and returns an error.
+func (s *Session) SetDeadline(t time.Time) error {
+	return errNoDeadline
+}
+
+// SetReadDeadline is not supported and returns an error.
+func (s *Session) SetReadDeadline(t time.Time) error {
+	return errNoDeadline
+}
+
+// SetWriteDeadline is not supported and returns an error.
+func (s *Session) SetWriteDeadline(t time.Time) error {
+	return errNoDeadline
+}
+
+// User returns the SSH username.
+func (s *Session) User() string {
+	return s.sess.User()
+}
+
+// Peer returns the Tailscale identity of the remote node.
+func (s *Session) Peer() tailcfg.NodeView { return s.peer.Node }
+
+// UserProfile returns the Tailscale user profile of the remote node.
+//
+// For tagged nodes, this is same sort of UserProfile that is returned by the
+// LocalAPI WhoIs API.
+func (s *Session) UserProfile() tailcfg.UserProfile { return s.peer.UserProfile }
+
+// Environ returns a copy of the environment variables set by the client.
+func (s *Session) Environ() []string {
+	return s.sess.Environ()
+}
+
+// RawCommand returns the exact command string provided by the client.
+func (s *Session) RawCommand() string {
+	return s.sess.RawCommand()
+}
+
+// Subsystem returns the subsystem requested by the client.
+func (s *Session) Subsystem() string {
+	return s.sess.Subsystem()
+}
+
+// Pty returns PTY information, a channel of window size changes, and whether a
+// PTY was requested.
+func (s *Session) Pty() (_ Pty, _ <-chan Window, ok bool) {
+	gPty, gWinCh, ok := s.sess.Pty()
+	if !ok {
+		return Pty{}, nil, false
+	}
+	p := Pty{
+		Term: gPty.Term,
+		Window: Window{
+			Width:        gPty.Window.Width,
+			Height:       gPty.Window.Height,
+			WidthPixels:  gPty.Window.WidthPixels,
+			HeightPixels: gPty.Window.HeightPixels,
+		},
+	}
+	if gPty.Modes != nil {
+		p.Modes = make(map[uint8]uint32, len(gPty.Modes))
+		maps.Copy(p.Modes, gPty.Modes)
+	}
+
+	// Convert the gliderlabs Window channel to our Window type.
+	winCh := make(chan Window, 1)
+	go func() {
+		defer close(winCh)
+		for gw := range gWinCh {
+			winCh <- Window{
+				Width:        gw.Width,
+				Height:       gw.Height,
+				WidthPixels:  gw.WidthPixels,
+				HeightPixels: gw.HeightPixels,
+			}
+		}
+	}()
+
+	return p, winCh, true
+}
+
+// Signals registers a channel to receive signals from the client.
+// Pass nil to unregister.
+func (s *Session) Signals(c chan<- Signal) {
+	s.sess.Signals(c)
+}
+
+// Exit sends an exit status to the client and closes the session.
+func (s *Session) Exit(code int) error {
+	err := s.sess.Exit(code)
+	s.Close()
+	return err
+}
+
+// Stderr returns an io.Writer for the SSH stderr channel.
+func (s *Session) Stderr() io.Writer {
+	return s.sess.Stderr()
+}
+
+// Context returns the session's context, which is canceled when the client
+// disconnects.
+func (s *Session) Context() context.Context {
+	return s.sess.Context()
+}
diff --git a/ssh/tailssh/tailssh.go b/ssh/tailssh/tailssh.go
index c13d3d29e..4408683eb 100644
--- a/ssh/tailssh/tailssh.go
+++ b/ssh/tailssh/tailssh.go
@@ -39,6 +39,7 @@ import (
 	"tailscale.com/net/tsdial"
 	"tailscale.com/sessionrecording"
 	"tailscale.com/tailcfg"
+	"tailscale.com/tstime"
 	"tailscale.com/types/key"
 	"tailscale.com/types/logger"
 	"tailscale.com/types/netmap"
@@ -46,6 +47,7 @@ import (
 	"tailscale.com/util/clientmetric"
 	"tailscale.com/util/httpm"
 	"tailscale.com/util/mak"
+	"tailscale.com/version/distro"
 )
 
 var (
@@ -76,6 +78,7 @@ const (
 type ipnLocalBackend interface {
 	ShouldRunSSH() bool
 	NetMap() *netmap.NetworkMap
+	NetMapNoPeers() *netmap.NetworkMap
 	WhoIs(proto string, ipp netip.AddrPort) (n tailcfg.NodeView, u tailcfg.UserProfile, ok bool)
 	DoNoiseRequest(req *http.Request) (*http.Response, error)
 	Dialer() *tsdial.Dialer
@@ -478,7 +481,7 @@ func (srv *server) newConn() (*conn, error) {
 	srv.mu.Unlock()
 	c := &conn{srv: srv}
 	now := srv.now()
-	c.connID = fmt.Sprintf("ssh-conn-%s-%02x", now.UTC().Format("20060102T150405"), randBytes(5))
+	c.connID = fmt.Sprintf("ssh-conn-%s-%02x", now.UTC().Format(tstime.BasicDateTTime), randBytes(5))
 	fwdHandler := &gliderssh.ForwardedTCPHandler{}
 	streamLocalFwdHandler := &gliderssh.ForwardedUnixHandler{}
 	c.Server = &gliderssh.Server{
@@ -598,7 +601,7 @@ func (c *conn) sshPolicy() (_ *tailcfg.SSHPolicy, ok bool) {
 	if !lb.ShouldRunSSH() {
 		return nil, false
 	}
-	nm := lb.NetMap()
+	nm := lb.NetMapNoPeers()
 	if nm == nil {
 		return nil, false
 	}
@@ -717,7 +720,7 @@ func (c *conn) handleSessionPostSSHAuth(s gliderssh.Session) {
 }
 
 func (c *conn) expandDelegateURLLocked(actionURL string) string {
-	nm := c.srv.lb.NetMap()
+	nm := c.srv.lb.NetMapNoPeers()
 	ci := c.info
 	lu := c.localUser
 	var dstNodeID string
@@ -775,7 +778,7 @@ func (ss *sshSession) vlogf(format string, args ...any) {
 }
 
 func (c *conn) newSSHSession(s gliderssh.Session) *sshSession {
-	sharedID := fmt.Sprintf("sess-%s-%02x", c.srv.now().UTC().Format("20060102T150405"), randBytes(5))
+	sharedID := fmt.Sprintf("sess-%s-%02x", c.srv.now().UTC().Format(tstime.BasicDateTTime), randBytes(5))
 	c.logf("starting session: %v", sharedID)
 	ctx, cancel := context.WithCancelCause(s.Context())
 	return &sshSession{
@@ -1253,6 +1256,22 @@ func mapLocalUser(ruleSSHUsers map[string]string, reqSSHUser string) (localUser
 		v = ruleSSHUsers["*"]
 	}
 	if v == "=" {
+		// Skip lookup for gokrazy as we intentionally fall back to a synthesized
+		// root user there when user lookup fails.
+		if distro.Get() == distro.Gokrazy {
+			return reqSSHUser
+		}
+
+		// Immediately look up user information for purposes of generating
+		// hold and delegate URL (if necessary).
+		lu, err := userLookup(reqSSHUser)
+		if err != nil {
+			return ""
+		}
+		// Don't match as root for autogroup:nonroot
+		if lu.Uid == "0" || lu.Username == "root" {
+			return ""
+		}
 		return reqSSHUser
 	}
 	return v
diff --git a/ssh/tailssh/tailssh_integration_test.go b/ssh/tailssh/tailssh_integration_test.go
index d49ca8eef..7b70a6d51 100644
--- a/ssh/tailssh/tailssh_integration_test.go
+++ b/ssh/tailssh/tailssh_integration_test.go
@@ -6,7 +6,6 @@
 package tailssh
 
 import (
-	"bufio"
 	"bytes"
 	"context"
 	"crypto/rand"
@@ -60,56 +59,33 @@ import (
 var testVarRoot string
 
 func TestMain(m *testing.M) {
+	debugTest.Store(true)
+
+	// Create our log file.
+	if err := os.WriteFile("/tmp/tailscalessh.log", nil, 0666); err != nil {
+		log.Fatal(err)
+	}
+
+	// Create a temp directory for SSH host keys.
 	var err error
 	testVarRoot, err = os.MkdirTemp("", "tailssh-test-var")
 	if err != nil {
 		log.Fatal(err)
 	}
-	defer os.RemoveAll(testVarRoot)
 
-	// Create our log file.
-	file, err := os.OpenFile("/tmp/tailscalessh.log", os.O_CREATE|os.O_WRONLY, 0666)
-	if err != nil {
-		log.Fatal(err)
-	}
-	file.Close()
+	code := m.Run()
 
-	// Tail our log file.
-	cmd := exec.Command("tail", "-F", "/tmp/tailscalessh.log")
+	os.RemoveAll(testVarRoot)
 
-	r, err := cmd.StdoutPipe()
-	if err != nil {
-		return
+	// Print any log output from the incubator subprocesses.
+	if b, err := os.ReadFile("/tmp/tailscalessh.log"); err == nil && len(b) > 0 {
+		log.Print(string(b))
 	}
 
-	scanner := bufio.NewScanner(r)
-	go func() {
-		for scanner.Scan() {
-			line := scanner.Text()
-			log.Println(line)
-		}
-	}()
-
-	err = cmd.Start()
-	if err != nil {
-		return
-	}
-	defer func() {
-		// tail -f has a default sleep interval of 1 second, so it takes a
-		// moment for it to finish reading our log file after we've terminated.
-		// So, wait a bit to let it catch up.
-		time.Sleep(2 * time.Second)
-	}()
-
-	m.Run()
+	os.Exit(code)
 }
 
 func TestIntegrationSSH(t *testing.T) {
-	debugTest.Store(true)
-	t.Cleanup(func() {
-		debugTest.Store(false)
-	})
-
 	homeDir := "/home/testuser"
 	if runtime.GOOS == "darwin" {
 		homeDir = "/Users/testuser"
@@ -215,11 +191,6 @@ func TestIntegrationSSH(t *testing.T) {
 }
 
 func TestIntegrationSFTP(t *testing.T) {
-	debugTest.Store(true)
-	t.Cleanup(func() {
-		debugTest.Store(false)
-	})
-
 	for _, forceV1Behavior := range []bool{false, true} {
 		name := "v2"
 		if forceV1Behavior {
@@ -276,11 +247,6 @@ func TestIntegrationSFTP(t *testing.T) {
 }
 
 func TestIntegrationSCP(t *testing.T) {
-	debugTest.Store(true)
-	t.Cleanup(func() {
-		debugTest.Store(false)
-	})
-
 	for _, forceV1Behavior := range []bool{false, true} {
 		name := "v2"
 		if forceV1Behavior {
@@ -334,11 +300,6 @@ func TestIntegrationSCP(t *testing.T) {
 }
 
 func TestSSHAgentForwarding(t *testing.T) {
-	debugTest.Store(true)
-	t.Cleanup(func() {
-		debugTest.Store(false)
-	})
-
 	// Create a client SSH key
 	tmpDir, err := os.MkdirTemp("", "")
 	if err != nil {
@@ -428,11 +389,6 @@ func TestSSHAgentForwarding(t *testing.T) {
 // request 'none' auth and instead immediately authenticate with a public key
 // or password.
 func TestIntegrationParamiko(t *testing.T) {
-	debugTest.Store(true)
-	t.Cleanup(func() {
-		debugTest.Store(false)
-	})
-
 	addr := testServer(t, "testuser", true, false)
 	host, port, err := net.SplitHostPort(addr)
 	if err != nil {
@@ -736,26 +692,34 @@ func (s *session) run(t *testing.T, cmdString string, shell bool) string {
 func (s *session) read() string {
 	ch := make(chan []byte)
 	go func() {
+		defer close(ch)
 		for {
 			b := make([]byte, 1)
 			n, err := s.stdout.Read(b)
 			if n > 0 {
 				ch <- b
 			}
-			if err == io.EOF {
+			if err != nil {
 				return
 			}
 		}
 	}()
 
 	// Read first byte in blocking fashion.
-	_got := <-ch
+	b, ok := <-ch
+	if !ok {
+		return ""
+	}
+	_got := b
 
-	// Read subsequent bytes in non-blocking fashion.
+	// Read subsequent bytes until EOF or silence.
 readLoop:
 	for {
 		select {
-		case b := <-ch:
+		case b, ok := <-ch:
+			if !ok {
+				break readLoop
+			}
 			_got = append(_got, b...)
 		case <-time.After(1 * time.Second):
 			break readLoop
@@ -937,8 +901,8 @@ func (tb *testBackend) NetMap() *netmap.NetworkMap {
 						AllowLocalPortForwarding:  tb.allowLocalPortForwarding,
 						AllowRemotePortForwarding: tb.allowRemotePortForwarding,
 					},
-					SSHUsers:   map[string]string{"*": tb.localUser},
-					AcceptEnv:  []string{"GIT_*", "EXACT_MATCH", "TEST?NG"},
+					SSHUsers:  map[string]string{"*": tb.localUser},
+					AcceptEnv: []string{"GIT_*", "EXACT_MATCH", "TEST?NG"},
 				},
 			},
 		},
@@ -946,6 +910,8 @@ func (tb *testBackend) NetMap() *netmap.NetworkMap {
 	}
 }
 
+func (tb *testBackend) NetMapNoPeers() *netmap.NetworkMap { return tb.NetMap() }
+
 func (tb *testBackend) WhoIs(_ string, ipp netip.AddrPort) (n tailcfg.NodeView, u tailcfg.UserProfile, ok bool) {
 	return (&tailcfg.Node{}).View(), tailcfg.UserProfile{
 		LoginName: tb.localUser + "@example.com",
diff --git a/ssh/tailssh/tailssh_test.go b/ssh/tailssh/tailssh_test.go
index c8b5f698b..234ac1c12 100644
--- a/ssh/tailssh/tailssh_test.go
+++ b/ssh/tailssh/tailssh_test.go
@@ -6,6 +6,7 @@
 package tailssh
 
 import (
+	"bufio"
 	"bytes"
 	"context"
 	"crypto/ecdsa"
@@ -36,6 +37,7 @@ import (
 	gliderssh "github.com/tailscale/gliderssh"
 	"golang.org/x/net/http2"
 	"golang.org/x/net/http2/h2c"
+	"tailscale.com/cmd/testwrapper/flakytest"
 	"tailscale.com/ipn/ipnlocal"
 	"tailscale.com/ipn/store/mem"
 	"tailscale.com/net/memnet"
@@ -57,6 +59,10 @@ import (
 
 func TestMatchRule(t *testing.T) {
 	someAction := new(tailcfg.SSHAction)
+	// nonRootUser is a real non-root user in the local passwd database,
+	// used by the "ssh-user-equal" case because mapLocalUser now does a
+	// userLookup (via getent) when the mapped value is "=" and rejects root.
+	nonRootUser := aNonRootUser(t)
 	tests := []struct {
 		name          string
 		rule          *tailcfg.SSHRule
@@ -218,8 +224,8 @@ func TestMatchRule(t *testing.T) {
 					"*": "=",
 				},
 			},
-			ci:       &sshConnInfo{sshUser: "alice"},
-			wantUser: "alice",
+			ci:       &sshConnInfo{sshUser: nonRootUser},
+			wantUser: nonRootUser,
 		},
 	}
 	for _, tt := range tests {
@@ -386,7 +392,47 @@ type localState struct {
 	serverActions map[string]*tailcfg.SSHAction
 }
 
-var currentUser = os.Getenv("USER") // Use the current user for the test.
+var currentUser = func() string {
+	// Prefer user.Current because the USER env var is not set in
+	// some environments (e.g. the golang:latest container used by CI).
+	if u, err := user.Current(); err == nil {
+		return u.Username
+	}
+	return os.Getenv("USER")
+}()
+
+// aNonRootUser returns the username of a non-root user that exists in the
+// local passwd database (verified via userLookup, which uses getent on
+// Linux). It prefers the current user, falling back to reading /etc/passwd
+// for a real non-root account when the tests are run as root (e.g. in CI).
+// It skips the test if no such user can be found.
+func aNonRootUser(t *testing.T) string {
+	t.Helper()
+	if u, err := userLookup(currentUser); err == nil && u.Uid != "0" && u.Username != "root" {
+		return currentUser
+	}
+	f, err := os.Open("/etc/passwd")
+	if err != nil {
+		t.Skipf("can't find a non-root user: %v", err)
+	}
+	defer f.Close()
+	scan := bufio.NewScanner(f)
+	for scan.Scan() {
+		fields := strings.Split(scan.Text(), ":")
+		if len(fields) < 3 {
+			continue
+		}
+		name, uid := fields[0], fields[2]
+		if uid == "0" || name == "root" {
+			continue
+		}
+		if _, err := userLookup(name); err == nil {
+			return name
+		}
+	}
+	t.Skip("can't find a non-root user in /etc/passwd")
+	return ""
+}
 
 func (ts *localState) Dialer() *tsdial.Dialer {
 	return &tsdial.Dialer{}
@@ -414,6 +460,8 @@ func (ts *localState) NetMap() *netmap.NetworkMap {
 	}
 }
 
+func (ts *localState) NetMapNoPeers() *netmap.NetworkMap { return ts.NetMap() }
+
 func (ts *localState) WhoIs(proto string, ipp netip.AddrPort) (n tailcfg.NodeView, u tailcfg.UserProfile, ok bool) {
 	if proto != "tcp" {
 		return tailcfg.NodeView{}, tailcfg.UserProfile{}, false
@@ -458,6 +506,7 @@ func newSSHRule(action *tailcfg.SSHAction) *tailcfg.SSHRule {
 	return &tailcfg.SSHRule{
 		SSHUsers: map[string]string{
 			"alice": currentUser,
+			"*":     "=",
 		},
 		Action: action,
 		Principals: []*tailcfg.SSHPrincipal{
@@ -469,6 +518,9 @@ func newSSHRule(action *tailcfg.SSHAction) *tailcfg.SSHRule {
 }
 
 func TestSSHRecordingCancelsSessionsOnUploadFailure(t *testing.T) {
+	if runtime.GOOS == "darwin" {
+		flakytest.Mark(t, "https://github.com/tailscale/tailscale/issues/7707")
+	}
 	if runtime.GOOS != "linux" && runtime.GOOS != "darwin" {
 		t.Skipf("skipping on %q; only runs on linux and darwin", runtime.GOOS)
 	}
@@ -790,6 +842,11 @@ func TestSSHAuthFlow(t *testing.T) {
 		Reject:  true,
 		Message: "Go Away!",
 	})
+	autogroupNonrootRule := newSSHRule(&tailcfg.SSHAction{
+		Accept:  true,
+		Message: "autogroup:nonroot",
+	})
+	autogroupNonrootRule.SSHUsers = map[string]string{"*": "="}
 
 	tests := []struct {
 		name         string
@@ -818,6 +875,72 @@ func TestSSHAuthFlow(t *testing.T) {
 			authErr:     true,
 			wantBanners: []string{`tailscale: tailnet policy does not permit you to SSH as user "alice"` + "\n"},
 		},
+		{
+			name:    "user-mismatch-numeric-username",
+			sshUser: "321",
+			state: &localState{
+				sshEnabled:   true,
+				varRoot:      varRoot,
+				matchingRule: bobRule,
+			},
+			authErr:     true,
+			wantBanners: []string{`tailscale: tailnet policy does not permit you to SSH as user "321"` + "\n"},
+		},
+		{
+			name:    "user-mismatch-root-uid",
+			sshUser: "0",
+			state: &localState{
+				sshEnabled:   true,
+				varRoot:      varRoot,
+				matchingRule: autogroupNonrootRule,
+			},
+			authErr:     true,
+			wantBanners: []string{`tailscale: tailnet policy does not permit you to SSH as user "0"` + "\n"},
+		},
+		{
+			name:    "user-mismatch-root-uid-leading-space",
+			sshUser: " 0",
+			state: &localState{
+				sshEnabled:   true,
+				varRoot:      varRoot,
+				matchingRule: autogroupNonrootRule,
+			},
+			authErr:     true,
+			wantBanners: []string{`tailscale: tailnet policy does not permit you to SSH as user " 0"` + "\n"},
+		},
+		{
+			name:    "user-mismatch-root-uid-force-password-auth",
+			sshUser: "0+password",
+			state: &localState{
+				sshEnabled:   true,
+				varRoot:      varRoot,
+				matchingRule: autogroupNonrootRule,
+			},
+			authErr:     true,
+			wantBanners: []string{`tailscale: tailnet policy does not permit you to SSH as user "0"` + "\n"},
+		},
+		{
+			name:    "user-mismatch-double-zero-force-password-auth",
+			sshUser: "00+password",
+			state: &localState{
+				sshEnabled:   true,
+				varRoot:      varRoot,
+				matchingRule: autogroupNonrootRule,
+			},
+			authErr:     true,
+			wantBanners: []string{`tailscale: tailnet policy does not permit you to SSH as user "00"` + "\n"},
+		},
+		{
+			name:    "user-mismatch-leading-plus",
+			sshUser: "+0",
+			state: &localState{
+				sshEnabled:   true,
+				varRoot:      varRoot,
+				matchingRule: autogroupNonrootRule,
+			},
+			authErr:     true,
+			wantBanners: []string{`tailscale: tailnet policy does not permit you to SSH as user "+0"` + "\n"},
+		},
 		{
 			name: "accept",
 			state: &localState{
diff --git a/ssh/tailssh/testcontainers/Dockerfile b/ssh/tailssh/testcontainers/Dockerfile
index 768791028..9d662ca1a 100644
--- a/ssh/tailssh/testcontainers/Dockerfile
+++ b/ssh/tailssh/testcontainers/Dockerfile
@@ -28,64 +28,68 @@ COPY tailssh.test .
 
 RUN chmod 755 tailscaled
 
-RUN echo "First run tests normally."
-RUN eval `ssh-agent -s` && TAILSCALED_PATH=`pwd`tailscaled ./tailssh.test -test.v -test.run TestSSHAgentForwarding
-RUN if echo "$BASE" | grep "ubuntu:"; then rm -Rf /home/testuser; fi
-RUN TAILSCALED_PATH=`pwd`tailscaled ./tailssh.test -test.v -test.run TestIntegrationSFTP
-RUN if echo "$BASE" | grep "ubuntu:"; then rm -Rf /home/testuser; fi
-RUN TAILSCALED_PATH=`pwd`tailscaled ./tailssh.test -test.v -test.run TestIntegrationSCP
-RUN if echo "$BASE" | grep "ubuntu:"; then rm -Rf /home/testuser; fi
-RUN TAILSCALED_PATH=`pwd`tailscaled ./tailssh.test -test.v -test.run TestIntegrationSSH
-RUN if echo "$BASE" | grep "ubuntu:"; then rm -Rf /home/testuser; fi
-RUN TAILSCALED_PATH=`pwd`tailscaled ./tailssh.test -test.v -test.run TestIntegrationParamiko
-RUN TAILSCALED_PATH=`pwd`tailscaled ./tailssh.test -test.v -test.run TestLocalUnixForwarding
-RUN TAILSCALED_PATH=`pwd`tailscaled ./tailssh.test -test.v -test.run TestReverseUnixForwarding
-RUN TAILSCALED_PATH=`pwd`tailscaled ./tailssh.test -test.v -test.run TestUnixForwardingDenied
-RUN TAILSCALED_PATH=`pwd`tailscaled ./tailssh.test -test.v -test.run TestUnixForwardingPathRestriction
+# Run tests normally.
+# On Ubuntu, delete testuser's home directory between tests to verify
+# that PAM's pam_mkhomedir recreates it each time.
+RUN set -e && \
+    eval $(ssh-agent -s) && \
+    TAILSCALED_PATH=$(pwd)/tailscaled ./tailssh.test -test.v -test.run TestSSHAgentForwarding && \
+    if echo "$BASE" | grep -q "ubuntu:"; then rm -Rf /home/testuser; fi && \
+    TAILSCALED_PATH=$(pwd)/tailscaled ./tailssh.test -test.v -test.run TestIntegrationSFTP && \
+    if echo "$BASE" | grep -q "ubuntu:"; then rm -Rf /home/testuser; fi && \
+    TAILSCALED_PATH=$(pwd)/tailscaled ./tailssh.test -test.v -test.run TestIntegrationSCP && \
+    if echo "$BASE" | grep -q "ubuntu:"; then rm -Rf /home/testuser; fi && \
+    TAILSCALED_PATH=$(pwd)/tailscaled ./tailssh.test -test.v -test.run TestIntegrationSSH && \
+    if echo "$BASE" | grep -q "ubuntu:"; then rm -Rf /home/testuser; fi && \
+    TAILSCALED_PATH=$(pwd)/tailscaled ./tailssh.test -test.v -test.run TestIntegrationParamiko && \
+    TAILSCALED_PATH=$(pwd)/tailscaled ./tailssh.test -test.v -test.run TestLocalUnixForwarding && \
+    TAILSCALED_PATH=$(pwd)/tailscaled ./tailssh.test -test.v -test.run TestReverseUnixForwarding && \
+    TAILSCALED_PATH=$(pwd)/tailscaled ./tailssh.test -test.v -test.run TestUnixForwardingDenied && \
+    TAILSCALED_PATH=$(pwd)/tailscaled ./tailssh.test -test.v -test.run TestUnixForwardingPathRestriction
 
-RUN echo "Then run tests as non-root user testuser and make sure tests still pass."
-RUN touch /tmp/tailscalessh.log
-RUN chown testuser:groupone /tmp/tailscalessh.log
-RUN TAILSCALED_PATH=`pwd`tailscaled eval `su -m testuser -c ssh-agent -s` && su -m testuser -c "./tailssh.test -test.v -test.run TestSSHAgentForwarding"
-RUN TAILSCALED_PATH=`pwd`tailscaled su -m testuser -c "./tailssh.test -test.v -test.run TestIntegration TestDoDropPrivileges"
-RUN echo "Also, deny everyone access to the user's home directory and make sure non file-related tests still pass."
-RUN mkdir -p /home/testuser && chown testuser:groupone /home/testuser && chmod 0000 /home/testuser
-RUN TAILSCALED_PATH=`pwd`tailscaled SKIP_FILE_OPS=1 su -m testuser -c "./tailssh.test -test.v -test.run TestIntegrationSSH"
-RUN chmod 0755 /home/testuser
-RUN chown root:root /tmp/tailscalessh.log
+# Run tests as non-root user testuser and make sure tests still pass.
+RUN set -e && \
+    touch /tmp/tailscalessh.log && \
+    chown testuser:groupone /tmp/tailscalessh.log && \
+    export TAILSCALED_PATH=$(pwd)/tailscaled && \
+    eval $(su -m testuser -c "ssh-agent -s") && \
+    su -m testuser -c "./tailssh.test -test.v -test.run 'TestSSHAgentForwarding|TestIntegration|TestDoDropPrivileges'" && \
+    echo "Also, deny everyone access to the user's home directory and make sure non file-related tests still pass." && \
+    mkdir -p /home/testuser && chown testuser:groupone /home/testuser && chmod 0000 /home/testuser && \
+    SKIP_FILE_OPS=1 su -m testuser -c "./tailssh.test -test.v -test.run TestIntegrationSSH" && \
+    chmod 0755 /home/testuser && \
+    chown root:root /tmp/tailscalessh.log
 
-RUN if echo "$BASE" | grep "ubuntu:"; then \
-    echo "Then run tests in a system that's pretending to be SELinux in enforcing mode" && \
-    # Remove execute permissions for /usr/bin/login so that it fails.
+# On Ubuntu, run tests pretending to be SELinux in enforcing mode.
+RUN if echo "$BASE" | grep -q "ubuntu:"; then \
+    set -e && \
+    echo "Run tests in a system that's pretending to be SELinux in enforcing mode" && \
     mv /usr/bin/login /tmp/login_orig && \
-    # Use nonsense for /usr/bin/login so that it fails.
-    # It's not the same failure mode as in SELinux, but failure is good enough for test.
     echo "adsfasdfasdf" > /usr/bin/login && \
     chmod 755 /usr/bin/login && \
-    # Simulate getenforce command
     printf "#!/bin/bash\necho 'Enforcing'" > /usr/bin/getenforce && \
     chmod 755 /usr/bin/getenforce && \
-    eval `ssh-agent -s` && TAILSCALED_PATH=`pwd`tailscaled ./tailssh.test -test.v -test.run TestSSHAgentForwarding && \
-    TAILSCALED_PATH=`pwd`tailscaled ./tailssh.test -test.v -test.run TestIntegration && \
+    eval $(ssh-agent -s) && \
+    TAILSCALED_PATH=$(pwd)/tailscaled ./tailssh.test -test.v -test.run 'TestSSHAgentForwarding|TestIntegration' && \
     mv /tmp/login_orig /usr/bin/login && \
     rm /usr/bin/getenforce \
     ; fi
 
-RUN echo "Then remove the login command and make sure tests still pass."
-RUN rm `which login`
-RUN eval `ssh-agent -s` && TAILSCALED_PATH=`pwd`tailscaled ./tailssh.test -test.v -test.run TestSSHAgentForwarding
-RUN if echo "$BASE" | grep "ubuntu:"; then rm -Rf /home/testuser; fi
-RUN TAILSCALED_PATH=`pwd`tailscaled ./tailssh.test -test.v -test.run TestIntegrationSFTP
-RUN if echo "$BASE" | grep "ubuntu:"; then rm -Rf /home/testuser; fi
-RUN TAILSCALED_PATH=`pwd`tailscaled ./tailssh.test -test.v -test.run TestIntegrationSCP
-RUN if echo "$BASE" | grep "ubuntu:"; then rm -Rf /home/testuser; fi
-RUN TAILSCALED_PATH=`pwd`tailscaled ./tailssh.test -test.v -test.run TestIntegrationSSH
+# Remove the login command and make sure tests still pass.
+RUN set -e && \
+    rm $(which login) && \
+    eval $(ssh-agent -s) && \
+    TAILSCALED_PATH=$(pwd)/tailscaled ./tailssh.test -test.v -test.run TestSSHAgentForwarding && \
+    if echo "$BASE" | grep -q "ubuntu:"; then rm -Rf /home/testuser; fi && \
+    TAILSCALED_PATH=$(pwd)/tailscaled ./tailssh.test -test.v -test.run TestIntegrationSFTP && \
+    if echo "$BASE" | grep -q "ubuntu:"; then rm -Rf /home/testuser; fi && \
+    TAILSCALED_PATH=$(pwd)/tailscaled ./tailssh.test -test.v -test.run TestIntegrationSCP && \
+    if echo "$BASE" | grep -q "ubuntu:"; then rm -Rf /home/testuser; fi && \
+    TAILSCALED_PATH=$(pwd)/tailscaled ./tailssh.test -test.v -test.run TestIntegrationSSH
 
-RUN echo "Then remove the su command and make sure tests still pass."
-RUN chown root:root /tmp/tailscalessh.log
-RUN rm `which su`
-RUN eval `ssh-agent -s` && TAILSCALED_PATH=`pwd`tailscaled ./tailssh.test -test.v -test.run TestSSHAgentForwarding
-RUN TAILSCALED_PATH=`pwd`tailscaled ./tailssh.test -test.v -test.run TestIntegration
-
-RUN echo "Test doDropPrivileges"
-RUN TAILSCALED_PATH=`pwd`tailscaled ./tailssh.test -test.v -test.run TestDoDropPrivileges
+# Remove the su command and make sure tests still pass.
+RUN set -e && \
+    chown root:root /tmp/tailscalessh.log && \
+    rm $(which su) && \
+    eval $(ssh-agent -s) && \
+    TAILSCALED_PATH=$(pwd)/tailscaled ./tailssh.test -test.v -test.run 'TestSSHAgentForwarding|TestIntegration|TestDoDropPrivileges'
diff --git a/ssh/tailssh/user.go b/ssh/tailssh/user.go
index 0d2bf31e7..8d7775cfb 100644
--- a/ssh/tailssh/user.go
+++ b/ssh/tailssh/user.go
@@ -93,7 +93,7 @@ func defaultPathForUser(u *user.User) string {
 	}
 	isRoot := u.Uid == "0"
 	switch distro.Get() {
-	case distro.Debian:
+	case distro.Debian, distro.Crostini:
 		hi := hostinfo.New()
 		if hi.Distro == "ubuntu" {
 			// distro.Get's Debian includes Ubuntu. But see if it's actually Ubuntu.
diff --git a/tailcfg/derpmap.go b/tailcfg/derpmap.go
index c18b04ea1..3bb75e329 100644
--- a/tailcfg/derpmap.go
+++ b/tailcfg/derpmap.go
@@ -11,6 +11,9 @@ import (
 )
 
 // DERPMap describes the set of DERP packet relay servers that are available.
+//
+// API maturity: this type is subject to minor changes over time, though
+// its general shape is stable.
 type DERPMap struct {
 	// HomeParams, if non-nil, is a change in home parameters.
 	//
diff --git a/tailcfg/proto_port_range.go b/tailcfg/proto_port_range.go
index 63012e93b..611f76001 100644
--- a/tailcfg/proto_port_range.go
+++ b/tailcfg/proto_port_range.go
@@ -119,7 +119,7 @@ func parseProtoPortRange(ipProtoPort string) (*ProtoPortRange, error) {
 }
 
 // ParseHostPortRange parses hostport as HOST:PORTS where HOST is
-// returned unchanged and PORTS is is either "*" or PORTLOW-PORTHIGH ranges.
+// returned unchanged and PORTS is either "*" or PORTLOW-PORTHIGH ranges.
 func ParseHostPortRange(hostport string) (host string, ports PortRange, err error) {
 	hostport = strings.ToLower(hostport)
 	colon := strings.LastIndexByte(hostport, ':')
diff --git a/tailcfg/tailcfg.go b/tailcfg/tailcfg.go
index 3d7921d75..5b38218c0 100644
--- a/tailcfg/tailcfg.go
+++ b/tailcfg/tailcfg.go
@@ -182,7 +182,15 @@ type CapabilityVersion int
 //   - 133: 2026-02-17: client understands [NodeAttrForceRegisterMagicDNSIPv4Only]; MagicDNS IPv6 registered w/ OS by default
 //   - 134: 2026-03-09: Client understands [NodeAttrDisableAndroidBindToActiveNetwork]
 //   - 135: 2026-03-30: Client understands [NodeAttrCacheNetworkMaps]
-const CurrentCapabilityVersion CapabilityVersion = 135
+//   - 136: 2026-04-09: Client understands [NodeAttrDisableLinuxCGNATDropRule]
+//   - 137: 2026-04-15: Client handles 429 responses to /machine/register.
+//   - 138: 2026-03-31: can handle C2N /debug/tka.
+//   - 139: 2026-05-22: Client understands [NodeAttrEmitRuntimeMetrics]
+//   - 140: 2026-05-27: Client understands [NodeAttrDisableUDPGRO], [NodeAttrDisableUDPGSO], [NodeAttrDisableTUNUDPGRO], [NodeAttrDisableTUNTCPGRO]
+//   - 141: 2026-05-28: Client understands [NodeAttrNeverGSOEqualTail]
+//   - 142: 2026-07-06: Client understands c2n /remoteapi/localapi/* proxy
+//   - 143: 2026-07-22: Client correctly ignores conn25 node attributes when not enabled by environment variable
+const CurrentCapabilityVersion CapabilityVersion = 143
 
 // ID is an integer ID for a user, node, or login allocated by the
 // control plane.
@@ -564,7 +572,7 @@ func (n *Node) DisplayName(forOwner bool) string {
 	return n.ComputedName
 }
 
-// DisplayName returns the decomposed user-facing name for a node.
+// DisplayNames returns the decomposed user-facing name for a node.
 //
 // Parameter forOwner specifies whether the name is requested by
 // the owner of the node. When forOwner is false, hostIfDifferent
@@ -587,6 +595,18 @@ func (n *Node) DisplayNames(forOwner bool) (name, hostIfDifferent string) {
 	return n.ComputedName, ""
 }
 
+// IsRouter reports whether n is a router: it routes addresses besides its own.
+// Examples: an exit node, a subnet router, an app connector, etc.
+func (n *Node) IsRouter() bool {
+	// TODO(sfllaw): Keep this aligned with dbx.Node.IsSubnetRouter.
+	for _, r := range n.AllowedIPs {
+		if !slices.Contains(n.Addresses, r) {
+			return true
+		}
+	}
+	return false
+}
+
 // IsTagged reports whether the node has any tags.
 func (n *Node) IsTagged() bool {
 	return len(n.Tags) > 0
@@ -597,6 +617,10 @@ func (n *Node) SharerOrUser() UserID {
 	return cmp.Or(n.Sharer, n.User)
 }
 
+// IsRouter reports whether n is a router: it routes addresses besides its own.
+// Examples: an exit node, a subnet router, an app connector, etc.
+func (n NodeView) IsRouter() bool { return n.ж.IsRouter() }
+
 // IsTagged reports whether the node has any tags.
 func (n NodeView) IsTagged() bool { return n.ж.IsTagged() }
 
@@ -874,6 +898,15 @@ type Hostinfo struct {
 	ShieldsUp       bool     `json:",omitzero"` // indicates whether the host is blocking incoming connections
 	ShareeNode      bool     `json:",omitzero"` // indicates this node exists in netmap because it's owned by a shared-to user
 	NoLogsNoSupport bool     `json:",omitzero"` // indicates that the user has opted out of sending logs and support
+
+	// RemoteConfig is whether the node has both linked
+	// feature/remoteconfig into its binary and enabled
+	// Prefs.RemoteConfig: it has delegated full remote management of
+	// its prefs and LocalAPI to the tailnet admin via the
+	// /remoteapi/localapi/* c2n endpoint. See feature/remoteconfig for
+	// the trust model.
+	RemoteConfig bool `json:",omitzero"`
+
 	// WireIngress indicates that the node would like to be wired up server-side
 	// (DNS, etc) to be able to use Tailscale Funnel, even if it's not currently
 	// enabled. For example, the user might only use it for intermittent
@@ -881,9 +914,15 @@ type Hostinfo struct {
 	// away, even if it's disabled most of the time. As an optimization, this is
 	// only sent if IngressEnabled is false, as IngressEnabled implies that this
 	// option is true.
-	WireIngress     bool           `json:",omitzero"`
-	IngressEnabled  bool           `json:",omitzero"`  // if the node has any funnel endpoint enabled
-	AllowsUpdate    bool           `json:",omitzero"`  // indicates that the node has opted-in to admin-console-drive remote updates
+	WireIngress    bool `json:",omitzero"`
+	IngressEnabled bool `json:",omitzero"` // if the node has any funnel endpoint enabled
+
+	// AllowsUpdate reports that the node has opted in to
+	// admin-console-driven remote updates and that the running binary
+	// includes client update support (the feature/clientupdate package,
+	// which tsnet apps don't include).
+	AllowsUpdate bool `json:",omitzero"`
+
 	Machine         string         `json:",omitzero"`  // the current host's machine type (uname -m)
 	GoArch          string         `json:",omitzero"`  // GOARCH value (of the built binary)
 	GoArchVar       string         `json:",omitzero"`  // GOARM, GOAMD64, etc (of the built binary)
@@ -1064,7 +1103,7 @@ type NetInfo struct {
 
 	// PreferredDERP is this node's preferred (home) DERP region ID.
 	// This is where the node expects to be contacted to begin a
-	// peer-to-peer connection. The node might be be temporarily
+	// peer-to-peer connection. The node might be temporarily
 	// connected to multiple DERP servers (to speak to other nodes
 	// that are located elsewhere) but PreferredDERP is the region ID
 	// that the node subscribes to traffic at.
@@ -1280,7 +1319,7 @@ type RegisterRequest struct {
 	Ephemeral bool `json:",omitempty"`
 
 	// NodeKeySignature is the node's own node-key signature, re-signed
-	// for its new node key using its network-lock key.
+	// for its new node key using its tailnet-lock key.
 	//
 	// This field is set when the client retries registration after learning
 	// its NodeKeySignature (which is in need of rotation).
@@ -2095,7 +2134,7 @@ type MapResponse struct {
 	PacketFilters map[string][]FilterRule `json:",omitempty"`
 
 	// UserProfiles are the user profiles of nodes in the network.
-	// As as of 1.1.541 (mapver 5), this contains new or updated
+	// As of 1.1.541 (mapver 5), this contains new or updated
 	// user profiles only.
 	UserProfiles []UserProfile `json:",omitempty"`
 
@@ -2431,7 +2470,7 @@ type Oauth2Token struct {
 	// If zero, TokenSource implementations will reuse the same
 	// token forever and RefreshToken or equivalent
 	// mechanisms for that TokenSource will not be used.
-	Expiry time.Time `json:"expiry,omitempty"`
+	Expiry time.Time `json:"expiry,omitzero"`
 }
 
 // NodeCapability represents a capability granted to the self node as listed in
@@ -2447,6 +2486,18 @@ type Oauth2Token struct {
 // These are also referred to as "Node Attributes" in the ACL policy file.
 type NodeCapability string
 
+// NodeCapabilityPrefix is a prefix for [NodeCapMap] keys that share a common
+// namespace, where each entry represents a distinct named instance (e.g. one
+// per service). The full key is formed by concatenating the prefix with the
+// instance name.
+type NodeCapabilityPrefix string
+
+// ToAttribute returns the full [NodeCapability] key for the given value under
+// this prefix, of the form prefix+value.
+func (p NodeCapabilityPrefix) ToAttribute(value string) NodeCapability {
+	return NodeCapability(string(p) + value)
+}
+
 const (
 	CapabilityFileSharing        NodeCapability = "https://tailscale.com/cap/file-sharing"
 	CapabilityAdmin              NodeCapability = "https://tailscale.com/cap/is-admin"
@@ -2460,6 +2511,10 @@ const (
 	// CapabilityMacUIV2 makes the macOS GUI enable its v2 mode.
 	CapabilityMacUIV2 NodeCapability = "https://tailscale.com/cap/mac-ui-v2"
 
+	// CapabilityServicesInDesktopClients enables services list/menu/section in desktop clients.
+	// If this capability is not present, desktop clients should not show services.
+	CapabilityServicesInDesktopClients NodeCapability = "https://tailscale.com/cap/services-in-desktop-clients"
+
 	// CapabilityBindToInterfaceByRoute changes how Darwin nodes create
 	// sockets (in the net/netns package). See that package for more
 	// details on the behaviour of this capability.
@@ -2585,21 +2640,6 @@ const (
 	// This cannot be set simultaneously with NodeAttrLinuxMustUseIPTables.
 	NodeAttrLinuxMustUseNfTables NodeCapability = "linux-netfilter?v=nftables"
 
-	// NodeAttrDisableSeamlessKeyRenewal disables seamless key renewal, which is
-	// enabled by default in clients as of 2025-09-17 (1.90 and later).
-	//
-	// We will use this attribute to manage the rollout, and disable seamless in
-	// clients with known bugs.
-	// http://go/seamless-key-renewal
-	NodeAttrDisableSeamlessKeyRenewal NodeCapability = "disable-seamless-key-renewal"
-
-	// NodeAttrSeamlessKeyRenewal was used to opt-in to seamless key renewal
-	// during its private alpha.
-	//
-	// Deprecated: NodeAttrSeamlessKeyRenewal is deprecated as of CapabilityVersion 126,
-	// because seamless key renewal is now enabled by default.
-	NodeAttrSeamlessKeyRenewal NodeCapability = "seamless-key-renewal"
-
 	// NodeAttrProbeUDPLifetime makes the client probe UDP path lifetime at the
 	// tail end of an active direct connection in magicsock.
 	NodeAttrProbeUDPLifetime NodeCapability = "probe-udp-lifetime"
@@ -2749,7 +2789,17 @@ const (
 	// reachability itself when choosing connectors. When absent, the
 	// default behavior is to trust the control plane when it claims that a
 	// node is no longer online, but that is not a reliable signal.
-	NodeAttrClientSideReachability = "client-side-reachability"
+	//
+	// It is temporary and will be ignored once its behaviour becomes the default.
+	NodeAttrClientSideReachability NodeCapability = "client-side-reachability"
+
+	// NodeAttrClientSideReachabilityRouteCheck configures the node to use
+	// the routecheck subsystem to determine reachability when choosing
+	// connectors. This relies on [NodeAttrClientSideReachability] being set.
+	// See tailscale/tailscale#17367.
+	//
+	// It is temporary and will be ignored once its behaviour becomes the default.
+	NodeAttrClientSideReachabilityRouteCheck NodeCapability = "client-side-reachability-routecheck"
 
 	// NodeAttrDefaultAutoUpdate advertises the default node auto-update setting
 	// for this tailnet. The node is free to opt-in or out locally regardless of
@@ -2778,6 +2828,77 @@ const (
 	// absent (or removed), a node that supports netmap caching will ignore and
 	// discard existing cached maps, and will not store any.
 	NodeAttrCacheNetworkMaps NodeCapability = "cache-network-maps"
+
+	// NodeAttrDisableCacheNetworkMaps indicates that the node should not cache
+	// network maps (as per [NodeAttrCacheNetworkMaps]) when it normally would.
+	// This attribute exists to allow the policy document to override the default.
+	// When set, it takes precedence over [NodeAttrCacheNetworkMaps].
+	NodeAttrDisableCacheNetworkMaps NodeCapability = "disable-cache-network-maps"
+
+	// NodeAttrDisableLinuxCGNATDropRule tells Linux clients to not insert a
+	// blanket firewall DROP rule for inbound traffic from the CGNAT IP range
+	// that does not originate from the Tailscale network interface.
+	// This enables access to off-tailnet endpoints within that IP range.
+	NodeAttrDisableLinuxCGNATDropRule NodeCapability = "disable-linux-cgnat-drop-rule"
+
+	// NodeAttrEmitRuntimeMetrics enables emission of [runtime/metrics] as
+	// [tailscale.com/util/clientmetric]'s.
+	NodeAttrEmitRuntimeMetrics NodeCapability = "emit-runtime-metrics"
+
+	// NodeAttrDisableUDPGRO disables UDP GRO (UDP_GRO socket option on Linux)
+	// on the magicsock UDP socket. It exists so control can mitigate kernel
+	// regressions that cause throughput or correctness issues with UDP GRO on
+	// specific OS/kernel versions, without requiring a client release. See
+	// https://github.com/tailscale/tailscale/issues/19777 for example.
+	// Currently only consulted on Linux; may apply to other platforms as they
+	// gain UDP GRO support.
+	NodeAttrDisableUDPGRO NodeCapability = "disable-udp-gro"
+
+	// NodeAttrDisableUDPGSO disables UDP GSO (UDP_SEGMENT socket option on
+	// Linux) on the magicsock UDP socket. It exists so control can mitigate
+	// kernel regressions that cause throughput or correctness issues with UDP
+	// GSO on specific OS/kernel versions, without requiring a client release.
+	// See https://github.com/tailscale/tailscale/issues/19777 for example.
+	// Currently only consulted on Linux; may apply to other platforms as they
+	// gain UDP GSO support.
+	NodeAttrDisableUDPGSO NodeCapability = "disable-udp-gso"
+
+	// NodeAttrDisableTUNUDPGRO disables UDP GRO on the Tailscale TUN device.
+	// It exists so control can mitigate kernel regressions that cause
+	// throughput or correctness issues with TUN UDP GRO on specific OS/kernel
+	// versions, without requiring a client release. See
+	// https://github.com/tailscale/tailscale/issues/13041 for example.
+	// Currently only consulted on Linux; may apply to other platforms as they
+	// gain TUN UDP GRO support.
+	NodeAttrDisableTUNUDPGRO NodeCapability = "disable-tun-udp-gro"
+
+	// NodeAttrDisableTUNTCPGRO disables TCP GRO on the Tailscale TUN device.
+	// It exists so control can mitigate kernel regressions that cause
+	// throughput or correctness issues with TUN TCP GRO on specific OS/kernel
+	// versions, without requiring a client release. See
+	// https://github.com/tailscale/tailscale/issues/13041 for example.
+	// Currently only consulted on Linux; may apply to other platforms as they
+	// gain TUN TCP GRO support.
+	NodeAttrDisableTUNTCPGRO NodeCapability = "disable-tun-tcp-gro"
+
+	// NodeAttrNeverGSOEqualTail enables a sentinel-tail workaround in the
+	// underlay UDP packet TX path on Linux. Applies to magicsock and peer relay
+	// UDP sockets. The workaround avoids emitting UDP GSO batches whose
+	// fragments are all equal in length, at a small payload and packet overhead
+	// cost. It exists so control can mitigate kernel regressions that mangle
+	// UDP headers or checksums for equal-length GSO batches, without requiring
+	// a client release. See https://github.com/tailscale/tailscale/issues/19777.
+	NodeAttrNeverGSOEqualTail NodeCapability = "never-gso-equal-tail"
+)
+
+const (
+	// NodeAttrPrefixServices is the prefix for per-service [NodeCapMap]
+	// entries describing Services visible (accessible) to this node.
+	// Each value under such a key is of type [ServiceDetails].
+	// The suffix after the prefix is an opaque server-chosen identifier;
+	// consumers must use [ServiceDetails.Name] as the canonical service name
+	// rather than parsing it from the map key.
+	NodeAttrPrefixServices NodeCapabilityPrefix = "services/"
 )
 
 // SetDNSRequest is a request to add a DNS record.
@@ -2968,7 +3089,12 @@ type SSHAction struct {
 
 	// SessionDuration, if non-zero, is how long the session can stay open
 	// before being forcefully terminated.
-	SessionDuration time.Duration `json:"sessionDuration,omitempty,format:nano"`
+	// It is encoded as an int64 of nanoseconds (Go's time.Duration
+	// wire format for encoding/json v1). It must not use a jsonv2
+	// format tag; the mere presence of one makes Go 1.27's
+	// encoding/json fail to decode the struct. See
+	// https://github.com/tailscale/tailscale/issues/20528.
+	SessionDuration time.Duration `json:"sessionDuration,omitempty"`
 
 	// AllowAgentForwarding, if true, allows accepted connections to forward
 	// the ssh agent if requested.
@@ -3318,6 +3444,200 @@ const LBHeader = "Ts-Lb"
 // this client is hosting can be ignored.
 type ServiceIPMappings map[ServiceName][]netip.Addr
 
+// ServiceActionType represents the type of a [ServiceAction]. Clients use
+// this value to determine which protocol or application to use when
+// handling the action.
+//
+// Well-known Tailscale types are defined as constants in this package.
+// They are plain slugs (e.g. "ssh", "http") with no URL prefix.
+//
+// When a type corresponds to an application layer protocol with a
+// well-known port, the slug generally follows the IANA Service Name and
+// Transport Protocol Port Number Registry:
+// https://www.iana.org/assignments/service-names-port-numbers.
+//
+// In cases where the IANA service name differs from the commonly used
+// protocol name, the protocol name is preferred for readability and
+// interoperability (e.g. RDP is registered as "ms-wbt-server").
+//
+// If third-party types are introduced in the future, they must use URL
+// form (e.g. "example.com/my-custom-type") to avoid collisions with
+// first-party types.
+type ServiceActionType string
+
+const (
+	// ServiceActionTypeAWSS3 indicates that a port corresponds to an
+	// AWS S3 compatible endpoint and the AWS configuration may be modified
+	// to point to this endpoint and S3 clients may be used.
+	ServiceActionTypeAWSS3 ServiceActionType = "aws-s3"
+
+	// ServiceActionTypeCockroachDB indicates that a port corresponds to a
+	// CockroachDB server and CockroachDB clients may be used.
+	ServiceActionTypeCockroachDB ServiceActionType = "cockroach"
+
+	// ServiceActionTypeElasticSearch indicates that a port corresponds to
+	// an Elasticsearch server and Elasticsearch clients may be used.
+	ServiceActionTypeElasticSearch ServiceActionType = "elasticsearch"
+
+	// ServiceActionTypeHTTP indicates that a port corresponds to an HTTP
+	// server and HTTP clients may be used.
+	ServiceActionTypeHTTP ServiceActionType = "http"
+
+	// ServiceActionTypeKubernetes indicates that a port corresponds to a
+	// Kubernetes API server and the Kubernetes context may be configured to
+	// point to the service and Kubernetes clients may be used.
+	ServiceActionTypeKubernetes ServiceActionType = "kubernetes"
+
+	// ServiceActionTypeMongoDB indicates that a port corresponds to a MongoDB
+	// server and MongoDB clients may be used.
+	ServiceActionTypeMongoDB ServiceActionType = "mongodb"
+
+	// ServiceActionTypeMSSQL indicates that a port corresponds to a Microsoft
+	// SQL Server and MSSQL clients may be used. The IANA registry uses
+	// "ms-sql-s" but "mssql" is the widely recognized name.
+	ServiceActionTypeMSSQL ServiceActionType = "mssql"
+
+	// ServiceActionTypeMySQL indicates that a port corresponds to a MySQL
+	// server and MySQL clients may be used.
+	ServiceActionTypeMySQL ServiceActionType = "mysql"
+
+	// ServiceActionTypePostgreSQL indicates that a port corresponds to a
+	// PostgreSQL server and PostgreSQL clients may be used.
+	ServiceActionTypePostgreSQL ServiceActionType = "postgresql"
+
+	// ServiceActionTypeRDP indicates that a port corresponds to an RDP
+	// server and RDP clients may be used. The IANA registry uses
+	// "ms-wbt-server" but "rdp" is the widely recognized name.
+	ServiceActionTypeRDP ServiceActionType = "rdp"
+
+	// ServiceActionTypeVNC indicates that a port corresponds to a VNC
+	// server and VNC clients may be used. The IANA registry uses "rfb"
+	// (Remote Framebuffer) but "vnc" is the widely recognized name.
+	ServiceActionTypeVNC ServiceActionType = "vnc"
+
+	// ServiceActionTypeSSH indicates that a port corresponds to an SSH
+	// server and SSH clients may be used.
+	ServiceActionTypeSSH ServiceActionType = "ssh"
+
+	// ServiceActionTypeTCP indicates that a port corresponds to a generic
+	// TCP server and TCP clients may be used.
+	ServiceActionTypeTCP ServiceActionType = "tcp"
+)
+
+// Valid reports whether t is a recognized ServiceActionType.
+func (t ServiceActionType) Valid() bool {
+	switch t {
+	case ServiceActionTypeAWSS3,
+		ServiceActionTypeCockroachDB,
+		ServiceActionTypeElasticSearch,
+		ServiceActionTypeHTTP,
+		ServiceActionTypeKubernetes,
+		ServiceActionTypeMongoDB,
+		ServiceActionTypeMSSQL,
+		ServiceActionTypeMySQL,
+		ServiceActionTypePostgreSQL,
+		ServiceActionTypeRDP,
+		ServiceActionTypeVNC,
+		ServiceActionTypeSSH,
+		ServiceActionTypeTCP:
+		return true
+	}
+	return false
+}
+
+// ServiceActionAttribute represents an attribute key for a [ServiceAction].
+// A given attribute's applicability depends on the [ServiceAction.Type].
+//
+// Well-known Tailscale attributes are defined as constants in this package.
+// Values are [RawMessage] (raw JSON) whose schema depends on the attribute.
+//
+// Clients should ignore attributes they do not recognize.
+type ServiceActionAttribute string
+
+const (
+	// ServiceActionAttributeWebClientURL is a [ServiceActionAttribute]
+	// that indicates to clients that a browser based client for the
+	// action is available at the URL in the value.
+	//
+	// The value is a JSON string containing a URL with an http(s) scheme.
+	ServiceActionAttributeWebClientURL ServiceActionAttribute = "tailscale.com/cap/web-client-url"
+
+	// ServiceActionAttributeResourceName is a [ServiceActionAttribute]
+	// that indicates to clients that the resource specified by the value
+	// should be selected when opening the application corresponding to
+	// the [ServiceAction.Type].
+	//
+	// This is particularly relevant for PostgreSQL services, where a
+	// database must be specified while opening a connection.
+	//
+	// The value is a JSON string containing the resource name
+	// (e.g. a database name).
+	ServiceActionAttributeResourceName ServiceActionAttribute = "tailscale.com/cap/resource-name"
+
+	// ServiceActionAttributeSkipUsername is a [ServiceActionAttribute]
+	// that indicates to clients that a username is not required.
+	//
+	// This attribute is typically used for services that are backed by
+	// an application-layer proxy. The proxy injects the appropriate
+	// credentials on behalf of the user, and any username provided by
+	// the user is ignored. This attribute informs clients that the
+	// username is irrelevant, and any username prompt should be skipped.
+	//
+	// The value is a JSON boolean.
+	ServiceActionAttributeSkipUsername ServiceActionAttribute = "tailscale.com/cap/skip-username"
+)
+
+// ServiceAction describes an action that a Tailscale
+// client can invoke for a [ServiceDetails].
+//
+// Clients should ignore actions with types they do not recognize.
+type ServiceAction struct {
+	// Type is the action's identifier i.e. a unique slug corresponding to a well
+	// known action. It drives icon selection and client application matching.
+	Type ServiceActionType
+
+	// Port is the target TCP port for this action. It must match one of
+	// the specific (non-range) TCP ports listed in the enclosing
+	// [ServiceDetails.Ports].
+	Port uint16
+
+	// DisplayName is an optional human-readable label which may be shown
+	// in client menus when there are multiple actions to select from.
+	// If empty, a display name may be inferred from the Type field.
+	DisplayName string `json:",omitzero"`
+
+	// Attributes is an optional key-value map carrying additional metadata
+	// to help clients drive UI or behavior related to this action.
+	Attributes map[ServiceActionAttribute]RawMessage `json:",omitzero"`
+}
+
+// ServiceDetails describes a Service visible to this node.
+// It is the value type stored under [NodeAttrPrefixServices]+serviceName keys in [NodeCapMap].
+type ServiceDetails struct {
+	// Name is the name of the Service, of the form "svc:dns-label".
+	Name ServiceName
+
+	// DisplayName is an optional human-readable label for the service.
+	// If empty, Name is used as a fallback by clients.
+	DisplayName string `json:",omitzero"`
+
+	// Addrs are the IP addresses (IPv4 and IPv6) assigned to this Service.
+	Addrs []netip.Addr `json:",omitempty"`
+
+	// Ports are the protocol/port combinations the Service accepts.
+	Ports []ProtoPortRange `json:",omitempty"`
+
+	// Actions is an optional list of actions describing how a client may
+	// interact with this service. Each action maps a [ServiceAction.Type] to a
+	// specific TCP port; the port must match one of the concrete (non-range)
+	// ports listed in Ports.
+	//
+	// Multiple actions may reference the same port. Not every port requires
+	// a corresponding action. When Actions has length zero, clients may infer
+	// default interactions from Ports.
+	Actions []ServiceAction `json:",omitzero"`
+}
+
 // ClientAuditAction represents an auditable action that a client can report to the
 // control plane.  These actions must correspond to the supported actions
 // in the control plane.
diff --git a/tailcfg/tailcfg_clone.go b/tailcfg/tailcfg_clone.go
index 8b966b621..e1d5551cd 100644
--- a/tailcfg/tailcfg_clone.go
+++ b/tailcfg/tailcfg_clone.go
@@ -167,6 +167,7 @@ var _HostinfoCloneNeedsRegeneration = Hostinfo(struct {
 	ShieldsUp       bool
 	ShareeNode      bool
 	NoLogsNoSupport bool
+	RemoteConfig    bool
 	WireIngress     bool
 	IngressEnabled  bool
 	AllowsUpdate    bool
@@ -262,8 +263,19 @@ func (src *DNSConfig) Clone() *DNSConfig {
 	}
 	if dst.Routes != nil {
 		dst.Routes = map[string][]*dnstype.Resolver{}
-		for k := range src.Routes {
-			dst.Routes[k] = append([]*dnstype.Resolver{}, src.Routes[k]...)
+		for k, sv := range src.Routes {
+			if sv == nil {
+				dst.Routes[k] = nil
+				continue
+			}
+			dst.Routes[k] = make([]*dnstype.Resolver, len(sv))
+			for i := range sv {
+				if sv[i] == nil {
+					dst.Routes[k][i] = nil
+				} else {
+					dst.Routes[k][i] = sv[i].Clone()
+				}
+			}
 		}
 	}
 	if src.FallbackResolvers != nil {
diff --git a/tailcfg/tailcfg_test.go b/tailcfg/tailcfg_test.go
index 8dd9191b6..5658f3111 100644
--- a/tailcfg/tailcfg_test.go
+++ b/tailcfg/tailcfg_test.go
@@ -5,14 +5,17 @@ package tailcfg_test
 
 import (
 	"encoding/json"
+	"log"
 	"net/netip"
 	"os"
 	"reflect"
 	"regexp"
 	"strconv"
+	"strings"
 	"testing"
 	"time"
 
+	"tailscale.com/ipn/ipnstate"
 	. "tailscale.com/tailcfg"
 	"tailscale.com/tstest/deptest"
 	"tailscale.com/types/key"
@@ -48,6 +51,7 @@ func TestHostinfoEqual(t *testing.T) {
 		"ShieldsUp",
 		"ShareeNode",
 		"NoLogsNoSupport",
+		"RemoteConfig",
 		"WireIngress",
 		"IngressEnabled",
 		"AllowsUpdate",
@@ -614,6 +618,251 @@ func TestNodeEqual(t *testing.T) {
 	}
 }
 
+var nodeIsRouterCases = []struct {
+	name string
+	node Node
+	want bool
+}{
+	{
+		name: "empty",
+		node: Node{},
+		want: false,
+	},
+	{
+		name: "too-few-allowedips",
+		node: Node{
+			Addresses: []netip.Prefix{
+				netip.MustParsePrefix("100.64.0.1/32"),
+			},
+			AllowedIPs: []netip.Prefix{},
+		},
+		want: false,
+	},
+	{
+		name: "duplicates",
+		node: Node{
+			Addresses: []netip.Prefix{
+				netip.MustParsePrefix("100.64.0.1/32"),
+			},
+			AllowedIPs: []netip.Prefix{
+				netip.MustParsePrefix("100.64.0.1/32"),
+				netip.MustParsePrefix("100.64.0.1/32"),
+			},
+		},
+		want: false,
+	},
+	{
+		name: "plain-ipv4",
+		node: Node{
+			Addresses: []netip.Prefix{
+				netip.MustParsePrefix("100.64.0.1/32"),
+			},
+			AllowedIPs: []netip.Prefix{
+				netip.MustParsePrefix("100.64.0.1/32"),
+			},
+		},
+		want: false,
+	},
+	{
+		name: "plain-ipv6",
+		node: Node{
+			Addresses: []netip.Prefix{
+				netip.MustParsePrefix("fd7a:115c:a1e0::1/128"),
+			},
+			AllowedIPs: []netip.Prefix{
+				netip.MustParsePrefix("fd7a:115c:a1e0::1/128"),
+			},
+		},
+		want: false,
+	},
+	{
+		name: "plain-ipv4-ipv6",
+		node: Node{
+			Addresses: []netip.Prefix{
+				netip.MustParsePrefix("100.64.0.1/32"),
+				netip.MustParsePrefix("fd7a:115c:a1e0::1/128"),
+			},
+			AllowedIPs: []netip.Prefix{
+				netip.MustParsePrefix("100.64.0.1/32"),
+				netip.MustParsePrefix("fd7a:115c:a1e0::1/128"),
+			},
+		},
+		want: false,
+	},
+	{
+		name: "exit-node-ipv4",
+		node: Node{
+			Addresses: []netip.Prefix{
+				netip.MustParsePrefix("100.64.0.1/32"),
+			},
+			AllowedIPs: []netip.Prefix{
+				netip.MustParsePrefix("100.64.0.1/32"),
+				netip.MustParsePrefix("0.0.0.0/0"),
+			},
+		},
+		want: true,
+	},
+	{
+		name: "exit-node-ipv6",
+		node: Node{
+			Addresses: []netip.Prefix{
+				netip.MustParsePrefix("fd7a:115c:a1e0::1/128"),
+			},
+			AllowedIPs: []netip.Prefix{
+				netip.MustParsePrefix("fd7a:115c:a1e0::1/128"),
+				netip.MustParsePrefix("::/0"),
+			},
+		},
+		want: true,
+	},
+	{
+		name: "exit-node-ipv4-ipv6",
+		node: Node{
+			Addresses: []netip.Prefix{
+				netip.MustParsePrefix("100.64.0.1/32"),
+				netip.MustParsePrefix("fd7a:115c:a1e0::1/128"),
+			},
+			AllowedIPs: []netip.Prefix{
+				netip.MustParsePrefix("100.64.0.1/32"),
+				netip.MustParsePrefix("fd7a:115c:a1e0::1/128"),
+				netip.MustParsePrefix("0.0.0.0/0"),
+				netip.MustParsePrefix("::/0"),
+			},
+		},
+		want: true,
+	},
+	{
+		name: "subnet-router-ipv4",
+		node: Node{
+			Addresses: []netip.Prefix{
+				netip.MustParsePrefix("100.64.0.1/32"),
+			},
+			AllowedIPs: []netip.Prefix{
+				netip.MustParsePrefix("100.64.0.1/32"),
+				netip.MustParsePrefix("192.0.2.0/24"),
+			},
+		},
+		want: true,
+	},
+	{
+		name: "subnet-router-ipv6",
+		node: Node{
+			Addresses: []netip.Prefix{
+				netip.MustParsePrefix("fd7a:115c:a1e0::1/128"),
+			},
+			AllowedIPs: []netip.Prefix{
+				netip.MustParsePrefix("fd7a:115c:a1e0::1/128"),
+				netip.MustParsePrefix("2001:db8::/32"),
+			},
+		},
+		want: true,
+	},
+	{
+		name: "subnet-router-ipv4-ipv6",
+		node: Node{
+			Addresses: []netip.Prefix{
+				netip.MustParsePrefix("100.64.0.1/32"),
+				netip.MustParsePrefix("fd7a:115c:a1e0::1/128"),
+			},
+			AllowedIPs: []netip.Prefix{
+				netip.MustParsePrefix("100.64.0.1/32"),
+				netip.MustParsePrefix("fd7a:115c:a1e0::1/128"),
+				netip.MustParsePrefix("192.0.2.0/24"),
+				netip.MustParsePrefix("2001:db8::/32"),
+			},
+		},
+		want: true,
+	},
+}
+
+func TestNodeIsRouter(t *testing.T) {
+	for _, tc := range nodeIsRouterCases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := tc.node.IsRouter(); got != tc.want {
+				t.Errorf("node: got %t, want %t", got, tc.want)
+			}
+
+			nv := tc.node.View()
+			if got := nv.IsRouter(); got != tc.want {
+				t.Errorf("view: got %t, want %t", got, tc.want)
+			}
+
+			// Check that [ipnstate.PeerStatus.IsRouter] matches.
+			ps := peerStatusFromNode(nv)
+			if got := ps.IsRouter(); got != tc.want {
+				t.Errorf("peer status: got %t, want %t", got, tc.want)
+			}
+		})
+	}
+}
+
+func FuzzNodeIsRouter(f *testing.F) {
+	encodePrefixes := func(f *testing.F, prefixes ...netip.Prefix) string {
+		f.Helper()
+		out := make([]string, len(prefixes))
+		for i, p := range prefixes {
+			out[i] = p.String()
+		}
+		return strings.Join(out, " ")
+	}
+	decodePrefixes := func(t *testing.T, prefixes string) []netip.Prefix {
+		t.Helper()
+		var out []netip.Prefix
+		for p := range strings.FieldsSeq(prefixes) {
+			pfx, err := netip.ParsePrefix(p)
+			if err != nil {
+				log.Printf("skipping %q: %v", prefixes, err)
+				t.Skipf("%q: %v", prefixes, err)
+			}
+			out = append(out, pfx)
+		}
+		return out
+	}
+
+	for _, tc := range nodeIsRouterCases {
+		addresses := encodePrefixes(f, tc.node.Addresses...)
+		allowedIPs := encodePrefixes(f, tc.node.AllowedIPs...)
+		f.Logf("addresses=%q allowedIPs=%q", addresses, allowedIPs)
+		f.Add(addresses, allowedIPs)
+	}
+	f.Fuzz(func(t *testing.T, addresses, allowedIPs string) {
+		n := Node{
+			Addresses:  decodePrefixes(t, addresses),
+			AllowedIPs: decodePrefixes(t, allowedIPs),
+		}
+		ps := peerStatusFromNode(n.View())
+		t.Logf("%v %v", n.Addresses, n.AllowedIPs)
+
+		if len(n.Addresses) != len(ps.TailscaleIPs) ||
+			len(n.AllowedIPs) != ps.AllowedIPs.Len() {
+			t.Skip("n and ps are not equivalent")
+		}
+
+		gotN := n.IsRouter()
+		gotPS := ps.IsRouter()
+		if gotN != gotPS {
+			t.Errorf("mismatched node %t, peer status %t; addresses=%q allowedIPs=%q",
+				gotN, gotPS, addresses, allowedIPs)
+		}
+	})
+}
+
+func peerStatusFromNode(n NodeView) *ipnstate.PeerStatus {
+	ps := &ipnstate.PeerStatus{
+		ID:        n.StableID(),
+		NodeID:    n.ID(),
+		PublicKey: n.Key(),
+		DNSName:   n.Name(),
+	}
+	for _, p := range n.Addresses().All() {
+		if p.IsSingleIP() {
+			ps.TailscaleIPs = append(ps.TailscaleIPs, p.Addr())
+		}
+	}
+	ps.AllowedIPs = new(n.AllowedIPs())
+	return ps
+}
+
 func TestNetInfoFields(t *testing.T) {
 	handled := []string{
 		"MappingVariesByDestIP",
@@ -827,7 +1076,7 @@ func TestMarshalToRawMessageAndBack(t *testing.T) {
 		Ports    []int            `json:"ports,omitempty"`
 		ToggleOn bool             `json:"toggleOn,omitempty"`
 		Name     string           `json:"name,omitempty"`
-		Groups   inner            `json:"groups,omitempty"`
+		Groups   inner            `json:"groups"`
 		Addrs    []netip.AddrPort `json:"addrs"`
 	}
 	tests := []struct {
@@ -1033,3 +1282,58 @@ func TestDisplayMessageEqual(t *testing.T) {
 		})
 	}
 }
+
+func TestServiceActionTypeValid(t *testing.T) {
+	tests := []struct {
+		typ  ServiceActionType
+		want bool
+	}{
+		{ServiceActionTypeAWSS3, true},
+		{ServiceActionTypeCockroachDB, true},
+		{ServiceActionTypeElasticSearch, true},
+		{ServiceActionTypeHTTP, true},
+		{ServiceActionTypeKubernetes, true},
+		{ServiceActionTypeMongoDB, true},
+		{ServiceActionTypeMSSQL, true},
+		{ServiceActionTypeMySQL, true},
+		{ServiceActionTypePostgreSQL, true},
+		{ServiceActionTypeRDP, true},
+		{ServiceActionTypeVNC, true},
+		{ServiceActionTypeSSH, true},
+		{ServiceActionTypeTCP, true},
+		{"ftp", false},
+		{"", false},
+	}
+	for _, tt := range tests {
+		if got := tt.typ.Valid(); got != tt.want {
+			t.Errorf("ServiceActionType(%q).Valid() = %v, want %v", tt.typ, got, tt.want)
+		}
+	}
+}
+
+// TestSSHActionJSON verifies that SSHAction round-trips through
+// encoding/json with SessionDuration encoded as int64 nanoseconds.
+// It notably guards against jsonv2 `format` tag options in struct
+// tags, which Go 1.27's encoding/json rejects at runtime.
+// See https://github.com/tailscale/tailscale/issues/20528.
+func TestSSHActionJSON(t *testing.T) {
+	a := SSHAction{
+		Accept:          true,
+		SessionDuration: 5 * time.Second,
+	}
+	got, err := json.Marshal(a)
+	if err != nil {
+		t.Fatalf("Marshal: %v", err)
+	}
+	const want = `{"accept":true,"sessionDuration":5000000000}`
+	if string(got) != want {
+		t.Errorf("Marshal = %s; want %s", got, want)
+	}
+	var back SSHAction
+	if err := json.Unmarshal(got, &back); err != nil {
+		t.Fatalf("Unmarshal: %v", err)
+	}
+	if !reflect.DeepEqual(back, a) {
+		t.Errorf("round trip = %+v; want %+v", back, a)
+	}
+}
diff --git a/tailcfg/tailcfg_view.go b/tailcfg/tailcfg_view.go
index 9900efbcc..008c6fcfa 100644
--- a/tailcfg/tailcfg_view.go
+++ b/tailcfg/tailcfg_view.go
@@ -550,6 +550,14 @@ func (v HostinfoView) ShareeNode() bool { return v.ж.ShareeNode }
 // indicates that the user has opted out of sending logs and support
 func (v HostinfoView) NoLogsNoSupport() bool { return v.ж.NoLogsNoSupport }
 
+// RemoteConfig is whether the node has both linked
+// feature/remoteconfig into its binary and enabled
+// Prefs.RemoteConfig: it has delegated full remote management of
+// its prefs and LocalAPI to the tailnet admin via the
+// /remoteapi/localapi/* c2n endpoint. See feature/remoteconfig for
+// the trust model.
+func (v HostinfoView) RemoteConfig() bool { return v.ж.RemoteConfig }
+
 // WireIngress indicates that the node would like to be wired up server-side
 // (DNS, etc) to be able to use Tailscale Funnel, even if it's not currently
 // enabled. For example, the user might only use it for intermittent
@@ -562,7 +570,10 @@ func (v HostinfoView) WireIngress() bool { return v.ж.WireIngress }
 // if the node has any funnel endpoint enabled
 func (v HostinfoView) IngressEnabled() bool { return v.ж.IngressEnabled }
 
-// indicates that the node has opted-in to admin-console-drive remote updates
+// AllowsUpdate reports that the node has opted in to
+// admin-console-driven remote updates and that the running binary
+// includes client update support (the feature/clientupdate package,
+// which tsnet apps don't include).
 func (v HostinfoView) AllowsUpdate() bool { return v.ж.AllowsUpdate }
 
 // the current host's machine type (uname -m)
@@ -649,6 +660,7 @@ var _HostinfoViewNeedsRegeneration = Hostinfo(struct {
 	ShieldsUp       bool
 	ShareeNode      bool
 	NoLogsNoSupport bool
+	RemoteConfig    bool
 	WireIngress     bool
 	IngressEnabled  bool
 	AllowsUpdate    bool
@@ -777,7 +789,7 @@ func (v NetInfoView) PCP() opt.Bool { return v.ж.PCP }
 
 // PreferredDERP is this node's preferred (home) DERP region ID.
 // This is where the node expects to be contacted to begin a
-// peer-to-peer connection. The node might be be temporarily
+// peer-to-peer connection. The node might be temporarily
 // connected to multiple DERP servers (to speak to other nodes
 // that are located elsewhere) but PreferredDERP is the region ID
 // that the node subscribes to traffic at.
@@ -1349,7 +1361,7 @@ func (v RegisterRequestView) Hostinfo() HostinfoView { return v.ж.Hostinfo.View
 func (v RegisterRequestView) Ephemeral() bool { return v.ж.Ephemeral }
 
 // NodeKeySignature is the node's own node-key signature, re-signed
-// for its new node key using its network-lock key.
+// for its new node key using its tailnet-lock key.
 //
 // This field is set when the client retries registration after learning
 // its NodeKeySignature (which is in need of rotation).
@@ -2095,6 +2107,11 @@ func (v SSHActionView) Accept() bool { return v.ж.Accept }
 
 // SessionDuration, if non-zero, is how long the session can stay open
 // before being forcefully terminated.
+// It is encoded as an int64 of nanoseconds (Go's time.Duration
+// wire format for encoding/json v1). It must not use a jsonv2
+// format tag; the mere presence of one makes Go 1.27's
+// encoding/json fail to decode the struct. See
+// https://github.com/tailscale/tailscale/issues/20528.
 func (v SSHActionView) SessionDuration() time.Duration { return v.ж.SessionDuration }
 
 // AllowAgentForwarding, if true, allows accepted connections to forward
diff --git a/tailcfg/tka.go b/tailcfg/tka.go
index 29c17b756..50678cde9 100644
--- a/tailcfg/tka.go
+++ b/tailcfg/tka.go
@@ -36,7 +36,7 @@ type TKASignInfo struct {
 	// a NodeKeySignature (NKS), which rotates the node key.
 	//
 	// This is necessary so the node can rotate its node-key without
-	// talking to a node which holds a trusted network-lock key.
+	// talking to a node which holds a trusted tailnet-lock key.
 	// It does this by nesting the original NKS in a 'rotation' NKS,
 	// which it then signs with the key corresponding to RotationPubkey.
 	//
@@ -111,7 +111,7 @@ type TKABootstrapRequest struct {
 	NodeKey key.NodePublic
 
 	// Head represents the node's head AUMHash (tka.Authority.Head), if
-	// network lock is enabled.
+	// tailnet lock is enabled.
 	Head string
 }
 
@@ -193,7 +193,7 @@ type TKASyncSendResponse struct {
 	Head string
 }
 
-// TKADisableRequest disables network-lock across the tailnet using the
+// TKADisableRequest disables tailnet-lock across the tailnet using the
 // provided disablement secret.
 //
 // This is the request schema for a /tka/disable noise RPC.
diff --git a/tempfork/acme/acme.go b/tempfork/acme/acme.go
index bbddb9551..96a717d3e 100644
--- a/tempfork/acme/acme.go
+++ b/tempfork/acme/acme.go
@@ -31,12 +31,11 @@ import (
 	"crypto/x509/pkix"
 	"encoding/asn1"
 	"encoding/base64"
-	"encoding/hex"
 	"encoding/json"
-	"encoding/pem"
 	"errors"
 	"fmt"
 	"math/big"
+	"net"
 	"net/http"
 	"strings"
 	"sync"
@@ -187,10 +186,11 @@ func (c *Client) Discover(ctx context.Context) (Directory, error) {
 		KeyChange   string `json:"keyChange"`
 		RenewalInfo string `json:"renewalInfo"`
 		Meta        struct {
-			Terms        string   `json:"termsOfService"`
-			Website      string   `json:"website"`
-			CAA          []string `json:"caaIdentities"`
-			ExternalAcct bool     `json:"externalAccountRequired"`
+			Terms        string            `json:"termsOfService"`
+			Website      string            `json:"website"`
+			CAA          []string          `json:"caaIdentities"`
+			ExternalAcct bool              `json:"externalAccountRequired"`
+			Profiles     map[string]string `json:"profiles"`
 		}
 	}
 	if err := json.NewDecoder(res.Body).Decode(&v); err != nil {
@@ -211,6 +211,7 @@ func (c *Client) Discover(ctx context.Context) (Directory, error) {
 		Website:                 v.Meta.Website,
 		CAA:                     v.Meta.CAA,
 		ExternalAccountRequired: v.Meta.ExternalAcct,
+		Profiles:                v.Meta.Profiles,
 	}
 	return *c.dir, nil
 }
@@ -397,6 +398,10 @@ func (c *Client) authorize(ctx context.Context, typ, val string) (*Authorization
 	if _, err := c.Discover(ctx); err != nil {
 		return nil, err
 	}
+	if c.dir.AuthzURL == "" {
+		// Pre-Authorization is unsupported
+		return nil, errPreAuthorizationNotSupported
+	}
 
 	type authzID struct {
 		Type  string `json:"type"`
@@ -511,7 +516,7 @@ func (c *Client) WaitAuthorization(ctx context.Context, url string) (*Authorizat
 		// while waiting for a final authorization status.
 		d := retryAfter(res.Header.Get("Retry-After"))
 		if d == 0 {
-			// Given that the fastest challenges TLS-SNI and HTTP-01
+			// Given that the fastest challenges TLS-ALPN and HTTP-01
 			// require a CA to make at least 1 network round trip
 			// and most likely persist a challenge state,
 			// this default delay seems reasonable.
@@ -612,50 +617,28 @@ func (c *Client) HTTP01ChallengePath(token string) string {
 }
 
 // TLSSNI01ChallengeCert creates a certificate for TLS-SNI-01 challenge response.
+// Always returns an error.
 //
-// Deprecated: This challenge type is unused in both draft-02 and RFC versions of the ACME spec.
-func (c *Client) TLSSNI01ChallengeCert(token string, opt ...CertOption) (cert tls.Certificate, name string, err error) {
-	ka, err := keyAuth(c.Key.Public(), token)
-	if err != nil {
-		return tls.Certificate{}, "", err
-	}
-	b := sha256.Sum256([]byte(ka))
-	h := hex.EncodeToString(b[:])
-	name = fmt.Sprintf("%s.%s.acme.invalid", h[:32], h[32:])
-	cert, err = tlsChallengeCert([]string{name}, opt)
-	if err != nil {
-		return tls.Certificate{}, "", err
-	}
-	return cert, name, nil
+// Deprecated: This challenge type was only present in pre-standardized ACME
+// protocol drafts and is insecure for use in shared hosting environments.
+func (c *Client) TLSSNI01ChallengeCert(token string, opt ...CertOption) (tls.Certificate, string, error) {
+	return tls.Certificate{}, "", errPreRFC
 }
 
 // TLSSNI02ChallengeCert creates a certificate for TLS-SNI-02 challenge response.
+// Always returns an error.
 //
-// Deprecated: This challenge type is unused in both draft-02 and RFC versions of the ACME spec.
-func (c *Client) TLSSNI02ChallengeCert(token string, opt ...CertOption) (cert tls.Certificate, name string, err error) {
-	b := sha256.Sum256([]byte(token))
-	h := hex.EncodeToString(b[:])
-	sanA := fmt.Sprintf("%s.%s.token.acme.invalid", h[:32], h[32:])
-
-	ka, err := keyAuth(c.Key.Public(), token)
-	if err != nil {
-		return tls.Certificate{}, "", err
-	}
-	b = sha256.Sum256([]byte(ka))
-	h = hex.EncodeToString(b[:])
-	sanB := fmt.Sprintf("%s.%s.ka.acme.invalid", h[:32], h[32:])
-
-	cert, err = tlsChallengeCert([]string{sanA, sanB}, opt)
-	if err != nil {
-		return tls.Certificate{}, "", err
-	}
-	return cert, sanA, nil
+// Deprecated: This challenge type was only present in pre-standardized ACME
+// protocol drafts and is insecure for use in shared hosting environments.
+func (c *Client) TLSSNI02ChallengeCert(token string, opt ...CertOption) (tls.Certificate, string, error) {
+	return tls.Certificate{}, "", errPreRFC
 }
 
 // TLSALPN01ChallengeCert creates a certificate for TLS-ALPN-01 challenge response.
 // Servers can present the certificate to validate the challenge and prove control
-// over a domain name. For more details on TLS-ALPN-01 see
-// https://tools.ietf.org/html/draft-shoemaker-acme-tls-alpn-00#section-3
+// over an identifier (either a DNS name or the textual form of an IPv4 or IPv6
+// address). For more details on TLS-ALPN-01 see
+// https://www.rfc-editor.org/rfc/rfc8737 and https://www.rfc-editor.org/rfc/rfc8738
 //
 // The token argument is a Challenge.Token value.
 // If a WithKey option is provided, its private part signs the returned cert,
@@ -663,9 +646,13 @@ func (c *Client) TLSSNI02ChallengeCert(token string, opt ...CertOption) (cert tl
 // If no WithKey option is provided, a new ECDSA key is generated using P-256 curve.
 //
 // The returned certificate is valid for the next 24 hours and must be presented only when
-// the server name in the TLS ClientHello matches the domain, and the special acme-tls/1 ALPN protocol
+// the server name in the TLS ClientHello matches the identifier, and the special acme-tls/1 ALPN protocol
 // has been specified.
-func (c *Client) TLSALPN01ChallengeCert(token, domain string, opt ...CertOption) (cert tls.Certificate, err error) {
+//
+// Validation requests for IP address identifiers will use the reverse DNS form in the server name
+// in the TLS ClientHello since the SNI extension is not supported for IP addresses.
+// See RFC 8738 Section 6 for more information.
+func (c *Client) TLSALPN01ChallengeCert(token, identifier string, opt ...CertOption) (cert tls.Certificate, err error) {
 	ka, err := keyAuth(c.Key.Public(), token)
 	if err != nil {
 		return tls.Certificate{}, err
@@ -695,7 +682,7 @@ func (c *Client) TLSALPN01ChallengeCert(token, domain string, opt ...CertOption)
 	}
 	tmpl.ExtraExtensions = append(tmpl.ExtraExtensions, acmeExtension)
 	newOpt = append(newOpt, WithTemplate(tmpl))
-	return tlsChallengeCert([]string{domain}, newOpt)
+	return tlsChallengeCert(identifier, newOpt)
 }
 
 // popNonce returns a nonce value previously stored with c.addNonce
@@ -749,7 +736,7 @@ func (c *Client) addNonce(h http.Header) {
 }
 
 func (c *Client) fetchNonce(ctx context.Context, url string) (string, error) {
-	r, err := http.NewRequest("HEAD", url, nil)
+	r, err := http.NewRequestWithContext(ctx, "HEAD", url, nil)
 	if err != nil {
 		return "", err
 	}
@@ -813,11 +800,15 @@ func defaultTLSChallengeCertTemplate() *x509.Certificate {
 	}
 }
 
-// tlsChallengeCert creates a temporary certificate for TLS-SNI challenges
-// with the given SANs and auto-generated public/private key pair.
-// The Subject Common Name is set to the first SAN to aid debugging.
+// tlsChallengeCert creates a temporary certificate for TLS-ALPN challenges
+// for the given identifier, using an auto-generated public/private key pair.
+//
+// If the provided identifier is a domain name, it will be used as a DNS type SAN and for the
+// subject common name. If the provided identifier is an IP address it will be used as an IP type
+// SAN.
+//
 // To create a cert with a custom key pair, specify WithKey option.
-func tlsChallengeCert(san []string, opt []CertOption) (tls.Certificate, error) {
+func tlsChallengeCert(identifier string, opt []CertOption) (tls.Certificate, error) {
 	var key crypto.Signer
 	tmpl := defaultTLSChallengeCertTemplate()
 	for _, o := range opt {
@@ -841,9 +832,12 @@ func tlsChallengeCert(san []string, opt []CertOption) (tls.Certificate, error) {
 			return tls.Certificate{}, err
 		}
 	}
-	tmpl.DNSNames = san
-	if len(san) > 0 {
-		tmpl.Subject.CommonName = san[0]
+
+	if ip := net.ParseIP(identifier); ip != nil {
+		tmpl.IPAddresses = []net.IP{ip}
+	} else {
+		tmpl.DNSNames = []string{identifier}
+		tmpl.Subject.CommonName = identifier
 	}
 
 	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, key.Public(), key)
@@ -856,11 +850,5 @@ func tlsChallengeCert(san []string, opt []CertOption) (tls.Certificate, error) {
 	}, nil
 }
 
-// encodePEM returns b encoded as PEM with block of type typ.
-func encodePEM(typ string, b []byte) []byte {
-	pb := &pem.Block{Type: typ, Bytes: b}
-	return pem.EncodeToMemory(pb)
-}
-
 // timeNow is time.Now, except in tests which can mess with it.
 var timeNow = time.Now
diff --git a/tempfork/acme/acme_test.go b/tempfork/acme/acme_test.go
index f0c45aea9..fa91ca19a 100644
--- a/tempfork/acme/acme_test.go
+++ b/tempfork/acme/acme_test.go
@@ -9,13 +9,13 @@ import (
 	"context"
 	"crypto/rand"
 	"crypto/rsa"
-	"crypto/tls"
 	"crypto/x509"
 	"crypto/x509/pkix"
 	"encoding/base64"
 	"encoding/hex"
 	"encoding/json"
 	"encoding/pem"
+	"errors"
 	"fmt"
 	"io"
 	"math/big"
@@ -23,7 +23,6 @@ import (
 	"net/http/httptest"
 	"net/url"
 	"reflect"
-	"sort"
 	"strings"
 	"testing"
 	"time"
@@ -267,6 +266,57 @@ func TestAuthorizeValid(t *testing.T) {
 	}
 }
 
+func TestAuthorizeUnsupported(t *testing.T) {
+	const (
+		nonce       = "https://example.com/acme/new-nonce"
+		reg         = "https://example.com/acme/new-acct"
+		order       = "https://example.com/acme/new-order"
+		revoke      = "https://example.com/acme/revoke-cert"
+		keychange   = "https://example.com/acme/key-change"
+		metaTerms   = "https://example.com/acme/terms/2017-5-30"
+		metaWebsite = "https://www.example.com/"
+		metaCAA     = "example.com"
+	)
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Replay-Nonce", "nonce")
+		if r.Method == http.MethodHead {
+			return
+		}
+		switch r.URL.Path {
+		case "/": // Directory
+			w.Header().Set("Content-Type", "application/json")
+			fmt.Fprintf(w, `{
+                "newNonce": %q,
+                "newAccount": %q,
+                "newOrder": %q,
+                "revokeCert": %q,
+                "keyChange": %q,
+                "meta": {
+                    "termsOfService": %q,
+                    "website": %q,
+                    "caaIdentities": [%q],
+                    "externalAccountRequired": true
+                }
+            }`, nonce, reg, order, revoke, keychange, metaTerms, metaWebsite, metaCAA)
+			w.WriteHeader(http.StatusOK)
+		case "/acme/new-authz":
+			w.WriteHeader(http.StatusBadRequest)
+		}
+	}))
+	defer ts.Close()
+	client := &Client{Key: testKey, DirectoryURL: ts.URL}
+	dir, err := client.Discover(context.Background())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if dir.AuthzURL != "" {
+		t.Fatalf("expected AuthzURL to be empty, got %q", dir.AuthzURL)
+	}
+	if _, err := client.Authorize(context.Background(), "example.com"); !errors.Is(err, errPreAuthorizationNotSupported) {
+		t.Errorf("expected err to indicate pre-authorization is unsupported, got %+v", err)
+	}
+}
+
 func TestWaitAuthorization(t *testing.T) {
 	t.Run("wait loop", func(t *testing.T) {
 		var count int
@@ -755,71 +805,6 @@ func TestLinkHeader(t *testing.T) {
 	}
 }
 
-func TestTLSSNI01ChallengeCert(t *testing.T) {
-	const (
-		token = "evaGxfADs6pSRb2LAv9IZf17Dt3juxGJ-PCt92wr-oA"
-		// echo -n <token.testKeyECThumbprint> | shasum -a 256
-		san = "dbbd5eefe7b4d06eb9d1d9f5acb4c7cd.a27d320e4b30332f0b6cb441734ad7b0.acme.invalid"
-	)
-
-	tlscert, name, err := newTestClient().TLSSNI01ChallengeCert(token)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if n := len(tlscert.Certificate); n != 1 {
-		t.Fatalf("len(tlscert.Certificate) = %d; want 1", n)
-	}
-	cert, err := x509.ParseCertificate(tlscert.Certificate[0])
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(cert.DNSNames) != 1 || cert.DNSNames[0] != san {
-		t.Fatalf("cert.DNSNames = %v; want %q", cert.DNSNames, san)
-	}
-	if cert.DNSNames[0] != name {
-		t.Errorf("cert.DNSNames[0] != name: %q vs %q", cert.DNSNames[0], name)
-	}
-	if cn := cert.Subject.CommonName; cn != san {
-		t.Errorf("cert.Subject.CommonName = %q; want %q", cn, san)
-	}
-}
-
-func TestTLSSNI02ChallengeCert(t *testing.T) {
-	const (
-		token = "evaGxfADs6pSRb2LAv9IZf17Dt3juxGJ-PCt92wr-oA"
-		// echo -n evaGxfADs6pSRb2LAv9IZf17Dt3juxGJ-PCt92wr-oA | shasum -a 256
-		sanA = "7ea0aaa69214e71e02cebb18bb867736.09b730209baabf60e43d4999979ff139.token.acme.invalid"
-		// echo -n <token.testKeyECThumbprint> | shasum -a 256
-		sanB = "dbbd5eefe7b4d06eb9d1d9f5acb4c7cd.a27d320e4b30332f0b6cb441734ad7b0.ka.acme.invalid"
-	)
-
-	tlscert, name, err := newTestClient().TLSSNI02ChallengeCert(token)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if n := len(tlscert.Certificate); n != 1 {
-		t.Fatalf("len(tlscert.Certificate) = %d; want 1", n)
-	}
-	cert, err := x509.ParseCertificate(tlscert.Certificate[0])
-	if err != nil {
-		t.Fatal(err)
-	}
-	names := []string{sanA, sanB}
-	if !reflect.DeepEqual(cert.DNSNames, names) {
-		t.Fatalf("cert.DNSNames = %v;\nwant %v", cert.DNSNames, names)
-	}
-	sort.Strings(cert.DNSNames)
-	i := sort.SearchStrings(cert.DNSNames, name)
-	if i >= len(cert.DNSNames) || cert.DNSNames[i] != name {
-		t.Errorf("%v doesn't have %q", cert.DNSNames, name)
-	}
-	if cn := cert.Subject.CommonName; cn != sanA {
-		t.Errorf("CommonName = %q; want %q", cn, sanA)
-	}
-}
-
 func TestTLSALPN01ChallengeCert(t *testing.T) {
 	const (
 		token   = "evaGxfADs6pSRb2LAv9IZf17Dt3juxGJ-PCt92wr-oA"
@@ -876,6 +861,7 @@ func TestTLSChallengeCertOpt(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
+	domain := "example.com"
 	tmpl := &x509.Certificate{
 		SerialNumber: big.NewInt(2),
 		Subject:      pkix.Name{Organization: []string{"Test"}},
@@ -884,52 +870,43 @@ func TestTLSChallengeCertOpt(t *testing.T) {
 	opts := []CertOption{WithKey(key), WithTemplate(tmpl)}
 
 	client := newTestClient()
-	cert1, _, err := client.TLSSNI01ChallengeCert("token", opts...)
-	if err != nil {
-		t.Fatal(err)
-	}
-	cert2, _, err := client.TLSSNI02ChallengeCert("token", opts...)
+	cert, err := client.TLSALPN01ChallengeCert("token", domain, opts...)
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	for i, tlscert := range []tls.Certificate{cert1, cert2} {
-		// verify generated cert private key
-		tlskey, ok := tlscert.PrivateKey.(*rsa.PrivateKey)
-		if !ok {
-			t.Errorf("%d: tlscert.PrivateKey is %T; want *rsa.PrivateKey", i, tlscert.PrivateKey)
-			continue
-		}
-		if tlskey.D.Cmp(key.D) != 0 {
-			t.Errorf("%d: tlskey.D = %v; want %v", i, tlskey.D, key.D)
-		}
-		// verify generated cert public key
-		x509Cert, err := x509.ParseCertificate(tlscert.Certificate[0])
-		if err != nil {
-			t.Errorf("%d: %v", i, err)
-			continue
-		}
-		tlspub, ok := x509Cert.PublicKey.(*rsa.PublicKey)
-		if !ok {
-			t.Errorf("%d: x509Cert.PublicKey is %T; want *rsa.PublicKey", i, x509Cert.PublicKey)
-			continue
-		}
-		if tlspub.N.Cmp(key.N) != 0 {
-			t.Errorf("%d: tlspub.N = %v; want %v", i, tlspub.N, key.N)
-		}
-		// verify template option
-		sn := big.NewInt(2)
-		if x509Cert.SerialNumber.Cmp(sn) != 0 {
-			t.Errorf("%d: SerialNumber = %v; want %v", i, x509Cert.SerialNumber, sn)
-		}
-		org := []string{"Test"}
-		if !reflect.DeepEqual(x509Cert.Subject.Organization, org) {
-			t.Errorf("%d: Subject.Organization = %+v; want %+v", i, x509Cert.Subject.Organization, org)
-		}
-		for _, v := range x509Cert.DNSNames {
-			if !strings.HasSuffix(v, ".acme.invalid") {
-				t.Errorf("%d: invalid DNSNames element: %q", i, v)
-			}
+	// verify generated cert private key
+	tlskey, ok := cert.PrivateKey.(*rsa.PrivateKey)
+	if !ok {
+		t.Fatalf("tlscert.PrivateKey is %T; want *rsa.PrivateKey", cert.PrivateKey)
+	}
+	if tlskey.D.Cmp(key.D) != 0 {
+		t.Errorf("tlskey.D = %v; want %v", tlskey.D, key.D)
+	}
+	// verify generated cert public key
+	x509Cert, err := x509.ParseCertificate(cert.Certificate[0])
+	if err != nil {
+		t.Fatal(err)
+	}
+	tlspub, ok := x509Cert.PublicKey.(*rsa.PublicKey)
+	if !ok {
+		t.Fatalf("x509Cert.PublicKey is %T; want *rsa.PublicKey", x509Cert.PublicKey)
+	}
+	if tlspub.N.Cmp(key.N) != 0 {
+		t.Errorf("tlspub.N = %v; want %v", tlspub.N, key.N)
+	}
+	// verify template option
+	sn := big.NewInt(2)
+	if x509Cert.SerialNumber.Cmp(sn) != 0 {
+		t.Errorf("SerialNumber = %v; want %v", x509Cert.SerialNumber, sn)
+	}
+	org := []string{"Test"}
+	if !reflect.DeepEqual(x509Cert.Subject.Organization, org) {
+		t.Errorf("Subject.Organization = %+v; want %+v", x509Cert.Subject.Organization, org)
+	}
+	for _, v := range x509Cert.DNSNames {
+		if v != domain {
+			t.Errorf("invalid DNSNames element: %q", v)
 		}
 	}
 }
diff --git a/tempfork/acme/http.go b/tempfork/acme/http.go
index d92ff232f..7d1052acd 100644
--- a/tempfork/acme/http.go
+++ b/tempfork/acme/http.go
@@ -66,7 +66,7 @@ func (c *Client) retryTimer() *retryTimer {
 // The n argument is always bounded between 1 and 30.
 // The returned value is always greater than 0.
 func defaultBackoff(n int, r *http.Request, res *http.Response) time.Duration {
-	const max = 10 * time.Second
+	const maxVal = 10 * time.Second
 	var jitter time.Duration
 	if x, err := rand.Int(rand.Reader, big.NewInt(1000)); err == nil {
 		// Set the minimum to 1ms to avoid a case where
@@ -86,10 +86,7 @@ func defaultBackoff(n int, r *http.Request, res *http.Response) time.Duration {
 		n = 30
 	}
 	d := time.Duration(1<<uint(n-1))*time.Second + jitter
-	if d > max {
-		return max
-	}
-	return d
+	return min(d, maxVal)
 }
 
 // retryAfter parses a Retry-After HTTP header value,
@@ -131,7 +128,7 @@ func wantStatus(codes ...int) resOkay {
 func (c *Client) get(ctx context.Context, url string, ok resOkay) (*http.Response, error) {
 	retry := c.retryTimer()
 	for {
-		req, err := http.NewRequest("GET", url, nil)
+		req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
 		if err != nil {
 			return nil, err
 		}
@@ -231,7 +228,7 @@ func (c *Client) postNoRetry(ctx context.Context, key crypto.Signer, url string,
 	if err != nil {
 		return nil, nil, err
 	}
-	req, err := http.NewRequest("POST", url, bytes.NewReader(b))
+	req, err := http.NewRequestWithContext(ctx, "POST", url, bytes.NewReader(b))
 	if err != nil {
 		return nil, nil, err
 	}
diff --git a/tempfork/acme/jws.go b/tempfork/acme/jws.go
index b38828d85..685027566 100644
--- a/tempfork/acme/jws.go
+++ b/tempfork/acme/jws.go
@@ -92,7 +92,7 @@ func jwsEncodeJSON(claimset interface{}, key crypto.Signer, kid KeyID, nonce, ur
 	if err != nil {
 		return nil, err
 	}
-	phead := base64.RawURLEncoding.EncodeToString([]byte(phJSON))
+	phead := base64.RawURLEncoding.EncodeToString(phJSON)
 	var payload string
 	if val, ok := claimset.(string); ok {
 		payload = val
diff --git a/tempfork/acme/rfc8555.go b/tempfork/acme/rfc8555.go
index 3eaf935fd..1c161ebe4 100644
--- a/tempfork/acme/rfc8555.go
+++ b/tempfork/acme/rfc8555.go
@@ -54,6 +54,9 @@ func (c *Client) registerRFC(ctx context.Context, acct *Account, prompt func(tos
 		Contact: acct.Contact,
 	}
 	if c.dir.Terms != "" {
+		if prompt == nil {
+			return nil, errors.New("acme: missing Manager.Prompt to accept server's terms of service")
+		}
 		req.TermsAgreed = prompt(c.dir.Terms)
 	}
 
@@ -207,6 +210,7 @@ func (c *Client) AuthorizeOrder(ctx context.Context, id []AuthzID, opt ...OrderO
 		NotBefore   string        `json:"notBefore,omitempty"`
 		NotAfter    string        `json:"notAfter,omitempty"`
 		Replaces    string        `json:"replaces,omitempty"`
+		Profile     string        `json:"profile,omitempty"`
 	}{}
 	for _, v := range id {
 		req.Identifiers = append(req.Identifiers, wireAuthzID{
@@ -228,6 +232,15 @@ func (c *Client) AuthorizeOrder(ctx context.Context, id []AuthzID, opt ...OrderO
 				return nil, fmt.Errorf("failed to parse certificate being replaced: %w", err)
 			}
 			req.Replaces = certRenewalIdentifier(cert)
+		case orderProfileOpt:
+			if !dir.Profiles.isSupported() {
+				return nil, ErrCADoesNotSupportProfiles
+			}
+			profileName := string(o)
+			if !dir.Profiles.Has(profileName) {
+				return nil, fmt.Errorf("%w %s", ErrProfileNotInSetOfSupportedProfiles, profileName)
+			}
+			req.Profile = profileName
 		default:
 			// Package's fault if we let this happen.
 			panic(fmt.Sprintf("unsupported order option type %T", o))
@@ -242,7 +255,7 @@ func (c *Client) AuthorizeOrder(ctx context.Context, id []AuthzID, opt ...OrderO
 	return responseOrder(res)
 }
 
-// GetOrder retrives an order identified by the given URL.
+// GetOrder retrieves an order identified by the given URL.
 // For orders created with AuthorizeOrder, the url value is Order.URI.
 //
 // If a caller needs to poll an order until its status is final,
@@ -282,7 +295,7 @@ func (c *Client) WaitOrder(ctx context.Context, url string) (*Order, error) {
 		case err != nil:
 			// Skip and retry.
 		case o.Status == StatusInvalid:
-			return nil, &OrderError{OrderURL: o.URI, Status: o.Status}
+			return nil, &OrderError{OrderURL: o.URI, Status: o.Status, Problem: o.Error}
 		case o.Status == StatusReady || o.Status == StatusValid:
 			return o, nil
 		}
@@ -379,7 +392,7 @@ func (c *Client) CreateOrderCert(ctx context.Context, url string, csr []byte, bu
 	}
 	// The only acceptable status post finalize and WaitOrder is "valid".
 	if o.Status != StatusValid {
-		return nil, "", &OrderError{OrderURL: o.URI, Status: o.Status}
+		return nil, "", &OrderError{OrderURL: o.URI, Status: o.Status, Problem: o.Error}
 	}
 	crt, err := c.fetchCertRFC(ctx, o.CertURL, bundle)
 	return crt, o.CertURL, err
diff --git a/tempfork/acme/rfc8555_test.go b/tempfork/acme/rfc8555_test.go
index ec51a7a5e..b9ac1e805 100644
--- a/tempfork/acme/rfc8555_test.go
+++ b/tempfork/acme/rfc8555_test.go
@@ -99,6 +99,61 @@ func TestRFC_Discover(t *testing.T) {
 	if !dir.ExternalAccountRequired {
 		t.Error("dir.Meta.ExternalAccountRequired is false")
 	}
+	if dir.Profiles != nil {
+		t.Errorf("dir.Profiles is expected to be nil, got %+v", dir.Profiles)
+	}
+}
+
+func TestDiscover_WithProfiles(t *testing.T) {
+	const (
+		nonce       = "https://example.com/acme/new-nonce"
+		reg         = "https://example.com/acme/new-acct"
+		order       = "https://example.com/acme/new-order"
+		authz       = "https://example.com/acme/new-authz"
+		revoke      = "https://example.com/acme/revoke-cert"
+		keychange   = "https://example.com/acme/key-change"
+		metaTerms   = "https://example.com/acme/terms/2017-5-30"
+		metaWebsite = "https://www.example.com/"
+		metaCAA     = "example.com"
+	)
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		fmt.Fprintf(w, `{
+			"newNonce": %q,
+			"newAccount": %q,
+			"newOrder": %q,
+			"newAuthz": %q,
+			"revokeCert": %q,
+			"keyChange": %q,
+			"meta": {
+				"termsOfService": %q,
+				"website": %q,
+				"caaIdentities": [%q],
+				"externalAccountRequired": true,
+                "profiles": {
+                    "default": "Your favorite default profile",
+                    "tlsserver": "New and improved",
+                    "client": "For all your mutual TLS needs"
+                }
+			}
+		}`, nonce, reg, order, authz, revoke, keychange, metaTerms, metaWebsite, metaCAA)
+	}))
+	defer ts.Close()
+	c := &Client{DirectoryURL: ts.URL}
+	dir, err := c.Discover(context.Background())
+	if err != nil {
+		t.Fatal(err)
+	}
+	expected := Profiles(map[string]string{"default": "Your favorite default profile", "tlsserver": "New and improved", "client": "For all your mutual TLS needs"})
+	if dir.Profiles == nil {
+		t.Errorf("expected directory to be %+v; got nil", expected)
+	}
+
+	for key, value := range dir.Profiles {
+		if expValue := expected.GetDescription(key); value != expValue {
+			t.Errorf("expected key %+q to have description %+q; got %+q", key, expected, value)
+		}
+	}
 }
 
 func TestRFC_popNonce(t *testing.T) {
@@ -247,6 +302,27 @@ func (s *acmeServer) start() {
 			return
 		}
 
+		if r.URL.Path == "/directory-with-profiles" {
+			fmt.Fprintf(w, `{
+				"newNonce": %q,
+				"newAccount": %q,
+				"newOrder": %q,
+				"newAuthz": %q,
+				"revokeCert": %q,
+				"keyChange": %q,
+                "meta": {"termsOfService": %q, "profiles": {"default": "Default", "server": "Server", "client": "Client"}}
+				}`,
+				s.url("/acme/new-nonce"),
+				s.url("/acme/new-account"),
+				s.url("/acme/new-order"),
+				s.url("/acme/new-authz"),
+				s.url("/acme/revoke-cert"),
+				s.url("/acme/key-change"),
+				s.url("/terms"),
+			)
+			return
+		}
+
 		// All other responses contain a nonce value unconditionally.
 		w.Header().Set("Replay-Nonce", s.nonce())
 		if r.URL.Path == "/acme/new-nonce" {
@@ -795,6 +871,51 @@ func TestRFC_AuthorizeOrder(t *testing.T) {
 	}
 }
 
+func TestRFC_AuthorizeOrder_WithOrderProfile(t *testing.T) {
+	s := newACMEServer()
+	s.handle("/acme/new-account", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Location", s.url("/accounts/1"))
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte(`{"status": "valid"}`))
+	})
+	s.handle("/acme/new-order", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Location", s.url("/orders/1"))
+		w.WriteHeader(http.StatusCreated)
+		fmt.Fprintf(w, `{
+			"status": "pending",
+			"expires": "2019-09-01T00:00:00Z",
+			"notBefore": "2019-08-31T00:00:00Z",
+			"notAfter": "2019-09-02T00:00:00Z",
+			"identifiers": [{"type":"dns", "value":"example.org"}],
+			"authorizations": [%q]
+		}`, s.url("/authz/1"))
+	})
+	s.start()
+	defer s.close()
+
+	cl := &Client{Key: testKeyEC, DirectoryURL: s.url("/directory-with-profiles")}
+	o, err := cl.AuthorizeOrder(context.Background(), DomainIDs("example.org"),
+		WithOrderNotBefore(time.Date(2019, 8, 31, 0, 0, 0, 0, time.UTC)),
+		WithOrderNotAfter(time.Date(2019, 9, 2, 0, 0, 0, 0, time.UTC)),
+		WithOrderProfile("server"),
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	okOrder := &Order{
+		URI:         s.url("/orders/1"),
+		Status:      StatusPending,
+		Expires:     time.Date(2019, 9, 1, 0, 0, 0, 0, time.UTC),
+		NotBefore:   time.Date(2019, 8, 31, 0, 0, 0, 0, time.UTC),
+		NotAfter:    time.Date(2019, 9, 2, 0, 0, 0, 0, time.UTC),
+		Identifiers: []AuthzID{{Type: "dns", Value: "example.org"}},
+		AuthzURLs:   []string{s.url("/authz/1")},
+	}
+	if !reflect.DeepEqual(o, okOrder) {
+		t.Errorf("AuthorizeOrder = %+v; want %+v", o, okOrder)
+	}
+}
+
 func TestRFC_GetOrder(t *testing.T) {
 	s := newACMEServer()
 	s.handle("/acme/new-account", func(w http.ResponseWriter, r *http.Request) {
@@ -892,11 +1013,17 @@ func TestRFC_WaitOrderError(t *testing.T) {
 	s.handle("/orders/1", func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Location", s.url("/orders/1"))
 		w.WriteHeader(http.StatusOK)
-		s := StatusPending
 		if count > 0 {
-			s = StatusInvalid
+			// https://www.rfc-editor.org/rfc/rfc8555#section-7.3.3
+			errorData := `{
+				"type": "urn:ietf:params:acme:error:userActionRequired",
+				"detail": "Terms of service have changed",
+				"instance": "https://example.com/acme/agreement/?token=W8Ih3PswD-8"
+			}`
+			fmt.Fprintf(w, `{"status": %q, "error": %s}`, StatusInvalid, errorData)
+		} else {
+			fmt.Fprintf(w, `{"status": %q}`, StatusPending)
 		}
-		fmt.Fprintf(w, `{"status": %q}`, s)
 		count++
 	})
 	s.start()
@@ -917,6 +1044,13 @@ func TestRFC_WaitOrderError(t *testing.T) {
 	if e.Status != StatusInvalid {
 		t.Errorf("e.Status = %q; want %q", e.Status, StatusInvalid)
 	}
+	if e.Problem == nil {
+		t.Errorf("e.Problem = nil")
+	}
+	expectedProbType := "urn:ietf:params:acme:error:userActionRequired"
+	if e.Problem.ProblemType != expectedProbType {
+		t.Errorf("e.Problem.ProblemType = %q; want %q", e.Problem.ProblemType, expectedProbType)
+	}
 }
 
 func TestRFC_CreateOrderCert(t *testing.T) {
diff --git a/tempfork/acme/sync_to_upstream_test.go b/tempfork/acme/sync_to_upstream_test.go
index e22c8c1a8..7a79de69a 100644
--- a/tempfork/acme/sync_to_upstream_test.go
+++ b/tempfork/acme/sync_to_upstream_test.go
@@ -45,7 +45,14 @@ func TestSyncedToUpstream(t *testing.T) {
 		}
 		for _, de := range ents {
 			name := de.Name()
-			if name == "sync_to_upstream_test.go" {
+			switch name {
+			case "sync_to_upstream_test.go":
+				continue
+			case "pebble_test.go":
+				// We don't vendor upstream's pebble_test.go: its
+				// TestWithPebble downloads the Pebble module from
+				// outside our go.mod, then builds and runs its
+				// binaries during tests.
 				continue
 			}
 			if !strings.HasSuffix(name, ".go") {
diff --git a/tempfork/acme/types.go b/tempfork/acme/types.go
index 0142469d8..71746c15e 100644
--- a/tempfork/acme/types.go
+++ b/tempfork/acme/types.go
@@ -56,6 +56,19 @@ var (
 
 	// ErrNoAccount indicates that the Client's key has not been registered with the CA.
 	ErrNoAccount = errors.New("acme: account does not exist")
+
+	// errPreAuthorizationNotSupported indicates that the server does not
+	// support pre-authorization of identifiers.
+	errPreAuthorizationNotSupported = errors.New("acme: pre-authorization is not supported")
+
+	// ErrCADoesNotSupportProfiles indicates that [WithOrderProfile] was
+	// included with a CA that does not advertise support for profiles in
+	// their directory.
+	ErrCADoesNotSupportProfiles = errors.New("acme: certificate authority does not support profiles")
+
+	// ErrProfileNotInSetOfSupportedProfiles indicates that the profile
+	// specified with [WithOrderProfile} is not one supported by the CA
+	ErrProfileNotInSetOfSupportedProfiles = errors.New("acme: certificate authority does not advertise a profile with name")
 )
 
 // A Subproblem describes an ACME subproblem as reported in an Error.
@@ -150,17 +163,24 @@ func (a *AuthorizationError) Error() string {
 
 // OrderError is returned from Client's order related methods.
 // It indicates the order is unusable and the clients should start over with
-// AuthorizeOrder.
+// AuthorizeOrder. A Problem description may be provided with details on
+// what caused the order to become unusable.
 //
 // The clients can still fetch the order object from CA using GetOrder
 // to inspect its state.
 type OrderError struct {
 	OrderURL string
 	Status   string
+	// Problem is the error that occurred while processing the order.
+	Problem *Error
 }
 
 func (oe *OrderError) Error() string {
-	return fmt.Sprintf("acme: order %s status: %s", oe.OrderURL, oe.Status)
+	str := fmt.Sprintf("acme: order %s status: %s", oe.OrderURL, oe.Status)
+	if oe.Problem != nil {
+		str += fmt.Sprintf("; problem: %s", oe.Problem)
+	}
+	return str
 }
 
 // RateLimit reports whether err represents a rate limit error and
@@ -308,6 +328,10 @@ type Directory struct {
 	// ExternalAccountRequired indicates that the CA requires for all account-related
 	// requests to include external account binding information.
 	ExternalAccountRequired bool
+
+	// Profiles indicates that the CA supports specifying a profile for an
+	// order. See also [WithOrderNotAfter].
+	Profiles Profiles
 }
 
 // Order represents a client's request for a certificate.
@@ -383,6 +407,15 @@ func WithOrderNotAfter(t time.Time) OrderOption {
 	return orderNotAfterOpt(t)
 }
 
+// WithOrderProfile sets an order's Profile field for servers which support
+// profiles.
+// See also:
+// * https://datatracker.ietf.org/doc/draft-aaron-acme-profiles/
+// * https://letsencrypt.org/docs/profiles/
+func WithOrderProfile(name string) OrderOption {
+	return orderProfileOpt(name)
+}
+
 type orderNotBeforeOpt time.Time
 
 func (orderNotBeforeOpt) privateOrderOpt() {}
@@ -415,6 +448,10 @@ type orderReplacesCertDER []byte
 
 func (orderReplacesCertDER) privateOrderOpt() {}
 
+type orderProfileOpt string
+
+func (orderProfileOpt) privateOrderOpt() {}
+
 // Authorization encodes an authorization response.
 type Authorization struct {
 	// URI uniquely identifies a authorization.
@@ -643,7 +680,7 @@ func (*certOptKey) privateCertOpt() {}
 //
 // In TLS ChallengeCert methods, the template is also used as parent,
 // resulting in a self-signed certificate.
-// The DNSNames field of t is always overwritten for tls-sni challenge certs.
+// The DNSNames or IPAddresses fields of t are always overwritten for tls-alpn challenge certs.
 func WithTemplate(t *x509.Certificate) CertOption {
 	return (*certOptTemplate)(t)
 }
@@ -665,3 +702,18 @@ type RenewalInfo struct {
 	SuggestedWindow RenewalInfoWindow `json:"suggestedWindow"`
 	ExplanationURL  string            `json:"explanationURL"`
 }
+
+type Profiles map[string]string
+
+func (ps Profiles) isSupported() bool {
+	return len(ps) > 0
+}
+
+func (ps Profiles) GetDescription(name string) string {
+	return ps[name]
+}
+
+func (ps Profiles) Has(name string) bool {
+	_, ok := ps[name]
+	return ok
+}
diff --git a/tempfork/acme/types_test.go b/tempfork/acme/types_test.go
index 59ce7e760..2a59f6f0b 100644
--- a/tempfork/acme/types_test.go
+++ b/tempfork/acme/types_test.go
@@ -217,3 +217,19 @@ func TestErrorStringerWithSubproblems(t *testing.T) {
 		t.Errorf("Unexpected error string: wanted %q, got %q", expectedStr, err.Error())
 	}
 }
+
+func TestOrderErrorProblem(t *testing.T) {
+	oe := &OrderError{
+		OrderURL: "url",
+		Status:   "invalid",
+		Problem: &Error{
+			StatusCode:  400,
+			ProblemType: "type",
+			Detail:      "detail",
+		},
+	}
+	want := "acme: order url status: invalid; problem: 400 type: detail"
+	if got := oe.Error(); got != want {
+		t.Errorf("oe.Error() = %q, want %q", got, want)
+	}
+}
diff --git a/tempfork/acme/version_go112.go b/tempfork/acme/version_go112.go
deleted file mode 100644
index cc5fab604..000000000
--- a/tempfork/acme/version_go112.go
+++ /dev/null
@@ -1,27 +0,0 @@
-// Copyright 2019 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build go1.12
-
-package acme
-
-import "runtime/debug"
-
-func init() {
-	// Set packageVersion if the binary was built in modules mode and x/crypto
-	// was not replaced with a different module.
-	info, ok := debug.ReadBuildInfo()
-	if !ok {
-		return
-	}
-	for _, m := range info.Deps {
-		if m.Path != "golang.org/x/crypto" {
-			continue
-		}
-		if m.Replace == nil {
-			packageVersion = m.Version
-		}
-		break
-	}
-}
diff --git a/tempfork/pkgdoc/pkgdoc.go b/tempfork/pkgdoc/pkgdoc.go
new file mode 100644
index 000000000..cab38dd48
--- /dev/null
+++ b/tempfork/pkgdoc/pkgdoc.go
@@ -0,0 +1,234 @@
+// Copyright 2015 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package pkgdoc is a library-ified fork of Go's cmd/doc program
+// that only does what we need for misc/genreadme.
+package pkgdoc
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"go/ast"
+	"go/build"
+	"go/doc"
+	"go/doc/comment"
+	"go/parser"
+	"go/token"
+	"io"
+	"io/fs"
+	"log"
+	"slices"
+)
+
+const (
+	punchedCardWidth = 80
+	indent           = "    "
+)
+
+type Package struct {
+	writer   io.Writer    // Destination for output.
+	name     string       // Package name, json for encoding/json.
+	userPath string       // String the user used to find this package.
+	pkg      *ast.Package // Parsed package.
+	file     *ast.File    // Merged from all files in the package
+	doc      *doc.Package
+	build    *build.Package
+	fs       *token.FileSet // Needed for printing.
+	buf      pkgBuffer
+}
+
+func (pkg *Package) ToText(w io.Writer, text, prefix, codePrefix string) {
+	d := pkg.doc.Parser().Parse(text)
+	pr := pkg.doc.Printer()
+	pr.TextPrefix = prefix
+	pr.TextCodePrefix = codePrefix
+	w.Write(pr.Text(d))
+}
+
+// ToMarkdown parses the godoc comment text and writes a Markdown rendering to w
+// suitable for a repository README.md: top-level sections become ## headings
+// without per-heading anchor IDs, and [Symbol] doc links resolve to pkg.go.dev,
+// including for symbols in the current package (which the default printer would
+// otherwise emit as bare #Name fragments with no backing anchor).
+func (pkg *Package) ToMarkdown(w io.Writer, text string) {
+	d := pkg.doc.Parser().Parse(text)
+	pr := pkg.doc.Printer()
+	pr.HeadingLevel = 2
+	pr.HeadingID = func(*comment.Heading) string { return "" }
+	pr.DocLinkBaseURL = "https://pkg.go.dev"
+	pr.DocLinkURL = func(link *comment.DocLink) string {
+		importPath := link.ImportPath
+		if importPath == "" {
+			importPath = pkg.doc.ImportPath
+		}
+		name := link.Name
+		if link.Recv != "" {
+			name = link.Recv + "." + name
+		}
+		return "https://pkg.go.dev/" + importPath + "#" + name
+	}
+	w.Write(pr.Markdown(d))
+}
+
+// pkgBuffer is a wrapper for bytes.Buffer that prints a package clause the
+// first time Write is called.
+type pkgBuffer struct {
+	pkg     *Package
+	printed bool // Prevent repeated package clauses.
+	bytes.Buffer
+}
+
+func (pb *pkgBuffer) Write(p []byte) (int, error) {
+	pb.packageClause()
+	return pb.Buffer.Write(p)
+}
+
+func (pb *pkgBuffer) packageClause() {
+	if !pb.printed {
+		pb.printed = true
+		// Only show package clause for commands if requested explicitly.
+		if pb.pkg.pkg.Name != "main" {
+			pb.pkg.packageClause()
+		}
+	}
+}
+
+type PackageError string // type returned by pkg.Fatalf.
+
+func (p PackageError) Error() string {
+	return string(p)
+}
+
+// parsePackage turns the build package we found into a parsed package
+// we can then use to generate documentation.
+func parsePackage(writer io.Writer, pkg *build.Package, userPath string) *Package {
+	// include tells parser.ParseDir which files to include.
+	// That means the file must be in the build package's GoFiles or CgoFiles
+	// list only (no tag-ignored files, tests, swig or other non-Go files).
+	include := func(info fs.FileInfo) bool {
+		return slices.Contains(pkg.GoFiles, info.Name()) || slices.Contains(pkg.CgoFiles, info.Name())
+	}
+	fset := token.NewFileSet()
+	// Parse declarations (not just imports) so that doc.Package knows the
+	// package's symbols; the Markdown printer needs this to resolve
+	// [Symbol] doc links in package comments.
+	pkgs, err := parser.ParseDir(fset, pkg.Dir, include, parser.ParseComments)
+	if err != nil {
+		log.Fatal(err)
+	}
+	// Make sure they are all in one package.
+	if len(pkgs) == 0 {
+		log.Fatalf("no source-code package in directory %s", pkg.Dir)
+	}
+	if len(pkgs) > 1 {
+		log.Fatalf("multiple packages in directory %s", pkg.Dir)
+	}
+	astPkg := pkgs[pkg.Name]
+
+	// TODO: go/doc does not include typed constants in the constants
+	// list, which is what we want. For instance, time.Sunday is of type
+	// time.Weekday, so it is defined in the type but not in the
+	// Consts list for the package. This prevents
+	//	go doc time.Sunday
+	// from finding the symbol. Work around this for now, but we
+	// should fix it in go/doc.
+	// A similar story applies to factory functions.
+	mode := doc.AllDecls
+	docPkg := doc.New(astPkg, pkg.ImportPath, mode)
+
+	p := &Package{
+		writer:   writer,
+		name:     pkg.Name,
+		userPath: userPath,
+		pkg:      astPkg,
+		file:     ast.MergePackageFiles(astPkg, 0),
+		doc:      docPkg,
+		build:    pkg,
+		fs:       fset,
+	}
+	p.buf.pkg = p
+	return p
+}
+
+func (pkg *Package) Printf(format string, args ...any) {
+	fmt.Fprintf(&pkg.buf, format, args...)
+}
+
+func (pkg *Package) flush() {
+	_, err := pkg.writer.Write(pkg.buf.Bytes())
+	if err != nil {
+		log.Fatal(err)
+	}
+	pkg.buf.Reset() // Not needed, but it's a flush.
+}
+
+var newlineBytes = []byte("\n\n") // We never ask for more than 2.
+
+// newlines guarantees there are n newlines at the end of the buffer.
+func (pkg *Package) newlines(n int) {
+	for !bytes.HasSuffix(pkg.buf.Bytes(), newlineBytes[:n]) {
+		pkg.buf.WriteRune('\n')
+	}
+}
+
+// packageDoc prints the docs for the package as Markdown.
+func (pkg *Package) packageDoc() {
+	pkg.Printf("") // Trigger the package clause; we know the package exists.
+	pkg.ToMarkdown(&pkg.buf, pkg.doc.Doc)
+	pkg.newlines(1)
+
+	pkg.bugs()
+}
+
+// packageClause prints the package clause.
+func (pkg *Package) packageClause() {
+	importPath := pkg.build.ImportComment
+	if importPath == "" {
+		importPath = pkg.build.ImportPath
+	}
+
+	pkg.Printf("package %s // import %q\n\n", pkg.name, importPath)
+}
+
+// bugs prints the BUGS information for the package.
+// TODO: Provide access to TODOs and NOTEs as well (very noisy so off by default)?
+func (pkg *Package) bugs() {
+	if pkg.doc.Notes["BUG"] == nil {
+		return
+	}
+	pkg.Printf("\n")
+	for _, note := range pkg.doc.Notes["BUG"] {
+		pkg.Printf("%s: %v\n", "BUG", note.Body)
+	}
+}
+
+// PackageDoc generates Markdown documentation for the package in the given
+// directory. importPath is the full Go import path of that package (e.g.
+// "tailscale.com/tsnet"); it's used to render [Symbol] doc links to the
+// right pkg.go.dev URL. If importPath is empty, build.ImportDir's guess
+// is used (typically "." for module-based repos).
+func PackageDoc(dir, importPath string) ([]byte, error) {
+	var buf bytes.Buffer
+	var writer io.Writer = &buf
+
+	buildPackage, err := build.ImportDir(dir, build.ImportComment)
+	if err != nil {
+		var noGoError *build.NoGoError
+		if errors.As(err, &noGoError) {
+			return nil, nil
+		}
+		return nil, err
+	}
+	if importPath != "" {
+		buildPackage.ImportPath = importPath
+	}
+	userPath := dir
+
+	pkg := parsePackage(writer, buildPackage, userPath)
+	pkg.packageDoc()
+	pkg.flush()
+
+	return buf.Bytes(), nil
+}
diff --git a/tka/builder_test.go b/tka/builder_test.go
index 29ecaf88c..4e820e14d 100644
--- a/tka/builder_test.go
+++ b/tka/builder_test.go
@@ -27,12 +27,10 @@ func (s signer25519) SignAUM(sigHash tkatype.AUMSigHash) ([]tkatype.Signature, e
 func TestAuthorityBuilderAddKey(t *testing.T) {
 	pub, priv := testingKey25519(t, 1)
 	key := Key{Kind: Key25519, Public: pub, Votes: 2}
+	state := CreateStateForTest(key)
 
 	storage := ChonkMem()
-	a, _, err := Create(storage, State{
-		Keys:              []Key{key},
-		DisablementValues: [][]byte{DisablementKDF([]byte{1, 2, 3})},
-	}, signer25519(priv))
+	a, _, err := Create(storage, state, signer25519(priv))
 	if err != nil {
 		t.Fatalf("Create() failed: %v", err)
 	}
@@ -61,12 +59,10 @@ func TestAuthorityBuilderAddKey(t *testing.T) {
 func TestAuthorityBuilderMaxKey(t *testing.T) {
 	pub, priv := testingKey25519(t, 1)
 	key := Key{Kind: Key25519, Public: pub, Votes: 2}
+	state := CreateStateForTest(key)
 
 	storage := ChonkMem()
-	a, _, err := Create(storage, State{
-		Keys:              []Key{key},
-		DisablementValues: [][]byte{DisablementKDF([]byte{1, 2, 3})},
-	}, signer25519(priv))
+	a, _, err := Create(storage, state, signer25519(priv))
 	if err != nil {
 		t.Fatalf("Create() failed: %v", err)
 	}
@@ -108,12 +104,10 @@ func TestAuthorityBuilderRemoveKey(t *testing.T) {
 	key := Key{Kind: Key25519, Public: pub, Votes: 2}
 	pub2, _ := testingKey25519(t, 2)
 	key2 := Key{Kind: Key25519, Public: pub2, Votes: 1}
+	state := CreateStateForTest(key, key2)
 
 	storage := ChonkMem()
-	a, _, err := Create(storage, State{
-		Keys:              []Key{key, key2},
-		DisablementValues: [][]byte{DisablementKDF([]byte{1, 2, 3})},
-	}, signer25519(priv))
+	a, _, err := Create(storage, state, signer25519(priv))
 	if err != nil {
 		t.Fatalf("Create() failed: %v", err)
 	}
@@ -154,12 +148,10 @@ func TestAuthorityBuilderRemoveKey(t *testing.T) {
 func TestAuthorityBuilderSetKeyVote(t *testing.T) {
 	pub, priv := testingKey25519(t, 1)
 	key := Key{Kind: Key25519, Public: pub, Votes: 2}
+	state := CreateStateForTest(key)
 
 	storage := ChonkMem()
-	a, _, err := Create(storage, State{
-		Keys:              []Key{key},
-		DisablementValues: [][]byte{DisablementKDF([]byte{1, 2, 3})},
-	}, signer25519(priv))
+	a, _, err := Create(storage, state, signer25519(priv))
 	if err != nil {
 		t.Fatalf("Create() failed: %v", err)
 	}
@@ -190,12 +182,10 @@ func TestAuthorityBuilderSetKeyVote(t *testing.T) {
 func TestAuthorityBuilderSetKeyMeta(t *testing.T) {
 	pub, priv := testingKey25519(t, 1)
 	key := Key{Kind: Key25519, Public: pub, Votes: 2, Meta: map[string]string{"a": "b"}}
+	state := CreateStateForTest(key)
 
 	storage := ChonkMem()
-	a, _, err := Create(storage, State{
-		Keys:              []Key{key},
-		DisablementValues: [][]byte{DisablementKDF([]byte{1, 2, 3})},
-	}, signer25519(priv))
+	a, _, err := Create(storage, state, signer25519(priv))
 	if err != nil {
 		t.Fatalf("Create() failed: %v", err)
 	}
@@ -226,12 +216,10 @@ func TestAuthorityBuilderSetKeyMeta(t *testing.T) {
 func TestAuthorityBuilderMultiple(t *testing.T) {
 	pub, priv := testingKey25519(t, 1)
 	key := Key{Kind: Key25519, Public: pub, Votes: 2}
+	state := CreateStateForTest(key)
 
 	storage := ChonkMem()
-	a, _, err := Create(storage, State{
-		Keys:              []Key{key},
-		DisablementValues: [][]byte{DisablementKDF([]byte{1, 2, 3})},
-	}, signer25519(priv))
+	a, _, err := Create(storage, state, signer25519(priv))
 	if err != nil {
 		t.Fatalf("Create() failed: %v", err)
 	}
@@ -274,12 +262,10 @@ func TestAuthorityBuilderMultiple(t *testing.T) {
 func TestAuthorityBuilderCheckpointsAfterXUpdates(t *testing.T) {
 	pub, priv := testingKey25519(t, 1)
 	key := Key{Kind: Key25519, Public: pub, Votes: 2}
+	state := CreateStateForTest(key)
 
 	storage := ChonkMem()
-	a, _, err := Create(storage, State{
-		Keys:              []Key{key},
-		DisablementValues: [][]byte{DisablementKDF([]byte{1, 2, 3})},
-	}, signer25519(priv))
+	a, _, err := Create(storage, state, signer25519(priv))
 	if err != nil {
 		t.Fatalf("Create() failed: %v", err)
 	}
diff --git a/tka/chaintest_test.go b/tka/chaintest_test.go
index 467880e2c..71210608b 100644
--- a/tka/chaintest_test.go
+++ b/tka/chaintest_test.go
@@ -320,6 +320,20 @@ func optTemplate(name string, template AUM) testchainOpt {
 	}
 }
 
+func genesisTemplate(key Key) testchainOpt {
+	state := CreateStateForTest(key)
+	return optTemplate("genesis", AUM{MessageKind: AUMCheckpoint, State: &state})
+}
+
+func checkpointTemplate() testchainOpt {
+	fakeState := &State{
+		Keys:              []Key{{Kind: Key25519, Votes: 1}},
+		DisablementValues: [][]byte{bytes.Repeat([]byte{1}, 32)},
+	}
+
+	return optTemplate("checkpoint", AUM{MessageKind: AUMCheckpoint, State: fakeState})
+}
+
 func optKey(name string, key Key, priv ed25519.PrivateKey) testchainOpt {
 	return testchainOpt{
 		Name:    name,
diff --git a/tka/deeplink_test.go b/tka/deeplink_test.go
index 4d813272a..260ec9026 100644
--- a/tka/deeplink_test.go
+++ b/tka/deeplink_test.go
@@ -14,11 +14,7 @@ func TestGenerateDeeplink(t *testing.T) {
         G1 -> L1
 
         G1.template = genesis
-    `,
-		optTemplate("genesis", AUM{MessageKind: AUMCheckpoint, State: &State{
-			Keys:              []Key{key},
-			DisablementValues: [][]byte{DisablementKDF([]byte{1, 2, 3})},
-		}}),
+    `, genesisTemplate(key),
 	)
 	a, _ := Open(c.Chonk())
 
diff --git a/tka/disabled_stub.go b/tka/disabled_stub.go
index d14473e5e..f3cabd491 100644
--- a/tka/disabled_stub.go
+++ b/tka/disabled_stub.go
@@ -8,6 +8,7 @@ package tka
 import (
 	"crypto/ed25519"
 	"errors"
+	"time"
 
 	"tailscale.com/types/key"
 	"tailscale.com/types/logger"
@@ -158,3 +159,8 @@ func SignByCredential(privKey []byte, wrapped *NodeKeySignature, nodeKey key.Nod
 }
 
 func (s NodeKeySignature) String() string { return "" }
+
+type CompactionOptions struct {
+	MinChain int
+	MinAge   time.Duration
+}
diff --git a/tka/key.go b/tka/key.go
index 08897d409..840a65f5c 100644
--- a/tka/key.go
+++ b/tka/key.go
@@ -32,7 +32,7 @@ func (k KeyKind) String() string {
 	}
 }
 
-// Key describes the public components of a key known to network-lock.
+// Key describes the public components of a key known to tailnet-lock.
 type Key struct {
 	Kind KeyKind `cbor:"1,keyasint"`
 
diff --git a/tka/key_test.go b/tka/key_test.go
index cc6a1f580..1edeaf54f 100644
--- a/tka/key_test.go
+++ b/tka/key_test.go
@@ -72,10 +72,8 @@ func TestNLPrivate(t *testing.T) {
 	// Test that key.NLPrivate implements Signer by making a new
 	// authority.
 	k := Key{Kind: Key25519, Public: pub.Verifier(), Votes: 1}
-	_, aum, err := Create(ChonkMem(), State{
-		Keys:              []Key{k},
-		DisablementValues: [][]byte{bytes.Repeat([]byte{1}, 32)},
-	}, p)
+	state := CreateStateForTest(k)
+	_, aum, err := Create(ChonkMem(), state, p)
 	if err != nil {
 		t.Fatalf("Create() failed: %v", err)
 	}
diff --git a/tka/limits.go b/tka/limits.go
index 7f5b8dccd..5fa4de78e 100644
--- a/tka/limits.go
+++ b/tka/limits.go
@@ -3,11 +3,15 @@
 
 package tka
 
+import (
+	"time"
+)
+
 const (
 	// Upper bound on checkpoint elements, chosen arbitrarily. Intended
 	// to cap the size of large AUMs.
-	maxDisablementSecrets = 32
-	maxKeys               = 512
+	maxDisablementValues = 32
+	maxKeys              = 512
 
 	// Max amount of metadata that can be associated with a key, chosen arbitrarily.
 	// Intended to avoid people abusing TKA as a key-value score.
@@ -17,8 +21,15 @@ const (
 	maxSyncIter = 2000
 
 	// Max iterations searching for a head intersection during the sync process.
-	maxSyncHeadIntersectionIter = 400
+	maxSyncHeadIntersectionIter = 1000
 
 	// Limit on scanning AUM trees, chosen arbitrarily.
 	maxScanIterations = 2000
 )
+
+var (
+	CompactionDefaults = CompactionOptions{
+		MinChain: 24,                  // Keep at minimum 24 AUMs since head.
+		MinAge:   14 * 24 * time.Hour, // Keep 2 weeks of AUMs.
+	}
+)
diff --git a/tka/scenario_test.go b/tka/scenario_test.go
index 277bb1acf..61d9e2529 100644
--- a/tka/scenario_test.go
+++ b/tka/scenario_test.go
@@ -147,10 +147,7 @@ func testScenario(t *testing.T, sharedChain string, sharedOptions ...testchainOp
 	pub, priv := testingKey25519(t, 1)
 	key := Key{Kind: Key25519, Public: pub, Votes: 1}
 	sharedOptions = append(sharedOptions,
-		optTemplate("genesis", AUM{MessageKind: AUMCheckpoint, State: &State{
-			Keys:              []Key{key},
-			DisablementValues: [][]byte{DisablementKDF([]byte{1, 2, 3})},
-		}}),
+		genesisTemplate(key),
 		optKey("key", key, priv),
 		optSignAllUsing("key"))
 
diff --git a/tka/sig.go b/tka/sig.go
index 9d107c98f..7361da3c4 100644
--- a/tka/sig.go
+++ b/tka/sig.go
@@ -178,7 +178,7 @@ func (s NodeKeySignature) UnverifiedAuthorizingKeyID() (tkatype.KeyID, error) {
 	return s.authorizingKeyID()
 }
 
-// authorizingKeyID returns the KeyID of the key trusted by network-lock which authorizes
+// authorizingKeyID returns the KeyID of the key trusted by tailnet-lock which authorizes
 // this signature.
 func (s NodeKeySignature) authorizingKeyID() (tkatype.KeyID, error) {
 	switch s.SigKind {
@@ -349,14 +349,14 @@ func (s *NodeKeySignature) rotationDetails() (*RotationDetails, error) {
 
 // ResignNKS re-signs a node-key signature for a new node-key.
 //
-// This only matters on network-locked tailnets, because node-key signatures are
+// This only matters on tailnet-locked tailnets, because node-key signatures are
 // how other nodes know that a node-key is authentic. When the node-key is
 // rotated then the existing signature becomes invalid, so this function is
 // responsible for generating a new wrapping signature to certify the new node-key.
 //
 // The signature itself is a SigRotation signature, which embeds the old signature
 // and certifies the new node-key as a replacement for the old by signing the new
-// signature with RotationPubkey (which is the node's own network-lock key).
+// signature with RotationPubkey (which is the node's own tailnet-lock key).
 func ResignNKS(priv key.NLPrivate, nodeKey key.NodePublic, oldNKS tkatype.MarshaledSignature) (tkatype.MarshaledSignature, error) {
 	var oldSig NodeKeySignature
 	if err := oldSig.Unserialize(oldNKS); err != nil {
diff --git a/tka/sig_test.go b/tka/sig_test.go
index d02ef9cef..bc2279b3d 100644
--- a/tka/sig_test.go
+++ b/tka/sig_test.go
@@ -51,7 +51,7 @@ func TestSigDirect(t *testing.T) {
 }
 
 func TestSigNested(t *testing.T) {
-	// Network-lock key (the key used to sign the nested sig)
+	// tailnet-lock key (the key used to sign the nested sig)
 	pub, priv := testingKey25519(t, 1)
 	k := Key{Kind: Key25519, Public: pub, Votes: 2}
 	// Rotation key (the key used to sign the outer sig)
@@ -64,7 +64,7 @@ func TestSigNested(t *testing.T) {
 	nodeKeyPub, _ := node.Public().MarshalBinary()
 
 	// The original signature for the old node key, signed by
-	// the network-lock key.
+	// the tailnet-lock key.
 	nestedSig := NodeKeySignature{
 		SigKind:        SigDirect,
 		KeyID:          k.MustID(),
@@ -127,7 +127,7 @@ func TestSigNested(t *testing.T) {
 }
 
 func TestSigNested_DeepNesting(t *testing.T) {
-	// Network-lock key (the key used to sign the nested sig)
+	// tailnet-lock key (the key used to sign the nested sig)
 	pub, priv := testingKey25519(t, 1)
 	k := Key{Kind: Key25519, Public: pub, Votes: 2}
 	// Rotation key (the key used to sign the outer sig)
@@ -137,7 +137,7 @@ func TestSigNested_DeepNesting(t *testing.T) {
 	oldPub, _ := oldNode.Public().MarshalBinary()
 
 	// The original signature for the old node key, signed by
-	// the network-lock key.
+	// the tailnet-lock key.
 	nestedSig := NodeKeySignature{
 		SigKind:        SigDirect,
 		KeyID:          k.MustID(),
@@ -152,7 +152,7 @@ func TestSigNested_DeepNesting(t *testing.T) {
 
 	outer := nestedSig
 	var lastNodeKey key.NodePrivate
-	for range 15 { // 15 = max nesting level for CBOR
+	for range cborDecOpts.MaxNestedLevels - 1 {
 		lastNodeKey = key.NewNode()
 		nodeKeyPub, _ := lastNodeKey.Public().MarshalBinary()
 
@@ -173,11 +173,8 @@ func TestSigNested_DeepNesting(t *testing.T) {
 	}
 
 	// Test this works with our public API
-	a, _ := Open(newTestchain(t, "G1\nG1.template = genesis",
-		optTemplate("genesis", AUM{MessageKind: AUMCheckpoint, State: &State{
-			Keys:              []Key{k},
-			DisablementValues: [][]byte{DisablementKDF([]byte{1, 2, 3})},
-		}})).Chonk())
+	c := newTestchain(t, "G1\nG1.template = genesis", genesisTemplate(k))
+	a, _ := Open(c.Chonk())
 	if err := a.NodeKeyAuthorized(lastNodeKey.Public(), outer.Serialize()); err != nil {
 		t.Errorf("NodeKeyAuthorized(lastNodeKey) failed: %v", err)
 	}
@@ -199,7 +196,7 @@ func TestSigNested_DeepNesting(t *testing.T) {
 }
 
 func TestSigCredential(t *testing.T) {
-	// Network-lock key (the key used to sign the nested sig)
+	// tailnet-lock key (the key used to sign the nested sig)
 	pub, priv := testingKey25519(t, 1)
 	k := Key{Kind: Key25519, Public: pub, Votes: 2}
 	// 'credential' key (the one being delegated to)
@@ -238,11 +235,8 @@ func TestSigCredential(t *testing.T) {
 	}
 
 	// Test someone can't misuse our public API for verifying node-keys
-	a, _ := Open(newTestchain(t, "G1\nG1.template = genesis",
-		optTemplate("genesis", AUM{MessageKind: AUMCheckpoint, State: &State{
-			Keys:              []Key{k},
-			DisablementValues: [][]byte{DisablementKDF([]byte{1, 2, 3})},
-		}})).Chonk())
+	c := newTestchain(t, "G1\nG1.template = genesis", genesisTemplate(k))
+	a, _ := Open(c.Chonk())
 	if err := a.NodeKeyAuthorized(node.Public(), nestedSig.Serialize()); err == nil {
 		t.Error("NodeKeyAuthorized(SigCredential, node) did not fail")
 	}
@@ -309,7 +303,7 @@ func TestSigSerializeUnserialize(t *testing.T) {
 }
 
 func TestNodeKeySignatureRotationDetails(t *testing.T) {
-	// Trusted network lock key
+	// Trusted tailnet lock key
 	pub, priv := testingKey25519(t, 1)
 	k := Key{Kind: Key25519, Public: pub, Votes: 2}
 
@@ -519,7 +513,7 @@ func TestResignNKS(t *testing.T) {
 	origPub, _ := origNode.Public().MarshalBinary()
 
 	// The original signature for the old node key, signed by
-	// the network-lock key.
+	// the tailnet-lock key.
 	directSig := NodeKeySignature{
 		SigKind:        SigDirect,
 		KeyID:          authKey.MustID(),
diff --git a/tka/state.go b/tka/state.go
index 69b3dbfeb..6ccd68da4 100644
--- a/tka/state.go
+++ b/tka/state.go
@@ -13,6 +13,7 @@ import (
 
 	"golang.org/x/crypto/argon2"
 	"tailscale.com/types/tkatype"
+	"tailscale.com/util/testenv"
 )
 
 // ErrNoSuchKey is returned if the key referenced by a KeyID does not exist.
@@ -33,7 +34,7 @@ type State struct {
 	// possesses a valid DisablementSecret. These values are used during the
 	// Tailnet Lock deactivation process.
 	//
-	// These are  safe to share publicly or store in the clear. They cannot be
+	// These are safe to share publicly or store in the clear. They cannot be
 	// used to derive the original DisablementSecret.
 	DisablementValues [][]byte `cbor:"2,keyasint"`
 
@@ -261,8 +262,8 @@ func (s *State) staticValidateCheckpoint() error {
 	if len(s.DisablementValues) == 0 {
 		return errors.New("at least one disablement secret required")
 	}
-	if numDS := len(s.DisablementValues); numDS > maxDisablementSecrets {
-		return fmt.Errorf("too many disablement secrets (%d, max %d)", numDS, maxDisablementSecrets)
+	if numDS := len(s.DisablementValues); numDS > maxDisablementValues {
+		return fmt.Errorf("too many disablement values (%d, max %d)", numDS, maxDisablementValues)
 	}
 	for i, ds := range s.DisablementValues {
 		if len(ds) != disablementLength {
@@ -313,3 +314,18 @@ func (s *State) staticValidateCheckpoint() error {
 	}
 	return nil
 }
+
+// CreateStateForTest creates a [State] that marks the given keys as trusted
+// with an arbitrary disablement value.
+//
+// This is only for use in tests, and will panic if called outside a test.
+func CreateStateForTest(keys ...Key) State {
+	testenv.AssertInTest()
+
+	disablementSecret := bytes.Repeat([]byte{0xa5}, 32)
+
+	return State{
+		Keys:              keys,
+		DisablementValues: [][]byte{DisablementKDF(disablementSecret)},
+	}
+}
diff --git a/tka/sync.go b/tka/sync.go
index 5cae9b45f..4bb94ea2b 100644
--- a/tka/sync.go
+++ b/tka/sync.go
@@ -9,6 +9,8 @@ import (
 	"errors"
 	"fmt"
 	"os"
+
+	"tailscale.com/util/testenv"
 )
 
 // ErrNoIntersection is returned when a shared AUM could
@@ -60,18 +62,6 @@ func FromSyncOffer(offer SyncOffer) (head string, ancestors []string, err error)
 	return string(headBytes), ancestors, nil
 }
 
-const (
-	// The starting number of AUMs to skip when listing
-	// ancestors in a SyncOffer.
-	ancestorsSkipStart = 4
-
-	// How many bits to advance the skip count when listing
-	// ancestors in a SyncOffer.
-	//
-	// 2 bits, so (4<<2), so after skipping 4 it skips 16.
-	ancestorsSkipShift = 2
-)
-
 // SyncOffer returns an abbreviated description of the current AUM
 // chain, which can be used to synchronize with another (untrusted)
 // Authority instance.
@@ -92,20 +82,10 @@ func (a *Authority) SyncOffer(storage Chonk) (SyncOffer, error) {
 		Ancestors: make([]AUMHash, 0, 6), // 6 chosen arbitrarily.
 	}
 
-	// We send some subset of our ancestors to help the remote
-	// find a more-recent 'head intersection'.
-	// The number of AUMs between each ancestor entry gets
-	// exponentially larger.
-	var (
-		skipAmount uint64  = ancestorsSkipStart
-		curs       AUMHash = a.Head()
-	)
-	for i := range uint64(maxSyncHeadIntersectionIter) {
-		if i > 0 && (i%skipAmount) == 0 {
-			out.Ancestors = append(out.Ancestors, curs)
-			skipAmount = skipAmount << ancestorsSkipShift
-		}
-
+	// We send all our checkpoints to help the remote find a
+	// more-recent 'head intersection'.
+	curs := a.Head()
+	for range maxSyncHeadIntersectionIter {
 		parent, err := storage.AUM(curs)
 		if err != nil {
 			if err != os.ErrNotExist {
@@ -118,6 +98,11 @@ func (a *Authority) SyncOffer(storage Chonk) (SyncOffer, error) {
 		if parent.Hash() == oldest {
 			break
 		}
+
+		if parent.MessageKind == AUMCheckpoint {
+			out.Ancestors = append(out.Ancestors, curs)
+		}
+
 		copy(curs[:], parent.PrevAUMHash)
 	}
 
@@ -274,3 +259,65 @@ func (a *Authority) MissingAUMs(storage Chonk, remoteOffer SyncOffer) ([]AUM, er
 
 	panic("unreachable")
 }
+
+// SeedNode is an authority-chonk pair that can be seeded by [SeedAUMs].
+type SeedNode struct {
+	authority *Authority
+	storage   Chonk
+}
+
+// CreateSeedNode creates a node for use with [SeedAUMs].
+func CreateSeedNode(t testenv.TB, authority *Authority, storage Chonk) SeedNode {
+	t.Helper()
+	return SeedNode{authority, storage}
+}
+
+type SeedAUMConfig struct {
+	Count  int
+	Signer Signer
+	Nodes  []SeedNode
+}
+
+// SeedAUMs generates many AUMs by repeatedly adding and removing keys
+// from the TKA.
+//
+// The AUMs are written to all the supplied nodes, so if you pass more
+// than one, you can build up a long sync history.
+//
+// This is only for use in testing.
+func SeedAUMs(t testenv.TB, config SeedAUMConfig) {
+	t.Helper()
+
+	if len(config.Nodes) == 0 {
+		panic("called SeedAUMs without any nodes")
+	}
+	primaryNode := config.Nodes[0]
+
+	// The key that we'll repeatedly add/remove in the TKA.
+	key := Key{Kind: Key25519, Public: []byte{1, 1, 1}, Votes: 1}
+
+	for i := 0; i < config.Count/2; i++ {
+		for _, action := range []string{"add", "remove"} {
+			updater := primaryNode.authority.NewUpdater(config.Signer)
+			if action == "add" {
+				if err := updater.AddKey(key); err != nil {
+					t.Fatalf("error from updater.AddKey: %v")
+				}
+			} else {
+				if err := updater.RemoveKey(key.MustID()); err != nil {
+					t.Fatalf("error from updater.RemoveKey: %v")
+				}
+			}
+			aum, err := updater.Finalize(primaryNode.storage)
+			if err != nil {
+				t.Fatalf("error from authority.Finalize: %v", err)
+			}
+
+			for _, n := range config.Nodes {
+				if err := n.authority.Inform(n.storage, aum); err != nil {
+					t.Fatalf("error from authority.Inform: %v", err)
+				}
+			}
+		}
+	}
+}
diff --git a/tka/sync_test.go b/tka/sync_test.go
index 68f659ae5..55d0ad055 100644
--- a/tka/sync_test.go
+++ b/tka/sync_test.go
@@ -5,42 +5,140 @@ package tka
 
 import (
 	"bytes"
-	"strconv"
+	"fmt"
+	"strings"
 	"testing"
+	"time"
 
 	"github.com/google/go-cmp/cmp"
+	"tailscale.com/tstest"
+	"tailscale.com/util/must"
 )
 
-func TestSyncOffer(t *testing.T) {
-	c := newTestchain(t, `
-        A1 -> A2 -> A3 -> A4 -> A5 -> A6 -> A7 -> A8 -> A9 -> A10
-        A10 -> A11 -> A12 -> A13 -> A14 -> A15 -> A16 -> A17 -> A18
-        A18 -> A19 -> A20 -> A21 -> A22 -> A23 -> A24 -> A25
-    `)
-	storage := c.Chonk()
+// getSyncOffer returns a SyncOffer for the given Chonk.
+func getSyncOffer(t *testing.T, storage Chonk) SyncOffer {
+	t.Helper()
+
 	a, err := Open(storage)
 	if err != nil {
 		t.Fatal(err)
 	}
-	got, err := a.SyncOffer(storage)
+	offer, err := a.SyncOffer(storage)
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	// A SyncOffer includes a selection of AUMs going backwards in the tree,
-	// progressively skipping more and more each iteration.
-	want := SyncOffer{
-		Head: c.AUMHashes["A25"],
-		Ancestors: []AUMHash{
-			c.AUMHashes["A"+strconv.Itoa(25-ancestorsSkipStart)],
-			c.AUMHashes["A"+strconv.Itoa(25-ancestorsSkipStart<<ancestorsSkipShift)],
-			c.AUMHashes["A1"],
-		},
+	return offer
+}
+
+func TestSyncOffer(t *testing.T) {
+	fakeState := &State{
+		Keys:              []Key{{Kind: Key25519, Votes: 1}},
+		DisablementValues: [][]byte{bytes.Repeat([]byte{1}, 32)},
 	}
 
-	if diff := cmp.Diff(want, got); diff != "" {
-		t.Errorf("SyncOffer diff (-want, +got):\n%s", diff)
-	}
+	checkpointTemplate := optTemplate("checkpoint", AUM{MessageKind: AUMCheckpoint, State: fakeState})
+
+	// If we have a small chain with just a handful of AUMs, the SyncOffer
+	// contains the current HEAD and the first checkpoint.
+	t.Run("short-chain", func(t *testing.T) {
+		c := newTestchain(t, `A1 -> A2 -> A3 -> A4 -> A5`)
+		got := getSyncOffer(t, c.Chonk())
+
+		// A SyncOffer includes the first checkpoint.
+		want := SyncOffer{
+			Head: c.AUMHashes["A5"],
+			Ancestors: []AUMHash{
+				c.AUMHashes["A1"],
+			},
+		}
+
+		if diff := cmp.Diff(want, got); diff != "" {
+			t.Errorf("SyncOffer diff (-want, +got):\n%s", diff)
+		}
+	})
+
+	// If the chain contains multiple checkpoints, the SyncOffer includes
+	// all of them.
+	t.Run("chain-with-multiple-checkpoints", func(t *testing.T) {
+		c := newTestchain(t, `
+            A1 -> A2 -> A3 -> A4 -> A5 -> A6 -> A7 -> A8 -> A9 -> A10
+            A10 -> A11 -> A12 -> A13 -> A14 -> A15 -> A16 -> A17 -> A18
+            A18 -> A19 -> A20 -> A21 -> A22 -> A23 -> A24 -> A25 -> A26
+            A26 -> A27 -> A28 -> A29 -> A30 -> A31 -> A32 -> A33 -> A34
+            A34 -> A35 -> A36 -> A37 -> A38 -> A39 -> A40 -> A41 -> A42
+            A42 -> A43 -> A45 -> A46 -> A47 -> A48 -> A49 -> A50 -> A51
+            A51 -> A52 -> A53 -> A54 -> A55
+
+            A1.template = checkpoint
+            A11.template = checkpoint
+            A21.template = checkpoint
+            A31.template = checkpoint
+            A41.template = checkpoint
+            A51.template = checkpoint
+        `, checkpointTemplate)
+		got := getSyncOffer(t, c.Chonk())
+
+		// A SyncOffer includes the first checkpoint.
+		want := SyncOffer{
+			Head: c.AUMHashes["A55"],
+			Ancestors: []AUMHash{
+				c.AUMHashes["A51"],
+				c.AUMHashes["A41"],
+				c.AUMHashes["A31"],
+				c.AUMHashes["A21"],
+				c.AUMHashes["A11"],
+				c.AUMHashes["A1"],
+			},
+		}
+
+		if diff := cmp.Diff(want, got); diff != "" {
+			t.Errorf("SyncOffer diff (-want, +got):\n%s", diff)
+		}
+	})
+
+	// The size of a SyncOffer does not grow without bound as the number of AUMs increases.
+	t.Run("long-chain-size-is-bounded", func(t *testing.T) {
+		size := 1800
+
+		// Build a template string with a checkpoint every 50 AUMs.
+		var sb strings.Builder
+		sb.WriteString("A")
+		for i := range size {
+			sb.WriteString(fmt.Sprintf(" -> A%d", i))
+		}
+		for i := range size {
+			if i%50 == 0 {
+				sb.WriteString(fmt.Sprintf("\nA%d.template = checkpoint", i))
+			}
+		}
+
+		c := newTestchain(t, sb.String(), checkpointTemplate)
+		got := getSyncOffer(t, c.Chonk())
+
+		// We expect the SyncOffer to include:
+		//
+		//	- the latest AUM as the HEAD
+		//	- the checkpoints from the last 1000 AUMs (maxSyncHeadIntersectionIter)
+		//	- the oldest AUM in storage
+		//
+		want := SyncOffer{
+			Head: c.AUMHashes["A1799"],
+			Ancestors: []AUMHash{
+				c.AUMHashes["A1750"], c.AUMHashes["A1700"], c.AUMHashes["A1650"],
+				c.AUMHashes["A1600"], c.AUMHashes["A1550"], c.AUMHashes["A1500"],
+				c.AUMHashes["A1450"], c.AUMHashes["A1400"], c.AUMHashes["A1350"],
+				c.AUMHashes["A1300"], c.AUMHashes["A1250"], c.AUMHashes["A1200"],
+				c.AUMHashes["A1150"], c.AUMHashes["A1100"], c.AUMHashes["A1050"],
+				c.AUMHashes["A1000"], c.AUMHashes["A950"], c.AUMHashes["A900"],
+				c.AUMHashes["A850"], c.AUMHashes["A800"], c.AUMHashes["A"],
+			},
+		}
+
+		if diff := cmp.Diff(want, got); diff != "" {
+			t.Errorf("SyncOffer diff (-want, +got):\n%s", diff)
+		}
+	})
 }
 
 func TestComputeSyncIntersection_FastForward(t *testing.T) {
@@ -52,24 +150,10 @@ func TestComputeSyncIntersection_FastForward(t *testing.T) {
 	a1H, a2H := c.AUMHashes["A1"], c.AUMHashes["A2"]
 
 	chonk1 := c.ChonkWith("A1", "A2")
-	n1, err := Open(chonk1)
-	if err != nil {
-		t.Fatal(err)
-	}
-	offer1, err := n1.SyncOffer(chonk1)
-	if err != nil {
-		t.Fatal(err)
-	}
+	offer1 := getSyncOffer(t, chonk1)
 
 	chonk2 := c.Chonk() // All AUMs
-	n2, err := Open(chonk2)
-	if err != nil {
-		t.Fatal(err)
-	}
-	offer2, err := n2.SyncOffer(chonk2)
-	if err != nil {
-		t.Fatal(err)
-	}
+	offer2 := getSyncOffer(t, chonk2)
 
 	// Node 1 only knows about the first two nodes, so the head of n2 is
 	// alien to it.
@@ -123,48 +207,16 @@ func TestComputeSyncIntersection_ForkSmallDiff(t *testing.T) {
 	}
 
 	chonk1 := c.ChonkWith("A1", "A2", "A3", "A4", "A5", "A6", "A7", "A8", "F1")
-	n1, err := Open(chonk1)
-	if err != nil {
-		t.Fatal(err)
-	}
-	offer1, err := n1.SyncOffer(chonk1)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if diff := cmp.Diff(SyncOffer{
-		Head: c.AUMHashes["F1"],
-		Ancestors: []AUMHash{
-			c.AUMHashes["A"+strconv.Itoa(9-ancestorsSkipStart)],
-			c.AUMHashes["A1"],
-		},
-	}, offer1); diff != "" {
-		t.Errorf("offer1 diff (-want, +got):\n%s", diff)
-	}
+	offer1 := getSyncOffer(t, chonk1)
 
 	chonk2 := c.ChonkWith("A1", "A2", "A3", "A4", "A5", "A6", "A7", "A8", "A9", "A10")
-	n2, err := Open(chonk2)
-	if err != nil {
-		t.Fatal(err)
-	}
-	offer2, err := n2.SyncOffer(chonk2)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if diff := cmp.Diff(SyncOffer{
-		Head: c.AUMHashes["A10"],
-		Ancestors: []AUMHash{
-			c.AUMHashes["A"+strconv.Itoa(10-ancestorsSkipStart)],
-			c.AUMHashes["A1"],
-		},
-	}, offer2); diff != "" {
-		t.Errorf("offer2 diff (-want, +got):\n%s", diff)
-	}
+	offer2 := getSyncOffer(t, chonk2)
 
 	// Node 1 only knows about the first eight nodes, so the head of n2 is
 	// alien to it.
 	t.Run("n1", func(t *testing.T) {
-		// n2 has 10 nodes, so the first common ancestor should be 10-ancestorsSkipStart
-		wantIntersection := c.AUMHashes["A"+strconv.Itoa(10-ancestorsSkipStart)]
+		// n2 has 10 nodes, so the first common ancestor is the genesis AUM
+		wantIntersection := c.AUMHashes["A1"]
 
 		got, err := computeSyncIntersection(chonk1, offer1, offer2)
 		if err != nil {
@@ -180,8 +232,8 @@ func TestComputeSyncIntersection_ForkSmallDiff(t *testing.T) {
 
 	// Node 2 knows about the full chain but doesn't recognize the head.
 	t.Run("n2", func(t *testing.T) {
-		// n1 has 9 nodes, so the first common ancestor should be 9-ancestorsSkipStart
-		wantIntersection := c.AUMHashes["A"+strconv.Itoa(9-ancestorsSkipStart)]
+		// n1 has 9 nodes, so the first common ancestor is the genesis AUM
+		wantIntersection := c.AUMHashes["A1"]
 
 		got, err := computeSyncIntersection(chonk2, offer2, offer1)
 		if err != nil {
@@ -339,10 +391,7 @@ func TestSyncSimpleE2E(t *testing.T) {
         G1 -> L1 -> L2 -> L3
         G1.template = genesis
     `,
-		optTemplate("genesis", AUM{MessageKind: AUMCheckpoint, State: &State{
-			Keys:              []Key{key},
-			DisablementValues: [][]byte{DisablementKDF([]byte{1, 2, 3})},
-		}}),
+		genesisTemplate(key),
 		optKey("key", key, priv),
 		optSignAllUsing("key"))
 
@@ -375,3 +424,199 @@ func TestSyncSimpleE2E(t *testing.T) {
 		t.Errorf("node & control are not synced: c=%x, n=%x", cHash, nHash)
 	}
 }
+
+// TestSyncFromFarBehind checks that nodes with compacted state can still find
+// a common ancestor when the remote is significantly ahead.
+//
+// We simulate a node that has compacted its early history and is now ~500 AUMs
+// behind the control plane, a distance that previously caused exponential sampling
+// in SyncOffer to skip the node's entire local history.
+//
+// Regression test for http://go/corp/40404
+func TestSyncFromFarBehind(t *testing.T) {
+	pub1, priv1 := testingKey25519(t, 1)
+	signer1 := signer25519(priv1)
+
+	key1 := Key{Kind: Key25519, Public: pub1, Votes: 2}
+
+	// Setup: persistentAuthority (control plane) vs compactingAuthority (client node).
+	state := State{
+		Keys:              []Key{key1},
+		DisablementValues: [][]byte{DisablementKDF([]byte{1, 2, 3})},
+	}
+
+	persistentStorage, compactingStorage := ChonkMem(), ChonkMem()
+	persistentSize := func() int { return len(must.Get(persistentStorage.AllAUMs())) }
+	compactingSize := func() int { return len(must.Get(compactingStorage.AllAUMs())) }
+
+	// Backdate the clock on the compactingStorage so all AUMs will be old enough
+	// to be considered for compacting.
+	clock := tstest.NewClock(tstest.ClockOpts{
+		Start: time.Now().Add(-(CompactionDefaults.MinAge + 24*time.Hour)),
+	})
+	compactingStorage.SetClock(clock)
+
+	persistentAuthority, genesisAUM := must.Get2(Create(persistentStorage, state, signer1))
+	compactingAuthority := must.Get(Bootstrap(compactingStorage, genesisAUM))
+
+	// 1. Generate enough history to trigger checkpoints.
+	persistentNode := CreateSeedNode(t, persistentAuthority, persistentStorage)
+	compactingNode := CreateSeedNode(t, compactingAuthority, compactingStorage)
+	SeedAUMs(t, SeedAUMConfig{
+		Count:  checkpointEvery * 2,
+		Signer: signer1,
+		Nodes:  []SeedNode{persistentNode, compactingNode},
+	})
+
+	t.Logf("genesis and first batch of AUMs: persistent = %d, compacting = %d", persistentSize(), compactingSize())
+
+	// 2. Compact the node state.
+	//
+	// It now has a different 'oldestAncestor' than the control plane.
+	beforeCompacting := compactingSize()
+	must.Do(compactingAuthority.Compact(compactingStorage, CompactionDefaults))
+	afterCompacting := compactingSize()
+
+	if beforeCompacting == afterCompacting {
+		t.Errorf("expected Compact to reduce the number of AUMs, but unchanged: size = %d", afterCompacting)
+	}
+
+	// 3. Advance the control plane far beyond the node.
+	//
+	// As of 2026-04-17, the largest TKA has ~750 AUMs.
+	//
+	// If you keep increasing this number, eventually the sync will fail because you
+	// hit the hard-coded limits on iteration during the sync process.
+	SeedAUMs(t, SeedAUMConfig{
+		Count:  compactingSize() - persistentSize() + 800,
+		Signer: signer1, Nodes: []SeedNode{persistentNode},
+	})
+
+	t.Logf("post-compacting and extra AUMs:  persistent = %d, compacting = %d", persistentSize(), compactingSize())
+
+	// 4. Verify Intersection.
+	// The node should find an intersection even with a 500-AUM gap.
+	persistentOffer := must.Get(persistentAuthority.SyncOffer(persistentStorage))
+	compactingOffer := must.Get(compactingAuthority.SyncOffer(compactingStorage))
+
+	if _, err := compactingAuthority.MissingAUMs(compactingStorage, persistentOffer); err != nil {
+		t.Errorf("node failed to find intersection with far-ahead control plane: %v", err)
+	}
+
+	// 5. Check that the persistent authority can find an intersection with the
+	// compacting authority, and has missing AUMs to send it.
+	missing, err := persistentAuthority.MissingAUMs(persistentStorage, compactingOffer)
+	if len(missing) == 0 {
+		t.Errorf("control plane did not find any missing AUMs for node")
+	}
+	if err != nil {
+		t.Errorf("control plane failed to find missing AUMs for node: %v", err)
+	}
+}
+
+// TestSyncFromFarBehindFork checks that nodes with compacted state that have
+// also branched from the active chain can still find a common ancestor when
+// the remote is significantly ahead of the inersection point.
+//
+// We simulate a node that has compacted its early history and is now ~500 AUMs
+// behind the control plane, plus a few AUMs extra, a distance that previously
+// caused exponential sampling in SyncOffer to skip the node's entire local history.
+//
+// Regression test for http://go/corp/40404
+func TestSyncFromFarBehindFork(t *testing.T) {
+	// Set up two signing keys. They have a different number of votes, so if there's
+	// a fork, the chain with the winning key will take precedence.
+	majorityPub, majorityPriv := testingKey25519(t, 1)
+	losingPub, losingPriv := testingKey25519(t, 2)
+	winningSigner := signer25519(majorityPriv)
+	losingSigner := signer25519(losingPriv)
+
+	losingKey := Key{Kind: Key25519, Public: majorityPub, Votes: 1}
+	winningKey := Key{Kind: Key25519, Public: losingPub, Votes: 2}
+
+	// Setup: persistentAuthority (control plane) vs compactingAuthority (client node).
+	state := State{
+		Keys:              []Key{losingKey, winningKey},
+		DisablementValues: [][]byte{DisablementKDF([]byte{1, 2, 3})},
+	}
+
+	persistentStorage, compactingStorage := ChonkMem(), ChonkMem()
+	persistentSize := func() int { return len(must.Get(persistentStorage.AllAUMs())) }
+	compactingSize := func() int { return len(must.Get(compactingStorage.AllAUMs())) }
+
+	// Backdate the clock on the compactingStorage so all AUMs will be old enough
+	// to be considered for compacting.
+	clock := tstest.NewClock(tstest.ClockOpts{
+		Start: time.Now().Add(-(CompactionDefaults.MinAge + 24*time.Hour)),
+	})
+	compactingStorage.SetClock(clock)
+
+	persistentAuthority, genesisAUM := must.Get2(Create(persistentStorage, state, winningSigner))
+	compactingAuthority := must.Get(Bootstrap(compactingStorage, genesisAUM))
+
+	// 1. Generate enough history to trigger checkpoints.
+	persistentNode := CreateSeedNode(t, persistentAuthority, persistentStorage)
+	compactingNode := CreateSeedNode(t, compactingAuthority, compactingStorage)
+	SeedAUMs(t, SeedAUMConfig{
+		Count:  checkpointEvery * 2,
+		Signer: winningSigner,
+		Nodes:  []SeedNode{persistentNode, compactingNode},
+	})
+
+	t.Logf("genesis and first batch of AUMs: persistent = %d, compacting = %d", persistentSize(), compactingSize())
+
+	// 2. Compact the node state.
+	//
+	// It now has a different 'oldestAncestor' than the control plane.
+	beforeCompacting := compactingSize()
+	must.Do(compactingAuthority.Compact(compactingStorage, CompactionDefaults))
+	afterCompacting := compactingSize()
+
+	if beforeCompacting == afterCompacting {
+		t.Errorf("expected Compact to reduce the number of AUMs, but unchanged: size = %d", afterCompacting)
+	}
+
+	// 2. Advance the node state slightly beyond the control plane, using the
+	// losing signer.
+	SeedAUMs(t, SeedAUMConfig{
+		Count:  1,
+		Signer: losingSigner,
+		Nodes:  []SeedNode{compactingNode},
+	})
+
+	// 3. Advance the control plane far beyond the node, using the winning signer.
+	//
+	// Now the node is forked from the control plane state, and the control plane's
+	// chain will win because its chain was signed by a key with more votes.
+	//
+	// As of 2026-04-17, the largest TKA has ~750 AUMs.
+	//
+	// If you keep increasing this number, eventually the sync will fail because you
+	// hit the hard-coded limits on iteration during the sync process.
+	SeedAUMs(t, SeedAUMConfig{
+		Count:  compactingSize() - persistentSize() + 800,
+		Signer: winningSigner,
+		Nodes:  []SeedNode{persistentNode},
+	})
+
+	t.Logf("post-compacting and extra AUMs:  persistent = %d, compacting = %d", persistentSize(), compactingSize())
+
+	// 4. Verify Intersection.
+	// The node should find an intersection even with a 500-AUM gap.
+	persistentOffer := must.Get(persistentAuthority.SyncOffer(persistentStorage))
+	compactingOffer := must.Get(compactingAuthority.SyncOffer(compactingStorage))
+
+	if _, err := compactingAuthority.MissingAUMs(compactingStorage, persistentOffer); err != nil {
+		t.Errorf("node failed to find intersection with far-ahead control plane: %v", err)
+	}
+
+	// 5. Check that the persistent authority can find an intersection with the
+	// compacting authority, and has missing AUMs to send it.
+	missing, err := persistentAuthority.MissingAUMs(persistentStorage, compactingOffer)
+	if len(missing) == 0 {
+		t.Errorf("control plane did not find any missing AUMs for node")
+	}
+	if err != nil {
+		t.Errorf("control plane failed to find missing AUMs for node: %v", err)
+	}
+}
diff --git a/tka/tailchonk.go b/tka/tailchonk.go
index da1915acb..3b083f327 100644
--- a/tka/tailchonk.go
+++ b/tka/tailchonk.go
@@ -597,9 +597,6 @@ func (c *FS) CommitVerifiedAUMs(updates []AUM) error {
 	for i, aum := range updates {
 		h := aum.Hash()
 		err := c.commit(h, func(info *fsHashInfo) {
-			if info.PurgedUnix > 0 {
-				log.Printf("tka: CommitVerifiedAUMs: committing previously-deleted AUM %s", h.String())
-			}
 			info.PurgedUnix = 0 // just in-case it was set for some reason
 			info.AUM = &aum
 		})
@@ -976,8 +973,5 @@ func Compact(storage CompactableChonk, head AUMHash, opts CompactionOptions) (la
 	if err := storage.SetLastActiveAncestor(lastActiveAncestor); err != nil {
 		return AUMHash{}, err
 	}
-	if len(toDelete) > 0 {
-		log.Printf("tka compaction: purging %d AUM(s) [%q]", len(toDelete), toDelete)
-	}
 	return lastActiveAncestor, storage.PurgeAUMs(toDelete)
 }
diff --git a/tka/tailchonk_test.go b/tka/tailchonk_test.go
index afc4f4de0..125fbecc0 100644
--- a/tka/tailchonk_test.go
+++ b/tka/tailchonk_test.go
@@ -315,11 +315,6 @@ func TestMarkDescendantAUMs(t *testing.T) {
 }
 
 func TestMarkAncestorIntersectionAUMs(t *testing.T) {
-	fakeState := &State{
-		Keys:              []Key{{Kind: Key25519, Votes: 1}},
-		DisablementValues: [][]byte{bytes.Repeat([]byte{1}, 32)},
-	}
-
 	tcs := []struct {
 		name            string
 		chain           *testChain
@@ -333,7 +328,7 @@ func TestMarkAncestorIntersectionAUMs(t *testing.T) {
 			name: "genesis",
 			chain: newTestchain(t, `
                 A
-                A.template = checkpoint`, optTemplate("checkpoint", AUM{MessageKind: AUMCheckpoint, State: fakeState})),
+                A.template = checkpoint`, checkpointTemplate()),
 			initialAncestor: "A",
 			wantAncestor:    "A",
 			verdicts: map[string]retainState{
@@ -346,7 +341,7 @@ func TestMarkAncestorIntersectionAUMs(t *testing.T) {
 			chain: newTestchain(t, `
                 DEAD -> A -> B -> C
                 A.template = checkpoint
-                B.template = checkpoint`, optTemplate("checkpoint", AUM{MessageKind: AUMCheckpoint, State: fakeState})),
+                B.template = checkpoint`, checkpointTemplate()),
 			initialAncestor: "A",
 			wantAncestor:    "A",
 			verdicts: map[string]retainState{
@@ -366,7 +361,7 @@ func TestMarkAncestorIntersectionAUMs(t *testing.T) {
                 A.template = checkpoint
                 C.template = checkpoint
                 D.template = checkpoint
-                FORK.hashSeed = 2`, optTemplate("checkpoint", AUM{MessageKind: AUMCheckpoint, State: fakeState})),
+                FORK.hashSeed = 2`, checkpointTemplate()),
 			initialAncestor: "D",
 			wantAncestor:    "C",
 			verdicts: map[string]retainState{
@@ -387,7 +382,7 @@ func TestMarkAncestorIntersectionAUMs(t *testing.T) {
                 A.template = checkpoint
                 B.template = checkpoint
                 E.template = checkpoint
-                FORK.hashSeed = 2`, optTemplate("checkpoint", AUM{MessageKind: AUMCheckpoint, State: fakeState})),
+                FORK.hashSeed = 2`, checkpointTemplate()),
 			initialAncestor: "E",
 			wantAncestor:    "B",
 			verdicts: map[string]retainState{
@@ -413,7 +408,7 @@ func TestMarkAncestorIntersectionAUMs(t *testing.T) {
                 D.template = checkpoint
                 E.template = checkpoint
                 FORK.hashSeed = 2
-                DEADFORK.hashSeed = 3`, optTemplate("checkpoint", AUM{MessageKind: AUMCheckpoint, State: fakeState})),
+                DEADFORK.hashSeed = 3`, checkpointTemplate()),
 			initialAncestor: "D",
 			wantAncestor:    "C",
 			verdicts: map[string]retainState{
@@ -443,7 +438,7 @@ func TestMarkAncestorIntersectionAUMs(t *testing.T) {
                 F.template = checkpoint
                 F1.hashSeed = 2
                 F2.hashSeed = 3
-                F3.hashSeed = 4`, optTemplate("checkpoint", AUM{MessageKind: AUMCheckpoint, State: fakeState})),
+                F3.hashSeed = 4`, checkpointTemplate()),
 			initialAncestor: "F",
 			wantAncestor:    "B",
 			verdicts: map[string]retainState{
@@ -541,11 +536,6 @@ func cloneMem(src, dst *Mem) {
 }
 
 func TestCompact(t *testing.T) {
-	fakeState := &State{
-		Keys:              []Key{{Kind: Key25519, Votes: 1}},
-		DisablementValues: [][]byte{bytes.Repeat([]byte{1}, 32)},
-	}
-
 	// A & B are deleted because the new lastActiveAncestor advances beyond them.
 	// OLD is deleted because it does not match retention criteria, and
 	// though it is a descendant of the new lastActiveAncestor (C), it is not a
@@ -578,7 +568,7 @@ func TestCompact(t *testing.T) {
         F1.hashSeed = 1
         OLD.hashSeed = 2
         G2.hashSeed = 3
-    `, optTemplate("checkpoint", AUM{MessageKind: AUMCheckpoint, State: fakeState}))
+    `, checkpointTemplate())
 
 	storage := &compactingChonkFake{
 		aumAge:     map[AUMHash]time.Time{(c.AUMHashes["F1"]): time.Now()},
@@ -607,12 +597,10 @@ func TestCompactLongButYoung(t *testing.T) {
 	ourPriv := key.NewNLPrivate()
 	ourKey := Key{Kind: Key25519, Public: ourPriv.Public().Verifier(), Votes: 1}
 	someOtherKey := Key{Kind: Key25519, Public: key.NewNLPrivate().Public().Verifier(), Votes: 1}
+	state := CreateStateForTest(ourKey, someOtherKey)
 
 	storage := ChonkMem()
-	auth, _, err := Create(storage, State{
-		Keys:              []Key{ourKey, someOtherKey},
-		DisablementValues: [][]byte{DisablementKDF(bytes.Repeat([]byte{0xa5}, 32))},
-	}, ourPriv)
+	auth, _, err := Create(storage, state, ourPriv)
 	if err != nil {
 		t.Fatalf("tka.Create() failed: %v", err)
 	}
diff --git a/tka/tka.go b/tka/tka.go
index 57a8bd122..cb1c08326 100644
--- a/tka/tka.go
+++ b/tka/tka.go
@@ -10,7 +10,6 @@ import (
 	"bytes"
 	"errors"
 	"fmt"
-	"log"
 	"os"
 	"sort"
 
@@ -557,8 +556,6 @@ func Bootstrap(storage Chonk, bootstrap AUM) (*Authority, error) {
 	// Everything looks good, write it to storage.
 	if err := storage.CommitVerifiedAUMs([]AUM{bootstrap}); err != nil {
 		return nil, fmt.Errorf("commit: %v", err)
-	} else {
-		log.Printf("tka.Bootstrap: successfully committed bootstrap AUM (%s)", bootstrap.Hash())
 	}
 	if err := storage.SetLastActiveAncestor(bootstrap.Hash()); err != nil {
 		return nil, fmt.Errorf("set ancestor: %v", err)
@@ -570,7 +567,7 @@ func Bootstrap(storage Chonk, bootstrap AUM) (*Authority, error) {
 // ValidDisablement returns true if the disablement secret was correct.
 //
 // If this method returns true, the caller should shut down the authority
-// and purge all network-lock state.
+// and purge all tailnet-lock state.
 func (a *Authority) ValidDisablement(secret []byte) bool {
 	return a.state.checkDisablement(secret)
 }
@@ -590,7 +587,6 @@ func (a *Authority) InformIdempotent(storage Chonk, updates []AUM) (Authority, e
 	}
 	stateAt := make(map[AUMHash]State, len(updates)+1)
 	toCommit := make([]AUM, 0, len(updates))
-	toCommitHashes := make([]AUMHash, 0, len(updates))
 	prevHash := a.Head()
 
 	// The state at HEAD is the current state of the authority. It's likely
@@ -640,13 +636,10 @@ func (a *Authority) InformIdempotent(storage Chonk, updates []AUM) (Authority, e
 		}
 		prevHash = hash
 		toCommit = append(toCommit, update)
-		toCommitHashes = append(toCommitHashes, update.Hash())
 	}
 
 	if err := storage.CommitVerifiedAUMs(toCommit); err != nil {
 		return Authority{}, fmt.Errorf("commit: %v", err)
-	} else {
-		log.Printf("tka.CommitVerifiedAUMs: successfully committed %d AUMs: %v", len(toCommit), toCommitHashes)
 	}
 
 	if isHeadChain {
diff --git a/tka/tka_test.go b/tka/tka_test.go
index cb18be68d..f0ec3ff68 100644
--- a/tka/tka_test.go
+++ b/tka/tka_test.go
@@ -197,6 +197,7 @@ func TestComputeStateAt(t *testing.T) {
 // for tests you want one AUM to be 'lower' than another, so that
 // that chain is taken based on fork resolution rules).
 func fakeAUM(t *testing.T, template any, parent *AUMHash) (AUM, AUMHash) {
+	t.Helper()
 	if seed, ok := template.(int); ok {
 		a := AUM{MessageKind: AUMNoOp, KeyID: []byte{byte(seed)}}
 		if parent != nil {
@@ -299,15 +300,17 @@ func TestAuthorityHead(t *testing.T) {
 func TestAuthorityValidDisablement(t *testing.T) {
 	pub, _ := testingKey25519(t, 1)
 	key := Key{Kind: Key25519, Public: pub, Votes: 2}
+	disablementSecret := []byte{1, 2, 3}
+	state := State{
+		Keys:              []Key{key},
+		DisablementValues: [][]byte{DisablementKDF(disablementSecret)},
+	}
 	c := newTestchain(t, `
         G1 -> L1
 
         G1.template = genesis
     `,
-		optTemplate("genesis", AUM{MessageKind: AUMCheckpoint, State: &State{
-			Keys:              []Key{key},
-			DisablementValues: [][]byte{DisablementKDF([]byte{1, 2, 3})},
-		}}),
+		optTemplate("genesis", AUM{MessageKind: AUMCheckpoint, State: &state}),
 	)
 
 	a, _ := Open(c.Chonk())
@@ -320,10 +323,7 @@ func TestCreateBootstrapAuthority(t *testing.T) {
 	pub, priv := testingKey25519(t, 1)
 	key := Key{Kind: Key25519, Public: pub, Votes: 2}
 
-	a1, genesisAUM, err := Create(ChonkMem(), State{
-		Keys:              []Key{key},
-		DisablementValues: [][]byte{DisablementKDF([]byte{1, 2, 3})},
-	}, signer25519(priv))
+	a1, genesisAUM, err := Create(ChonkMem(), CreateStateForTest(key), signer25519(priv))
 	if err != nil {
 		t.Fatalf("Create() failed: %v", err)
 	}
@@ -352,10 +352,7 @@ func TestBootstrapChonkMustBeEmpty(t *testing.T) {
 
 	pub, priv := testingKey25519(t, 1)
 	key := Key{Kind: Key25519, Public: pub, Votes: 2}
-	state := State{
-		Keys:              []Key{key},
-		DisablementValues: [][]byte{DisablementKDF([]byte{1, 2, 3})},
-	}
+	state := CreateStateForTest(key)
 
 	// Bootstrap our chonk for the first time, which should succeed.
 	_, _, err := Create(chonk, state, signer25519(priv))
@@ -415,14 +412,11 @@ func TestAuthorityInformNonLinear(t *testing.T) {
                | -> L4 -> L5
 
         G1.template = genesis
-        L1.hashSeed = 3
+        L1.hashSeed = 2
         L2.hashSeed = 2
         L4.hashSeed = 2
     `,
-		optTemplate("genesis", AUM{MessageKind: AUMCheckpoint, State: &State{
-			Keys:              []Key{key},
-			DisablementValues: [][]byte{DisablementKDF([]byte{1, 2, 3})},
-		}}),
+		genesisTemplate(key),
 		optKey("key", key, priv),
 		optSignAllUsing("key"))
 
@@ -451,6 +445,8 @@ func TestAuthorityInformNonLinear(t *testing.T) {
 	}
 
 	if a.Head() != c.AUMHashes["L3"] {
+		t.Logf("a.Head() = %s", a.Head())
+		t.Logf("auMHashes = %v", c.AUMHashes)
 		t.Fatal("authority did not converge to correct AUM")
 	}
 }
@@ -464,10 +460,7 @@ func TestAuthorityInformLinear(t *testing.T) {
 
         G1.template = genesis
     `,
-		optTemplate("genesis", AUM{MessageKind: AUMCheckpoint, State: &State{
-			Keys:              []Key{key},
-			DisablementValues: [][]byte{DisablementKDF([]byte{1, 2, 3})},
-		}}),
+		genesisTemplate(key),
 		optKey("key", key, priv),
 		optSignAllUsing("key"))
 
@@ -504,21 +497,12 @@ func TestInteropWithNLKey(t *testing.T) {
 	pub2 := key.NewNLPrivate().Public()
 	pub3 := key.NewNLPrivate().Public()
 
-	a, _, err := Create(ChonkMem(), State{
-		Keys: []Key{
-			{
-				Kind:   Key25519,
-				Votes:  1,
-				Public: pub1.KeyID(),
-			},
-			{
-				Kind:   Key25519,
-				Votes:  1,
-				Public: pub2.KeyID(),
-			},
-		},
-		DisablementValues: [][]byte{DisablementKDF([]byte{1, 2, 3})},
-	}, priv1)
+	state := CreateStateForTest(
+		Key{Kind: Key25519, Votes: 1, Public: pub1.KeyID()},
+		Key{Kind: Key25519, Votes: 1, Public: pub2.KeyID()},
+	)
+
+	a, _, err := Create(ChonkMem(), state, priv1)
 	if err != nil {
 		t.Errorf("tka.Create: %v", err)
 		return
@@ -538,6 +522,7 @@ func TestInteropWithNLKey(t *testing.T) {
 func TestAuthorityCompact(t *testing.T) {
 	pub, priv := testingKey25519(t, 1)
 	key := Key{Kind: Key25519, Public: pub, Votes: 2}
+	state := CreateStateForTest(key)
 
 	c := newTestchain(t, `
         G -> A -> B -> C -> D -> E
@@ -545,14 +530,8 @@ func TestAuthorityCompact(t *testing.T) {
         G.template = genesis
         C.template = checkpoint2
     `,
-		optTemplate("genesis", AUM{MessageKind: AUMCheckpoint, State: &State{
-			Keys:              []Key{key},
-			DisablementValues: [][]byte{DisablementKDF([]byte{1, 2, 3})},
-		}}),
-		optTemplate("checkpoint2", AUM{MessageKind: AUMCheckpoint, State: &State{
-			Keys:              []Key{key},
-			DisablementValues: [][]byte{DisablementKDF([]byte{1, 2, 3})},
-		}}),
+		genesisTemplate(key),
+		optTemplate("checkpoint2", AUM{MessageKind: AUMCheckpoint, State: &state}),
 		optKey("key", key, priv),
 		optSignAllUsing("key"))
 
@@ -602,10 +581,7 @@ func TestFindParentForRewrite(t *testing.T) {
         C.template = add3
         D.template = remove2
     `,
-		optTemplate("genesis", AUM{MessageKind: AUMCheckpoint, State: &State{
-			Keys:              []Key{k1},
-			DisablementValues: [][]byte{DisablementKDF([]byte{1, 2, 3})},
-		}}),
+		genesisTemplate(k1),
 		optTemplate("add2", AUM{MessageKind: AUMAddKey, Key: &k2}),
 		optTemplate("add3", AUM{MessageKind: AUMAddKey, Key: &k3}),
 		optTemplate("remove2", AUM{MessageKind: AUMRemoveKey, KeyID: k2ID}))
@@ -671,10 +647,7 @@ func TestMakeRetroactiveRevocation(t *testing.T) {
         C.template = add2
         D.template = add3
     `,
-		optTemplate("genesis", AUM{MessageKind: AUMCheckpoint, State: &State{
-			Keys:              []Key{k1},
-			DisablementValues: [][]byte{DisablementKDF([]byte{1, 2, 3})},
-		}}),
+		genesisTemplate(k1),
 		optTemplate("add2", AUM{MessageKind: AUMAddKey, Key: &k2}),
 		optTemplate("add3", AUM{MessageKind: AUMAddKey, Key: &k3}))
 
diff --git a/tool/go.exe.README.txt b/tool/go.exe.README.txt
index 3f4988599..cc75613f2 100644
--- a/tool/go.exe.README.txt
+++ b/tool/go.exe.README.txt
@@ -6,9 +6,9 @@ In summary, our previous attempts to provide a version of ./tool/go (a
 shell script) on Windows with PowerShell and cmd.exe both were
 lacking.
 
-So now we we're regrettably checking in a binary to the tree. Its
+So now we're regrettably checking in a binary to the tree. Its
 source code is in ./tool/goexe. It's written in Rust without std so
-it's very small (smaller than plenty of of our source code files!) and
+it's very small (smaller than plenty of our source code files!) and
 it's 32-bit x86 so it runs on 32-bit x86, 64-bit x86, and arm64 Windows
 where it's emulated.
 
diff --git a/tool/gocross/gocross-wrapper.sh b/tool/gocross/gocross-wrapper.sh
index 05a35ba42..d95c12848 100755
--- a/tool/gocross/gocross-wrapper.sh
+++ b/tool/gocross/gocross-wrapper.sh
@@ -75,7 +75,7 @@ case "$REV" in
             # Go uses the name "amd64".
             HOST_ARCH="amd64"
         fi
-        curl -f -L -o "$toolchain.tar.gz" "https://github.com/tailscale/go/releases/download/build-${REV}/${HOST_OS}-${HOST_ARCH}.tar.gz"
+        curl --retry 3 -f -L -o "$toolchain.tar.gz" "https://github.com/tailscale/go/releases/download/build-${REV}/${HOST_OS}-${HOST_ARCH}.tar.gz"
         mkdir -p "$toolchain"
         (cd "$toolchain" && tar --strip-components=1 -xf "$toolchain.tar.gz")
         echo "$REV" >"$toolchain.extracted"
diff --git a/tool/listpkgs/listpkgs.go b/tool/listpkgs/listpkgs.go
index 1c2dda257..b29db94b1 100644
--- a/tool/listpkgs/listpkgs.go
+++ b/tool/listpkgs/listpkgs.go
@@ -10,9 +10,12 @@ import (
 	"flag"
 	"fmt"
 	"go/build/constraint"
+	"io/fs"
 	"log"
 	"os"
+	"path/filepath"
 	"slices"
+	"sort"
 	"strings"
 	"sync"
 
@@ -27,11 +30,18 @@ var (
 	withoutTagsAnyStr = flag.String("without-tags-any", "", "if non-empty, a comma-separated list of build constraints to exclude (a package will be omitted if it contains any of these build tags)")
 	shard             = flag.String("shard", "", "if non-empty, a string of the form 'N/M' to only print packages in shard N of M (e.g. '1/3', '2/3', '3/3/' for different thirds of the list)")
 	affectedByTag     = flag.String("affected-by-tag", "", "if non-empty, only list packages whose test binary would be affected by the presence or absence of this build tag")
+	hasRootTests      = flag.Bool("has-root-tests", false, "list packages (as ./relative/path) containing _test.go files that call tstest.RequireRoot")
+	hasGoGenerate     = flag.Bool("has-go-generate", false, "only list packages that contain at least one //go:generate directive")
 )
 
 func main() {
 	flag.Parse()
 
+	if *hasRootTests {
+		printRootTestPkgs()
+		return
+	}
+
 	patterns := flag.Args()
 	if len(patterns) == 0 {
 		flag.Usage()
@@ -112,6 +122,9 @@ Pkg:
 				continue Pkg
 			}
 		}
+		if *hasGoGenerate && !pkgHasGoGenerate(pkg) {
+			continue Pkg
+		}
 		matches++
 
 		if *shard != "" {
@@ -281,3 +294,123 @@ func fileMentionsTag(filename, tag string) (bool, error) {
 	}
 	return tags[tag], nil
 }
+
+// pkgHasGoGenerate reports whether any source file in pkg contains a
+// //go:generate directive.
+func pkgHasGoGenerate(pkg *packages.Package) bool {
+	// Include IgnoredFiles so directives behind build constraints are still
+	// found; the caller can narrow by tag via -with-tags-all/-without-tags-any
+	// if they care.
+	all := slices.Concat(pkg.CompiledGoFiles, pkg.OtherFiles, pkg.IgnoredFiles)
+	for _, name := range all {
+		ok, err := fileHasGoGenerate(name)
+		if err != nil {
+			log.Printf("reading %s: %v", name, err)
+			continue
+		}
+		if ok {
+			return true
+		}
+	}
+	return false
+}
+
+var (
+	goGenerateMu sync.Mutex
+	goGenerate   = map[string]bool{} // abs path -> whether file has //go:generate
+)
+
+func fileHasGoGenerate(filename string) (bool, error) {
+	goGenerateMu.Lock()
+	v, ok := goGenerate[filename]
+	goGenerateMu.Unlock()
+	if ok {
+		return v, nil
+	}
+
+	f, err := os.Open(filename)
+	if err != nil {
+		return false, err
+	}
+	defer f.Close()
+
+	has := false
+	s := bufio.NewScanner(f)
+	for s.Scan() {
+		// go:generate directives must start at column 1 (no leading
+		// whitespace) to be recognized by the go tool.
+		if strings.HasPrefix(s.Text(), "//go:generate") {
+			has = true
+			break
+		}
+	}
+	if err := s.Err(); err != nil {
+		return false, fmt.Errorf("reading %s: %w", filename, err)
+	}
+
+	goGenerateMu.Lock()
+	goGenerate[filename] = has
+	goGenerateMu.Unlock()
+	return has, nil
+}
+
+// printRootTestPkgs walks the current directory tree looking for _test.go
+// files that contain "tstest.RequireRoot" and prints the unique package
+// directories as ./relative/path.
+func printRootTestPkgs() {
+	root, err := os.Getwd()
+	if err != nil {
+		log.Fatal(err)
+	}
+	seen := map[string]bool{}
+	var dirs []string
+	filepath.WalkDir(root, func(path string, d fs.DirEntry, err error) error {
+		if err != nil {
+			return nil
+		}
+		name := d.Name()
+		if d.IsDir() {
+			// Skip hidden dirs and common non-Go dirs.
+			if strings.HasPrefix(name, ".") || name == "vendor" || name == "node_modules" {
+				return filepath.SkipDir
+			}
+			return nil
+		}
+		if !strings.HasSuffix(name, "_test.go") {
+			return nil
+		}
+		rel, err := filepath.Rel(root, path)
+		if err != nil {
+			return nil
+		}
+		dir := filepath.Dir(rel)
+		if seen[dir] {
+			return nil // already found a match in this dir
+		}
+		if fileContains(path, "tstest.RequireRoot") {
+			seen[dir] = true
+			dirs = append(dirs, dir)
+		}
+		return nil
+	})
+	sort.Strings(dirs)
+	for _, d := range dirs {
+		fmt.Println("./" + filepath.ToSlash(d))
+	}
+}
+
+// fileContains reports whether the file at path contains the given substring.
+func fileContains(path, substr string) bool {
+	f, err := os.Open(path)
+	if err != nil {
+		return false
+	}
+	defer f.Close()
+	s := bufio.NewScanner(f)
+	for s.Scan() {
+		if strings.Contains(s.Text(), substr) {
+			return true
+		}
+	}
+	return false
+}
diff --git a/tool/updateflakes/updateflakes.go b/tool/updateflakes/updateflakes.go
new file mode 100644
index 000000000..e2a572d12
--- /dev/null
+++ b/tool/updateflakes/updateflakes.go
@@ -0,0 +1,264 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// updateflakes regenerates flakehashes.json, the file that records
+// the Nix SRI hashes for the Go module vendor tree and the Tailscale
+// Go toolchain tarball.
+//
+// The file is content-addressed: each block records the input
+// fingerprint that produced its SRI, and updateflakes only
+// regenerates a block when the current input differs from the
+// recorded fingerprint. As a result, repeat runs with no input
+// changes are no-ops.
+//
+// Run from the repo root:
+//
+//	./tool/go run ./tool/updateflakes
+package main
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"io/fs"
+	"log"
+	"net/http"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+
+	"golang.org/x/sync/errgroup"
+	"tailscale.com/cmd/nardump/nardump"
+)
+
+const (
+	hashesFile       = "flakehashes.json"
+	goModFile        = "go.mod"
+	goSumFile        = "go.sum"
+	toolchainRevFile = "go.toolchain.rev"
+	flakeNixFile     = "flake.nix"
+	shellNixFile     = "shell.nix"
+	cacheBustPrefix  = "# nix-direnv cache busting line:"
+)
+
+// FlakeHashes is the on-disk schema of flakehashes.json. It is also
+// consumed directly by flake.nix via builtins.fromJSON, so changes
+// to the JSON shape must be coordinated with flake.nix.
+type FlakeHashes struct {
+	Toolchain ToolchainHash `json:"toolchain"`
+	Vendor    VendorHash    `json:"vendor"`
+}
+
+// ToolchainHash records the SRI of the Tailscale Go toolchain
+// tarball. Rev is the value in go.toolchain.rev that produced SRI.
+type ToolchainHash struct {
+	Rev string `json:"rev"`
+	SRI string `json:"sri"`
+}
+
+// VendorHash records the SRI of `go mod vendor` output. GoModSum is a
+// fingerprint of go.mod and go.sum that produced SRI.
+type VendorHash struct {
+	GoModSum string `json:"goModSum"`
+	SRI      string `json:"sri"`
+}
+
+func main() {
+	flag.Parse()
+	if err := run(); err != nil {
+		log.Fatal(err)
+	}
+}
+
+func run() error {
+	have, err := loadHashes()
+	if err != nil {
+		return err
+	}
+	want := have
+
+	rev, err := readTrim(toolchainRevFile)
+	if err != nil {
+		return err
+	}
+	wantToolchain := have.Toolchain.Rev != rev || have.Toolchain.SRI == ""
+
+	goModSum, err := goModFingerprint()
+	if err != nil {
+		return err
+	}
+	wantVendor := have.Vendor.GoModSum != goModSum || have.Vendor.SRI == ""
+
+	var (
+		newToolchain ToolchainHash
+		newVendor    VendorHash
+	)
+	var g errgroup.Group
+	if wantToolchain {
+		g.Go(func() error {
+			sri, err := hashToolchain(rev)
+			if err != nil {
+				return err
+			}
+			newToolchain = ToolchainHash{Rev: rev, SRI: sri}
+			return nil
+		})
+	}
+	if wantVendor {
+		g.Go(func() error {
+			sri, err := hashVendor()
+			if err != nil {
+				return err
+			}
+			newVendor = VendorHash{GoModSum: goModSum, SRI: sri}
+			return nil
+		})
+	}
+	if err := g.Wait(); err != nil {
+		return err
+	}
+	if wantToolchain {
+		want.Toolchain = newToolchain
+	}
+	if wantVendor {
+		want.Vendor = newVendor
+	}
+
+	if want != have {
+		if err := writeHashes(want); err != nil {
+			return err
+		}
+	}
+
+	// nix-direnv only watches the top-level nix files for changes,
+	// so when a referenced hash changes we must also tickle
+	// flake.nix and shell.nix to force re-evaluation.
+	for _, f := range []string{flakeNixFile, shellNixFile} {
+		if err := updateCacheBust(f, want.Vendor.SRI); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func loadHashes() (FlakeHashes, error) {
+	var h FlakeHashes
+	data, err := os.ReadFile(hashesFile)
+	if errors.Is(err, fs.ErrNotExist) {
+		return h, nil
+	}
+	if err != nil {
+		return h, err
+	}
+	if err := json.Unmarshal(data, &h); err != nil {
+		return h, fmt.Errorf("parse %s: %w", hashesFile, err)
+	}
+	return h, nil
+}
+
+func writeHashes(h FlakeHashes) error {
+	b, err := json.MarshalIndent(h, "", "  ")
+	if err != nil {
+		return err
+	}
+	b = append(b, '\n')
+	return os.WriteFile(hashesFile, b, 0644)
+}
+
+func readTrim(path string) (string, error) {
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return "", err
+	}
+	return strings.TrimSpace(string(b)), nil
+}
+
+// goModFingerprint returns a content fingerprint of go.mod and go.sum
+// that changes whenever either file changes.
+func goModFingerprint() (string, error) {
+	h := sha256.New()
+	for _, f := range []string{goModFile, goSumFile} {
+		b, err := os.ReadFile(f)
+		if err != nil {
+			return "", err
+		}
+		fmt.Fprintf(h, "%s %d\n", f, len(b))
+		h.Write(b)
+	}
+	return "sha256-" + base64.StdEncoding.EncodeToString(h.Sum(nil)), nil
+}
+
+func hashVendor() (string, error) {
+	out, err := os.MkdirTemp("", "nar-vendor-")
+	if err != nil {
+		return "", err
+	}
+	// `go mod vendor -o` requires the destination to not already exist.
+	if err := os.Remove(out); err != nil {
+		return "", err
+	}
+	defer os.RemoveAll(out)
+
+	cmd := exec.Command("./tool/go", "mod", "vendor", "-o", out)
+	cmd.Env = append(os.Environ(), "GOWORK=off")
+	cmd.Stderr = os.Stderr
+	if err := cmd.Run(); err != nil {
+		return "", fmt.Errorf("go mod vendor: %w", err)
+	}
+	return nardump.SRI(os.DirFS(out))
+}
+
+func hashToolchain(rev string) (string, error) {
+	out, err := os.MkdirTemp("", "nar-toolchain-")
+	if err != nil {
+		return "", err
+	}
+	defer os.RemoveAll(out)
+
+	url := fmt.Sprintf("https://github.com/tailscale/go/archive/%s.tar.gz", rev)
+	resp, err := http.Get(url)
+	if err != nil {
+		return "", fmt.Errorf("fetching %s: %w", url, err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return "", fmt.Errorf("fetching %s: %s", url, resp.Status)
+	}
+
+	tar := exec.Command("tar", "-xz", "-C", out)
+	tar.Stdin = resp.Body
+	tar.Stderr = os.Stderr
+	if err := tar.Run(); err != nil {
+		return "", fmt.Errorf("extracting toolchain tarball: %w", err)
+	}
+	return nardump.SRI(os.DirFS(filepath.Join(out, "go-"+rev)))
+}
+
+// updateCacheBust rewrites the "# nix-direnv cache busting line"
+// in path to embed sri so nix-direnv re-evaluates when the SRI
+// changes. The line lives at end of file, so walk in reverse.
+func updateCacheBust(path, sri string) error {
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return err
+	}
+	want := []byte(cacheBustPrefix + " " + sri)
+	lines := bytes.Split(b, []byte("\n"))
+	for i := len(lines) - 1; i >= 0; i-- {
+		line := lines[i]
+		if !bytes.HasPrefix(line, []byte(cacheBustPrefix)) {
+			continue
+		}
+		if bytes.Equal(line, want) {
+			return nil
+		}
+		lines[i] = want
+		return os.WriteFile(path, bytes.Join(lines, []byte("\n")), 0644)
+	}
+	return fmt.Errorf("%s: missing %q line", path, cacheBustPrefix)
+}
diff --git a/tsconsensus/monitor.go b/tsconsensus/monitor.go
index b937926a6..bf7410d0d 100644
--- a/tsconsensus/monitor.go
+++ b/tsconsensus/monitor.go
@@ -12,7 +12,6 @@ import (
 	"net/http"
 	"slices"
 
-	"tailscale.com/ipn"
 	"tailscale.com/ipn/ipnstate"
 	"tailscale.com/tsnet"
 	"tailscale.com/util/dnsname"
@@ -108,24 +107,16 @@ func (m *monitor) handleNetmap(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "", http.StatusInternalServerError)
 		return
 	}
-	watcher, err := lc.WatchIPNBus(r.Context(), ipn.NotifyInitialNetMap)
+	st, err := lc.Status(r.Context())
 	if err != nil {
-		log.Printf("monitor: error WatchIPNBus: %v", err)
-		http.Error(w, "", http.StatusInternalServerError)
-		return
-	}
-	defer watcher.Close()
-
-	n, err := watcher.Next()
-	if err != nil {
-		log.Printf("monitor: error watcher.Next: %v", err)
+		log.Printf("monitor: error fetching status: %v", err)
 		http.Error(w, "", http.StatusInternalServerError)
 		return
 	}
 	encoder := json.NewEncoder(w)
 	encoder.SetIndent("", "\t")
-	if err := encoder.Encode(n); err != nil {
-		log.Printf("monitor: error encoding netmap: %v", err)
+	if err := encoder.Encode(st); err != nil {
+		log.Printf("monitor: error encoding status: %v", err)
 		return
 	}
 }
diff --git a/tsconst/health.go b/tsconst/health.go
index 93c6550ef..dbcb8d29a 100644
--- a/tsconst/health.go
+++ b/tsconst/health.go
@@ -23,4 +23,5 @@ const (
 	HealthWarnableTestWarnable              = "test-warnable"
 	HealthWarnableApplyDiskConfig           = "apply-disk-config"
 	HealthWarnableWarmingUp                 = "warming-up"
+	HealthWarnableTLSCertPending            = "tls-cert-pending"
 )
diff --git a/tsconst/ping.go b/tsconst/ping.go
new file mode 100644
index 000000000..603f9c25d
--- /dev/null
+++ b/tsconst/ping.go
@@ -0,0 +1,16 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package tsconst
+
+import "time"
+
+const (
+	// DefaultPingTimeout is the default time we wait for a pong reply
+	// before assuming it's never coming.
+	DefaultPingTimeout = 5 * time.Second
+
+	// DefaultPingInterval is the default minimum time
+	// between pings to an endpoint.
+	DefaultPingInterval = 5 * time.Second
+)
diff --git a/tsconst/tsconst.go b/tsconst/tsconst.go
index 85f05e549..1477bafec 100644
--- a/tsconst/tsconst.go
+++ b/tsconst/tsconst.go
@@ -10,6 +10,6 @@ package tsconst
 const WintunInterfaceDesc = "Tailscale Tunnel"
 const WintunInterfaceDesc0_14 = "Wintun Userspace Tunnel"
 
-// TailnetLockNotTrustedMsg is the error message used by network lock
+// TailnetLockNotTrustedMsg is the error message used by tailnet lock
 // and sniffed (via substring) out of an error sent over the network.
-const TailnetLockNotTrustedMsg = "this node is not trusted by network lock"
+const TailnetLockNotTrustedMsg = "this node is not trusted by Tailnet Lock"
diff --git a/tsconst/wintun/wintun.go b/tsconst/wintun/wintun.go
new file mode 100644
index 000000000..a2676b96e
--- /dev/null
+++ b/tsconst/wintun/wintun.go
@@ -0,0 +1,24 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package wintun is the single source of truth for the pinned wintun.dll release
+// the Tailscale Windows client is built and tested against.
+package wintun
+
+const (
+	// Version is the pinned wintun release.
+	Version = "0.14.1"
+	// URL is the wintun.net download for Version.
+	URL = "https://www.wintun.net/builds/wintun-" + Version + ".zip"
+	// SHA256 is the hex-encoded sha256 of the zip at URL.
+	SHA256 = "07c256185d6ee3652e09fa55c0b673e2624b565e02c4b9091c79ca7d2f24ef51"
+)
+
+// DLLZipPath returns the path of the wintun.dll for goArch within the release zip.
+func DLLZipPath(goArch string) string {
+	arch := goArch
+	if goArch == "386" {
+		arch = "x86"
+	}
+	return "wintun/bin/" + arch + "/wintun.dll"
+}
diff --git a/tsd/tsd.go b/tsd/tsd.go
index 615c9c0e7..98b6a6bd3 100644
--- a/tsd/tsd.go
+++ b/tsd/tsd.go
@@ -20,6 +20,7 @@ package tsd
 import (
 	"crypto/x509"
 	"fmt"
+	"net/http"
 	"reflect"
 
 	"tailscale.com/control/controlknobs"
@@ -64,6 +65,10 @@ type System struct {
 	PolicyClient   SubSystem[policyclient.Client]
 	HealthTracker  SubSystem[*health.Tracker]
 
+	// NoiseRoundTripper, if set, provides an http.RoundTripper that
+	// sends requests over the control plane Noise connection.
+	NoiseRoundTripper SubSystem[http.RoundTripper]
+
 	// ExtraRootCAs, if non-nil, specifies additional trusted root CAs
 	// beyond the system roots. On Android, this includes user-installed
 	// CA certificates that Go's crypto/x509 does not see.
diff --git a/tsnet/README.md b/tsnet/README.md
new file mode 100644
index 000000000..f9a96af00
--- /dev/null
+++ b/tsnet/README.md
@@ -0,0 +1,109 @@
+<!-- README.md auto-generated by misc/genreadme; DO NOT EDIT. (or remove this line) -->
+
+# tsnet
+
+[![Go Reference](https://pkg.go.dev/badge/tailscale.com/tsnet.svg)](https://pkg.go.dev/tailscale.com/tsnet)
+
+Package tsnet embeds a Tailscale node directly into a Go program, allowing it to join a tailnet and accept or dial connections without running a separate tailscaled daemon or requiring any system-level configuration.
+
+## Overview
+
+Normally, Tailscale runs as a background system service (tailscaled) that manages a virtual network interface for the whole machine. tsnet takes a different approach: it runs a fully self-contained Tailscale node inside your process using a userspace TCP/IP stack (gVisor). This means:
+
+  - No root privileges required.
+  - No system daemons to install or manage.
+  - Multiple independent Tailscale nodes can run within a single binary.
+  - The node's [Tailscale identity](https://tailscale.com/docs/concepts/tailscale-identity) and state are stored in a directory you control.
+
+The core type is [Server](https://pkg.go.dev/tailscale.com/tsnet#Server), which represents one embedded Tailscale node. Calling [Server.Listen](https://pkg.go.dev/tailscale.com/tsnet#Server.Listen) or [Server.Dial](https://pkg.go.dev/tailscale.com/tsnet#Server.Dial) routes traffic exclusively over the tailnet. The standard library's [net.Listener](https://pkg.go.dev/net#Listener) and [net.Conn](https://pkg.go.dev/net#Conn) interfaces are returned, so any existing Go HTTP server, gRPC server, or other net-based code works without modification.
+
+## Usage
+
+	import "tailscale.com/tsnet"
+
+	s := &tsnet.Server{
+		Hostname: "my-service",
+		AuthKey:  os.Getenv("TS_AUTHKEY"),
+	}
+	defer s.Close()
+
+	ln, err := s.Listen("tcp", ":80")
+	if err != nil {
+		log.Fatal(err)
+	}
+	log.Fatal(http.Serve(ln, myHandler))
+
+On first run, if no [Server.AuthKey](https://pkg.go.dev/tailscale.com/tsnet#Server.AuthKey) is provided and the node is not already enrolled, the server logs an authentication URL. Open it in a browser to add the node to your tailnet.
+
+## Authentication
+
+A [Server](https://pkg.go.dev/tailscale.com/tsnet#Server) authenticates using, in order of precedence:
+
+ 1. [Server.AuthKey](https://pkg.go.dev/tailscale.com/tsnet#Server.AuthKey).
+
+ 2. The TS\_AUTHKEY environment variable.
+
+ 3. The TS\_AUTH\_KEY environment variable.
+
+ 4. An OAuth client secret ([Server.ClientSecret](https://pkg.go.dev/tailscale.com/tsnet#Server.ClientSecret) or TS\_CLIENT\_SECRET), used to mint an auth key.
+
+ 5. Workload identity federation ([Server.ClientID](https://pkg.go.dev/tailscale.com/tsnet#Server.ClientID) plus [Server.IDToken](https://pkg.go.dev/tailscale.com/tsnet#Server.IDToken) or [Server.Audience](https://pkg.go.dev/tailscale.com/tsnet#Server.Audience)). Available only if the program imports the feature:
+
+    import \_ "tailscale.com/feature/identityfederation"
+
+    The feature is not linked by default to keep the AWS SDK and other cloud-provider dependencies out of programs that don't use workload identity federation.
+
+ 6. An interactive login URL printed to [Server.UserLogf](https://pkg.go.dev/tailscale.com/tsnet#Server.UserLogf).
+
+If the node is already enrolled (state found in [Server.Store](https://pkg.go.dev/tailscale.com/tsnet#Server.Store)), the auth key is ignored unless TSNET\_FORCE\_LOGIN=1 is set.
+
+## Identifying callers
+
+Use the WhoIs method on the client returned by [Server.LocalClient](https://pkg.go.dev/tailscale.com/tsnet#Server.LocalClient) to identify who is making a request:
+
+	lc, _ := srv.LocalClient()
+	http.Serve(ln, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		who, err := lc.WhoIs(r.Context(), r.RemoteAddr)
+		if err != nil {
+			http.Error(w, err.Error(), 500)
+			return
+		}
+		fmt.Fprintf(w, "Hello, %s!", who.UserProfile.LoginName)
+	}))
+
+## Tailscale Funnel
+
+[Server.ListenFunnel](https://pkg.go.dev/tailscale.com/tsnet#Server.ListenFunnel) exposes your service on the public internet. [Tailscale Funnel](https://tailscale.com/docs/features/tailscale-funnel) currently supports TCP on ports 443, 8443, and 10000. HTTPS must be enabled in the Tailscale admin console.
+
+	ln, err := srv.ListenFunnel("tcp", ":443")
+	// ln is a TLS listener; connections can come from anywhere on the
+	// internet as well as from your tailnet.
+
+	// To restrict to public traffic only:
+	ln, err = srv.ListenFunnel("tcp", ":443", tsnet.FunnelOnly())
+
+## Tailscale Services
+
+[Server.ListenService](https://pkg.go.dev/tailscale.com/tsnet#Server.ListenService) advertises the node as a host for a named [Tailscale Service](https://tailscale.com/docs/features/tailscale-services). The node must use a tag-based identity. To advertise multiple ports, call ListenService once per port.
+
+	srv.AdvertiseTags = []string{"tag:myservice"}
+
+	ln, err := srv.ListenService("svc:my-service", tsnet.ServiceModeHTTP{
+		HTTPS: true,
+		Port:  443,
+	})
+	log.Printf("Listening on https://%s", ln.FQDN)
+
+## Running multiple nodes in one process
+
+Each [Server](https://pkg.go.dev/tailscale.com/tsnet#Server) instance is an independent node. Give each a unique [Server.Dir](https://pkg.go.dev/tailscale.com/tsnet#Server.Dir) and [Server.Hostname](https://pkg.go.dev/tailscale.com/tsnet#Server.Hostname):
+
+	for _, name := range []string{"frontend", "backend"} {
+		srv := &tsnet.Server{
+			Hostname:  name,
+			Dir:       filepath.Join(baseDir, name),
+			AuthKey:   os.Getenv("TS_AUTHKEY"),
+			Ephemeral: true,
+		}
+		srv.Start()
+	}
diff --git a/tsnet/depaware.txt b/tsnet/depaware.txt
index b8b6aec98..4f80f04d0 100644
--- a/tsnet/depaware.txt
+++ b/tsnet/depaware.txt
@@ -6,81 +6,9 @@ tailscale.com/tsnet dependencies: (generated by github.com/tailscale/depaware)
    W 💣 github.com/alexbrainman/sspi                                 from github.com/alexbrainman/sspi/internal/common+
    W    github.com/alexbrainman/sspi/internal/common                 from github.com/alexbrainman/sspi/negotiate
    W 💣 github.com/alexbrainman/sspi/negotiate                       from tailscale.com/net/tshttpproxy
-        github.com/aws/aws-sdk-go-v2/aws                             from github.com/aws/aws-sdk-go-v2/aws/defaults+
-        github.com/aws/aws-sdk-go-v2/aws/defaults                    from github.com/aws/aws-sdk-go-v2/service/sso+
-        github.com/aws/aws-sdk-go-v2/aws/middleware                  from github.com/aws/aws-sdk-go-v2/aws/retry+
-        github.com/aws/aws-sdk-go-v2/aws/protocol/query              from github.com/aws/aws-sdk-go-v2/service/sts
-        github.com/aws/aws-sdk-go-v2/aws/protocol/restjson           from github.com/aws/aws-sdk-go-v2/service/sso+
-        github.com/aws/aws-sdk-go-v2/aws/protocol/xml                from github.com/aws/aws-sdk-go-v2/service/sts
-        github.com/aws/aws-sdk-go-v2/aws/ratelimit                   from github.com/aws/aws-sdk-go-v2/aws/retry
-        github.com/aws/aws-sdk-go-v2/aws/retry                       from github.com/aws/aws-sdk-go-v2/credentials/endpointcreds/internal/client+
-        github.com/aws/aws-sdk-go-v2/aws/signer/internal/v4          from github.com/aws/aws-sdk-go-v2/aws/signer/v4
-        github.com/aws/aws-sdk-go-v2/aws/signer/v4                   from github.com/aws/aws-sdk-go-v2/internal/auth/smithy+
-        github.com/aws/aws-sdk-go-v2/aws/transport/http              from github.com/aws/aws-sdk-go-v2/config+
-        github.com/aws/aws-sdk-go-v2/config                          from tailscale.com/wif
-        github.com/aws/aws-sdk-go-v2/credentials                     from github.com/aws/aws-sdk-go-v2/config
-        github.com/aws/aws-sdk-go-v2/credentials/ec2rolecreds        from github.com/aws/aws-sdk-go-v2/config
-        github.com/aws/aws-sdk-go-v2/credentials/endpointcreds       from github.com/aws/aws-sdk-go-v2/config
-        github.com/aws/aws-sdk-go-v2/credentials/endpointcreds/internal/client from github.com/aws/aws-sdk-go-v2/credentials/endpointcreds
-        github.com/aws/aws-sdk-go-v2/credentials/processcreds        from github.com/aws/aws-sdk-go-v2/config
-        github.com/aws/aws-sdk-go-v2/credentials/ssocreds            from github.com/aws/aws-sdk-go-v2/config
-        github.com/aws/aws-sdk-go-v2/credentials/stscreds            from github.com/aws/aws-sdk-go-v2/config
-        github.com/aws/aws-sdk-go-v2/feature/ec2/imds                from github.com/aws/aws-sdk-go-v2/config+
-        github.com/aws/aws-sdk-go-v2/feature/ec2/imds/internal/config from github.com/aws/aws-sdk-go-v2/feature/ec2/imds
-        github.com/aws/aws-sdk-go-v2/internal/auth                   from github.com/aws/aws-sdk-go-v2/aws/signer/v4+
-        github.com/aws/aws-sdk-go-v2/internal/auth/smithy            from github.com/aws/aws-sdk-go-v2/service/sso+
-        github.com/aws/aws-sdk-go-v2/internal/configsources          from github.com/aws/aws-sdk-go-v2/service/sso+
-        github.com/aws/aws-sdk-go-v2/internal/context                from github.com/aws/aws-sdk-go-v2/aws/retry+
-        github.com/aws/aws-sdk-go-v2/internal/endpoints              from github.com/aws/aws-sdk-go-v2/service/sso+
-        github.com/aws/aws-sdk-go-v2/internal/endpoints/awsrulesfn   from github.com/aws/aws-sdk-go-v2/service/sso+
-        github.com/aws/aws-sdk-go-v2/internal/endpoints/v2           from github.com/aws/aws-sdk-go-v2/service/sso/internal/endpoints+
-        github.com/aws/aws-sdk-go-v2/internal/ini                    from github.com/aws/aws-sdk-go-v2/config
-        github.com/aws/aws-sdk-go-v2/internal/middleware             from github.com/aws/aws-sdk-go-v2/service/sso+
-        github.com/aws/aws-sdk-go-v2/internal/rand                   from github.com/aws/aws-sdk-go-v2/aws+
-        github.com/aws/aws-sdk-go-v2/internal/sdk                    from github.com/aws/aws-sdk-go-v2/aws+
-        github.com/aws/aws-sdk-go-v2/internal/sdkio                  from github.com/aws/aws-sdk-go-v2/credentials/processcreds
-        github.com/aws/aws-sdk-go-v2/internal/shareddefaults         from github.com/aws/aws-sdk-go-v2/config+
-        github.com/aws/aws-sdk-go-v2/internal/strings                from github.com/aws/aws-sdk-go-v2/aws/signer/internal/v4
-        github.com/aws/aws-sdk-go-v2/internal/sync/singleflight      from github.com/aws/aws-sdk-go-v2/aws
-        github.com/aws/aws-sdk-go-v2/internal/timeconv               from github.com/aws/aws-sdk-go-v2/aws/retry
-        github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding from github.com/aws/aws-sdk-go-v2/service/sts
-        github.com/aws/aws-sdk-go-v2/service/internal/presigned-url  from github.com/aws/aws-sdk-go-v2/service/sts
-        github.com/aws/aws-sdk-go-v2/service/sso                     from github.com/aws/aws-sdk-go-v2/config+
-        github.com/aws/aws-sdk-go-v2/service/sso/internal/endpoints  from github.com/aws/aws-sdk-go-v2/service/sso
-        github.com/aws/aws-sdk-go-v2/service/sso/types               from github.com/aws/aws-sdk-go-v2/service/sso
-        github.com/aws/aws-sdk-go-v2/service/ssooidc                 from github.com/aws/aws-sdk-go-v2/config+
-        github.com/aws/aws-sdk-go-v2/service/ssooidc/internal/endpoints from github.com/aws/aws-sdk-go-v2/service/ssooidc
-        github.com/aws/aws-sdk-go-v2/service/ssooidc/types           from github.com/aws/aws-sdk-go-v2/service/ssooidc
-        github.com/aws/aws-sdk-go-v2/service/sts                     from github.com/aws/aws-sdk-go-v2/config+
-        github.com/aws/aws-sdk-go-v2/service/sts/internal/endpoints  from github.com/aws/aws-sdk-go-v2/service/sts
-        github.com/aws/aws-sdk-go-v2/service/sts/types               from github.com/aws/aws-sdk-go-v2/credentials/stscreds+
-        github.com/aws/smithy-go                                     from github.com/aws/aws-sdk-go-v2/aws/protocol/restjson+
-        github.com/aws/smithy-go/auth                                from github.com/aws/aws-sdk-go-v2/internal/auth+
-        github.com/aws/smithy-go/auth/bearer                         from github.com/aws/aws-sdk-go-v2/aws+
-        github.com/aws/smithy-go/context                             from github.com/aws/smithy-go/auth/bearer
-        github.com/aws/smithy-go/document                            from github.com/aws/aws-sdk-go-v2/service/sso+
-        github.com/aws/smithy-go/encoding                            from github.com/aws/smithy-go/encoding/json+
-        github.com/aws/smithy-go/encoding/httpbinding                from github.com/aws/aws-sdk-go-v2/aws/protocol/query+
-        github.com/aws/smithy-go/encoding/json                       from github.com/aws/aws-sdk-go-v2/service/ssooidc
-        github.com/aws/smithy-go/encoding/xml                        from github.com/aws/aws-sdk-go-v2/service/sts
-        github.com/aws/smithy-go/endpoints                           from github.com/aws/aws-sdk-go-v2/service/sso+
-        github.com/aws/smithy-go/endpoints/private/rulesfn           from github.com/aws/aws-sdk-go-v2/service/sts
-        github.com/aws/smithy-go/internal/sync/singleflight          from github.com/aws/smithy-go/auth/bearer
-        github.com/aws/smithy-go/io                                  from github.com/aws/aws-sdk-go-v2/feature/ec2/imds+
-        github.com/aws/smithy-go/logging                             from github.com/aws/aws-sdk-go-v2/aws+
-        github.com/aws/smithy-go/metrics                             from github.com/aws/aws-sdk-go-v2/aws/retry+
-        github.com/aws/smithy-go/middleware                          from github.com/aws/aws-sdk-go-v2/aws+
-        github.com/aws/smithy-go/private/requestcompression          from github.com/aws/aws-sdk-go-v2/config
-        github.com/aws/smithy-go/ptr                                 from github.com/aws/aws-sdk-go-v2/aws+
-        github.com/aws/smithy-go/rand                                from github.com/aws/aws-sdk-go-v2/aws/middleware
-        github.com/aws/smithy-go/time                                from github.com/aws/aws-sdk-go-v2/service/sso+
-        github.com/aws/smithy-go/tracing                             from github.com/aws/aws-sdk-go-v2/aws/middleware+
-        github.com/aws/smithy-go/transport/http                      from github.com/aws/aws-sdk-go-v2/aws+
-        github.com/aws/smithy-go/transport/http/internal/io          from github.com/aws/smithy-go/transport/http
  LDW    github.com/coder/websocket                                   from tailscale.com/util/eventbus
  LDW    github.com/coder/websocket/internal/errd                     from github.com/coder/websocket
  LDW    github.com/coder/websocket/internal/util                     from github.com/coder/websocket
- LDW    github.com/coder/websocket/internal/xsync                    from github.com/coder/websocket
         github.com/creachadair/msync/trigger                         from tailscale.com/logtail
    W 💣 github.com/dblohm7/wingoes                                   from tailscale.com/net/tshttpproxy+
    W 💣 github.com/dblohm7/wingoes/com                               from tailscale.com/util/osdiag+
@@ -102,10 +30,10 @@ tailscale.com/tsnet dependencies: (generated by github.com/tailscale/depaware)
         github.com/go-json-experiment/json/internal/jsonopts         from github.com/go-json-experiment/json+
         github.com/go-json-experiment/json/internal/jsonwire         from github.com/go-json-experiment/json+
         github.com/go-json-experiment/json/jsontext                  from github.com/go-json-experiment/json+
+        github.com/go-json-experiment/json/v1                        from tailscale.com/net/routecheck+
    L 💣 github.com/godbus/dbus/v5                                    from tailscale.com/net/dns
         github.com/golang/groupcache/lru                             from tailscale.com/net/dnscache
         github.com/google/btree                                      from gvisor.dev/gvisor/pkg/tcpip/transport/tcp
-  DI    github.com/google/uuid                                       from github.com/prometheus-community/pro-bing
         github.com/hdevalence/ed25519consensus                       from tailscale.com/tka
         github.com/huin/goupnp                                       from github.com/huin/goupnp/dcps/internetgateway2+
         github.com/huin/goupnp/dcps/internetgateway2                 from tailscale.com/net/portmapper
@@ -128,17 +56,16 @@ tailscale.com/tsnet dependencies: (generated by github.com/tailscale/depaware)
   LA 💣 github.com/mdlayher/socket                                   from github.com/mdlayher/netlink+
  LDW 💣 github.com/mitchellh/go-ps                                   from tailscale.com/safesocket
         github.com/pires/go-proxyproto                               from tailscale.com/ipn/ipnlocal
-  DI    github.com/prometheus-community/pro-bing                     from tailscale.com/wgengine/netstack
    L 💣 github.com/safchain/ethtool                                  from tailscale.com/net/netkernelconf
-   W 💣 github.com/tailscale/certstore                               from tailscale.com/control/controlclient
+  DW 💣 github.com/tailscale/certstore                               from tailscale.com/control/controlclient
    W 💣 github.com/tailscale/go-winio                                from tailscale.com/safesocket
    W 💣 github.com/tailscale/go-winio/internal/fs                    from github.com/tailscale/go-winio
    W 💣 github.com/tailscale/go-winio/internal/socket                from github.com/tailscale/go-winio
    W    github.com/tailscale/go-winio/internal/stringbuffer          from github.com/tailscale/go-winio/internal/fs
    W    github.com/tailscale/go-winio/pkg/guid                       from github.com/tailscale/go-winio+
- LDW    github.com/tailscale/hujson                                  from tailscale.com/ipn/conffile
+ LDW    github.com/tailscale/hujson                                  from tailscale.com/ipn/conffile+
  LDAI    github.com/tailscale/peercred                                from tailscale.com/ipn/ipnauth
- LDW    github.com/tailscale/web-client-prebuilt                     from tailscale.com/client/web
+ LDWI    github.com/tailscale/web-client-prebuilt                     from tailscale.com/client/web
      💣 github.com/tailscale/wireguard-go/conn                       from github.com/tailscale/wireguard-go/device+
    W 💣 github.com/tailscale/wireguard-go/conn/winrio                from github.com/tailscale/wireguard-go/conn
      💣 github.com/tailscale/wireguard-go/device                     from tailscale.com/net/tstun+
@@ -201,7 +128,7 @@ tailscale.com/tsnet dependencies: (generated by github.com/tailscale/depaware)
         tailscale.com/client/local                                   from tailscale.com/client/web+
         tailscale.com/client/tailscale                               from tailscale.com/internal/client/tailscale
         tailscale.com/client/tailscale/apitype                       from tailscale.com/client/local+
- LDW    tailscale.com/client/web                                     from tailscale.com/ipn/ipnlocal
+ LDWI    tailscale.com/client/web                                     from tailscale.com/ipn/ipnlocal
         tailscale.com/control/controlbase                            from tailscale.com/control/controlhttp+
         tailscale.com/control/controlclient                          from tailscale.com/ipn/ipnext+
         tailscale.com/control/controlhttp                            from tailscale.com/control/ts2021
@@ -216,17 +143,18 @@ tailscale.com/tsnet dependencies: (generated by github.com/tailscale/depaware)
         tailscale.com/envknob                                        from tailscale.com/client/local+
         tailscale.com/envknob/featureknob                            from tailscale.com/client/web+
         tailscale.com/feature                                        from tailscale.com/ipn/ipnext+
+        tailscale.com/feature/acme                                   from tailscale.com/tsnet
         tailscale.com/feature/buildfeatures                          from tailscale.com/wgengine/magicsock+
         tailscale.com/feature/c2n                                    from tailscale.com/tsnet
         tailscale.com/feature/condlite/expvar                        from tailscale.com/wgengine/magicsock
-        tailscale.com/feature/condregister/identityfederation        from tailscale.com/tsnet
+        tailscale.com/feature/condregister/netlog                    from tailscale.com/tsnet
         tailscale.com/feature/condregister/oauthkey                  from tailscale.com/tsnet
         tailscale.com/feature/condregister/portmapper                from tailscale.com/tsnet
         tailscale.com/feature/condregister/useproxy                  from tailscale.com/tsnet
-        tailscale.com/feature/identityfederation                     from tailscale.com/feature/condregister/identityfederation
+        tailscale.com/feature/netlog                                 from tailscale.com/feature/condregister/netlog
         tailscale.com/feature/oauthkey                               from tailscale.com/feature/condregister/oauthkey
         tailscale.com/feature/portmapper                             from tailscale.com/feature/condregister/portmapper
-        tailscale.com/feature/syspolicy                              from tailscale.com/logpolicy
+        tailscale.com/feature/serviceclientprefs/serviceclient       from tailscale.com/client/local
         tailscale.com/feature/useproxy                               from tailscale.com/feature/condregister/useproxy
         tailscale.com/health                                         from tailscale.com/control/controlclient+
         tailscale.com/health/healthmsg                               from tailscale.com/ipn/ipnlocal
@@ -240,19 +168,18 @@ tailscale.com/tsnet dependencies: (generated by github.com/tailscale/depaware)
         tailscale.com/ipn/ipnlocal/netmapcache                       from tailscale.com/ipn/ipnlocal
         tailscale.com/ipn/ipnstate                                   from tailscale.com/client/local+
         tailscale.com/ipn/localapi                                   from tailscale.com/tsnet
-        tailscale.com/ipn/store                                      from tailscale.com/ipn/ipnlocal+
+        tailscale.com/ipn/store                                      from tailscale.com/tsnet+
         tailscale.com/ipn/store/mem                                  from tailscale.com/ipn/ipnlocal+
         tailscale.com/kube/kubetypes                                 from tailscale.com/envknob
- LDW    tailscale.com/licenses                                       from tailscale.com/client/web
+ LDWI    tailscale.com/licenses                                       from tailscale.com/client/web
         tailscale.com/log/filelogger                                 from tailscale.com/logpolicy
         tailscale.com/log/sockstatlog                                from tailscale.com/ipn/ipnlocal
         tailscale.com/logpolicy                                      from tailscale.com/ipn/ipnlocal+
         tailscale.com/logtail                                        from tailscale.com/control/controlclient+
         tailscale.com/logtail/filch                                  from tailscale.com/log/sockstatlog+
         tailscale.com/metrics                                        from tailscale.com/tsweb+
-        tailscale.com/net/bakedroots                                 from tailscale.com/ipn/ipnlocal+
+        tailscale.com/net/bakedroots                                 from tailscale.com/net/tlsdial+
      💣 tailscale.com/net/batching                                   from tailscale.com/wgengine/magicsock
-        tailscale.com/net/captivedetection                           from tailscale.com/ipn/ipnlocal+
         tailscale.com/net/dns                                        from tailscale.com/ipn/ipnlocal+
         tailscale.com/net/dns/publicdns                              from tailscale.com/net/dns+
         tailscale.com/net/dns/resolvconffile                         from tailscale.com/net/dns+
@@ -263,7 +190,7 @@ tailscale.com/tsnet dependencies: (generated by github.com/tailscale/depaware)
         tailscale.com/net/ipset                                      from tailscale.com/ipn/ipnlocal+
         tailscale.com/net/memnet                                     from tailscale.com/tsnet
         tailscale.com/net/netaddr                                    from tailscale.com/ipn+
-        tailscale.com/net/netcheck                                   from tailscale.com/ipn/ipnlocal+
+        tailscale.com/net/netcheck                                   from tailscale.com/wgengine/magicsock
         tailscale.com/net/neterror                                   from tailscale.com/net/dns/resolver+
         tailscale.com/net/netkernelconf                              from tailscale.com/ipn/ipnlocal
         tailscale.com/net/netknob                                    from tailscale.com/logpolicy+
@@ -277,12 +204,16 @@ tailscale.com/tsnet dependencies: (generated by github.com/tailscale/depaware)
         tailscale.com/net/portmapper                                 from tailscale.com/feature/portmapper
         tailscale.com/net/portmapper/portmappertype                  from tailscale.com/net/netcheck+
         tailscale.com/net/proxymux                                   from tailscale.com/tsnet
+        tailscale.com/net/routecheck                                 from tailscale.com/client/local+
+        tailscale.com/net/routecheck/peernode                        from tailscale.com/ipn/ipnlocal+
+        tailscale.com/net/routemanager                               from tailscale.com/ipn/ipnlocal+
      💣 tailscale.com/net/sockopts                                   from tailscale.com/wgengine/magicsock
         tailscale.com/net/socks5                                     from tailscale.com/tsnet
         tailscale.com/net/sockstats                                  from tailscale.com/control/controlclient+
         tailscale.com/net/stun                                       from tailscale.com/ipn/localapi+
         tailscale.com/net/tlsdial                                    from tailscale.com/control/controlclient+
         tailscale.com/net/tlsdial/blockblame                         from tailscale.com/net/tlsdial
+        tailscale.com/net/traffic                                    from tailscale.com/ipn/ipnlocal+
         tailscale.com/net/tsaddr                                     from tailscale.com/client/web+
         tailscale.com/net/tsdial                                     from tailscale.com/control/controlclient+
      💣 tailscale.com/net/tshttpproxy                                from tailscale.com/feature/useproxy
@@ -295,7 +226,7 @@ tailscale.com/tsnet dependencies: (generated by github.com/tailscale/depaware)
      💣 tailscale.com/safesocket                                     from tailscale.com/client/local+
         tailscale.com/syncs                                          from tailscale.com/control/controlhttp+
         tailscale.com/tailcfg                                        from tailscale.com/client/local+
-        tailscale.com/tempfork/acme                                  from tailscale.com/ipn/ipnlocal
+        tailscale.com/tempfork/acme                                  from tailscale.com/feature/acme
         tailscale.com/tempfork/heap                                  from tailscale.com/wgengine/magicsock
         tailscale.com/tempfork/httprec                               from tailscale.com/feature/c2n
         tailscale.com/tka                                            from tailscale.com/client/local+
@@ -304,7 +235,7 @@ tailscale.com/tsnet dependencies: (generated by github.com/tailscale/depaware)
         tailscale.com/tstime                                         from tailscale.com/control/controlclient+
         tailscale.com/tstime/mono                                    from tailscale.com/net/tstun+
         tailscale.com/tstime/rate                                    from tailscale.com/wgengine/filter
- LDW    tailscale.com/tsweb                                          from tailscale.com/util/eventbus
+        tailscale.com/tsweb                                          from tailscale.com/util/eventbus+
         tailscale.com/tsweb/varz                                     from tailscale.com/tsweb+
         tailscale.com/types/appctype                                 from tailscale.com/ipn/ipnlocal+
         tailscale.com/types/bools                                    from tailscale.com/tsnet+
@@ -316,7 +247,7 @@ tailscale.com/tsnet dependencies: (generated by github.com/tailscale/depaware)
         tailscale.com/types/lazy                                     from tailscale.com/hostinfo+
         tailscale.com/types/logger                                   from tailscale.com/appc+
         tailscale.com/types/logid                                    from tailscale.com/ipn/ipnlocal+
-        tailscale.com/types/mapx                                     from tailscale.com/ipn/ipnext
+        tailscale.com/types/mapx                                     from tailscale.com/ipn/ipnext+
         tailscale.com/types/netlogfunc                               from tailscale.com/net/tstun+
         tailscale.com/types/netlogtype                               from tailscale.com/wgengine/netlog
         tailscale.com/types/netmap                                   from tailscale.com/control/controlclient+
@@ -338,6 +269,7 @@ tailscale.com/tsnet dependencies: (generated by github.com/tailscale/depaware)
   LW    tailscale.com/util/cmpver                                    from tailscale.com/net/dns+
         tailscale.com/util/ctxkey                                    from tailscale.com/client/tailscale/apitype+
      💣 tailscale.com/util/deephash                                  from tailscale.com/util/syspolicy/setting
+        tailscale.com/util/def                                       from tailscale.com/ipn/localapi
   LA 💣 tailscale.com/util/dirwalk                                   from tailscale.com/metrics
         tailscale.com/util/dnsname                                   from tailscale.com/appc+
         tailscale.com/util/eventbus                                  from tailscale.com/client/local+
@@ -360,16 +292,15 @@ tailscale.com/tsnet dependencies: (generated by github.com/tailscale/depaware)
         tailscale.com/util/set                                       from tailscale.com/control/controlclient+
         tailscale.com/util/singleflight                              from tailscale.com/control/controlclient+
         tailscale.com/util/slicesx                                   from tailscale.com/appc+
-        tailscale.com/util/syspolicy                                 from tailscale.com/feature/syspolicy
-        tailscale.com/util/syspolicy/internal                        from tailscale.com/util/syspolicy+
-        tailscale.com/util/syspolicy/internal/loggerx                from tailscale.com/util/syspolicy+
+        tailscale.com/util/syspolicy/internal                        from tailscale.com/util/syspolicy/internal/metrics+
+        tailscale.com/util/syspolicy/internal/loggerx                from tailscale.com/util/syspolicy/internal/metrics+
         tailscale.com/util/syspolicy/internal/metrics                from tailscale.com/util/syspolicy/source
         tailscale.com/util/syspolicy/pkey                            from tailscale.com/control/controlclient+
         tailscale.com/util/syspolicy/policyclient                    from tailscale.com/control/controlclient+
-        tailscale.com/util/syspolicy/ptype                           from tailscale.com/util/syspolicy+
-        tailscale.com/util/syspolicy/rsop                            from tailscale.com/ipn/localapi+
+        tailscale.com/util/syspolicy/ptype                           from tailscale.com/ipn/ipnlocal+
+        tailscale.com/util/syspolicy/rsop                            from tailscale.com/ipn/localapi
         tailscale.com/util/syspolicy/setting                         from tailscale.com/client/local+
-        tailscale.com/util/syspolicy/source                          from tailscale.com/util/syspolicy+
+        tailscale.com/util/syspolicy/source                          from tailscale.com/util/syspolicy/rsop
         tailscale.com/util/testenv                                   from tailscale.com/control/controlclient+
         tailscale.com/util/truncate                                  from tailscale.com/logtail
         tailscale.com/util/usermetric                                from tailscale.com/health+
@@ -386,15 +317,13 @@ tailscale.com/tsnet dependencies: (generated by github.com/tailscale/depaware)
         tailscale.com/wgengine/filter                                from tailscale.com/control/controlclient+
         tailscale.com/wgengine/filter/filtertype                     from tailscale.com/types/netmap+
      💣 tailscale.com/wgengine/magicsock                             from tailscale.com/ipn/ipnlocal+
-        tailscale.com/wgengine/netlog                                from tailscale.com/wgengine
+        tailscale.com/wgengine/netlog                                from tailscale.com/feature/netlog
         tailscale.com/wgengine/netstack                              from tailscale.com/tsnet
         tailscale.com/wgengine/netstack/gro                          from tailscale.com/net/tstun+
         tailscale.com/wgengine/router                                from tailscale.com/ipn/ipnlocal+
         tailscale.com/wgengine/wgcfg                                 from tailscale.com/ipn/ipnlocal+
-        tailscale.com/wgengine/wgcfg/nmcfg                           from tailscale.com/ipn/ipnlocal
      💣 tailscale.com/wgengine/wgint                                 from tailscale.com/wgengine+
         tailscale.com/wgengine/wglog                                 from tailscale.com/wgengine
-        tailscale.com/wif                                            from tailscale.com/feature/identityfederation
         golang.org/x/crypto/argon2                                   from tailscale.com/tka
         golang.org/x/crypto/blake2b                                  from golang.org/x/crypto/argon2+
         golang.org/x/crypto/blake2s                                  from github.com/tailscale/wireguard-go/device+
@@ -414,16 +343,16 @@ tailscale.com/tsnet dependencies: (generated by github.com/tailscale/depaware)
         golang.org/x/net/dns/dnsmessage                              from tailscale.com/appc+
         golang.org/x/net/http/httpguts                               from tailscale.com/ipn/ipnlocal
         golang.org/x/net/http/httpproxy                              from tailscale.com/net/tshttpproxy
-        golang.org/x/net/icmp                                        from github.com/prometheus-community/pro-bing+
+        golang.org/x/net/icmp                                        from tailscale.com/net/ping
         golang.org/x/net/idna                                        from golang.org/x/net/http/httpguts+
         golang.org/x/net/internal/iana                               from golang.org/x/net/icmp+
-        golang.org/x/net/internal/socket                             from golang.org/x/net/icmp+
+        golang.org/x/net/internal/socket                             from golang.org/x/net/ipv4+
  LDW    golang.org/x/net/internal/socks                              from golang.org/x/net/proxy
-        golang.org/x/net/ipv4                                        from github.com/prometheus-community/pro-bing+
-        golang.org/x/net/ipv6                                        from github.com/prometheus-community/pro-bing+
+        golang.org/x/net/ipv4                                        from github.com/tailscale/wireguard-go/conn+
+        golang.org/x/net/ipv6                                        from github.com/tailscale/wireguard-go/conn+
  LDW    golang.org/x/net/proxy                                       from tailscale.com/net/netns
   DI    golang.org/x/net/route                                       from tailscale.com/net/netmon+
-        golang.org/x/oauth2                                          from golang.org/x/oauth2/clientcredentials+
+        golang.org/x/oauth2                                          from golang.org/x/oauth2/clientcredentials
         golang.org/x/oauth2/clientcredentials                        from tailscale.com/feature/oauthkey
         golang.org/x/oauth2/internal                                 from golang.org/x/oauth2+
         golang.org/x/sync/errgroup                                   from github.com/mdlayher/socket+
@@ -481,22 +410,22 @@ tailscale.com/tsnet dependencies: (generated by github.com/tailscale/depaware)
         crypto/internal/boring/bbig                                  from crypto/ecdsa+
         crypto/internal/boring/sig                                   from crypto/internal/boring
         crypto/internal/constanttime                                 from crypto/internal/fips140/edwards25519+
-        crypto/internal/fips140                                      from crypto/internal/fips140/aes+
+        crypto/internal/fips140                                      from crypto/fips140+
         crypto/internal/fips140/aes                                  from crypto/aes+
         crypto/internal/fips140/aes/gcm                              from crypto/cipher+
         crypto/internal/fips140/alias                                from crypto/cipher+
         crypto/internal/fips140/bigmod                               from crypto/internal/fips140/ecdsa+
-        crypto/internal/fips140/check                                from crypto/internal/fips140/aes+
-        crypto/internal/fips140/drbg                                 from crypto/internal/fips140/aes/gcm+
+        crypto/internal/fips140/check                                from crypto/fips140+
+        crypto/internal/fips140/drbg                                 from crypto/hpke+
         crypto/internal/fips140/ecdh                                 from crypto/ecdh
         crypto/internal/fips140/ecdsa                                from crypto/ecdsa
         crypto/internal/fips140/ed25519                              from crypto/ed25519
         crypto/internal/fips140/edwards25519                         from crypto/internal/fips140/ed25519
         crypto/internal/fips140/edwards25519/field                   from crypto/ecdh+
-        crypto/internal/fips140/hkdf                                 from crypto/internal/fips140/tls13+
+        crypto/internal/fips140/hkdf                                 from crypto/hkdf+
         crypto/internal/fips140/hmac                                 from crypto/hmac+
         crypto/internal/fips140/mlkem                                from crypto/mlkem
-        crypto/internal/fips140/nistec                               from crypto/elliptic+
+        crypto/internal/fips140/nistec                               from crypto/ecdsa+
         crypto/internal/fips140/nistec/fiat                          from crypto/internal/fips140/nistec
         crypto/internal/fips140/rsa                                  from crypto/rsa
         crypto/internal/fips140/sha256                               from crypto/internal/fips140/check+
@@ -526,12 +455,11 @@ tailscale.com/tsnet dependencies: (generated by github.com/tailscale/depaware)
         crypto/sha3                                                  from crypto/internal/fips140hash+
         crypto/sha512                                                from crypto/ecdsa+
         crypto/subtle                                                from crypto/cipher+
-        crypto/tls                                                   from github.com/prometheus-community/pro-bing+
+        crypto/tls                                                   from net/http+
         crypto/tls/internal/fips140tls                               from crypto/tls
         crypto/x509                                                  from crypto/tls+
   DI    crypto/x509/internal/macos                                   from crypto/x509
         crypto/x509/pkix                                             from crypto/x509+
-  DI    database/sql/driver                                          from github.com/google/uuid
    W    debug/dwarf                                                  from debug/pe
    W    debug/pe                                                     from github.com/dblohm7/wingoes/pe
         embed                                                        from github.com/tailscale/web-client-prebuilt+
@@ -551,6 +479,7 @@ tailscale.com/tsnet dependencies: (generated by github.com/tailscale/depaware)
         hash                                                         from crypto+
    W    hash/adler32                                                 from compress/zlib
         hash/crc32                                                   from compress/gzip+
+        hash/fnv                                                     from tailscale.com/net/traffic
         hash/maphash                                                 from go4.org/mem
         html                                                         from html/template+
  LDW    html/template                                                from tailscale.com/util/eventbus
@@ -565,15 +494,15 @@ tailscale.com/tsnet dependencies: (generated by github.com/tailscale/depaware)
         internal/filepathlite                                        from os+
         internal/fmtsort                                             from fmt+
         internal/goarch                                              from crypto/internal/fips140deps/cpu+
-        internal/godebug                                             from crypto/internal/fips140deps/godebug+
+        internal/godebug                                             from crypto/ed25519+
         internal/godebugs                                            from internal/godebug+
         internal/goexperiment                                        from net/http/pprof+
         internal/goos                                                from crypto/x509+
         internal/msan                                                from internal/runtime/maps+
         internal/nettrace                                            from net+
-        internal/oserror                                             from io/fs+
+        internal/oserror                                             from internal/syscall/windows+
         internal/poll                                                from net+
- LDW    internal/profile                                             from net/http/pprof
+        internal/profile                                             from net/http/pprof
         internal/profilerecord                                       from runtime+
         internal/race                                                from internal/poll+
         internal/reflectlite                                         from context+
@@ -581,9 +510,9 @@ tailscale.com/tsnet dependencies: (generated by github.com/tailscale/depaware)
         internal/runtime/atomic                                      from internal/runtime/exithook+
   LA    internal/runtime/cgroup                                      from runtime
         internal/runtime/exithook                                    from runtime
-        internal/runtime/gc                                          from runtime+
+        internal/runtime/gc                                          from internal/runtime/gc/scan+
         internal/runtime/gc/scan                                     from runtime
-        internal/runtime/maps                                        from reflect+
+        internal/runtime/maps                                        from hash/maphash+
         internal/runtime/math                                        from internal/runtime/maps+
         internal/runtime/pprof/label                                 from runtime+
         internal/runtime/sys                                         from crypto/subtle+
@@ -597,7 +526,7 @@ tailscale.com/tsnet dependencies: (generated by github.com/tailscale/depaware)
         internal/synctest                                            from sync
         internal/syscall/execenv                                     from os+
  LDAI    internal/syscall/unix                                        from crypto/internal/sysrand+
-   W    internal/syscall/windows                                     from crypto/internal/sysrand+
+   W    internal/syscall/windows                                     from crypto/internal/fips140deps/time+
    W    internal/syscall/windows/registry                            from mime+
    W    internal/syscall/windows/sysdll                              from internal/syscall/windows+
         internal/testlog                                             from os
@@ -605,7 +534,7 @@ tailscale.com/tsnet dependencies: (generated by github.com/tailscale/depaware)
         internal/unsafeheader                                        from internal/reflectlite+
         io                                                           from bufio+
         io/fs                                                        from crypto/x509+
-        io/ioutil                                                    from github.com/godbus/dbus/v5+
+        io/ioutil                                                    from github.com/huin/goupnp/soap+
         iter                                                         from bytes+
         log                                                          from expvar+
         log/internal                                                 from log
@@ -620,12 +549,12 @@ tailscale.com/tsnet dependencies: (generated by github.com/tailscale/depaware)
         mime/quotedprintable                                         from mime/multipart
         net                                                          from crypto/tls+
         net/http                                                     from expvar+
-        net/http/httptrace                                           from github.com/prometheus-community/pro-bing+
+        net/http/httptrace                                           from net/http+
         net/http/httputil                                            from tailscale.com/client/web+
         net/http/internal                                            from net/http+
         net/http/internal/ascii                                      from net/http+
         net/http/internal/httpcommon                                 from net/http
- LDW    net/http/pprof                                               from tailscale.com/ipn/localapi+
+        net/http/pprof                                               from tailscale.com/ipn/localapi+
         net/netip                                                    from crypto/x509+
         net/textproto                                                from github.com/coder/websocket+
         net/url                                                      from crypto/x509+
@@ -634,13 +563,13 @@ tailscale.com/tsnet dependencies: (generated by github.com/tailscale/depaware)
         os/user                                                      from github.com/godbus/dbus/v5+
         path                                                         from debug/dwarf+
         path/filepath                                                from crypto/x509+
-        reflect                                                      from database/sql/driver+
+        reflect                                                      from encoding/asn1+
         regexp                                                       from github.com/huin/goupnp/httpu+
         regexp/syntax                                                from regexp
         runtime                                                      from crypto/internal/fips140+
-        runtime/debug                                                from github.com/coder/websocket/internal/xsync+
+        runtime/debug                                                from github.com/klauspost/compress/zstd+
         runtime/pprof                                                from net/http/pprof+
- LDW    runtime/trace                                                from net/http/pprof
+        runtime/trace                                                from net/http/pprof
         slices                                                       from crypto/tls+
         sort                                                         from compress/flate+
         strconv                                                      from compress/flate+
diff --git a/tsnet/example/ssh-game/README.md b/tsnet/example/ssh-game/README.md
new file mode 100644
index 000000000..6fc0c598e
--- /dev/null
+++ b/tsnet/example/ssh-game/README.md
@@ -0,0 +1,13 @@
+<!-- README.md auto-generated by misc/genreadme; DO NOT EDIT. (or remove this line) -->
+
+# ssh-game
+
+The ssh-game server demonstrates how to use tsnet's ListenSSH to build a custom SSH application. It runs a simple "guess the number" game.
+
+Usage:
+
+	go run ./tsnet/example/ssh-game
+
+Then from another Tailscale node:
+
+	ssh -p 2222 <hostname>
diff --git a/tsnet/example/ssh-game/ssh-game.go b/tsnet/example/ssh-game/ssh-game.go
new file mode 100644
index 000000000..23d5d3d60
--- /dev/null
+++ b/tsnet/example/ssh-game/ssh-game.go
@@ -0,0 +1,92 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build (linux && !android) || (darwin && !ios) || freebsd || openbsd || plan9
+
+// The ssh-game server demonstrates how to use tsnet's ListenSSH to build
+// a custom SSH application. It runs a simple "guess the number" game.
+//
+// Usage:
+//
+//	go run ./tsnet/example/ssh-game
+//
+// Then from another Tailscale node:
+//
+//	ssh -p 2222 <hostname>
+package main
+
+import (
+	"bufio"
+	"fmt"
+	"log"
+	"math/rand/v2"
+	"net"
+	"strings"
+
+	_ "tailscale.com/feature/ssh"
+	"tailscale.com/ssh/tailssh"
+	"tailscale.com/tsnet"
+)
+
+func main() {
+	s := &tsnet.Server{
+		Hostname: "ssh-game",
+	}
+	defer s.Close()
+
+	ln, err := s.ListenSSH(":2222")
+	if err != nil {
+		log.Fatal(err)
+	}
+	defer ln.Close()
+	log.Println("Listening on :2222")
+
+	for {
+		conn, err := ln.Accept()
+		if err != nil {
+			log.Fatal(err)
+		}
+		go handleGame(conn)
+	}
+}
+
+func handleGame(c net.Conn) {
+	sess, ok := c.(*tailssh.Session)
+	if !ok {
+		fmt.Fprintf(c, "unexpected connection type\n")
+		c.Close()
+		return
+	}
+	defer sess.Exit(0)
+
+	target := rand.IntN(100) + 1
+	scanner := bufio.NewScanner(sess)
+
+	fmt.Fprintf(sess, "Welcome, %s from %s!\r\n",
+		sess.UserProfile().LoginName,
+		sess.Peer().ComputedName())
+	fmt.Fprintf(sess, "I'm thinking of a number between 1 and 100.\r\n")
+	fmt.Fprintf(sess, "Can you guess it?\r\n\r\n")
+
+	for attempts := 1; ; attempts++ {
+		fmt.Fprintf(sess, "Your guess: ")
+		if !scanner.Scan() {
+			return
+		}
+		line := strings.TrimSpace(scanner.Text())
+		var guess int
+		if _, err := fmt.Sscanf(line, "%d", &guess); err != nil {
+			fmt.Fprintf(sess, "Please enter a number.\r\n")
+			continue
+		}
+		switch {
+		case guess < target:
+			fmt.Fprintf(sess, "Higher!\r\n")
+		case guess > target:
+			fmt.Fprintf(sess, "Lower!\r\n")
+		default:
+			fmt.Fprintf(sess, "Correct! You got it in %d attempts.\r\n", attempts)
+			return
+		}
+	}
+}
diff --git a/tsnet/example/tshello/README.md b/tsnet/example/tshello/README.md
new file mode 100644
index 000000000..5d9d81829
--- /dev/null
+++ b/tsnet/example/tshello/README.md
@@ -0,0 +1,5 @@
+<!-- README.md auto-generated by misc/genreadme; DO NOT EDIT. (or remove this line) -->
+
+# tshello
+
+The tshello server demonstrates how to use Tailscale as a library.
diff --git a/tsnet/example/tsnet-funnel/README.md b/tsnet/example/tsnet-funnel/README.md
new file mode 100644
index 000000000..2b3031bed
--- /dev/null
+++ b/tsnet/example/tsnet-funnel/README.md
@@ -0,0 +1,9 @@
+<!-- README.md auto-generated by misc/genreadme; DO NOT EDIT. (or remove this line) -->
+
+# tsnet-funnel
+
+The tsnet-funnel server demonstrates how to use tsnet with Funnel.
+
+To use it, generate an auth key from the Tailscale admin panel and run the demo with the key:
+
+	TS_AUTHKEY=<yourkey> go run tsnet-funnel.go
diff --git a/tsnet/example/tsnet-http-client/README.md b/tsnet/example/tsnet-http-client/README.md
new file mode 100644
index 000000000..24aba97c8
--- /dev/null
+++ b/tsnet/example/tsnet-http-client/README.md
@@ -0,0 +1,5 @@
+<!-- README.md auto-generated by misc/genreadme; DO NOT EDIT. (or remove this line) -->
+
+# tsnet-http-client
+
+The tshello server demonstrates how to use Tailscale as a library.
diff --git a/tsnet/example/tsnet-services/README.md b/tsnet/example/tsnet-services/README.md
new file mode 100644
index 000000000..18bc072d7
--- /dev/null
+++ b/tsnet/example/tsnet-services/README.md
@@ -0,0 +1,32 @@
+<!-- README.md auto-generated by misc/genreadme; DO NOT EDIT. (or remove this line) -->
+
+# tsnet-services
+
+The tsnet-services example demonstrates how to use tsnet with Services.
+
+To run this example yourself:
+
+ 1. Add access controls which (i) define a new ACL tag, (ii) allow the demo node to host the Service, and (iii) allow peers on the tailnet to reach the Service. A sample ACL policy is provided below.
+ 2. [Generate an auth key](https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key) using the Tailscale admin panel. When doing so, add your new tag to your key (Service hosts must be tagged nodes).
+ 3. [Define a Service](https://tailscale.com/kb/1552/tailscale-services#step-1-define-a-tailscale-service). For the purposes of this demo, it must be defined to listen on TCP port 443. Note that you only need to follow Step 1 in the linked document.
+ 4. Run the demo on the command line (step 4 command shown below).
+
+Command for step 4:
+
+	TS_AUTHKEY=<yourkey> go run tsnet-services.go -service <service-name>
+
+The following is a sample ACL policy for step 1:
+
+	"tagOwners": {
+	   "tag:tsnet-demo-host": ["autogroup:member"],
+	},
+	"autoApprovers": {
+	   "services": {
+	      "svc:tsnet-demo": ["tag:tsnet-demo-host"],
+	   },
+	},
+	"grants": [
+	   "src": ["*"],
+	   "dst": ["svc:tsnet-demo"],
+	   "ip": ["*"],
+	],
diff --git a/tsnet/example/tsnet-services/tsnet-services.go b/tsnet/example/tsnet-services/tsnet-services.go
index d72fd68fd..4604e8d3f 100644
--- a/tsnet/example/tsnet-services/tsnet-services.go
+++ b/tsnet/example/tsnet-services/tsnet-services.go
@@ -8,17 +8,16 @@
 //  1. Add access controls which (i) define a new ACL tag, (ii) allow the demo
 //     node to host the Service, and (iii) allow peers on the tailnet to reach
 //     the Service. A sample ACL policy is provided below.
-//
 //  2. [Generate an auth key] using the Tailscale admin panel. When doing so, add
 //     your new tag to your key (Service hosts must be tagged nodes).
-//
 //  3. [Define a Service]. For the purposes of this demo, it must be defined to
 //     listen on TCP port 443. Note that you only need to follow Step 1 in the
 //     linked document.
+//  4. Run the demo on the command line (step 4 command shown below).
 //
-//  4. Run the demo on the command line:
+// Command for step 4:
 //
-//     TS_AUTHKEY=<yourkey> go run tsnet-services.go -service <service-name>
+//	TS_AUTHKEY=<yourkey> go run tsnet-services.go -service <service-name>
 //
 // The following is a sample ACL policy for step 1:
 //
diff --git a/tsnet/example/web-client/README.md b/tsnet/example/web-client/README.md
new file mode 100644
index 000000000..6b4c42235
--- /dev/null
+++ b/tsnet/example/web-client/README.md
@@ -0,0 +1,5 @@
+<!-- README.md auto-generated by misc/genreadme; DO NOT EDIT. (or remove this line) -->
+
+# web-client
+
+The web-client command demonstrates serving the Tailscale web client over tsnet.
diff --git a/tsnet/listenssh_test.go b/tsnet/listenssh_test.go
new file mode 100644
index 000000000..eb3384aa8
--- /dev/null
+++ b/tsnet/listenssh_test.go
@@ -0,0 +1,121 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build (linux && !android) || (darwin && !ios) || freebsd || openbsd || plan9
+
+package tsnet
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	gossh "golang.org/x/crypto/ssh"
+
+	_ "tailscale.com/feature/ssh"
+	"tailscale.com/ssh/tailssh"
+	"tailscale.com/tstest"
+)
+
+// TestListenSSH starts two tsnet nodes on a test tailnet, has one listen
+// for SSH via ListenSSH, and has the other connect using the Go
+// x/crypto/ssh client. The server verifies the command string and echoes
+// back the connecting peer's login name, verifying that WhoIs and
+// Peer/UserProfile work end-to-end.
+func TestListenSSH(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 90*time.Second)
+	defer cancel()
+
+	controlURL, _ := startControl(t)
+	srvNode, srvIP, _ := startServer(t, ctx, controlURL, "sshsrv")
+	clientNode, clientIP, _ := startServer(t, ctx, controlURL, "sshclient")
+
+	// Listen for SSH on srvNode.
+	ln, err := srvNode.ListenSSH(":22")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { ln.Close() })
+
+	// Server goroutine: verify the command, then write the peer's login name back.
+	srvErrCh := make(chan error, 1)
+	go func() {
+		conn, err := ln.Accept()
+		if err != nil {
+			srvErrCh <- err
+			return
+		}
+		sess := conn.(*tailssh.Session)
+		defer sess.Exit(0)
+		if got := sess.RawCommand(); got != "test-whoami" {
+			srvErrCh <- fmt.Errorf("server got command %q, want %q", got, "test-whoami")
+			return
+		}
+		fmt.Fprintf(sess, "%s\n", sess.UserProfile().LoginName)
+		srvErrCh <- nil
+	}()
+
+	// Wait until srvNode knows about clientNode so WhoIs succeeds when the
+	// SSH connection arrives.
+	if err := tstest.WaitFor(30*time.Second, func() error {
+		lc, err := srvNode.LocalClient()
+		if err != nil {
+			return err
+		}
+		st, err := lc.Status(ctx)
+		if err != nil {
+			return err
+		}
+		for _, peer := range st.Peer {
+			if slices.Contains(peer.TailscaleIPs, clientIP) {
+				return nil
+			}
+		}
+		return errors.New("clientNode not yet in srvNode's netmap")
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	// Dial srvNode's SSH listener from clientNode's Tailscale network.
+	addr := net.JoinHostPort(srvIP.String(), "22")
+	tcpConn, err := clientNode.Dial(ctx, "tcp", addr)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// gliderssh defaults to NoClientAuth when no auth handler is registered,
+	// so no Auth methods are needed.
+	sshConn, chans, reqs, err := gossh.NewClientConn(tcpConn, addr, &gossh.ClientConfig{
+		User:            "test",
+		HostKeyCallback: gossh.InsecureIgnoreHostKey(),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	sshClient := gossh.NewClient(sshConn, chans, reqs)
+	defer sshClient.Close()
+
+	session, err := sshClient.NewSession()
+	if err != nil {
+		t.Fatal(err)
+	}
+	out, err := session.Output("test-whoami")
+	if err != nil {
+		t.Fatalf("session.Output: %v", err)
+	}
+
+	loginName := strings.TrimSpace(string(out))
+	if loginName == "" {
+		t.Error("SSH server returned empty login name; WhoIs or Peer/UserProfile may be broken")
+	}
+	t.Logf("peer login name from SSH server: %q", loginName)
+
+	if err := <-srvErrCh; err != nil {
+		t.Errorf("SSH server goroutine: %v", err)
+	}
+}
diff --git a/tsnet/maybe_acme.go b/tsnet/maybe_acme.go
new file mode 100644
index 000000000..41941a0a0
--- /dev/null
+++ b/tsnet/maybe_acme.go
@@ -0,0 +1,12 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !js && !ts_omit_acme
+
+package tsnet
+
+// Link in the ACME/TLS-cert feature so [Server.CertDomains],
+// [Server.ListenTLS], and related cert-fetch paths work out of the box.
+// Build with the ts_omit_acme tag to omit it.
+
+import _ "tailscale.com/feature/acme"
diff --git a/tsnet/packet_filter_test.go b/tsnet/packet_filter_test.go
index ca776436e..a34a01a5c 100644
--- a/tsnet/packet_filter_test.go
+++ b/tsnet/packet_filter_test.go
@@ -12,7 +12,6 @@ import (
 
 	"tailscale.com/ipn"
 	"tailscale.com/tailcfg"
-	"tailscale.com/tstest"
 	"tailscale.com/types/ipproto"
 	"tailscale.com/types/key"
 	"tailscale.com/types/netmap"
@@ -20,26 +19,23 @@ import (
 	"tailscale.com/wgengine/filter"
 )
 
-// waitFor blocks until a NetMap is seen on the IPN bus that satisfies the given
-// function f. Note: has no timeout, should be called with a ctx that has an
-// appropriate timeout set.
+// waitFor blocks until the LocalBackend's current netmap satisfies the given
+// function f. It uses a bus subscription to wake up on netmap and peer-mutation
+// events rather than polling. Note: it has no timeout and should be called with
+// a ctx that has an appropriate timeout set.
 func waitFor(t testing.TB, ctx context.Context, s *Server, f func(*netmap.NetworkMap) bool) error {
 	t.Helper()
-	watcher, err := s.localClient.WatchIPNBus(ctx, ipn.NotifyInitialNetMap)
+	w, err := s.localClient.WatchIPNBus(ctx, ipn.NotifyInitialState|ipn.NotifyPeerChanges)
 	if err != nil {
-		t.Fatalf("error watching IPN bus: %s", err)
+		return fmt.Errorf("watching IPN bus: %w", err)
 	}
-	defer watcher.Close()
-
+	defer w.Close()
 	for {
-		n, err := watcher.Next()
-		if err != nil {
-			return fmt.Errorf("getting next ipn.Notify from IPN bus: %w", err)
+		if nm := s.lb.NetMapWithPeers(); nm != nil && f(nm) {
+			return nil
 		}
-		if n.NetMap != nil {
-			if f(n.NetMap) {
-				return nil
-			}
+		if _, err := w.Next(); err != nil {
+			return fmt.Errorf("waiting for netmap: %w", err)
 		}
 	}
 }
@@ -48,7 +44,6 @@ func waitFor(t testing.TB, ctx context.Context, s *Server, f func(*netmap.Networ
 // netmaps and turning them into packet filters together. Only the control-plane
 // side is mocked out.
 func TestPacketFilterFromNetmap(t *testing.T) {
-	tstest.Shard(t)
 	t.Parallel()
 
 	var key key.NodePublic
@@ -192,7 +187,7 @@ func TestPacketFilterFromNetmap(t *testing.T) {
 			controlURL, c := startControl(t)
 			s, _, pubKey := startServer(t, ctx, controlURL, "node")
 
-			if test.waitTest(s.lb.NetMap()) {
+			if test.waitTest(s.lb.NetMapWithPeers()) {
 				t.Fatal("waitTest already passes before sending initial netmap: this will be flaky")
 			}
 
@@ -204,7 +199,7 @@ func TestPacketFilterFromNetmap(t *testing.T) {
 				t.Fatalf("waitFor: %s", err)
 			}
 
-			pf := s.lb.GetFilterForTest()
+			pf := s.lb.ForTest().GetFilter()
 
 			for _, check := range test.checks {
 				got := pf.Check(netip.MustParseAddr(check.src), netip.MustParseAddr(check.dst), check.port, ipproto.TCP)
@@ -223,7 +218,7 @@ func TestPacketFilterFromNetmap(t *testing.T) {
 					t.Fatal("incrementalWaitTest must be set if incrementalMapResponse is set")
 				}
 
-				if test.incrementalWaitTest(s.lb.NetMap()) {
+				if test.incrementalWaitTest(s.lb.NetMapWithPeers()) {
 					t.Fatal("incrementalWaitTest already passes before sending incremental netmap: this will be flaky")
 				}
 
@@ -235,7 +230,7 @@ func TestPacketFilterFromNetmap(t *testing.T) {
 					t.Fatalf("waitFor: %s", err)
 				}
 
-				pf := s.lb.GetFilterForTest()
+				pf := s.lb.ForTest().GetFilter()
 
 				for _, check := range test.checks {
 					got := pf.Check(netip.MustParseAddr(check.src), netip.MustParseAddr(check.dst), check.port, ipproto.TCP)
diff --git a/tsnet/tailnetlock_test.go b/tsnet/tailnetlock_test.go
new file mode 100644
index 000000000..397578bfd
--- /dev/null
+++ b/tsnet/tailnetlock_test.go
@@ -0,0 +1,403 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package tsnet
+
+// These tests pin down that Tailnet Lock's signature filter
+// ([LocalBackend.tkaFilterNetmapLocked] on full netmaps, and
+// [LocalBackend.tkaFilterDeltaMutsLocked] on netmap deltas) catches
+// unsigned and invalidly-signed peers arriving via the netmap delta
+// path. The tsnet package is a slightly awkward home for them: the
+// behavior under test lives in [ipn/ipnlocal], not in tsnet itself.
+// They live here because:
+//
+//   - tsnet has the right harness: a real [tsnet.Server] joined to a
+//     [testcontrol.Server], with a working noise channel for the
+//     /machine/tka/* RPC dance that enables Tailnet Lock and signs the
+//     local node key. Standing the equivalent up directly under
+//     [ipn/ipnlocal] would mean recreating large parts of that.
+//
+//   - [ipn/ipnlocal/tailnet-lock_test.go] tests
+//     [tkaFilterNetmapLocked] against a hand-built netmap, but doesn't
+//     exercise the wire path through [controlclient] and
+//     [LocalBackend.UpdateNetmapDelta] where these regressions
+//     actually surface.
+//
+//   - [tstest/integration] does drive a real tailscaled but its harness
+//     is heavier (forking the binary, no [testcontrol.Server.AddRawMapResponse]
+//     hook), and we want the precision of synthetic delta injection.
+//
+// If a smaller harness ever lands that lets [ipn/ipnlocal] tests drive
+// the full controlclient->LocalBackend pipe with raw MapResponses,
+// these tests should move there.
+
+import (
+	"bytes"
+	"context"
+	"net/netip"
+	"testing"
+	"time"
+
+	"tailscale.com/tailcfg"
+	"tailscale.com/tka"
+	"tailscale.com/tstest"
+	"tailscale.com/tstest/integration/testcontrol"
+	"tailscale.com/types/key"
+	"tailscale.com/types/netmap"
+	"tailscale.com/types/tkatype"
+	"tailscale.com/util/must"
+)
+
+// setupTailnetLockedServer brings up a tsnet [Server] under a testcontrol
+// [Server] with Tailnet Lock enabled and ready to take injected raw
+// [tailcfg.MapResponse]s. The returned *Server has:
+//
+//   - the [tailcfg.CapabilityTailnetLock] capability on its self node,
+//   - Tailnet Lock initialized with trustedKeys (always including the
+//     self node's own NL public key, plus any extras the caller supplies),
+//   - a valid self [tailcfg.Node.KeySignature], and
+//     [netmap.NetworkMap.TKAEnabled] true, so [LocalBackend.tkaFilterNetmapLocked]
+//     is wired up and would catch unsigned peers if invoked on subsequent
+//     deltas, and
+//   - control's auto-MapResponse generation suppressed: from here on, only
+//     raw responses the caller pushes via [testcontrol.Server.AddRawMapResponse]
+//     reach the node.
+//
+// Tests for Tailnet Lock's interaction with the delta path build on top of
+// this helper and only need to inject the specific delta they want to
+// exercise.
+func setupTailnetLockedServer(t *testing.T, ctx context.Context, extraTrustedKeys ...tka.Key) (s *Server, control *testcontrol.Server, s1Key key.NodePublic) {
+	t.Helper()
+	controlURL, control := startControl(t)
+
+	// Hand out the tailnet-lock capability so the server can call
+	// TailnetLockInit.
+	control.DefaultNodeCapabilities = &tailcfg.NodeCapMap{
+		tailcfg.CapabilityTailnetLock: nil,
+	}
+
+	s, _, s1Key = startServer(t, ctx, controlURL, "s1")
+
+	// Enable Tailnet Lock with the node's own NL public key plus any
+	// extras the caller supplied. This drives the /machine/tka/init/{begin,
+	// finish} dance against testcontrol; on finish, control stores a valid
+	// KeySignature for the node and the next auto-generated MapResponse
+	// will carry TKAInfo + the signature.
+	lc := must.Get(s.LocalClient())
+	tkaStatus := must.Get(lc.TailnetLockStatus(ctx))
+	trustedKeys := append([]tka.Key{
+		{Kind: tka.Key25519, Public: tkaStatus.PublicKey.Verifier(), Votes: 2},
+	}, extraTrustedKeys...)
+	disablementSecret := bytes.Repeat([]byte{0xa5}, 32)
+	if _, err := lc.TailnetLockInit(ctx, trustedKeys,
+		[][]byte{tka.DisablementKDF(disablementSecret)}, nil); err != nil {
+		t.Fatalf("TailnetLockInit: %v", err)
+	}
+
+	// testcontrol's serveTKAInitFinish stores signatures but doesn't wake
+	// up the streaming map long-poll. Re-publish the node to wake it, so
+	// the next MapResponse carries TKAInfo + the new self KeySignature.
+	control.UpdateNode(control.Node(s1Key))
+
+	// Wait for the node to receive the netmap that turns Tailnet Lock on
+	// and carries a valid self-node signature. At that point
+	// [LocalBackend.tkaSyncIfNeeded] has bootstrapped b.tka locally, so
+	// any subsequent peer arrival is subject to tkaFilterNetmapLocked
+	// when it goes through the full-netmap path.
+	if err := waitFor(t, ctx, s, func(nm *netmap.NetworkMap) bool {
+		return nm.TKAEnabled && nm.SelfNode.KeySignature().Len() > 0
+	}); err != nil {
+		t.Fatalf("waitFor s1 to enable Tailnet Lock: %v", err)
+	}
+
+	// Switch the node into manual MapResponse mode so any further peer
+	// state can only reach it via raw responses the caller injects.
+	if !control.AddRawMapResponse(s1Key, &tailcfg.MapResponse{}) {
+		t.Fatal("AddRawMapResponse(s1, empty): node not connected")
+	}
+	return s, control, s1Key
+}
+
+// signNodeKeyForTest signs nodeKey with nlPriv. It is a copy of the
+// (unexported) signNodeKey in ipn/ipnlocal/tailnet-lock.go, replicated
+// here so tsnet tests can mint valid signatures without cyclically
+// depending on ipnlocal internals.
+func signNodeKeyForTest(t *testing.T, nodeKey key.NodePublic, nlPriv key.NLPrivate) tkatype.MarshaledSignature {
+	t.Helper()
+	pub, err := nodeKey.MarshalBinary()
+	if err != nil {
+		t.Fatal(err)
+	}
+	sig := tka.NodeKeySignature{
+		SigKind: tka.SigDirect,
+		KeyID:   nlPriv.KeyID(),
+		Pubkey:  pub,
+	}
+	sig.Signature, err = nlPriv.SignNKS(sig.SigHash())
+	if err != nil {
+		t.Fatalf("SignNKS: %v", err)
+	}
+	return sig.Serialize()
+}
+
+// signedMarkerPeer constructs a fresh Node signed by nlPriv, suitable
+// for use as a delta-sync sentinel: tests can append it to a
+// [tailcfg.MapResponse.PeersChanged] alongside the actual fixture and
+// then waitFor the marker key to appear in nm.Peers. Because the
+// MapResponse delivers all entries atomically as a single delta,
+// observing the marker proves the preceding entries in the same
+// PeersChanged batch have already been processed end-to-end through
+// [LocalBackend.UpdateNetmapDelta]. That makes the absence-of-fixture
+// assertion race-free without having to wait a fixed timeout for
+// "nothing to happen".
+func signedMarkerPeer(t *testing.T, nlPriv key.NLPrivate) *tailcfg.Node {
+	t.Helper()
+	markerKey := key.NewNode().Public()
+	markerAddr := netip.MustParsePrefix("100.64.99.250/32")
+	return &tailcfg.Node{
+		ID:                tailcfg.NodeID(10000),
+		StableID:          tailcfg.StableNodeID("TESTMARKER0000001"),
+		Name:              "marker.test.",
+		Key:               markerKey,
+		Machine:           key.NewMachine().Public(),
+		DiscoKey:          key.NewDisco().Public(),
+		Addresses:         []netip.Prefix{markerAddr},
+		AllowedIPs:        []netip.Prefix{markerAddr},
+		MachineAuthorized: true,
+		KeySignature:      signNodeKeyForTest(t, markerKey, nlPriv),
+	}
+}
+
+// injectPeersChangedAndAssertFiltered pushes badPeer alongside a fresh
+// signed marker peer in a single [tailcfg.MapResponse.PeersChanged]
+// batch, then waits for the marker to land in s's netmap. Observing
+// the marker means the whole batch was applied end-to-end through
+// [LocalBackend.UpdateNetmapDelta], so the helper can then make a
+// race-free assertion that badPeer.Key is absent from
+// [LocalBackend.NetMapWithPeers]. markerNL must be a private NL key
+// whose public verifier is trusted by the tailnet-lock state on s
+// (e.g. an extra key passed to [setupTailnetLockedServer]).
+func injectPeersChangedAndAssertFiltered(t *testing.T, ctx context.Context, s *Server, control *testcontrol.Server, dst key.NodePublic, badPeer *tailcfg.Node, markerNL key.NLPrivate) {
+	t.Helper()
+	marker := signedMarkerPeer(t, markerNL)
+	if !control.AddRawMapResponse(dst, &tailcfg.MapResponse{
+		PeersChanged: []*tailcfg.Node{badPeer, marker},
+	}) {
+		t.Fatal("AddRawMapResponse(PeersChanged): node not connected")
+	}
+	if err := waitFor(t, ctx, s, func(nm *netmap.NetworkMap) bool {
+		for _, p := range nm.Peers {
+			if p.Key() == marker.Key {
+				return true
+			}
+		}
+		return false
+	}); err != nil {
+		t.Fatalf("waitFor marker peer to land: %v", err)
+	}
+	for _, p := range s.lb.NetMapWithPeers().Peers {
+		if p.Key() == badPeer.Key {
+			t.Fatalf("peer %q (key %v, KeySignature.Len=%d) leaked into s.NetMap.Peers via PeersChanged delta path; Tailnet Lock filter not applied to deltas",
+				badPeer.Name, badPeer.Key, p.KeySignature().Len())
+		}
+	}
+
+	// Verify TailnetLockStatus via LocalAPI: the bad peer must appear
+	// in FilteredPeers.
+	lc := must.Get(s.LocalClient())
+	st := must.Get(lc.TailnetLockStatus(ctx))
+	var badInFiltered bool
+	for _, fp := range st.FilteredPeers {
+		if fp.NodeKey == badPeer.Key {
+			badInFiltered = true
+			break
+		}
+	}
+	if !badInFiltered {
+		t.Errorf("TailnetLockStatus().FilteredPeers does not contain bad peer %v; got %d entries", badPeer.Key, len(st.FilteredPeers))
+	}
+}
+
+// TestTailnetLockFiltersUnsignedDeltaPeer verifies that with Tailnet Lock
+// enabled, an unsigned peer arriving via [tailcfg.MapResponse.PeersChanged]
+// is dropped from the local netmap, just like one arriving in a full
+// [tailcfg.MapResponse.Peers] list.
+//
+// Background: [LocalBackend.tkaFilterNetmapLocked] is the canonical
+// chokepoint for Tailnet Lock; it runs on full netmaps via
+// [LocalBackend.setClientStatusLocked]. The delta-path equivalent is
+// [LocalBackend.UpdateNetmapDelta], which routes peer
+// adds/removes/patches through [nodeBackend.UpdateNetmapDelta] directly.
+// This test pins down that the delta path stays subject to the tailnet
+// lock filter: a fresh peer that ships as a [netmap.NodeMutationUpsert]
+// must not reach [LocalBackend.NetMapWithPeers] without a verifying
+// [tailcfg.Node.KeySignature].
+//
+// Updates #12542
+// Updates tailscale/corp#43767
+func TestTailnetLockFiltersUnsignedDeltaPeer(t *testing.T) {
+	tstest.ResourceCheck(t)
+	ctx, cancel := context.WithTimeout(t.Context(), 120*time.Second)
+	defer cancel()
+
+	// Trust an extra NL key the test holds so it can mint signed marker
+	// peers for delta-sync below.
+	markerNL := key.NewNLPrivate()
+	s1, control, s1Key := setupTailnetLockedServer(t, ctx, tka.Key{
+		Kind:   tka.Key25519,
+		Public: markerNL.Public().Verifier(),
+		Votes:  2,
+	})
+
+	// Build a fake peer Node with no KeySignature. testcontrol's normal
+	// Node-registration path doesn't apply here -- we want a peer that
+	// only ever exists as a PeersChanged delta entry, never as part of
+	// a full netmap that would go through tkaFilterNetmapLocked.
+	unsignedAddr := netip.MustParsePrefix("100.64.99.42/32")
+	unsignedNode := &tailcfg.Node{
+		ID:                tailcfg.NodeID(9999),
+		StableID:          tailcfg.StableNodeID("TESTUNSIGNED0001"),
+		Name:              "unsigned.test.",
+		Key:               key.NewNode().Public(),
+		Machine:           key.NewMachine().Public(),
+		DiscoKey:          key.NewDisco().Public(),
+		Addresses:         []netip.Prefix{unsignedAddr},
+		AllowedIPs:        []netip.Prefix{unsignedAddr},
+		MachineAuthorized: true,
+		// KeySignature intentionally omitted: Tailnet Lock must drop this.
+	}
+	injectPeersChangedAndAssertFiltered(t, ctx, s1, control, s1Key, unsignedNode, markerNL)
+}
+
+// TestTailnetLockFiltersUnsignedDeltaPeerReplacement verifies that with
+// Tailnet Lock enabled, replacing a previously-signed peer via
+// [tailcfg.MapResponse.PeersChanged] with an unsigned copy causes that
+// peer to drop from the local netmap, instead of lingering in
+// [LocalBackend.NetMapWithPeers].
+//
+// This is structurally distinct from
+// [TestTailnetLockFiltersUnsignedDeltaPeer] in that the peer already
+// existed with a valid signature. The replacement strips the signature
+// alongside a non-patchable field change ([tailcfg.Node.Name]) so that
+// [mapSession.patchifyPeer] refuses to convert the entry to a
+// [tailcfg.PeersChangedPatch] -- it stays in PeersChanged and reaches
+// the local backend as a [netmap.NodeMutationUpsert], the same delta
+// shape that
+// [TestTailnetLockFiltersUnsignedDeltaPeer] exercises for an add but
+// here applied to a swap-in of an unsigned replacement.
+//
+// Updates #12542
+// Updates tailscale/corp#43767
+func TestTailnetLockFiltersUnsignedDeltaPeerReplacement(t *testing.T) {
+	tstest.ResourceCheck(t)
+	ctx, cancel := context.WithTimeout(t.Context(), 120*time.Second)
+	defer cancel()
+
+	// Trust an extra NL key the test holds, so the test can mint valid
+	// signatures for the fake peer without colluding with the node's
+	// own NL private key (which lives only in s1's prefs).
+	testNL := key.NewNLPrivate()
+	s1, control, s1Key := setupTailnetLockedServer(t, ctx, tka.Key{
+		Kind:   tka.Key25519,
+		Public: testNL.Public().Verifier(),
+		Votes:  2,
+	})
+
+	// Fake peer Node, signed by the test's extra trusted NL key.
+	peerNodeKey := key.NewNode().Public()
+	peerAddr := netip.MustParsePrefix("100.64.99.43/32")
+	peerID := tailcfg.NodeID(9998)
+	signedSig := signNodeKeyForTest(t, peerNodeKey, testNL)
+	signedNode := &tailcfg.Node{
+		ID:                peerID,
+		StableID:          tailcfg.StableNodeID("TESTPEER00000001"),
+		Name:              "peer.test.",
+		Key:               peerNodeKey,
+		Machine:           key.NewMachine().Public(),
+		DiscoKey:          key.NewDisco().Public(),
+		Addresses:         []netip.Prefix{peerAddr},
+		AllowedIPs:        []netip.Prefix{peerAddr},
+		MachineAuthorized: true,
+		KeySignature:      signedSig,
+	}
+
+	// Inject the signed peer via PeersChanged, then wait for it to land
+	// in s1's netmap with a valid KeySignature.
+	if !control.AddRawMapResponse(s1Key, &tailcfg.MapResponse{
+		PeersChanged: []*tailcfg.Node{signedNode},
+	}) {
+		t.Fatal("AddRawMapResponse(s1, signed peer): node not connected")
+	}
+	if err := waitFor(t, ctx, s1, func(nm *netmap.NetworkMap) bool {
+		for _, p := range nm.Peers {
+			if p.Key() == peerNodeKey && p.KeySignature().Len() > 0 {
+				return true
+			}
+		}
+		return false
+	}); err != nil {
+		t.Fatalf("waitFor signed peer to land in s1 netmap: %v", err)
+	}
+
+	// Now inject a replacement Node for the same peer ID with no
+	// KeySignature and a non-patchable diff ([tailcfg.Node.Name]).
+	// [mapSession.patchifyPeer] treats Name as an unpatchable field,
+	// so the entry stays in [tailcfg.MapResponse.PeersChanged] and
+	// reaches [LocalBackend.UpdateNetmapDelta] as a
+	// [netmap.NodeMutationUpsert] of an unsigned Node, overwriting
+	// the previously-signed [nodeBackend.peers] entry.
+	replacement := signedNode.Clone()
+	replacement.KeySignature = nil
+	replacement.Name = "peer-renamed.test."
+	injectPeersChangedAndAssertFiltered(t, ctx, s1, control, s1Key, replacement, testNL)
+}
+
+// TestTailnetLockFiltersDeltaPeerWithInvalidSignature verifies that with
+// Tailnet Lock enabled, a peer arriving via
+// [tailcfg.MapResponse.PeersChanged] with a non-empty but invalid
+// [tailcfg.Node.KeySignature] is dropped from the local netmap.
+//
+// This is the verify-side counterpart to
+// [TestTailnetLockFiltersUnsignedDeltaPeer], which covers the
+// length-zero case: the same delta-path filter must also reject a
+// signature blob that fails [tka.Authority.NodeKeyAuthorized] -- e.g.
+// garbage bytes, a signature for a different node key, or a signature
+// the local trust state doesn't accept.
+//
+// Updates #12542
+// Updates tailscale/corp#43767
+func TestTailnetLockFiltersDeltaPeerWithInvalidSignature(t *testing.T) {
+	tstest.ResourceCheck(t)
+	ctx, cancel := context.WithTimeout(t.Context(), 120*time.Second)
+	defer cancel()
+
+	testNL := key.NewNLPrivate()
+	s1, control, s1Key := setupTailnetLockedServer(t, ctx, tka.Key{
+		Kind:   tka.Key25519,
+		Public: testNL.Public().Verifier(),
+		Votes:  2,
+	})
+
+	// Construct a peer Node with a non-empty but unverifiable
+	// KeySignature. The bytes are well-formed enough to round-trip
+	// through JSON but [tka.NodeKeySignature.Unserialize] (called
+	// from [tka.Authority.NodeKeyAuthorized]) will reject them.
+	// That hits the verify-failure branch of
+	// [LocalBackend.tkaFilterDeltaMutsLocked] rather than the
+	// length-zero branch exercised by
+	// [TestTailnetLockFiltersUnsignedDeltaPeer].
+	badSigAddr := netip.MustParsePrefix("100.64.99.44/32")
+	badSigNode := &tailcfg.Node{
+		ID:                tailcfg.NodeID(9997),
+		StableID:          tailcfg.StableNodeID("TESTBADSIG000001"),
+		Name:              "badsig.test.",
+		Key:               key.NewNode().Public(),
+		Machine:           key.NewMachine().Public(),
+		DiscoKey:          key.NewDisco().Public(),
+		Addresses:         []netip.Prefix{badSigAddr},
+		AllowedIPs:        []netip.Prefix{badSigAddr},
+		MachineAuthorized: true,
+		KeySignature:      []byte("not-a-real-tka-signature-just-garbage-bytes"),
+	}
+	injectPeersChangedAndAssertFiltered(t, ctx, s1, control, s1Key, badSigNode, testNL)
+}
diff --git a/tsnet/tsnet.go b/tsnet/tsnet.go
index f28179773..14a35cbf3 100644
--- a/tsnet/tsnet.go
+++ b/tsnet/tsnet.go
@@ -1,7 +1,139 @@
 // Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
-// Package tsnet provides Tailscale as a library.
+// Package tsnet embeds a Tailscale node directly into a Go program,
+// allowing it to join a tailnet and accept or dial connections without
+// running a separate tailscaled daemon or requiring any system-level
+// configuration.
+//
+// # Overview
+//
+// Normally, Tailscale runs as a background system service (tailscaled)
+// that manages a virtual network interface for the whole machine. tsnet
+// takes a different approach: it runs a fully self-contained Tailscale
+// node inside your process using a userspace TCP/IP stack (gVisor).
+// This means:
+//
+//   - No root privileges required.
+//   - No system daemons to install or manage.
+//   - Multiple independent Tailscale nodes can run within a single binary.
+//   - The node's [Tailscale identity] and state are stored in a directory you control.
+//
+// The core type is [Server], which represents one embedded Tailscale
+// node. Calling [Server.Listen] or [Server.Dial] routes traffic
+// exclusively over the tailnet. The standard library's [net.Listener]
+// and [net.Conn] interfaces are returned, so any existing Go HTTP
+// server, gRPC server, or other net-based code works without
+// modification.
+//
+// # Usage
+//
+//	import "tailscale.com/tsnet"
+//
+//	s := &tsnet.Server{
+//		Hostname: "my-service",
+//		AuthKey:  os.Getenv("TS_AUTHKEY"),
+//	}
+//	defer s.Close()
+//
+//	ln, err := s.Listen("tcp", ":80")
+//	if err != nil {
+//		log.Fatal(err)
+//	}
+//	log.Fatal(http.Serve(ln, myHandler))
+//
+// On first run, if no [Server.AuthKey] is provided and the node is not
+// already enrolled, the server logs an authentication URL. Open it in a
+// browser to add the node to your tailnet.
+//
+// # Authentication
+//
+// A [Server] authenticates using, in order of precedence:
+//
+//  1. [Server.AuthKey].
+//
+//  2. The TS_AUTHKEY environment variable.
+//
+//  3. The TS_AUTH_KEY environment variable.
+//
+//  4. An OAuth client secret ([Server.ClientSecret] or TS_CLIENT_SECRET),
+//     used to mint an auth key.
+//
+//  5. Workload identity federation ([Server.ClientID] plus
+//     [Server.IDToken] or [Server.Audience]). Available only if the
+//     program imports the feature:
+//
+//     import _ "tailscale.com/feature/identityfederation"
+//
+//     The feature is not linked by default to keep the AWS SDK and
+//     other cloud-provider dependencies out of programs that don't
+//     use workload identity federation.
+//
+//  6. An interactive login URL printed to [Server.UserLogf].
+//
+// If the node is already enrolled (state found in [Server.Store]), the
+// auth key is ignored unless TSNET_FORCE_LOGIN=1 is set.
+//
+// # Identifying callers
+//
+// Use the WhoIs method on the client returned by [Server.LocalClient]
+// to identify who is making a request:
+//
+//	lc, _ := srv.LocalClient()
+//	http.Serve(ln, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+//		who, err := lc.WhoIs(r.Context(), r.RemoteAddr)
+//		if err != nil {
+//			http.Error(w, err.Error(), 500)
+//			return
+//		}
+//		fmt.Fprintf(w, "Hello, %s!", who.UserProfile.LoginName)
+//	}))
+//
+// # Tailscale Funnel
+//
+// [Server.ListenFunnel] exposes your service on the public internet.
+// [Tailscale Funnel] currently supports TCP on ports 443, 8443, and
+// 10000. HTTPS must be enabled in the Tailscale admin console.
+//
+//	ln, err := srv.ListenFunnel("tcp", ":443")
+//	// ln is a TLS listener; connections can come from anywhere on the
+//	// internet as well as from your tailnet.
+//
+//	// To restrict to public traffic only:
+//	ln, err = srv.ListenFunnel("tcp", ":443", tsnet.FunnelOnly())
+//
+// # Tailscale Services
+//
+// [Server.ListenService] advertises the node as a host for a named
+// [Tailscale Service]. The node must use a tag-based identity. To
+// advertise multiple ports, call ListenService once per port.
+//
+//	srv.AdvertiseTags = []string{"tag:myservice"}
+//
+//	ln, err := srv.ListenService("svc:my-service", tsnet.ServiceModeHTTP{
+//		HTTPS: true,
+//		Port:  443,
+//	})
+//	log.Printf("Listening on https://%s", ln.FQDN)
+//
+// # Running multiple nodes in one process
+//
+// Each [Server] instance is an independent node. Give each a unique
+// [Server.Dir] and [Server.Hostname]:
+//
+//	for _, name := range []string{"frontend", "backend"} {
+//		srv := &tsnet.Server{
+//			Hostname:  name,
+//			Dir:       filepath.Join(baseDir, name),
+//			AuthKey:   os.Getenv("TS_AUTHKEY"),
+//			Ephemeral: true,
+//		}
+//		srv.Start()
+//	}
+//
+// [Tailscale identity]: https://tailscale.com/docs/concepts/tailscale-identity
+// [Tailscale Funnel]: https://tailscale.com/docs/features/tailscale-funnel
+// [Tailscale Service]: https://tailscale.com/docs/features/tailscale-services
 package tsnet
 
 import (
@@ -31,7 +163,7 @@ import (
 	"tailscale.com/control/controlclient"
 	"tailscale.com/envknob"
 	_ "tailscale.com/feature/c2n"
-	_ "tailscale.com/feature/condregister/identityfederation"
+	_ "tailscale.com/feature/condregister/netlog"
 	_ "tailscale.com/feature/condregister/oauthkey"
 	_ "tailscale.com/feature/condregister/portmapper"
 	_ "tailscale.com/feature/condregister/useproxy"
@@ -283,6 +415,19 @@ func (s *Server) LocalClient() (*local.Client, error) {
 	return s.localClient, nil
 }
 
+// TestHooks are hooks meant for internal-testing only; they're not stable
+// or documented, intentionally.
+var TestHooks testHooks
+
+type testHooks struct{}
+
+// LocalBackend returns the [ipnlocal.LocalBackend] backing s. It panics
+// outside of tests.
+func (testHooks) LocalBackend(s *Server) *ipnlocal.LocalBackend {
+	testenv.AssertInTest()
+	return s.lb
+}
+
 // Loopback starts a routing server on a loopback address.
 //
 // The server has multiple functions.
@@ -535,7 +680,7 @@ func (s *Server) doInit() {
 // Server.
 // If the server is not running, it returns nil.
 func (s *Server) CertDomains() []string {
-	nm := s.lb.NetMap()
+	nm := s.lb.NetMapNoPeers()
 	if nm == nil {
 		return nil
 	}
@@ -546,7 +691,7 @@ func (s *Server) CertDomains() []string {
 // has not yet joined a tailnet or is otherwise unaware of its own IP addresses,
 // the returned ip4, ip6 will be !netip.IsValid().
 func (s *Server) TailscaleIPs() (ip4, ip6 netip.Addr) {
-	nm := s.lb.NetMap()
+	nm := s.lb.NetMapNoPeers()
 	if nm == nil {
 		return
 	}
@@ -741,7 +886,8 @@ func (s *Server) start() (reterr error) {
 	ns.GetUDPHandlerForFlow = s.getUDPHandlerForFlow
 	s.netstack = ns
 	s.dialer.UseNetstackForIP = func(ip netip.Addr) bool {
-		_, ok := eng.PeerForIP(ip)
+		// s.lb is assigned below, before any dials can happen.
+		_, ok := s.lb.PeerForIP(ip)
 		return ok
 	}
 	s.dialer.NetstackDialTCP = func(ctx context.Context, dst netip.AddrPort) (net.Conn, error) {
@@ -861,7 +1007,10 @@ func (s *Server) resolveAuthKey() (string, error) {
 		if authKey == "" {
 			clientSecret = s.getClientSecret()
 		}
-		authKey, err = resolveViaOAuth(s.shutdownCtx, clientSecret, s.AdvertiseTags)
+		authKey, err = resolveViaOAuth(s.shutdownCtx, tailscale.ResolveAuthKeyArgs{
+			AuthKey: clientSecret,
+			Tags:    s.AdvertiseTags,
+		})
 		if err != nil {
 			return "", err
 		}
@@ -887,7 +1036,13 @@ func (s *Server) resolveAuthKey() (string, error) {
 				return "", fmt.Errorf("audience for workload identity federation found, but client ID is empty")
 			}
 		}
-		authKey, err = resolveViaWIF(s.shutdownCtx, s.getControlURL(), clientID, idToken, audience, s.AdvertiseTags)
+		authKey, err = resolveViaWIF(s.shutdownCtx, tailscale.ResolveAuthKeyWIFArgs{
+			BaseURL:  s.getControlURL(),
+			ClientID: clientID,
+			IDToken:  idToken,
+			Audience: audience,
+			Tags:     s.AdvertiseTags,
+		})
 		if err != nil {
 			return "", err
 		}
@@ -1120,6 +1275,33 @@ func (s *Server) Listen(network, addr string) (net.Listener, error) {
 	return s.listen(network, addr, listenOnTailnet)
 }
 
+// ListenSSH listens on the Tailscale network for SSH connections at the given
+// addr (e.g. ":2222"). The returned listener's Accept method yields net.Conn
+// values that are actually *tailssh.Session, providing access to the
+// connecting peer's Tailscale identity, PTY information, signals, and more.
+//
+// Basic applications can use the returned connections as plain net.Conn
+// (Read/Write/Close). Applications that need richer SSH semantics should
+// type-assert to *tailssh.Session.
+//
+// SSH support must be linked into the binary by importing
+// _ "tailscale.com/feature/ssh". Without that import, ListenSSH returns an
+// error.
+//
+// If s has not been started yet, it will be started.
+func (s *Server) ListenSSH(addr string) (net.Listener, error) {
+	rawLn, err := s.Listen("tcp", addr)
+	if err != nil {
+		return nil, err
+	}
+	sshLn, err := s.lb.ListenSSH(rawLn, s.logf)
+	if err != nil {
+		rawLn.Close()
+		return nil, err
+	}
+	return sshLn, nil
+}
+
 // ListenPacket announces on the Tailscale network.
 //
 // The network must be "udp", "udp4" or "udp6". The addr must be of the form
diff --git a/tsnet/tsnet_test.go b/tsnet/tsnet_test.go
index 4ed20fb2a..e4fa719c3 100644
--- a/tsnet/tsnet_test.go
+++ b/tsnet/tsnet_test.go
@@ -40,6 +40,7 @@ import (
 	"github.com/google/go-cmp/cmp"
 	dto "github.com/prometheus/client_model/go"
 	"github.com/prometheus/common/expfmt"
+	"github.com/prometheus/common/model"
 	"github.com/tailscale/wireguard-go/tun"
 	"golang.org/x/net/proxy"
 
@@ -63,8 +64,18 @@ import (
 	"tailscale.com/types/views"
 	"tailscale.com/util/mak"
 	"tailscale.com/util/must"
+	"tailscale.com/wgengine/filter"
 )
 
+// pingTimeout returns a per-ping budget for use within the larger test ctx:
+// enough headroom for wireguard-go's RekeyTimeout (5s) plus the actual handshake on slow CI
+// (notably GOARCH=386 emulation where Curve25519/ChaCha20 lack the amd64 assembly fast paths),
+// but tight enough that a hung Ping points the finger at its callsite
+// rather than swallowing the whole test deadline.
+func pingTimeout(ctx context.Context) (context.Context, context.CancelFunc) {
+	return context.WithTimeout(ctx, 10*time.Second)
+}
+
 // TestListener_Server ensures that the listener type always keeps the Server
 // method, which is used by some external applications to identify a tsnet.Listener
 // from other net.Listeners, as well as access the underlying Server.
@@ -334,13 +345,40 @@ func startServer(t *testing.T, ctx context.Context, controlURL, hostname string)
 	if err != nil {
 		t.Fatal(err)
 	}
-	s.lb.ConfigureCertsForTest(testCertRoot.getCert)
+	s.lb.ForTest().ConfigureCerts(testCertRoot.getCert)
+
+	// Wait for the server to finish connecting to its home DERP server,
+	// to prevent fast tests from racing the DERP handshake resulting
+	// in a dropped request with PeerGoneNotHere.
+	waitForHomeDERPConnected(t, ctx, s)
 
 	return s, status.TailscaleIPs[0], status.Self.PublicKey
 }
 
+// waitForHomeDERPConnected blocks until s has selected a home DERP region
+// and received its first frame from that region.
+// Until s establishes a complete connection to its home DERP server,
+// the DERP server will drop any incoming peer DISCO frames looking for s
+// with PeerGoneNotHere.
+func waitForHomeDERPConnected(t testing.TB, ctx context.Context, s *Server) {
+	t.Helper()
+	h := s.Sys().HealthTracker.Get()
+	ms := s.Sys().MagicSock.Get()
+	for {
+		if r := ms.GetLastNetcheckReport(ctx); r != nil &&
+			r.PreferredDERP != 0 &&
+			!h.GetDERPRegionReceivedTime(r.PreferredDERP).IsZero() {
+			return
+		}
+		select {
+		case <-ctx.Done():
+			t.Fatalf("waitForHomeDERPConnected(%s): %v", s.hostname, ctx.Err())
+		case <-time.After(20 * time.Millisecond):
+		}
+	}
+}
+
 func TestDialBlocks(t *testing.T) {
-	tstest.Shard(t)
 	tstest.ResourceCheck(t)
 	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 	defer cancel()
@@ -387,7 +425,6 @@ func TestDialBlocks(t *testing.T) {
 //   - s2 can dial through the subnet router functionality (getting a synthetic RST
 //     that we verify we generated & saw)
 func TestConn(t *testing.T) {
-	tstest.Shard(t)
 	tstest.ResourceCheck(t)
 	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 	defer cancel()
@@ -429,7 +466,9 @@ func TestConn(t *testing.T) {
 	}))
 
 	// ping to make sure the connection is up.
-	res, err := lc2.Ping(ctx, s1ip, tailcfg.PingTSMP)
+	pingCtx, cancelPing := pingTimeout(ctx)
+	defer cancelPing()
+	res, err := lc2.Ping(pingCtx, s1ip, tailcfg.PingTSMP)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -520,7 +559,6 @@ func TestConn(t *testing.T) {
 
 func TestLoopbackLocalAPI(t *testing.T) {
 	flakytest.Mark(t, "https://github.com/tailscale/tailscale/issues/8557")
-	tstest.Shard(t)
 	tstest.ResourceCheck(t)
 	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 	defer cancel()
@@ -596,7 +634,6 @@ func TestLoopbackLocalAPI(t *testing.T) {
 
 func TestLoopbackSOCKS5(t *testing.T) {
 	flakytest.Mark(t, "https://github.com/tailscale/tailscale/issues/8198")
-	tstest.Shard(t)
 	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 	defer cancel()
 
@@ -647,7 +684,6 @@ func TestLoopbackSOCKS5(t *testing.T) {
 }
 
 func TestTailscaleIPs(t *testing.T) {
-	tstest.Shard(t)
 	controlURL, _ := startControl(t)
 
 	tmp := t.TempDir()
@@ -690,7 +726,6 @@ func TestTailscaleIPs(t *testing.T) {
 // TestListenerCleanup is a regression test to verify that s.Close doesn't
 // deadlock if a listener is still open.
 func TestListenerCleanup(t *testing.T) {
-	tstest.Shard(t)
 	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 	defer cancel()
 
@@ -733,7 +768,6 @@ func (wc *closeTrackConn) Close() error {
 // tests https://github.com/tailscale/tailscale/issues/6973 -- that we can start a tsnet server,
 // stop it, and restart it, even on Windows.
 func TestStartStopStartGetsSameIP(t *testing.T) {
-	tstest.Shard(t)
 	controlURL, _ := startControl(t)
 
 	tmp := t.TempDir()
@@ -783,7 +817,6 @@ func TestStartStopStartGetsSameIP(t *testing.T) {
 }
 
 func TestFunnel(t *testing.T) {
-	tstest.Shard(t)
 	ctx, dialCancel := context.WithTimeout(context.Background(), 30*time.Second)
 	defer dialCancel()
 
@@ -848,7 +881,6 @@ func TestFunnel(t *testing.T) {
 // after itself when closed. Specifically, changes made to the serve config
 // should be cleared.
 func TestFunnelClose(t *testing.T) {
-	tstest.Shard(t)
 
 	marshalServeConfig := func(t *testing.T, sc ipn.ServeConfigView) string {
 		t.Helper()
@@ -1022,7 +1054,11 @@ func setUpServiceState(t *testing.T, name, ip string, host, client *Server,
 		t.Helper()
 		w := must.Get(s.localClient.WatchIPNBus(t.Context(), ipn.NotifyInitialNetMap))
 		defer w.Close()
-		for n := must.Get(w.Next()); !netmapUpToDate(n.NetMap); n = must.Get(w.Next()) {
+		for {
+			must.Get(w.Next())
+			if nm := s.lb.NetMapWithPeers(); nm != nil && netmapUpToDate(nm) {
+				return
+			}
 		}
 	}
 	waitForLatestNetmap(t, client)
@@ -1030,7 +1066,6 @@ func setUpServiceState(t *testing.T, name, ip string, host, client *Server,
 }
 
 func TestListenService(t *testing.T) {
-	tstest.Shard(t)
 
 	type dialFn func(context.Context, string, string) (net.Conn, error)
 
@@ -1426,7 +1461,6 @@ func TestListenService(t *testing.T) {
 }
 
 func TestListenServiceClose(t *testing.T) {
-	tstest.Shard(t)
 	const serviceName = "svc:foo"
 
 	diffServeConfig := func(a, b ipn.ServeConfigView) string {
@@ -1582,7 +1616,6 @@ func TestListenServiceClose(t *testing.T) {
 }
 
 func TestListenerClose(t *testing.T) {
-	tstest.Shard(t)
 	ctx := context.Background()
 	controlURL, _ := startControl(t)
 
@@ -1662,7 +1695,6 @@ func (c *bufferedConn) Read(b []byte) (int, error) {
 }
 
 func TestFallbackTCPHandler(t *testing.T) {
-	tstest.Shard(t)
 	tstest.ResourceCheck(t)
 	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 	defer cancel()
@@ -1677,7 +1709,9 @@ func TestFallbackTCPHandler(t *testing.T) {
 	}
 
 	// ping to make sure the connection is up.
-	res, err := lc2.Ping(ctx, s1ip, tailcfg.PingICMP)
+	pingCtx, cancelPing := pingTimeout(ctx)
+	defer cancelPing()
+	res, err := lc2.Ping(pingCtx, s1ip, tailcfg.PingICMP)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -1704,8 +1738,297 @@ func TestFallbackTCPHandler(t *testing.T) {
 	}
 }
 
+// TestPingPeerLearnedViaDelta verifies that `tailscale ping` works
+// for a peer that the local node learned about only via a
+// [tailcfg.MapResponse.PeersChanged] delta, never via a full
+// [tailcfg.MapResponse.Peers] list.
+//
+// Before aa5da2e5f22a, every peer change rebuilt a full netmap on
+// the engine, so [wgengine.Engine.SetNetworkMap] kept the engine's
+// cached netmap fresh and [wgengine.Engine.Reconfig] kept wgdev and
+// e.lastCfg fresh. After that refactor, peer adds and removes
+// ride the delta path and only mutate [nodeBackend]; the engine's
+// cached netmap and wireguard config stayed stale, and
+// [wgengine.Engine.PeerForIP] / [wgengine.Engine.Ping] / wgdev's
+// outbound encryption all missed the new peer.
+//
+// Two subtests exercise different layers:
+//
+//   - "disco" uses [tailcfg.PingDisco], which goes straight to
+//     magicsock (which has the peer via UpsertPeer) and bypasses
+//     wireguard-go entirely. It targets the cold-path PeerForIP
+//     lookup -- before the fix this missed the new peer with
+//     "no matching peer".
+//
+//   - "tsmp" uses [tailcfg.PingTSMP], which builds a real
+//     IP-proto-99 packet and pushes it through the full data path:
+//     PeerForIP -> lookupPeerByIP -> wgdev encryption ->
+//     magicsock transport. The receiving side's [tstun.Wrapper]
+//     intercepts TSMP and replies with a pong. Catches the
+//     wireguard-go side too: wgdev's PeerLookupFunc closure
+//     (captured at the last ReconfigDevice) didn't have the new
+//     peer's noise key, so even after lookupPeerByIP returned the
+//     right NodePublic wgdev couldn't lazily create the peer for
+//     outbound encryption.
+//
+// See tailscale/corp#43394.
+func TestPingPeerLearnedViaDelta(t *testing.T) {
+	for _, pt := range []tailcfg.PingType{tailcfg.PingDisco, tailcfg.PingTSMP} {
+		t.Run(string(pt), func(t *testing.T) {
+			testPingPeerLearnedViaDelta(t, pt)
+		})
+	}
+}
+
+func testPingPeerLearnedViaDelta(t *testing.T, pt tailcfg.PingType) {
+	if runtime.GOARCH == "386" {
+		t.Skip("skipping on 386: see https://github.com/tailscale/tailscale/issues/20146")
+	}
+	tstest.ResourceCheck(t)
+	ctx, cancel := context.WithTimeout(t.Context(), 120*time.Second)
+	defer cancel()
+
+	controlURL, control := startControl(t)
+
+	// Bring up s1 alone so its initial (auto-generated) MapResponse
+	// has no peers; testcontrol only has s1 registered at this point.
+	s1, _, s1Key := startServer(t, ctx, controlURL, "s1")
+
+	// Switch s1 into manual MapResponse mode. The empty response is a
+	// no-op heartbeat; the side effect is that suppressAutoMapResponses
+	// is set for s1, so the s2 join below cannot reach s1 as a full
+	// auto-generated netmap.
+	if !control.AddRawMapResponse(s1Key, &tailcfg.MapResponse{}) {
+		t.Fatal("AddRawMapResponse(s1, empty): node not connected")
+	}
+
+	// Bring up s2. testcontrol would normally push a peer-changed
+	// update to s1's long-poll, but autos for s1 are suppressed.
+	// s2 itself is not suppressed, so it gets a full netmap that
+	// includes s1, which is necessary for disco to complete in both
+	// directions (and for the TSMP pong to make it back).
+	_, s2ip, s2Key := startServer(t, ctx, controlURL, "s2")
+
+	// Snapshot s2's node-as-seen-by-control and inject it into s1's
+	// stream as a PeersChanged delta.
+	s2Node := control.Node(s2Key)
+	if !control.AddRawMapResponse(s1Key, &tailcfg.MapResponse{
+		PeersChanged: []*tailcfg.Node{s2Node},
+	}) {
+		t.Fatal("AddRawMapResponse(s1, PeersChanged): node not connected")
+	}
+
+	// Wait for the delta to land in s1's nodeBackend.
+	if err := waitFor(t, ctx, s1, func(nm *netmap.NetworkMap) bool {
+		return slices.ContainsFunc(nm.Peers, func(p tailcfg.NodeView) bool {
+			return p.Key() == s2Key
+		})
+	}); err != nil {
+		t.Fatalf("waitFor s2 in s1 netmap: %v", err)
+	}
+
+	lc1, err := s1.LocalClient()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	pingCtx, cancelPing := pingTimeout(ctx)
+	defer cancelPing()
+	pr, err := lc1.Ping(pingCtx, s2ip, pt)
+	if err != nil {
+		t.Fatalf("Ping(%s): %v", pt, err)
+	}
+	if pr.Err != "" {
+		t.Fatalf("Ping(%s) s1->s2 failed: %s (want success)", pt, pr.Err)
+	}
+}
+
+// TestPingSubnetRouteOfDeltaPeer verifies that when a peer arrives
+// purely via a [tailcfg.MapResponse.PeersChanged] delta and that peer
+// advertises a subnet route, the local node can resolve an IP within
+// that subnet to the new peer and exchange traffic with it.
+//
+// Before the fix, [netmapDeltaNeedsAuthReconfig] returned false for a
+// brand-new peer Upsert (the NodeID wasn't already known), so
+// [LocalBackend.authReconfigLocked] -- the only path that pushes a
+// fresh wireguard config into the engine -- never ran. The engine's
+// wireguard-filtered peer list and BART stayed stale, so
+// [LocalBackend.lookupPeerByIP] and [LocalBackend.peerForIP] both
+// missed any IP inside the advertised CIDR, and wgdev's
+// PeerLookupFunc closure didn't have the new peer's noise key for
+// outbound encryption.
+//
+// See tailscale/corp#43394.
+func TestPingSubnetRouteOfDeltaPeer(t *testing.T) {
+	if runtime.GOARCH == "386" {
+		t.Skip("skipping on 386: see https://github.com/tailscale/tailscale/issues/20146")
+	}
+	tstest.ResourceCheck(t)
+	ctx, cancel := context.WithTimeout(t.Context(), 120*time.Second)
+	defer cancel()
+
+	controlURL, control := startControl(t)
+
+	// Bring up s1 alone so its initial netmap has no peers.
+	s1, _, s1Key := startServer(t, ctx, controlURL, "s1")
+
+	// Accept subnet routes on s1; otherwise nmcfg.WGCfg strips a peer's
+	// non-self AllowedIPs out of the wireguard config (and thus out of
+	// the engine BART), and a subnet-router delta wouldn't actually
+	// install the route locally even with the fix.
+	lc1 := must.Get(s1.LocalClient())
+	must.Get(lc1.EditPrefs(ctx, &ipn.MaskedPrefs{
+		Prefs:       ipn.Prefs{RouteAll: true},
+		RouteAllSet: true,
+	}))
+
+	// Switch s1 into manual MapResponse mode so the s2 join cannot
+	// arrive as a full auto-generated netmap.
+	if !control.AddRawMapResponse(s1Key, &tailcfg.MapResponse{}) {
+		t.Fatal("AddRawMapResponse(s1, empty): node not connected")
+	}
+
+	// Bring up s2. We'll treat it as a subnet router for 10.0.0.0/24
+	// by adding that prefix to its AllowedIPs in the delta we inject
+	// below. (s2 isn't a real subnet router -- we don't try to forward
+	// traffic through it. The receiving side's tstun.Wrapper handles
+	// TSMP regardless of dst IP, so the pong comes back as long as
+	// the encrypt/transport chain works.)
+	_, _, s2Key := startServer(t, ctx, controlURL, "s2")
+
+	const subnet = "10.0.0.0/24"
+	subnetPrefix := netip.MustParsePrefix(subnet)
+	probeIP := netip.MustParseAddr("10.0.0.5")
+
+	// Inject s2 into s1 as a PeersChanged delta with the subnet route
+	// in AllowedIPs.
+	s2Node := control.Node(s2Key)
+	s2Node.PrimaryRoutes = []netip.Prefix{subnetPrefix}
+	s2Node.AllowedIPs = append(s2Node.AllowedIPs, subnetPrefix)
+	if !control.AddRawMapResponse(s1Key, &tailcfg.MapResponse{
+		PeersChanged: []*tailcfg.Node{s2Node},
+	}) {
+		t.Fatal("AddRawMapResponse(s1, PeersChanged): node not connected")
+	}
+
+	// Wait for the delta to land in s1's nodeBackend.
+	if err := waitFor(t, ctx, s1, func(nm *netmap.NetworkMap) bool {
+		return slices.ContainsFunc(nm.Peers, func(p tailcfg.NodeView) bool {
+			return p.Key() == s2Key
+		})
+	}); err != nil {
+		t.Fatalf("waitFor s2 in s1 netmap: %v", err)
+	}
+
+	// PingTSMP sends a real IP packet (IP proto 99) over wireguard
+	// to probeIP, exercising the full data path -- PeerForIP lookup,
+	// outbound wgdev encryption, magicsock transport. The receiving
+	// side (s2's tstun.Wrapper) intercepts TSMP regardless of dst
+	// IP and replies with a pong. So this catches both halves of
+	// the bug: a stale BART / lastCfg (PeerForIP / lookupPeerByIP
+	// miss) AND a stale wgdev PeerLookupFunc closure (peer's noise
+	// key not yet registered for outbound encryption).
+	pingCtx, cancelPing := pingTimeout(ctx)
+	defer cancelPing()
+	pr, err := lc1.Ping(pingCtx, probeIP, tailcfg.PingTSMP)
+	if err != nil {
+		t.Fatalf("Ping: %v", err)
+	}
+	if pr.Err != "" {
+		t.Fatalf("ping s1->%v (subnet route via s2) failed: %s (want success)", probeIP, pr.Err)
+	}
+}
+
+// TestPingSelfReturnsIsLocalIP verifies that pinging one's own
+// Tailscale IP takes the IsSelf early-out in [wgengine.Engine.Ping]
+// instead of trying to ping self via magicsock. Lives here as a
+// regression guard against future refactors of the PeerForIP self
+// path; the original userspaceEngine.PeerForIP handles self via a
+// dedicated nm.GetAddresses() scan, but anything that re-routes
+// PeerForIP through a more general index needs to keep
+// [wgengine.PeerForIP.IsSelf] set for self addresses.
+func TestPingSelfReturnsIsLocalIP(t *testing.T) {
+	tstest.ResourceCheck(t)
+	ctx, cancel := context.WithTimeout(t.Context(), 120*time.Second)
+	defer cancel()
+
+	controlURL, _ := startControl(t)
+	s1, s1ip, _ := startServer(t, ctx, controlURL, "s1")
+
+	lc, err := s1.LocalClient()
+	if err != nil {
+		t.Fatal(err)
+	}
+	pingCtx, cancelPing := pingTimeout(ctx)
+	defer cancelPing()
+	pr, err := lc.Ping(pingCtx, s1ip, tailcfg.PingDisco)
+	if err != nil {
+		t.Fatalf("Ping: %v", err)
+	}
+	if !pr.IsLocalIP {
+		t.Errorf("IsLocalIP = false, want true (pr=%+v)", pr)
+	}
+	if pr.Err == "" {
+		t.Errorf("Err = %q, want a 'local Tailscale IP' message", pr.Err)
+	}
+}
+
+// TestStatusReportsPeerInEngine verifies that a peer with an active
+// wireguard session is reported as InEngine=true in the local
+// [ipnstate.Status]. This exercises [wgengine.Engine.UpdateStatus] ->
+// userspaceEngine.getStatus -> the active-wgdev-peer iteration ->
+// [ipnstate.StatusBuilder.AddPeer] with InEngine=true. It's the only
+// signal in the tree that exercises getStatus's peer-list path; the
+// wgengine and ipnlocal unit tests don't assert on it.
+func TestStatusReportsPeerInEngine(t *testing.T) {
+	tstest.ResourceCheck(t)
+	ctx, cancel := context.WithTimeout(t.Context(), 120*time.Second)
+	defer cancel()
+
+	controlURL, _ := startControl(t)
+	s1, _, _ := startServer(t, ctx, controlURL, "s1")
+	_, s2ip, s2Key := startServer(t, ctx, controlURL, "s2")
+
+	lc1, err := s1.LocalClient()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if err := waitFor(t, ctx, s1, func(nm *netmap.NetworkMap) bool {
+		return slices.ContainsFunc(nm.Peers, func(p tailcfg.NodeView) bool {
+			return p.Key() == s2Key
+		})
+	}); err != nil {
+		t.Fatalf("waitFor s2 in s1 netmap: %v", err)
+	}
+
+	// Ping via ICMP so a real packet flows through wireguard-go and
+	// instantiates s2 in s1's wgdev peer map. PingDisco wouldn't
+	// suffice; it goes directly to magicsock and bypasses wgdev.
+	pingCtx, cancelPing := pingTimeout(ctx)
+	defer cancelPing()
+	pr, err := lc1.Ping(pingCtx, s2ip, tailcfg.PingICMP)
+	if err != nil {
+		t.Fatalf("Ping: %v", err)
+	}
+	if pr.Err != "" {
+		t.Fatalf("Ping s1->s2 failed: %s", pr.Err)
+	}
+
+	status, err := lc1.Status(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	peer, ok := status.Peer[s2Key]
+	if !ok {
+		t.Fatalf("status.Peer missing s2 (%v); peers=%v", s2Key, status.Peers())
+	}
+	if !peer.InEngine {
+		t.Errorf("peer.InEngine = false, want true (peer=%+v)", peer)
+	}
+}
+
 func TestCapturePcap(t *testing.T) {
-	tstest.Shard(t)
 	const timeLimit = 120
 	ctx, cancel := context.WithTimeout(context.Background(), timeLimit*time.Second)
 	defer cancel()
@@ -1726,7 +2049,9 @@ func TestCapturePcap(t *testing.T) {
 	}
 
 	// send a packet which both nodes will capture
-	res, err := lc2.Ping(ctx, s1ip, tailcfg.PingICMP)
+	pingCtx, cancelPing := pingTimeout(ctx)
+	defer cancelPing()
+	res, err := lc2.Ping(pingCtx, s1ip, tailcfg.PingICMP)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -1759,7 +2084,6 @@ func TestCapturePcap(t *testing.T) {
 }
 
 func TestUDPConn(t *testing.T) {
-	tstest.Shard(t)
 	tstest.ResourceCheck(t)
 	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 	defer cancel()
@@ -1774,7 +2098,9 @@ func TestUDPConn(t *testing.T) {
 	}
 
 	// ping to make sure the connection is up.
-	res, err := lc2.Ping(ctx, s1ip, tailcfg.PingICMP)
+	pingCtx, cancelPing := pingTimeout(ctx)
+	defer cancelPing()
+	res, err := lc2.Ping(pingCtx, s1ip, tailcfg.PingICMP)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -1832,7 +2158,11 @@ func TestUDPConn(t *testing.T) {
 func parseMetrics(m []byte) (map[string]float64, error) {
 	metrics := make(map[string]float64)
 
-	var parser expfmt.TextParser
+	// prometheus/common v0.67 made the validation scheme mandatory;
+	// the zero-value parser now panics. LegacyValidation matches the
+	// classic ASCII metric/label name rules that the tailscaled exporter
+	// uses (e.g. tailscaled_inbound_bytes_total).
+	parser := expfmt.NewTextParser(model.LegacyValidation)
 	mf, err := parser.TextToMetricFamilies(bytes.NewReader(m))
 	if err != nil {
 		return nil, err
@@ -1951,7 +2281,6 @@ func sendData(logf func(format string, args ...any), ctx context.Context, bytesC
 }
 
 func TestUserMetricsByteCounters(t *testing.T) {
-	tstest.Shard(t)
 	ctx, cancel := context.WithTimeout(context.Background(), 120*time.Second)
 	defer cancel()
 
@@ -1993,7 +2322,9 @@ func TestUserMetricsByteCounters(t *testing.T) {
 	})
 
 	// ping to make sure the connection is up.
-	res, err := lc2.Ping(ctx, s1ip, tailcfg.PingICMP)
+	pingCtx, cancelPing := pingTimeout(ctx)
+	defer cancelPing()
+	res, err := lc2.Ping(pingCtx, s1ip, tailcfg.PingICMP)
 	if err != nil {
 		t.Fatalf("pinging: %s", err)
 	}
@@ -2066,7 +2397,6 @@ func TestUserMetricsByteCounters(t *testing.T) {
 }
 
 func TestUserMetricsRouteGauges(t *testing.T) {
-	tstest.Shard(t)
 	// Windows does not seem to support or report back routes when running in
 	// userspace via tsnet. So, we skip this check on Windows.
 	// TODO(kradalby): Figure out if this is correct.
@@ -2230,6 +2560,10 @@ type chanTUN struct {
 	Outbound chan []byte // packets to read from TUN
 	closed   chan struct{}
 	events   chan tun.Event
+
+	// wmu serializes Write and Close so a Write can't send on
+	// Inbound while Close is closing it.
+	wmu sync.Mutex
 }
 
 func newChanTUN() *chanTUN {
@@ -2246,6 +2580,8 @@ func newChanTUN() *chanTUN {
 func (t *chanTUN) File() *os.File { panic("not implemented") }
 
 func (t *chanTUN) Close() error {
+	t.wmu.Lock()
+	defer t.wmu.Unlock()
 	select {
 	case <-t.closed:
 	default:
@@ -2266,14 +2602,19 @@ func (t *chanTUN) Read(bufs [][]byte, sizes []int, offset int) (int, error) {
 }
 
 func (t *chanTUN) Write(bufs [][]byte, offset int) (int, error) {
+	t.wmu.Lock()
+	defer t.wmu.Unlock()
+	select {
+	case <-t.closed:
+		return 0, errors.New("closed")
+	default:
+	}
 	for _, buf := range bufs {
 		pkt := buf[offset:]
 		if len(pkt) == 0 {
 			continue
 		}
 		select {
-		case <-t.closed:
-			return 0, errors.New("closed")
 		case t.Inbound <- slices.Clone(pkt):
 		default:
 			// Drop the packet if the channel is full, like a real
@@ -2298,11 +2639,41 @@ type listenTest struct {
 	tun          *chanTUN // nil for netstack mode
 }
 
+// waitForPeerReachable blocks until s's current netmap contains the given peer
+// with a non-zero HomeDERP and endpoints.
+//
+// This is polled via the LocalBackend's netmap rather than via the IPN bus
+// because the bus does not carry HomeDERP or Endpoint deltas; the netmap
+// itself is the source of truth for those fields.
+func waitForPeerReachable(t *testing.T, s *Server, peer key.NodePublic) {
+	t.Helper()
+	if err := tstest.WaitFor(30*time.Second, func() error {
+		nm := s.lb.NetMapWithPeers()
+		if nm == nil {
+			return errors.New("no netmap yet")
+		}
+		for _, p := range nm.Peers {
+			if p.Key() != peer {
+				continue
+			}
+			if p.HomeDERP() == 0 {
+				return fmt.Errorf("peer %v: no HomeDERP", peer.ShortString())
+			}
+			if p.Endpoints().Len() == 0 {
+				return fmt.Errorf("peer %v: no endpoints", peer.ShortString())
+			}
+			return nil
+		}
+		return fmt.Errorf("peer %v not in netmap", peer.ShortString())
+	}); err != nil {
+		t.Fatalf("waitForPeerReachable(%v): %v", peer.ShortString(), err)
+	}
+}
+
 // setupTwoClientTest creates two tsnet servers for testing.
 // If useTUN is true, s2 uses a chanTUN; otherwise it uses netstack only.
 func setupTwoClientTest(t *testing.T, useTUN bool) *listenTest {
 	t.Helper()
-	tstest.Shard(t)
 	tstest.ResourceCheck(t)
 	ctx := t.Context()
 	controlURL, control := startControl(t)
@@ -2333,7 +2704,7 @@ func setupTwoClientTest(t *testing.T, useTUN bool) *listenTest {
 	if err != nil {
 		t.Fatal(err)
 	}
-	s2.lb.ConfigureCertsForTest(testCertRoot.getCert)
+	s2.lb.ForTest().ConfigureCerts(testCertRoot.getCert)
 
 	s1ip4, s1ip6 := s1.TailscaleIPs()
 	s2ip4 := s2status.TailscaleIPs[0]
@@ -2342,8 +2713,14 @@ func setupTwoClientTest(t *testing.T, useTUN bool) *listenTest {
 		s2ip6 = s2status.TailscaleIPs[1]
 	}
 
+	waitForPeerReachable(t, s1, s2.lb.NodeKey())
+	waitForPeerReachable(t, s2, s1.lb.NodeKey())
+
 	lc1 := must.Get(s1.LocalClient())
-	must.Get(lc1.Ping(ctx, s2ip4, tailcfg.PingTSMP))
+
+	pingCtx, cancelPing := pingTimeout(ctx)
+	defer cancelPing()
+	must.Get(lc1.Ping(pingCtx, s2ip4, tailcfg.PingTSMP))
 
 	return &listenTest{
 		control: control,
@@ -2858,6 +3235,143 @@ func TestDialUDP(t *testing.T) {
 	})
 }
 
+// TestDialUDPInjectedReadRecordsFlowState reproduces tailscale/tailscale#14229
+// and #20064: a tsnet/netstack client dialing UDP must record reverse-flow
+// state in its inbound filter for the outbound packet it injects via
+// [netstack.Impl] → [tstun.Wrapper.InjectOutboundPacketBuffer]. If it doesn't,
+// the inbound reply is silently dropped by the inbound packet filter when no
+// ACL rule explicitly admits it.
+//
+// [TestDialUDP] doesn't catch this because [testcontrol.Server] serves
+// [tailcfg.FilterAllowAll] by default, so the reply is always admitted by
+// rule and the flow-state path is never exercised. Each subtest below sets
+// up s1 and s2 so that the inbound reply is admissible only via the
+// reverse-flow state recorded when s2 dialed.
+func TestDialUDPInjectedReadRecordsFlowState(t *testing.T) {
+	// RestrictedACL replaces the default allow-all PacketFilter with a
+	// one-way rule that permits s2 → s1 only. The reply path s1 → s2 matches
+	// no rule, so it can only be admitted by reverse-flow state on s2's
+	// main filter.
+	t.Run("RestrictedACL", func(t *testing.T) {
+		lt := setupTwoClientTest(t, false) // netstack on both sides.
+		rule := []tailcfg.FilterRule{{
+			SrcIPs: []string{lt.s2ip4.String(), lt.s2ip6.String()},
+			DstPorts: []tailcfg.NetPortRange{
+				{IP: lt.s1ip4.String(), Ports: tailcfg.PortRange{First: 0, Last: 65535}},
+				{IP: lt.s1ip6.String(), Ports: tailcfg.PortRange{First: 0, Last: 65535}},
+			},
+			IPProto: []int{int(ipproto.TCP), int(ipproto.UDP)},
+		}}
+
+		for _, s := range []*Server{lt.s1, lt.s2} {
+			if !lt.control.AddRawMapResponse(s.lb.NodeKey(), &tailcfg.MapResponse{
+				PacketFilter: rule,
+			}) {
+				t.Fatalf("AddRawMapResponse(%s) failed", s.Hostname)
+			}
+		}
+
+		// PacketFilter-only changes don't necessarily fire peer/netmap
+		// notifications, so poll the wgengine filter directly.
+		if err := tstest.WaitFor(30*time.Second, func() error {
+			f := lt.s2.lb.ForTest().GetFilter()
+			if f == nil {
+				return errors.New("no filter yet")
+			}
+			if got := f.Check(lt.s1ip4, lt.s2ip4, 1234, ipproto.UDP); got != filter.Drop {
+				return fmt.Errorf("inbound s1 → s2:1234 UDP: got %v, want Drop", got)
+			}
+			return nil
+		}); err != nil {
+			t.Fatalf("waiting for restrictive filter on s2: %v", err)
+		}
+
+		runDialUDPEcho(t, lt)
+	})
+
+	// JailedPeer marks s1 as jailed from s2's perspective. tstun.Wrapper
+	// then routes s2's outbound to s1 and inbound from s1 through a
+	// separate "jailed" filter (a shields-up filter with no rules; also
+	// used for Mullvad exit nodes). The reply path can only be admitted
+	// by reverse-flow state on the *jailed* filter, so injectedRead must
+	// select the right filter for the outbound packet.
+	t.Run("JailedPeer", func(t *testing.T) {
+		lt := setupTwoClientTest(t, false) // netstack on both sides.
+		s1Key := lt.s1.lb.NodeKey()
+		lt.control.SetJailed(lt.s2.lb.NodeKey(), s1Key, true)
+
+		ctx, cancel := context.WithTimeout(t.Context(), 30*time.Second)
+		defer cancel()
+		if err := waitFor(t, ctx, lt.s2, func(nm *netmap.NetworkMap) bool {
+			return slices.ContainsFunc(nm.Peers, func(p tailcfg.NodeView) bool {
+				return p.Key() == s1Key && p.IsJailed()
+			})
+		}); err != nil {
+			t.Fatalf("waiting for s1 to appear jailed in s2's netmap: %v", err)
+		}
+
+		runDialUDPEcho(t, lt)
+	})
+}
+
+// runDialUDPEcho runs an s2.Dial("udp", s1-listener)/Write/Read round trip
+// against listeners on lt.s1's IPv4 and IPv6 addresses as t.Run subtests,
+// asserting that the echoed reply makes it back to s2. The caller is
+// responsible for configuring lt so that the inbound reply on s2 is only
+// admissible via reverse-flow state recorded by the outbound dial.
+func runDialUDPEcho(t *testing.T, lt *listenTest) {
+	t.Helper()
+	test := func(t *testing.T, listenIP netip.Addr) {
+		pc, err := lt.s1.ListenPacket("udp", netip.AddrPortFrom(listenIP, 0).String())
+		if err != nil {
+			t.Fatalf("ListenPacket: %v", err)
+		}
+		defer pc.Close()
+
+		echoErr := make(chan error, 1)
+		go func() {
+			buf := make([]byte, 1500)
+			n, addr, err := pc.ReadFrom(buf)
+			if err != nil {
+				echoErr <- err
+				return
+			}
+			if _, err := pc.WriteTo(buf[:n], addr); err != nil {
+				echoErr <- err
+			}
+		}()
+
+		conn, err := lt.s2.Dial(t.Context(), "udp", pc.LocalAddr().String())
+		if err != nil {
+			t.Fatalf("Dial: %v", err)
+		}
+		defer conn.Close()
+
+		want := "hello udp"
+		if _, err := conn.Write([]byte(want)); err != nil {
+			t.Fatalf("Write: %v", err)
+		}
+
+		conn.SetReadDeadline(time.Now().Add(5 * time.Second))
+		got := make([]byte, 1024)
+		n, err := conn.Read(got)
+		if err != nil {
+			select {
+			case e := <-echoErr:
+				t.Fatalf("echo error: %v; read error: %v", e, err)
+			default:
+				t.Fatalf("UDP reply dropped — injectedRead didn't record flow state on the filter that runs on the reply (#14229, #20064): %v", err)
+			}
+		}
+		if string(got[:n]) != want {
+			t.Errorf("got %q, want %q", got[:n], want)
+		}
+	}
+
+	t.Run("IPv4", func(t *testing.T) { test(t, lt.s1ip4) })
+	t.Run("IPv6", func(t *testing.T) { test(t, lt.s1ip6) })
+}
+
 // buildDNSQuery builds a UDP/IP packet containing a DNS query for name to the
 // Tailscale service IP (100.100.100.100 for IPv4, fd7a:115c:a1e0::53 for IPv6).
 func buildDNSQuery(name string, srcIP netip.Addr) []byte {
@@ -2900,16 +3414,26 @@ func buildDNSQuery(name string, srcIP netip.Addr) []byte {
 }
 
 func TestDeps(t *testing.T) {
-	tstest.Shard(t)
 	deptest.DepChecker{
 		GOOS:   "linux",
 		GOARCH: "amd64",
 		BadDeps: map[string]string{
 			"golang.org/x/crypto/ssh":                       "tsnet should not depend on SSH",
 			"golang.org/x/crypto/ssh/internal/bcrypt_pbkdf": "tsnet should not depend on SSH",
+			"tailscale.com/chirp":                           "tsnet should not depend on BIRD integration",
+			"tailscale.com/feature/bird":                    "tsnet should not depend on BIRD integration",
+			"tailscale.com/feature/captiveportal":           "tsnet apps don't need captive portal detection; import it explicitly if desired",
+			"tailscale.com/feature/clientupdate":            "tsnet should not depend on feature/clientupdate",
+			"tailscale.com/feature/remoteconfig":            "tsnet should not depend on feature/remoteconfig",
+			"tailscale.com/feature/syspolicy":               "tsnet should not depend on syspolicy",
+			"tailscale.com/ipn/store/awsstore":              "tsnet callers wanting AWS state storage should import awsstore themselves",
+			"tailscale.com/ipn/store/kubestore":             "tsnet callers wanting Kubernetes state storage should import kubestore themselves",
+			"tailscale.com/wif":                             "tsnet callers wanting workload identity federation should import tailscale.com/feature/identityfederation themselves",
 		},
 		OnDep: func(dep string) {
-			if strings.Contains(dep, "portlist") {
+			if strings.Contains(dep, "portlist") ||
+				strings.Contains(dep, "github.com/aws/") ||
+				strings.Contains(dep, "k8s.io/") {
 				t.Errorf("unexpected dep: %q", dep)
 			}
 		},
@@ -2926,8 +3450,8 @@ func TestResolveAuthKey(t *testing.T) {
 		audience        string
 		oauthAvailable  bool
 		wifAvailable    bool
-		resolveViaOAuth func(ctx context.Context, clientSecret string, tags []string) (string, error)
-		resolveViaWIF   func(ctx context.Context, baseURL, clientID, idToken, audience string, tags []string) (string, error)
+		resolveViaOAuth func(ctx context.Context, args tailscale.ResolveAuthKeyArgs) (string, error)
+		resolveViaWIF   func(ctx context.Context, args tailscale.ResolveAuthKeyWIFArgs) (string, error)
 		wantAuthKey     string
 		wantErr         bool
 		wantErrContains string
@@ -2936,9 +3460,9 @@ func TestResolveAuthKey(t *testing.T) {
 			name:           "success-oauth-client-secret",
 			clientSecret:   "tskey-client-secret-123",
 			oauthAvailable: true,
-			resolveViaOAuth: func(ctx context.Context, clientSecret string, tags []string) (string, error) {
-				if clientSecret != "tskey-client-secret-123" {
-					return "", fmt.Errorf("unexpected client secret: %s", clientSecret)
+			resolveViaOAuth: func(ctx context.Context, args tailscale.ResolveAuthKeyArgs) (string, error) {
+				if args.AuthKey != "tskey-client-secret-123" {
+					return "", fmt.Errorf("unexpected client secret: %s", args.AuthKey)
 				}
 				return "tskey-auth-via-oauth", nil
 			},
@@ -2949,7 +3473,7 @@ func TestResolveAuthKey(t *testing.T) {
 			name:           "fail-oauth-client-secret",
 			clientSecret:   "tskey-client-secret-123",
 			oauthAvailable: true,
-			resolveViaOAuth: func(ctx context.Context, clientSecret string, tags []string) (string, error) {
+			resolveViaOAuth: func(ctx context.Context, args tailscale.ResolveAuthKeyArgs) (string, error) {
 				return "", fmt.Errorf("resolution failed")
 			},
 			wantErrContains: "resolution failed",
@@ -2959,12 +3483,12 @@ func TestResolveAuthKey(t *testing.T) {
 			clientID:     "client-id-123",
 			idToken:      "id-token-456",
 			wifAvailable: true,
-			resolveViaWIF: func(ctx context.Context, baseURL, clientID, idToken, audience string, tags []string) (string, error) {
-				if clientID != "client-id-123" {
-					return "", fmt.Errorf("unexpected client ID: %s", clientID)
+			resolveViaWIF: func(ctx context.Context, args tailscale.ResolveAuthKeyWIFArgs) (string, error) {
+				if args.ClientID != "client-id-123" {
+					return "", fmt.Errorf("unexpected client ID: %s", args.ClientID)
 				}
-				if idToken != "id-token-456" {
-					return "", fmt.Errorf("unexpected ID token: %s", idToken)
+				if args.IDToken != "id-token-456" {
+					return "", fmt.Errorf("unexpected ID token: %s", args.IDToken)
 				}
 				return "tskey-auth-via-wif", nil
 			},
@@ -2976,12 +3500,12 @@ func TestResolveAuthKey(t *testing.T) {
 			clientID:     "client-id-123",
 			audience:     "api.tailscale.com",
 			wifAvailable: true,
-			resolveViaWIF: func(ctx context.Context, baseURL, clientID, idToken, audience string, tags []string) (string, error) {
-				if clientID != "client-id-123" {
-					return "", fmt.Errorf("unexpected client ID: %s", clientID)
+			resolveViaWIF: func(ctx context.Context, args tailscale.ResolveAuthKeyWIFArgs) (string, error) {
+				if args.ClientID != "client-id-123" {
+					return "", fmt.Errorf("unexpected client ID: %s", args.ClientID)
 				}
-				if audience != "api.tailscale.com" {
-					return "", fmt.Errorf("unexpected ID token: %s", idToken)
+				if args.Audience != "api.tailscale.com" {
+					return "", fmt.Errorf("unexpected audience: %s", args.Audience)
 				}
 				return "tskey-auth-via-wif", nil
 			},
@@ -2993,7 +3517,7 @@ func TestResolveAuthKey(t *testing.T) {
 			clientID:     "client-id-123",
 			idToken:      "id-token-456",
 			wifAvailable: true,
-			resolveViaWIF: func(ctx context.Context, baseURL, clientID, idToken, audience string, tags []string) (string, error) {
+			resolveViaWIF: func(ctx context.Context, args tailscale.ResolveAuthKeyWIFArgs) (string, error) {
 				return "", fmt.Errorf("resolution failed")
 			},
 			wantErrContains: "resolution failed",
@@ -3003,7 +3527,7 @@ func TestResolveAuthKey(t *testing.T) {
 			clientID:     "",
 			idToken:      "id-token-456",
 			wifAvailable: true,
-			resolveViaWIF: func(ctx context.Context, baseURL, clientID, idToken, audience string, tags []string) (string, error) {
+			resolveViaWIF: func(ctx context.Context, args tailscale.ResolveAuthKeyWIFArgs) (string, error) {
 				return "", fmt.Errorf("should not be called")
 			},
 			wantErrContains: "empty",
@@ -3013,7 +3537,7 @@ func TestResolveAuthKey(t *testing.T) {
 			clientID:     "",
 			audience:     "api.tailscale.com",
 			wifAvailable: true,
-			resolveViaWIF: func(ctx context.Context, baseURL, clientID, idToken, audience string, tags []string) (string, error) {
+			resolveViaWIF: func(ctx context.Context, args tailscale.ResolveAuthKeyWIFArgs) (string, error) {
 				return "", fmt.Errorf("should not be called")
 			},
 			wantErrContains: "empty",
@@ -3023,7 +3547,7 @@ func TestResolveAuthKey(t *testing.T) {
 			clientID:     "client-id-123",
 			idToken:      "",
 			wifAvailable: true,
-			resolveViaWIF: func(ctx context.Context, baseURL, clientID, idToken, audience string, tags []string) (string, error) {
+			resolveViaWIF: func(ctx context.Context, args tailscale.ResolveAuthKeyWIFArgs) (string, error) {
 				return "", fmt.Errorf("should not be called")
 			},
 			wantErrContains: "empty",
@@ -3034,7 +3558,7 @@ func TestResolveAuthKey(t *testing.T) {
 			idToken:      "id-token-456",
 			audience:     "api.tailscale.com",
 			wifAvailable: true,
-			resolveViaWIF: func(ctx context.Context, baseURL, clientID, idToken, audience string, tags []string) (string, error) {
+			resolveViaWIF: func(ctx context.Context, args tailscale.ResolveAuthKeyWIFArgs) (string, error) {
 				return "", fmt.Errorf("should not be called")
 			},
 			wantErrContains: "only one of ID token and audience",
@@ -3043,14 +3567,14 @@ func TestResolveAuthKey(t *testing.T) {
 			name:           "wif-skipped-oauth-succeeds",
 			clientSecret:   "tskey-client-secret-123",
 			oauthAvailable: true,
-			resolveViaOAuth: func(ctx context.Context, clientSecret string, tags []string) (string, error) {
-				if clientSecret != "tskey-client-secret-123" {
-					return "", fmt.Errorf("unexpected client secret: %s", clientSecret)
+			resolveViaOAuth: func(ctx context.Context, args tailscale.ResolveAuthKeyArgs) (string, error) {
+				if args.AuthKey != "tskey-client-secret-123" {
+					return "", fmt.Errorf("unexpected client secret: %s", args.AuthKey)
 				}
 				return "tskey-auth-via-oauth", nil
 			},
 			wifAvailable: true,
-			resolveViaWIF: func(ctx context.Context, baseURL, clientID, idToken, audience string, tags []string) (string, error) {
+			resolveViaWIF: func(ctx context.Context, args tailscale.ResolveAuthKeyWIFArgs) (string, error) {
 				return "", fmt.Errorf("should not be called")
 			},
 			wantAuthKey:     "tskey-auth-via-oauth",
@@ -3061,11 +3585,11 @@ func TestResolveAuthKey(t *testing.T) {
 			clientID:       "tskey-client-id-123",
 			idToken:        "",
 			oauthAvailable: true,
-			resolveViaOAuth: func(ctx context.Context, clientSecret string, tags []string) (string, error) {
+			resolveViaOAuth: func(ctx context.Context, args tailscale.ResolveAuthKeyArgs) (string, error) {
 				return "", fmt.Errorf("resolution failed")
 			},
 			wifAvailable: true,
-			resolveViaWIF: func(ctx context.Context, baseURL, clientID, idToken, audience string, tags []string) (string, error) {
+			resolveViaWIF: func(ctx context.Context, args tailscale.ResolveAuthKeyWIFArgs) (string, error) {
 				return "", fmt.Errorf("should not be called")
 			},
 			wantErrContains: "failed",
@@ -3089,9 +3613,9 @@ func TestResolveAuthKey(t *testing.T) {
 			name:           "authkey-client-secret-oauth-succeeds",
 			authKey:        "tskey-client-secret-123",
 			oauthAvailable: true,
-			resolveViaOAuth: func(ctx context.Context, clientSecret string, tags []string) (string, error) {
-				if clientSecret != "tskey-client-secret-123" {
-					return "", fmt.Errorf("unexpected client secret: %s", clientSecret)
+			resolveViaOAuth: func(ctx context.Context, args tailscale.ResolveAuthKeyArgs) (string, error) {
+				if args.AuthKey != "tskey-client-secret-123" {
+					return "", fmt.Errorf("unexpected client secret: %s", args.AuthKey)
 				}
 				return "tskey-auth-via-oauth", nil
 			},
@@ -3102,7 +3626,7 @@ func TestResolveAuthKey(t *testing.T) {
 			name:           "authkey-client-secret-oauth-fails",
 			authKey:        "tskey-client-secret-123",
 			oauthAvailable: true,
-			resolveViaOAuth: func(ctx context.Context, clientSecret string, tags []string) (string, error) {
+			resolveViaOAuth: func(ctx context.Context, args tailscale.ResolveAuthKeyArgs) (string, error) {
 				return "", fmt.Errorf("resolution failed")
 			},
 			wantErrContains: "resolution failed",
@@ -3159,7 +3683,6 @@ func TestResolveAuthKey(t *testing.T) {
 // packets were sent to WireGuard (which has no peer for the node's own IP)
 // and silently dropped, causing Dial to hang indefinitely.
 func TestSelfDial(t *testing.T) {
-	tstest.Shard(t)
 	tstest.ResourceCheck(t)
 	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 	defer cancel()
diff --git a/tstest/allocs.go b/tstest/allocs.go
index 6c2a1a22b..fdbc31b31 100644
--- a/tstest/allocs.go
+++ b/tstest/allocs.go
@@ -6,8 +6,9 @@ package tstest
 import (
 	"fmt"
 	"runtime"
-	"testing"
 	"time"
+
+	"tailscale.com/util/testenv"
 )
 
 // MinAllocsPerRun asserts that f can run with no more than target allocations.
@@ -16,7 +17,7 @@ import (
 //
 // MinAllocsPerRun sets GOMAXPROCS to 1 during its measurement and restores
 // it before returning.
-func MinAllocsPerRun(t *testing.T, target uint64, f func()) error {
+func MinAllocsPerRun(t testenv.TB, target uint64, f func()) error {
 	defer runtime.GOMAXPROCS(runtime.GOMAXPROCS(1))
 
 	var memstats runtime.MemStats
diff --git a/tstest/clock.go b/tstest/clock.go
index 5742c6e5a..1f88fb0a2 100644
--- a/tstest/clock.go
+++ b/tstest/clock.go
@@ -20,6 +20,9 @@ type ClockOpts struct {
 	// to Clock.Now. If you are passing a value here, set an explicit
 	// timezone, otherwise the test may be non-deterministic when TZ environment
 	// variable is set to different values. The default time is in UTC.
+	//
+	// If you do not pass an explicit Start time, the clock will start at the
+	// current UTC time.
 	Start time.Time
 
 	// Step is the amount of time the Clock will advance whenever Clock.Now is
diff --git a/tstest/integration/capmap_test.go b/tstest/integration/capmap_test.go
index aea4a210b..48e9dae49 100644
--- a/tstest/integration/capmap_test.go
+++ b/tstest/integration/capmap_test.go
@@ -14,7 +14,6 @@ import (
 
 // TestPeerCapMap tests that the node capability map (CapMap) is included in peer information.
 func TestPeerCapMap(t *testing.T) {
-	tstest.Shard(t)
 	tstest.Parallel(t)
 	env := NewTestEnv(t)
 
@@ -97,7 +96,6 @@ func TestPeerCapMap(t *testing.T) {
 
 // TestSetNodeCapMap tests that SetNodeCapMap updates are propagated to peers.
 func TestSetNodeCapMap(t *testing.T) {
-	tstest.Shard(t)
 	tstest.Parallel(t)
 	env := NewTestEnv(t)
 
diff --git a/tstest/integration/integration.go b/tstest/integration/integration.go
index a98df8180..fe62bc5a2 100644
--- a/tstest/integration/integration.go
+++ b/tstest/integration/integration.go
@@ -40,6 +40,7 @@ import (
 	"tailscale.com/ipn/ipnstate"
 	"tailscale.com/ipn/store"
 	"tailscale.com/net/stun/stuntest"
+	"tailscale.com/paths"
 	"tailscale.com/safesocket"
 	"tailscale.com/syncs"
 	"tailscale.com/tailcfg"
@@ -49,6 +50,7 @@ import (
 	"tailscale.com/types/logger"
 	"tailscale.com/types/logid"
 	"tailscale.com/types/nettype"
+	"tailscale.com/util/cibuild"
 	"tailscale.com/util/rands"
 	"tailscale.com/util/zstdframe"
 	"tailscale.com/version"
@@ -57,6 +59,10 @@ import (
 var (
 	verboseTailscaled = flag.Bool("verbose-tailscaled", false, "verbose tailscaled logging")
 	verboseTailscale  = flag.Bool("verbose-tailscale", false, "verbose tailscale CLI logging")
+
+	// runWindowsServiceTests enables the Windows service-mode integration tests.
+	// On by default in CI; tests opt in via NewTestEnv(t, canRunAsServiceOnWindows()).
+	runWindowsServiceTests = flag.Bool("run-windows-service-tests", cibuild.On(), "run Windows service-mode integration tests")
 )
 
 // MainError is an error that's set if an error conditions happens outside of a
@@ -73,7 +79,11 @@ type Binaries struct {
 
 // BinaryInfo describes a tailscale or tailscaled binary.
 type BinaryInfo struct {
-	Path string // abs path to tailscale or tailscaled binary
+	// Path is the absolute path to the tailscale or tailscaled binary.
+	// This path may become invalid after the owning test's TempDir is
+	// cleaned up; use FD (or Contents on Windows) to access the binary
+	// contents.
+	Path string
 	Size int64
 
 	// FD and FDmu are set on Unix to efficiently copy the binary to a new
@@ -88,16 +98,24 @@ type BinaryInfo struct {
 	Contents []byte
 }
 
+// CopyTo copies or hardlinks the binary into dir, returning a new BinaryInfo
+// with an updated Path. The source bytes come from FD (or Contents on Windows),
+// not from b.Path, which may have been deleted when its owning test's TempDir
+// was cleaned up.
 func (b BinaryInfo) CopyTo(dir string) (BinaryInfo, error) {
 	ret := b
-	ret.Path = filepath.Join(dir, path.Base(b.Path))
+	ret.Path = filepath.Join(dir, filepath.Base(b.Path))
 
 	switch runtime.GOOS {
 	case "linux":
-		// TODO(bradfitz): be fancy and use linkat with AT_EMPTY_PATH to avoid
-		// copying? I couldn't get it to work, though.
-		// For now, just do the same thing as every other Unix and copy
-		// the binary.
+		// Try to hardlink from the open FD via /proc/self/fd, avoiding a
+		// full copy of the binary. We can't use os.Link(b.Path, ret.Path)
+		// because b.Path is in the first test's TempDir, which may be
+		// cleaned up before later tests call CopyTo. The open FD keeps the
+		// inode alive after the path is deleted.
+		if err := tryLinkat(b.FD, ret.Path); err == nil {
+			return ret, nil
+		}
 		fallthrough
 	case "darwin", "freebsd", "openbsd", "netbsd":
 		f, err := os.OpenFile(ret.Path, os.O_RDWR|os.O_CREATE|os.O_EXCL, 0o755)
@@ -303,7 +321,10 @@ func RunDERPAndSTUN(t testing.TB, logf logger.Logf, ipAddress string) (derpMap *
 		t.Fatal(err)
 	}
 
-	httpsrv := httptest.NewUnstartedServer(derpserver.Handler(d))
+	// Wrap with WebSocket support so browser-WASM (cmd/tsconnect) clients,
+	// which can only reach DERP via WebSocket, can use this same server.
+	handler := derpserver.AddWebSocketSupport(d, derpserver.Handler(d))
+	httpsrv := httptest.NewUnstartedServer(handler)
 	httpsrv.Listener.Close()
 	httpsrv.Listener = ln
 	httpsrv.Config.ErrorLog = logger.StdLogger(logf)
@@ -481,6 +502,7 @@ func (lc *LogCatcher) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 type TestEnv struct {
 	t                      testing.TB
 	tunMode                bool
+	windowsService         bool // run tailscaled as a Windows service
 	cli                    string
 	daemon                 string
 	loopbackPort           *int
@@ -519,11 +541,40 @@ func (f ConfigureControl) ModifyTestEnv(te *TestEnv) {
 	f(te.Control)
 }
 
+// canRunAsServiceOnWindowsOpt is the TestEnvOpt returned by canRunAsServiceOnWindows.
+type canRunAsServiceOnWindowsOpt struct{}
+
+func (canRunAsServiceOnWindowsOpt) ModifyTestEnv(te *TestEnv) {
+	// Only run as a service on Windows; on other platforms the test runs
+	// the normal userspace daemon with a faked Windows GOOS, as it always has.
+	if runtime.GOOS == "windows" {
+		te.windowsService = true
+	}
+}
+
+// canRunAsServiceOnWindows enables the test to run on Windows.
+// TODO(#20464): remove this and explicitly skip tests that need more work
+// before they can run on Windows, instead of requiring tests to opt in with this option.
+func canRunAsServiceOnWindows() TestEnvOpt { return canRunAsServiceOnWindowsOpt{} }
+
 // NewTestEnv starts a bunch of services and returns a new test environment.
 // NewTestEnv arranges for the environment's resources to be cleaned up on exit.
 func NewTestEnv(t testing.TB, opts ...TestEnvOpt) *TestEnv {
+	// Integration tests skip on Windows unless a test opts in via canRunAsServiceOnWindows.
+	// Pre-scan the opts before starting any servers so a skip leaks nothing.
+	canRunAsService := false
+	for _, o := range opts {
+		if _, ok := o.(canRunAsServiceOnWindowsOpt); ok {
+			canRunAsService = true
+		}
+	}
 	if runtime.GOOS == "windows" {
-		t.Skip("not tested/working on Windows yet")
+		if !canRunAsService {
+			t.Skip("integration tests skip on Windows unless the test calls canRunAsServiceOnWindows")
+		}
+		if !*runWindowsServiceTests {
+			t.Skip("Windows service tests disabled (--run-windows-service-tests=false)")
+		}
 	}
 	derpMap := RunDERPAndSTUN(t, logger.Discard, "127.0.0.1")
 	logc := new(LogCatcher)
@@ -593,11 +644,18 @@ func NewTestNode(t *testing.T, env *TestEnv) *TestNode {
 		sockFile = filepath.Join(os.TempDir(), rands.HexString(8)+".sock")
 		t.Cleanup(func() { os.Remove(sockFile) })
 	}
+	stateFile := filepath.Join(dir, "tailscaled.state") // matches what cmd/tailscaled uses
+	if env.windowsService {
+		// A LocalSystem service ignores --socket/--statedir and uses the
+		// default pipe and state path; point the harness at those.
+		sockFile = paths.DefaultTailscaledSocket()
+		stateFile = paths.DefaultTailscaledStateFile()
+	}
 	n := &TestNode{
 		env:       env,
 		dir:       dir,
 		sockFile:  sockFile,
-		stateFile: filepath.Join(dir, "tailscaled.state"), // matches what cmd/tailscaled uses
+		stateFile: stateFile,
 	}
 
 	// Look for a data race or panic.
@@ -760,9 +818,17 @@ func (op *nodeOutputParser) parseLinesLocked() {
 
 type Daemon struct {
 	Process *os.Process
+
+	// svc is set when the daemon is a Windows service (no owned Process);
+	// MustCleanShutdown then stops it via the SCM.
+	svc *TestNode
 }
 
 func (d *Daemon) MustCleanShutdown(t testing.TB) {
+	if d.svc != nil {
+		d.svc.stopService()
+		return
+	}
 	d.Process.Signal(os.Interrupt)
 	ps, err := d.Process.Wait()
 	if err != nil {
@@ -794,6 +860,40 @@ func (n *TestNode) awaitTailscaledRunnable() error {
 	return nil
 }
 
+// daemonEnv returns the extra environment variables to use when starting tailscaled.
+// The ipnGOOS argument overrides [envknob.GOOS].
+func (n *TestNode) daemonEnv(ipnGOOS string) []string {
+	env := []string{
+		"TS_DEBUG_PERMIT_HTTP_C2N=1",
+		"TS_LOG_TARGET=" + n.env.LogCatcherServer.URL,
+		"HTTP_PROXY=" + n.env.TrafficTrapServer.URL,
+		"HTTPS_PROXY=" + n.env.TrafficTrapServer.URL,
+		"TS_DEBUG_FAKE_GOOS=" + ipnGOOS,
+		"TS_LOGS_DIR=" + n.dir,
+		"TS_NETCHECK_GENERATE_204_URL=" + n.env.ControlServer.URL + "/generate_204",
+		"TS_ASSUME_NETWORK_UP_FOR_TEST=1", // don't pause control client in airplane mode (no wifi, etc)
+		"TS_PANIC_IF_HIT_MAIN_CONTROL=1",
+		"TS_DISABLE_PORTMAPPER=1", // shouldn't be needed; test is all localhost
+		"TS_DEBUG_LOG_RATE=all",
+	}
+	if n.allowUpdates {
+		env = append(env, "TS_TEST_ALLOW_AUTO_UPDATE=1")
+	}
+	if n.env.loopbackPort != nil {
+		env = append(env, "TS_DEBUG_NETSTACK_LOOPBACK_PORT="+strconv.Itoa(*n.env.loopbackPort))
+	}
+	if n.env.neverDirectUDP {
+		env = append(env, "TS_DEBUG_NEVER_DIRECT_UDP=1")
+	}
+	if n.env.relayServerUseLoopback {
+		env = append(env, "TS_DEBUG_RELAY_SERVER_ADDRS=::1,127.0.0.1")
+	}
+	if version.IsRace() {
+		env = append(env, "GORACE=halt_on_error=1")
+	}
+	return env
+}
+
 // StartDaemon starts the node's tailscaled, failing if it fails to start.
 // StartDaemon ensures that the process will exit when the test completes.
 func (n *TestNode) StartDaemon() *Daemon {
@@ -807,6 +907,12 @@ func (n *TestNode) StartDaemonAsIPNGOOS(ipnGOOS string) *Daemon {
 		t.Fatalf("awaitTailscaledRunnable: %v", err)
 	}
 
+	if n.env.windowsService {
+		// TODO(#20443): plumb service logs here so races/panics/DEBUG-ADDR are seen in service mode.
+		n.tailscaledParser = &nodeOutputParser{n: n}
+		return n.startWindowsServiceDaemon()
+	}
+
 	cmd := exec.Command(n.env.daemon)
 	cmd.Args = append(cmd.Args,
 		"--statedir="+n.dir,
@@ -828,34 +934,7 @@ func (n *TestNode) StartDaemonAsIPNGOOS(ipnGOOS string) *Daemon {
 	if n.encryptState {
 		cmd.Args = append(cmd.Args, "--encrypt-state")
 	}
-	cmd.Env = append(os.Environ(),
-		"TS_DEBUG_PERMIT_HTTP_C2N=1",
-		"TS_LOG_TARGET="+n.env.LogCatcherServer.URL,
-		"HTTP_PROXY="+n.env.TrafficTrapServer.URL,
-		"HTTPS_PROXY="+n.env.TrafficTrapServer.URL,
-		"TS_DEBUG_FAKE_GOOS="+ipnGOOS,
-		"TS_LOGS_DIR="+t.TempDir(),
-		"TS_NETCHECK_GENERATE_204_URL="+n.env.ControlServer.URL+"/generate_204",
-		"TS_ASSUME_NETWORK_UP_FOR_TEST=1", // don't pause control client in airplane mode (no wifi, etc)
-		"TS_PANIC_IF_HIT_MAIN_CONTROL=1",
-		"TS_DISABLE_PORTMAPPER=1", // shouldn't be needed; test is all localhost
-		"TS_DEBUG_LOG_RATE=all",
-	)
-	if n.allowUpdates {
-		cmd.Env = append(cmd.Env, "TS_TEST_ALLOW_AUTO_UPDATE=1")
-	}
-	if n.env.loopbackPort != nil {
-		cmd.Env = append(cmd.Env, "TS_DEBUG_NETSTACK_LOOPBACK_PORT="+strconv.Itoa(*n.env.loopbackPort))
-	}
-	if n.env.neverDirectUDP {
-		cmd.Env = append(cmd.Env, "TS_DEBUG_NEVER_DIRECT_UDP=1")
-	}
-	if n.env.relayServerUseLoopback {
-		cmd.Env = append(cmd.Env, "TS_DEBUG_RELAY_SERVER_ADDRS=::1,127.0.0.1")
-	}
-	if version.IsRace() {
-		cmd.Env = append(cmd.Env, "GORACE=halt_on_error=1")
-	}
+	cmd.Env = append(os.Environ(), n.daemonEnv(ipnGOOS)...)
 	n.tailscaledParser = &nodeOutputParser{n: n}
 	cmd.Stderr = n.tailscaledParser
 	if *verboseTailscaled {
@@ -904,6 +983,20 @@ func (n *TestNode) MustDown() {
 	if err := n.Tailscale("down", "--accept-risk=all").Run(); err != nil {
 		t.Fatalf("down: %v", err)
 	}
+
+	// The tailscale down command is asynchronous, so it returns early.
+	// Wait for tailscaled to drop its connection before continuing.
+	if err := tstest.WaitFor(time.Second, func() error {
+		if err := t.Context().Err(); err != nil {
+			return err
+		}
+		if c := n.env.Control.InServeMap(); c != 0 {
+			return fmt.Errorf("%d connections remaining in serve map", c)
+		}
+		return nil
+	}); err != nil {
+		t.Fatalf("tailscale down: %v", err)
+	}
 }
 
 func (n *TestNode) MustLogOut() {
@@ -1044,6 +1137,9 @@ func (n *TestNode) Tailscale(arg ...string) *exec.Cmd {
 	cmd.Env = append(os.Environ(),
 		"TS_DEBUG_UP_FLAG_GOOS="+n.upFlagGOOS,
 		"TS_LOGS_DIR="+n.env.t.TempDir(),
+		"SSH_CLIENT=",     // Clear SSH_CLIENT to prevent isSSHOverTailscale() false positives in tests
+		"SSH_CONNECTION=", // just in case
+		"SSH_AUTH_SOCK=",  // just in case
 	)
 	if *verboseTailscale {
 		cmd.Stdout = os.Stdout
@@ -1098,7 +1194,7 @@ func (n *TestNode) PublicKey() string {
 	return st.Self.PublicKey
 }
 
-// NLPublicKey returns the hex-encoded network lock public key of
+// NLPublicKey returns the hex-encoded tailnet lock public key of
 // this node, e.g. `tlpub:123456abc`
 func (n *TestNode) NLPublicKey() string {
 	tb := n.env.t
diff --git a/tstest/integration/integration_linkat_linux.go b/tstest/integration/integration_linkat_linux.go
new file mode 100644
index 000000000..68e9075d9
--- /dev/null
+++ b/tstest/integration/integration_linkat_linux.go
@@ -0,0 +1,24 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package integration
+
+import (
+	"fmt"
+	"os"
+
+	"golang.org/x/sys/unix"
+)
+
+// tryLinkat attempts to hardlink the file referenced by fd to newpath,
+// avoiding a full copy of the binary. It uses /proc/self/fd/<N> with
+// AT_SYMLINK_FOLLOW, which works without elevated privileges (unlike
+// AT_EMPTY_PATH which requires CAP_DAC_READ_SEARCH).
+func tryLinkat(fd *os.File, newpath string) error {
+	procPath := fmt.Sprintf("/proc/self/fd/%d", fd.Fd())
+	err := unix.Linkat(unix.AT_FDCWD, procPath, unix.AT_FDCWD, newpath, unix.AT_SYMLINK_FOLLOW)
+	if err != nil {
+		return fmt.Errorf("linkat via /proc/self/fd: %w", err)
+	}
+	return nil
+}
diff --git a/tstest/integration/integration_linkat_linux_test.go b/tstest/integration/integration_linkat_linux_test.go
new file mode 100644
index 000000000..fc0a2873f
--- /dev/null
+++ b/tstest/integration/integration_linkat_linux_test.go
@@ -0,0 +1,48 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package integration
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"golang.org/x/sys/unix"
+)
+
+func TestTryLinkat(t *testing.T) {
+	src := filepath.Join(t.TempDir(), "src")
+	if err := os.WriteFile(src, []byte("hello world"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	fd, err := os.Open(src)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer fd.Close()
+
+	dst := filepath.Join(t.TempDir(), "dst")
+	if err := tryLinkat(fd, dst); err != nil {
+		t.Fatal(err)
+	}
+
+	got, err := os.ReadFile(dst)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(got) != "hello world" {
+		t.Fatalf("got %q, want %q", got, "hello world")
+	}
+
+	var stSrc, stDst unix.Stat_t
+	if err := unix.Stat(src, &stSrc); err != nil {
+		t.Fatal(err)
+	}
+	if err := unix.Stat(dst, &stDst); err != nil {
+		t.Fatal(err)
+	}
+	if stSrc.Ino != stDst.Ino {
+		t.Fatalf("inodes differ: src=%d, dst=%d", stSrc.Ino, stDst.Ino)
+	}
+}
diff --git a/tstest/integration/integration_linkat_other.go b/tstest/integration/integration_linkat_other.go
new file mode 100644
index 000000000..7e22ca0da
--- /dev/null
+++ b/tstest/integration/integration_linkat_other.go
@@ -0,0 +1,15 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !linux
+
+package integration
+
+import (
+	"errors"
+	"os"
+)
+
+func tryLinkat(_ *os.File, _ string) error {
+	return errors.New("linkat with AT_EMPTY_PATH not supported on this OS")
+}
diff --git a/tstest/integration/integration_test.go b/tstest/integration/integration_test.go
index 74c9c745b..8a894c7cf 100644
--- a/tstest/integration/integration_test.go
+++ b/tstest/integration/integration_test.go
@@ -34,8 +34,8 @@ import (
 	"github.com/miekg/dns"
 	"go4.org/mem"
 	"tailscale.com/client/local"
-	"tailscale.com/client/tailscale"
 	"tailscale.com/cmd/testwrapper/flakytest"
+	"tailscale.com/envknob"
 	"tailscale.com/feature"
 	_ "tailscale.com/feature/clientupdate"
 	"tailscale.com/health"
@@ -58,6 +58,11 @@ func TestMain(m *testing.M) {
 	// Have to disable UPnP which hits the network, otherwise it fails due to HTTP proxy.
 	os.Setenv("TS_DISABLE_UPNP", "true")
 	flag.Parse()
+	if *runWindowsServiceTests && runtime.GOOS == "windows" {
+		// On Windows the service is a singleton, so its tests run serially.
+		// envknob.Setenv refreshes the TS_SERIAL_TESTS that tstest.Parallel reads.
+		envknob.Setenv("TS_SERIAL_TESTS", "true")
+	}
 	v := m.Run()
 	if v != 0 {
 		os.Exit(v)
@@ -69,13 +74,18 @@ func TestMain(m *testing.M) {
 	os.Exit(0)
 }
 
+// fetchNetMapForTest fetches the current netmap from tailscaled via the
+// "current-netmap" debug action. The debug action's payload shape is
+// intentionally not part of any stable API; tests use it to inspect
+// internal state.
+func fetchNetMapForTest(ctx context.Context, lc *local.Client) (*netmap.NetworkMap, error) {
+	return local.GetDebugResultJSON[*netmap.NetworkMap](ctx, lc, "current-netmap")
+}
+
 // Tests that tailscaled starts up in TUN mode, and also without data races:
 // https://github.com/tailscale/tailscale/issues/7894
 func TestTUNMode(t *testing.T) {
-	tstest.Shard(t)
-	if os.Getuid() != 0 {
-		t.Skip("skipping when not root")
-	}
+	tstest.RequireRoot(t)
 	tstest.Parallel(t)
 	env := NewTestEnv(t)
 	env.tunMode = true
@@ -92,7 +102,6 @@ func TestTUNMode(t *testing.T) {
 }
 
 func TestOneNodeUpNoAuth(t *testing.T) {
-	tstest.Shard(t)
 	tstest.Parallel(t)
 	env := NewTestEnv(t)
 	n1 := NewTestNode(t, env)
@@ -110,7 +119,6 @@ func TestOneNodeUpNoAuth(t *testing.T) {
 }
 
 func TestOneNodeExpiredKey(t *testing.T) {
-	tstest.Shard(t)
 	tstest.Parallel(t)
 	env := NewTestEnv(t)
 	n1 := NewTestNode(t, env)
@@ -147,7 +155,6 @@ func TestOneNodeExpiredKey(t *testing.T) {
 }
 
 func TestControlKnobs(t *testing.T) {
-	tstest.Shard(t)
 	tstest.Parallel(t)
 	env := NewTestEnv(t)
 	n1 := NewTestNode(t, env)
@@ -178,7 +185,6 @@ func TestControlKnobs(t *testing.T) {
 }
 
 func TestExpectedFeaturesLinked(t *testing.T) {
-	tstest.Shard(t)
 	tstest.Parallel(t)
 	env := NewTestEnv(t)
 	n1 := NewTestNode(t, env)
@@ -200,7 +206,6 @@ func TestExpectedFeaturesLinked(t *testing.T) {
 }
 
 func TestCollectPanic(t *testing.T) {
-	tstest.Shard(t)
 	tstest.Parallel(t)
 	env := NewTestEnv(t)
 	n := NewTestNode(t, env)
@@ -243,7 +248,6 @@ func TestCollectPanic(t *testing.T) {
 }
 
 func TestControlTimeLogLine(t *testing.T) {
-	tstest.Shard(t)
 	tstest.Parallel(t)
 	env := NewTestEnv(t)
 	env.LogCatcher.StoreRawJSON()
@@ -267,7 +271,6 @@ func TestControlTimeLogLine(t *testing.T) {
 
 // test Issue 2321: Start with UpdatePrefs should save prefs to disk
 func TestStateSavedOnStart(t *testing.T) {
-	tstest.Shard(t)
 	tstest.Parallel(t)
 	env := NewTestEnv(t)
 	n1 := NewTestNode(t, env)
@@ -468,84 +471,202 @@ func TestOneNodeUpAuth(t *testing.T) {
 			},
 		},
 	} {
-		tstest.Shard(t)
+		t.Run(tt.name, func(t *testing.T) {
+			tstest.Parallel(t)
 
-		for _, useSeamlessKeyRenewal := range []bool{true, false} {
-			name := tt.name
-			if useSeamlessKeyRenewal {
-				name += "-with-seamless"
-			}
-			t.Run(name, func(t *testing.T) {
-				tstest.Parallel(t)
-
-				env := NewTestEnv(t, ConfigureControl(
-					func(control *testcontrol.Server) {
-						if tt.authKey != "" {
-							control.RequireAuthKey = tt.authKey
-						} else {
-							control.RequireAuth = true
-						}
-
-						if tt.requireDeviceApproval {
-							control.RequireMachineAuth = true
-						}
-
-						control.AllNodesSameUser = true
-
-						if useSeamlessKeyRenewal {
-							control.DefaultNodeCapabilities = &tailcfg.NodeCapMap{
-								tailcfg.NodeAttrSeamlessKeyRenewal: []tailcfg.RawMessage{},
-							}
-						}
-					},
-				))
-
-				n1 := NewTestNode(t, env)
-				d1 := n1.StartDaemon()
-				defer d1.MustCleanShutdown(t)
-
-				for i, step := range tt.steps {
-					t.Logf("Running step %d", i)
-					cmdArgs := append(step.args, "--login-server="+env.ControlURL())
-
-					t.Logf("Running command: %s", strings.Join(cmdArgs, " "))
-
-					var authURLCount atomic.Int32
-					var deviceApprovalURLCount atomic.Int32
-
-					handler := &authURLParserWriter{t: t,
-						authURLFn:           completeLogin(t, env.Control, &authURLCount),
-						deviceApprovalURLFn: completeDeviceApproval(t, n1, &deviceApprovalURLCount),
+			env := NewTestEnv(t, ConfigureControl(
+				func(control *testcontrol.Server) {
+					if tt.authKey != "" {
+						control.RequireAuthKey = tt.authKey
+					} else {
+						control.RequireAuth = true
 					}
 
-					cmd := n1.Tailscale(cmdArgs...)
-					cmd.Stdout = handler
-					cmd.Stdout = handler
-					cmd.Stderr = cmd.Stdout
-					if err := cmd.Run(); err != nil {
-						t.Fatalf("up: %v", err)
+					if tt.requireDeviceApproval {
+						control.RequireMachineAuth = true
 					}
 
-					n1.AwaitRunning()
+					control.AllNodesSameUser = true
+				},
+			))
 
-					var wantAuthURLCount int32
-					if step.wantAuthURL {
-						wantAuthURLCount = 1
-					}
-					if n := authURLCount.Load(); n != wantAuthURLCount {
-						t.Errorf("Auth URLs completed = %d; want %d", n, wantAuthURLCount)
-					}
+			n1 := NewTestNode(t, env)
+			d1 := n1.StartDaemon()
+			defer d1.MustCleanShutdown(t)
 
-					var wantDeviceApprovalURLCount int32
-					if step.wantDeviceApprovalURL {
-						wantDeviceApprovalURLCount = 1
-					}
-					if n := deviceApprovalURLCount.Load(); n != wantDeviceApprovalURLCount {
-						t.Errorf("Device approval URLs completed = %d; want %d", n, wantDeviceApprovalURLCount)
-					}
+			for i, step := range tt.steps {
+				t.Logf("Running step %d", i)
+				cmdArgs := append(step.args, "--login-server="+env.ControlURL())
+
+				t.Logf("Running command: %s", strings.Join(cmdArgs, " "))
+
+				var authURLCount atomic.Int32
+				var deviceApprovalURLCount atomic.Int32
+
+				handler := &authURLParserWriter{t: t,
+					authURLFn:           completeLogin(t, env.Control, &authURLCount),
+					deviceApprovalURLFn: completeDeviceApproval(t, n1, &deviceApprovalURLCount),
 				}
-			})
+
+				cmd := n1.Tailscale(cmdArgs...)
+				cmd.Stdout = handler
+				cmd.Stdout = handler
+				cmd.Stderr = cmd.Stdout
+				if err := cmd.Run(); err != nil {
+					t.Fatalf("up: %v", err)
+				}
+
+				n1.AwaitRunning()
+
+				var wantAuthURLCount int32
+				if step.wantAuthURL {
+					wantAuthURLCount = 1
+				}
+				if n := authURLCount.Load(); n != wantAuthURLCount {
+					t.Errorf("Auth URLs completed = %d; want %d", n, wantAuthURLCount)
+				}
+
+				var wantDeviceApprovalURLCount int32
+				if step.wantDeviceApprovalURL {
+					wantDeviceApprovalURLCount = 1
+				}
+				if n := deviceApprovalURLCount.Load(); n != wantDeviceApprovalURLCount {
+					t.Errorf("Device approval URLs completed = %d; want %d", n, wantDeviceApprovalURLCount)
+				}
+			}
+		})
+	}
+}
+
+// TestRetagStaleMapRequestRace reproduces tailscale/tailscale#20365: a node
+// tagged tag:tag1, where tag:tag1 owns tag:tag2, is retagged with "tailscale
+// up --advertise-tags=tag:tag2". This should always succeed, but sometimes
+// the machine is logged out instead.
+//
+// The cause is a race: "tailscale up" makes LocalBackend.Start shut down the
+// old control client asynchronously while the new one starts, so a lite map
+// update carrying the old Hostinfo.RequestTags can still be in flight when
+// the new client's requests retag the node. If control processes the stale
+// update after the tag transition, it looks like a request to change the
+// node's tags from tag:tag2 back to tag:tag1. That fails the tag ownership
+// check (tag:tag2 doesn't own tag:tag1), and control expires the node's key
+// to force reauthentication, logging the machine out.
+//
+// The test recreates that interleaving deterministically: it triggers a lite
+// map update carrying the old tags (any routine hostinfo change does that),
+// holds it at the server, retags the node, and only then lets the held
+// update be processed.
+func TestRetagStaleMapRequestRace(t *testing.T) {
+	tstest.Parallel(t)
+
+	var (
+		holdStale    atomic.Bool
+		staleHeld    = make(chan struct{}, 1)
+		staleRelease = make(chan struct{})
+		staleDone    = make(chan struct{}, 1)
+	)
+	env := NewTestEnv(t, ConfigureControl(func(control *testcontrol.Server) {
+		control.TagOwners = map[string][]string{
+			"tag:tag1": nil,
+			"tag:tag2": {"tag:tag1"},
 		}
+		control.HoldMapRequest = func(req *tailcfg.MapRequest) (done func()) {
+			if req.Stream || req.Hostinfo == nil || !holdStale.Load() {
+				return nil
+			}
+			if !slices.Equal(req.Hostinfo.RequestTags, []string{"tag:tag1"}) {
+				return nil
+			}
+			select {
+			case staleHeld <- struct{}{}:
+			default:
+			}
+			<-staleRelease
+			return func() {
+				select {
+				case staleDone <- struct{}{}:
+				default:
+				}
+			}
+		}
+	}))
+
+	n1 := NewTestNode(t, env)
+	d1 := n1.StartDaemon()
+	defer d1.MustCleanShutdown(t)
+	n1.AwaitResponding()
+	n1.MustUp("--advertise-tags=tag:tag1")
+	n1.AwaitRunning()
+
+	nodes := env.Control.AllNodes()
+	if len(nodes) != 1 {
+		t.Fatalf("expected 1 node, got %d", len(nodes))
+	}
+	origKey := nodes[0].Key
+	if got, want := nodes[0].Tags, []string{"tag:tag1"}; !slices.Equal(got, want) {
+		t.Fatalf("node tags = %v; want %v", got, want)
+	}
+
+	// Make the current control client send a lite map update carrying the
+	// old RequestTags, as any routine hostinfo change does. Control holds
+	// it (per HoldMapRequest above) so that it's still outstanding when
+	// the node is retagged below. Shutting down that control client
+	// cancels the request but can't unsend it; control still has it.
+	holdStale.Store(true)
+	if out, err := n1.Tailscale("set", "--hostname=retag-race-test").CombinedOutput(); err != nil {
+		t.Fatalf("tailscale set: %v, %s", err, out)
+	}
+	select {
+	case <-staleHeld:
+	case <-time.After(10 * time.Second):
+		t.Fatal("timed out waiting for the stale map update to reach control")
+	}
+
+	// Retag the node while the stale update is still outstanding. This
+	// doesn't block on the held update: the new control client's requests
+	// are processed while it is held.
+	n1.MustUp("--advertise-tags=tag:tag2")
+	if err := tstest.WaitFor(10*time.Second, func() error {
+		n := env.Control.Node(origKey)
+		if n == nil {
+			return fmt.Errorf("node %v not found in control", origKey.ShortString())
+		}
+		if !slices.Equal(n.Tags, []string{"tag:tag2"}) {
+			return fmt.Errorf("node tags = %v; want [tag:tag2]", n.Tags)
+		}
+		return nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	// Let control process the stale update, now that the retag has been
+	// committed, and wait for it to finish.
+	close(staleRelease)
+	select {
+	case <-staleDone:
+	case <-time.After(10 * time.Second):
+		t.Fatal("timed out waiting for control to process the stale map update")
+	}
+
+	// The retag should stick, and the machine should stay logged in with
+	// the same node key. With the bug present, control instead expires the
+	// node key when it processes the stale update.
+	n := env.Control.Node(origKey)
+	if n == nil {
+		t.Fatalf("node %v disappeared from control", origKey.ShortString())
+	}
+	if !n.KeyExpiry.IsZero() {
+		t.Fatalf("control expired the node key after processing a stale map update; the machine was logged out (issue 20365)")
+	}
+	if got, want := n.Tags, []string{"tag:tag2"}; !slices.Equal(got, want) {
+		t.Fatalf("node tags = %v; want %v", got, want)
+	}
+	st := n1.MustStatus()
+	if st.BackendState != "Running" {
+		t.Errorf("BackendState = %q; want Running", st.BackendState)
+	}
+	if st.Self.PublicKey != origKey {
+		t.Errorf("node key changed from %v to %v; the machine was logged out and re-registered", origKey.ShortString(), st.Self.PublicKey.ShortString())
 	}
 }
 
@@ -567,7 +688,6 @@ func isNonZeroExitCode(err error) bool {
 // If we interrupt `tailscale up` and then run it again, we should only
 // print a single auth URL.
 func TestOneNodeUpInterruptedAuth(t *testing.T) {
-	tstest.Shard(t)
 	tstest.Parallel(t)
 
 	env := NewTestEnv(t, ConfigureControl(
@@ -646,7 +766,6 @@ func TestOneNodeUpInterruptedAuth(t *testing.T) {
 // complete the device approval, we should see the device approval URL
 // when we run `tailscale up` a second time.
 func TestOneNodeUpInterruptedDeviceApproval(t *testing.T) {
-	tstest.Shard(t)
 	tstest.Parallel(t)
 
 	env := NewTestEnv(t, ConfigureControl(
@@ -726,8 +845,6 @@ func TestOneNodeUpInterruptedDeviceApproval(t *testing.T) {
 }
 
 func TestConfigFileAuthKey(t *testing.T) {
-	tstest.SkipOnUnshardedCI(t)
-	tstest.Shard(t)
 	t.Parallel()
 	const authKey = "opensesame"
 	env := NewTestEnv(t, ConfigureControl(func(control *testcontrol.Server) {
@@ -753,7 +870,6 @@ func TestConfigFileAuthKey(t *testing.T) {
 }
 
 func TestTwoNodes(t *testing.T) {
-	tstest.Shard(t)
 	tstest.Parallel(t)
 	env := NewTestEnv(t)
 
@@ -839,7 +955,6 @@ func TestTwoNodes(t *testing.T) {
 // tests two nodes where the first gets a incremental MapResponse (with only
 // PeersRemoved set) saying that the second node disappeared.
 func TestIncrementalMapUpdatePeersRemoved(t *testing.T) {
-	tstest.Shard(t)
 	tstest.Parallel(t)
 	env := NewTestEnv(t)
 
@@ -922,8 +1037,96 @@ func TestIncrementalMapUpdatePeersRemoved(t *testing.T) {
 	d2.MustCleanShutdown(t)
 }
 
+// TestIncrementalMapUpdatePeerAllowedIPsReachability verifies that an incremental
+// peer upsert changing a peer's AllowedIPs reprograms the local WireGuard config.
+// This covers VIP additions at runtime, where the VIP route is not reachable
+// before the map mutation but is reachable over TSMP afterward.
+func TestIncrementalMapUpdatePeerAllowedIPsReachability(t *testing.T) {
+	tstest.Parallel(t)
+	env := NewTestEnv(t)
+
+	n1 := NewTestNode(t, env)
+	d1 := n1.StartDaemon()
+	defer d1.MustCleanShutdown(t)
+	n1.AwaitListening()
+	n1.MustUp()
+	n1.AwaitRunning()
+
+	n2 := NewTestNode(t, env)
+	d2 := n2.StartDaemon()
+	defer d2.MustCleanShutdown(t)
+	n2.AwaitListening()
+	n2.MustUp()
+	n2.AwaitRunning()
+
+	n1Status := n1.MustStatus()
+	n2Status := n2.MustStatus()
+	tnode1 := env.Control.Node(n1Status.Self.PublicKey)
+	if tnode1 == nil {
+		t.Fatalf("control has no node for %v", n1Status.Self.PublicKey)
+	}
+	tnode2 := env.Control.Node(n2Status.Self.PublicKey)
+	if tnode2 == nil {
+		t.Fatalf("control has no node for %v", n2Status.Self.PublicKey)
+	}
+
+	vip := netip.MustParseAddr("100.99.99.99")
+	vipPrefix := netip.PrefixFrom(vip, vip.BitLen())
+
+	if err := n1.Tailscale("ping", "--tsmp", "--c=1", "--timeout=5s", n2.AwaitIP4().String()).Run(); err != nil {
+		t.Fatalf("initial ping n1 -> n2: %v", err)
+	}
+	if err := n1.Tailscale("ping", "--tsmp", "--c=1", "--timeout=1s", vip.String()).Run(); err == nil {
+		t.Fatalf("ping n1 -> n2 VIP %v before AllowedIPs delta succeeded unexpectedly", vip)
+	}
+
+	mr, err := env.Control.MapResponse(&tailcfg.MapRequest{NodeKey: tnode1.Key})
+	if err != nil {
+		t.Fatalf("MapResponse: %v", err)
+	}
+	var replacement *tailcfg.Node
+	for _, p := range mr.Peers {
+		if p.ID == tnode2.ID {
+			replacement = p.Clone()
+			break
+		}
+	}
+	if replacement == nil {
+		t.Fatalf("MapResponse for n1 has no peer n2")
+	}
+
+	replacement.AllowedIPs = append(replacement.AllowedIPs, vipPrefix)
+	if !env.Control.AddRawMapResponse(tnode1.Key, &tailcfg.MapResponse{
+		PeersChanged: []*tailcfg.Node{replacement},
+	}) {
+		t.Fatalf("failed to add map response")
+	}
+
+	if err := tstest.WaitFor(5*time.Second, func() error {
+		st := n1.MustStatus()
+		p, ok := st.Peer[tnode2.Key]
+		if !ok {
+			return fmt.Errorf("node 1 doesn't see node 2 as a peer")
+		}
+		if p.AllowedIPs == nil {
+			return fmt.Errorf("node 1 sees node 2 with no AllowedIPs")
+		}
+		for _, allowedIP := range p.AllowedIPs.All() {
+			if allowedIP == vipPrefix {
+				return nil
+			}
+		}
+		return fmt.Errorf("node 1 sees node 2 AllowedIPs %v; want %v", p.AllowedIPs, vipPrefix)
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := n1.Tailscale("ping", "--tsmp", "--c=1", "--timeout=5s", vip.String()).Run(); err != nil {
+		t.Fatalf("ping n1 -> n2 VIP %v after AllowedIPs delta: %v", vip, err)
+	}
+}
+
 func TestNodeAddressIPFields(t *testing.T) {
-	tstest.Shard(t)
 	flakytest.Mark(t, "https://github.com/tailscale/tailscale/issues/7008")
 	tstest.Parallel(t)
 	env := NewTestEnv(t)
@@ -951,7 +1154,6 @@ func TestNodeAddressIPFields(t *testing.T) {
 }
 
 func TestAddPingRequest(t *testing.T) {
-	tstest.Shard(t)
 	tstest.Parallel(t)
 	env := NewTestEnv(t)
 	n1 := NewTestNode(t, env)
@@ -1004,7 +1206,6 @@ func TestAddPingRequest(t *testing.T) {
 }
 
 func TestC2NPingRequest(t *testing.T) {
-	tstest.Shard(t)
 	tstest.Parallel(t)
 
 	env := NewTestEnv(t)
@@ -1066,7 +1267,6 @@ func TestC2NPingRequest(t *testing.T) {
 // Issue 2434: when "down" (WantRunning false), tailscaled shouldn't
 // be connected to control.
 func TestNoControlConnWhenDown(t *testing.T) {
-	tstest.Shard(t)
 	tstest.Parallel(t)
 	env := NewTestEnv(t)
 	n1 := NewTestNode(t, env)
@@ -1089,14 +1289,24 @@ func TestNoControlConnWhenDown(t *testing.T) {
 
 	n1.AwaitBackendState("Stopped")
 
+	// The real test: verify our daemon doesn't have an HTTP request open.
+	// Stopping the client may take some time to disconnect from testcontrol.
+	if err := tstest.WaitFor(time.Second, func() error {
+		if n := env.Control.InServeMap(); n != 0 {
+			return fmt.Errorf("in serve map = %d; want 0", n)
+		}
+		return nil
+	}); err != nil {
+		t.Fatalf("unexpected connections while stopped: %v", err)
+	}
+
 	ip2 := n1.AwaitIP4()
 	if ip1 != ip2 {
 		t.Errorf("IPs different: %q vs %q", ip1, ip2)
 	}
 
-	// The real test: verify our daemon doesn't have an HTTP request open.
 	if n := env.Control.InServeMap(); n != 0 {
-		t.Errorf("in serve map = %d; want 0", n)
+		t.Fatalf("unexpected connection triggered by tailscale ip: in serve map = %d; want 0", n)
 	}
 
 	d2.MustCleanShutdown(t)
@@ -1105,9 +1315,8 @@ func TestNoControlConnWhenDown(t *testing.T) {
 // Issue 2137: make sure Windows tailscaled works with the CLI alone,
 // without the GUI to kick off a Start.
 func TestOneNodeUpWindowsStyle(t *testing.T) {
-	tstest.Shard(t)
 	tstest.Parallel(t)
-	env := NewTestEnv(t)
+	env := NewTestEnv(t, canRunAsServiceOnWindows())
 	n1 := NewTestNode(t, env)
 	n1.upFlagGOOS = "windows"
 
@@ -1126,7 +1335,6 @@ func TestOneNodeUpWindowsStyle(t *testing.T) {
 // node can initiate connections to the jailed node.
 func TestClientSideJailing(t *testing.T) {
 	flakytest.Mark(t, "https://github.com/tailscale/tailscale/issues/17419")
-	tstest.Shard(t)
 	tstest.Parallel(t)
 	env := NewTestEnv(t)
 	registerNode := func() (*TestNode, key.NodePublic) {
@@ -1204,20 +1412,18 @@ func TestClientSideJailing(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	waitPeerIsJailed := func(t *testing.T, b *tailscale.IPNBusWatcher, jailed bool) {
+	waitPeerIsJailed := func(t *testing.T, b *local.IPNBusWatcher, lc *local.Client, jailed bool) {
 		t.Helper()
 		for {
-			n, err := b.Next()
+			_, err := b.Next()
 			if err != nil {
 				t.Fatal(err)
 			}
-			if n.NetMap == nil {
+			nm, err := fetchNetMapForTest(context.Background(), lc)
+			if err != nil || nm == nil || len(nm.Peers) == 0 {
 				continue
 			}
-			if len(n.NetMap.Peers) == 0 {
-				continue
-			}
-			if j := n.NetMap.Peers[0].IsJailed(); j == jailed {
+			if j := nm.Peers[0].IsJailed(); j == jailed {
 				break
 			}
 		}
@@ -1228,8 +1434,8 @@ func TestClientSideJailing(t *testing.T) {
 			env.Control.SetJailed(k2, k1, tc.n1JailedForN2)
 
 			// Wait for the jailed status to propagate.
-			waitPeerIsJailed(t, b1, tc.n2JailedForN1)
-			waitPeerIsJailed(t, b2, tc.n1JailedForN2)
+			waitPeerIsJailed(t, b1, lc1, tc.n2JailedForN1)
+			waitPeerIsJailed(t, b2, lc2, tc.n1JailedForN2)
 
 			testDial(t, lc1, ip2, port, tc.n1JailedForN2)
 			testDial(t, lc2, ip1, port, tc.n2JailedForN1)
@@ -1241,7 +1447,6 @@ func TestClientSideJailing(t *testing.T) {
 // tries to do bi-directional pings between them.
 func TestNATPing(t *testing.T) {
 	flakytest.Mark(t, "https://github.com/tailscale/tailscale/issues/12169")
-	tstest.Shard(t)
 	tstest.Parallel(t)
 	for _, v6 := range []bool{false, true} {
 		env := NewTestEnv(t)
@@ -1369,7 +1574,6 @@ func TestNATPing(t *testing.T) {
 }
 
 func TestLogoutRemovesAllPeers(t *testing.T) {
-	tstest.Shard(t)
 	tstest.Parallel(t)
 	env := NewTestEnv(t)
 	// Spin up some nodes.
@@ -1431,7 +1635,6 @@ func TestAutoUpdateDefaults_cap(t *testing.T) { testAutoUpdateDefaults(t, true)
 func testAutoUpdateDefaults(t *testing.T, useCap bool) {
 	t.Cleanup(feature.HookCanAutoUpdate.SetForTest(func() bool { return true }))
 
-	tstest.Shard(t)
 	env := NewTestEnv(t)
 
 	var (
@@ -1564,10 +1767,7 @@ func testAutoUpdateDefaults(t *testing.T, useCap bool) {
 // gVisor/netstack.
 // https://github.com/tailscale/corp/issues/22511
 func TestDNSOverTCPIntervalResolver(t *testing.T) {
-	tstest.Shard(t)
-	if os.Getuid() != 0 {
-		t.Skip("skipping when not root")
-	}
+	tstest.RequireRoot(t)
 	env := NewTestEnv(t)
 	env.tunMode = true
 	n1 := NewTestNode(t, env)
@@ -1636,10 +1836,7 @@ func TestDNSOverTCPIntervalResolver(t *testing.T) {
 // TestNetstackTCPLoopback tests netstack loopback of a TCP stream, in both
 // directions.
 func TestNetstackTCPLoopback(t *testing.T) {
-	tstest.Shard(t)
-	if os.Getuid() != 0 {
-		t.Skip("skipping when not root")
-	}
+	tstest.RequireRoot(t)
 
 	env := NewTestEnv(t)
 	env.tunMode = true
@@ -1778,10 +1975,7 @@ func TestNetstackTCPLoopback(t *testing.T) {
 // TestNetstackUDPLoopback tests netstack loopback of UDP packets, in both
 // directions.
 func TestNetstackUDPLoopback(t *testing.T) {
-	tstest.Shard(t)
-	if os.Getuid() != 0 {
-		t.Skip("skipping when not root")
-	}
+	tstest.RequireRoot(t)
 
 	env := NewTestEnv(t)
 	env.tunMode = true
@@ -1929,7 +2123,6 @@ func TestEncryptStateMigration(t *testing.T) {
 	if runtime.GOOS != "linux" && runtime.GOOS != "windows" {
 		t.Skip("--encrypt-state for tailscaled state not supported on this platform")
 	}
-	tstest.Shard(t)
 	tstest.Parallel(t)
 	env := NewTestEnv(t)
 	n := NewTestNode(t, env)
@@ -1985,7 +2178,6 @@ func TestEncryptStateMigration(t *testing.T) {
 // expected values.
 func TestPeerRelayPing(t *testing.T) {
 	flakytest.Mark(t, "https://github.com/tailscale/tailscale/issues/17251")
-	tstest.Shard(t)
 	tstest.Parallel(t)
 
 	env := NewTestEnv(t, ConfigureControl(func(server *testcontrol.Server) {
@@ -2125,7 +2317,6 @@ func TestPeerRelayPing(t *testing.T) {
 }
 
 func TestC2NDebugNetmap(t *testing.T) {
-	tstest.Shard(t)
 	tstest.Parallel(t)
 	env := NewTestEnv(t, ConfigureControl(func(s *testcontrol.Server) {
 		s.CollectServices = opt.False
@@ -2268,7 +2459,6 @@ func TestTailnetLock(t *testing.T) {
 	// If you run `tailscale lock log` on a node where Tailnet Lock isn't
 	// enabled, you get an error explaining that.
 	t.Run("log-when-not-enabled", func(t *testing.T) {
-		tstest.Shard(t)
 		t.Parallel()
 
 		env := NewTestEnv(t)
@@ -2306,7 +2496,6 @@ func TestTailnetLock(t *testing.T) {
 	// the signed nodes can talk to each other but the unsigned node cannot
 	// talk to anybody.
 	t.Run("node-connectivity", func(t *testing.T) {
-		tstest.Shard(t)
 		t.Parallel()
 
 		env := NewTestEnv(t)
@@ -2382,7 +2571,6 @@ func TestTailnetLock(t *testing.T) {
 	t.Run("no-keys-is-error", func(t *testing.T) {
 		for _, verb := range []string{"add", "remove", "revoke-keys"} {
 			t.Run(verb, func(t *testing.T) {
-				tstest.Shard(t)
 				t.Parallel()
 
 				env := NewTestEnv(t)
@@ -2409,7 +2597,6 @@ func TestTailnetLock(t *testing.T) {
 }
 
 func TestNodeWithBadStateFile(t *testing.T) {
-	tstest.Shard(t)
 	tstest.Parallel(t)
 	env := NewTestEnv(t)
 	n1 := NewTestNode(t, env)
diff --git a/tstest/integration/jswasmtest/index.html b/tstest/integration/jswasmtest/index.html
new file mode 100644
index 000000000..205b9231f
--- /dev/null
+++ b/tstest/integration/jswasmtest/index.html
@@ -0,0 +1,167 @@
+<!doctype html>
+<!--
+  Copyright (c) Tailscale Inc & contributors
+  SPDX-License-Identifier: BSD-3-Clause
+
+  Fixture page for tailscale.com/tstest/integration/jswasmtest.
+
+  It imports the built pkg.js (served by the Go harness at /_pkg/) and
+  dispatches into one of two flows based on URL query parameters, then
+  reports back via window.tsTest so the Go-side chromedp driver only
+  has to poll one flag (window.tsTest.done) and then read static fields.
+
+  createIPN flow (no query params): just instantiate via createIPN with
+  a junk auth key and report the IPN object's method types. Used by
+  TestCreateIPN.
+
+  fetch flow (?mode=fetch&controlURL=...&authKey=...&peerURL=...&hostname=...):
+  call createIPN with the given controlURL+authKey, wait for the IPN to
+  reach BackendState=Running, then ipn.fetch(peerURL) and report the
+  response status + body. Used by TestFetchTailnetPeer.
+-->
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <title>@tailscale/connect jswasmtest</title>
+</head>
+<body>
+  <div id="status">loading...</div>
+  <script type="module">
+    const tsTest = {
+      mode: null,
+      imported: false,
+      importErrors: [],
+      runtimeErrors: [],
+      panics: [],
+      exports: null,
+
+      // createIPN flow:
+      ipnMethods: null,
+      instantiateError: null,
+
+      // Fetch flow:
+      states: [],
+      browseURLs: [],
+      runError: null,
+      fetchResult: null,
+      fetchError: null,
+
+      done: false,
+    };
+    window.tsTest = tsTest;
+
+    window.addEventListener("error", (e) => {
+      tsTest.runtimeErrors.push(String(e.error || e.message));
+    });
+    window.addEventListener("unhandledrejection", (e) => {
+      tsTest.runtimeErrors.push(String(e.reason));
+    });
+
+    const setStatus = (s) => { document.getElementById("status").textContent = s; };
+
+    const params = new URLSearchParams(window.location.search);
+    tsTest.mode = params.get("mode") || "createIPN";
+
+    try {
+      const mod = await import("/_pkg/pkg.js");
+      tsTest.imported = true;
+      tsTest.exports = {
+        createIPN: typeof mod.createIPN,
+        runSSHSession: typeof mod.runSSHSession,
+      };
+      setStatus("imported");
+
+      if (tsTest.mode === "createIPN") {
+        // createIPN with a junk auth key just to verify the WASM loads and
+        // newIPN returns an object with the documented methods. We never
+        // call ipn.run(), so no control-plane traffic is attempted.
+        try {
+          const ipn = await mod.createIPN({
+            authKey: "tskey-pkgtest-not-real",
+            wasmURL: "/_pkg/main.wasm",
+            panicHandler: (err) => { tsTest.panics.push(String(err)); },
+          });
+          tsTest.ipnMethods = {
+            run: typeof ipn.run,
+            login: typeof ipn.login,
+            logout: typeof ipn.logout,
+            ssh: typeof ipn.ssh,
+            fetch: typeof ipn.fetch,
+          };
+          setStatus("instantiated");
+        } catch (err) {
+          tsTest.instantiateError = String(err);
+          setStatus("instantiate failed");
+        }
+      } else if (tsTest.mode === "fetch") {
+        const controlURL = params.get("controlURL");
+        const authKey = params.get("authKey");
+        const peerURL = params.get("peerURL");
+        const hostname = params.get("hostname") || "browser-pkgtest";
+
+        const ipn = await mod.createIPN({
+          authKey,
+          controlURL,
+          hostname,
+          wasmURL: "/_pkg/main.wasm",
+          panicHandler: (err) => { tsTest.panics.push(String(err)); },
+        });
+        setStatus("instantiated");
+
+        // Wait for the IPN to reach "Running" via the notifyState callback,
+        // then fetch the peer URL through ipn.fetch (which dials via the
+        // tailnet, not the browser).
+        await new Promise((resolve, reject) => {
+          let settled = false;
+          const settle = (err) => {
+            if (settled) return;
+            settled = true;
+            if (err) reject(err); else resolve();
+          };
+          ipn.run({
+            notifyState: (state) => {
+              tsTest.states.push(state);
+              setStatus("state: " + state);
+              // LocalBackend.Start does not auto-call Login on a fresh
+              // profile (no node key, no config file). Match what
+              // tsnet.Server.Up does: when state is NeedsLogin and we
+              // were given an auth key, kick off StartLoginInteractive
+              // so the auth key gets used.
+              if (state === "NeedsLogin") ipn.login();
+              if (state === "Running") settle();
+            },
+            notifyNetMap: () => {},
+            notifyBrowseToURL: (url) => { tsTest.browseURLs.push(url); },
+            notifyPanicRecover: (err) => { settle(new Error("panic: " + err)); },
+          });
+        });
+
+        try {
+          const resp = await ipn.fetch(peerURL);
+          const body = await resp.text();
+          tsTest.fetchResult = { status: resp.status, body };
+          setStatus("fetched");
+        } catch (err) {
+          tsTest.fetchError = String(err);
+          setStatus("fetch failed");
+        }
+      } else {
+        tsTest.instantiateError = "unknown mode: " + tsTest.mode;
+      }
+    } catch (err) {
+      if (!tsTest.imported) {
+        tsTest.importErrors.push(String(err));
+        setStatus("import failed");
+      } else if (tsTest.mode === "fetch") {
+        tsTest.runError = String(err);
+        setStatus("run failed");
+      } else {
+        tsTest.instantiateError = String(err);
+        setStatus("instantiate failed");
+      }
+    } finally {
+      tsTest.done = true;
+    }
+  </script>
+</body>
+</html>
diff --git a/tstest/integration/jswasmtest/wasm_test.go b/tstest/integration/jswasmtest/wasm_test.go
new file mode 100644
index 000000000..bc0906836
--- /dev/null
+++ b/tstest/integration/jswasmtest/wasm_test.go
@@ -0,0 +1,466 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package jswasmtest contains headless-browser tests for the
+// @tailscale/connect NPM package, built by cmd/tsconnect from
+// tailscale.com/cmd/tsconnect/wasm (the js/wasm build of the client).
+//
+// To run locally:
+//
+//	./tool/go run ./cmd/tsconnect build-pkg
+//	./tool/go test ./tstest/integration/jswasmtest/ -v --run-headless-browser-tests
+//
+// Tests are skipped unless --run-headless-browser-tests is set. When the
+// flag is set, tests are also skipped if cmd/tsconnect/pkg/ has not been
+// built, and fail with t.Error if no chromium binary is found in $PATH
+// (honoring $CHROME_BIN as an override). On macOS, /Applications/Google
+// Chrome.app and /Applications/Chromium.app are also tried.
+//
+// macOS note: launching Chrome from a terminal as a child process may
+// trigger the system "App Management" privacy prompt on Sonoma and later
+// (a one-shot prompt that says "<terminal> was prevented from modifying
+// apps on your Mac"). Grant the terminal app this permission under
+// System Settings → Privacy & Security → App Management and re-run.
+package jswasmtest
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"flag"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+	"time"
+
+	cdpruntime "github.com/chromedp/cdproto/runtime"
+	"github.com/chromedp/chromedp"
+	"tailscale.com/cmd/tsconnect/wasmbuild"
+	"tailscale.com/ipn/store/mem"
+	"tailscale.com/tsnet"
+	"tailscale.com/tstest/integration"
+	"tailscale.com/tstest/integration/testcontrol"
+)
+
+// pkgDir is the path to cmd/tsconnect/pkg/ (the directory written by
+// `go run ./cmd/tsconnect build-pkg`), relative to this test file's
+// directory (the cwd `go test` sets).
+const pkgDir = "../../../cmd/tsconnect/pkg"
+
+var runHeadlessBrowserTests = flag.Bool("run-headless-browser-tests", false,
+	"run tests that require a headless browser (Chromium / Google Chrome)")
+
+// preflight returns the chromium binary path, or fails / skips the test as
+// appropriate. Tests skip if --run-headless-browser-tests is not set or if
+// cmd/tsconnect/pkg/ has not been built. They t.Error if the flag is set
+// but no chromium binary is on $PATH.
+func preflight(t *testing.T) (chromiumBin string) {
+	t.Helper()
+	if !*runHeadlessBrowserTests {
+		t.Skip("skipping headless-browser test; set --run-headless-browser-tests to run")
+	}
+	if _, err := os.Stat(filepath.Join(pkgDir, "main.wasm")); err != nil {
+		t.Skipf("cmd/tsconnect/pkg/ not built; run "+
+			"`./tool/go run ./cmd/tsconnect build-pkg` first: %v", err)
+	}
+	checkPkgFreshness(t)
+	if t.Failed() {
+		return ""
+	}
+	bin := findChromium()
+	if bin == "" {
+		t.Errorf("no chromium / chromium-browser / google-chrome binary in $PATH " +
+			"(set $CHROME_BIN to override)")
+		return ""
+	}
+	return bin
+}
+
+// launchChrome boots a headless chromium under chromedp and returns a context
+// whose cancellation tears down the browser.
+func launchChrome(t *testing.T, bin string, extraFlags map[string]any) context.Context {
+	t.Helper()
+	opts := append(chromedp.DefaultExecAllocatorOptions[:],
+		chromedp.ExecPath(bin),
+		chromedp.Flag("headless", "new"),
+		chromedp.Flag("no-sandbox", true),
+		chromedp.Flag("disable-dev-shm-usage", true),
+	)
+	for k, v := range extraFlags {
+		opts = append(opts, chromedp.Flag(k, v))
+	}
+	allocCtx, cancelAlloc := chromedp.NewExecAllocator(t.Context(), opts...)
+	t.Cleanup(cancelAlloc)
+	browserCtx, cancelBrowser := chromedp.NewContext(allocCtx, chromedp.WithLogf(t.Logf))
+	t.Cleanup(cancelBrowser)
+
+	// Pipe browser console output and uncaught exceptions into go test logs.
+	chromedp.ListenTarget(browserCtx, func(ev any) {
+		switch ev := ev.(type) {
+		case *cdpruntime.EventConsoleAPICalled:
+			var sb strings.Builder
+			for i, arg := range ev.Args {
+				if i > 0 {
+					sb.WriteByte(' ')
+				}
+				if len(arg.Value) > 0 {
+					sb.Write(arg.Value)
+				} else {
+					sb.WriteString(arg.Description)
+				}
+			}
+			t.Logf("[chrome console.%s] %s", ev.Type, sb.String())
+		case *cdpruntime.EventExceptionThrown:
+			t.Logf("[chrome exception] %s", ev.ExceptionDetails.Text)
+		}
+	})
+	return browserCtx
+}
+
+// TestCreateIPN loads pkg.js into a real browser, calls createIPN with a
+// junk auth key, and verifies that the documented public API surface is
+// present on both the module exports and the returned IPN object. It does
+// no control-plane traffic.
+func TestCreateIPN(t *testing.T) {
+	chromiumBin := preflight(t)
+	if t.Failed() {
+		return
+	}
+
+	mux := http.NewServeMux()
+	mux.Handle("/_pkg/", http.StripPrefix("/_pkg/", http.FileServer(http.Dir(pkgDir))))
+	mux.Handle("/", http.FileServer(http.Dir(".")))
+	srv := httptest.NewServer(mux)
+	t.Cleanup(srv.Close)
+
+	browserCtx := launchChrome(t, chromiumBin, nil)
+	runCtx, cancelRun := context.WithTimeout(browserCtx, 60*time.Second)
+	t.Cleanup(cancelRun)
+
+	var (
+		done             bool
+		imported         bool
+		importErrors     []string
+		runtimeErrs      []string
+		panics           []string
+		exports          map[string]string
+		ipnMethods       map[string]string
+		instantiateError string
+	)
+
+	if err := chromedp.Run(runCtx,
+		chromedp.Navigate(srv.URL+"/index.html"),
+		chromedp.Poll("window.tsTest && window.tsTest.done === true", &done,
+			chromedp.WithPollingTimeout(45*time.Second)),
+		chromedp.Evaluate("window.tsTest.imported", &imported),
+		chromedp.Evaluate("window.tsTest.importErrors", &importErrors),
+		chromedp.Evaluate("window.tsTest.exports", &exports),
+		chromedp.Evaluate("window.tsTest.instantiateError || ''", &instantiateError),
+		chromedp.Evaluate("window.tsTest.ipnMethods", &ipnMethods),
+		chromedp.Evaluate("window.tsTest.runtimeErrors", &runtimeErrs),
+		chromedp.Evaluate("window.tsTest.panics", &panics),
+	); err != nil {
+		t.Fatalf("chromedp run: %v", err)
+	}
+
+	if !done {
+		t.Fatalf("page never set window.tsTest.done = true")
+	}
+	if !imported {
+		t.Fatalf("pkg.js import failed: %v", importErrors)
+	}
+	if instantiateError != "" {
+		t.Fatalf("createIPN() rejected: %s", instantiateError)
+	}
+
+	wantExports := map[string]string{
+		"createIPN":     "function",
+		"runSSHSession": "function",
+	}
+	for name, want := range wantExports {
+		if got := exports[name]; got != want {
+			t.Errorf("typeof pkg.%s = %q; want %q", name, got, want)
+		}
+	}
+
+	wantIPN := []string{"run", "login", "logout", "ssh", "fetch"}
+	for _, name := range wantIPN {
+		if got := ipnMethods[name]; got != "function" {
+			t.Errorf("createIPN() result: typeof ipn.%s = %q; want %q",
+				name, got, "function")
+		}
+	}
+
+	for _, e := range panics {
+		t.Errorf("WASM panic handler invoked: %s", e)
+	}
+	for _, e := range runtimeErrs {
+		// The WASM may emit non-fatal console errors (e.g. failed log uploads,
+		// no DERP, etc.); only fail on errors that look like a real crash.
+		if strings.Contains(e, "RuntimeError") || strings.Contains(e, "panic:") {
+			t.Errorf("page runtime error: %s", e)
+		} else {
+			t.Logf("benign page runtime message: %s", e)
+		}
+	}
+}
+
+// TestFetchTailnetPeer wires a full local control-plane world
+// (testcontrol + DERP + a tsnet.Server peer) and verifies that the
+// browser-side WASM client can join the same tailnet over WebSocket
+// transport and then ipn.fetch() an HTTP service hosted on the tsnet peer.
+//
+// The transport stack exercised by this test (browser-only):
+//   - control plane noise upgrade over ws:// (via control/controlhttp/client_js.go)
+//   - DERP relay over wss:// (via derp/derphttp + derpserver.AddWebSocketSupport)
+//   - ipn.fetch dials via netstack through DERP to the tsnet peer
+//
+// The DERP server uses a self-signed httptest TLS cert; Chromium is
+// launched with --ignore-certificate-errors so the WSS connect succeeds.
+func TestFetchTailnetPeer(t *testing.T) {
+	chromiumBin := preflight(t)
+	if t.Failed() {
+		return
+	}
+
+	const authKey = "tskey-pkgtest-not-a-real-key"
+	const wantBody = "hello-from-tsnet-pkgtest"
+
+	derpMap := integration.RunDERPAndSTUN(t, t.Logf, "127.0.0.1")
+
+	control := &testcontrol.Server{
+		DERPMap:        derpMap,
+		Logf:           t.Logf,
+		RequireAuthKey: authKey,
+		AllOnline:      true,
+	}
+
+	// Single-origin HTTP server: static fixtures + pkg + testcontrol all on
+	// one origin so the browser's WebSocket-upgrade dial to /ts2021 stays
+	// same-origin and so the WASM can configure controlURL = page origin.
+	//
+	// Only route testcontrol's known paths to it; everything else returns
+	// 404. testcontrol's default-handler panics on any unrecognized request,
+	// and Chromium spontaneously fetches /favicon.ico and similar browser
+	// chrome that would otherwise crash the test.
+	mux := http.NewServeMux()
+	mux.Handle("/_pkg/", http.StripPrefix("/_pkg/", http.FileServer(http.Dir(pkgDir))))
+	mux.Handle("/_fixture/", http.StripPrefix("/_fixture/", http.FileServer(http.Dir("."))))
+	mux.Handle("/key", control)
+	mux.Handle("/ts2021", control)
+	mux.Handle("/machine/", control)
+	mux.Handle("/c2n/", control)
+	mux.HandleFunc("/", http.NotFound)
+	srv := httptest.NewServer(mux)
+	t.Cleanup(srv.Close)
+
+	peer := &tsnet.Server{
+		Dir:        t.TempDir(),
+		ControlURL: srv.URL,
+		AuthKey:    authKey,
+		Hostname:   "tsnetpeer",
+		Ephemeral:  true,
+		Logf:       t.Logf,
+		Store:      new(mem.Store),
+	}
+	t.Cleanup(func() { peer.Close() })
+
+	upCtx, cancelUp := context.WithTimeout(t.Context(), 30*time.Second)
+	defer cancelUp()
+	status, err := peer.Up(upCtx)
+	if err != nil {
+		t.Fatalf("tsnet peer Up: %v", err)
+	}
+	if len(status.TailscaleIPs) == 0 {
+		t.Fatalf("tsnet peer has no TailscaleIPs")
+	}
+	peerIP := status.TailscaleIPs[0]
+	t.Logf("tsnet peer up at %v", peerIP)
+
+	ln, err := peer.Listen("tcp", ":80")
+	if err != nil {
+		t.Fatalf("tsnet peer Listen :80: %v", err)
+	}
+	t.Cleanup(func() { ln.Close() })
+	go http.Serve(ln, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprint(w, wantBody)
+	}))
+
+	browserCtx := launchChrome(t, chromiumBin, map[string]any{
+		"ignore-certificate-errors": true,
+	})
+	runCtx, cancelRun := context.WithTimeout(browserCtx, 120*time.Second)
+	t.Cleanup(cancelRun)
+
+	peerURL := fmt.Sprintf("http://%s/", peerIP)
+	pageURL := srv.URL + "/_fixture/index.html?" + url.Values{
+		"mode":       {"fetch"},
+		"controlURL": {srv.URL},
+		"authKey":    {authKey},
+		"peerURL":    {peerURL},
+		"hostname":   {"browser-pkgtest"},
+	}.Encode()
+	t.Logf("navigating to %s", pageURL)
+
+	var (
+		done         bool
+		imported     bool
+		importErrors []string
+		states       []string
+		browseURLs   []string
+		runError     string
+		fetchError   string
+		fetchResult  map[string]any
+		panics       []string
+		runtimeErrs  []string
+	)
+
+	if err := chromedp.Run(runCtx,
+		chromedp.Navigate(pageURL),
+		chromedp.Poll("window.tsTest && window.tsTest.done === true", &done,
+			chromedp.WithPollingTimeout(100*time.Second)),
+		chromedp.Evaluate("window.tsTest.imported", &imported),
+		chromedp.Evaluate("window.tsTest.importErrors", &importErrors),
+		chromedp.Evaluate("window.tsTest.states", &states),
+		chromedp.Evaluate("window.tsTest.browseURLs", &browseURLs),
+		chromedp.Evaluate("window.tsTest.runError || ''", &runError),
+		chromedp.Evaluate("window.tsTest.fetchError || ''", &fetchError),
+		chromedp.Evaluate("window.tsTest.fetchResult", &fetchResult),
+		chromedp.Evaluate("window.tsTest.panics", &panics),
+		chromedp.Evaluate("window.tsTest.runtimeErrors", &runtimeErrs),
+	); err != nil {
+		t.Fatalf("chromedp run: %v", err)
+	}
+
+	t.Logf("browser state transitions: %v", states)
+	if len(browseURLs) > 0 {
+		t.Logf("browser notifyBrowseToURL: %v", browseURLs)
+	}
+
+	if !done {
+		t.Fatalf("page never set window.tsTest.done = true")
+	}
+	if !imported {
+		t.Fatalf("pkg.js import failed: %v", importErrors)
+	}
+	if runError != "" {
+		t.Fatalf("ipn.run did not reach Running: %s (states=%v)", runError, states)
+	}
+	if fetchError != "" {
+		t.Fatalf("ipn.fetch failed: %s (states=%v)", fetchError, states)
+	}
+	if fetchResult == nil {
+		t.Fatalf("fetchResult is nil; states=%v", states)
+	}
+
+	if statusCode, _ := fetchResult["status"].(float64); int(statusCode) != http.StatusOK {
+		t.Errorf("fetch status = %v; want %d", fetchResult["status"], http.StatusOK)
+	}
+	body, _ := fetchResult["body"].(string)
+	if !strings.Contains(body, wantBody) {
+		t.Errorf("fetch body = %q; want substring %q", body, wantBody)
+	}
+
+	for _, e := range panics {
+		t.Errorf("WASM panic handler invoked: %s", e)
+	}
+	for _, e := range runtimeErrs {
+		if strings.Contains(e, "RuntimeError") || strings.Contains(e, "panic:") {
+			t.Errorf("page runtime error: %s", e)
+		} else {
+			t.Logf("benign page runtime message: %s", e)
+		}
+	}
+}
+
+func findChromium() string {
+	if p := os.Getenv("CHROME_BIN"); p != "" {
+		return p
+	}
+	for _, name := range []string{
+		"chromium",
+		"chromium-browser",
+		"google-chrome",
+		"google-chrome-stable",
+		"chrome",
+	} {
+		if p, err := exec.LookPath(name); err == nil {
+			return p
+		}
+	}
+	if runtime.GOOS == "darwin" {
+		// On macOS, Chrome installs as an .app bundle whose executable is
+		// not on $PATH.
+		for _, p := range []string{
+			"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
+			"/Applications/Chromium.app/Contents/MacOS/Chromium",
+		} {
+			if _, err := os.Stat(p); err == nil {
+				return p
+			}
+		}
+	}
+	return ""
+}
+
+// checkPkgFreshness fails the test if pkg/main.wasm was built from source
+// that differs from what `go build` would produce against the current
+// working tree. The mechanism is to do a fresh `go build` of
+// cmd/tsconnect/wasm with the same flags build-pkg used, sha256 the
+// output, and compare against pkg/build-info.json's recorded raw sha256.
+// The Go build cache makes the rebuild nearly instant when CI just ran
+// build-pkg, and equally fast locally between iterations.
+func checkPkgFreshness(t *testing.T) {
+	t.Helper()
+	biPath := filepath.Join(pkgDir, wasmbuild.BuildInfoFile)
+	biBytes, err := os.ReadFile(biPath)
+	if err != nil {
+		t.Fatalf("reading %s: %v\nRe-run `./tool/go run ./cmd/tsconnect build-pkg`.", biPath, err)
+	}
+	var bi wasmbuild.BuildInfo
+	if err := json.Unmarshal(biBytes, &bi); err != nil {
+		t.Fatalf("parsing %s: %v", biPath, err)
+	}
+
+	tmpWasm := filepath.Join(t.TempDir(), "main.wasm")
+	cmd := wasmbuild.ProdCommand("", tmpWasm)
+	cmd.Stdout = os.Stderr
+	cmd.Stderr = os.Stderr
+	t.Logf("checking pkg freshness: %s", strings.Join(cmd.Args, " "))
+	if err := cmd.Run(); err != nil {
+		t.Fatalf("go build cmd/tsconnect/wasm: %v", err)
+	}
+	freshSum, err := sha256File(tmpWasm)
+	if err != nil {
+		t.Fatalf("sha256 %s: %v", tmpWasm, err)
+	}
+	if freshSum != bi.RawWasmSHA256 {
+		t.Fatalf("pkg/main.wasm is stale\n"+
+			"  build-info.json raw_wasm_sha256: %s\n"+
+			"  freshly built (same -tags/-ldflags): %s\n"+
+			"Re-run `./tool/go run ./cmd/tsconnect build-pkg`.",
+			bi.RawWasmSHA256, freshSum)
+	}
+}
+
+func sha256File(path string) (string, error) {
+	f, err := os.Open(path)
+	if err != nil {
+		return "", err
+	}
+	defer f.Close()
+	h := sha256.New()
+	if _, err := io.Copy(h, f); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(h.Sum(nil)), nil
+}
diff --git a/tstest/integration/nat/nat_test.go b/tstest/integration/nat/nat_test.go
index 98116f173..520d1f093 100644
--- a/tstest/integration/nat/nat_test.go
+++ b/tstest/integration/nat/nat_test.go
@@ -7,6 +7,7 @@ import (
 	"bytes"
 	"cmp"
 	"context"
+	"encoding/json"
 	"errors"
 	"flag"
 	"fmt"
@@ -17,7 +18,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
-	"strconv"
+	"runtime"
 	"strings"
 	"sync"
 	"testing"
@@ -26,7 +27,6 @@ import (
 	"golang.org/x/mod/modfile"
 	"golang.org/x/sync/errgroup"
 	"tailscale.com/client/tailscale"
-	"tailscale.com/envknob"
 	"tailscale.com/ipn/ipnstate"
 	"tailscale.com/syncs"
 	"tailscale.com/tailcfg"
@@ -106,7 +106,7 @@ func findKernelPath(goMod string) (string, error) {
 		return "", err
 	}
 	for _, r := range mf.Require {
-		if r.Mod.Path == "github.com/tailscale/gokrazy-kernel" {
+		if r.Mod.Path == "github.com/gokrazy/kernel.amd64" {
 			return strings.TrimSpace(string(goModB)) + "/" + r.Mod.String() + "/vmlinuz", nil
 		}
 	}
@@ -115,10 +115,6 @@ func findKernelPath(goMod string) (string, error) {
 
 type addNodeFunc func(c *vnet.Config) *vnet.Node // returns nil to omit test
 
-func v6cidr(n int) string {
-	return fmt.Sprintf("2000:%d::1/64", n)
-}
-
 func easy(c *vnet.Config) *vnet.Node {
 	n := c.NumNodes() + 1
 	return c.AddNode(c.AddNetwork(
@@ -126,57 +122,6 @@ func easy(c *vnet.Config) *vnet.Node {
 		fmt.Sprintf("192.168.%d.1/24", n), vnet.EasyNAT))
 }
 
-func easyAnd6(c *vnet.Config) *vnet.Node {
-	n := c.NumNodes() + 1
-	return c.AddNode(c.AddNetwork(
-		fmt.Sprintf("2.%d.%d.%d", n, n, n), // public IP
-		fmt.Sprintf("192.168.%d.1/24", n),
-		v6cidr(n),
-		vnet.EasyNAT))
-}
-
-// easyNoControlDiscoRotate sets up a node with easy NAT, cuts traffic to
-// control after connecting, and then rotates the disco key to simulate a newly
-// started node (from a disco perspective).
-func easyNoControlDiscoRotate(c *vnet.Config) *vnet.Node {
-	n := c.NumNodes() + 1
-	nw := c.AddNetwork(
-		fmt.Sprintf("2.%d.%d.%d", n, n, n), // public IP
-		fmt.Sprintf("192.168.%d.1/24", n),
-		vnet.EasyNAT)
-	nw.SetPostConnectControlBlackhole(true)
-	return c.AddNode(
-		vnet.TailscaledEnv{
-			Key:   "TS_USE_CACHED_NETMAP",
-			Value: "true",
-		},
-		vnet.RotateDisco, vnet.PreICMPPing, nw)
-}
-
-func v6AndBlackholedIPv4(c *vnet.Config) *vnet.Node {
-	n := c.NumNodes() + 1
-	nw := c.AddNetwork(
-		fmt.Sprintf("2.%d.%d.%d", n, n, n), // public IP
-		fmt.Sprintf("192.168.%d.1/24", n),
-		v6cidr(n),
-		vnet.EasyNAT)
-	nw.SetBlackholedIPv4(true)
-	return c.AddNode(nw)
-}
-
-func just6(c *vnet.Config) *vnet.Node {
-	n := c.NumNodes() + 1
-	return c.AddNode(c.AddNetwork(v6cidr(n))) // public IPv6 prefix
-}
-
-// easy + host firewall
-func easyFW(c *vnet.Config) *vnet.Node {
-	n := c.NumNodes() + 1
-	return c.AddNode(vnet.HostFirewall, c.AddNetwork(
-		fmt.Sprintf("2.%d.%d.%d", n, n, n), // public IP
-		fmt.Sprintf("192.168.%d.1/24", n), vnet.EasyNAT))
-}
-
 func easyAF(c *vnet.Config) *vnet.Node {
 	n := c.NumNodes() + 1
 	return c.AddNode(c.AddNetwork(
@@ -209,46 +154,6 @@ func easyPMP(c *vnet.Config) *vnet.Node {
 		fmt.Sprintf("192.168.%d.1/24", n), vnet.EasyNAT, vnet.NATPMP))
 }
 
-// easy + port mapping + host firewall + BPF
-func easyPMPFWPlusBPF(c *vnet.Config) *vnet.Node {
-	n := c.NumNodes() + 1
-	return c.AddNode(
-		vnet.HostFirewall,
-		vnet.TailscaledEnv{
-			Key:   "TS_ENABLE_RAW_DISCO",
-			Value: "true",
-		},
-		vnet.TailscaledEnv{
-			Key:   "TS_DEBUG_RAW_DISCO",
-			Value: "1",
-		},
-		vnet.TailscaledEnv{
-			Key:   "TS_DEBUG_DISCO",
-			Value: "1",
-		},
-		vnet.TailscaledEnv{
-			Key:   "TS_LOG_VERBOSITY",
-			Value: "2",
-		},
-		c.AddNetwork(
-			fmt.Sprintf("2.%d.%d.%d", n, n, n), // public IP
-			fmt.Sprintf("192.168.%d.1/24", n), vnet.EasyNAT, vnet.NATPMP))
-}
-
-// easy + port mapping + host firewall - BPF
-func easyPMPFWNoBPF(c *vnet.Config) *vnet.Node {
-	n := c.NumNodes() + 1
-	return c.AddNode(
-		vnet.HostFirewall,
-		vnet.TailscaledEnv{
-			Key:   "TS_ENABLE_RAW_DISCO",
-			Value: "false",
-		},
-		c.AddNetwork(
-			fmt.Sprintf("2.%d.%d.%d", n, n, n), // public IP
-			fmt.Sprintf("192.168.%d.1/24", n), vnet.EasyNAT, vnet.NATPMP))
-}
-
 func hard(c *vnet.Config) *vnet.Node {
 	n := c.NumNodes() + 1
 	return c.AddNode(c.AddNetwork(
@@ -256,22 +161,6 @@ func hard(c *vnet.Config) *vnet.Node {
 		fmt.Sprintf("10.0.%d.1/24", n), vnet.HardNAT))
 }
 
-func hardNoDERPOrEndoints(c *vnet.Config) *vnet.Node {
-	n := c.NumNodes() + 1
-	return c.AddNode(c.AddNetwork(
-		fmt.Sprintf("2.%d.%d.%d", n, n, n), // public IP
-		fmt.Sprintf("10.0.%d.1/24", n), vnet.HardNAT),
-		vnet.TailscaledEnv{
-			Key:   "TS_DEBUG_STRIP_ENDPOINTS",
-			Value: "1",
-		},
-		vnet.TailscaledEnv{
-			Key:   "TS_DEBUG_STRIP_HOME_DERP",
-			Value: "1",
-		},
-	)
-}
-
 func hardPMP(c *vnet.Config) *vnet.Node {
 	n := c.NumNodes() + 1
 	return c.AddNode(c.AddNetwork(
@@ -327,6 +216,15 @@ func (nt *natTest) setupTest(ctx context.Context, addNode ...addNodeFunc) (nodes
 		}
 	})
 
+	haveKVM := false
+	if runtime.GOOS == "linux" {
+		if f, err := os.OpenFile("/dev/kvm", os.O_RDWR, 0); err == nil {
+			f.Close()
+			haveKVM = true
+		}
+	}
+
+	qmpSocks := make([]string, len(nodes))
 	for i, node := range nodes {
 		disk := fmt.Sprintf("%s/node-%d.qcow2", nt.tempDir, i)
 		out, err := exec.Command("qemu-img", "create",
@@ -349,22 +247,28 @@ func (nt *natTest) setupTest(ctx context.Context, addNode ...addNodeFunc) (nodes
 		}
 		envStr := envBuf.String()
 
-		cmd := exec.Command("qemu-system-x86_64",
+		qmpSocks[i] = fmt.Sprintf("%s/qmp-node-%d.sock", nt.tempDir, i)
+		qemuArgs := []string{
 			"-M", "microvm,isa-serial=off",
 			"-m", "384M",
 			"-nodefaults", "-no-user-config", "-nographic",
 			"-kernel", nt.kernel,
-			"-append", "console=hvc0 root=PARTUUID=60c24cc1-f3f9-427a-8199-76baa2d60001/PARTNROFF=1 ro init=/gokrazy/init panic=10 oops=panic pci=off nousb tsc=unstable clocksource=hpet gokrazy.remote_syslog.target="+sysLogAddr+" tailscale-tta=1"+envStr,
-			"-drive", "id=blk0,file="+disk+",format=qcow2",
+			"-append", "console=hvc0 root=PARTUUID=60c24cc1-f3f9-427a-8199-76baa2d60001/PARTNROFF=1 ro init=/gokrazy/init panic=10 oops=panic pci=off nousb gokrazy.remote_syslog.target=" + sysLogAddr + " tailscale-tta=1" + envStr,
+			"-drive", "id=blk0,file=" + disk + ",format=qcow2",
 			"-device", "virtio-blk-device,drive=blk0",
-			"-netdev", "stream,id=net0,addr.type=unix,addr.path="+sockAddr,
+			"-netdev", "stream,id=net0,addr.type=unix,addr.path=" + sockAddr,
 			"-device", "virtio-serial-device",
 			"-device", "virtio-rng-device",
-			"-device", "virtio-net-device,netdev=net0,mac="+node.MAC().String(),
+			"-device", "virtio-net-device,netdev=net0,mac=" + node.MAC().String(),
 			"-chardev", "stdio,id=virtiocon0,mux=on",
 			"-device", "virtconsole,chardev=virtiocon0",
 			"-mon", "chardev=virtiocon0,mode=readline",
-		)
+			"-qmp", "unix:" + qmpSocks[i] + ",server=on,wait=off",
+		}
+		if haveKVM {
+			qemuArgs = append(qemuArgs, "-enable-kvm", "-cpu", "host")
+		}
+		cmd := exec.Command("qemu-system-x86_64", qemuArgs...)
 		cmd.Stdout = os.Stdout
 		cmd.Stderr = os.Stderr
 		if err := cmd.Start(); err != nil {
@@ -376,6 +280,15 @@ func (nt *natTest) setupTest(ctx context.Context, addNode ...addNodeFunc) (nodes
 		})
 	}
 
+	for i, node := range nodes {
+		if err := nt.vnet.AwaitFirstPacket(ctx, node.MAC()); err != nil {
+			t.Logf("node %v: no boot progress (no packets received): %v", node, err)
+			t.Logf("node %v: QMP status: %s", node, qmpQueryStatus(qmpSocks[i]))
+			t.FailNow()
+		}
+		t.Logf("node %v: boot detected (first packet received)", node)
+	}
+
 	for _, n := range nodes {
 		client := nt.vnet.NodeAgentClient(n)
 		n.SetClient(client)
@@ -411,6 +324,11 @@ func (nt *natTest) setupTest(ctx context.Context, addNode ...addNodeFunc) (nodes
 					return fmt.Errorf("%v status: %w", node, err)
 				}
 
+				if capMap := node.WantCapMap(); capMap != nil {
+					nt.tb.Logf("using capmap for %s: %+v", node.String(), capMap)
+					nt.vnet.ControlServer().SetNodeCapMap(st.Self.PublicKey, capMap)
+				}
+
 				if st.BackendState != "Running" {
 					return fmt.Errorf("%v state = %q", node, st.BackendState)
 				}
@@ -430,34 +348,24 @@ func (nt *natTest) setupTest(ctx context.Context, addNode ...addNodeFunc) (nodes
 	return nodes, clients, nt.vnet.Close
 }
 
-func (nt *natTest) runHostConnectivityTest(addNode ...addNodeFunc) bool {
-	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
-	defer cancel()
-	nodes, clients, cleanup := nt.setupTest(ctx, addNode...)
-	defer cleanup()
+type hasDeadline interface {
+	Deadline() (deadline time.Time, ok bool)
+}
 
-	if len(nodes) != 2 {
-		nt.tb.Logf("ping can only be done among exactly two nodes")
-		return false
-	}
-	var fromClient, toClient *vnet.NodeAgentClient
-	for i, n := range nodes {
-		if n.ShouldJoinTailnet() && fromClient == nil {
-			fromClient = clients[i]
-		} else {
-			toClient = clients[i]
+// testContext returns a context derived from the test's deadline (from -timeout),
+// leaving a small margin for cleanup. Falls back to 60s if no deadline is set.
+func testContext(tb testing.TB) (context.Context, context.CancelFunc) {
+	if t, ok := tb.(hasDeadline); ok {
+		if dl, ok := t.Deadline(); ok {
+			const margin = 5 * time.Second
+			return context.WithDeadline(context.Background(), dl.Add(-margin))
 		}
 	}
-	got, err := sendHostNetworkPing(ctx, nt.tb, fromClient, toClient)
-	if err != nil {
-		nt.tb.Fatalf("ping host: %v", err)
-	}
-	nt.tb.Logf("ping success: %v", got)
-	return got
+	return context.WithTimeout(context.Background(), 60*time.Second)
 }
 
 func (nt *natTest) runTailscaleConnectivityTest(addNode ...addNodeFunc) pingRoute {
-	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
+	ctx, cancel := testContext(nt.tb)
 	defer cancel()
 
 	nodes, clients, cleanup := nt.setupTest(ctx, addNode...)
@@ -580,6 +488,55 @@ func ping(ctx context.Context, t testing.TB, c *vnet.NodeAgentClient, target net
 	return nil, fmt.Errorf("no ping response (ctx: %v)", ctx.Err())
 }
 
+// qmpQueryStatus connects to a QEMU QMP socket and returns the VM status
+// (e.g. "running", "paused", "prelaunch") or an error string.
+func qmpQueryStatus(sockPath string) string {
+	conn, err := net.DialTimeout("unix", sockPath, 2*time.Second)
+	if err != nil {
+		return fmt.Sprintf("dial error: %v", err)
+	}
+	defer conn.Close()
+	conn.SetDeadline(time.Now().Add(5 * time.Second))
+	dec := json.NewDecoder(conn)
+
+	// Read QMP greeting.
+	var greeting json.RawMessage
+	if err := dec.Decode(&greeting); err != nil {
+		return fmt.Sprintf("greeting error: %v", err)
+	}
+
+	// Enter command mode.
+	if _, err := conn.Write([]byte(`{"execute":"qmp_capabilities"}` + "\n")); err != nil {
+		return fmt.Sprintf("write caps: %v", err)
+	}
+	var capsResp json.RawMessage
+	if err := dec.Decode(&capsResp); err != nil {
+		return fmt.Sprintf("caps response: %v", err)
+	}
+
+	// Query status.
+	if _, err := conn.Write([]byte(`{"execute":"query-status"}` + "\n")); err != nil {
+		return fmt.Sprintf("write query-status: %v", err)
+	}
+	var statusResp struct {
+		Return struct {
+			Running bool   `json:"running"`
+			Status  string `json:"status"`
+		} `json:"return"`
+		Error *struct {
+			Class string `json:"class"`
+			Desc  string `json:"desc"`
+		} `json:"error"`
+	}
+	if err := dec.Decode(&statusResp); err != nil {
+		return fmt.Sprintf("status response: %v", err)
+	}
+	if statusResp.Error != nil {
+		return fmt.Sprintf("qmp error: %s: %s", statusResp.Error.Class, statusResp.Error.Desc)
+	}
+	return fmt.Sprintf("status=%s running=%v", statusResp.Return.Status, statusResp.Return.Running)
+}
+
 func up(ctx context.Context, c *vnet.NodeAgentClient) error {
 	req, err := http.NewRequestWithContext(ctx, "GET", "http://unused/up", nil)
 	if err != nil {
@@ -597,60 +554,6 @@ func up(ctx context.Context, c *vnet.NodeAgentClient) error {
 	return nil
 }
 
-func getClientIP(ctx context.Context, c *vnet.NodeAgentClient) (netip.Addr, error) {
-	getIPReq, err := http.NewRequestWithContext(ctx, "GET", "http://unused/ip", nil)
-	if err != nil {
-		return netip.Addr{}, err
-	}
-	res, err := c.HTTPClient.Do(getIPReq)
-	if err != nil {
-		return netip.Addr{}, err
-	}
-	defer res.Body.Close()
-	if res.StatusCode != http.StatusOK {
-		return netip.Addr{}, fmt.Errorf("client returned http status %q", res.Status)
-	}
-	ipBytes, err := io.ReadAll(res.Body)
-	if err != nil {
-		return netip.Addr{}, err
-	}
-	addrPort, err := netip.ParseAddrPort(string(ipBytes))
-	if err != nil {
-		return netip.Addr{}, err
-	}
-	return addrPort.Addr(), nil
-}
-
-// sendHostNetworkPing pings toClient from fromClient, and returns whether
-// toClient responded to the ping.
-func sendHostNetworkPing(ctx context.Context, tb testing.TB, fromClient, toClient *vnet.NodeAgentClient) (bool, error) {
-	toIP, err := getClientIP(ctx, toClient)
-	if err != nil {
-		return false, fmt.Errorf("get ip: %w", err)
-	}
-	req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("http://unused/ping?host=%s", toIP.String()), nil)
-	if err != nil {
-		return false, err
-	}
-	res, err := fromClient.HTTPClient.Do(req)
-	if err != nil {
-		return false, err
-	}
-	defer res.Body.Close()
-	got, err := io.ReadAll(res.Body)
-	if err != nil {
-		tb.Logf("error while reading http body: %v", err)
-	} else {
-		tb.Logf("got response from ping: %q", got)
-	}
-	ec, err := strconv.Atoi(res.Header.Get("Exec-Exit-Code"))
-	if err != nil {
-		return false, fmt.Errorf("parse exit code: %w", err)
-	}
-	tb.Logf("got ec: %v", ec)
-	return ec == 0, nil
-}
-
 type nodeType struct {
 	name string
 	fn   addNodeFunc
@@ -667,26 +570,6 @@ var types = []nodeType{
 	{"cgnat", cgnatNoTailnet},
 }
 
-// want sets the expected ping route for the test.
-func (nt *natTest) want(r pingRoute) {
-	if nt.gotRoute != r {
-		nt.tb.Errorf("ping route = %v; want %v", nt.gotRoute, r)
-	}
-}
-
-func TestEasyEasy(t *testing.T) {
-	nt := newNatTest(t)
-	nt.runTailscaleConnectivityTest(easy, easy)
-	nt.want(routeDirect)
-}
-
-func TestTwoEasyNoControlDiscoRotate(t *testing.T) {
-	envknob.Setenv("TS_USE_CACHED_NETMAP", "1")
-	nt := newNatTest(t)
-	nt.runTailscaleConnectivityTest(easyNoControlDiscoRotate, easyNoControlDiscoRotate)
-	nt.want(routeDirect)
-}
-
 func cgnatNoTailnet(c *vnet.Config) *vnet.Node {
 	n := c.NumNodes() + 1
 	return c.AddNode(c.AddNetwork(
@@ -696,101 +579,6 @@ func cgnatNoTailnet(c *vnet.Config) *vnet.Node {
 		vnet.DontJoinTailnet)
 }
 
-func TestNonTailscaleCGNATEndpoint(t *testing.T) {
-	if !*knownBroken {
-		t.Skip("skipping known-broken test; set --known-broken to run; see https://github.com/tailscale/corp/issues/36270")
-	}
-	nt := newNatTest(t)
-	if !nt.runHostConnectivityTest(cgnatNoTailnet, sameLAN) {
-		t.Fatalf("could not ping")
-	}
-}
-
-// Issue tailscale/corp#26438: use learned DERP route as send path of last
-// resort
-//
-// See (*magicsock.Conn).fallbackDERPRegionForPeer and its comment for
-// background.
-//
-// This sets up a test with two nodes that must use DERP to communicate but the
-// target of the ping (the second node) additionally is not getting DERP or
-// Endpoint updates from the control plane. (Or rather, it's getting them but is
-// configured to scrub them right when they come off the network before being
-// processed) This then tests whether node2, upon receiving a packet, will be
-// able to reply to node1 since it knows neither node1's endpoints nor its home
-// DERP. The only reply route it can use is that fact that it just received a
-// packet over a particular DERP from that peer.
-func TestFallbackDERPRegionForPeer(t *testing.T) {
-	nt := newNatTest(t)
-	nt.runTailscaleConnectivityTest(hard, hardNoDERPOrEndoints)
-	nt.want(routeDERP)
-}
-
-func TestSingleJustIPv6(t *testing.T) {
-	nt := newNatTest(t)
-	nt.runTailscaleConnectivityTest(just6)
-}
-
-var knownBroken = flag.Bool("known-broken", false, "run known-broken tests")
-
-// TestSingleDualStackButBrokenIPv4 tests a dual-stack node with broken
-// (blackholed) IPv4.
-//
-// See https://github.com/tailscale/tailscale/issues/13346
-func TestSingleDualBrokenIPv4(t *testing.T) {
-	if !*knownBroken {
-		t.Skip("skipping known-broken test; set --known-broken to run; see https://github.com/tailscale/tailscale/issues/13346")
-	}
-	nt := newNatTest(t)
-	nt.runTailscaleConnectivityTest(v6AndBlackholedIPv4)
-}
-
-func TestJustIPv6(t *testing.T) {
-	nt := newNatTest(t)
-	nt.runTailscaleConnectivityTest(just6, just6)
-	nt.want(routeDirect)
-}
-
-func TestEasy4AndJust6(t *testing.T) {
-	nt := newNatTest(t)
-	nt.runTailscaleConnectivityTest(easyAnd6, just6)
-	nt.want(routeDirect)
-}
-
-func TestSameLAN(t *testing.T) {
-	nt := newNatTest(t)
-	nt.runTailscaleConnectivityTest(easy, sameLAN)
-	nt.want(routeLocal)
-}
-
-// TestBPFDisco tests https://github.com/tailscale/tailscale/issues/3824 ...
-// * server behind a Hard NAT
-// * client behind a NAT with UPnP support
-// * client machine has a stateful host firewall (e.g. ufw)
-func TestBPFDisco(t *testing.T) {
-	nt := newNatTest(t)
-	nt.runTailscaleConnectivityTest(easyPMPFWPlusBPF, hard)
-	nt.want(routeDirect)
-}
-
-func TestHostFWNoBPF(t *testing.T) {
-	nt := newNatTest(t)
-	nt.runTailscaleConnectivityTest(easyPMPFWNoBPF, hard)
-	nt.want(routeDERP)
-}
-
-func TestHostFWPair(t *testing.T) {
-	nt := newNatTest(t)
-	nt.runTailscaleConnectivityTest(easyFW, easyFW)
-	nt.want(routeDirect)
-}
-
-func TestOneHostFW(t *testing.T) {
-	nt := newNatTest(t)
-	nt.runTailscaleConnectivityTest(easy, easyFW)
-	nt.want(routeDirect)
-}
-
 var pair = flag.String("pair", "", "comma-separated pair of types to test (easy, easyAF, hard, easyPMP, hardPMP, one2one, sameLAN)")
 
 func TestPair(t *testing.T) {
diff --git a/tstest/integration/service_notwindows.go b/tstest/integration/service_notwindows.go
new file mode 100644
index 000000000..729977232
--- /dev/null
+++ b/tstest/integration/service_notwindows.go
@@ -0,0 +1,18 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !windows
+
+package integration
+
+// Non-Windows stubs for the Windows service backend; never called, since
+// windowsService is only set on Windows.
+
+func (n *TestNode) startWindowsServiceDaemon() *Daemon {
+	n.env.t.Fatal("Windows service daemon is only supported on Windows")
+	return nil
+}
+
+func (n *TestNode) stopService() {
+	n.env.t.Fatal("Windows service daemon is only supported on Windows")
+}
diff --git a/tstest/integration/service_windows.go b/tstest/integration/service_windows.go
new file mode 100644
index 000000000..6e24d5ea9
--- /dev/null
+++ b/tstest/integration/service_windows.go
@@ -0,0 +1,270 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build windows
+
+package integration
+
+import (
+	"archive/zip"
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"io"
+	"net/http"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+	"time"
+
+	"golang.org/x/sys/windows/svc"
+	"golang.org/x/sys/windows/svc/mgr"
+	"tailscale.com/tsconst/wintun"
+)
+
+// serviceName is the Windows service tailscaled installs itself as.
+const serviceName = "Tailscale"
+
+// startWindowsServiceDaemon installs and starts tailscaled as a Windows service.
+func (n *TestNode) startWindowsServiceDaemon() *Daemon {
+	t := n.env.t
+	t.Helper()
+
+	// A pre-existing Tailscale service means this isn't a disposable/CI machine;
+	// fail rather than uninstall it. Stale state is wiped below, not fatal.
+	if serviceExists(t) {
+		t.Fatal("existing Tailscale service found; run only on a disposable/CI machine")
+	}
+
+	n.cleanupServiceState()
+	stageWintun(t, filepath.Dir(n.env.daemon))
+	n.writeServiceEnvFile()
+
+	if out, err := exec.CommandContext(t.Context(), n.env.daemon, "install-system-daemon").CombinedOutput(); err != nil {
+		t.Fatalf("install-system-daemon: %v\n%s", err, out)
+	}
+	// Teardown (LIFO): stop, uninstall, then wipe state for the next test.
+	t.Cleanup(func() {
+		n.stopService()
+		n.uninstallService()
+		n.cleanupServiceState()
+	})
+
+	n.startService()
+	n.waitServiceReady(90 * time.Second)
+	return &Daemon{svc: n}
+}
+
+// startService starts the service and waits for the SCM to report it Running.
+func (n *TestNode) startService() {
+	t := n.env.t
+	t.Helper()
+	m := connectSCM(t)
+	defer m.Disconnect()
+	s, err := m.OpenService(serviceName)
+	if err != nil {
+		t.Fatalf("open service %q: %v", serviceName, err)
+	}
+	defer s.Close()
+	if err := s.Start(); err != nil {
+		t.Fatalf("start service %q: %v", serviceName, err)
+	}
+	n.waitServiceState(s, svc.Running, 60*time.Second)
+}
+
+// stopService requests a stop and waits until the service is Stopped, failing
+// the test if it doesn't stop in time.
+func (n *TestNode) stopService() {
+	t := n.env.t
+	t.Helper()
+	m := connectSCM(t)
+	defer m.Disconnect()
+	s, err := m.OpenService(serviceName)
+	if err != nil {
+		return // not installed; nothing to stop
+	}
+	defer s.Close()
+	st, err := s.Query()
+	if err != nil {
+		t.Fatalf("query service %q: %v", serviceName, err)
+	}
+	if st.State == svc.Stopped {
+		return
+	}
+	if _, err := s.Control(svc.Stop); err != nil {
+		t.Fatalf("stop service %q: %v", serviceName, err)
+	}
+	n.waitServiceState(s, svc.Stopped, 60*time.Second)
+}
+
+// uninstallService removes the service via tailscaled's uninstall-system-daemon
+// and waits until it's gone; a missing service is fine.
+func (n *TestNode) uninstallService() {
+	t := n.env.t
+	t.Helper()
+	if !serviceExists(t) {
+		return
+	}
+	// Not t.Context(): this also runs from t.Cleanup, where it's canceled.
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+	if out, err := exec.CommandContext(ctx, n.env.daemon, "uninstall-system-daemon").CombinedOutput(); err != nil {
+		t.Fatalf("uninstall-system-daemon: %v\n%s", err, out)
+	}
+	n.waitServiceGone(30 * time.Second)
+}
+
+// writeServiceEnvFile writes the harness env to the file tailscaled reads at
+// startup, since a service doesn't inherit the test process's environment.
+func (n *TestNode) writeServiceEnvFile() {
+	t := n.env.t
+	t.Helper()
+	dir := serviceStateDir()
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		t.Fatalf("creating %s: %v", dir, err)
+	}
+	dst := filepath.Join(dir, "tailscaled-env.txt")
+	body := strings.Join(n.daemonEnv("windows"), "\n") + "\n"
+	if err := os.WriteFile(dst, []byte(body), 0o644); err != nil {
+		t.Fatalf("writing %s: %v", dst, err)
+	}
+}
+
+// cleanupServiceState removes the service's global state dir so the next test
+// doesn't inherit a prior node's identity; call only after the service stops.
+func (n *TestNode) cleanupServiceState() {
+	t := n.env.t
+	t.Helper()
+	dir := serviceStateDir()
+	if err := os.RemoveAll(dir); err != nil {
+		t.Logf("removing %s: %v", dir, err)
+	}
+}
+
+// serviceStateDir is the global state dir a Tailscale service uses.
+func serviceStateDir() string {
+	return filepath.Join(os.Getenv("ProgramData"), "Tailscale")
+}
+
+// waitServiceReady polls the LocalAPI until BackendState leaves NoState,
+// guarding the post-start race (tailscale/tailscale#8695).
+func (n *TestNode) waitServiceReady(timeout time.Duration) {
+	t := n.env.t
+	t.Helper()
+	deadline := time.Now().Add(timeout)
+	var last error
+	for time.Now().Before(deadline) {
+		st, err := n.Status()
+		if err == nil && st.BackendState != "" && st.BackendState != "NoState" {
+			return
+		}
+		last = err
+		time.Sleep(2 * time.Second)
+	}
+	t.Fatalf("service LocalAPI not ready within %v (last err: %v)", timeout, last)
+}
+
+// waitServiceState polls s until it reaches want, failing the test on timeout.
+func (n *TestNode) waitServiceState(s *mgr.Service, want svc.State, timeout time.Duration) {
+	t := n.env.t
+	t.Helper()
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		st, err := s.Query()
+		if err != nil {
+			t.Fatalf("query service %q: %v", serviceName, err)
+		}
+		if st.State == want {
+			return
+		}
+		time.Sleep(time.Second)
+	}
+	t.Fatalf("service %q did not reach state %d within %v", serviceName, want, timeout)
+}
+
+// waitServiceGone polls until the service no longer exists.
+func (n *TestNode) waitServiceGone(timeout time.Duration) {
+	t := n.env.t
+	t.Helper()
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		if !serviceExists(t) {
+			return
+		}
+		time.Sleep(time.Second)
+	}
+	t.Fatalf("service %q still present after %v", serviceName, timeout)
+}
+
+// serviceExists reports whether the Tailscale service is currently installed.
+func serviceExists(t testing.TB) bool {
+	t.Helper()
+	m := connectSCM(t)
+	defer m.Disconnect()
+	s, err := m.OpenService(serviceName)
+	if err != nil {
+		return false
+	}
+	s.Close()
+	return true
+}
+
+// connectSCM connects to the Windows service manager, failing the test on error.
+func connectSCM(t testing.TB) *mgr.Mgr {
+	t.Helper()
+	m, err := mgr.Connect()
+	if err != nil {
+		t.Fatalf("connect to service manager: %v", err)
+	}
+	return m
+}
+
+// stageWintun downloads and verifies wintun.dll into dir; tailscaled loads it
+// from its executable's dir (cmd/tailscaled.fullyQualifiedWintunPath).
+func stageWintun(t testing.TB, dir string) {
+	t.Helper()
+	req, err := http.NewRequestWithContext(t.Context(), "GET", wintun.URL, nil)
+	if err != nil {
+		t.Fatalf("wintun request: %v", err)
+	}
+	res, err := http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatalf("downloading wintun: %v", err)
+	}
+	defer res.Body.Close()
+	if res.StatusCode != http.StatusOK {
+		t.Fatalf("downloading %s: HTTP %s", wintun.URL, res.Status)
+	}
+	zipBytes, err := io.ReadAll(res.Body)
+	if err != nil {
+		t.Fatalf("reading wintun zip: %v", err)
+	}
+	if sum := sha256.Sum256(zipBytes); hex.EncodeToString(sum[:]) != wintun.SHA256 {
+		t.Fatalf("wintun zip sha256 = %s, want %s", hex.EncodeToString(sum[:]), wintun.SHA256)
+	}
+	zr, err := zip.NewReader(bytes.NewReader(zipBytes), int64(len(zipBytes)))
+	if err != nil {
+		t.Fatalf("opening wintun zip: %v", err)
+	}
+	member := wintun.DLLZipPath(runtime.GOARCH)
+	f, err := zr.Open(member)
+	if err != nil {
+		t.Fatalf("wintun zip missing %q: %v", member, err)
+	}
+	defer f.Close()
+	out, err := os.Create(filepath.Join(dir, "wintun.dll"))
+	if err != nil {
+		t.Fatalf("creating wintun.dll: %v", err)
+	}
+	if _, err := io.Copy(out, f); err != nil {
+		out.Close()
+		t.Fatalf("extracting wintun.dll: %v", err)
+	}
+	if err := out.Close(); err != nil {
+		t.Fatalf("closing wintun.dll: %v", err)
+	}
+}
diff --git a/tstest/integration/tailscaled_deps_test_darwin.go b/tstest/integration/tailscaled_deps_test_darwin.go
index 70e0d75fa..9a19b3997 100644
--- a/tstest/integration/tailscaled_deps_test_darwin.go
+++ b/tstest/integration/tailscaled_deps_test_darwin.go
@@ -10,7 +10,6 @@ import (
 	// Otherwise cmd/go never sees that we depend on these packages'
 	// transitive deps when we run "go install tailscaled" in a child
 	// process and can cache a prior success when a dependency changes.
-	_ "tailscale.com/chirp"
 	_ "tailscale.com/client/local"
 	_ "tailscale.com/cmd/tailscaled/childproc"
 	_ "tailscale.com/control/controlclient"
@@ -52,6 +51,7 @@ import (
 	_ "tailscale.com/util/clientmetric"
 	_ "tailscale.com/util/eventbus"
 	_ "tailscale.com/util/osshare"
+	_ "tailscale.com/util/syspolicy"
 	_ "tailscale.com/util/syspolicy/pkey"
 	_ "tailscale.com/util/syspolicy/policyclient"
 	_ "tailscale.com/version"
diff --git a/tstest/integration/tailscaled_deps_test_freebsd.go b/tstest/integration/tailscaled_deps_test_freebsd.go
index 70e0d75fa..9a19b3997 100644
--- a/tstest/integration/tailscaled_deps_test_freebsd.go
+++ b/tstest/integration/tailscaled_deps_test_freebsd.go
@@ -10,7 +10,6 @@ import (
 	// Otherwise cmd/go never sees that we depend on these packages'
 	// transitive deps when we run "go install tailscaled" in a child
 	// process and can cache a prior success when a dependency changes.
-	_ "tailscale.com/chirp"
 	_ "tailscale.com/client/local"
 	_ "tailscale.com/cmd/tailscaled/childproc"
 	_ "tailscale.com/control/controlclient"
@@ -52,6 +51,7 @@ import (
 	_ "tailscale.com/util/clientmetric"
 	_ "tailscale.com/util/eventbus"
 	_ "tailscale.com/util/osshare"
+	_ "tailscale.com/util/syspolicy"
 	_ "tailscale.com/util/syspolicy/pkey"
 	_ "tailscale.com/util/syspolicy/policyclient"
 	_ "tailscale.com/version"
diff --git a/tstest/integration/tailscaled_deps_test_linux.go b/tstest/integration/tailscaled_deps_test_linux.go
index 70e0d75fa..9a19b3997 100644
--- a/tstest/integration/tailscaled_deps_test_linux.go
+++ b/tstest/integration/tailscaled_deps_test_linux.go
@@ -10,7 +10,6 @@ import (
 	// Otherwise cmd/go never sees that we depend on these packages'
 	// transitive deps when we run "go install tailscaled" in a child
 	// process and can cache a prior success when a dependency changes.
-	_ "tailscale.com/chirp"
 	_ "tailscale.com/client/local"
 	_ "tailscale.com/cmd/tailscaled/childproc"
 	_ "tailscale.com/control/controlclient"
@@ -52,6 +51,7 @@ import (
 	_ "tailscale.com/util/clientmetric"
 	_ "tailscale.com/util/eventbus"
 	_ "tailscale.com/util/osshare"
+	_ "tailscale.com/util/syspolicy"
 	_ "tailscale.com/util/syspolicy/pkey"
 	_ "tailscale.com/util/syspolicy/policyclient"
 	_ "tailscale.com/version"
diff --git a/tstest/integration/tailscaled_deps_test_openbsd.go b/tstest/integration/tailscaled_deps_test_openbsd.go
index 70e0d75fa..9a19b3997 100644
--- a/tstest/integration/tailscaled_deps_test_openbsd.go
+++ b/tstest/integration/tailscaled_deps_test_openbsd.go
@@ -10,7 +10,6 @@ import (
 	// Otherwise cmd/go never sees that we depend on these packages'
 	// transitive deps when we run "go install tailscaled" in a child
 	// process and can cache a prior success when a dependency changes.
-	_ "tailscale.com/chirp"
 	_ "tailscale.com/client/local"
 	_ "tailscale.com/cmd/tailscaled/childproc"
 	_ "tailscale.com/control/controlclient"
@@ -52,6 +51,7 @@ import (
 	_ "tailscale.com/util/clientmetric"
 	_ "tailscale.com/util/eventbus"
 	_ "tailscale.com/util/osshare"
+	_ "tailscale.com/util/syspolicy"
 	_ "tailscale.com/util/syspolicy/pkey"
 	_ "tailscale.com/util/syspolicy/policyclient"
 	_ "tailscale.com/version"
diff --git a/tstest/integration/tailscaled_deps_test_windows.go b/tstest/integration/tailscaled_deps_test_windows.go
index 00768c99e..620d0ccd6 100644
--- a/tstest/integration/tailscaled_deps_test_windows.go
+++ b/tstest/integration/tailscaled_deps_test_windows.go
@@ -62,6 +62,7 @@ import (
 	_ "tailscale.com/util/eventbus"
 	_ "tailscale.com/util/osdiag"
 	_ "tailscale.com/util/osshare"
+	_ "tailscale.com/util/syspolicy"
 	_ "tailscale.com/util/syspolicy/pkey"
 	_ "tailscale.com/util/syspolicy/policyclient"
 	_ "tailscale.com/util/winutil"
diff --git a/tstest/integration/testcontrol/testcontrol.go b/tstest/integration/testcontrol/testcontrol.go
index 486bc8b81..ff28c76f0 100644
--- a/tstest/integration/testcontrol/testcontrol.go
+++ b/tstest/integration/testcontrol/testcontrol.go
@@ -60,15 +60,60 @@ type Server struct {
 	DNSConfig          *tailcfg.DNSConfig // nil means no DNS config
 	MagicDNSDomain     string
 	C2NResponses       syncs.Map[string, func(*http.Response)] // token => onResponse func
+	OnSetDNS           func(*tailcfg.SetDNSRequest) error
 
 	// PeerRelayGrants, if true, inserts relay capabilities into the wildcard
 	// grants rules.
 	PeerRelayGrants bool
 
+	// SSHPolicy, if non-nil, is sent to every node in MapResponses.
+	// Each node also gets [tailcfg.CapabilitySSH] added to its capability
+	// map, permitting "tailscale up --ssh".
+	SSHPolicy *tailcfg.SSHPolicy
+
 	// AllNodesSameUser, if true, makes all created nodes
 	// belong to the same user.
 	AllNodesSameUser bool
 
+	// TagOwners, if non-nil, enables modeling of the production control
+	// server's tag transition handling. Map keys are tags (e.g. "tag:foo")
+	// and values are the tags whose nodes are allowed to assign the key's
+	// tag. A node registering with Hostinfo.RequestTags gets those tags
+	// (signup-time ownership checks are not modeled). A later non-streaming
+	// map request whose Hostinfo.RequestTags differ from both the node's
+	// stored Hostinfo's RequestTags and its current tags is treated as a
+	// tag transition request: if the node's current tags own each requested
+	// tag, the node is retagged; otherwise its node key is expired to force
+	// reauthentication, as the production control server does.
+	//
+	// If nil, RequestTags in map requests are ignored.
+	TagOwners map[string][]string
+
+	// HoldMapRequest, if non-nil, is called with each incoming MapRequest
+	// before the server starts processing it. It may block to delay
+	// processing, letting tests control the order in which concurrent map
+	// requests are handled. If it returns a non-nil func, the server calls
+	// it when it finishes handling the request. For streaming requests
+	// that is when the poll ends, so returning a done func is mostly
+	// useful for non-streaming requests.
+	HoldMapRequest func(*tailcfg.MapRequest) (done func())
+
+	// AllOnline, if true, marks every peer entry in MapResponses as
+	// Online=true. This is a coarse stand-in for the per-node
+	// online/offline tracking that production control servers do based
+	// on streaming map sessions: certain disco-key handling fast paths
+	// in [tailscale.com/control/controlclient] and
+	// [tailscale.com/wgengine/userspace] only fire when the peer is
+	// reported online, so without this flag they are silently skipped
+	// in tests, which can mask bugs and slow down recovery from disco
+	// rotations. See [tailscale.com/control/controlclient/map.go]
+	// removeUnwantedDiscoUpdates and
+	// removeUnwantedDiscoUpdatesFromFullNetmapUpdate for callers that
+	// branch on Online.
+	//
+	// Finer-grained per-node online tracking can be added later.
+	AllOnline bool
+
 	// DefaultNodeCapabilities overrides the capability map sent to each client.
 	DefaultNodeCapabilities *tailcfg.NodeCapMap
 
@@ -80,10 +125,18 @@ type Server struct {
 	ExplicitBaseURL string           // e.g. "http://127.0.0.1:1234" with no trailing URL
 	HTTPTestServer  *httptest.Server // if non-nil, used to get BaseURL
 
+	// MaybeRateLimitRegister, if non-nil, is called before processing
+	// register requests. If it returns true, a 429 response is sent
+	// with the given Retry-After header value and body string.
+	MaybeRateLimitRegister func() (reject bool, retryAfter string, msg string)
+
 	// ModifyFirstMapResponse, if non-nil, is called exactly once per
 	// MapResponse stream to modify the first MapResponse sent in response to it.
 	ModifyFirstMapResponse func(*tailcfg.MapResponse, *tailcfg.MapRequest)
 
+	// AltMapStream, if non-nil, takes over serveMap. See [AltMapStreamFunc].
+	AltMapStream AltMapStreamFunc
+
 	initMuxOnce sync.Once
 	mux         *http.ServeMux
 
@@ -132,12 +185,16 @@ type Server struct {
 	updates       map[tailcfg.NodeID]chan updateType
 	authPath      map[string]*AuthPath
 	nodeKeyAuthed set.Set[key.NodePublic]
-	msgToSend     map[key.NodePublic]any // value is *tailcfg.PingRequest or entire *tailcfg.MapResponse
-	allExpired    bool                   // All nodes will be told their node key is expired.
+	msgToSend     map[key.NodePublic][]any // FIFO queue per node; values are *tailcfg.PingRequest or *tailcfg.MapResponse
+	allExpired    bool                     // All nodes will be told their node key is expired.
 
 	// tkaStorage records the Tailnet Lock state, if any.
 	// If nil, Tailnet Lock is not enabled in the Tailnet.
 	tkaStorage tka.CompactableChonk
+
+	// onMapRequest, if non-nil, is called at the start of each map poll request.
+	// It can be used in tests to panic or fail if a node contacts control unexpectedly.
+	onMapRequest func(nodeKey key.NodePublic)
 }
 
 // BaseURL returns the server's base URL, without trailing slash.
@@ -276,14 +333,16 @@ func (s *Server) AddRawMapResponse(nodeKeyDst key.NodePublic, mr *tailcfg.MapRes
 func (s *Server) addDebugMessage(nodeKeyDst key.NodePublic, msg any) bool {
 	s.mu.Lock()
 	defer s.mu.Unlock()
-	if s.msgToSend == nil {
-		s.msgToSend = map[key.NodePublic]any{}
-	}
-	// Now send the update to the channel
 	node := s.nodeLocked(nodeKeyDst)
 	if node == nil {
 		return false
 	}
+	updatesCh := s.updates[node.ID]
+	if updatesCh == nil {
+		// No streaming poll is registered, so there's nobody to deliver
+		// the message to.
+		return false
+	}
 
 	if _, ok := msg.(*tailcfg.MapResponse); ok {
 		if s.suppressAutoMapResponses == nil {
@@ -292,10 +351,14 @@ func (s *Server) addDebugMessage(nodeKeyDst key.NodePublic, msg any) bool {
 		s.suppressAutoMapResponses.Add(nodeKeyDst)
 	}
 
-	s.msgToSend[nodeKeyDst] = msg
-	nodeID := node.ID
-	oldUpdatesCh := s.updates[nodeID]
-	return sendUpdate(oldUpdatesCh, updateDebugInjection)
+	mak.Set(&s.msgToSend, nodeKeyDst, append(s.msgToSend[nodeKeyDst], msg))
+	// sendUpdate returning false here is fine: the channel is a lossy
+	// wake-up signal whose buffer is single-slot. A full buffer means a
+	// prior wake-up is still pending, and the streaming poll will check
+	// msgToSend when it processes that wake-up. The queue in msgToSend
+	// is the source of truth.
+	sendUpdate(updatesCh, updateDebugInjection)
+	return true
 }
 
 // Mark the Node key of every node as expired
@@ -345,6 +408,7 @@ func (s *Server) initMux() {
 	})
 	s.mux.HandleFunc("/key", s.serveKey)
 	s.mux.HandleFunc("/machine/tka/", s.serveTKA)
+	s.mux.HandleFunc("/machine/webclient/", s.serveWebClient)
 	s.mux.HandleFunc("/machine/", s.serveMachine)
 	s.mux.HandleFunc("/ts2021", s.serveNoiseUpgrade)
 	s.mux.HandleFunc("/c2n/", s.serveC2N)
@@ -396,8 +460,12 @@ type peerMachinePublicContextKey struct{}
 
 func (s *Server) serveNoiseUpgrade(w http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
-	if r.Method != "POST" {
-		http.Error(w, "POST required", 400)
+	// Allow GET for WebSocket-based clients (e.g. cmd/tsconnect/wasm) in
+	// addition to POST for the raw HTTP-upgrade path. AcceptHTTP routes by
+	// the Upgrade header and the underlying websocket library enforces
+	// GET for WebSocket upgrades.
+	if r.Method != "POST" && r.Method != "GET" {
+		http.Error(w, "POST or GET required", 400)
 		return
 	}
 
@@ -470,6 +538,8 @@ func (s *Server) serveMachine(w http.ResponseWriter, r *http.Request) {
 		s.serveMap(w, r, mkey)
 	case "/machine/register":
 		s.serveRegister(w, r, mkey)
+	case "/machine/set-dns":
+		s.serveSetDNS(w, r, mkey)
 	case "/machine/update-health":
 		io.Copy(io.Discard, r.Body)
 		w.WriteHeader(http.StatusNoContent)
@@ -478,6 +548,95 @@ func (s *Server) serveMachine(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
+// serveWebClient handles the Noise-protected web client auth flow endpoints
+// posted to /machine/webclient/init/<src>/to/<dst> and
+// /machine/webclient/wait/<src>/to/<dst>/<id>. It is the test-control
+// counterpart to client/web's check-mode session creation: it returns a
+// placeholder auth URL for init, and immediately Complete=true for wait, so
+// tests can drive the full check-mode session lifecycle without a real
+// browser-click loop.
+func (s *Server) serveWebClient(w http.ResponseWriter, r *http.Request) {
+	if r.Method != httpm.POST {
+		http.Error(w, "POST required", http.StatusMethodNotAllowed)
+		return
+	}
+	var resp tailcfg.WebClientAuthResponse
+	switch {
+	case strings.HasPrefix(r.URL.Path, "/machine/webclient/init/"):
+		resp.ID = "testcontrol-webclient-auth"
+		resp.URL = "https://control.tailscale/test-web-auth"
+	case strings.HasPrefix(r.URL.Path, "/machine/webclient/wait/"):
+		resp.Complete = true
+	default:
+		s.serveUnhandled(w, r)
+		return
+	}
+	w.Header().Set("Content-Type", "application/json")
+	if err := json.NewEncoder(w).Encode(resp); err != nil {
+		log.Printf("testcontrol: encoding web client response: %v", err)
+	}
+}
+
+func (s *Server) serveSetDNS(w http.ResponseWriter, r *http.Request, mkey key.MachinePublic) {
+	var req tailcfg.SetDNSRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
+	if req.Type != "TXT" {
+		http.Error(w, "only TXT records are supported", http.StatusBadRequest)
+		return
+	}
+	if req.Name == "" || req.Value == "" {
+		http.Error(w, "missing name or value", http.StatusBadRequest)
+		return
+	}
+	if req.NodeKey.IsZero() {
+		http.Error(w, "missing node key", http.StatusBadRequest)
+		return
+	}
+
+	s.mu.Lock()
+	node := s.nodes[req.NodeKey]
+	certDomains := s.certDomainsLocked(node)
+	s.mu.Unlock()
+	if node == nil {
+		http.Error(w, "unknown node key", http.StatusForbidden)
+		return
+	}
+	if node.Machine != mkey {
+		http.Error(w, "node key does not belong to machine", http.StatusForbidden)
+		return
+	}
+	baseName, ok := strings.CutPrefix(req.Name, "_acme-challenge.")
+	if !ok || !slices.Contains(certDomains, baseName) {
+		http.Error(w, "name is not an ACME challenge for a cert domain", http.StatusForbidden)
+		return
+	}
+	if s.OnSetDNS != nil {
+		if err := s.OnSetDNS(&req); err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+	}
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(tailcfg.SetDNSResponse{})
+}
+
+func (s *Server) certDomainsLocked(node *tailcfg.Node) []string {
+	if node == nil {
+		return nil
+	}
+	var ret []string
+	if s.DNSConfig != nil {
+		ret = append(ret, s.DNSConfig.CertDomains...)
+	}
+	if s.MagicDNSDomain != "" {
+		ret = append(ret, node.Hostinfo.Hostname()+"."+s.MagicDNSDomain)
+	}
+	return ret
+}
+
 // SetSubnetRoutes sets the list of subnet routes which a node is routing.
 func (s *Server) SetSubnetRoutes(nodeKey key.NodePublic, routes []netip.Prefix) {
 	s.mu.Lock()
@@ -539,6 +698,15 @@ func (s *Server) SetMasqueradeAddresses(pairs []MasqueradePair) {
 	s.updateLocked("SetMasqueradeAddresses", s.nodeIDsLocked(0))
 }
 
+// SetSSHPolicy sets the SSH policy sent in MapResponses and notifies all
+// connected nodes so they pick up the change.
+func (s *Server) SetSSHPolicy(policy *tailcfg.SSHPolicy) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.SSHPolicy = policy
+	s.updateLocked("SetSSHPolicy", s.nodeIDsLocked(0))
+}
+
 // SetNodeCapMap overrides the capability map the specified client receives.
 func (s *Server) SetNodeCapMap(nodeKey key.NodePublic, capMap tailcfg.NodeCapMap) {
 	s.mu.Lock()
@@ -768,6 +936,16 @@ func (s *Server) CompleteDeviceApproval(controlUrl string, urlStr string, nodeKe
 }
 
 func (s *Server) serveRegister(w http.ResponseWriter, r *http.Request, mkey key.MachinePublic) {
+	if fn := s.MaybeRateLimitRegister; fn != nil {
+		if reject, retryAfter, msg := fn(); reject {
+			if retryAfter != "" {
+				w.Header().Set("Retry-After", retryAfter)
+			}
+			http.Error(w, msg, http.StatusTooManyRequests)
+			return
+		}
+	}
+
 	msg, err := io.ReadAll(io.LimitReader(r.Body, msgLimit))
 	r.Body.Close()
 	if err != nil {
@@ -799,7 +977,8 @@ func (s *Server) serveRegister(w http.ResponseWriter, r *http.Request, mkey key.
 	}
 
 	// If this is a followup request, wait until interactive followup URL visit complete.
-	if req.Followup != "" {
+	isFollowup := req.Followup != ""
+	if isFollowup {
 		followupURL, err := url.Parse(req.Followup)
 		if err != nil {
 			panic(err)
@@ -815,18 +994,22 @@ func (s *Server) serveRegister(w http.ResponseWriter, r *http.Request, mkey key.
 		// some follow-ups? For now all are successes.
 	}
 
-	// The in-memory list of nodes, users, and logins is keyed by
-	// the node key.  If the node key changes, update all the data stores
-	// to use the new node key.
+	// On a key rotation (OldNodeKey set and known to s.nodes), stage
+	// the new key as a candidate entry but keep the old key's entry
+	// alive so an in-flight map poll can still receive updates while
+	// the user completes the auth URL.
 	s.mu.Lock()
 	if _, oldNodeKeyOk := s.nodes[req.OldNodeKey]; oldNodeKeyOk {
 		if _, newNodeKeyOk := s.nodes[req.NodeKey]; !newNodeKeyOk {
-			s.nodes[req.OldNodeKey].Key = req.NodeKey
-			s.nodes[req.NodeKey] = s.nodes[req.OldNodeKey]
-
+			cloned := s.nodes[req.OldNodeKey].Clone()
+			cloned.Key = req.NodeKey
+			s.nodes[req.NodeKey] = cloned
 			s.users[req.NodeKey] = s.users[req.OldNodeKey]
 			s.logins[req.NodeKey] = s.logins[req.OldNodeKey]
-
+		}
+		if isFollowup {
+			// The user has completed the auth URL, the new key
+			// is now authoritative. Retire the old key's entry.
 			delete(s.nodes, req.OldNodeKey)
 			delete(s.users, req.OldNodeKey)
 			delete(s.logins, req.OldNodeKey)
@@ -881,16 +1064,29 @@ func (s *Server) serveRegister(w http.ResponseWriter, r *http.Request, mkey key.
 			CapMap:            capMap,
 			Capabilities:      slices.Collect(maps.Keys(capMap)),
 		}
+		if s.TagOwners != nil && req.Hostinfo != nil {
+			// Trust the requested tags at signup; ownership checks
+			// against the registering user are not modeled.
+			node.Tags = slices.Clone(req.Hostinfo.RequestTags)
+		}
 		if s.MagicDNSDomain != "" {
 			node.Name = node.Name + "." + s.MagicDNSDomain + "."
 		}
 		s.nodes[nk] = node
 	}
+	// Consider a node key expired if allExpired is set or if the nodeKey has
+	// an expiry time in the past. This allows tests to set per-node KeyExpiry
+	// via UpdateNode to simulate an admin-triggered or time-based expiry.
+	nodeKeyExpired := s.allExpired
+	if !nodeKeyExpired && req.OldNodeKey.IsZero() {
+		if n, ok := s.nodes[nk]; ok && !n.KeyExpiry.IsZero() && n.KeyExpiry.Before(time.Now()) {
+			nodeKeyExpired = true
+		}
+	}
 	requireAuth := s.RequireAuth
-	if requireAuth && s.nodeKeyAuthed.Contains(nk) {
+	if requireAuth && s.nodeKeyAuthed.Contains(nk) && !nodeKeyExpired {
 		requireAuth = false
 	}
-	allExpired := s.allExpired
 	s.mu.Unlock()
 
 	authURL := ""
@@ -903,7 +1099,7 @@ func (s *Server) serveRegister(w http.ResponseWriter, r *http.Request, mkey key.
 	res, err := s.encode(false, tailcfg.RegisterResponse{
 		User:              *user,
 		Login:             *login,
-		NodeKeyExpired:    allExpired,
+		NodeKeyExpired:    nodeKeyExpired,
 		MachineAuthorized: machineAuthorized,
 		AuthURL:           authURL,
 	})
@@ -1104,6 +1300,71 @@ func (s *Server) incrInServeMap(delta int) {
 	s.inServeMap += delta
 }
 
+// handleTagTransitionLocked models the production control server's handling
+// of tag changes requested via Hostinfo.RequestTags in non-streaming map
+// requests (see updateTags in the control server). A request whose
+// RequestTags differ from both the node's stored Hostinfo's RequestTags and
+// the node's current tags is a tag transition request. If the transition is
+// permitted by s.TagOwners, the node is retagged; otherwise its node key is
+// expired to force reauthentication.
+//
+// hi is the Hostinfo from the incoming request; node.Hostinfo is the
+// previously stored one. s.mu must be held.
+func (s *Server) handleTagTransitionLocked(node *tailcfg.Node, hi tailcfg.HostinfoView) {
+	var oldReqTags []string
+	if node.Hostinfo.Valid() {
+		oldReqTags = node.Hostinfo.RequestTags().AsSlice()
+	}
+	newReqTags := hi.RequestTags().AsSlice()
+	if tagsEqualAnyOrder(oldReqTags, newReqTags) || tagsEqualAnyOrder(newReqTags, node.Tags) {
+		return
+	}
+	if s.validTagTransition(node.Tags, newReqTags) {
+		s.logf("testcontrol: retagging node %v: %v -> %v", node.ID, node.Tags, newReqTags)
+		node.Tags = newReqTags
+	} else {
+		s.logf("testcontrol: invalid tag transition %v -> %v for node %v; expiring its node key", node.Tags, newReqTags, node.ID)
+		node.KeyExpiry = time.Now().Add(-time.Minute)
+	}
+}
+
+// validTagTransition reports whether a node currently tagged cur may retag
+// itself as want, per s.TagOwners: every requested tag must be owned by one
+// of the node's current tags. An untagged node may claim any defined tag,
+// standing in for the production server's checks against the requesting
+// user, which this server doesn't model. Removing all tags is not allowed,
+// matching the production server.
+func (s *Server) validTagTransition(cur, want []string) bool {
+	if len(want) == 0 {
+		return len(cur) == 0
+	}
+	for _, tag := range want {
+		owners, ok := s.TagOwners[tag]
+		if !ok {
+			return false
+		}
+		if len(cur) == 0 {
+			continue
+		}
+		owned := slices.ContainsFunc(cur, func(c string) bool { return slices.Contains(owners, c) })
+		if !owned {
+			return false
+		}
+	}
+	return true
+}
+
+// tagsEqualAnyOrder reports whether a and b contain the same tags, ignoring order.
+func tagsEqualAnyOrder(a, b []string) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	as, bs := slices.Clone(a), slices.Clone(b)
+	slices.Sort(as)
+	slices.Sort(bs)
+	return slices.Equal(as, bs)
+}
+
 // InServeMap returns the number of clients currently in a MapRequest HTTP handler.
 func (s *Server) InServeMap() int {
 	s.mu.Lock()
@@ -1129,6 +1390,27 @@ func (s *Server) serveMap(w http.ResponseWriter, r *http.Request, mkey key.Machi
 		go panic(fmt.Sprintf("bad map request: %v", err))
 	}
 
+	s.mu.Lock()
+	if s.onMapRequest != nil {
+		s.onMapRequest(req.NodeKey)
+	}
+	s.mu.Unlock()
+
+	if s.HoldMapRequest != nil {
+		if done := s.HoldMapRequest(req); done != nil {
+			defer done()
+		}
+	}
+
+	if s.AltMapStream != nil {
+		// The caller takes over the stream entirely; it must handle
+		// keeping the HTTP response alive until ctx is done.
+		compress := req.Compress != ""
+		w.WriteHeader(200)
+		s.AltMapStream(ctx, &mapStreamSender{s: s, w: w, compress: compress}, req)
+		return
+	}
+
 	jitter := rand.N(8 * time.Second)
 	keepAlive := 50*time.Second + jitter
 
@@ -1142,22 +1424,54 @@ func (s *Server) serveMap(w http.ResponseWriter, r *http.Request, mkey key.Machi
 		return
 	}
 
+	// Per tailcfg.MapRequest.Stream docs: if Stream is true and Version >= 68,
+	// the server must treat this as read-only and ignore Hostinfo, Endpoints,
+	// DiscoKey, etc. — modern clients send those via a separate non-streaming
+	// POST /machine/map from a dedicated updateRoutine, not piggybacked on the
+	// streaming poll. Without this, the streaming MapRequest's zero-valued
+	// DiscoKey/Endpoints clobber whatever was just pushed out-of-band.
+	streamingNonUpdate := req.Stream && req.Version >= 68
 	var peersToUpdate []tailcfg.NodeID
-	if !req.ReadOnly {
+	if !req.ReadOnly && !streamingNonUpdate {
+		if ctx.Err() != nil {
+			// The client canceled the request (say, its control client
+			// was shut down mid-request when "tailscale up" or a
+			// profile switch created a new one), so its contents may
+			// predate newer requests that were already processed.
+			// Don't apply its Hostinfo/endpoints; they may be stale.
+			s.logf("testcontrol: dropping canceled map update from %v", req.NodeKey.ShortString())
+			http.Error(w, "request canceled", 400)
+			return
+		}
 		endpoints := filterInvalidIPv6Endpoints(req.Endpoints)
-		node.Endpoints = endpoints
-		node.DiscoKey = req.DiscoKey
-		node.Cap = req.Version
+		var hi tailcfg.HostinfoView
+		var newDERP int
 		if req.Hostinfo != nil {
-			node.Hostinfo = req.Hostinfo.View()
-			if ni := node.Hostinfo.NetInfo(); ni.Valid() {
-				if ni.PreferredDERP() != 0 {
-					node.HomeDERP = ni.PreferredDERP()
-				}
+			hi = req.Hostinfo.View()
+			if ni := hi.NetInfo(); ni.Valid() {
+				newDERP = ni.PreferredDERP()
 			}
 		}
+		// Mutate the live node under the mutex; writing back the clone
+		// obtained above would clobber any concurrent writer's changes
+		// to other fields (e.g. UpdateNode, SetNodeCapMap).
 		s.mu.Lock()
-		peersToUpdate = s.updateNodeLocked(node)
+		live := s.nodes[req.NodeKey]
+		if live != nil {
+			live.Endpoints = endpoints
+			live.DiscoKey = req.DiscoKey
+			live.Cap = req.Version
+			if hi.Valid() {
+				if s.TagOwners != nil {
+					s.handleTagTransitionLocked(live, hi)
+				}
+				live.Hostinfo = hi
+				if newDERP != 0 {
+					live.HomeDERP = newDERP
+				}
+			}
+			peersToUpdate = s.nodeIDsLocked(live.ID)
+		}
 		s.mu.Unlock()
 	}
 
@@ -1312,10 +1626,14 @@ func (s *Server) MapResponse(req *tailcfg.MapRequest) (res *tailcfg.MapResponse,
 		dns = s.DNSConfig.Clone()
 	}
 	magicDNSDomain := s.MagicDNSDomain
+	sshPolicy := s.SSHPolicy.Clone()
 	s.mu.Unlock()
 
 	node.CapMap = nodeCapMap
 	node.Capabilities = append(node.Capabilities, tailcfg.NodeAttrDisableUPnP)
+	if sshPolicy != nil {
+		mak.Set(&node.CapMap, tailcfg.CapabilitySSH, nil)
+	}
 
 	t := time.Date(2020, 8, 3, 0, 0, 0, 1, time.UTC)
 	if dns != nil && magicDNSDomain != "" {
@@ -1329,6 +1647,7 @@ func (s *Server) MapResponse(req *tailcfg.MapRequest) (res *tailcfg.MapResponse,
 		CollectServices: cmp.Or(s.CollectServices, opt.True),
 		PacketFilter:    packetFilterWithIngress(s.PeerRelayGrants),
 		DNSConfig:       dns,
+		SSHPolicy:       sshPolicy,
 		ControlTime:     &t,
 	}
 
@@ -1371,6 +1690,9 @@ func (s *Server) MapResponse(req *tailcfg.MapRequest) (res *tailcfg.MapResponse,
 			p.PrimaryRoutes = routes
 			p.AllowedIPs = append(p.AllowedIPs, routes...)
 		}
+		if s.AllOnline {
+			p.Online = new(true)
+		}
 		res.Peers = append(res.Peers, p)
 	}
 
@@ -1419,15 +1741,29 @@ func (s *Server) MapResponse(req *tailcfg.MapRequest) (res *tailcfg.MapResponse,
 	res.Node.PrimaryRoutes = s.nodeSubnetRoutes[nk]
 	res.Node.AllowedIPs = append(res.Node.Addresses, s.nodeSubnetRoutes[nk]...)
 
-	// Consume a PingRequest while protected by mutex if it exists
-	switch m := s.msgToSend[nk].(type) {
-	case *tailcfg.PingRequest:
-		res.PingRequest = m
-		delete(s.msgToSend, nk)
+	// Consume a PingRequest at the head of the queue, if any.
+	if q := s.msgToSend[nk]; len(q) > 0 {
+		if pr, ok := q[0].(*tailcfg.PingRequest); ok {
+			res.PingRequest = pr
+			s.popMsgToSendLocked(nk)
+		}
 	}
 	return res, nil
 }
 
+// popMsgToSendLocked pops the head of the per-node message queue.
+// s.mu must be held.
+func (s *Server) popMsgToSendLocked(nk key.NodePublic) {
+	q := s.msgToSend[nk]
+	if len(q) <= 1 {
+		delete(s.msgToSend, nk)
+		return
+	}
+	// Zero the head to allow GC of any large referenced response.
+	q[0] = nil
+	s.msgToSend[nk] = q[1:]
+}
+
 func (s *Server) canGenerateAutomaticMapResponseFor(nk key.NodePublic) bool {
 	s.mu.Lock()
 	defer s.mu.Unlock()
@@ -1437,22 +1773,21 @@ func (s *Server) canGenerateAutomaticMapResponseFor(nk key.NodePublic) bool {
 func (s *Server) hasPendingRawMapMessage(nk key.NodePublic) bool {
 	s.mu.Lock()
 	defer s.mu.Unlock()
-	_, ok := s.msgToSend[nk]
-	return ok
+	return len(s.msgToSend[nk]) > 0
 }
 
 func (s *Server) takeRawMapMessage(nk key.NodePublic) (mapResJSON []byte, ok bool) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
-	mr, ok := s.msgToSend[nk]
-	if !ok {
+	q := s.msgToSend[nk]
+	if len(q) == 0 {
 		return nil, false
 	}
-	delete(s.msgToSend, nk)
+	mr := q[0]
+	s.popMsgToSendLocked(nk)
 
 	// If it's a bare PingRequest, wrap it in a MapResponse.
-	switch pr := mr.(type) {
-	case *tailcfg.PingRequest:
+	if pr, ok := mr.(*tailcfg.PingRequest); ok {
 		mr = &tailcfg.MapResponse{PingRequest: pr}
 	}
 
@@ -1464,12 +1799,51 @@ func (s *Server) takeRawMapMessage(nk key.NodePublic) (mapResJSON []byte, ok boo
 	return mapResJSON, true
 }
 
+// AltMapStreamFunc is the type of [Server.AltMapStream]: a callback that
+// takes over the serveMap handler entirely. The callback hand-builds and
+// sends MapResponses via the provided [MapStreamWriter] and is responsible
+// for keeping the stream alive until ctx is done. When set, the normal
+// per-node map-stream state machine in serveMap is bypassed.
+//
+// The callback is invoked for every map long-poll, including the
+// non-streaming "lite" polls controlclient issues to push HostInfo updates
+// (req.Stream == false). Implementations that only care about the streaming
+// long-poll typically respond to non-streaming polls with an empty
+// MapResponse and return immediately.
+//
+// This hook is for benchmarks and stress tests that need to drive clients
+// with a controlled sequence of responses.
+type AltMapStreamFunc func(ctx context.Context, w MapStreamWriter, req *tailcfg.MapRequest)
+
+// MapStreamWriter is the interface passed to an [AltMapStreamFunc],
+// letting the callback write framed MapResponse messages directly onto the
+// long-poll HTTP response.
+type MapStreamWriter interface {
+	// SendMapMessage encodes and writes msg as a single framed
+	// MapResponse on the stream. It respects the client's Compress flag
+	// (captured when the stream started).
+	SendMapMessage(msg *tailcfg.MapResponse) error
+}
+
+// mapStreamSender implements [MapStreamWriter] for [Server.AltMapStream]
+// callbacks.
+type mapStreamSender struct {
+	s        *Server
+	w        http.ResponseWriter
+	compress bool
+}
+
+func (m *mapStreamSender) SendMapMessage(msg *tailcfg.MapResponse) error {
+	return m.s.sendMapMsg(m.w, m.compress, msg)
+}
+
 func (s *Server) sendMapMsg(w http.ResponseWriter, compress bool, msg any) error {
 	resBytes, err := s.encode(compress, msg)
 	if err != nil {
 		return err
 	}
-	if len(resBytes) > 16<<20 {
+	const maxMapSize = 256 << 20 // 256MB
+	if len(resBytes) > maxMapSize {
 		return fmt.Errorf("map message too big: %d", len(resBytes))
 	}
 	var siz [4]byte
@@ -1509,6 +1883,15 @@ func (s *Server) encode(compress bool, v any) (b []byte, err error) {
 	return b, nil
 }
 
+// SetOnMapRequest sets callback used for testing when a new mapRequest happens.
+// Pass nil to remove the callback.
+func (s *Server) SetOnMapRequest(f func(key.NodePublic)) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	s.onMapRequest = f
+}
+
 // filterInvalidIPv6Endpoints removes invalid IPv6 endpoints from eps,
 // modify the slice in place, returning the potentially smaller subset (aliasing
 // the original memory).
diff --git a/tstest/integration/testcontrol/testcontrol_test.go b/tstest/integration/testcontrol/testcontrol_test.go
new file mode 100644
index 000000000..d3008cdb7
--- /dev/null
+++ b/tstest/integration/testcontrol/testcontrol_test.go
@@ -0,0 +1,132 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package testcontrol_test
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"tailscale.com/control/ts2021"
+	"tailscale.com/control/tsp"
+	"tailscale.com/net/tsdial"
+	"tailscale.com/tailcfg"
+	"tailscale.com/tstest/integration/testcontrol"
+	"tailscale.com/types/key"
+	"tailscale.com/util/must"
+)
+
+// TestStreamingMapReqReadOnlyByVersion verifies that testcontrol matches
+// production control's streaming-is-read-only semantics for clients at
+// capability version >= 68. Per tailcfg.MapRequest.Stream docs, a streaming
+// MapRequest from a cap>=68 client must be treated as read-only by the
+// server (Endpoints/Hostinfo/DiscoKey are sent separately via a non-streaming
+// /machine/map call), so the streaming MapRequest's zero-valued DiscoKey
+// must not clobber the node's currently stored DiscoKey.
+//
+// For older (cap<68) clients, the streaming MapRequest is still a write and
+// writes do happen, so DiscoKey=zero in the request does clobber.
+func TestStreamingMapReqReadOnlyByVersion(t *testing.T) {
+	tests := []struct {
+		version     tailcfg.CapabilityVersion
+		wantClobber bool
+	}{
+		{67, true},  // pre-cap-68: streaming is a write, DiscoKey=zero clobbers.
+		{68, false}, // cap>=68: streaming is read-only, DiscoKey unchanged.
+	}
+
+	for _, tt := range tests {
+		t.Run(fmt.Sprintf("v%d", tt.version), func(t *testing.T) {
+			ctrl := &testcontrol.Server{}
+			ctrl.HTTPTestServer = httptest.NewUnstartedServer(ctrl)
+			ctrl.HTTPTestServer.Start()
+			t.Cleanup(ctrl.HTTPTestServer.Close)
+			baseURL := ctrl.HTTPTestServer.URL
+
+			ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+			defer cancel()
+
+			serverKey := must.Get(tsp.DiscoverServerKey(ctx, baseURL))
+
+			// Register a node and push a known DiscoKey via SendMapUpdate
+			// (a non-streaming, unambiguously-a-write request).
+			nodeKey := key.NewNode()
+			machineKey := key.NewMachine()
+			wantDisco := key.NewDisco().Public()
+
+			tc := must.Get(tsp.NewClient(tsp.ClientOpts{
+				ServerURL:  baseURL,
+				MachineKey: machineKey,
+			}))
+			defer tc.Close()
+			tc.SetControlPublicKey(serverKey)
+			must.Get(tc.Register(ctx, tsp.RegisterOpts{
+				NodeKey:  nodeKey,
+				Hostinfo: &tailcfg.Hostinfo{Hostname: "target"},
+			}))
+			if err := tc.SendMapUpdate(ctx, tsp.SendMapUpdateOpts{
+				NodeKey:  nodeKey,
+				DiscoKey: wantDisco,
+				Hostinfo: &tailcfg.Hostinfo{Hostname: "target"},
+			}); err != nil {
+				t.Fatalf("SendMapUpdate: %v", err)
+			}
+			if n := ctrl.Node(nodeKey.Public()); n == nil || n.DiscoKey != wantDisco {
+				t.Fatalf("pre: DiscoKey not set; node=%+v", n)
+			}
+
+			// Fire a streaming MapRequest with the chosen Version and a
+			// zero DiscoKey. Use ts2021 directly because tsp.Map hardcodes
+			// Version to tailcfg.CurrentCapabilityVersion.
+			nc := must.Get(ts2021.NewClient(ts2021.ClientOpts{
+				ServerURL:    baseURL,
+				PrivKey:      machineKey,
+				ServerPubKey: serverKey,
+				Dialer:       tsdial.NewFromFuncForDebug(t.Logf, (&net.Dialer{}).DialContext),
+			}))
+			defer nc.Close()
+
+			body := must.Get(json.Marshal(&tailcfg.MapRequest{
+				Version: tt.version,
+				NodeKey: nodeKey.Public(),
+				Stream:  true,
+				// DiscoKey intentionally zero.
+			}))
+			reqURL := strings.Replace(baseURL+"/machine/map", "http:", "https:", 1)
+			reqCtx, reqCancel := context.WithCancel(ctx)
+			defer reqCancel()
+			req := must.Get(http.NewRequestWithContext(reqCtx, "POST", reqURL, bytes.NewReader(body)))
+			ts2021.AddLBHeader(req, nodeKey.Public())
+
+			// nc.Do returns once response headers arrive, which in
+			// testcontrol's serveMap is AFTER the write branch has run
+			// (or been skipped). So by the time this returns, any write
+			// this request is going to do has already happened.
+			res, err := nc.Do(req)
+			if err != nil {
+				t.Fatalf("nc.Do: %v", err)
+			}
+			res.Body.Close() // tears down the streaming session server-side
+
+			got := ctrl.Node(nodeKey.Public())
+			if got == nil {
+				t.Fatal("node disappeared")
+			}
+			switch {
+			case tt.wantClobber && !got.DiscoKey.IsZero():
+				t.Errorf("v%d: expected DiscoKey clobbered to zero, got %v", tt.version, got.DiscoKey)
+			case !tt.wantClobber && got.DiscoKey != wantDisco:
+				t.Errorf("v%d: DiscoKey changed from %v to %v; should have been left alone",
+					tt.version, wantDisco, got.DiscoKey)
+			}
+		})
+	}
+}
diff --git a/tstest/integration/vms/distros.go b/tstest/integration/vms/distros.go
index 94f11c77a..b6312dba4 100644
--- a/tstest/integration/vms/distros.go
+++ b/tstest/integration/vms/distros.go
@@ -35,11 +35,10 @@ func (d *Distro) InstallPre() string {
 		return ` - [ dnf, install, "-y", iptables ]`
 
 	case "apt":
-		return ` - [ apt-get, update ]
- - [ apt-get, "-y", install, curl, "apt-transport-https", gnupg2 ]`
+		return ` - [ apt-get, "-y", install, curl, "apt-transport-https", gnupg2 ]`
 
 	case "apk":
-		return ` - [ apk, "-U", add, curl, "ca-certificates", iptables, ip6tables ]
+		return ` - [ apk, add, curl, "ca-certificates", iptables, ip6tables ]
  - [ modprobe, tun ]`
 	}
 
diff --git a/tstest/integration/whois_test.go b/tstest/integration/whois_test.go
index b4e99a547..258a22987 100644
--- a/tstest/integration/whois_test.go
+++ b/tstest/integration/whois_test.go
@@ -21,7 +21,6 @@ import (
 // netstack forwards the connection to localhost, and the listener
 // calls WhoIs on n2's LocalAPI to identify the remote peer as n1.
 func TestUserspaceWhoIsProxyMap(t *testing.T) {
-	tstest.Shard(t)
 	tstest.Parallel(t)
 	env := NewTestEnv(t)
 
diff --git a/tstest/iosdeps/iosdeps.go b/tstest/iosdeps/iosdeps.go
index f6290af67..a1279e20b 100644
--- a/tstest/iosdeps/iosdeps.go
+++ b/tstest/iosdeps/iosdeps.go
@@ -4,28 +4,36 @@
 // Package iosdeps is a just a list of the packages we import on iOS, to let us
 // test that our transitive closure of dependencies on iOS doesn't accidentally
 // grow too large, as we've historically been memory constrained there.
+//
+// It is intended to mirror the imports of the ipn-go-bridge package in the
+// private "corp" repository (the Go side of the iOS / macOS app).
 package iosdeps
 
 import (
 	_ "bufio"
 	_ "bytes"
-	_ "context"
-	_ "crypto/rand"
+	_ "crypto"
+	_ "crypto/ecdsa"
+	_ "crypto/elliptic"
 	_ "crypto/sha256"
+	_ "encoding/base64"
 	_ "encoding/json"
 	_ "errors"
 	_ "fmt"
 	_ "io"
-	_ "io/fs"
 	_ "log"
 	_ "math"
 	_ "net"
 	_ "net/http"
+	_ "net/netip"
+	_ "net/url"
 	_ "os"
 	_ "os/signal"
 	_ "path/filepath"
 	_ "runtime"
 	_ "runtime/debug"
+	_ "slices"
+	_ "strconv"
 	_ "strings"
 	_ "sync"
 	_ "sync/atomic"
@@ -35,24 +43,48 @@ import (
 
 	_ "github.com/tailscale/wireguard-go/device"
 	_ "github.com/tailscale/wireguard-go/tun"
-	_ "go4.org/mem"
 	_ "golang.org/x/sys/unix"
+	_ "tailscale.com/client/tailscale/apitype"
+	_ "tailscale.com/drive/driveimpl"
+	_ "tailscale.com/envknob"
+	_ "tailscale.com/feature/condregister"
+	_ "tailscale.com/feature/syspolicy"
+	_ "tailscale.com/feature/taildrop"
 	_ "tailscale.com/hostinfo"
 	_ "tailscale.com/ipn"
+	_ "tailscale.com/ipn/ipnauth"
 	_ "tailscale.com/ipn/ipnlocal"
 	_ "tailscale.com/ipn/localapi"
+	_ "tailscale.com/logpolicy"
 	_ "tailscale.com/logtail"
 	_ "tailscale.com/logtail/filch"
 	_ "tailscale.com/net/dns"
-	_ "tailscale.com/net/netaddr"
+	_ "tailscale.com/net/netmon"
+	_ "tailscale.com/net/netutil"
+	_ "tailscale.com/net/tsaddr"
 	_ "tailscale.com/net/tsdial"
+	_ "tailscale.com/net/tshttpproxy"
 	_ "tailscale.com/net/tstun"
 	_ "tailscale.com/paths"
+	_ "tailscale.com/safesocket"
+	_ "tailscale.com/tsd"
 	_ "tailscale.com/types/empty"
+	_ "tailscale.com/types/key"
+	_ "tailscale.com/types/lazy"
 	_ "tailscale.com/types/logger"
+	_ "tailscale.com/types/logid"
+	_ "tailscale.com/types/netmap"
 	_ "tailscale.com/util/clientmetric"
 	_ "tailscale.com/util/dnsname"
+	_ "tailscale.com/util/eventbus"
+	_ "tailscale.com/util/must"
+	_ "tailscale.com/util/set"
+	_ "tailscale.com/util/syspolicy"
+	_ "tailscale.com/util/syspolicy/pkey"
+	_ "tailscale.com/util/syspolicy/setting"
+	_ "tailscale.com/util/syspolicy/source"
 	_ "tailscale.com/version"
 	_ "tailscale.com/wgengine"
+	_ "tailscale.com/wgengine/netstack"
 	_ "tailscale.com/wgengine/router"
 )
diff --git a/tstest/kernel_linux.go b/tstest/kernel_linux.go
index ab7c0d529..ed48fd071 100644
--- a/tstest/kernel_linux.go
+++ b/tstest/kernel_linux.go
@@ -20,8 +20,13 @@ func KernelVersion() (major, minor, patch int) {
 		return 0, 0, 0
 	}
 	release := unix.ByteSliceToString(uname.Release[:])
+	return parseKernelVersion(release)
+}
 
-	// Parse version string (e.g., "5.15.0-...")
+// parseKernelVersion parses a Linux kernel version string like "6.12.73+deb13-amd64"
+// or "5.15.0-76-generic" and returns the major, minor, and patch components.
+// It returns (0, 0, 0) if the version cannot be parsed.
+func parseKernelVersion(release string) (major, minor, patch int) {
 	parts := strings.Split(release, ".")
 	if len(parts) < 3 {
 		return 0, 0, 0
@@ -37,9 +42,12 @@ func KernelVersion() (major, minor, patch int) {
 		return 0, 0, 0
 	}
 
-	// Patch version may have additional info after a hyphen (e.g., "0-76-generic")
-	// Extract just the numeric part before any hyphen
-	patchStr, _, _ := strings.Cut(parts[2], "-")
+	// Patch version may have additional info after a hyphen or plus (e.g., "0-76-generic" or "41+deb13-amd64")
+	// Extract just the numeric part before any hyphen or plus
+	patchStr := parts[2]
+	if idx := strings.IndexAny(patchStr, "-+"); idx != -1 {
+		patchStr = patchStr[:idx]
+	}
 
 	patch, err = strconv.Atoi(patchStr)
 	if err != nil {
diff --git a/tstest/kernel_linux_test.go b/tstest/kernel_linux_test.go
new file mode 100644
index 000000000..9445ebe2c
--- /dev/null
+++ b/tstest/kernel_linux_test.go
@@ -0,0 +1,34 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build linux
+
+package tstest
+
+import "testing"
+
+func TestParseKernelVersion(t *testing.T) {
+	tests := []struct {
+		release             string
+		major, minor, patch int
+	}{
+		{"5.15.0-76-generic", 5, 15, 0},
+		{"6.12.73+deb13-amd64", 6, 12, 73},
+		{"6.1.0-18-amd64", 6, 1, 0},
+		{"5.4.0", 5, 4, 0},
+		{"6.8.12", 6, 8, 12},
+		{"4.19.0+1", 4, 19, 0},
+		{"6.12.41+deb13-amd64", 6, 12, 41},
+		{"", 0, 0, 0},
+		{"not-a-version", 0, 0, 0},
+		{"1.2", 0, 0, 0},
+		{"a.b.c", 0, 0, 0},
+	}
+	for _, tt := range tests {
+		major, minor, patch := parseKernelVersion(tt.release)
+		if major != tt.major || minor != tt.minor || patch != tt.patch {
+			t.Errorf("parseKernelVersion(%q) = (%d, %d, %d), want (%d, %d, %d)",
+				tt.release, major, minor, patch, tt.major, tt.minor, tt.patch)
+		}
+	}
+}
diff --git a/tstest/largetailnet/delta_test.go b/tstest/largetailnet/delta_test.go
new file mode 100644
index 000000000..7ca2bb503
--- /dev/null
+++ b/tstest/largetailnet/delta_test.go
@@ -0,0 +1,278 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package largetailnet_test
+
+import (
+	"context"
+	"fmt"
+	"net/http/httptest"
+	"net/netip"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"tailscale.com/ipn/store/mem"
+	"tailscale.com/tailcfg"
+	"tailscale.com/tsnet"
+	"tailscale.com/tstest"
+	"tailscale.com/tstest/integration"
+	"tailscale.com/tstest/integration/testcontrol"
+	"tailscale.com/tstest/largetailnet"
+	"tailscale.com/types/ipproto"
+	"tailscale.com/types/logger"
+	"tailscale.com/util/clientmetric"
+	"tailscale.com/wgengine/filter"
+)
+
+// metricByName returns the [clientmetric.Metric] with the given name,
+// failing the test if not found.
+func metricByName(t testing.TB, name string) *clientmetric.Metric {
+	t.Helper()
+	for _, m := range clientmetric.Metrics() {
+		if m.Name() == name {
+			return m
+		}
+	}
+	t.Fatalf("metric %q not found", name)
+	return nil
+}
+
+// TestNetmapDeltaFastPath drives a sequence of MapResponses against an
+// in-process tsnet + testcontrol harness via [largetailnet.Streamer]'s
+// AltMapStream hook, exercising every delta-message kind the
+// incremental netmap path handles. After each delta it asserts both:
+//
+//   - the appropriate fast-path metric counters incremented (i.e. we
+//     stayed on the incremental path and did not fall through to a full
+//     netmap rebuild); and
+//
+//   - the corresponding side effect is observable on the [LocalBackend]
+//     (a fresh peer resolvable via PeerByID, a UserProfile resolvable
+//     via UserProfile, a packet filter rule reflected in
+//     ForTest().GetFilter, a per-field patch reflected in PeerByID, etc.).
+//
+// This is the destination-side companion to
+// [tstest/largetailnet/BenchmarkGiantTailnet], which only measures cost
+// of the same fast path — this test verifies correctness.
+func TestNetmapDeltaFastPath(t *testing.T) {
+
+	logf := logger.Discard
+	if testing.Verbose() {
+		logf = t.Logf
+	}
+
+	ctx, cancel := context.WithTimeout(t.Context(), 60*time.Second)
+	t.Cleanup(cancel)
+
+	derpMap := integration.RunDERPAndSTUN(t, logf, "127.0.0.1")
+
+	// Start with one initial peer (NodeID 2) so the initial netmap is
+	// realistic. The fast path will not fire for the initial response —
+	// it always goes through UpdateFullNetmap — but every subsequent
+	// SendDelta should.
+	streamer := largetailnet.New(1, derpMap)
+	ctrl := &testcontrol.Server{
+		DERPMap:      derpMap,
+		DNSConfig:    &tailcfg.DNSConfig{},
+		AltMapStream: streamer.AltMapStream(),
+		Logf:         logf,
+	}
+	ctrl.HTTPTestServer = httptest.NewUnstartedServer(ctrl)
+	ctrl.HTTPTestServer.Start()
+	t.Cleanup(ctrl.HTTPTestServer.Close)
+
+	tmp := filepath.Join(t.TempDir(), "tsnet")
+	if err := os.MkdirAll(tmp, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	s := &tsnet.Server{
+		Dir:        tmp,
+		ControlURL: ctrl.HTTPTestServer.URL,
+		Hostname:   "delta-test",
+		Store:      new(mem.Store),
+		Ephemeral:  true,
+		Logf:       logf,
+	}
+	t.Cleanup(func() { s.Close() })
+	if _, err := s.Up(ctx); err != nil {
+		t.Fatalf("tsnet.Server.Up: %v", err)
+	}
+	lb := tsnet.TestHooks.LocalBackend(s)
+
+	// Snapshot baseline metric values; we'll assert deltas against
+	// these. Globals make per-test isolation impossible, but deltas
+	// are robust against interleaving (assuming no other test runs in
+	// parallel here).
+	mFast := metricByName(t, "controlclient_map_response_handled_incrementally")
+	mFull := metricByName(t, "controlclient_map_response_handled_full_rebuild")
+	mUpsert := metricByName(t, "localbackend_netmap_delta_peer_upserted")
+	mRem := metricByName(t, "localbackend_netmap_delta_peer_removed")
+	mPatch := metricByName(t, "localbackend_netmap_delta_peer_patched")
+	mFilter := metricByName(t, "localbackend_update_packet_filter")
+	mUsers := metricByName(t, "localbackend_update_user_profiles")
+	baseline := map[*clientmetric.Metric]int64{
+		mFast: mFast.Value(), mFull: mFull.Value(),
+		mUpsert: mUpsert.Value(), mRem: mRem.Value(), mPatch: mPatch.Value(),
+		mFilter: mFilter.Value(), mUsers: mUsers.Value(),
+	}
+	dumpMetrics := func(t *testing.T) {
+		t.Helper()
+		for _, m := range []*clientmetric.Metric{mFast, mFull, mUpsert, mRem, mPatch, mFilter, mUsers} {
+			t.Logf("metric %s = %d (baseline %d, delta %d)", m.Name(), m.Value(), baseline[m], m.Value()-baseline[m])
+		}
+	}
+	waitDelta := func(t *testing.T, m *clientmetric.Metric, want int64) {
+		t.Helper()
+		err := tstest.WaitFor(2*time.Second, func() error {
+			got := m.Value() - baseline[m]
+			if got >= want {
+				return nil
+			}
+			return fmt.Errorf("%s delta = %d, want >= %d", m.Name(), got, want)
+		})
+		if err != nil {
+			dumpMetrics(t)
+			t.Fatalf("%s: %v", m.Name(), err)
+		}
+		if got := m.Value() - baseline[m]; got != want {
+			t.Errorf("%s delta = %d, want exactly %d", m.Name(), got, want)
+		}
+		baseline[m] = m.Value()
+	}
+
+	// Helper to send a MapResponse and wait for it to be processed by
+	// the client. We use the metric deltas as our synchronization
+	// point: SendDelta is synchronous from the streamer side, but the
+	// client processes the response on its own goroutine, so we wait
+	// for the fast-path counter to tick.
+	sendDelta := func(t *testing.T, mr *tailcfg.MapResponse) {
+		t.Helper()
+		if err := streamer.SendDelta(ctx, mr); err != nil {
+			t.Fatalf("SendDelta: %v", err)
+		}
+	}
+
+	// Self IPv4, used as the destination in packet filter checks below.
+	// largetailnet derives self addresses from SelfNodeID via node4/node6;
+	// for SelfNodeID=1 that's 100.100.0.1.
+	selfIP4 := netip.MustParseAddr("100.100.0.1")
+
+	// addedPeerID is set by the peer_added_with_filter_and_user_profile
+	// subtest and consumed later by peer_removed.
+	var addedPeerID tailcfg.NodeID
+
+	t.Run("peer_added_with_filter_and_user_profile", func(t *testing.T) {
+		// Add a fresh peer. Bundle a new PacketFilter rule allowing
+		// TCP from that peer's IP to a port we'll later probe, and a
+		// new UserProfile for the user that owns the new peer.
+		newPeer := streamer.AllocPeer()
+		newUser := tailcfg.UserID(42)
+		newPeer.User = newUser
+		newPeer.Addresses = []netip.Prefix{netip.MustParsePrefix("100.64.0.42/32")}
+		addedPeerID = newPeer.ID
+		sendDelta(t, &tailcfg.MapResponse{
+			PeersChanged: []*tailcfg.Node{newPeer},
+			PacketFilter: []tailcfg.FilterRule{{
+				SrcIPs:   []string{"100.64.0.42/32"},
+				IPProto:  []int{int(ipproto.TCP)},
+				DstPorts: []tailcfg.NetPortRange{{IP: "*", Ports: tailcfg.PortRange{First: 22, Last: 22}}},
+			}},
+			UserProfiles: []tailcfg.UserProfile{{
+				ID:          newUser,
+				LoginName:   "alice@example.com",
+				DisplayName: "Alice",
+			}},
+		})
+
+		waitDelta(t, mFast, 1)
+		waitDelta(t, mUpsert, 1)
+		waitDelta(t, mFilter, 1)
+		waitDelta(t, mUsers, 1)
+		waitDelta(t, mFull, 0)
+
+		// Side effects.
+		nv, ok := lb.PeerByID(newPeer.ID)
+		if !ok || nv.ID() != newPeer.ID {
+			t.Errorf("PeerByID(%d) ok=%v node=%v", newPeer.ID, ok, nv)
+		}
+		uv, ok := lb.UserProfile(newUser)
+		if !ok || uv.LoginName() != "alice@example.com" {
+			t.Errorf("UserProfile(%d) ok=%v login=%q", newUser, ok, uv.LoginName())
+		}
+		pf := lb.ForTest().GetFilter()
+		if got := pf.Check(netip.MustParseAddr("100.64.0.42"), selfIP4, 22, ipproto.TCP); got != filter.Accept {
+			t.Errorf("packet filter Check from new peer = %s; want Accept", got)
+		}
+	})
+
+	t.Run("peer_patch_derp_home", func(t *testing.T) {
+		// Patch the initial peer's DERPRegion via PeersChangedPatch.
+		// This rides as NodeMutationDERPHome.
+		sendDelta(t, &tailcfg.MapResponse{
+			PeersChangedPatch: []*tailcfg.PeerChange{{
+				NodeID:     2,
+				DERPRegion: 7,
+			}},
+		})
+
+		waitDelta(t, mFast, 1)
+		waitDelta(t, mPatch, 1)
+		waitDelta(t, mFull, 0)
+
+		nv, ok := lb.PeerByID(2)
+		if !ok {
+			t.Fatalf("PeerByID(2) not found")
+		}
+		if got := nv.HomeDERP(); got != 7 {
+			t.Errorf("HomeDERP = %d, want 7", got)
+		}
+	})
+
+	t.Run("peer_online_and_last_seen", func(t *testing.T) {
+		// Online + LastSeen on the same delta. PeerSeenChange's value
+		// is true to set LastSeen, false to clear it; the time it gets
+		// is now() at the time MutationsFromMapResponse runs on the
+		// client, not a wire value.
+		sendDelta(t, &tailcfg.MapResponse{
+			OnlineChange:   map[tailcfg.NodeID]bool{2: true},
+			PeerSeenChange: map[tailcfg.NodeID]bool{2: true},
+		})
+
+		waitDelta(t, mFast, 1)
+		// Two mutations: one NodeMutationOnline + one NodeMutationLastSeen.
+		waitDelta(t, mPatch, 2)
+		waitDelta(t, mFull, 0)
+
+		nv, ok := lb.PeerByID(2)
+		if !ok {
+			t.Fatalf("PeerByID(2) not found")
+		}
+		if o := nv.Online(); !o.Valid() || !o.Get() {
+			t.Errorf("Online = %v, want true", o)
+		}
+	})
+
+	t.Run("peer_removed", func(t *testing.T) {
+		if addedPeerID == 0 {
+			t.Fatal("peer_added_with_filter_and_user_profile must run first")
+		}
+		// Sanity check: the peer should currently exist.
+		if _, ok := lb.PeerByID(addedPeerID); !ok {
+			t.Fatalf("PeerByID(%d) missing before removal", addedPeerID)
+		}
+
+		sendDelta(t, &tailcfg.MapResponse{
+			PeersRemoved: []tailcfg.NodeID{addedPeerID},
+		})
+
+		waitDelta(t, mFast, 1)
+		waitDelta(t, mRem, 1)
+		waitDelta(t, mFull, 0)
+
+		if _, ok := lb.PeerByID(addedPeerID); ok {
+			t.Errorf("PeerByID(%d) still present after PeersRemoved", addedPeerID)
+		}
+	})
+}
diff --git a/tstest/largetailnet/largetailnet.go b/tstest/largetailnet/largetailnet.go
new file mode 100644
index 000000000..73ec2da80
--- /dev/null
+++ b/tstest/largetailnet/largetailnet.go
@@ -0,0 +1,265 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package largetailnet provides reusable building blocks for in-process
+// benchmarks and stress tests that drive a single tailnet client (typically a
+// [tsnet.Server]) with a synthetic large-tailnet MapResponse stream.
+//
+// A [Streamer] takes over the map long-poll on a [testcontrol.Server] via the
+// AltMapStream hook: it sends one initial MapResponse announcing the self
+// node and N synthetic peers, and then forwards caller-supplied delta
+// MapResponses on the same stream until ctx is done.
+//
+// The package is designed so that a benchmark can:
+//
+//   - Build a [Streamer] with the desired peer count.
+//   - Stand up a [testcontrol.Server] with the streamer's [Streamer.AltMapStream]
+//     installed.
+//   - Stand up a [tsnet.Server] pointed at the testcontrol; its Up call
+//     blocks until the initial netmap has been processed.
+//   - Reset the benchmark timer and drive add/remove deltas with
+//     [Streamer.SendDelta] and [Streamer.AllocPeer].
+package largetailnet
+
+import (
+	"context"
+	cryptorand "crypto/rand"
+	"fmt"
+	"net/netip"
+	"sync/atomic"
+	"time"
+
+	"go4.org/mem"
+	"tailscale.com/net/tsaddr"
+	"tailscale.com/tailcfg"
+	"tailscale.com/tstest/integration/testcontrol"
+	"tailscale.com/types/key"
+)
+
+// SelfUserID is the synthetic [tailcfg.UserID] assigned to the self node and
+// to every initial peer produced by [Streamer]. Tests that build their own
+// peers via [MakePeer] should pass this value.
+const SelfUserID tailcfg.UserID = 1_000_000
+
+// Streamer drives a controlled MapResponse stream to a single client via
+// [testcontrol.Server.AltMapStream]. It synthesizes an initial netmap with N
+// peers and forwards caller-supplied delta MapResponses on the same stream.
+//
+// A Streamer is single-shot: it expects exactly one map long-poll over its
+// lifetime and is not safe for re-use across multiple clients.
+type Streamer struct {
+	n       int
+	derpMap *tailcfg.DERPMap
+
+	started     chan struct{} // closed when the alt-map-stream callback first fires
+	initialDone chan struct{} // closed after initial MapResponse has been written
+	deltas      chan *tailcfg.MapResponse
+
+	// nextID is the next free node ID. It starts at N+2 (1 is the self
+	// node, 2..N+1 are the initial peers) and is bumped by AllocPeer.
+	nextID atomic.Int64
+}
+
+// New constructs a Streamer that will produce an initial netmap with n peers
+// and a self node when its AltMapStream callback first fires. derpMap is
+// included verbatim in the initial MapResponse.
+func New(n int, derpMap *tailcfg.DERPMap) *Streamer {
+	s := &Streamer{
+		n:           n,
+		derpMap:     derpMap,
+		started:     make(chan struct{}),
+		initialDone: make(chan struct{}),
+		// Buffered so a benchmark loop body that does send-then-wait
+		// doesn't block on the channel under steady state.
+		deltas: make(chan *tailcfg.MapResponse, 64),
+	}
+	s.nextID.Store(int64(n) + 2)
+	return s
+}
+
+// AltMapStream returns a callback suitable for [testcontrol.Server.AltMapStream].
+// On the first streaming long-poll it sends the initial big MapResponse and
+// then forwards deltas enqueued via [Streamer.SendDelta] until ctx is done.
+// Non-streaming "lite" polls are answered with an empty MapResponse so they
+// complete quickly. The streamer is single-shot: any later streaming polls
+// are kept alive but produce no further messages.
+func (s *Streamer) AltMapStream() testcontrol.AltMapStreamFunc {
+	return func(ctx context.Context, w testcontrol.MapStreamWriter, req *tailcfg.MapRequest) {
+		if !req.Stream {
+			_ = w.SendMapMessage(&tailcfg.MapResponse{})
+			return
+		}
+
+		select {
+		case <-s.started:
+			// Re-poll after the original stream ended. Keep the
+			// connection alive so the client doesn't churn.
+			<-ctx.Done()
+			return
+		default:
+			close(s.started)
+		}
+
+		if err := s.sendInitial(w, req); err != nil {
+			// Make the failure loud rather than wedging the
+			// caller's [tsnet.Server.Up] on a silent retry loop.
+			panic(fmt.Sprintf("largetailnet: sendInitial: %v", err))
+		}
+		close(s.initialDone)
+
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case mr := <-s.deltas:
+				if err := w.SendMapMessage(mr); err != nil {
+					<-ctx.Done()
+					return
+				}
+			}
+		}
+	}
+}
+
+// AwaitInitialSent blocks until the initial big MapResponse has been written
+// to the wire. Note this is not the same as "the client has finished
+// processing it"; for that, callers should rely on [tsnet.Server.Up]
+// returning, or watch the IPN bus.
+func (s *Streamer) AwaitInitialSent(ctx context.Context) error {
+	select {
+	case <-ctx.Done():
+		return ctx.Err()
+	case <-s.initialDone:
+		return nil
+	}
+}
+
+// SendDelta enqueues mr for delivery on the active MapResponse stream. It
+// blocks if the internal queue is full or the stream hasn't started yet.
+func (s *Streamer) SendDelta(ctx context.Context, mr *tailcfg.MapResponse) error {
+	select {
+	case <-ctx.Done():
+		return ctx.Err()
+	case s.deltas <- mr:
+		return nil
+	}
+}
+
+// AllocPeer returns a fresh synthetic peer node with a never-before-used
+// [tailcfg.NodeID]. It's intended for use in PeersChanged deltas.
+func (s *Streamer) AllocPeer() *tailcfg.Node {
+	return MakePeer(tailcfg.NodeID(s.nextID.Add(1)-1), SelfUserID)
+}
+
+// SelfNodeID returns the [tailcfg.NodeID] used for the self node in the
+// initial netmap.
+func (s *Streamer) SelfNodeID() tailcfg.NodeID { return 1 }
+
+// sendInitial writes the big initial MapResponse with s.n peers.
+func (s *Streamer) sendInitial(w testcontrol.MapStreamWriter, req *tailcfg.MapRequest) error {
+	selfNodeID := s.SelfNodeID()
+	selfIP4 := node4(selfNodeID)
+	selfIP6 := node6(selfNodeID)
+
+	peers := make([]*tailcfg.Node, 0, s.n)
+	for i := 0; i < s.n; i++ {
+		peers = append(peers, MakePeer(tailcfg.NodeID(i+2), SelfUserID))
+	}
+
+	now := time.Now().UTC()
+	selfNode := &tailcfg.Node{
+		ID:                selfNodeID,
+		StableID:          "largetailnet-self",
+		Name:              "self.largetailnet.ts.net.",
+		User:              SelfUserID,
+		Key:               req.NodeKey,
+		KeyExpiry:         now.Add(24 * time.Hour),
+		Machine:           randMachineKey(), // fake; client doesn't verify
+		DiscoKey:          req.DiscoKey,
+		MachineAuthorized: true,
+		Addresses:         []netip.Prefix{selfIP4, selfIP6},
+		AllowedIPs:        []netip.Prefix{selfIP4, selfIP6},
+		CapMap:            map[tailcfg.NodeCapability][]tailcfg.RawMessage{},
+	}
+
+	initial := &tailcfg.MapResponse{
+		KeepAlive: false,
+		Node:      selfNode,
+		DERPMap:   s.derpMap,
+		Peers:     peers,
+		PacketFilter: []tailcfg.FilterRule{{
+			// Accept-all filter so the client isn't logging packet-filter
+			// failures; this is a benchmark harness, not a security test.
+			SrcIPs:   []string{"*"},
+			DstPorts: []tailcfg.NetPortRange{{IP: "*", Ports: tailcfg.PortRangeAny}},
+		}},
+		DNSConfig: &tailcfg.DNSConfig{},
+		Domain:    "largetailnet.ts.net",
+		UserProfiles: []tailcfg.UserProfile{{
+			ID:          SelfUserID,
+			LoginName:   "largetailnet@example.com",
+			DisplayName: "largetailnet",
+		}},
+		ControlTime: &now,
+	}
+	return w.SendMapMessage(initial)
+}
+
+// MakePeer constructs a synthetic [tailcfg.Node] for the given NodeID and
+// UserID. The peer's node/disco/machine keys are derived from random bytes
+// via the *PublicFromRaw32 constructors rather than via key.New*().Public(),
+// which avoids the per-peer Curve25519 ScalarBaseMult and lets the harness
+// construct hundreds of thousands of peers in a few hundred milliseconds.
+// The client never crypto-validates these keys in the bench, so opaque
+// random bytes are sufficient.
+func MakePeer(nid tailcfg.NodeID, user tailcfg.UserID) *tailcfg.Node {
+	v4, v6 := node4(nid), node6(nid)
+	name := fmt.Sprintf("peer-%d", nid)
+	return &tailcfg.Node{
+		ID:                nid,
+		StableID:          tailcfg.StableNodeID(name),
+		Name:              name + ".largetailnet.ts.net.",
+		Key:               randNodeKey(),
+		MachineAuthorized: true,
+		DiscoKey:          randDiscoKey(),
+		Machine:           randMachineKey(),
+		Addresses:         []netip.Prefix{v4, v6},
+		AllowedIPs:        []netip.Prefix{v4, v6},
+		User:              user,
+		// Hostinfo must be non-nil: LocalBackend.populatePeerStatus
+		// dereferences it via HostinfoView.Hostname unconditionally.
+		Hostinfo: (&tailcfg.Hostinfo{Hostname: name}).View(),
+	}
+}
+
+func randNodeKey() key.NodePublic {
+	var b [32]byte
+	cryptorand.Read(b[:])
+	return key.NodePublicFromRaw32(mem.B(b[:]))
+}
+
+func randDiscoKey() key.DiscoPublic {
+	var b [32]byte
+	cryptorand.Read(b[:])
+	return key.DiscoPublicFromRaw32(mem.B(b[:]))
+}
+
+func randMachineKey() key.MachinePublic {
+	var b [32]byte
+	cryptorand.Read(b[:])
+	return key.MachinePublicFromRaw32(mem.B(b[:]))
+}
+
+func node4(nid tailcfg.NodeID) netip.Prefix {
+	return netip.PrefixFrom(
+		netip.AddrFrom4([4]byte{100, 100 + byte(nid>>16), byte(nid >> 8), byte(nid)}),
+		32)
+}
+
+func node6(nid tailcfg.NodeID) netip.Prefix {
+	a := tsaddr.TailscaleULARange().Addr().As16()
+	a[13] = byte(nid >> 16)
+	a[14] = byte(nid >> 8)
+	a[15] = byte(nid)
+	return netip.PrefixFrom(netip.AddrFrom16(a), 128)
+}
diff --git a/tstest/largetailnet/largetailnet_test.go b/tstest/largetailnet/largetailnet_test.go
new file mode 100644
index 000000000..b3bda6bc0
--- /dev/null
+++ b/tstest/largetailnet/largetailnet_test.go
@@ -0,0 +1,220 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package largetailnet_test
+
+import (
+	"context"
+	"flag"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"runtime"
+	"testing"
+	"time"
+
+	"tailscale.com/ipn/store/mem"
+	"tailscale.com/tailcfg"
+	"tailscale.com/tsnet"
+	"tailscale.com/tstest/integration"
+	"tailscale.com/tstest/integration/testcontrol"
+	"tailscale.com/tstest/largetailnet"
+	"tailscale.com/types/logger"
+)
+
+// tsnet.Server.Up handles the wait-for-ipn.Running step itself: it
+// subscribes to the IPN bus with NotifyInitialState and blocks until State
+// reaches ipn.Running, which by definition means a netmap has been applied.
+// We don't redo that work here.
+
+var (
+	flagActuallyTest = flag.Bool("actually-test-giant-tailnet", false,
+		"if set, run the BenchmarkGiantTailnet* benchmarks; otherwise they are skipped")
+	flagN = flag.Int("giant-tailnet-n", 250_000,
+		"size of the initial netmap (peer count) for BenchmarkGiantTailnet*")
+	flagBenchVerbose = flag.Bool("giant-tailnet-verbose", false,
+		"if set, log tsnet output and DERP setup to stderr")
+)
+
+// BenchmarkGiantTailnet measures the per-delta CPU cost of a tailnet client
+// processing peer-add/peer-remove deltas in steady state, with no IPN bus
+// subscribers attached. This represents the headless-tailscaled workload
+// (Linux subnet routers, container sidecars, ...) where the LocalBackend
+// does not pay for fanning Notify events out to GUI watchers.
+//
+// Use [BenchmarkGiantTailnetBusWatcher] for the GUI-client workload.
+//
+// The benchmark is opt-in via --actually-test-giant-tailnet.
+func BenchmarkGiantTailnet(b *testing.B) {
+	if !*flagActuallyTest {
+		b.Skip("set --actually-test-giant-tailnet to run this benchmark")
+	}
+	benchGiantTailnet(b, false)
+}
+
+// BenchmarkGiantTailnetBusWatcher is like [BenchmarkGiantTailnet] but
+// attaches one [local.Client.WatchIPNBus] subscriber for the duration of the
+// benchmark. The Notify-fan-out cost (per-watcher encoding done on every
+// full-rebuild path) is therefore included in the per-delta measurement,
+// which approximates the GUI-client workload.
+//
+// The benchmark is opt-in via --actually-test-giant-tailnet.
+func BenchmarkGiantTailnetBusWatcher(b *testing.B) {
+	if !*flagActuallyTest {
+		b.Skip("set --actually-test-giant-tailnet to run this benchmark")
+	}
+	benchGiantTailnet(b, true)
+}
+
+// benchGiantTailnet is the shared body of the BenchmarkGiantTailnet*
+// benchmarks. Setup is entirely in-process: a [testcontrol.Server] hosts
+// the control plane, a [tsnet.Server] hosts the client, and a
+// [largetailnet.Streamer] hijacks the map long-poll to drive an exact
+// MapResponse sequence.
+//
+// Each loop iteration sends one [tailcfg.MapResponse] with PeersChanged
+// (a fresh peer) and PeersRemoved (the previous fresh peer), then waits
+// for the client to apply it. Net peer count stays at flagN throughout the
+// loop.
+//
+// The wait mechanism differs by variant:
+//
+//   - busWatcher=false: block on a channel returned by
+//     [ipnlocal.forTest.AwaitNodeKey] (reached via
+//     [tsnet.TestHooks]). The channel is closed by LocalBackend the moment
+//     the just-added peer's key appears in the netmap, so the wait has zero
+//     polling overhead.
+//   - busWatcher=true: drain Notify events from the bus subscription, since
+//     a Notify firing is exactly the side-effect we want to amortize into
+//     the per-delta measurement.
+//
+// Recommended invocation for profiling on unmodified main:
+//
+//	go test ./tstest/largetailnet/ -run=^$ \
+//	    -bench='BenchmarkGiantTailnet(BusWatcher)?$' \
+//	    -benchtime=2000x -timeout=10m \
+//	    --actually-test-giant-tailnet \
+//	    --giant-tailnet-n=250000 \
+//	    -cpuprofile=/tmp/giant.cpu.pprof
+func benchGiantTailnet(b *testing.B, busWatcher bool) {
+	logf := logger.Discard
+	if *flagBenchVerbose {
+		logf = b.Logf
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Minute)
+	b.Cleanup(cancel)
+
+	derpMap := integration.RunDERPAndSTUN(b, logf, "127.0.0.1")
+
+	streamer := largetailnet.New(*flagN, derpMap)
+
+	ctrl := &testcontrol.Server{
+		DERPMap:      derpMap,
+		DNSConfig:    &tailcfg.DNSConfig{},
+		AltMapStream: streamer.AltMapStream(),
+		Logf:         logf,
+	}
+	ctrl.HTTPTestServer = httptest.NewUnstartedServer(ctrl)
+	ctrl.HTTPTestServer.Start()
+	b.Cleanup(ctrl.HTTPTestServer.Close)
+	controlURL := ctrl.HTTPTestServer.URL
+	b.Logf("testcontrol listening on %s", controlURL)
+
+	tmp := filepath.Join(b.TempDir(), "tsnet")
+	if err := os.MkdirAll(tmp, 0755); err != nil {
+		b.Fatal(err)
+	}
+
+	s := &tsnet.Server{
+		Dir:        tmp,
+		ControlURL: controlURL,
+		Hostname:   "largetailnet-bench",
+		Store:      new(mem.Store),
+		Ephemeral:  true,
+		Logf:       logf,
+	}
+	b.Cleanup(func() { s.Close() })
+
+	// tsnet.Server.Up blocks until the backend reaches Running, which
+	// requires the initial flagN-peer MapResponse to have been processed.
+	upStart := time.Now()
+	if _, err := s.Up(ctx); err != nil {
+		b.Fatalf("tsnet.Server.Up: %v", err)
+	}
+	b.Logf("initial %d-peer netmap processed in %v", *flagN, time.Since(upStart))
+
+	lc, err := s.LocalClient()
+	if err != nil {
+		b.Fatalf("LocalClient: %v", err)
+	}
+	lb := tsnet.TestHooks.LocalBackend(s)
+
+	var notifyCh chan struct{}
+	if busWatcher {
+		bw, err := lc.WatchIPNBus(ctx, 0)
+		if err != nil {
+			b.Fatalf("WatchIPNBus: %v", err)
+		}
+		b.Cleanup(func() { bw.Close() })
+		notifyCh = make(chan struct{}, 1024)
+		go func() {
+			for {
+				if _, err := bw.Next(); err != nil {
+					return
+				}
+				// Any notify counts as a per-delta ack: peer add/remove
+				// in the delta path emits Notify.PeersChanged /
+				// Notify.PeersRemoved, peer patches emit
+				// Notify.PeerChanges, and self-node updates emit
+				// Notify.SelfChange.
+				select {
+				case notifyCh <- struct{}{}:
+				default:
+				}
+			}
+		}()
+	}
+
+	var prevAdded *tailcfg.Node
+	runtime.GC()
+
+	b.ResetTimer()
+	for b.Loop() {
+		added := streamer.AllocPeer()
+		mr := &tailcfg.MapResponse{
+			PeersChanged: []*tailcfg.Node{added},
+		}
+		if prevAdded != nil {
+			mr.PeersRemoved = []tailcfg.NodeID{prevAdded.ID}
+		}
+		prevAdded = added
+
+		if err := streamer.SendDelta(ctx, mr); err != nil {
+			b.Fatalf("SendDelta: %v", err)
+		}
+
+		if busWatcher {
+			// A Notify firing is itself part of the workload we
+			// want to measure on this variant.
+			select {
+			case <-notifyCh:
+			case <-time.After(10 * time.Second):
+				b.Fatal("timed out waiting for notify")
+			case <-ctx.Done():
+				b.Fatalf("ctx done waiting for notify: %v", ctx.Err())
+			}
+		} else {
+			// Block on the LocalBackend's test-only signal that
+			// the just-added peer key has landed in the netmap.
+			// No polling, no notify fan-out cost.
+			select {
+			case <-lb.ForTest().AwaitNodeKey(added.Key):
+			case <-time.After(10 * time.Second):
+				b.Fatalf("timed out waiting for node key %v", added.Key)
+			case <-ctx.Done():
+				b.Fatalf("ctx done waiting for node key: %v", ctx.Err())
+			}
+		}
+	}
+}
diff --git a/tstest/log.go b/tstest/log.go
index 73e973d23..3b271a166 100644
--- a/tstest/log.go
+++ b/tstest/log.go
@@ -9,7 +9,6 @@ import (
 	"log"
 	"os"
 	"sync"
-	"testing"
 
 	"go4.org/mem"
 	"tailscale.com/types/logger"
@@ -17,7 +16,7 @@ import (
 )
 
 type testLogWriter struct {
-	t *testing.T
+	t testenv.TB
 }
 
 func (w *testLogWriter) Write(b []byte) (int, error) {
@@ -26,12 +25,12 @@ func (w *testLogWriter) Write(b []byte) (int, error) {
 	return len(b), nil
 }
 
-func FixLogs(t *testing.T) {
+func FixLogs(t testenv.TB) {
 	log.SetFlags(log.Ltime | log.Lshortfile)
 	log.SetOutput(&testLogWriter{t})
 }
 
-func UnfixLogs(t *testing.T) {
+func UnfixLogs(t testenv.TB) {
 	defer log.SetOutput(os.Stderr)
 }
 
diff --git a/tstest/natlab/vmtest/acme_test.go b/tstest/natlab/vmtest/acme_test.go
new file mode 100644
index 000000000..3fe6094f7
--- /dev/null
+++ b/tstest/natlab/vmtest/acme_test.go
@@ -0,0 +1,86 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package vmtest_test
+
+import (
+	"encoding/base64"
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/creachadair/mds/shell"
+	"tailscale.com/tstest/natlab/vmtest"
+	"tailscale.com/tstest/natlab/vnet"
+)
+
+func TestACMECertServeHTTPS(t *testing.T) {
+	env := vmtest.New(t, vmtest.FakeACME())
+	issuer := ubuntuHard(env, "issuer")
+	client := ubuntuHard(env, "client")
+	env.Start()
+
+	st := env.Status(issuer)
+	if len(st.CertDomains) == 0 {
+		t.Fatalf("issuer has no CertDomains in status")
+	}
+	domain := st.CertDomains[0]
+
+	out, err := env.SSHExec(issuer, certAndWatchHealthCommand(domain))
+	if err != nil {
+		t.Fatalf("tailscale cert: %v\n%s", err, out)
+	}
+
+	out, err = env.SSHExec(issuer, "tailscale serve --bg --https=443 text:natlab-acme-ok")
+	if err != nil {
+		t.Fatalf("tailscale serve: %v\n%s", err, out)
+	}
+
+	rootB64 := base64.StdEncoding.EncodeToString(env.FakeACMERootPEM())
+	out, err = env.SSHExec(client, "printf %s "+shell.Quote(rootB64)+" | base64 -d >/tmp/fake-acme-root.pem")
+	if err != nil {
+		t.Fatalf("install fake ACME root: %v\n%s", err, out)
+	}
+	out, err = env.SSHExec(client, "curl --fail --silent --show-error --cacert /tmp/fake-acme-root.pem https://"+shell.Quote(domain)+"/")
+	if err != nil {
+		t.Fatalf("curl served HTTPS page: %v\n%s", err, out)
+	}
+	if strings.TrimSpace(out) != "natlab-acme-ok" {
+		t.Fatalf("curl body = %q, want %q", out, "natlab-acme-ok")
+	}
+}
+
+func ubuntuHard(env *vmtest.Env, name string) *vmtest.Node {
+	n := env.NumNodes()
+	return env.AddNode(name,
+		env.AddNetwork(
+			fmt.Sprintf("2.%d.%d.%d", n, n, n),
+			fmt.Sprintf("10.0.%d.1/24", n), vnet.HardNAT),
+		vmtest.OS(vmtest.Ubuntu2404))
+}
+
+func certAndWatchHealthCommand(domain string) string {
+	qdomain := shell.Quote(domain)
+	return fmt.Sprintf(`
+set -eu
+cd /tmp
+rm -f cert.out cert.status cert.done cert-health.out
+(set +e; tailscale cert %[1]s >cert.out 2>&1; echo $? >cert.status; touch cert.done) &
+certpid=$!
+for i in $(seq 1 60); do
+	if tailscale status --json | grep -F "Fetching TLS certificate" >cert-health.out; then
+		break
+	fi
+	if [ -e cert.done ]; then
+		break
+	fi
+	sleep 0.1
+done
+wait "$certpid" || true
+cat cert.out
+if [ "$(cat cert.status)" != "0" ]; then
+	exit "$(cat cert.status)"
+fi
+test -s cert-health.out
+`, qdomain)
+}
diff --git a/tstest/natlab/vmtest/assets/event.html b/tstest/natlab/vmtest/assets/event.html
new file mode 100644
index 000000000..a5f596673
--- /dev/null
+++ b/tstest/natlab/vmtest/assets/event.html
@@ -0,0 +1,45 @@
+{{if eq .Type "test_status"}}
+<span class="test-status test-{{.Message}}" id="test-status" hx-swap-oob="outerHTML">{{.Message}} ({{.Detail}})</span>
+{{end}}
+
+{{if eq .Type "step_changed"}}
+<div class="step step-{{.Step.Status}}" id="step-{{.Step.Index}}" hx-swap-oob="outerHTML">
+    <span class="step-icon">{{.Step.Status.Icon}}</span>
+    <span class="step-name">{{.Step.Name}}</span>
+    <span class="step-time">{{formatDuration .Step.Elapsed}}</span>
+</div>
+{{end}}
+
+{{if eq .Type "console_output"}}
+<div id="console-{{.NodeName}}" hx-swap-oob="beforeend">{{ansi .Message}}
+</div>
+{{end}}
+
+{{if eq .Type "dhcp_discover"}}
+<span id="dhcp-{{.NodeName}}-{{.NIC}}" hx-swap-oob="innerHTML">Discover sent</span>
+{{end}}
+
+{{if eq .Type "dhcp_offer"}}
+<span id="dhcp-{{.NodeName}}-{{.NIC}}" hx-swap-oob="innerHTML">Offered {{.Detail}}</span>
+{{end}}
+
+{{if eq .Type "dhcp_request"}}
+<span id="dhcp-{{.NodeName}}-{{.NIC}}" hx-swap-oob="innerHTML">Requesting {{.Detail}}</span>
+{{end}}
+
+{{if eq .Type "dhcp_ack"}}
+<span id="dhcp-{{.NodeName}}-{{.NIC}}" hx-swap-oob="innerHTML">Got {{.Detail}}</span>
+{{end}}
+
+{{if eq .Type "tailscale"}}
+<span id="ts-{{.NodeName}}" hx-swap-oob="innerHTML">{{.Detail}}</span>
+{{end}}
+
+{{if eq .Type "screenshot"}}
+<div id="screenshot-{{.NodeName}}" hx-swap-oob="innerHTML"><a href="/screenshot/{{.NodeName}}" target="_blank"><img src="data:image/jpeg;base64,{{.Message}}"></a></div>
+{{end}}
+
+{{if ne .Type "screenshot"}}
+<div id="events" hx-swap-oob="beforeend"><div class="event event-{{.Type}}"><span class="event-time">{{.Time.Format "15:04:05.000"}}</span> {{if .NodeName}}<span class="event-node">[{{.NodeName}}]</span> {{end}}<span class="event-msg">{{.Message}}</span>{{if .Detail}} <span class="event-detail">{{.Detail}}</span>{{end}}</div>
+</div>
+{{end}}
diff --git a/tstest/natlab/vmtest/assets/index.html b/tstest/natlab/vmtest/assets/index.html
new file mode 100644
index 000000000..044efffee
--- /dev/null
+++ b/tstest/natlab/vmtest/assets/index.html
@@ -0,0 +1,112 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <meta charset="utf-8">
+    <title>VMTest: {{.TestName}}</title>
+    <script src="https://unpkg.com/htmx.org@2.0.4"
+            integrity="sha384-HGfztofotfshcF7+8n44JQL2oJmowVChPTg48S+jvZoztPfvwD79OC/LTtG6dMp+"
+            crossorigin="anonymous"></script>
+    <script src="https://unpkg.com/htmx-ext-ws@2.0.2"
+            integrity="sha384-932iIqjARv+Gy0+r6RTGrfCkCKS5MsF539Iqf6Vt8L4YmbnnWI2DSFoMD90bvXd0"
+            crossorigin="anonymous"></script>
+    <link rel="stylesheet" href="style.css">
+</head>
+<body hx-ext="ws" ws-connect="ws">
+
+<h1>VMTest: {{.TestName}} <span class="test-status test-{{.TestStatus.State}}" id="test-status">{{.TestStatus.State}} ({{formatDuration .TestStatus.Elapsed}})</span></h1>
+
+<div class="steps">
+    <h2>Progress</h2>
+    {{range .Steps}}
+    <div class="step step-{{.Status}}" id="step-{{.Index}}">
+        <span class="step-icon">{{.Status.Icon}}</span>
+        <span class="step-name">{{.Name}}</span>
+        <span class="step-time">{{if ne .Status.String "pending"}}{{formatDuration .Elapsed}}{{end}}</span>
+    </div>
+    {{end}}
+</div>
+
+<div class="vm-grid">
+    {{range $node := .Nodes}}
+    <div class="vm-card" id="vm-{{$node.Name}}">
+        <div class="vm-header">
+            <span class="vm-name">{{$node.Name}}</span>
+            <span class="vm-os">{{$node.OS}}</span>
+        </div>
+        <div class="vm-status">
+            {{range $i, $nic := $node.NICs}}
+            <div class="vm-status-line">
+                <span class="vm-status-label">DHCP{{if gt (len $node.NICs) 1}} ({{$nic.NetName}}){{end}}:</span>
+                <span class="vm-status-value" id="dhcp-{{$node.Name}}-{{$i}}">{{$nic.DHCP}}</span>
+            </div>
+            {{end}}
+            {{if $node.JoinsTailnet}}
+            <div class="vm-status-line">
+                <span class="vm-status-label">Tailscale:</span>
+                <span class="vm-status-value" id="ts-{{$node.Name}}">{{$node.Tailscale}}</span>
+            </div>
+            {{end}}
+        </div>
+        <div class="screenshot" id="screenshot-{{$node.Name}}">{{if $node.Screenshot}}<a href="/screenshot/{{$node.Name}}" target="_blank"><img src="{{$node.Screenshot}}"></a>{{end}}</div>
+        <div class="console" id="console-{{$node.Name}}">{{range $node.Console}}{{ansi .}}
+{{end}}</div>
+    </div>
+    {{end}}
+</div>
+
+<div class="event-log">
+    <h2>Events</h2>
+    <div class="events" id="events"></div>
+</div>
+
+<script>
+// Tick the elapsed time on the test status badge while the test is running.
+(function() {
+    var startTime = {{.TestStatus.StartUnixMilli}};
+    var el = document.getElementById("test-status");
+    var timer = setInterval(function() {
+        if (!el || !el.classList.contains("test-Running")) {
+            clearInterval(timer);
+            return;
+        }
+        var elapsed = Date.now() - startTime;
+        var secs = elapsed / 1000;
+        var text;
+        if (secs < 1) {
+            text = Math.round(elapsed) + "ms";
+        } else {
+            text = secs.toFixed(1) + "s";
+        }
+        el.textContent = "Running (" + text + ")";
+    }, 100);
+})();
+
+// Auto-scroll console divs to bottom unless user has scrolled up.
+// Re-enable auto-scroll when user scrolls back to the bottom.
+(function() {
+    var consoles = document.querySelectorAll(".console");
+    consoles.forEach(function(el) {
+        el._autoScroll = true;
+        el.addEventListener("scroll", function() {
+            // At bottom if scrollTop + clientHeight >= scrollHeight - small threshold
+            var atBottom = el.scrollTop + el.clientHeight >= el.scrollHeight - 5;
+            el._autoScroll = atBottom;
+        });
+    });
+    // Use MutationObserver to detect when content is added to console divs.
+    var observer = new MutationObserver(function(mutations) {
+        mutations.forEach(function(m) {
+            var el = m.target;
+            if (el.classList && el.classList.contains("console") && el._autoScroll) {
+                el.scrollTop = el.scrollHeight;
+            }
+        });
+    });
+    consoles.forEach(function(el) {
+        observer.observe(el, { childList: true, characterData: true, subtree: true });
+    });
+})();
+</script>
+
+</body>
+</html>
diff --git a/tstest/natlab/vmtest/assets/style.css b/tstest/natlab/vmtest/assets/style.css
new file mode 100644
index 000000000..5970598b8
--- /dev/null
+++ b/tstest/natlab/vmtest/assets/style.css
@@ -0,0 +1,182 @@
+/* CSS reset */
+*, *::before, *::after { box-sizing: border-box; }
+* { margin: 0; }
+body {
+    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+    line-height: 1.5;
+    background: #1a1a2e;
+    color: #e0e0e0;
+    padding: 16px;
+}
+
+h1 {
+    font-size: 1.4em;
+    margin-bottom: 16px;
+    color: #fff;
+}
+
+.test-status {
+    font-size: 0.7em;
+    padding: 2px 10px;
+    border-radius: 4px;
+    font-weight: bold;
+    vertical-align: middle;
+}
+
+.test-Running { background: #2563eb; color: #fff; }
+.test-Passed { background: #16a34a; color: #fff; }
+.test-Failed { background: #dc2626; color: #fff; }
+
+h2 {
+    font-size: 1.1em;
+    margin-bottom: 8px;
+    color: #ccc;
+}
+
+/* Step progress panel */
+.steps {
+    background: #16213e;
+    border: 1px solid #333;
+    border-radius: 6px;
+    padding: 12px;
+    margin-bottom: 16px;
+}
+
+.step {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    padding: 4px 8px;
+    font-family: monospace;
+    font-size: 13px;
+    border-radius: 3px;
+}
+
+.step-pending { color: #666; }
+.step-running { color: #4af; font-weight: bold; background: rgba(68, 170, 255, 0.1); }
+.step-done { color: #4a4; }
+.step-failed { color: #f44; font-weight: bold; background: rgba(255, 68, 68, 0.1); }
+
+.step-icon { width: 1.2em; text-align: center; }
+.step-name { flex: 1; }
+.step-time { color: #666; font-size: 12px; min-width: 6em; text-align: right; }
+
+/* VM card grid */
+.vm-grid {
+    display: grid;
+    grid-template-columns: repeat(auto-fit, minmax(400px, 1fr));
+    gap: 12px;
+    margin-bottom: 16px;
+}
+
+.vm-card {
+    background: #16213e;
+    border: 1px solid #333;
+    border-radius: 6px;
+    padding: 12px;
+}
+
+.vm-header {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    margin-bottom: 8px;
+}
+
+.vm-name {
+    font-weight: bold;
+    font-size: 1.1em;
+    color: #fff;
+}
+
+.vm-os {
+    font-size: 0.8em;
+    background: #333;
+    padding: 1px 6px;
+    border-radius: 3px;
+    color: #aaa;
+}
+
+.vm-status {
+    display: flex;
+    flex-direction: column;
+    gap: 2px;
+    margin-bottom: 8px;
+    font-family: monospace;
+    font-size: 13px;
+}
+
+.vm-status-line {
+    display: flex;
+    gap: 8px;
+}
+
+.vm-status-label {
+    color: #888;
+    min-width: 7em;
+}
+
+.vm-status-value {
+    color: #4af;
+}
+
+/* VM display screenshot */
+.screenshot:empty { display: none; }
+.screenshot {
+    margin-bottom: 4px;
+}
+.screenshot img {
+    width: 100%;
+    height: auto;
+    display: block;
+    border-radius: 4px;
+    border: 1px solid #222;
+    cursor: pointer;
+}
+
+/* Console output */
+.console {
+    background: #0a0a0a;
+    color: #ccc;
+    font-family: "Cascadia Code", "Fira Code", "Consolas", monospace;
+    font-size: 11px;
+    line-height: 1.3;
+    max-height: 300px;
+    overflow-y: auto;
+    white-space: pre-wrap;
+    word-break: break-all;
+    padding: 8px;
+    border-radius: 4px;
+    border: 1px solid #222;
+}
+
+/* Event log */
+.event-log {
+    background: #16213e;
+    border: 1px solid #333;
+    border-radius: 6px;
+    padding: 12px;
+}
+
+.events {
+    max-height: 300px;
+    overflow-y: auto;
+}
+
+.event {
+    font-family: monospace;
+    font-size: 12px;
+    padding: 1px 0;
+    border-bottom: 1px solid #1a1a2e;
+}
+
+.event-time { color: #666; }
+.event-node { color: #4af; font-weight: bold; }
+.event-msg { color: #ccc; }
+.event-detail { color: #888; }
+
+.event-dhcp_discover .event-msg,
+.event-dhcp_request .event-msg { color: #fa4; }
+.event-dhcp_offer .event-msg,
+.event-dhcp_ack .event-msg { color: #4f4; }
+.event-step_changed .event-msg { color: #aaf; }
diff --git a/tstest/natlab/vmtest/cloudinit.go b/tstest/natlab/vmtest/cloudinit.go
index 334863f9c..eff228bba 100644
--- a/tstest/natlab/vmtest/cloudinit.go
+++ b/tstest/natlab/vmtest/cloudinit.go
@@ -4,12 +4,21 @@
 package vmtest
 
 import (
+	"crypto/ed25519"
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/pem"
 	"fmt"
 	"os"
 	"path/filepath"
+	"sort"
 	"strings"
+	"sync"
 
+	"github.com/creachadair/mds/shell"
 	"github.com/kdomanski/iso9660"
+	"golang.org/x/crypto/ssh"
+	"tailscale.com/tstest/natlab/vnet"
 )
 
 // createCloudInitISO creates a cidata seed ISO for the given cloud VM node.
@@ -18,6 +27,9 @@ import (
 // doesn't use netplan-style network-config; DHCP is enabled in rc.conf).
 func (e *Env) createCloudInitISO(n *Node) (string, error) {
 	metaData := fmt.Sprintf("instance-id: %s\nlocal-hostname: %s\n", n.name, n.name)
+	if err := ensureDebugSSHKey(); err != nil {
+		return "", err
+	}
 	userData := e.generateUserData(n)
 
 	files := map[string]string{
@@ -100,6 +112,10 @@ func (e *Env) generateLinuxUserData(n *Node) string {
 		ud.WriteString(fmt.Sprintf("    ssh_authorized_keys:\n      - %s\n", strings.TrimSpace(string(pubkey))))
 	}
 
+	if n.systemdUnit {
+		e.writeSystemdUnitFiles(&ud, n)
+	}
+
 	ud.WriteString("runcmd:\n")
 
 	// Remove the default route from the debug NIC (enp0s4) so traffic goes through vnet.
@@ -114,15 +130,38 @@ func (e *Env) generateLinuxUserData(n *Node) string {
 	}
 	ud.WriteString("  - [\"chmod\", \"+x\", \"/usr/local/bin/tailscaled\", \"/usr/local/bin/tailscale\", \"/usr/local/bin/tta\"]\n")
 
+	// Apply the bin_t label for SELinux enforcement: we curl the binaries in
+	// rather than installing a package, so nothing else labels them, and
+	// enforcing mode would deny exec. No-op on non-SELinux systems, but only
+	// RHEL-family images ship restorecon.
+	if n.os.Family == LinuxRHEL {
+		ud.WriteString("  - [\"/bin/sh\", \"-c\", \"restorecon -v /usr/local/bin/tailscaled /usr/local/bin/tailscale /usr/local/bin/tta 2>&1 || true\"]\n")
+	}
+
 	// Enable IP forwarding for subnet routers.
 	if n.advertiseRoutes != "" {
 		ud.WriteString("  - [\"sysctl\", \"-w\", \"net.ipv4.ip_forward=1\"]\n")
 		ud.WriteString("  - [\"sysctl\", \"-w\", \"net.ipv6.conf.all.forwarding=1\"]\n")
 	}
 
-	// Start tailscaled in the background.
-	ud.WriteString("  - [\"/bin/sh\", \"-c\", \"/usr/local/bin/tailscaled --state=mem: &\"]\n")
-	ud.WriteString("  - [\"sleep\", \"2\"]\n")
+	// Provision the requested DNS backend before tailscaled starts.
+	writeLinuxDNSModeSetup(&ud, n.dnsMode)
+
+	// Start tailscaled, either via the stock systemd unit or directly in
+	// the background. --statedir provides a VarRoot so features like
+	// Taildrop (which needs a place to stash incoming files) have a
+	// directory to work with.
+	if n.systemdUnit {
+		// The unit's ExecStart runs /usr/sbin/tailscaled.
+		ud.WriteString("  - [\"cp\", \"/usr/local/bin/tailscaled\", \"/usr/sbin/tailscaled\"]\n")
+		ud.WriteString("  - [\"systemctl\", \"daemon-reload\"]\n")
+		// Type=notify makes this block until tailscaled reports readiness.
+		ud.WriteString("  - [\"systemctl\", \"start\", \"tailscaled.service\"]\n")
+	} else {
+		ud.WriteString("  - [\"mkdir\", \"-p\", \"/var/lib/tailscale\"]\n")
+		fmt.Fprintf(&ud, "  - [\"/bin/sh\", \"-c\", \"%s/usr/local/bin/tailscaled --state=mem: --statedir=/var/lib/tailscale &\"]\n", tailscaledEnvPrefix(n))
+		ud.WriteString("  - [\"sleep\", \"2\"]\n")
+	}
 
 	// Start tta (Tailscale Test Agent).
 	ud.WriteString("  - [\"/bin/sh\", \"-c\", \"/usr/local/bin/tta &\"]\n")
@@ -130,6 +169,30 @@ func (e *Env) generateLinuxUserData(n *Node) string {
 	return ud.String()
 }
 
+// writeLinuxDNSModeSetup appends cloud-init runcmd entries that provision the
+// guest so tailscaled selects the requested DNS backend. Must run before the
+// tailscaled launch entries. The zero value (DNSDefault) is a no-op. mode is
+// validated in AddNode, so any other unknown value is a bug and panics.
+func writeLinuxDNSModeSetup(ud *strings.Builder, mode DNSMode) {
+	switch mode {
+	default:
+		// AddNode validates the mode, so an unknown value here is a bug.
+		panic(fmt.Sprintf("unhandled DNSMode %q", mode))
+	case DNSDefault:
+		// The empty/zero value: leave the image's DNS config alone, so
+		// systemd-resolved stays enabled and tailscaled selects it (or
+		// whatever the image runs by default). No-op.
+	case DNSDirect:
+		// Mask systemd-resolved and drop a plain resolv.conf so dnsMode() in
+		// net/dns/manager_linux.go falls through to "direct". Point it at
+		// natlab's fake DNS VIP (not a public resolver): it's the only resolver
+		// reachable in vnet and it serves the internal *.tailscale names.
+		fmt.Fprintf(ud, "  - [\"/bin/sh\", \"-c\", \"systemctl disable --now systemd-resolved 2>/dev/null || true\"]\n")
+		fmt.Fprintf(ud, "  - [\"/bin/sh\", \"-c\", \"systemctl mask systemd-resolved 2>/dev/null || true\"]\n")
+		fmt.Fprintf(ud, "  - [\"/bin/sh\", \"-c\", \"rm -f /etc/resolv.conf && printf 'nameserver %s\\\\n' >/etc/resolv.conf\"]\n", vnet.FakeDNSIPv4())
+	}
+}
+
 // generateFreeBSDUserData creates FreeBSD nuageinit user-data (#cloud-config)
 // for a node. FreeBSD's nuageinit supports a subset of cloud-init directives
 // including runcmd, which runs after networking is up.
@@ -144,6 +207,15 @@ func (e *Env) generateFreeBSDUserData(n *Node) string {
 
 	ud.WriteString("runcmd:\n")
 
+	// Enable root SSH login for debugging via the debug NIC.
+	ud.WriteString("  - \"echo 'PermitRootLogin yes' >>/etc/ssh/sshd_config\"\n")
+	ud.WriteString("  - \"echo 'PubkeyAuthentication yes' >>/etc/ssh/sshd_config\"\n")
+	// Also inject the host's SSH key if available.
+	if pubkey, err := os.ReadFile("/tmp/vmtest_key.pub"); err == nil {
+		ud.WriteString("  - \"mkdir -p /root/.ssh && chmod 700 /root/.ssh\"\n")
+		fmt.Fprintf(&ud, "  - \"echo '%s' >/root/.ssh/authorized_keys && chmod 600 /root/.ssh/authorized_keys\"\n", strings.TrimSpace(string(pubkey)))
+	}
+
 	// /usr/local/bin may not exist on a fresh FreeBSD cloud image (it's
 	// created when the first package is installed).
 	ud.WriteString("  - \"mkdir -p /usr/local/bin\"\n")
@@ -152,6 +224,20 @@ func (e *Env) generateFreeBSDUserData(n *Node) string {
 	// traffic goes through the vnet NICs. The debug NIC is only for SSH.
 	ud.WriteString("  - \"route delete default 10.0.2.2 2>/dev/null || true\"\n")
 
+	// Grow the TCP socket buffer limits before the binary downloads
+	// below. FreeBSD's defaults start receive windows at 64 kB and
+	// autoscale in slow 16 kB steps, which caps a transfer at roughly
+	// 64kB per round trip. On an oversubscribed CI runner, where
+	// scheduling delay inflates the effective RTT of the userspace vnet
+	// data path to tens or hundreds of milliseconds, that works out to
+	// a few hundred kB/s and made the multi-megabyte binary fetches (and
+	// so the whole test) time out.
+	ud.WriteString("  - \"sysctl kern.ipc.maxsockbuf=16777216\"\n")
+	ud.WriteString("  - \"sysctl net.inet.tcp.recvspace=4194304\"\n")
+	ud.WriteString("  - \"sysctl net.inet.tcp.sendspace=1048576\"\n")
+	ud.WriteString("  - \"sysctl net.inet.tcp.recvbuf_max=16777216\"\n")
+	ud.WriteString("  - \"sysctl net.inet.tcp.sendbuf_max=16777216\"\n")
+
 	// Download binaries from the files.tailscale VIP (52.52.0.6).
 	// FreeBSD's fetch(1) is part of the base system (no curl needed).
 	// Retry in a loop since the file server may not be ready immediately.
@@ -170,14 +256,108 @@ func (e *Env) generateFreeBSDUserData(n *Node) string {
 		ud.WriteString("  - \"sysctl net.inet6.ip6.forwarding=1\"\n")
 	}
 
-	// Start tailscaled and tta in the background.
-	// Set PATH to include /usr/local/bin so that tta can find "tailscale"
-	// (TTA uses exec.Command("tailscale", ...) without a full path).
-	ud.WriteString("  - \"export PATH=/usr/local/bin:$PATH && /usr/local/bin/tailscaled --state=mem: &\"\n")
+	// Start tailscaled and tta in the background. Redirect stdio to log
+	// files and away from /dev/null on stdin; otherwise nuageinit's runcmd
+	// executor keeps the backgrounded child's stdout/stderr pipes open and
+	// blocks waiting for them, so subsequent runcmd entries (including the
+	// tta launch below) never run. Linux cloud-init doesn't have this
+	// gotcha. Set PATH to include /usr/local/bin so that tta can find
+	// "tailscale" (TTA uses exec.Command("tailscale", ...) without a full
+	// path). --statedir provides a VarRoot so features like Taildrop have a
+	// directory.
+	ud.WriteString("  - \"mkdir -p /var/lib/tailscale\"\n")
+	fmt.Fprintf(&ud, "  - \"export PATH=/usr/local/bin:$PATH && %s/usr/local/bin/tailscaled --state=mem: --statedir=/var/lib/tailscale </dev/null >/var/log/tailscaled.log 2>&1 &\"\n", tailscaledEnvPrefix(n))
 	ud.WriteString("  - \"sleep 2\"\n")
 
-	// Start tta (Tailscale Test Agent).
-	ud.WriteString("  - \"export PATH=/usr/local/bin:$PATH && /usr/local/bin/tta &\"\n")
+	// Start tta (Tailscale Test Agent), with the same stdio redirection.
+	ud.WriteString("  - \"export PATH=/usr/local/bin:$PATH && /usr/local/bin/tta </dev/null >/var/log/tta.log 2>&1 &\"\n")
 
 	return ud.String()
 }
+
+// writeSystemdUnitFiles appends a cloud-init write_files section that
+// installs the stock tailscaled systemd unit from the source tree, along
+// with the packaging's /etc/default/tailscaled EnvironmentFile (plus any
+// per-node TailscaledEnv variables). File contents are base64-encoded to
+// sidestep YAML quoting.
+func (e *Env) writeSystemdUnitFiles(ud *strings.Builder, n *Node) {
+	modRoot, err := findModRoot()
+	if err != nil {
+		e.t.Fatalf("finding module root for tailscaled.service: %v", err)
+	}
+	unit, err := os.ReadFile(filepath.Join(modRoot, "cmd/tailscaled/tailscaled.service"))
+	if err != nil {
+		e.t.Fatalf("reading tailscaled.service: %v", err)
+	}
+	defaults, err := os.ReadFile(filepath.Join(modRoot, "cmd/tailscaled/tailscaled.defaults"))
+	if err != nil {
+		e.t.Fatalf("reading tailscaled.defaults: %v", err)
+	}
+	var envFile strings.Builder
+	envFile.Write(defaults)
+	for _, env := range n.vnetNode.Env() {
+		fmt.Fprintf(&envFile, "%s=%q\n", env.Key, env.Value)
+	}
+
+	ud.WriteString("write_files:\n")
+	writeFile := func(path string, content []byte) {
+		fmt.Fprintf(ud, "  - path: %s\n", path)
+		fmt.Fprintf(ud, "    encoding: b64\n")
+		fmt.Fprintf(ud, "    content: %s\n", base64.StdEncoding.EncodeToString(content))
+	}
+	writeFile("/etc/systemd/system/tailscaled.service", unit)
+	writeFile("/etc/default/tailscaled", []byte(envFile.String()))
+}
+
+func tailscaledEnvPrefix(n *Node) string {
+	env := n.vnetNode.Env()
+	if len(env) == 0 {
+		return ""
+	}
+	parts := make([]string, 0, len(env))
+	for _, e := range env {
+		parts = append(parts, e.Key+"="+shell.Quote(e.Value))
+	}
+	sort.Strings(parts)
+	return strings.Join(parts, " ") + " "
+}
+
+// debugSSHKeyMu serializes ensureDebugSSHKey calls. Env.Start boots all
+// nodes in parallel and each calls createCloudInitISO -> ensureDebugSSHKey,
+// which would otherwise race on creating /tmp/vmtest_key: one goroutine
+// can observe a newly-created-but-still-empty key file written by another
+// and fail to parse it.
+var debugSSHKeyMu sync.Mutex
+
+func ensureDebugSSHKey() error {
+	debugSSHKeyMu.Lock()
+	defer debugSSHKeyMu.Unlock()
+	const keyPath = "/tmp/vmtest_key"
+	if privPEM, err := os.ReadFile(keyPath); err == nil {
+		if _, err := os.Stat(keyPath + ".pub"); err == nil {
+			return nil
+		}
+		signer, err := ssh.ParsePrivateKey(privPEM)
+		if err != nil {
+			return fmt.Errorf("parse %s: %w", keyPath, err)
+		}
+		return os.WriteFile(keyPath+".pub", ssh.MarshalAuthorizedKey(signer.PublicKey()), 0644)
+	}
+
+	pub, priv, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		return err
+	}
+	block, err := ssh.MarshalPrivateKey(priv, "vmtest")
+	if err != nil {
+		return err
+	}
+	if err := os.WriteFile(keyPath, pem.EncodeToMemory(block), 0600); err != nil {
+		return err
+	}
+	sshPub, err := ssh.NewPublicKey(pub)
+	if err != nil {
+		return err
+	}
+	return os.WriteFile(keyPath+".pub", ssh.MarshalAuthorizedKey(sshPub), 0644)
+}
diff --git a/tstest/natlab/vmtest/cmd/natlabprep/natlabprep.go b/tstest/natlab/vmtest/cmd/natlabprep/natlabprep.go
new file mode 100644
index 000000000..d60b878e3
--- /dev/null
+++ b/tstest/natlab/vmtest/cmd/natlabprep/natlabprep.go
@@ -0,0 +1,24 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// The natlabprep tool warms the local natlab vmtest cache by downloading
+// every cloud VM image natlab can boot. It is intended for CI prep steps
+// so a subsequent test run does not pay the per-image download cost.
+package main
+
+import (
+	"context"
+	"log"
+
+	"tailscale.com/tstest/natlab/vmtest"
+)
+
+func main() {
+	ctx := context.Background()
+	for _, img := range vmtest.CloudImages() {
+		log.Printf("ensuring %s ...", img.Name)
+		if err := vmtest.EnsureImage(ctx, img); err != nil {
+			log.Fatalf("ensuring %s: %v", img.Name, err)
+		}
+	}
+}
diff --git a/tstest/natlab/vmtest/connectivity.go b/tstest/natlab/vmtest/connectivity.go
new file mode 100644
index 000000000..60d6e0e36
--- /dev/null
+++ b/tstest/natlab/vmtest/connectivity.go
@@ -0,0 +1,30 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package vmtest
+
+import (
+	"fmt"
+	"time"
+)
+
+// AddNodeFunc is used to describe a func passed to [RunConnectivityTest].
+type AddNodeFunc func(*Env) *Node
+
+// RunConnectivityTest adds the specified nodes to the network and then
+// verifies that a Disco ping from n1 to n2 completes within 30 seconds.
+func (env *Env) RunConnectivityTest(name string, pingRoute PingRoute, n1, n2 AddNodeFunc) {
+	n1(env)
+	n2(env)
+
+	discoPingStep := env.AddStep(
+		fmt.Sprintf("[%s] Ping a → b Disco (want %s)", name, pingRoute))
+	env.Start()
+
+	discoPingStep.Begin()
+	if err := env.PingExpect(env.nodes[0], env.nodes[1], pingRoute, 30*time.Second); err != nil {
+		discoPingStep.End(err)
+		env.t.Error(err)
+	}
+	discoPingStep.End(nil)
+}
diff --git a/tstest/natlab/vmtest/connectivity_test.go b/tstest/natlab/vmtest/connectivity_test.go
new file mode 100644
index 000000000..8cbbfdc29
--- /dev/null
+++ b/tstest/natlab/vmtest/connectivity_test.go
@@ -0,0 +1,249 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package vmtest_test
+
+import (
+	"fmt"
+	"testing"
+
+	"tailscale.com/tailcfg"
+	"tailscale.com/tstest/natlab/vmtest"
+	"tailscale.com/tstest/natlab/vnet"
+)
+
+func v6cidr(n int) string {
+	return fmt.Sprintf("2000:%d::1/64", n)
+}
+
+func easy(env *vmtest.Env) *vmtest.Node {
+	n := env.NumNodes()
+	return env.AddNode(fmt.Sprintf("node-%d", n),
+		env.AddNetwork(
+			fmt.Sprintf("2.%d.%d.%d", n, n, n), // public IP
+			fmt.Sprintf("192.168.%d.1/24", n), vnet.EasyNAT),
+		vmtest.OS(vmtest.Gokrazy))
+}
+
+func easyAnd6(env *vmtest.Env) *vmtest.Node {
+	n := env.NumNodes()
+	return env.AddNode(fmt.Sprintf("node-%d", n),
+		env.AddNetwork(
+			fmt.Sprintf("2.%d.%d.%d", n, n, n), // public IP
+			fmt.Sprintf("192.168.%d.1/24", n),
+			v6cidr(n),
+			vnet.EasyNAT),
+		vmtest.OS(vmtest.Gokrazy))
+}
+
+// easyNoControlDiscoRotate sets up a node with easy NAT, cuts traffic to
+// control after connecting, and then rotates the disco key to simulate a newly
+// started node (from a disco perspective).
+func easyNoControlDiscoRotate(env *vmtest.Env) *vmtest.Node {
+	n := env.NumNodes()
+	nw := env.AddNetwork(
+		fmt.Sprintf("2.%d.%d.%d", n, n, n), // public IP
+		fmt.Sprintf("192.168.%d.1/24", n),
+		vnet.EasyNAT)
+	nw.SetPostConnectControlBlackhole(true)
+	return env.AddNode(fmt.Sprintf("node-%d", n),
+		vnet.TailscaledEnv{Key: "TS_USE_CACHED_NETMAP", Value: "true"},
+		vnet.RotateDisco, vnet.PreICMPPing,
+		nw,
+		vmtest.OS(vmtest.Gokrazy))
+}
+
+// easyFW is easy + host firewall.
+func easyFW(env *vmtest.Env) *vmtest.Node {
+	n := env.NumNodes()
+	return env.AddNode(fmt.Sprintf("node-%d", n),
+		vnet.HostFirewall,
+		env.AddNetwork(
+			fmt.Sprintf("2.%d.%d.%d", n, n, n), // public IP
+			fmt.Sprintf("192.168.%d.1/24", n), vnet.EasyNAT),
+		vmtest.OS(vmtest.Gokrazy))
+}
+
+// easyPMPFWPlusBPF is easy + port mapping + host firewall + BPF.
+func easyPMPFWPlusBPF(env *vmtest.Env) *vmtest.Node {
+	n := env.NumNodes()
+	return env.AddNode(fmt.Sprintf("node-%d", n),
+		vnet.HostFirewall,
+		vnet.TailscaledEnv{Key: "TS_ENABLE_RAW_DISCO", Value: "true"},
+		vnet.TailscaledEnv{Key: "TS_DEBUG_RAW_DISCO", Value: "1"},
+		vnet.TailscaledEnv{Key: "TS_DEBUG_DISCO", Value: "1"},
+		vnet.TailscaledEnv{Key: "TS_LOG_VERBOSITY", Value: "2"},
+		env.AddNetwork(
+			fmt.Sprintf("2.%d.%d.%d", n, n, n), // public IP
+			fmt.Sprintf("192.168.%d.1/24", n), vnet.EasyNAT, vnet.NATPMP),
+		vmtest.OS(vmtest.Gokrazy))
+}
+
+// easyPMPFWNoBPF is easy + port mapping + host firewall - BPF.
+func easyPMPFWNoBPF(env *vmtest.Env) *vmtest.Node {
+	n := env.NumNodes()
+	return env.AddNode(fmt.Sprintf("node-%d", n),
+		vnet.HostFirewall,
+		vnet.TailscaledEnv{Key: "TS_ENABLE_RAW_DISCO", Value: "false"},
+		env.AddNetwork(
+			fmt.Sprintf("2.%d.%d.%d", n, n, n), // public IP
+			fmt.Sprintf("192.168.%d.1/24", n), vnet.EasyNAT, vnet.NATPMP),
+		vmtest.OS(vmtest.Gokrazy))
+}
+
+func hard(env *vmtest.Env) *vmtest.Node {
+	n := env.NumNodes()
+	return env.AddNode(fmt.Sprintf("node-%d", n),
+		env.AddNetwork(
+			fmt.Sprintf("2.%d.%d.%d", n, n, n), // public IP
+			fmt.Sprintf("10.0.%d.1/24", n), vnet.HardNAT),
+		vmtest.OS(vmtest.Gokrazy))
+}
+
+func hardNoDERPOrEndpoints(env *vmtest.Env) *vmtest.Node {
+	n := env.NumNodes()
+	return env.AddNode(fmt.Sprintf("node-%d", n),
+		env.AddNetwork(
+			fmt.Sprintf("2.%d.%d.%d", n, n, n), // public IP
+			fmt.Sprintf("10.0.%d.1/24", n), vnet.HardNAT),
+		vnet.TailscaledEnv{Key: "TS_DEBUG_STRIP_ENDPOINTS", Value: "1"},
+		vnet.TailscaledEnv{Key: "TS_DEBUG_STRIP_HOME_DERP", Value: "1"},
+		vmtest.OS(vmtest.Gokrazy))
+}
+
+func just6(env *vmtest.Env) *vmtest.Node {
+	n := env.NumNodes()
+	return env.AddNode(fmt.Sprintf("node-%d", n),
+		env.AddNetwork(v6cidr(n)), // public IPv6 prefix
+		vmtest.OS(vmtest.Gokrazy))
+}
+
+func v6AndBlackholedIPv4(env *vmtest.Env) *vmtest.Node {
+	n := env.NumNodes()
+	nw := env.AddNetwork(
+		fmt.Sprintf("2.%d.%d.%d", n, n, n),
+		fmt.Sprintf("192.168.%d.1/24", n),
+		v6cidr(n),
+		vnet.EasyNAT)
+	nw.SetBlackholedIPv4(true)
+	return env.AddNode(fmt.Sprintf("node-%d", n), nw, vmtest.OS(vmtest.Gokrazy))
+}
+
+func TestEasyEasy(t *testing.T) {
+	env := vmtest.New(t)
+	env.RunConnectivityTest(t.Name(), vmtest.PingRouteDirect, easy, easy)
+}
+
+// TestTwoEasyNoControlDiscoRotate tests a situation where two nodes have been
+// online and connected through control, but then lose control access and also
+// rotate keys. It is not a perfect proxy for a cached node, as the node will
+// still have a mapState and not use the backup method of inserting keys into
+// the engine directly.
+func TestTwoEasyNoControlDiscoRotate(t *testing.T) {
+	env := vmtest.New(t)
+	env.RunConnectivityTest(t.Name(), vmtest.PingRouteDirect, easyNoControlDiscoRotate, easyNoControlDiscoRotate)
+}
+
+func TestJustIPv6(t *testing.T) {
+	env := vmtest.New(t)
+	env.RunConnectivityTest(t.Name(), vmtest.PingRouteDirect, just6, just6)
+}
+
+func TestEasy4AndJust6(t *testing.T) {
+	env := vmtest.New(t)
+	env.RunConnectivityTest(t.Name(), vmtest.PingRouteDirect, easyAnd6, just6)
+}
+
+func TestSameLAN(t *testing.T) {
+	env := vmtest.New(t)
+	var sharedNW *vnet.Network
+	makeEasy := func(env *vmtest.Env) *vmtest.Node {
+		n := env.NumNodes()
+		sharedNW = env.AddNetwork(
+			fmt.Sprintf("2.%d.%d.%d", n, n, n), // public IP
+			fmt.Sprintf("192.168.%d.1/24", n), vnet.EasyNAT)
+		return env.AddNode(fmt.Sprintf("node-%d", n), sharedNW, vmtest.OS(vmtest.Gokrazy))
+	}
+	sameLAN := func(env *vmtest.Env) *vmtest.Node {
+		n := env.NumNodes()
+		return env.AddNode(fmt.Sprintf("node-%d", n), sharedNW, vmtest.OS(vmtest.Gokrazy))
+	}
+	env.RunConnectivityTest(t.Name(), vmtest.PingRouteLocal, makeEasy, sameLAN)
+}
+
+// TestBPFDisco tests https://github.com/tailscale/tailscale/issues/3824 ...
+// * server behind a Hard NAT
+// * client behind a NAT with UPnP support
+// * client machine has a stateful host firewall (e.g. ufw)
+func TestBPFDisco(t *testing.T) {
+	env := vmtest.New(t)
+	env.RunConnectivityTest(t.Name(), vmtest.PingRouteDirect, easyPMPFWPlusBPF, hard)
+}
+
+func TestHostFWNoBPF(t *testing.T) {
+	env := vmtest.New(t)
+	env.RunConnectivityTest(t.Name(), vmtest.PingRouteDERP, easyPMPFWNoBPF, hard)
+}
+
+func TestHostFWPair(t *testing.T) {
+	env := vmtest.New(t)
+	env.RunConnectivityTest(t.Name(), vmtest.PingRouteDirect, easyFW, easyFW)
+}
+
+func TestOneHostFW(t *testing.T) {
+	env := vmtest.New(t)
+	env.RunConnectivityTest(t.Name(), vmtest.PingRouteDirect, easy, easyFW)
+}
+
+// Issue tailscale/corp#26438: use learned DERP route as send path of last
+// resort
+//
+// See (*magicsock.Conn).fallbackDERPRegionForPeer and its comment for
+// background.
+//
+// This sets up a test with two nodes that must use DERP to communicate but the
+// target of the ping (the second node) additionally is not getting DERP or
+// Endpoint updates from the control plane. (Or rather, it's getting them but is
+// configured to scrub them right when they come off the network before being
+// processed) This then tests whether node2, upon receiving a packet, will be
+// able to reply to node1 since it knows neither node1's endpoints nor its home
+// DERP. The only reply route it can use is that fact that it just received a
+// packet over a particular DERP from that peer.
+func TestFallbackDERPRegionForPeer(t *testing.T) {
+	env := vmtest.New(t)
+	env.RunConnectivityTest(t.Name(), vmtest.PingRouteDERP, hard, hardNoDERPOrEndpoints)
+}
+
+// TestSingleJustIPv6 tests that a node can connect to control with just IPv6.
+// Since there is no connectivity testing needed, the test just asserts the
+// node coming up which will be asserted by env.Start().
+func TestSingleJustIPv6(t *testing.T) {
+	env := vmtest.New(t)
+	just6(env)
+	env.Start()
+}
+
+// TestSingleDualBrokenIPv4 tests a dual-stack node with broken
+// (blackholed) IPv4.
+func TestSingleDualBrokenIPv4(t *testing.T) {
+	env := vmtest.New(t)
+	v6AndBlackholedIPv4(env)
+	env.Start()
+}
+
+func TestNonTailscaleCGNATEndpoint(t *testing.T) {
+	env := vmtest.New(t)
+
+	cgnatNW := env.AddNetwork("100.65.1.1/16", "2.1.1.1", vnet.EasyNAT)
+	n0 := env.AddNode("node-0",
+		cgnatNW,
+		vmtest.DontJoinTailnet(),
+		vmtest.OS(vmtest.Gokrazy))
+	n1 := env.AddNode("node-1",
+		cgnatNW,
+		tailcfg.NodeCapMap{tailcfg.NodeAttrDisableLinuxCGNATDropRule: nil},
+		vmtest.OS(vmtest.Gokrazy))
+
+	env.Start()
+	env.LANPing(n1, n0.LanIP(cgnatNW))
+}
diff --git a/tstest/natlab/vmtest/dns_test.go b/tstest/natlab/vmtest/dns_test.go
new file mode 100644
index 000000000..50ad96b7d
--- /dev/null
+++ b/tstest/natlab/vmtest/dns_test.go
@@ -0,0 +1,165 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package vmtest_test
+
+import (
+	"fmt"
+	"net/netip"
+	"strings"
+	"testing"
+	"time"
+
+	"tailscale.com/tailcfg"
+	"tailscale.com/tstest"
+	"tailscale.com/tstest/natlab/vmtest"
+	"tailscale.com/tstest/natlab/vnet"
+	"tailscale.com/types/dnstype"
+	"tailscale.com/types/key"
+)
+
+// TestMagicDNS verifies that control-plane DNS config makes it all the
+// way into an Ubuntu guest's OS resolver, and that MagicDNS answers
+// track netmap changes. Booting a VM is expensive, so this one test
+// covers several scenarios in sequence:
+//
+//   - DNSConfig.ExtraRecords resolve via libc (getent), and search
+//     domains let bare names resolve, which requires tailscaled to
+//     have plumbed MagicDNS routes and search domains into
+//     systemd-resolved.
+//   - A peer added by control resolves by FQDN and by short name,
+//     and its IP reverse-resolves (PTR) to its name.
+//   - A peer renamed by control resolves under its new name only:
+//     the old name must stop resolving, and PTR must track the new
+//     name. When a node is renamed in the admin console, the control
+//     plane sends peers a single MapResponse delta: a PeersChanged
+//     entry containing the full updated Node with the new Name, and
+//     notably no new DNSConfig (MagicDNS records are computed
+//     client-side from peer names). This test injects deltas of
+//     exactly that shape. It reproduces tailscale/corp#45631, where
+//     a renamed node's old name kept resolving.
+//   - A peer removed by control stops resolving.
+func TestMagicDNS(t *testing.T) {
+	env := vmtest.New(t, vmtest.ControlDNS("tailnet.test", &tailcfg.DNSConfig{
+		Proxied: true,
+		Domains: []string{"tailnet.test", "record"},
+		Routes: map[string][]*dnstype.Resolver{
+			"tailnet.test": nil,
+			"record":       nil,
+		},
+		ExtraRecords: []tailcfg.DNSRecord{
+			{Name: "extratest.record", Type: "A", Value: "1.2.3.4"},
+		},
+	}))
+	node := env.AddNode("node",
+		env.AddNetwork("2.1.1.1", "192.168.1.1/24", vnet.EasyNAT),
+		vmtest.OS(vmtest.Ubuntu2404))
+	env.Start()
+
+	dt := &dnsTester{t: t, env: env, node: node}
+
+	// ExtraRecords, by full name and via the "record" search domain.
+	dt.wantResolves("extratest.record", "1.2.3.4")
+	dt.wantResolves("extratest", "1.2.3.4")
+
+	nodeKey := env.Status(node).Self.PublicKey
+	cs := env.ControlServer()
+
+	// Add a peer the way control does, as a PeersChanged delta
+	// carrying the full node.
+	peerAddr := netip.MustParsePrefix("100.64.7.7/32")
+	peer := &tailcfg.Node{
+		ID:                7777,
+		StableID:          "peer1renamed",
+		Name:              "renamee.tailnet.test.",
+		User:              7777,
+		Key:               key.NewNode().Public(),
+		Machine:           key.NewMachine().Public(),
+		DiscoKey:          key.NewDisco().Public(),
+		Addresses:         []netip.Prefix{peerAddr},
+		AllowedIPs:        []netip.Prefix{peerAddr},
+		Hostinfo:          (&tailcfg.Hostinfo{OS: "linux", Hostname: "renamee"}).View(),
+		Cap:               tailcfg.CurrentCapabilityVersion,
+		MachineAuthorized: true,
+	}
+	if !cs.AddRawMapResponse(nodeKey, &tailcfg.MapResponse{
+		PeersChanged: []*tailcfg.Node{peer},
+	}) {
+		t.Fatal("AddRawMapResponse(add peer): node not connected")
+	}
+	dt.wantResolves("renamee.tailnet.test", "100.64.7.7")
+	dt.wantResolves("renamee", "100.64.7.7") // via search domain
+	dt.wantResolves("100.64.7.7", "renamee.tailnet.test")
+
+	// Rename the peer, sending the same delta shape production
+	// control sends: the full node again with only the Name changed.
+	renamed := peer.Clone()
+	renamed.Name = "renamed.tailnet.test."
+	if !cs.AddRawMapResponse(nodeKey, &tailcfg.MapResponse{
+		PeersChanged: []*tailcfg.Node{renamed},
+	}) {
+		t.Fatal("AddRawMapResponse(rename peer): node not connected")
+	}
+	dt.wantResolves("renamed.tailnet.test", "100.64.7.7")
+	dt.wantResolves("renamed", "100.64.7.7")
+	dt.wantResolves("100.64.7.7", "renamed.tailnet.test")
+	dt.wantNXDOMAIN("renamee.tailnet.test")
+	dt.wantNXDOMAIN("renamee")
+
+	// Remove the peer; its name must stop resolving.
+	if !cs.AddRawMapResponse(nodeKey, &tailcfg.MapResponse{
+		PeersRemoved: []tailcfg.NodeID{peer.ID},
+	}) {
+		t.Fatal("AddRawMapResponse(remove peer): node not connected")
+	}
+	dt.wantNXDOMAIN("renamed.tailnet.test")
+}
+
+// dnsTester asserts DNS state in a guest via libc lookups (getent),
+// retrying for a bit because tailscaled applies netmap and DNS config
+// changes asynchronously.
+type dnsTester struct {
+	t    *testing.T
+	env  *vmtest.Env
+	node *vmtest.Node
+}
+
+// wantResolves waits until name resolves and its answer contains want.
+// With an IP address as name, getent does a reverse (PTR) lookup and
+// want is the expected hostname. It flushes systemd-resolved's cache
+// before each attempt so it tests tailscaled's resolver rather than a
+// previously cached answer.
+func (dt *dnsTester) wantResolves(name, want string) {
+	dt.t.Helper()
+	if err := tstest.WaitFor(30*time.Second, func() error {
+		dt.env.SSHExec(dt.node, "resolvectl flush-caches")
+		out, err := dt.env.SSHExec(dt.node, "getent hosts "+name)
+		if err != nil {
+			return fmt.Errorf("getent hosts %s: %v (%s)", name, err, strings.TrimSpace(out))
+		}
+		if !strings.Contains(out, want) {
+			return fmt.Errorf("getent hosts %s = %q, want it to contain %q", name, strings.TrimSpace(out), want)
+		}
+		return nil
+	}); err != nil {
+		out, _ := dt.env.SSHExec(dt.node, "resolvectl status; cat /etc/resolv.conf")
+		dt.t.Fatalf("%v\nresolver state:\n%s", err, out)
+	}
+}
+
+// wantNXDOMAIN waits until name no longer resolves. It flushes
+// systemd-resolved's cache before each attempt so it tests
+// tailscaled's resolver rather than a previously cached answer.
+func (dt *dnsTester) wantNXDOMAIN(name string) {
+	dt.t.Helper()
+	if err := tstest.WaitFor(30*time.Second, func() error {
+		dt.env.SSHExec(dt.node, "resolvectl flush-caches")
+		out, err := dt.env.SSHExec(dt.node, "getent hosts "+name)
+		if err == nil {
+			return fmt.Errorf("%s still resolves: %q", name, strings.TrimSpace(out))
+		}
+		return nil
+	}); err != nil {
+		dt.t.Fatal(err)
+	}
+}
diff --git a/tstest/natlab/vmtest/drive_test.go b/tstest/natlab/vmtest/drive_test.go
new file mode 100644
index 000000000..ba94b314e
--- /dev/null
+++ b/tstest/natlab/vmtest/drive_test.go
@@ -0,0 +1,225 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package vmtest_test
+
+import (
+	"fmt"
+	"net/url"
+	"regexp"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/creachadair/mds/shell"
+	"tailscale.com/tailcfg"
+	"tailscale.com/tstest"
+	"tailscale.com/tstest/natlab/vmtest"
+	"tailscale.com/tstest/natlab/vnet"
+)
+
+const (
+	driveShareName = "docs"
+	driveShareDir  = "/srv/taildrive-share"
+
+	driveASCIIName    = "hello.txt"
+	driveASCIIContent = "hello world"
+
+	// driveKanaNFC and driveKanaNFD are the same filename (テズト ä.wav) in
+	// NFC (precomposed) and NFD (decomposed) Unicode normalization forms,
+	// from tailscale/tailscale#15020. They are canonically equivalent but
+	// byte-wise different: in NFC, ズ is the single code point U+30BA and ä
+	// is U+00E4; in NFD they are ス U+30B9 plus the combining voiced sound
+	// mark U+3099, and "a" plus the combining diaeresis U+0308.
+	driveKanaNFC     = "\u30c6\u30ba\u30c8 \u00e4.wav"
+	driveKanaNFD     = "\u30c6\u30b9\u3099\u30c8 a\u0308.wav"
+	driveKanaContent = "kana content"
+)
+
+// TestTaildrive shares a directory from one node and accesses it from another
+// via the accessing node's local Taildrive WebDAV proxy at
+// 100.100.100.100:8080, first with a plain ASCII filename and then with
+// filenames whose Unicode normalization form differs between the request and
+// the on-disk name.
+//
+// The Unicode cases simulate a macOS WebDAV client, which requests paths in
+// NFD form, accessing a share on a Linux disk whose filenames are NFC bytes
+// (tailscale/tailscale#15020). Requesting a directory listing immediately
+// before the NFD PROPFIND also exercises the accessing node's StatCache,
+// which caches children under their NFC hrefs and previously inferred 404
+// for the NFD name without contacting the share host.
+func TestTaildrive(t *testing.T) {
+	env := vmtest.New(t, vmtest.AllOnline())
+
+	hostNet := env.AddNetwork("1.0.0.1", "192.168.1.1/24", vnet.EasyNAT)
+	clientNet := env.AddNetwork("2.0.0.1", "192.168.2.1/24", vnet.EasyNAT)
+
+	// Taildrive is disabled unless control sends these node attributes.
+	driveCaps := tailcfg.NodeCapMap{
+		tailcfg.NodeAttrsTaildriveShare:  nil,
+		tailcfg.NodeAttrsTaildriveAccess: nil,
+	}
+	host := env.AddNode("drivehost", hostNet,
+		vmtest.OS(vmtest.Ubuntu2404),
+		driveCaps)
+	client := env.AddNode("driveclient", clientNet,
+		vmtest.OS(vmtest.Ubuntu2404),
+		driveCaps)
+
+	// Declare test-specific steps for the web UI.
+	setupStep := env.AddStep("Create files and share on host")
+	waitStep := env.AddStep("Wait for share to be accessible from client")
+	asciiStep := env.AddStep("ASCII file access (client -> host)")
+	unicodeStep := env.AddStep("NFC/NFD normalization mismatch access")
+
+	env.Start()
+
+	// Access to a peer's shares additionally requires peer capabilities,
+	// normally granted via ACL grants. Grant every peer read/write access to
+	// every share, plus the sharer capability that makes share hosts show up
+	// in directory listings on accessing nodes.
+	env.ControlServer().SetGlobalAppCaps(tailcfg.PeerCapMap{
+		tailcfg.PeerCapabilityTaildrive:       {`{"shares":["*"],"access":"rw"}`},
+		tailcfg.PeerCapabilityTaildriveSharer: {`true`},
+	})
+
+	setupStep.Begin()
+	setupCmd := fmt.Sprintf("mkdir -p %s && printf %%s %s > %s && printf %%s %s > %s",
+		shell.Quote(driveShareDir),
+		shell.Quote(driveASCIIContent), shell.Quote(driveShareDir+"/"+driveASCIIName),
+		shell.Quote(driveKanaContent), shell.Quote(driveShareDir+"/"+driveKanaNFC))
+	if out, err := env.SSHExec(host, setupCmd); err != nil {
+		setupStep.Fatalf("share dir setup: %v\n%s", err, out)
+		return
+	}
+	if out, err := env.Tailscale(host, "drive", "share", driveShareName, driveShareDir); err != nil {
+		setupStep.Fatalf("tailscale drive share: %v\n%s", err, out)
+		return
+	}
+	setupStep.End(nil)
+
+	// Discover the tailnet domain (the top-level directory of the WebDAV
+	// tree) by listing the root, then wait until the host's share is
+	// reachable from the client. The peer capability grants pushed above
+	// take a map update to arrive at both nodes.
+	waitStep.Begin()
+	var shareBase string // /<domain>/drivehost/docs, percent-encoded
+	if err := tstest.WaitFor(2*time.Minute, func() error {
+		status, body, err := webdavCurl(env, client, "PROPFIND", "/", "-H", "Depth: 1")
+		if err != nil {
+			return err
+		}
+		if status != 207 {
+			return fmt.Errorf("PROPFIND /: status %d: %s", status, body)
+		}
+		domain := ""
+		for _, m := range hrefRegex.FindAllStringSubmatch(body, -1) {
+			if p := strings.Trim(m[1], "/"); p != "" {
+				domain = p
+				break
+			}
+		}
+		if domain == "" {
+			return fmt.Errorf("no domain in root listing: %s", body)
+		}
+		shareBase = "/" + domain + "/" + url.PathEscape(host.Name()) + "/" + url.PathEscape(driveShareName)
+		status, body, err = webdavCurl(env, client, "GET", shareBase+"/"+url.PathEscape(driveASCIIName))
+		if err != nil {
+			return err
+		}
+		if status != 200 {
+			return fmt.Errorf("GET %s: status %d: %s", driveASCIIName, status, body)
+		}
+		return nil
+	}); err != nil {
+		waitStep.Fatalf("share never became accessible: %v", err)
+		return
+	}
+	waitStep.End(nil)
+
+	asciiStep.Begin()
+	status, body, err := webdavCurl(env, client, "GET", shareBase+"/"+url.PathEscape(driveASCIIName))
+	if err != nil || status != 200 || body != driveASCIIContent {
+		asciiStep.Fatalf("GET %s = %d, %q, %v; want 200, %q", driveASCIIName, status, body, err, driveASCIIContent)
+		return
+	}
+	status, body, err = webdavCurl(env, client, "PROPFIND", shareBase+"/", "-H", "Depth: 1")
+	if err != nil || status != 207 || !strings.Contains(body, driveASCIIName) {
+		asciiStep.Fatalf("PROPFIND share = %d, %v; want 207 mentioning %s:\n%s", status, err, driveASCIIName, body)
+		return
+	}
+	asciiStep.End(nil)
+
+	unicodeStep.Begin()
+	// List the directory first. The response hrefs carry the NFC bytes from
+	// the host's disk, and the listing primes the client's StatCache, whose
+	// entries live for 10 seconds. The depth 0 PROPFIND for the NFD name
+	// that follows is answered from that cache, so it must treat the two
+	// forms as the same name.
+	status, body, err = webdavCurl(env, client, "PROPFIND", shareBase+"/", "-H", "Depth: 1")
+	if err != nil || status != 207 || !strings.Contains(body, url.PathEscape(driveKanaNFC)) {
+		unicodeStep.Fatalf("PROPFIND share = %d, %v; want 207 mentioning NFC name:\n%s", status, err, body)
+		return
+	}
+	nfdPath := shareBase + "/" + url.PathEscape(driveKanaNFD)
+	status, body, err = webdavCurl(env, client, "PROPFIND", nfdPath, "-H", "Depth: 0")
+	if err != nil || status != 207 {
+		unicodeStep.Fatalf("PROPFIND NFD name = %d, %v; want 207:\n%s", status, err, body)
+		return
+	}
+	status, body, err = webdavCurl(env, client, "GET", nfdPath)
+	if err != nil || status != 200 || body != driveKanaContent {
+		unicodeStep.Fatalf("GET NFD name = %d, %q, %v; want 200, %q", status, body, err, driveKanaContent)
+		return
+	}
+	// Overwriting via the NFD name must update the NFC file on the host's
+	// disk rather than creating a second file.
+	const updatedContent = "updated kana content"
+	status, body, err = webdavCurl(env, client, "PUT", nfdPath, "--data-binary", updatedContent)
+	if err != nil || status/100 != 2 {
+		unicodeStep.Fatalf("PUT NFD name = %d, %v; want 2xx:\n%s", status, err, body)
+		return
+	}
+	out, err := env.SSHExec(host, "cat "+shell.Quote(driveShareDir+"/"+driveKanaNFC))
+	if err != nil || out != updatedContent {
+		unicodeStep.Fatalf("host file after PUT = %q, %v; want %q", out, err, updatedContent)
+		return
+	}
+	out, err = env.SSHExec(host, "ls "+shell.Quote(driveShareDir)+" | wc -l")
+	if err != nil || strings.TrimSpace(out) != "2" {
+		unicodeStep.Fatalf("host share has %s files after PUT, %v; want 2", strings.TrimSpace(out), err)
+		return
+	}
+	unicodeStep.End(nil)
+}
+
+var hrefRegex = regexp.MustCompile(`<D:href>([^<]*)</D:href>`)
+
+// webdavCurl performs a WebDAV request from the given node against the
+// node's local Taildrive WebDAV proxy at 100.100.100.100:8080 by running
+// curl over the node's debug SSH connection. The path must already be
+// percent-encoded; extraArgs are passed to curl before the URL. It returns
+// the HTTP status code and the response body.
+func webdavCurl(env *vmtest.Env, n *vmtest.Node, method, path string, extraArgs ...string) (status int, body string, err error) {
+	cmd := "curl -s --max-time 15 -X " + shell.Quote(method)
+	for _, arg := range extraArgs {
+		cmd += " " + shell.Quote(arg)
+	}
+	// curl expands the \n itself, putting the status code on its own final
+	// line after the unmodified response body.
+	cmd += ` -w '\n%{http_code}' ` + shell.Quote("http://100.100.100.100:8080"+path)
+	out, err := env.SSHExec(n, cmd)
+	if err != nil {
+		return 0, "", fmt.Errorf("curl: %v\n%s", err, out)
+	}
+	i := strings.LastIndexByte(out, '\n')
+	if i == -1 {
+		return 0, "", fmt.Errorf("no status line in curl output: %q", out)
+	}
+	status, err = strconv.Atoi(strings.TrimSpace(out[i+1:]))
+	if err != nil {
+		return 0, "", fmt.Errorf("bad status line in curl output: %q", out)
+	}
+	return status, out[:i], nil
+}
diff --git a/tstest/natlab/vmtest/gokrazy_update_test.go b/tstest/natlab/vmtest/gokrazy_update_test.go
new file mode 100644
index 000000000..9743cbf3f
--- /dev/null
+++ b/tstest/natlab/vmtest/gokrazy_update_test.go
@@ -0,0 +1,118 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package vmtest_test
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"tailscale.com/tstest"
+	"tailscale.com/tstest/natlab/vmtest"
+	"tailscale.com/tstest/natlab/vnet"
+)
+
+// TestGokrazyUpdatesItselfToSameImage exercises the Gokrazy appliance update
+// path end-to-end in QEMU. It builds a GAF for the same natlab image, serves it
+// from the vnet fileserver, asks the guest to install it to the inactive
+// partition, then verifies the guest rebooted successfully from the other root
+// partition.
+func TestGokrazyUpdatesItselfToSameImage(t *testing.T) {
+	env := vmtest.New(t)
+
+	wan := env.AddNetwork("1.0.0.1", "192.168.1.1/24", vnet.EasyNAT)
+	node := env.AddNode("gokrazy", wan,
+		vmtest.OS(vmtest.Gokrazy),
+		vmtest.DontJoinTailnet())
+
+	env.Start()
+
+	gaf := buildNatlabGAF(t)
+	env.RegisterFile("natlabapp.gaf", gaf)
+
+	rootBefore, err := env.GokrazyRoot(node)
+	if err != nil {
+		t.Fatalf("getting initial gokrazy root: %v", err)
+	}
+	t.Logf("initial gokrazy root: %s", rootBefore)
+
+	out, err := env.Tailscale(node,
+		"update",
+		"--",
+		"--gokrazy-update-from-url=http://files.tailscale/natlabapp.gaf",
+		"--unsigned",
+	)
+	if err != nil {
+		if errors.Is(err, io.EOF) {
+			t.Logf("update command connection ended during reboot: %v", err)
+		} else {
+			t.Fatalf("gokrazy update command failed: %v\n%s", err, out)
+		}
+	} else {
+		t.Logf("update command output:\n%s", out)
+	}
+
+	if err := tstest.WaitFor(90*time.Second, func() error {
+		rootAfter, err := env.GokrazyRoot(node)
+		if err != nil {
+			return err
+		}
+		if rootAfter == rootBefore {
+			return fmt.Errorf("still booted with root %q", rootAfter)
+		}
+		t.Logf("updated gokrazy root: %s", rootAfter)
+		return nil
+	}); err != nil {
+		t.Fatalf("waiting for gokrazy to reboot into inactive partition: %v", err)
+	}
+}
+
+func buildNatlabGAF(t *testing.T) []byte {
+	t.Helper()
+
+	modRoot := moduleRoot(t)
+	gafPath := filepath.Join(modRoot, "gokrazy", "natlabapp.gaf")
+	t.Cleanup(func() { os.Remove(gafPath) })
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
+	defer cancel()
+
+	cmd := exec.CommandContext(ctx, "go", "run", "build.go", "--gaf", "--app=natlabapp")
+	cmd.Dir = filepath.Join(modRoot, "gokrazy")
+	var out bytes.Buffer
+	cmd.Stdout = &out
+	cmd.Stderr = &out
+	if err := cmd.Run(); err != nil {
+		t.Fatalf("building natlabapp.gaf: %v\n%s", err, out.String())
+	}
+	t.Logf("built natlabapp.gaf:\n%s", out.String())
+
+	gaf, err := os.ReadFile(gafPath)
+	if err != nil {
+		t.Fatalf("reading %s: %v", gafPath, err)
+	}
+	return gaf
+}
+
+func moduleRoot(t *testing.T) string {
+	t.Helper()
+
+	out, err := exec.Command("go", "env", "GOMOD").CombinedOutput()
+	if err != nil {
+		t.Fatalf("go env GOMOD: %v\n%s", err, out)
+	}
+	gomod := strings.TrimSpace(string(out))
+	if gomod == "" || gomod == os.DevNull {
+		t.Fatal("not in a Go module")
+	}
+	return filepath.Dir(gomod)
+}
diff --git a/tstest/natlab/vmtest/images.go b/tstest/natlab/vmtest/images.go
index 49eba443f..93bb99dca 100644
--- a/tstest/natlab/vmtest/images.go
+++ b/tstest/natlab/vmtest/images.go
@@ -19,17 +19,39 @@ import (
 	"github.com/ulikunitz/xz"
 )
 
+// LinuxFamily classifies a Linux distro by the conventions that affect how we
+// provision it via cloud-init (default network manager, MAC/LSM, etc). It is
+// only meaningful for Linux cloud images, which must declare one; the zero
+// value means "undeclared".
+type LinuxFamily string
+
+const (
+	// LinuxDebian covers Debian and Ubuntu cloud images: systemd-networkd for
+	// networking and AppArmor as the LSM.
+	LinuxDebian LinuxFamily = "debian"
+
+	// LinuxRHEL covers Fedora, CentOS Stream, Rocky, and AlmaLinux cloud
+	// images: NetworkManager + systemd-resolved for networking and SELinux
+	// enforcing.
+	LinuxRHEL LinuxFamily = "rhel"
+)
+
 // OSImage describes a VM operating system image.
 type OSImage struct {
 	Name      string
-	URL       string // download URL for the cloud image
-	SHA256    string // expected SHA256 hash of the image (of the final qcow2, after any decompression)
-	MemoryMB  int    // RAM for the VM
-	IsGokrazy bool   // true for gokrazy images (different QEMU setup)
+	URL       string      // download URL for the cloud image
+	SHA256    string      // expected SHA256 hash of the image (of the final qcow2, after any decompression)
+	MemoryMB  int         // RAM for the VM
+	Family    LinuxFamily // Linux distro family (affects cloud-init user-data); empty means Debian-like
+	IsGokrazy bool        // true for gokrazy images (different QEMU setup)
+	IsMacOS   bool        // true for macOS images (launched via tailmac, not QEMU)
 }
 
 // GOOS returns the Go OS name for this image.
 func (img OSImage) GOOS() string {
+	if img.IsMacOS {
+		return "darwin"
+	}
 	if img.IsGokrazy {
 		return "linux"
 	}
@@ -41,9 +63,20 @@ func (img OSImage) GOOS() string {
 
 // GOARCH returns the Go architecture name for this image.
 func (img OSImage) GOARCH() string {
+	if img.IsMacOS {
+		return "arm64"
+	}
 	return "amd64"
 }
 
+// isLinuxCloudImage reports whether the image is a Linux distro cloud image
+// (Ubuntu, Debian, Fedora, ...), as opposed to gokrazy or a non-Linux OS.
+// These are the images provisioned via generateLinuxUserData and are the ones
+// that must declare a LinuxFamily.
+func (img OSImage) isLinuxCloudImage() bool {
+	return img.GOOS() == "linux" && !img.IsGokrazy
+}
+
 var (
 	// Gokrazy is a minimal Tailscale appliance image built from the gokrazy/natlabapp directory.
 	Gokrazy = OSImage{
@@ -57,6 +90,7 @@ var (
 		Name:     "ubuntu-24.04",
 		URL:      "https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.img",
 		MemoryMB: 1024,
+		Family:   LinuxDebian,
 	}
 
 	// Debian12 is Debian 12 (Bookworm) generic cloud image.
@@ -64,6 +98,7 @@ var (
 		Name:     "debian-12",
 		URL:      "https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-generic-amd64.qcow2",
 		MemoryMB: 1024,
+		Family:   LinuxDebian,
 	}
 
 	// FreeBSD150 is FreeBSD 15.0-RELEASE with BASIC-CLOUDINIT (nuageinit) support.
@@ -73,8 +108,42 @@ var (
 		URL:      "https://download.freebsd.org/releases/VM-IMAGES/15.0-RELEASE/amd64/Latest/FreeBSD-15.0-RELEASE-amd64-BASIC-CLOUDINIT-ufs.qcow2.xz",
 		MemoryMB: 1024,
 	}
+
+	// Fedora43 is the Fedora 43 Cloud Base image: NetworkManager +
+	// systemd-resolved, SELinux enforcing, hence LinuxRHEL.
+	Fedora43 = OSImage{
+		Name:     "fedora-43",
+		URL:      "https://download.fedoraproject.org/pub/fedora/linux/releases/43/Cloud/x86_64/images/Fedora-Cloud-Base-Generic-43-1.6.x86_64.qcow2",
+		MemoryMB: 1024,
+		Family:   LinuxRHEL,
+	}
+
+	// MacOS is a macOS VM launched via tailmac (Apple Virtualization.framework).
+	// Uses a Tart pre-built base image (ghcr.io/cirruslabs/macos-tahoe-base)
+	// which is automatically pulled on first use. Only runs on macOS arm64 hosts.
+	MacOS = OSImage{
+		Name:     "macos",
+		IsMacOS:  true,
+		MemoryMB: 4096,
+	}
 )
 
+// CloudImages returns the set of QEMU-bootable cloud OS images natlab can
+// use for vmtests, excluding gokrazy (built from source) and macOS (which
+// uses a separate snapshot pipeline). It is intended for tooling such as
+// a CI prep step that wants to warm the image cache.
+func CloudImages() []OSImage {
+	return []OSImage{Ubuntu2404, Debian12, FreeBSD150, Fedora43}
+}
+
+// EnsureImage downloads img to the local cache if not already present.
+// It is intended for tooling that wants to warm the image cache before
+// running natlab vmtests (e.g. a CI prep step). The test framework also
+// calls into the package-internal equivalent on demand.
+func EnsureImage(ctx context.Context, img OSImage) error {
+	return ensureImage(ctx, img)
+}
+
 // imageCacheDir returns the directory for cached VM images.
 func imageCacheDir() string {
 	if d := os.Getenv("VMTEST_CACHE_DIR"); d != "" {
diff --git a/tstest/natlab/vmtest/jailmasq_test.go b/tstest/natlab/vmtest/jailmasq_test.go
new file mode 100644
index 000000000..a3ab5433d
--- /dev/null
+++ b/tstest/natlab/vmtest/jailmasq_test.go
@@ -0,0 +1,138 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package vmtest_test
+
+import (
+	"fmt"
+	"net/netip"
+	"strings"
+	"testing"
+	"time"
+
+	"tailscale.com/tailcfg"
+	"tailscale.com/tstest/integration/testcontrol"
+	"tailscale.com/tstest/natlab/vmtest"
+	"tailscale.com/tstest/natlab/vnet"
+	"tailscale.com/types/key"
+)
+
+// TestJailedAndMasqueradedPeers exercises the tun-layer per-peer data
+// plane end-to-end with two gokrazy VMs: the control server marks one
+// peer jailed (so the other side's jailed packet filter must drop its
+// TCP flows) and later assigns masquerade addresses (so per-packet
+// NAT must rewrite addresses in both directions). Connectivity is
+// probed with HTTP requests between the nodes' webservers, which flow
+// through the WireGuard tunnel and the tun-layer filters; TSMP pings
+// are no good here because tstun answers them before running the
+// packet filter. Each transition arrives as a netmap update and must
+// take effect without restarting anything.
+func TestJailedAndMasqueradedPeers(t *testing.T) {
+	env := vmtest.New(t, vmtest.AllOnline())
+	addNode := func() *vmtest.Node {
+		n := env.NumNodes()
+		return env.AddNode(fmt.Sprintf("node-%d", n),
+			env.AddNetwork(
+				fmt.Sprintf("2.%d.%d.%d", n, n, n), // public IP
+				fmt.Sprintf("192.168.%d.1/24", n), vnet.EasyNAT),
+			vmtest.OS(vmtest.Gokrazy),
+			vmtest.WebServer(8080))
+	}
+	n1 := addNode()
+	n2 := addNode()
+	env.Start()
+
+	st1 := env.Status(n1)
+	st2 := env.Status(n2)
+	k1, k2 := st1.Self.PublicKey, st2.Self.PublicKey
+	n1IP, n2IP := st1.Self.TailscaleIPs[0], st2.Self.TailscaleIPs[0]
+	cs := env.ControlServer()
+
+	url := func(ip netip.Addr) string { return fmt.Sprintf("http://%s:8080/", ip) }
+
+	// awaitHTTPOK polls until an HTTP GET from the given node succeeds
+	// and the body carries the serving node's greeting, proving the
+	// TCP flow crossed the tunnel to the intended node.
+	awaitHTTPOK := func(from *vmtest.Node, targetURL, wantGreeting string) {
+		t.Helper()
+		deadline := time.Now().Add(2 * time.Minute)
+		var lastErr error
+		for time.Now().Before(deadline) {
+			res, err := env.HTTPGetStatus(from, targetURL)
+			if err == nil && res.Status == 200 && strings.Contains(res.Body, wantGreeting) {
+				return
+			}
+			if err != nil {
+				lastErr = err
+			} else {
+				lastErr = fmt.Errorf("status=%d body=%q", res.Status, res.Body)
+			}
+		}
+		t.Fatalf("GET %s from %s never succeeded: %v", targetURL, from.Name(), lastErr)
+	}
+
+	// awaitHTTPFails polls until an HTTP GET from the given node
+	// fails, for asserting that a jailed peer's flows get dropped
+	// once the netmap update lands.
+	awaitHTTPFails := func(from *vmtest.Node, targetURL string) {
+		t.Helper()
+		deadline := time.Now().Add(2 * time.Minute)
+		for time.Now().Before(deadline) {
+			res, err := env.HTTPGetStatus(from, targetURL)
+			if err != nil || res.Status != 200 {
+				return
+			}
+		}
+		t.Fatalf("GET %s from %s still succeeding; want drop by jailed filter", targetURL, from.Name())
+	}
+
+	// Warm up the tunnel, then check HTTP in both directions.
+	if err := env.Ping(n1, n2, tailcfg.PingTSMP, 30*time.Second); err != nil {
+		t.Fatal(err)
+	}
+	awaitHTTPOK(n2, url(n1IP), n1.Name())
+	awaitHTTPOK(n1, url(n2IP), n2.Name())
+
+	// Jail n2 as seen by n1: n1's data plane must start dropping
+	// n2-initiated flows.
+	cs.SetJailed(k1, k2, true)
+	awaitHTTPFails(n2, url(n1IP))
+
+	// Unjailing must restore connectivity the same way.
+	cs.SetJailed(k1, k2, false)
+	awaitHTTPOK(n2, url(n1IP), n1.Name())
+	awaitHTTPOK(n1, url(n2IP), n2.Name())
+
+	// Masquerade both nodes: each side now knows the other only by
+	// its masquerade address, and the tun layer must NAT between the
+	// masquerade and native addresses in both directions.
+	n1Masq := netip.MustParseAddr("100.64.101.1")
+	n2Masq := netip.MustParseAddr("100.64.102.1")
+	cs.SetMasqueradeAddresses([]testcontrol.MasqueradePair{
+		{Node: k1, Peer: k2, NodeMasqueradesAs: n1Masq},
+		{Node: k2, Peer: k1, NodeMasqueradesAs: n2Masq},
+	})
+
+	// Wait for each side's netmap to show the peer at its masquerade
+	// address, then fetch through it.
+	awaitPeerIP := func(on *vmtest.Node, peer key.NodePublic, want netip.Addr) {
+		t.Helper()
+		deadline := time.Now().Add(time.Minute)
+		for time.Now().Before(deadline) {
+			if ps, ok := env.Status(on).Peer[peer]; ok {
+				for _, ip := range ps.TailscaleIPs {
+					if ip == want {
+						return
+					}
+				}
+			}
+			time.Sleep(500 * time.Millisecond)
+		}
+		t.Fatalf("%s never saw peer %s at %v", on.Name(), peer.ShortString(), want)
+	}
+	awaitPeerIP(n1, k2, n2Masq)
+	awaitPeerIP(n2, k1, n1Masq)
+
+	awaitHTTPOK(n2, url(n1Masq), n1.Name())
+	awaitHTTPOK(n1, url(n2Masq), n2.Name())
+}
diff --git a/tstest/natlab/vmtest/qemu.go b/tstest/natlab/vmtest/qemu.go
index df56322fa..93a69e137 100644
--- a/tstest/natlab/vmtest/qemu.go
+++ b/tstest/natlab/vmtest/qemu.go
@@ -5,6 +5,7 @@ package vmtest
 
 import (
 	"bytes"
+	"context"
 	"encoding/json"
 	"fmt"
 	"net"
@@ -12,18 +13,106 @@ import (
 	"os/exec"
 	"path/filepath"
 	"regexp"
+	"runtime"
 	"strconv"
+	"strings"
+	"testing"
 	"time"
 
 	"tailscale.com/tstest/natlab/vnet"
 )
 
-// startQEMU launches a QEMU process for the given node.
-func (e *Env) startQEMU(n *Node) error {
-	if n.os.IsGokrazy {
-		return e.startGokrazyQEMU(n)
+// qemuAccelArgs returns QEMU command-line flags for hardware-accelerated
+// virtualisation when available, or nil to fall back to TCG (software
+// emulation). On Linux, KVM is used when /dev/kvm is accessible. On other
+// platforms (macOS, etc.) TCG is used, which allows the tests to run
+// without a same-architecture hypervisor at the cost of speed.
+func qemuAccelArgs() []string {
+	if hardwareAccelAvailable() {
+		return []string{"-enable-kvm", "-cpu", "host"}
 	}
-	return e.startCloudQEMU(n)
+	return nil
+}
+
+// hardwareAccelAvailable reports whether hardware-accelerated virtualisation
+// (KVM) is usable. When false, VMs run under TCG software emulation, which is
+// dramatically slower and, when several VMs boot concurrently, prone to CPU
+// starvation — a heavy guest (e.g. Fedora) can monopolize host cores and stall
+// its lighter siblings' emulation threads. Callers use this to relax timeouts
+// tuned for KVM's near-native boot speed. VMTEST_NO_KVM=1 forces TCG, for
+// reproducing slow-host behavior.
+func hardwareAccelAvailable() bool {
+	if os.Getenv("VMTEST_NO_KVM") == "1" {
+		return false
+	}
+	if runtime.GOOS == "linux" {
+		if f, err := os.OpenFile("/dev/kvm", os.O_RDWR, 0); err == nil {
+			f.Close()
+			return true
+		}
+	}
+	return false
+}
+
+// gokrazyPlatform boots gokrazy (Linux) VMs via QEMU.
+type gokrazyPlatform struct{}
+
+func (gokrazyPlatform) planSteps(e *Env, n *Node) {
+	e.Step("Build gokrazy image")
+	e.Step("Launch QEMU: " + n.name)
+}
+
+func (gokrazyPlatform) boot(ctx context.Context, e *Env, n *Node) error {
+	e.gokrazyOnce.Do(func() {
+		step := e.Step("Build gokrazy image")
+		step.Begin()
+		if err := e.ensureGokrazy(ctx); err != nil {
+			step.End(err)
+			e.t.Fatalf("ensureGokrazy: %v", err)
+		}
+		step.End(nil)
+	})
+
+	e.ensureQEMUSocket()
+
+	vmStep := e.Step("Launch QEMU: " + n.name)
+	vmStep.Begin()
+	if err := e.startGokrazyQEMU(n); err != nil {
+		vmStep.End(err)
+		return err
+	}
+	vmStep.End(nil)
+	return nil
+}
+
+// qemuCloudPlatform boots cloud images (Ubuntu, Debian, FreeBSD) via QEMU.
+type qemuCloudPlatform struct{}
+
+func (qemuCloudPlatform) planSteps(e *Env, n *Node) {
+	e.Step(fmt.Sprintf("Compile %s_%s binaries", n.os.GOOS(), n.os.GOARCH()))
+	e.Step(fmt.Sprintf("Prepare %s image", n.os.Name))
+	e.Step("Launch QEMU: " + n.name)
+}
+
+func (qemuCloudPlatform) boot(ctx context.Context, e *Env, n *Node) error {
+	goos, goarch := n.os.GOOS(), n.os.GOARCH()
+
+	e.ensureCompiled(ctx, goos, goarch)
+
+	if err := e.ensureImage(ctx, n.os); err != nil {
+		return err
+	}
+
+	e.ensureQEMUSocket()
+
+	vmStep := e.Step("Launch QEMU: " + n.name)
+	vmStep.Begin()
+	if err := e.startCloudQEMU(n); err != nil {
+		vmStep.End(err)
+		return err
+	}
+	vmStep.End(nil)
+	return nil
 }
 
 // startGokrazyQEMU launches a QEMU process for a gokrazy node.
@@ -40,6 +129,7 @@ func (e *Env) startGokrazyQEMU(n *Node) error {
 	}
 	sysLogAddr := net.JoinHostPort(vnet.FakeSyslogIPv4().String(), "995")
 	if n.vnetNode.IsV6Only() {
+		fmt.Fprintf(&envBuf, " tta.nameserver=%s", vnet.FakeDNSIPv6())
 		sysLogAddr = net.JoinHostPort(vnet.FakeSyslogIPv6().String(), "995")
 	}
 
@@ -60,15 +150,17 @@ func (e *Env) startGokrazyQEMU(n *Node) error {
 	}
 
 	// Add network devices — one per NIC.
+	// rx_queue_size=1024: see the comment in startCloudQEMU.
 	for i := range n.vnetNode.NumNICs() {
 		mac := n.vnetNode.NICMac(i)
 		netdevID := fmt.Sprintf("net%d", i)
 		args = append(args,
 			"-netdev", fmt.Sprintf("stream,id=%s,addr.type=unix,addr.path=%s", netdevID, e.sockAddr),
-			"-device", fmt.Sprintf("virtio-net-device,netdev=%s,mac=%s", netdevID, mac),
+			"-device", fmt.Sprintf("virtio-net-device,netdev=%s,mac=%s,rx_queue_size=1024", netdevID, mac),
 		)
 	}
 
+	args = append(args, qemuAccelArgs()...)
 	return e.launchQEMU(n.name, logPath, args)
 }
 
@@ -89,12 +181,11 @@ func (e *Env) startCloudQEMU(n *Node) error {
 	}
 
 	logPath := filepath.Join(e.tempDir, n.name+".log")
-	qmpSock := filepath.Join(e.tempDir, n.name+"-qmp.sock")
+	qmpSock := filepath.Join(e.sockDir, n.name+"-qmp.sock")
 
 	args := []string{
-		"-machine", "q35,accel=kvm",
+		"-machine", "q35",
 		"-m", fmt.Sprintf("%dM", n.os.MemoryMB),
-		"-cpu", "host",
 		"-smp", "2",
 		"-display", "none",
 		"-drive", fmt.Sprintf("file=%s,if=virtio", disk),
@@ -102,17 +193,24 @@ func (e *Env) startCloudQEMU(n *Node) error {
 		"-smbios", "type=1,serial=ds=nocloud",
 		"-serial", "file:" + logPath,
 		"-qmp", "unix:" + qmpSock + ",server,nowait",
+		// Feed host entropy to the guest so early boot doesn't block in
+		// getrandom() waiting for the CRNG to seed. Cheap and worth it on any
+		// backend; the stall is especially likely under TCG.
+		"-device", "virtio-rng-pci",
 	}
 
 	// Add network devices — one per NIC.
 	// romfile="" disables the iPXE option ROM entirely, saving ~5s per NIC at boot
 	// and avoiding "duplicate fw_cfg file name" errors with multiple NICs.
+	// rx_queue_size=1024 (up from the 256 default) gives the guest 4x the
+	// virtio RX ring capacity, absorbing vnet bursts that would otherwise be
+	// dropped while the guest is descheduled on a contended host.
 	for i := range n.vnetNode.NumNICs() {
 		mac := n.vnetNode.NICMac(i)
 		netdevID := fmt.Sprintf("net%d", i)
 		args = append(args,
 			"-netdev", fmt.Sprintf("stream,id=%s,addr.type=unix,addr.path=%s", netdevID, e.sockAddr),
-			"-device", fmt.Sprintf("virtio-net-pci,netdev=%s,mac=%s,romfile=", netdevID, mac),
+			"-device", fmt.Sprintf("virtio-net-pci,netdev=%s,mac=%s,romfile=,rx_queue_size=1024", netdevID, mac),
 		)
 	}
 
@@ -123,6 +221,8 @@ func (e *Env) startCloudQEMU(n *Node) error {
 		"-device", "virtio-net-pci,netdev=debug0,romfile=",
 	)
 
+	args = append(args, qemuAccelArgs()...)
+
 	if err := e.launchQEMU(n.name, logPath, args); err != nil {
 		return err
 	}
@@ -137,55 +237,173 @@ func (e *Env) startCloudQEMU(n *Node) error {
 	return nil
 }
 
-// launchQEMU starts a qemu-system-x86_64 process with the given args.
+// qemuRun is one running qemu-system-x86_64 process plus the file handles
+// the wrapping code holds open on its behalf. kill tears the whole thing
+// down (used both for normal cleanup and for the in-flight retry path).
+type qemuRun struct {
+	cmd        *exec.Cmd
+	parentPipe *os.File
+	devNull    *os.File
+	qemuLog    *os.File
+}
+
+func (r *qemuRun) kill() {
+	killProcessTree(r.cmd)
+	r.cmd.Wait()
+	r.parentPipe.Close()
+	r.devNull.Close()
+	r.qemuLog.Close()
+}
+
+// launchQEMU starts a qemu-system-x86_64 process with the given args and
+// watches for console activity. If the guest produces no output within
+// stuckTimeout (empty console *and* QEMU has not exited with an error),
+// the QEMU process is killed and re-launched. This works around CI
+// hypervisor flakes seen on shared GitHub Actions runners where a QEMU
+// process starts but its vCPU never makes any forward progress (the
+// failure presents as both the virtconsole log and the QEMU stderr log
+// being zero bytes after many minutes, with the vnet stream socket
+// connected but no packet ever sent).
+//
 // VM console output goes to logPath (via QEMU's -serial or -chardev).
 // QEMU's own stdout/stderr go to logPath.qemu for diagnostics.
 func (e *Env) launchQEMU(name, logPath string, args []string) error {
+	// stuckTimeout is generous: a healthy VM prints SeaBIOS/kernel output
+	// within ~1-2s on KVM, but slow CI hardware can lag. Under TCG a heavy
+	// concurrent guest can starve its siblings, so give them much longer to
+	// emit a first console byte before we kill and retry.
+	stuckTimeout := 45 * time.Second
+	if !hardwareAccelAvailable() {
+		stuckTimeout = 4 * time.Minute
+	}
+	const maxAttempts = 3
+
+	// Dump the VM's console tail and QEMU's own stderr on test failure.
+	// Registered before the boot loop so it fires even when the node never
+	// boots (all attempts fail below), not just after a successful launch.
+	// The console log is empty when the guest never produced output (e.g. QEMU
+	// exited before the kernel ran); in that case the .qemu file holds the only
+	// diagnostic — KVM errors, "kvm not available", CPU model mismatch, etc.
+	e.t.Cleanup(func() {
+		if e.t.Failed() {
+			dumpLogTail(e.t, name, "console", logPath)
+			dumpLogTail(e.t, name, "qemu stderr", logPath+".qemu")
+		}
+	})
+
+	var lastErr error
+	for attempt := 1; attempt <= maxAttempts; attempt++ {
+		if attempt > 1 {
+			e.t.Logf("[%s] QEMU made no progress in %v; killing and retrying (attempt %d/%d)", name, stuckTimeout, attempt, maxAttempts)
+			// QEMU's -chardev file backend opens append-mode, so stale
+			// bytes from a previous attempt would falsely trip the
+			// progress check on retry. Truncate it.
+			os.Truncate(logPath, 0)
+		}
+		run, err := e.startQEMUOnce(name, logPath, args)
+		if err != nil {
+			lastErr = err
+			continue
+		}
+		if waitForConsoleProgress(logPath, stuckTimeout) {
+			e.qemuProcs = append(e.qemuProcs, run.cmd)
+			if e.ctx != nil {
+				go e.tailLogFile(e.ctx, name, logPath)
+			}
+			e.t.Cleanup(run.kill)
+			return nil
+		}
+		lastErr = fmt.Errorf("QEMU for %s produced no console output in %v", name, stuckTimeout)
+		run.kill()
+	}
+	return fmt.Errorf("QEMU for %s failed after %d attempts: %w", name, maxAttempts, lastErr)
+}
+
+// startQEMUOnce starts a single qemu-system-x86_64 process. On success the
+// returned qemuRun owns the process and all file handles; the caller must
+// invoke kill (either inline for a retry or via t.Cleanup for the
+// surviving attempt).
+func (e *Env) startQEMUOnce(name, logPath string, args []string) (*qemuRun, error) {
 	cmd := exec.Command("qemu-system-x86_64", args...)
-	// Send stdout/stderr to the log file for any QEMU diagnostic messages.
-	// Stdin must be /dev/null to prevent QEMU from trying to read.
 	devNull, err := os.Open(os.DevNull)
 	if err != nil {
-		return fmt.Errorf("open /dev/null: %w", err)
+		return nil, fmt.Errorf("open /dev/null: %w", err)
 	}
 	cmd.Stdin = devNull
 	qemuLog, err := os.Create(logPath + ".qemu")
 	if err != nil {
 		devNull.Close()
-		return err
+		return nil, err
 	}
 	cmd.Stdout = qemuLog
 	cmd.Stderr = qemuLog
-	if err := cmd.Start(); err != nil {
+	parentPipe, err := killWithParent(cmd)
+	if err != nil {
 		devNull.Close()
 		qemuLog.Close()
-		return fmt.Errorf("qemu for %s: %w", name, err)
+		return nil, fmt.Errorf("killWithParent: %w", err)
+	}
+	if err := cmd.Start(); err != nil {
+		parentPipe.Close()
+		devNull.Close()
+		qemuLog.Close()
+		return nil, fmt.Errorf("qemu for %s: %w", name, err)
 	}
 	e.t.Logf("launched QEMU for %s (pid %d), log: %s", name, cmd.Process.Pid, logPath)
-	e.qemuProcs = append(e.qemuProcs, cmd)
-	e.t.Cleanup(func() {
-		cmd.Process.Kill()
-		cmd.Wait()
-		devNull.Close()
-		qemuLog.Close()
-		// Dump tail of VM log on failure for debugging.
-		if e.t.Failed() {
-			if data, err := os.ReadFile(logPath); err == nil {
-				lines := bytes.Split(data, []byte("\n"))
-				start := 0
-				if len(lines) > 50 {
-					start = len(lines) - 50
-				}
-				e.t.Logf("=== last 50 lines of %s log ===", name)
-				for _, line := range lines[start:] {
-					e.t.Logf("[%s] %s", name, line)
-				}
-			}
-		}
-	})
-	return nil
+	return &qemuRun{
+		cmd:        cmd,
+		parentPipe: parentPipe,
+		devNull:    devNull,
+		qemuLog:    qemuLog,
+	}, nil
 }
 
+// waitForConsoleProgress polls logPath until its size is non-zero or
+// timeout elapses. It returns true on observed forward progress (any
+// bytes written), false on timeout.
+func waitForConsoleProgress(logPath string, timeout time.Duration) bool {
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		if fi, err := os.Stat(logPath); err == nil && fi.Size() > 0 {
+			return true
+		}
+		time.Sleep(200 * time.Millisecond)
+	}
+	return false
+}
+
+// dumpLogTail prints the last 50 lines of the file at path to the test log,
+// prefixed with the VM name and kind (e.g. "console", "qemu stderr"). It is
+// a no-op (with a short note) if the file can't be read or is empty, so
+// callers can use it unconditionally on test failure.
+func dumpLogTail(t testing.TB, name, kind, path string) {
+	t.Helper()
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Logf("=== %s %s log unavailable: %v ===", name, kind, err)
+		return
+	}
+	if len(data) == 0 {
+		t.Logf("=== %s %s log is empty ===", name, kind)
+		return
+	}
+	lines := bytes.Split(data, []byte("\n"))
+	start := 0
+	if len(lines) > 50 {
+		start = len(lines) - 50
+	}
+	t.Logf("=== last 50 lines of %s %s log ===", name, kind)
+	for _, line := range lines[start:] {
+		t.Logf("[%s] %s", name, line)
+	}
+}
+
+// hostFwdRe matches a single TCP[HOST_FORWARD] line from QEMU's
+// "info usernet" human-monitor command output, e.g.:
+//
+//	TCP[HOST_FORWARD]  12       127.0.0.1 35323       10.0.2.15    22
+var hostFwdRe = regexp.MustCompile(`TCP\[HOST_FORWARD\]\s+\d+\s+127\.0\.0\.1\s+(\d+)\s+`)
+
 // qmpQueryHostFwd connects to a QEMU QMP socket and queries the host port
 // assigned to the first TCP host forward rule (the SSH debug port).
 func qmpQueryHostFwd(sockPath string) (int, error) {
@@ -203,7 +421,7 @@ func qmpQueryHostFwd(sockPath string) (int, error) {
 		return 0, fmt.Errorf("QMP socket %s not available", sockPath)
 	}
 	defer conn.Close()
-	conn.SetDeadline(time.Now().Add(5 * time.Second))
+	conn.SetDeadline(time.Now().Add(20 * time.Second))
 
 	// Read the QMP greeting.
 	var greeting json.RawMessage
@@ -219,21 +437,94 @@ func qmpQueryHostFwd(sockPath string) (int, error) {
 		return 0, fmt.Errorf("reading qmp_capabilities response: %w", err)
 	}
 
-	// Query "info usernet" via human-monitor-command.
-	fmt.Fprintf(conn, `{"execute":"human-monitor-command","arguments":{"command-line":"info usernet"}}`+"\n")
-	var hmpResp struct {
-		Return string `json:"return"`
+	// Poll "info usernet" until the SLIRP host-forward rule appears.
+	// On slow runners (e.g. GitHub Actions) QEMU sometimes returns an
+	// empty "info usernet" if we query it before user-mode networking
+	// has finished wiring up the forward, so single-shot lookups fail.
+	deadline := time.Now().Add(10 * time.Second)
+	var lastReturn string
+	for {
+		fmt.Fprintf(conn, `{"execute":"human-monitor-command","arguments":{"command-line":"info usernet"}}`+"\n")
+		var hmpResp struct {
+			Return string `json:"return"`
+		}
+		if err := dec.Decode(&hmpResp); err != nil {
+			return 0, fmt.Errorf("reading info usernet response: %w", err)
+		}
+		lastReturn = hmpResp.Return
+		if m := hostFwdRe.FindStringSubmatch(hmpResp.Return); m != nil {
+			return strconv.Atoi(m[1])
+		}
+		if time.Now().After(deadline) {
+			break
+		}
+		time.Sleep(100 * time.Millisecond)
+	}
+	return 0, fmt.Errorf("no hostfwd port found after waiting: %q", lastReturn)
+}
+
+// tailLogFile tails a VM's serial console log file and publishes each line
+// as an EventConsoleOutput to the event bus for the web UI.
+func (e *Env) tailLogFile(ctx context.Context, name, logPath string) {
+	// Wait for the file to appear (QEMU may not have created it yet).
+	var f *os.File
+	for {
+		var err error
+		f, err = os.Open(logPath)
+		if err == nil {
+			break
+		}
+		select {
+		case <-ctx.Done():
+			return
+		case <-time.After(100 * time.Millisecond):
+		}
+	}
+	defer f.Close()
+
+	// Read the file in a loop, tracking our position manually.
+	// We can't use bufio.Scanner because it caches EOF and won't
+	// pick up new data appended by QEMU after the first EOF.
+	var buf []byte
+	var partial string // incomplete line (no trailing newline yet)
+	readBuf := make([]byte, 4096)
+	for {
+		n, err := f.Read(readBuf)
+		if n > 0 {
+			buf = append(buf, readBuf[:n]...)
+			// Split into complete lines.
+			for {
+				idx := bytes.IndexByte(buf, '\n')
+				if idx < 0 {
+					break
+				}
+				line := partial + string(buf[:idx])
+				partial = ""
+				buf = buf[idx+1:]
+				// Strip trailing \r from serial consoles.
+				line = strings.TrimRight(line, "\r")
+				if line == "" {
+					continue
+				}
+				e.appendConsoleLine(name, line)
+				e.eventBus.Publish(VMEvent{
+					NodeName: name,
+					Type:     EventConsoleOutput,
+					Message:  line,
+				})
+			}
+			if len(buf) > 0 {
+				partial = string(buf)
+				buf = buf[:0]
+			}
+		}
+		if err != nil || n == 0 {
+			// EOF or error — wait for more data.
+			select {
+			case <-ctx.Done():
+				return
+			case <-time.After(100 * time.Millisecond):
+			}
+		}
 	}
-	if err := dec.Decode(&hmpResp); err != nil {
-		return 0, fmt.Errorf("reading info usernet response: %w", err)
-	}
-
-	// Parse the port from output like:
-	//   TCP[HOST_FORWARD]  12       127.0.0.1 35323       10.0.2.15    22
-	re := regexp.MustCompile(`TCP\[HOST_FORWARD\]\s+\d+\s+127\.0\.0\.1\s+(\d+)\s+`)
-	m := re.FindStringSubmatch(hmpResp.Return)
-	if m == nil {
-		return 0, fmt.Errorf("no hostfwd port found in: %s", hmpResp.Return)
-	}
-	return strconv.Atoi(m[1])
 }
diff --git a/tstest/natlab/vmtest/qemu_wrapper.go b/tstest/natlab/vmtest/qemu_wrapper.go
new file mode 100644
index 000000000..5b5843bed
--- /dev/null
+++ b/tstest/natlab/vmtest/qemu_wrapper.go
@@ -0,0 +1,90 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build unix
+
+package vmtest
+
+import (
+	"fmt"
+	"io"
+	"log"
+	"os"
+	"os/exec"
+	"strconv"
+	"syscall"
+)
+
+// Re-exec'd as a wrapper around QEMU: when the test process dies (any
+// reason, including SIGKILL), the kernel closes the pipe write end, the
+// wrapper sees EOF, and kills QEMU's process group.
+
+const wrapperEnv = "TS_VMTEST_QEMU_WRAPPER"
+
+func init() {
+	if os.Getenv(wrapperEnv) == "" {
+		return
+	}
+	runQEMUWrapper()
+}
+
+func runQEMUWrapper() {
+	fd, err := strconv.Atoi(os.Getenv(wrapperEnv))
+	if err != nil {
+		log.Fatalf("vmtest qemu wrapper: bad %s: %v", wrapperEnv, err)
+	}
+	os.Unsetenv(wrapperEnv)
+	if len(os.Args) < 2 {
+		log.Fatalf("vmtest qemu wrapper: missing command")
+	}
+	pipeFd := os.NewFile(uintptr(fd), "parent-pipe")
+
+	// QEMU inherits our pgid (the test set Setpgid on us), so a group kill
+	// from the test reaches QEMU too. Don't set Setpgid here.
+	cmd := exec.Command(os.Args[1], os.Args[2:]...)
+	cmd.Stdin, cmd.Stdout, cmd.Stderr = os.Stdin, os.Stdout, os.Stderr
+	if err := cmd.Start(); err != nil {
+		log.Fatalf("vmtest qemu wrapper: %v", err)
+	}
+
+	go func() {
+		// Block until the parent's pipe write end closes (EOF), then kill
+		// our process group (which includes QEMU and any of its children).
+		io.Copy(io.Discard, pipeFd)
+		syscall.Kill(0, syscall.SIGKILL)
+	}()
+
+	cmd.Wait()
+}
+
+// killWithParent rewrites cmd to run via a wrapper that kills it if the
+// test process dies. The returned *os.File must be kept alive until the
+// command is no longer needed; closing it makes the wrapper exit.
+func killWithParent(cmd *exec.Cmd) (*os.File, error) {
+	self, err := os.Executable()
+	if err != nil {
+		return nil, fmt.Errorf("os.Executable: %w", err)
+	}
+	r, w, err := os.Pipe()
+	if err != nil {
+		return nil, fmt.Errorf("pipe: %w", err)
+	}
+
+	cmd.ExtraFiles = append(cmd.ExtraFiles, r)
+	pipeFd := 3 + len(cmd.ExtraFiles) - 1 // stdin/stdout/stderr + ExtraFiles index
+	cmd.Args = append([]string{self, cmd.Path}, cmd.Args[1:]...)
+	cmd.Path = self
+	if cmd.Env == nil {
+		cmd.Env = os.Environ()
+	}
+	cmd.Env = append(cmd.Env, fmt.Sprintf("%s=%d", wrapperEnv, pipeFd))
+	cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
+
+	return w, nil
+}
+
+// killProcessTree SIGKILLs cmd's process group (cmd plus any descendants
+// that didn't escape it).
+func killProcessTree(cmd *exec.Cmd) error {
+	return syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL)
+}
diff --git a/tstest/natlab/vmtest/qemu_wrapper_windows.go b/tstest/natlab/vmtest/qemu_wrapper_windows.go
new file mode 100644
index 000000000..59d96fad9
--- /dev/null
+++ b/tstest/natlab/vmtest/qemu_wrapper_windows.go
@@ -0,0 +1,20 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package vmtest
+
+import (
+	"os"
+	"os/exec"
+)
+
+// Stubs for Windows: no parent-death watcher, no process-group kill.
+// The test still launches QEMU; cleanup just kills the single process.
+
+func killWithParent(cmd *exec.Cmd) (*os.File, error) {
+	return os.Open(os.DevNull)
+}
+
+func killProcessTree(cmd *exec.Cmd) error {
+	return cmd.Process.Kill()
+}
diff --git a/tstest/natlab/vmtest/selfsignedderp_test.go b/tstest/natlab/vmtest/selfsignedderp_test.go
new file mode 100644
index 000000000..752e04738
--- /dev/null
+++ b/tstest/natlab/vmtest/selfsignedderp_test.go
@@ -0,0 +1,102 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package vmtest_test
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"testing"
+	"time"
+
+	"tailscale.com/tailcfg"
+	"tailscale.com/tstest"
+	"tailscale.com/tstest/natlab/vmtest"
+	"tailscale.com/tstest/natlab/vnet"
+)
+
+// easyAnd6NoEndpoints is easy NAT plus an IPv6 prefix and
+// TS_DEBUG_STRIP_ENDPOINTS=1 on tailscaled so peer endpoints from control
+// are dropped. That forces the initial peer-to-peer disco bootstrap to
+// traverse DERP, since without endpoints from control the nodes have no
+// other way to first learn about each other.
+func easyAnd6NoEndpoints(env *vmtest.Env) *vmtest.Node {
+	n := env.NumNodes()
+	return env.AddNode(fmt.Sprintf("node-%d", n),
+		env.AddNetwork(
+			fmt.Sprintf("2.%d.%d.%d", n, n, n), // public IP
+			fmt.Sprintf("192.168.%d.1/24", n),
+			v6cidr(n),
+			vnet.EasyNAT),
+		vnet.TailscaledEnv{Key: "TS_DEBUG_STRIP_ENDPOINTS", Value: "1"},
+		vmtest.OS(vmtest.Gokrazy))
+}
+
+// TestSelfSignedDERPHashPinning exercises the sha256-raw DERP cert pinning
+// code path end-to-end: tailscaled connects to its home DERP whose cert is
+// self-signed and pinned via CertName="sha256-raw:<hex>" (no separate
+// fronting CertName), the two nodes communicate over the resulting tailnet,
+// and `tailscale debug derp` against the same region succeeds.
+//
+// Nodes are dual-stack (v4 + v6) so the DebugDERPRegion probe exercises both
+// address families against the test DERP server. They additionally strip
+// peer endpoints from control so the initial peer-to-peer disco bootstrap
+// must traverse DERP; the eventual data path may be direct or DERP, the
+// test doesn't care, only that DERP worked end-to-end.
+//
+// The debug-derp half is the regression test for the bug fixed in PR #19965:
+// before that change, [ipn/localapi.serveDebugDERPRegion] passed the raw
+// sha256-raw fingerprint as the TLS ServerName and the handshake always
+// failed with a hostname mismatch.
+func TestSelfSignedDERPHashPinning(t *testing.T) {
+	env := vmtest.New(t, vmtest.SelfSignedDERPCertPinning())
+	n1 := easyAnd6NoEndpoints(env)
+	n2 := easyAnd6NoEndpoints(env)
+	env.Start()
+
+	// End-to-end ping over the WireGuard tunnel. With peer endpoints
+	// stripped from control, the only way for the peers to first reach each
+	// other is via DERP, so a successful tunnel ping proves the
+	// tailscaled→DERP TLS handshake (and thus sha256-raw cert pinning)
+	// worked on both ends.
+	if err := env.Ping(n1, n2, tailcfg.PingTSMP, 60*time.Second); err != nil {
+		t.Fatalf("ping node-0 -> node-1: %v", err)
+	}
+
+	// Also verify each node both sent and received data packets over DERP.
+	// With endpoints stripped from control, the TSMP ping above has no
+	// direct path available, so the WireGuard packets it generates must
+	// flow via DERP. These counters never decrease, so once they're
+	// non-zero we know DERP carried real frames in both directions.
+	for _, n := range []*vmtest.Node{n1, n2} {
+		if err := tstest.WaitFor(30*time.Second, func() error {
+			m := env.ClientMetrics(n)
+			sent := m["magicsock_send_data_derp"].Value
+			recv := m["magicsock_recv_data_derp"].Value
+			if sent == 0 || recv == 0 {
+				return fmt.Errorf("DERP data packets: sent=%d recv=%d; want both > 0", sent, recv)
+			}
+			t.Logf("[%s] DERP data packets: sent=%d recv=%d", n.Name(), sent, recv)
+			return nil
+		}); err != nil {
+			t.Errorf("[%s] %v", n.Name(), err)
+		}
+	}
+
+	ctx, cancel := context.WithTimeout(t.Context(), 30*time.Second)
+	defer cancel()
+
+	for _, n := range []*vmtest.Node{n1, n2} {
+		rep, err := n.Agent().DebugDERPRegion(ctx, "1")
+		if err != nil {
+			t.Fatalf("[%s] DebugDERPRegion(1): %v", n.Name(), err)
+		}
+		t.Logf("[%s] DebugDERPRegion(1): info=%v warnings=%v errors=%v",
+			n.Name(), rep.Info, rep.Warnings, rep.Errors)
+		if len(rep.Errors) > 0 {
+			t.Errorf("[%s] DebugDERPRegion(1) reported errors: %s",
+				n.Name(), strings.Join(rep.Errors, "; "))
+		}
+	}
+}
diff --git a/tstest/natlab/vmtest/ssh_test.go b/tstest/natlab/vmtest/ssh_test.go
new file mode 100644
index 000000000..8f332922e
--- /dev/null
+++ b/tstest/natlab/vmtest/ssh_test.go
@@ -0,0 +1,235 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package vmtest_test
+
+import (
+	"fmt"
+	"net/netip"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/creachadair/mds/shell"
+	"tailscale.com/tailcfg"
+	"tailscale.com/tstest"
+	"tailscale.com/tstest/natlab/vmtest"
+	"tailscale.com/tstest/natlab/vnet"
+)
+
+// TestTailscaleSSH_Ubuntu exercises the Tailscale SSH server ("tailscale up
+// --ssh", not a system sshd) on an Ubuntu node, with an Ubuntu node as the SSH
+// client. It tests logging in as both root and a non-root user, which
+// exercises the incubator's su-based login path.
+func TestTailscaleSSH_Ubuntu(t *testing.T) {
+	testSuite := newTestSuite(t, "ubuntu", vmtest.Ubuntu2404)
+
+	ubuntu := testSuite.server
+
+	if out, err := testSuite.env.SSHExec(ubuntu, "useradd -m -s /bin/bash tsuser"); err != nil {
+		t.Fatalf("useradd: %v\n%s", err, out)
+	}
+
+	testSuite.waitSSH(t, "ubuntu", "root")
+
+	testSuite.check(t, "ubuntu root login", "root", "id -un && pwd", "root\n/root")
+	testSuite.check(t, "ubuntu non-root login", "tsuser", "id -un && pwd", "tsuser\n/home/tsuser")
+
+	if out, code := testSuite.ssh(t, "nosuchuser", "true"); code == 0 {
+		t.Errorf("ubuntu nonexistent user: ssh succeeded, want failure:\n%s", out)
+	}
+
+	testSuite.checkAutogroupNonroot(t, "ubuntu")
+}
+
+// TestTailscaleSSH_FreeBSD exercises the Tailscale SSH server ("tailscale up
+// --ssh", not a system sshd) on a FreeBSD node, with an Ubuntu node as the SSH
+// client. It tests logging in as both root and a non-root user, which
+// exercises the incubator's su-based login path.
+func TestTailscaleSSH_FreeBSD(t *testing.T) {
+	testSuite := newTestSuite(t, "freebsd", vmtest.FreeBSD150)
+
+	freebsd := testSuite.server
+
+	if out, err := testSuite.env.SSHExec(freebsd, "pw useradd tsuser -m"); err != nil {
+		t.Fatalf("pw useradd: %v\n%s", err, out)
+	}
+
+	testSuite.waitSSH(t, "freebsd", "root")
+
+	testSuite.check(t, "freebsd root login", "root", "id -un && pwd", "root\n/root")
+	testSuite.check(t, "freebsd non-root login", "tsuser", "id -un && pwd", "tsuser\n/home/tsuser")
+
+	if out, code := testSuite.ssh(t, "nosuchuser", "true"); code == 0 {
+		t.Errorf("freebsd nonexistent user: ssh succeeded, want failure:\n%s", out)
+	}
+
+	testSuite.checkAutogroupNonroot(t, "freebsd")
+}
+
+// TestTailscaleSSH_Gokrazy exercises the gokrazy-specific cases in the
+// Tailscale SSH server ("tailscale up --ssh", not a system sshd), with an
+// Ubuntu node as the SSH client. util/osuser hard-codes the login shell to
+// /tmp/serial-busybox/ash and falls back to a synthesized root user (uid 0,
+// home dir "/") when user lookup fails, since gokrazy has no user database;
+// and the incubator's findSU refuses to use su on gokrazy, so sessions are
+// handled in-process.
+func TestTailscaleSSH_Gokrazy(t *testing.T) {
+	testSuite := newTestSuite(t, "gokrazy", vmtest.Gokrazy)
+
+	testSuite.waitSSH(t, "gokrazy", "root")
+
+	// $0 is the login shell the session ran the command with, which on gokrazy
+	// is hard-coded rather than looked up with getent. These sessions also
+	// implicitly exercise the incubator's su-less in-process path, since
+	// gokrazy has no su.
+	testSuite.check(t, "gokrazy root login shell", "root", "echo $0", "/tmp/serial-busybox/ash")
+	testSuite.check(t, "gokrazy nonexistent user maps to root", "nosuchuser", "pwd", "/")
+}
+
+// ssh runs cmd as user on the node at ip over Tailscale SSH, from the
+// client node, returning the combined output and the ssh client's exit
+// code. The command run via Env.SSHExec always exits 0 so that its
+// transport-error (exit 255) retry loop doesn't kick in when a
+// Tailscale SSH connection is expected to fail.
+const exitMarker = "tailscale-ssh-exit="
+
+type sshTest struct {
+	client   *vmtest.Node
+	server   *vmtest.Node
+	serverIP netip.Addr
+	env      *vmtest.Env
+}
+
+// ssh runs a command as the specified user on the [sshTest.server] via its
+// debug SSH NIC.
+func (st *sshTest) ssh(t *testing.T, user string, cmd string) (string, int) {
+	t.Helper()
+
+	inner := "ssh" +
+		" -o StrictHostKeyChecking=no" +
+		" -o UserKnownHostsFile=/dev/null" +
+		" -o BatchMode=yes" +
+		" -o ConnectTimeout=10" +
+		" -o LogLevel=ERROR" +
+		" " + user + "@" + st.serverIP.String() +
+		" " + shell.Quote(cmd)
+	out, err := st.env.SSHExec(st.client, inner+" 2>&1; echo "+exitMarker+"$?")
+	if err != nil {
+		t.Fatalf("ssh %s@%s: %v\n%s", user, st.serverIP, err, out)
+	}
+	i := strings.LastIndex(out, exitMarker)
+	if i == -1 {
+		t.Fatalf("ssh %s@%s: no exit marker in output:\n%s", user, st.serverIP, out)
+	}
+	code, err := strconv.Atoi(strings.TrimSpace(out[i+len(exitMarker):]))
+	if err != nil {
+		t.Fatalf("ssh %s@%s: bad exit marker in output:\n%s", user, st.serverIP, out)
+	}
+	return strings.TrimSpace(out[:i]), code
+}
+
+// waitSSH waits for the node's Tailscale SSH server to accept a
+// connection; the first one can race tailscaled's SSH server startup
+// and WireGuard path setup.
+func (st *sshTest) waitSSH(t *testing.T, name, user string) {
+	t.Helper()
+	deadline := time.Now().Add(2 * time.Minute)
+	for {
+		out, code := st.ssh(t, user, "echo ok")
+		if code == 0 && strings.Contains(out, "ok") {
+			t.Logf("[%s] Tailscale SSH up as %s@%s", name, user, st.serverIP)
+			return
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("[%s] Tailscale SSH as %s@%s never came up; last output (exit %d):\n%s", name, user, st.serverIP, code, out)
+		}
+		time.Sleep(2 * time.Second)
+	}
+}
+
+// check attempts to execute a command as specified user on the server, failing
+// if the output isn't what is expected.
+func (st *sshTest) check(t *testing.T, desc, user string, cmd, want string) {
+	t.Helper()
+	out, code := st.ssh(t, user, cmd)
+	if code != 0 {
+		t.Errorf("%s: ssh %s@%s %q exited %d:\n%s", desc, user, st.serverIP, cmd, code, out)
+		return
+	}
+	if out != want {
+		t.Errorf("%s: ssh %s@%s %q = %q, want %q", desc, user, st.serverIP, cmd, out, want)
+	}
+}
+
+// checkAutogroupNonroot adjusts the server's SSH policy to be equivalent to "autogroup:nonroot"
+// and verifies that attempting to SSH as root fails.
+func (st *sshTest) checkAutogroupNonroot(t *testing.T, name string) {
+	t.Helper()
+	orignalSSHPolicy := st.env.ControlServer().SSHPolicy
+	defer func() {
+		st.env.ControlServer().SetSSHPolicy(orignalSSHPolicy)
+	}()
+
+	st.env.ControlServer().SetSSHPolicy(&tailcfg.SSHPolicy{
+		Rules: []*tailcfg.SSHRule{{
+			Principals: []*tailcfg.SSHPrincipal{{Any: true}},
+			SSHUsers:   map[string]string{"*": "="},
+			Action:     &tailcfg.SSHAction{Accept: true},
+		}},
+	})
+
+	if err := tstest.WaitFor(30*time.Second, func() error {
+		_, code := st.ssh(t, "root", "true")
+		if code == 0 {
+			return fmt.Errorf("root SSH still succeeds")
+		}
+		return nil
+	}); err != nil {
+		t.Fatalf("%s: root SSH still succeeds after policy update to autogroup:nonroot-only; policy may not have propagated", name)
+	}
+}
+
+func newTestSuite(t *testing.T, serverName string, serverOS vmtest.OSImage) *sshTest {
+	t.Helper()
+	env := vmtest.New(t)
+	client := sshTestNode(env, "client", vmtest.Ubuntu2404)
+	server := sshTestNode(env, serverName, serverOS, vmtest.TailscaleSSH())
+	env.Start()
+
+	serverIP := tailscaleIP4(t, env, server)
+
+	return &sshTest{
+		client:   client,
+		server:   server,
+		serverIP: serverIP,
+		env:      env,
+	}
+}
+
+// sshTestNode adds a node named name running img behind its own
+// easy-NAT network.
+func sshTestNode(env *vmtest.Env, name string, img vmtest.OSImage, opts ...any) *vmtest.Node {
+	n := env.NumNodes()
+	opts = append([]any{
+		env.AddNetwork(
+			fmt.Sprintf("2.%d.%d.%d", n, n, n), // public IP
+			fmt.Sprintf("192.168.%d.1/24", n), vnet.EasyNAT),
+		vmtest.OS(img),
+	}, opts...)
+	return env.AddNode(name, opts...)
+}
+
+// tailscaleIP4 returns the node's IPv4 Tailscale address.
+func tailscaleIP4(t *testing.T, env *vmtest.Env, n *vmtest.Node) netip.Addr {
+	t.Helper()
+	st := env.Status(n)
+	for _, ip := range st.Self.TailscaleIPs {
+		if ip.Is4() {
+			return ip
+		}
+	}
+	t.Fatalf("no IPv4 Tailscale address for %s; have %v", n.Name(), st.Self.TailscaleIPs)
+	panic("unreachable")
+}
diff --git a/tstest/natlab/vmtest/systemd_test.go b/tstest/natlab/vmtest/systemd_test.go
new file mode 100644
index 000000000..360cd6b6d
--- /dev/null
+++ b/tstest/natlab/vmtest/systemd_test.go
@@ -0,0 +1,48 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package vmtest_test
+
+import (
+	"strings"
+	"testing"
+
+	"tailscale.com/tstest/natlab/vmtest"
+	"tailscale.com/tstest/natlab/vnet"
+)
+
+// TestUbuntuSystemdUnit runs tailscaled on an Ubuntu node via the stock
+// systemd unit that Linux packages ship (cmd/tailscaled/tailscaled.service)
+// rather than launching the binary directly, exercising the unit's
+// directives (EnvironmentFile, RuntimeDirectory, StateDirectory) and its
+// Type=notify readiness handshake. Env.Start already asserts that the node
+// reaches the Running backend state under that unit.
+func TestUbuntuSystemdUnit(t *testing.T) {
+	env := vmtest.New(t)
+	node := env.AddNode("node",
+		env.AddNetwork("2.1.1.1", "192.168.1.1/24", vnet.EasyNAT),
+		vmtest.OS(vmtest.Ubuntu2404),
+		vmtest.SystemdUnit())
+	env.Start()
+
+	// With Type=notify, systemd only reports the unit active after
+	// tailscaled sends READY=1, so this also verifies the sd_notify
+	// handshake worked.
+	out, err := env.SSHExec(node, "systemctl is-active tailscaled.service")
+	if err != nil {
+		t.Fatalf("systemctl is-active: %v\n%s", err, out)
+	}
+	if got := strings.TrimSpace(out); got != "active" {
+		t.Fatalf("tailscaled.service state = %q, want %q", got, "active")
+	}
+
+	// Verify the tailscaled that TTA talked to is the one systemd runs,
+	// not a stray process started some other way.
+	out, err = env.SSHExec(node, `test "$(systemctl show -p MainPID --value tailscaled.service)" = "$(pidof tailscaled)" && echo match`)
+	if err != nil {
+		t.Fatalf("MainPID check: %v\n%s", err, out)
+	}
+	if got := strings.TrimSpace(out); got != "match" {
+		t.Fatalf("MainPID check output = %q, want %q", got, "match")
+	}
+}
diff --git a/tstest/natlab/vmtest/tailmac.go b/tstest/natlab/vmtest/tailmac.go
new file mode 100644
index 000000000..ad133a1fc
--- /dev/null
+++ b/tstest/natlab/vmtest/tailmac.go
@@ -0,0 +1,736 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package vmtest
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/netip"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"golang.org/x/crypto/ssh"
+)
+
+// macPlatform boots macOS VMs via Tart base images and tailmac Host.app.
+type macPlatform struct{}
+
+func (macPlatform) planSteps(e *Env, n *Node) {
+	e.Step("Prepare macOS Tart image")
+	e.Step("Launch macOS VM: " + n.name)
+}
+
+func (macPlatform) boot(ctx context.Context, e *Env, n *Node) error {
+	imgStep := e.Step("Prepare macOS Tart image")
+	e.macosSnapshotOnce.Do(func() {
+		imgStep.Begin()
+		e.macosSnapshot = ensureSnapshot(e.t)
+		imgStep.End(nil)
+	})
+
+	e.ensureDgramSocket()
+
+	vmStep := e.Step("Launch macOS VM: " + n.name)
+	vmStep.Begin()
+	if err := e.startTailMacVM(n); err != nil {
+		vmStep.End(err)
+		return err
+	}
+	vmStep.End(nil)
+	return nil
+}
+
+const tartImage = "ghcr.io/cirruslabs/macos-tahoe-base:latest"
+
+// macOSSnapshotCodeVersion is bumped when the snapshot preparation logic
+// changes in a way that invalidates old snapshots. Old snapshots with a
+// different version are cleaned up automatically.
+const macOSSnapshotCodeVersion = 5
+
+// tartConfig is the subset of Tart's config.json we need.
+type tartConfig struct {
+	HardwareModel string `json:"hardwareModel"` // base64
+	ECID          string `json:"ecid"`          // base64
+}
+
+// tartManifest is the subset of Tart's OCI manifest.json we need.
+type tartManifest struct {
+	Config struct {
+		Digest string `json:"digest"` // e.g. "sha256:3a6cb4eb6201..."
+	} `json:"config"`
+}
+
+// ensureTartImage checks that the Tart base image is available, pulling it
+// if necessary. Returns the path to the OCI cache directory containing
+// disk.img, nvram.bin, config.json, and manifest.json.
+func ensureTartImage(t testing.TB) string {
+	if _, err := exec.LookPath("tart"); err != nil {
+		t.Skip("tart not installed; skipping macOS VM test")
+	}
+
+	home, err := os.UserHomeDir()
+	if err != nil {
+		t.Fatalf("UserHomeDir: %v", err)
+	}
+
+	ociDir := filepath.Join(home, ".tart", "cache", "OCIs",
+		"ghcr.io", "cirruslabs", "macos-tahoe-base", "latest")
+	if _, err := os.Stat(filepath.Join(ociDir, "disk.img")); err == nil {
+		return ociDir
+	}
+
+	t.Logf("pulling Tart image %s ...", tartImage)
+	cmd := exec.Command("tart", "pull", tartImage)
+	cmd.Stdout = os.Stderr
+	cmd.Stderr = os.Stderr
+	if err := cmd.Run(); err != nil {
+		t.Fatalf("tart pull: %v", err)
+	}
+
+	if _, err := os.Stat(filepath.Join(ociDir, "disk.img")); err == nil {
+		return ociDir
+	}
+	t.Fatalf("tart pull succeeded but image not found at %s", ociDir)
+	return ""
+}
+
+// snapshotCacheKey computes a cache key for the macOS VM snapshot.
+// The key combines the image name, the first 12 hex chars of the Tart
+// config digest (changes when the upstream image is updated), and the
+// snapshot code version (changes when our prep logic changes).
+func snapshotCacheKey(tartDir string) (string, error) {
+	manifestPath := filepath.Join(tartDir, "manifest.json")
+	data, err := os.ReadFile(manifestPath)
+	if err != nil {
+		return "", fmt.Errorf("reading manifest: %w", err)
+	}
+	var m tartManifest
+	if err := json.Unmarshal(data, &m); err != nil {
+		return "", fmt.Errorf("parsing manifest: %w", err)
+	}
+	digest := m.Config.Digest
+	// Strip "sha256:" prefix and take first 12 hex chars.
+	digest = strings.TrimPrefix(digest, "sha256:")
+	if len(digest) > 12 {
+		digest = digest[:12]
+	}
+	return fmt.Sprintf("snap-tahoe-%s-v%d", digest, macOSSnapshotCodeVersion), nil
+}
+
+// macosVMBaseDir returns ~/.cache/tailscale/vmtest/macos/, the directory
+// where Host.app expects to find VM directories by ID.
+func macosVMBaseDir() (string, error) {
+	home, err := os.UserHomeDir()
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(home, ".cache", "tailscale", "vmtest", "macos"), nil
+}
+
+// cleanOldSnapshots removes any snapshot directories for the given image
+// prefix (e.g. "snap-tahoe") that don't match the current cache key.
+func cleanOldSnapshots(t testing.TB, imagePrefix, currentKey string) {
+	base, err := macosVMBaseDir()
+	if err != nil {
+		return
+	}
+	matches, _ := filepath.Glob(filepath.Join(base, imagePrefix+"-*"))
+	currentPath := filepath.Join(base, currentKey)
+	for _, m := range matches {
+		if m != currentPath {
+			t.Logf("removing stale snapshot: %s", filepath.Base(m))
+			os.RemoveAll(m)
+		}
+	}
+}
+
+// ensureSnapshot returns the path to a cached macOS VM snapshot, creating
+// one if necessary. The snapshot contains a fully booted VM with
+// SaveFile.vzvmsave ready for fast restore.
+func ensureSnapshot(t testing.TB) string {
+	tartDir := ensureTartImage(t)
+
+	key, err := snapshotCacheKey(tartDir)
+	if err != nil {
+		t.Fatalf("snapshot cache key: %v", err)
+	}
+
+	base, err := macosVMBaseDir()
+	if err != nil {
+		t.Fatalf("macOS VM base dir: %v", err)
+	}
+	os.MkdirAll(base, 0755)
+
+	snapDir := filepath.Join(base, key)
+	saveFile := filepath.Join(snapDir, "SaveFile.vzvmsave")
+	if _, err := os.Stat(saveFile); err == nil {
+		t.Logf("using cached macOS snapshot: %s", key)
+		return snapDir
+	}
+
+	// Clean up old snapshots for this image.
+	cleanOldSnapshots(t, "snap-tahoe", key)
+
+	t.Logf("preparing macOS snapshot: %s (this takes ~30s on first run)", key)
+	if err := prepareSnapshot(t, tartDir, snapDir); err != nil {
+		os.RemoveAll(snapDir)
+		t.Fatalf("preparing snapshot: %v", err)
+	}
+	return snapDir
+}
+
+// prepareSnapshot creates a new macOS VM snapshot by booting the Tart base
+// image with a NAT NIC, waiting for SSH, and saving VM state.
+func prepareSnapshot(t testing.TB, tartDir, snapDir string) error {
+	// The vmID must match the directory name under macosVMBaseDir
+	// because Host.app looks up VM files at <base>/<vmID>/.
+	snapID := filepath.Base(snapDir)
+
+	if err := cloneTartToTailmac(tartDir, snapDir, snapID, "52:cc:cc:cc:ce:01", "/dev/null"); err != nil {
+		return fmt.Errorf("cloning tart: %w", err)
+	}
+
+	modRoot, err := findModRoot()
+	if err != nil {
+		return err
+	}
+	tailmacDir := filepath.Join(modRoot, "tstest", "tailmac", "bin")
+	hostBin := filepath.Join(tailmacDir, "Host.app", "Contents", "MacOS", "Host")
+	if _, err := os.Stat(hostBin); err != nil {
+		return fmt.Errorf("Host.app not found at %s; run 'make all' in tstest/tailmac/", hostBin)
+	}
+
+	// Host.app reads VM files from ~/.cache/tailscale/vmtest/macos/<id>/.
+	// Our snapDir is already under that tree, and the config.json vmID matches.
+	cmd := exec.Command(hostBin, "run", "--id", snapID, "--headless", "--nat-nic")
+	cmd.Env = append(os.Environ(), "NSUnbufferedIO=YES")
+
+	logPath := snapDir + ".prep.log"
+	logFile, err := os.Create(logPath)
+	if err != nil {
+		return err
+	}
+	defer logFile.Close()
+	cmd.Stdout = logFile
+	cmd.Stderr = logFile
+	devNull, _ := os.Open(os.DevNull)
+	cmd.Stdin = devNull
+	defer devNull.Close()
+
+	if err := cmd.Start(); err != nil {
+		return fmt.Errorf("starting Host.app: %w", err)
+	}
+	t.Logf("snapshot prep: launched Host.app (pid %d)", cmd.Process.Pid)
+
+	// Wait for SSH to become available via the NAT NIC.
+	// The VM gets an IP from macOS's vmnet DHCP (typically 192.168.64.x).
+	ip, err := waitForVMIP(t, "52:cc:cc:cc:ce:01", 60*time.Second)
+	if err != nil {
+		cmd.Process.Kill()
+		cmd.Wait()
+		return fmt.Errorf("waiting for VM IP: %w", err)
+	}
+	t.Logf("snapshot prep: VM IP is %s, waiting for SSH...", ip)
+
+	sc, err := waitForSSH(ip, 60*time.Second)
+	if err != nil {
+		cmd.Process.Kill()
+		cmd.Wait()
+		return fmt.Errorf("waiting for SSH: %w", err)
+	}
+	t.Logf("snapshot prep: SSH connected")
+
+	// Compile and install TTA in the macOS VM.
+	t.Logf("snapshot prep: installing TTA...")
+	if err := installTTA(t, sc); err != nil {
+		sc.Close()
+		cmd.Process.Kill()
+		cmd.Wait()
+		return fmt.Errorf("installing TTA: %w", err)
+	}
+	sc.Close()
+
+	// Save VM state by sending SIGINT.
+	t.Logf("snapshot prep: saving VM state...")
+	cmd.Process.Signal(os.Interrupt)
+	done := make(chan error, 1)
+	go func() { done <- cmd.Wait() }()
+	select {
+	case err := <-done:
+		if err != nil {
+			// Host.app exits 0 after saving state, non-zero is unexpected.
+			t.Logf("snapshot prep: Host.app exited with: %v", err)
+		}
+	case <-time.After(60 * time.Second):
+		cmd.Process.Kill()
+		<-done
+		return fmt.Errorf("Host.app did not exit after SIGINT")
+	}
+
+	// Verify the save file was created.
+	saveFile := filepath.Join(snapDir, "SaveFile.vzvmsave")
+	if _, err := os.Stat(saveFile); err != nil {
+		return fmt.Errorf("SaveFile.vzvmsave not found after prep")
+	}
+	t.Logf("snapshot prep: done, saved to %s", filepath.Base(snapDir))
+	os.Remove(logPath)
+	return nil
+}
+
+// installTTA compiles TTA for darwin/arm64 and installs it in the macOS VM
+// as a LaunchDaemon via SSH/SCP.
+func installTTA(t testing.TB, sc *ssh.Client) error {
+	modRoot, err := findModRoot()
+	if err != nil {
+		return err
+	}
+
+	// Compile TTA for the macOS VM.
+	tmpDir := t.TempDir()
+	ttaBin := filepath.Join(tmpDir, "tta")
+	t.Logf("snapshot prep: compiling TTA for darwin/arm64...")
+	buildCmd := exec.Command("go", "build", "-o", ttaBin, "./cmd/tta")
+	buildCmd.Dir = modRoot
+	buildCmd.Env = append(os.Environ(), "GOOS=darwin", "GOARCH=arm64", "CGO_ENABLED=0")
+	if out, err := buildCmd.CombinedOutput(); err != nil {
+		return fmt.Errorf("compiling TTA: %v\n%s", err, out)
+	}
+
+	// Read the binary.
+	ttaData, err := os.ReadFile(ttaBin)
+	if err != nil {
+		return fmt.Errorf("reading TTA binary: %w", err)
+	}
+	t.Logf("snapshot prep: TTA binary is %d bytes", len(ttaData))
+
+	// SCP the TTA binary to the VM via a temp file (admin user can't write /usr/local/bin directly).
+	if err := scpFile(sc, ttaData, "/tmp/tta", 0755); err != nil {
+		return fmt.Errorf("uploading TTA: %w", err)
+	}
+	if err := runSSHCmd(sc, "echo admin | sudo -S mv /tmp/tta /usr/local/bin/tta"); err != nil {
+		return fmt.Errorf("moving TTA to /usr/local/bin: %w", err)
+	}
+
+	// Install the LaunchDaemon plist.
+	plist := `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>Label</key>
+	<string>com.tailscale.tta</string>
+	<key>ProgramArguments</key>
+	<array>
+		<string>/usr/local/bin/tta</string>
+	</array>
+	<key>RunAtLoad</key>
+	<true/>
+	<key>KeepAlive</key>
+	<true/>
+	<key>StandardOutPath</key>
+	<string>/tmp/tta.log</string>
+	<key>StandardErrorPath</key>
+	<string>/tmp/tta.log</string>
+</dict>
+</plist>
+`
+	if err := scpFile(sc, []byte(plist), "/tmp/com.tailscale.tta.plist", 0644); err != nil {
+		return fmt.Errorf("uploading plist: %w", err)
+	}
+	if err := runSSHCmd(sc, "echo admin | sudo -S mv /tmp/com.tailscale.tta.plist /Library/LaunchDaemons/ && echo admin | sudo -S chown root:wheel /Library/LaunchDaemons/com.tailscale.tta.plist"); err != nil {
+		return fmt.Errorf("installing plist: %w", err)
+	}
+
+	// Load the LaunchDaemon.
+	if err := runSSHCmd(sc, "echo admin | sudo -S launchctl load /Library/LaunchDaemons/com.tailscale.tta.plist"); err != nil {
+		return fmt.Errorf("loading LaunchDaemon: %w", err)
+	}
+
+	// Wait for TTA to start.
+	for range 20 {
+		if err := runSSHCmd(sc, "pgrep -x tta"); err == nil {
+			break
+		}
+		time.Sleep(250 * time.Millisecond)
+	}
+	if err := runSSHCmd(sc, "pgrep -x tta"); err != nil {
+		return fmt.Errorf("TTA not running after install: %w", err)
+	}
+	t.Logf("snapshot prep: TTA installed and running")
+	return nil
+}
+
+// scpFile uploads data to a remote path via SSH/SCP.
+func scpFile(sc *ssh.Client, data []byte, remotePath string, mode os.FileMode) error {
+	sess, err := sc.NewSession()
+	if err != nil {
+		return err
+	}
+	defer sess.Close()
+
+	// Use a simple shell command to write the file.
+	cmd := fmt.Sprintf("cat > %s && chmod %o %s", remotePath, mode, remotePath)
+	sess.Stdin = bytes.NewReader(data)
+	out, err := sess.CombinedOutput(cmd)
+	if err != nil {
+		return fmt.Errorf("%s: %v: %s", cmd, err, out)
+	}
+	return nil
+}
+
+// runSSHCmd runs a command on the SSH client and returns an error if it fails.
+func runSSHCmd(sc *ssh.Client, cmd string) error {
+	sess, err := sc.NewSession()
+	if err != nil {
+		return err
+	}
+	defer sess.Close()
+	out, err := sess.CombinedOutput(cmd)
+	if err != nil {
+		return fmt.Errorf("%s: %v: %s", cmd, err, out)
+	}
+	return nil
+}
+
+// waitForVMIP polls /var/db/dhcpd_leases for a DHCP lease matching the
+// given MAC address (from macOS's vmnet NAT). Returns the IP.
+func waitForVMIP(t testing.TB, mac string, timeout time.Duration) (string, error) {
+	// Normalize MAC format: vmnet leases use "1,xx:xx:xx:xx:xx:xx" format
+	// with leading zeros stripped from each octet (e.g. "1,52:cc:cc:cc:ce:1"
+	// instead of "1,52:cc:cc:cc:ce:01").
+	mac = strings.ToLower(mac)
+	parts := strings.Split(mac, ":")
+	for i, p := range parts {
+		parts[i] = strings.TrimLeft(p, "0")
+		if parts[i] == "" {
+			parts[i] = "0"
+		}
+	}
+	leaseMAC := "1," + strings.Join(parts, ":")
+
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		data, err := os.ReadFile("/var/db/dhcpd_leases")
+		if err == nil {
+			// Parse the plist-like lease file.
+			lines := strings.Split(string(data), "\n")
+			var currentIP string
+			for _, line := range lines {
+				line = strings.TrimSpace(line)
+				if after, ok := strings.CutPrefix(line, "ip_address="); ok {
+					currentIP = after
+				}
+				if after, ok := strings.CutPrefix(line, "hw_address="); ok {
+					hw := after
+					if strings.ToLower(hw) == leaseMAC && currentIP != "" {
+						return currentIP, nil
+					}
+				}
+				if line == "}" {
+					currentIP = ""
+				}
+			}
+		}
+		time.Sleep(time.Second)
+	}
+	return "", fmt.Errorf("no DHCP lease for MAC %s after %v", mac, timeout)
+}
+
+// waitForSSH retries SSH connection to the given IP until it succeeds or
+// the timeout expires.
+func waitForSSH(ip string, timeout time.Duration) (*ssh.Client, error) {
+	deadline := time.Now().Add(timeout)
+	addr := net.JoinHostPort(ip, "22")
+	cfg := &ssh.ClientConfig{
+		User:            "admin",
+		Auth:            []ssh.AuthMethod{ssh.Password("admin")},
+		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
+		Timeout:         2 * time.Second,
+	}
+	for time.Now().Before(deadline) {
+		sc, err := ssh.Dial("tcp", addr, cfg)
+		if err == nil {
+			return sc, nil
+		}
+		time.Sleep(time.Second)
+	}
+	return nil, fmt.Errorf("SSH to %s timed out after %v", addr, timeout)
+}
+
+// ensureTailMac locates the pre-built tailmac Host.app binary.
+func (e *Env) ensureTailMac() error {
+	modRoot, err := findModRoot()
+	if err != nil {
+		return err
+	}
+	e.tailmacDir = filepath.Join(modRoot, "tstest", "tailmac", "bin")
+	hostApp := filepath.Join(e.tailmacDir, "Host.app", "Contents", "MacOS", "Host")
+	if _, err := os.Stat(hostApp); err != nil {
+		return fmt.Errorf("tailmac Host.app not found at %s; run 'make all' in tstest/tailmac/", hostApp)
+	}
+	return nil
+}
+
+// cloneTartToTailmac creates a tailmac-compatible VM directory from a Tart
+// base image. It uses APFS CoW clones for the disk and NVRAM, and extracts
+// the hardware identity from Tart's config.json.
+func cloneTartToTailmac(tartDir, cloneDir, testID, mac, dgramSock string) error {
+	if err := os.MkdirAll(cloneDir, 0755); err != nil {
+		return err
+	}
+
+	cfgData, err := os.ReadFile(filepath.Join(tartDir, "config.json"))
+	if err != nil {
+		return fmt.Errorf("reading tart config: %w", err)
+	}
+	var tc tartConfig
+	if err := json.Unmarshal(cfgData, &tc); err != nil {
+		return fmt.Errorf("parsing tart config: %w", err)
+	}
+
+	hwModel, err := base64.StdEncoding.DecodeString(tc.HardwareModel)
+	if err != nil {
+		return fmt.Errorf("decoding hardwareModel: %w", err)
+	}
+	if err := os.WriteFile(filepath.Join(cloneDir, "HardwareModel"), hwModel, 0644); err != nil {
+		return err
+	}
+
+	ecid, err := base64.StdEncoding.DecodeString(tc.ECID)
+	if err != nil {
+		return fmt.Errorf("decoding ecid: %w", err)
+	}
+	if err := os.WriteFile(filepath.Join(cloneDir, "MachineIdentifier"), ecid, 0644); err != nil {
+		return err
+	}
+
+	if out, err := exec.Command("cp", "-c", filepath.Join(tartDir, "disk.img"), filepath.Join(cloneDir, "Disk.img")).CombinedOutput(); err != nil {
+		if out2, err2 := exec.Command("cp", filepath.Join(tartDir, "disk.img"), filepath.Join(cloneDir, "Disk.img")).CombinedOutput(); err2 != nil {
+			return fmt.Errorf("copying disk: %v: %s (APFS clone: %v: %s)", err2, out2, err, out)
+		}
+	}
+
+	if out, err := exec.Command("cp", "-c", filepath.Join(tartDir, "nvram.bin"), filepath.Join(cloneDir, "AuxiliaryStorage")).CombinedOutput(); err != nil {
+		if out2, err2 := exec.Command("cp", filepath.Join(tartDir, "nvram.bin"), filepath.Join(cloneDir, "AuxiliaryStorage")).CombinedOutput(); err2 != nil {
+			return fmt.Errorf("copying nvram: %v: %s (APFS clone: %v: %s)", err2, out2, err, out)
+		}
+	}
+
+	tmCfg := struct {
+		VMid         string `json:"vmID"`
+		ServerSocket string `json:"serverSocket"`
+		MemorySize   uint64 `json:"memorySize"`
+		Mac          string `json:"mac"`
+	}{
+		VMid:         testID,
+		ServerSocket: dgramSock,
+		MemorySize:   4 * 1024 * 1024 * 1024,
+		Mac:          mac,
+	}
+	tmData, _ := json.MarshalIndent(tmCfg, "", "  ")
+	return os.WriteFile(filepath.Join(cloneDir, "config.json"), tmData, 0644)
+}
+
+// startTailMacVM restores a macOS VM from a cached snapshot and launches it
+// via tailmac Host.app in headless mode, connected to vnet's dgram socket.
+func (e *Env) startTailMacVM(n *Node) error {
+	snapDir := e.macosSnapshot
+
+	if err := e.ensureTailMac(); err != nil {
+		return err
+	}
+
+	testID := fmt.Sprintf("vmtest-%s-%d", n.name, os.Getpid())
+
+	// Host.app expects VM files under ~/.cache/tailscale/vmtest/macos/<id>/
+	home, err := os.UserHomeDir()
+	if err != nil {
+		return fmt.Errorf("UserHomeDir: %w", err)
+	}
+	vmBase := filepath.Join(home, ".cache", "tailscale", "vmtest", "macos")
+	os.MkdirAll(vmBase, 0755)
+	cloneDir := filepath.Join(vmBase, testID)
+
+	// APFS clone the entire snapshot directory (includes SaveFile.vzvmsave).
+	e.t.Logf("[%s] cloning snapshot -> %s", n.name, testID)
+	if out, err := exec.Command("cp", "-c", "-r", snapDir, cloneDir).CombinedOutput(); err != nil {
+		if out2, err2 := exec.Command("cp", "-r", snapDir, cloneDir).CombinedOutput(); err2 != nil {
+			return fmt.Errorf("cloning snapshot: %v: %s (APFS clone: %v: %s)", err2, out2, err, out)
+		}
+	}
+	e.t.Cleanup(func() { os.RemoveAll(cloneDir) })
+
+	// Write test-specific config.json with the vnet MAC and dgram socket.
+	mac := n.vnetNode.NICMac(0)
+	cfg := struct {
+		VMid         string `json:"vmID"`
+		ServerSocket string `json:"serverSocket"`
+		MemorySize   uint64 `json:"memorySize"`
+		Mac          string `json:"mac"`
+	}{
+		VMid:         testID,
+		ServerSocket: e.dgramSockAddr,
+		MemorySize:   8 * 1024 * 1024 * 1024,
+		Mac:          mac.String(),
+	}
+	cfgData, _ := json.MarshalIndent(cfg, "", "  ")
+	if err := os.WriteFile(filepath.Join(cloneDir, "config.json"), cfgData, 0644); err != nil {
+		return fmt.Errorf("writing config.json: %w", err)
+	}
+
+	// Launch Host.app with disconnected NIC + hot-swap to vnet.
+	// Host.app will restore from SaveFile.vzvmsave (fast), then
+	// hot-swap the NIC to the vnet dgram socket.
+	hostBin := filepath.Join(e.tailmacDir, "Host.app", "Contents", "MacOS", "Host")
+
+	// Compute the node's IP and gateway for static assignment via vsock.
+	nodeIP := n.vnetNode.LanIP(n.nets[0])
+	// The gateway is the network's base address (e.g. 192.168.1.1 for /24).
+	// We derive it from the node IP: same /24 prefix, host part = 1.
+	gwIP := nodeIP.As4()
+	gwIP[3] = 1
+	gateway := netip.AddrFrom4(gwIP)
+
+	args := []string{
+		"run", "--id", testID, "--headless",
+		"--disconnected-nic",
+		"--attach-network", e.dgramSockAddr,
+		"--assign-ip", fmt.Sprintf("%s/255.255.255.0/%s", nodeIP, gateway),
+	}
+
+	wantScreenshots := *vmtestWeb != ""
+	if wantScreenshots {
+		args = append(args, "--screenshot-port", "0")
+	}
+
+	logPath := filepath.Join(e.tempDir, n.name+"-tailmac.log")
+	logFile, err := os.Create(logPath)
+	if err != nil {
+		return fmt.Errorf("creating log file: %w", err)
+	}
+
+	cmd := exec.Command(hostBin, args...)
+	cmd.Env = append(os.Environ(), "NSUnbufferedIO=YES")
+
+	var stdoutPipe io.ReadCloser
+	if wantScreenshots {
+		stdoutPipe, err = cmd.StdoutPipe()
+		if err != nil {
+			logFile.Close()
+			return fmt.Errorf("stdout pipe: %w", err)
+		}
+		cmd.Stderr = logFile
+	} else {
+		cmd.Stdout = logFile
+		cmd.Stderr = logFile
+	}
+	devNull, err := os.Open(os.DevNull)
+	if err != nil {
+		logFile.Close()
+		return fmt.Errorf("open /dev/null: %w", err)
+	}
+	cmd.Stdin = devNull
+
+	if err := cmd.Start(); err != nil {
+		devNull.Close()
+		logFile.Close()
+		return fmt.Errorf("starting tailmac for %s: %w", n.name, err)
+	}
+	e.t.Logf("[%s] launched tailmac (pid %d), log: %s", n.name, cmd.Process.Pid, logPath)
+
+	if wantScreenshots {
+		screenshotPortCh := make(chan int, 1)
+		go func() {
+			scanner := bufio.NewScanner(stdoutPipe)
+			for scanner.Scan() {
+				line := scanner.Text()
+				fmt.Fprintln(logFile, line)
+				if port := 0; strings.HasPrefix(line, "SCREENSHOT_PORT=") {
+					fmt.Sscanf(line, "SCREENSHOT_PORT=%d", &port)
+					if port > 0 {
+						screenshotPortCh <- port
+					}
+				}
+			}
+		}()
+		go func() {
+			ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+			defer cancel()
+			select {
+			case port := <-screenshotPortCh:
+				e.t.Logf("[%s] screenshot server on port %d", n.name, port)
+				e.setNodeScreenshotPort(n.name, port)
+				e.tailScreenshots(n.name, port)
+			case <-ctx.Done():
+				e.t.Logf("[%s] screenshot port not received", n.name)
+			}
+		}()
+	}
+
+	clientSock := fmt.Sprintf("/tmp/qemu-dgram-%s.sock", testID)
+
+	e.t.Cleanup(func() {
+		// Kill immediately — no need to save state for ephemeral test clones.
+		cmd.Process.Kill()
+		cmd.Wait()
+		devNull.Close()
+		logFile.Close()
+		os.Remove(clientSock)
+
+		if e.t.Failed() {
+			if data, err := os.ReadFile(logPath); err == nil {
+				lines := strings.Split(string(data), "\n")
+				start := 0
+				if len(lines) > 50 {
+					start = len(lines) - 50
+				}
+				e.t.Logf("=== last 50 lines of %s tailmac log ===", n.name)
+				for _, line := range lines[start:] {
+					e.t.Logf("[%s] %s", n.name, line)
+				}
+			}
+		}
+	})
+
+	return nil
+}
+
+// tailScreenshots polls the Host.app screenshot HTTP server every 2 seconds
+// and publishes each screenshot as a base64 data URI to the web UI.
+func (e *Env) tailScreenshots(name string, port int) {
+	url := fmt.Sprintf("http://127.0.0.1:%d/screenshot", port)
+	client := &http.Client{Timeout: 5 * time.Second}
+	ticker := time.NewTicker(2 * time.Second)
+	defer ticker.Stop()
+
+	for range ticker.C {
+		resp, err := client.Get(url)
+		if err != nil {
+			continue
+		}
+		data, _ := io.ReadAll(resp.Body)
+		resp.Body.Close()
+		if resp.StatusCode != 200 || len(data) == 0 {
+			continue
+		}
+		b64 := base64.StdEncoding.EncodeToString(data)
+		dataURI := "data:image/jpeg;base64," + b64
+		e.setNodeScreenshot(name, dataURI)
+		e.eventBus.Publish(VMEvent{
+			NodeName: name,
+			Type:     EventScreenshot,
+			Message:  b64,
+		})
+	}
+}
diff --git a/tstest/natlab/vmtest/version.go b/tstest/natlab/vmtest/version.go
new file mode 100644
index 000000000..7e76716e4
--- /dev/null
+++ b/tstest/natlab/vmtest/version.go
@@ -0,0 +1,195 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package vmtest
+
+import (
+	"archive/tar"
+	"compress/gzip"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"path"
+	"path/filepath"
+	"regexp"
+	"strconv"
+	"strings"
+
+	"tailscale.com/types/logger"
+)
+
+// versionRE matches a concrete X.Y.Z release version.
+var versionRE = regexp.MustCompile(`^\d+\.\d+\.\d+$`)
+
+// resolveTestVersion returns the concrete release version (e.g. "1.97.255")
+// for the given --test-version flag value. If v is "unstable" or "stable", it
+// queries pkgs.tailscale.com for the latest TarballsVersion on that track.
+// Otherwise it returns v unchanged.
+func resolveTestVersion(ctx context.Context, v string) (string, error) {
+	if v != "unstable" && v != "stable" {
+		if !versionRE.MatchString(v) {
+			return "", fmt.Errorf("invalid --test-version %q: want \"stable\", \"unstable\", or X.Y.Z", v)
+		}
+		return v, nil
+	}
+	url := "https://pkgs.tailscale.com/" + v + "/?mode=json"
+	req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
+	if err != nil {
+		return "", err
+	}
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return "", fmt.Errorf("fetching %s: %w", url, err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != 200 {
+		return "", fmt.Errorf("fetching %s: HTTP %s", url, resp.Status)
+	}
+	var meta struct {
+		TarballsVersion string
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&meta); err != nil {
+		return "", fmt.Errorf("decoding %s: %w", url, err)
+	}
+	if meta.TarballsVersion == "" {
+		return "", fmt.Errorf("no TarballsVersion in %s response", url)
+	}
+	return meta.TarballsVersion, nil
+}
+
+// versionTrack returns the pkgs.tailscale.com track ("stable" or "unstable")
+// for a release version. Even minors are stable; odd minors are unstable.
+func versionTrack(version string) (string, error) {
+	parts := strings.Split(version, ".")
+	if len(parts) < 2 {
+		return "", fmt.Errorf("bad version %q (expected like 1.97.255)", version)
+	}
+	minor, err := strconv.Atoi(parts[1])
+	if err != nil {
+		return "", fmt.Errorf("bad minor in version %q: %w", version, err)
+	}
+	if minor%2 == 0 {
+		return "stable", nil
+	}
+	return "unstable", nil
+}
+
+// versionCacheRoot returns the root cache directory for downloaded version
+// tarballs.
+func versionCacheRoot() string {
+	if d := os.Getenv("VMTEST_BUILDS_CACHE_DIR"); d != "" {
+		return d
+	}
+	cache, err := os.UserCacheDir()
+	if err != nil {
+		panic(fmt.Sprintf("os.UserCacheDir: %v", err))
+	}
+	return filepath.Join(cache, "tailscale-vmtest", "builds")
+}
+
+// versionCacheDir returns the directory holding the extracted binaries for
+// the given version+arch.
+func versionCacheDir(version, arch string) string {
+	return filepath.Join(versionCacheRoot(), fmt.Sprintf("%s_%s", version, arch))
+}
+
+// ensureVersionBinaries downloads (if needed) and extracts the tailscale
+// release tarball for the given concrete version+arch, returning the
+// directory containing tailscale and tailscaled.
+func ensureVersionBinaries(ctx context.Context, version, arch string, logf logger.Logf) (string, error) {
+	dir := versionCacheDir(version, arch)
+	tailscaled := filepath.Join(dir, "tailscaled")
+	tailscale := filepath.Join(dir, "tailscale")
+	if _, err1 := os.Stat(tailscaled); err1 == nil {
+		if _, err2 := os.Stat(tailscale); err2 == nil {
+			return dir, nil
+		}
+	}
+
+	track, err := versionTrack(version)
+	if err != nil {
+		return "", err
+	}
+	url := fmt.Sprintf("https://pkgs.tailscale.com/%s/tailscale_%s_%s.tgz", track, version, arch)
+	logf("downloading %s", url)
+
+	req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
+	if err != nil {
+		return "", err
+	}
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return "", fmt.Errorf("fetching %s: %w", url, err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != 200 {
+		return "", fmt.Errorf("fetching %s: HTTP %s", url, resp.Status)
+	}
+
+	if err := os.MkdirAll(dir, 0755); err != nil {
+		return "", err
+	}
+
+	gzr, err := gzip.NewReader(resp.Body)
+	if err != nil {
+		return "", fmt.Errorf("gzip reader for %s: %w", url, err)
+	}
+	defer gzr.Close()
+	tr := tar.NewReader(gzr)
+
+	wantBase := map[string]bool{
+		"tailscale":  true,
+		"tailscaled": true,
+	}
+	got := map[string]bool{}
+	for {
+		hdr, err := tr.Next()
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			return "", fmt.Errorf("reading tarball %s: %w", url, err)
+		}
+		if hdr.Typeflag != tar.TypeReg {
+			continue
+		}
+		base := path.Base(hdr.Name)
+		if !wantBase[base] {
+			continue
+		}
+		if err := writeAtomic(filepath.Join(dir, base), tr, 0755); err != nil {
+			return "", fmt.Errorf("extracting %s from %s: %w", base, url, err)
+		}
+		got[base] = true
+	}
+	for b := range wantBase {
+		if !got[b] {
+			return "", fmt.Errorf("tarball %s missing %s", url, b)
+		}
+	}
+	logf("extracted %s and %s to %s", "tailscale", "tailscaled", dir)
+	return dir, nil
+}
+
+// writeAtomic writes the contents of r to dst with the given permission
+// bits, by writing to a sibling temp file and renaming on success.
+func writeAtomic(dst string, r io.Reader, perm os.FileMode) error {
+	tmp := dst + ".tmp"
+	f, err := os.OpenFile(tmp, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, perm)
+	if err != nil {
+		return err
+	}
+	if _, err := io.Copy(f, r); err != nil {
+		f.Close()
+		os.Remove(tmp)
+		return err
+	}
+	if err := f.Close(); err != nil {
+		os.Remove(tmp)
+		return err
+	}
+	return os.Rename(tmp, dst)
+}
diff --git a/tstest/natlab/vmtest/version_test.go b/tstest/natlab/vmtest/version_test.go
new file mode 100644
index 000000000..375056290
--- /dev/null
+++ b/tstest/natlab/vmtest/version_test.go
@@ -0,0 +1,97 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package vmtest
+
+import (
+	"context"
+	"flag"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+var testDownloadVersion = flag.Bool("test-download-version", false, "in TestVersionDownload, actually hit pkgs.tailscale.com")
+
+func TestResolveTestVersionInvalid(t *testing.T) {
+	bad := []string{
+		"",
+		"1.97",
+		"v1.97.255",
+		"1.97.255-pre",
+		"latest",
+		"unstabel",
+	}
+	for _, v := range bad {
+		got, err := resolveTestVersion(context.Background(), v)
+		if err == nil {
+			t.Errorf("resolveTestVersion(%q) = %q, want error", v, got)
+		}
+	}
+}
+
+func TestVersionTrack(t *testing.T) {
+	cases := []struct {
+		v, want string
+	}{
+		{"1.96.4", "stable"},
+		{"1.97.255", "unstable"},
+		{"1.98.0", "stable"},
+	}
+	for _, c := range cases {
+		got, err := versionTrack(c.v)
+		if err != nil {
+			t.Errorf("versionTrack(%q): %v", c.v, err)
+			continue
+		}
+		if got != c.want {
+			t.Errorf("versionTrack(%q) = %q, want %q", c.v, got, c.want)
+		}
+	}
+}
+
+// TestVersionDownload exercises the live network path (download + extract +
+// cache). Skipped by default; set --test-download-version to run.
+func TestVersionDownload(t *testing.T) {
+	if !*testDownloadVersion {
+		t.Skip("set --test-download-version to run")
+	}
+	cacheRoot := t.TempDir()
+	t.Setenv("VMTEST_BUILDS_CACHE_DIR", cacheRoot)
+
+	ctx := context.Background()
+	const version = "1.96.4" // stable
+	dir, err := ensureVersionBinaries(ctx, version, "amd64", t.Logf)
+	if err != nil {
+		t.Fatal(err)
+	}
+	wantDir := filepath.Join(cacheRoot, version+"_amd64")
+	if dir != wantDir {
+		t.Errorf("dir = %q, want %q", dir, wantDir)
+	}
+	for _, name := range []string{"tailscale", "tailscaled"} {
+		fi, err := os.Stat(filepath.Join(dir, name))
+		if err != nil {
+			t.Errorf("missing %s: %v", name, err)
+			continue
+		}
+		if fi.Size() < 1<<20 {
+			t.Errorf("%s suspiciously small: %d bytes", name, fi.Size())
+		}
+	}
+
+	// Re-fetch should be a fast no-op (cache hit).
+	if _, err := ensureVersionBinaries(ctx, version, "amd64", t.Logf); err != nil {
+		t.Fatalf("re-fetch: %v", err)
+	}
+
+	// "unstable" resolution.
+	resolved, err := resolveTestVersion(ctx, "unstable")
+	if err != nil {
+		t.Fatalf("resolveTestVersion(unstable): %v", err)
+	}
+	t.Logf("unstable resolved to %q", resolved)
+	if resolved == "" || resolved == "unstable" {
+		t.Errorf("resolved = %q", resolved)
+	}
+}
diff --git a/tstest/natlab/vmtest/vmstatus.go b/tstest/natlab/vmtest/vmstatus.go
new file mode 100644
index 000000000..240c34f42
--- /dev/null
+++ b/tstest/natlab/vmtest/vmstatus.go
@@ -0,0 +1,345 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package vmtest
+
+import (
+	"fmt"
+	"sync"
+	"time"
+)
+
+// StepStatus is the state of a declared test step.
+type StepStatus int
+
+const (
+	StepPending StepStatus = iota // not yet started
+	StepRunning                   // Begin called
+	StepDone                      // End(nil) called
+	StepFailed                    // End(non-nil) called
+)
+
+func (s StepStatus) String() string {
+	switch s {
+	case StepPending:
+		return "pending"
+	case StepRunning:
+		return "running"
+	case StepDone:
+		return "done"
+	case StepFailed:
+		return "failed"
+	}
+	return fmt.Sprintf("StepStatus(%d)", int(s))
+}
+
+// Icon returns a Unicode icon for the step status.
+func (s StepStatus) Icon() string {
+	switch s {
+	case StepPending:
+		return "○"
+	case StepRunning:
+		return "◉"
+	case StepDone:
+		return "✓"
+	case StepFailed:
+		return "✗"
+	}
+	return "?"
+}
+
+// Step is a declared stage of a test, created by [Env.AddStep].
+// The web UI shows all steps from the start, tracking their progress.
+type Step struct {
+	mu      sync.Mutex
+	name    string
+	index   int // 0-based position in Env.steps
+	env     *Env
+	status  StepStatus
+	err     error
+	started time.Time
+	ended   time.Time
+}
+
+// Name returns the step's display name.
+func (s *Step) Name() string { return s.name }
+
+// Index returns the step's 0-based position.
+func (s *Step) Index() int { return s.index }
+
+// Status returns the current status.
+func (s *Step) Status() StepStatus {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.status
+}
+
+// Err returns the error if the step failed, or nil.
+func (s *Step) Err() error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.err
+}
+
+// Elapsed returns how long the step has been running (if running)
+// or how long it took (if done/failed). Returns 0 if pending.
+func (s *Step) Elapsed() time.Duration {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.started.IsZero() {
+		return 0
+	}
+	if !s.ended.IsZero() {
+		return s.ended.Sub(s.started)
+	}
+	return time.Since(s.started)
+}
+
+// Begin marks the step as running. Publishes an event to the web UI.
+func (s *Step) Begin() {
+	s.mu.Lock()
+	if s.status != StepPending {
+		s.mu.Unlock()
+		panic(fmt.Sprintf("Step %q: Begin called in state %s", s.name, s.status))
+	}
+	s.started = time.Now()
+	s.status = StepRunning
+	s.mu.Unlock()
+	s.env.publishStepChange(s)
+}
+
+// End marks the step as done (err == nil) or failed (err != nil).
+// It publishes a status change event to the web UI.
+// It does not call t.Fatalf; callers should handle the error as appropriate
+// (return it from errgroup, call t.Fatalf on the test goroutine, etc).
+func (s *Step) End(err error) {
+	s.mu.Lock()
+	if s.status != StepRunning {
+		s.mu.Unlock()
+		panic(fmt.Sprintf("Step %q: End called in state %s", s.name, s.status))
+	}
+	s.ended = time.Now()
+	if err != nil {
+		s.status = StepFailed
+		s.err = err
+	} else {
+		s.status = StepDone
+	}
+	s.mu.Unlock()
+	s.env.publishStepChange(s)
+}
+
+// Fatalf marks the step as failed (as [Step.End]), and then logs a test
+// failure to the environment's test, with an error constructed from the given
+// arguments.
+func (s *Step) Fatalf(msg string, args ...any) {
+	s.Fatal(fmt.Errorf(msg, args...))
+}
+
+// Fatal marks the step as failed (as [Step.End]), and then logs a test failure
+// to the environment's test, with the specified (non-nil) error. It will panic
+// if err == nil.
+func (s *Step) Fatal(err error) {
+	if err == nil {
+		panic(fmt.Sprintf("Step %q: Fatal called with a nil error", s.name))
+	}
+	s.End(err)
+	s.env.t.Fatal(err)
+}
+
+// EventType identifies the kind of event published to the EventBus.
+type EventType string
+
+const (
+	EventStepChanged   EventType = "step_changed"   // a Step changed status
+	EventConsoleOutput EventType = "console_output" // serial console line
+	EventDHCPDiscover  EventType = "dhcp_discover"  // VM sent DHCP Discover
+	EventDHCPOffer     EventType = "dhcp_offer"     // server sent DHCP Offer
+	EventDHCPRequest   EventType = "dhcp_request"   // VM sent DHCP Request
+	EventDHCPAck       EventType = "dhcp_ack"       // server sent DHCP Ack
+	EventScreenshot    EventType = "screenshot"     // VM display screenshot (JPEG, base64)
+	EventTailscale     EventType = "tailscale"      // Tailscale status change
+	EventTestStatus    EventType = "test_status"    // test Running/Passed/Failed
+)
+
+// TestStatus tracks whether the overall test is running, passed, or failed.
+type TestStatus struct {
+	mu      sync.Mutex
+	state   string // "Running", "Passed", "Failed"
+	started time.Time
+	ended   time.Time
+}
+
+func newTestStatus() *TestStatus {
+	return &TestStatus{state: "Running", started: time.Now()}
+}
+
+// State returns the current test state.
+func (ts *TestStatus) State() string {
+	ts.mu.Lock()
+	defer ts.mu.Unlock()
+	return ts.state
+}
+
+// Elapsed returns total test duration.
+func (ts *TestStatus) Elapsed() time.Duration {
+	ts.mu.Lock()
+	defer ts.mu.Unlock()
+	if !ts.ended.IsZero() {
+		return ts.ended.Sub(ts.started)
+	}
+	return time.Since(ts.started)
+}
+
+// StartUnixMilli returns the test start time as Unix milliseconds,
+// for the client-side elapsed timer.
+func (ts *TestStatus) StartUnixMilli() int64 {
+	ts.mu.Lock()
+	defer ts.mu.Unlock()
+	return ts.started.UnixMilli()
+}
+
+// finish marks the test as passed or failed.
+func (ts *TestStatus) finish(failed bool) {
+	ts.mu.Lock()
+	defer ts.mu.Unlock()
+	ts.ended = time.Now()
+	if failed {
+		ts.state = "Failed"
+	} else {
+		ts.state = "Passed"
+	}
+}
+
+// VMEvent is a single event published to the [EventBus].
+type VMEvent struct {
+	Time     time.Time
+	NodeName string // "" for global events
+	Type     EventType
+	Message  string // human-readable description
+	Detail   string // e.g. IP address, node key
+	Step     *Step  // non-nil for EventStepChanged
+	NIC      int    // NIC index for DHCP events (0-based); -1 if not applicable
+}
+
+// NICStatus is the DHCP state for one NIC on a node.
+type NICStatus struct {
+	NetName string // human label like "192.168.1.0/24" or "10.0.0.0/24"
+	DHCP    string // "waiting", "Discover sent", "Got 10.0.0.101", etc.
+}
+
+// NodeStatus tracks the current DHCP and Tailscale state of a VM node
+// for rendering on the web UI's initial page load.
+type NodeStatus struct {
+	Name           string
+	OS             string
+	NICs           []NICStatus // one per NIC; index matches NIC index
+	JoinsTailnet   bool        // whether this node runs Tailscale
+	Tailscale      string      // "--", "Up (100.64.0.1)", etc.
+	Console        []string    // recent console output lines (ring buffer)
+	Screenshot     string      // latest screenshot as data URI, or ""
+	ScreenshotPort int         // Host.app screenshot server port, or 0
+}
+
+const maxConsoleLines = 200
+
+const (
+	eventBusHistorySize   = 500
+	subscriberChannelSize = 1000
+)
+
+// EventBus broadcasts VMEvents to subscribers and keeps a history for
+// late joiners. It is safe for concurrent use.
+type EventBus struct {
+	mu          sync.Mutex
+	history     []VMEvent
+	subscribers map[*subscriber]struct{}
+}
+
+func newEventBus() *EventBus {
+	return &EventBus{
+		subscribers: make(map[*subscriber]struct{}),
+	}
+}
+
+// Publish sends an event to all subscribers and appends it to the history.
+// Non-blocking: slow subscribers are skipped.
+func (b *EventBus) Publish(ev VMEvent) {
+	if ev.Time.IsZero() {
+		ev.Time = time.Now()
+	}
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	// Don't store screenshots in history — they're large and only the
+	// latest one matters (stored in NodeStatus.Screenshot instead).
+	if ev.Type != EventScreenshot {
+		b.history = append(b.history, ev)
+	}
+	if len(b.history) > eventBusHistorySize {
+		// Trim old events.
+		copy(b.history, b.history[len(b.history)-eventBusHistorySize:])
+		b.history = b.history[:eventBusHistorySize]
+	}
+	for sub := range b.subscribers {
+		select {
+		case sub.ch <- ev:
+		default:
+			// Slow consumer, skip.
+		}
+	}
+}
+
+// Subscribe returns a new subscriber that receives the event history
+// followed by live events.
+func (b *EventBus) Subscribe() *subscriber {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	sub := &subscriber{
+		bus:  b,
+		ch:   make(chan VMEvent, subscriberChannelSize),
+		done: make(chan struct{}),
+	}
+	// Send history.
+	for _, ev := range b.history {
+		select {
+		case sub.ch <- ev:
+		default:
+		}
+	}
+	b.subscribers[sub] = struct{}{}
+	return sub
+}
+
+func (b *EventBus) unsubscribe(sub *subscriber) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	delete(b.subscribers, sub)
+}
+
+// subscriber receives events from an [EventBus].
+type subscriber struct {
+	bus  *EventBus
+	ch   chan VMEvent
+	done chan struct{}
+	once sync.Once
+}
+
+// Events returns the channel of events. Closed when Close is called.
+func (s *subscriber) Events() <-chan VMEvent {
+	return s.ch
+}
+
+// Close unsubscribes and closes the event channel.
+func (s *subscriber) Close() {
+	s.once.Do(func() {
+		if s.bus != nil {
+			s.bus.unsubscribe(s)
+		}
+		close(s.done)
+	})
+}
+
+// Done returns a channel that's closed when Close is called.
+func (s *subscriber) Done() <-chan struct{} {
+	return s.done
+}
diff --git a/tstest/natlab/vmtest/vmtest.go b/tstest/natlab/vmtest/vmtest.go
index e6c89467f..110e6f5f4 100644
--- a/tstest/natlab/vmtest/vmtest.go
+++ b/tstest/natlab/vmtest/vmtest.go
@@ -7,7 +7,7 @@
 // and multi-NIC configurations for scenarios like subnet routing.
 //
 // Prerequisites:
-//   - qemu-system-x86_64 and KVM access (typically the "kvm" group; no root required)
+//   - qemu-system-x86_64 (KVM is used automatically on Linux when /dev/kvm is accessible)
 //   - A built gokrazy natlabapp image (auto-built on first run via "make natlab" in gokrazy/)
 //
 // Run tests with:
@@ -16,31 +16,49 @@
 package vmtest
 
 import (
+	"bytes"
 	"context"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
 	"flag"
 	"fmt"
 	"io"
 	"net"
 	"net/http"
 	"net/netip"
+	"net/url"
 	"os"
 	"os/exec"
 	"path/filepath"
+	"runtime"
+	"strconv"
 	"strings"
+	"sync"
 	"testing"
 	"time"
 
+	"github.com/google/gopacket/layers"
+	dto "github.com/prometheus/client_model/go"
+	"github.com/prometheus/common/expfmt"
+	"github.com/prometheus/common/model"
+	"go4.org/mem"
 	"golang.org/x/sync/errgroup"
 	"tailscale.com/client/local"
 	"tailscale.com/ipn"
+	"tailscale.com/ipn/ipnstate"
 	"tailscale.com/tailcfg"
+	"tailscale.com/tstest"
+	"tailscale.com/tstest/integration/testcontrol"
 	"tailscale.com/tstest/natlab/vnet"
-	"tailscale.com/util/set"
+	"tailscale.com/types/key"
+	"tailscale.com/util/mak"
 )
 
 var (
-	runVMTests     = flag.Bool("run-vm-tests", false, "run tests that require VMs with KVM")
+	runVMTests     = flag.Bool("run-vm-tests", false, "run tests that require QEMU VMs")
 	verboseVMDebug = flag.Bool("verbose-vm-debug", false, "enable verbose debug logging for VM tests")
+	testVersion    = flag.String("test-version", "", `if non-empty, download tailscale & tailscaled at the given release version (e.g. "1.97.255", "unstable", or "stable") instead of building from the source tree`)
 )
 
 // Env is a test environment that manages virtual networks and QEMU VMs.
@@ -52,14 +70,55 @@ type Env struct {
 	nodes   []*Node
 	tempDir string
 
-	sockAddr string // shared Unix socket path for all QEMU netdevs
-	binDir   string // directory for compiled binaries
+	sockDir       string // short-path dir for Unix sockets (macOS has 104-byte limit)
+	sockAddr      string // shared Unix socket path for all QEMU netdevs
+	dgramSockAddr string // Unix dgram socket path for macOS VMs (tailmac)
+	binDir        string // directory for compiled binaries
+
+	// testVersion is the resolved Tailscale release version to use (empty if
+	// building from source). When non-empty, tailscale and tailscaled binaries
+	// are downloaded from pkgs.tailscale.com instead of compiled from the tree.
+	testVersion string
 
 	// gokrazy-specific paths
 	gokrazyBase   string // path to gokrazy base qcow2 image
 	gokrazyKernel string // path to gokrazy kernel
 
+	// tailmac-specific paths (macOS VMs)
+	tailmacDir        string // path to tailmac bin/ directory containing Host.app
+	macosSnapshot     string // path to cached macOS VM snapshot directory
+	macosSnapshotOnce sync.Once
+
 	qemuProcs []*exec.Cmd // launched QEMU processes
+
+	sameTailnetUser           bool // all nodes register as the same Tailnet user
+	allOnline                 bool // mark every peer as Online=true in MapResponses
+	peerRelayGrants           bool // grant peer-relay capabilities on the wildcard packet filter
+	selfSignedDERPCertPinning bool // serve test DERP map with sha256-raw cert pins
+	fakeACME                  bool // point tailscaled at vnet's fake ACME server
+
+	controlDNSDomain string             // MagicDNS domain for the test control server (see ControlDNS)
+	controlDNS       *tailcfg.DNSConfig // DNS config for the test control server (see ControlDNS)
+
+	// Shared resource initialization (sync.Once for things multiple nodes share).
+	vnetOnce      sync.Once
+	gokrazyOnce   sync.Once
+	qemuSockOnce  sync.Once
+	dgramSockOnce sync.Once
+	compileMu     sync.Mutex
+	compileOnce   map[string]*sync.Once // keyed by goos_goarch
+	imageOnce     map[string]*sync.Once // keyed by OSImage.Name
+
+	// Web UI support.
+	ctx        context.Context // cancelled when test ends
+	eventBus   *EventBus
+	testStatus *TestStatus
+	stepsMu    sync.Mutex
+	stepsByKey map[string]*Step
+	steps      []*Step
+
+	nodeStatusMu sync.Mutex
+	nodeStatus   map[string]*NodeStatus // keyed by node name
 }
 
 // logVerbosef logs a message only when --verbose-vm-debug is set.
@@ -70,18 +129,291 @@ func (e *Env) logVerbosef(format string, args ...any) {
 	}
 }
 
-// New creates a new test environment. It skips the test if --run-vm-tests is not set.
-func New(t testing.TB) *Env {
+// vmPlatform defines how a VM type boots. Each OS image type (gokrazy,
+// cloud, macOS) implements this interface.
+type vmPlatform interface {
+	// planSteps registers steps with the web UI in a dry-run pass.
+	planSteps(e *Env, n *Node)
+
+	// boot does everything needed to get this node running: ensure images,
+	// compile binaries, set up sockets, launch VM. Called concurrently.
+	boot(ctx context.Context, e *Env, n *Node) error
+}
+
+// platform returns the vmPlatform for this node's OS type.
+func (n *Node) platform() vmPlatform {
+	if n.os.IsMacOS {
+		return macPlatform{}
+	}
+	if n.os.IsGokrazy {
+		return gokrazyPlatform{}
+	}
+	return qemuCloudPlatform{}
+}
+
+// AddStep declares an expected stage of the test. The web UI shows all steps
+// from the start, tracking their progress. Call before or during the test.
+// Returns a *Step whose Begin/End methods drive the progress display.
+func (e *Env) AddStep(name string) *Step {
+	s := &Step{
+		name:  name,
+		index: len(e.steps),
+		env:   e,
+	}
+	e.steps = append(e.steps, s)
+	return s
+}
+
+// Step returns a step by key, creating it if it doesn't exist.
+// Safe for concurrent use. Both planSteps (dry-run) and boot (real-run)
+// call this to get the same Step object.
+func (e *Env) Step(key string) *Step {
+	e.stepsMu.Lock()
+	defer e.stepsMu.Unlock()
+	if s, ok := e.stepsByKey[key]; ok {
+		return s
+	}
+	s := &Step{
+		name:  key,
+		index: len(e.steps),
+		env:   e,
+	}
+	e.steps = append(e.steps, s)
+	if e.stepsByKey == nil {
+		e.stepsByKey = make(map[string]*Step)
+	}
+	e.stepsByKey[key] = s
+	return s
+}
+
+// Steps returns all declared steps in order.
+func (e *Env) Steps() []*Step {
+	return e.steps
+}
+
+// publishStepChange publishes a step status change event.
+func (e *Env) publishStepChange(s *Step) {
+	e.eventBus.Publish(VMEvent{
+		Type:    EventStepChanged,
+		Message: fmt.Sprintf("%s %s", s.Status().Icon(), s.name),
+		Step:    s,
+	})
+}
+
+// initNodeStatus initializes the NodeStatus for all nodes. Called after
+// AddNode but before Start so the web UI can render them.
+func (e *Env) initNodeStatus() {
+	e.nodeStatusMu.Lock()
+	defer e.nodeStatusMu.Unlock()
+	for _, n := range e.nodes {
+		nics := make([]NICStatus, len(n.nets))
+		for i := range n.nets {
+			nics[i] = NICStatus{
+				NetName: e.nicLabel(n, i),
+				DHCP:    "waiting",
+			}
+		}
+		e.nodeStatus[n.name] = &NodeStatus{
+			Name:         n.name,
+			OS:           n.os.Name,
+			NICs:         nics,
+			JoinsTailnet: n.joinTailnet,
+			Tailscale:    "--",
+		}
+	}
+}
+
+// nicLabel returns a short human-readable label for a node's i-th NIC.
+// After Start(), we can use the assigned LAN IP. Before that, we use "NIC N".
+func (e *Env) nicLabel(n *Node, i int) string {
+	if n.vnetNode != nil {
+		ip := n.vnetNode.LanIP(n.nets[i])
+		if ip.IsValid() {
+			return ip.String()
+		}
+	}
+	return fmt.Sprintf("NIC %d", i)
+}
+
+// getNodeStatus returns the current status for a node.
+func (e *Env) getNodeStatus(name string) NodeStatus {
+	e.nodeStatusMu.Lock()
+	defer e.nodeStatusMu.Unlock()
+	ns := e.nodeStatus[name]
+	if ns == nil {
+		return NodeStatus{Name: name, Tailscale: "--"}
+	}
+	return *ns
+}
+
+// setNodeDHCP updates the DHCP status for a specific NIC on a node.
+func (e *Env) setNodeDHCP(name string, nicIdx int, status string) {
+	e.nodeStatusMu.Lock()
+	ns := e.nodeStatus[name]
+	if ns != nil && nicIdx < len(ns.NICs) {
+		ns.NICs[nicIdx].DHCP = status
+	}
+	e.nodeStatusMu.Unlock()
+}
+
+// setNodeTailscale updates the Tailscale status for a node and publishes
+// an event so the web UI updates via WebSocket.
+func (e *Env) setNodeTailscale(name, status string) {
+	e.nodeStatusMu.Lock()
+	ns := e.nodeStatus[name]
+	if ns != nil {
+		ns.Tailscale = status
+	}
+	e.nodeStatusMu.Unlock()
+	e.eventBus.Publish(VMEvent{
+		NodeName: name,
+		Type:     EventTailscale,
+		Message:  "Tailscale: " + status,
+		Detail:   status,
+	})
+}
+
+// appendConsoleLine adds a line to a node's console buffer.
+func (e *Env) appendConsoleLine(name, line string) {
+	e.nodeStatusMu.Lock()
+	ns := e.nodeStatus[name]
+	if ns != nil {
+		ns.Console = append(ns.Console, line)
+		if len(ns.Console) > maxConsoleLines {
+			ns.Console = ns.Console[len(ns.Console)-maxConsoleLines:]
+		}
+	}
+	e.nodeStatusMu.Unlock()
+}
+
+// nicIndexForMAC returns the NIC index (0-based) for a given MAC on a node.
+// Returns -1 if not found.
+func (e *Env) nicIndexForMAC(name string, mac vnet.MAC) int {
+	for _, n := range e.nodes {
+		if n.name != name {
+			continue
+		}
+		for i := range n.nets {
+			if n.vnetNode.NICMac(i) == mac {
+				return i
+			}
+		}
+	}
+	return -1
+}
+
+// nodeNameByNum returns the node name for a given vnet node number.
+func (e *Env) nodeNameByNum(num int) string {
+	for _, n := range e.nodes {
+		if n.num == num {
+			return n.name
+		}
+	}
+	return fmt.Sprintf("node%d", num)
+}
+
+// New creates a new test environment. It skips the test if --run-vm-tests is
+// not set. opts may contain [EnvOption] values returned by helpers like
+// [SameTailnetUser].
+func New(t testing.TB, opts ...EnvOption) *Env {
 	if !*runVMTests {
 		t.Skip("skipping VM test; set --run-vm-tests to run")
 	}
 
 	tempDir := t.TempDir()
-	return &Env{
-		t:       t,
-		tempDir: tempDir,
-		binDir:  filepath.Join(tempDir, "bin"),
+
+	// Unix sockets have a short path limit (104 bytes on macOS). The Go
+	// test TempDir path easily exceeds that, so create a dedicated short
+	// directory under /tmp for sockets.
+	sockDir, err := os.MkdirTemp("", "vmtest")
+	if err != nil {
+		t.Fatalf("creating socket tempdir: %v", err)
 	}
+	t.Cleanup(func() { os.RemoveAll(sockDir) })
+
+	e := &Env{
+		t:          t,
+		tempDir:    tempDir,
+		sockDir:    sockDir,
+		binDir:     filepath.Join(tempDir, "bin"),
+		eventBus:   newEventBus(),
+		testStatus: newTestStatus(),
+		nodeStatus: make(map[string]*NodeStatus),
+	}
+	for _, o := range opts {
+		o.applyTo(e)
+	}
+	t.Cleanup(func() {
+		e.testStatus.finish(t.Failed())
+		e.eventBus.Publish(VMEvent{
+			Type:    EventTestStatus,
+			Message: e.testStatus.State(),
+			Detail:  formatDuration(e.testStatus.Elapsed()),
+		})
+	})
+	return e
+}
+
+// EnvOption configures an [Env] in [New].
+type EnvOption interface {
+	applyTo(*Env)
+}
+
+type envOptFunc func(*Env)
+
+func (f envOptFunc) applyTo(e *Env) { f(e) }
+
+// SameTailnetUser returns an [EnvOption] that makes every node register with
+// the test control server as the same Tailnet user. This is needed for
+// cross-node features that require a same-user relationship — Taildrop, for
+// example.
+func SameTailnetUser() EnvOption {
+	return envOptFunc(func(e *Env) { e.sameTailnetUser = true })
+}
+
+// AllOnline returns an [EnvOption] that makes the test control server mark
+// every peer as Online=true in MapResponses (testcontrol.Server.AllOnline).
+// Several disco-key handling fast paths in the controlclient and wgengine
+// only fire when the peer is reported online; without this option those
+// paths are silently skipped, which can mask bugs and slow down recovery
+// from disco-key rotations.
+func AllOnline() EnvOption {
+	return envOptFunc(func(e *Env) { e.allOnline = true })
+}
+
+// PeerRelayGrants returns an [EnvOption] that makes the test control server
+// grant [tailcfg.PeerCapabilityRelay] and [tailcfg.PeerCapabilityRelayTarget]
+// on the wildcard packet filter (testcontrol.Server.PeerRelayGrants). Without
+// those capabilities, magicsock does not consider any peer a candidate
+// peer-relay server, so a node that has [ipn.Prefs.RelayServerPort] set
+// cannot actually be used as a relay by its peers.
+func PeerRelayGrants() EnvOption {
+	return envOptFunc(func(e *Env) { e.peerRelayGrants = true })
+}
+
+// SelfSignedDERPCertPinning returns an [EnvOption] that makes the test control
+// server advertise a DERP map whose nodes use CertName="sha256-raw:<hex>"
+// pinning against the self-signed certs vnet's fake DERP servers serve. This
+// exercises the sha256-raw verification path end-to-end (in tailscaled and in
+// `tailscale debug derp`) without involving a real CA.
+func SelfSignedDERPCertPinning() EnvOption {
+	return envOptFunc(func(e *Env) { e.selfSignedDERPCertPinning = true })
+}
+
+// FakeACME returns an [EnvOption] that points nodes at vnet's in-process ACME
+// CA and configures the test control server to advertise MagicDNS cert domains.
+func FakeACME() EnvOption {
+	return envOptFunc(func(e *Env) { e.fakeACME = true })
+}
+
+// ControlDNS returns an [EnvOption] that makes the test control server send
+// the given DNS configuration in MapResponses, with node names placed under
+// the given MagicDNS domain (e.g. "tailnet.test").
+func ControlDNS(magicDNSDomain string, cfg *tailcfg.DNSConfig) EnvOption {
+	return envOptFunc(func(e *Env) {
+		e.controlDNSDomain = magicDNSDomain
+		e.controlDNS = cfg
+	})
 }
 
 // AddNetwork creates a new virtual network. Arguments follow the same pattern as
@@ -90,19 +422,33 @@ func (e *Env) AddNetwork(opts ...any) *vnet.Network {
 	return e.cfg.AddNetwork(opts...)
 }
 
+// RegisterFile registers a file with the vnet fileserver.
+// It is served at http://files.tailscale/<path>.
+func (e *Env) RegisterFile(path string, data []byte) {
+	if e.server == nil {
+		e.t.Fatalf("RegisterFile called before Start")
+	}
+	e.server.RegisterFile(path, data)
+}
+
 // Node represents a virtual machine in the test environment.
 type Node struct {
 	name string
 	num  int // assigned during AddNode
 
-	os              OSImage
-	nets            []*vnet.Network
-	vnetNode        *vnet.Node // primary vnet node (set during Start)
-	agent           *vnet.NodeAgentClient
-	joinTailnet     bool
-	advertiseRoutes string
-	webServerPort   int
-	sshPort         int // host port for SSH debug access (cloud VMs only)
+	os               OSImage
+	nets             []*vnet.Network
+	vnetNode         *vnet.Node // primary vnet node (set during Start)
+	agent            *vnet.NodeAgentClient
+	joinTailnet      bool
+	runSSH           bool // true to enable the node's Tailscale SSH server
+	noAgent          bool // true to skip TTA agent setup (e.g. macOS VMs without TTA)
+	systemdUnit      bool // true to run tailscaled via the stock systemd unit (Linux cloud VMs only)
+	advertiseRoutes  string
+	snatSubnetRoutes *bool // nil means default (true)
+	webServerPort    int
+	sshPort          int     // host port for SSH debug access (cloud VMs only)
+	dnsMode          DNSMode // desired Linux DNS backend to provision; "" means the image default
 }
 
 // AddNode creates a new VM node. The name is used for identification and as the
@@ -128,33 +474,112 @@ func (e *Env) AddNode(name string, opts ...any) *Node {
 		case nodeOptNoTailscale:
 			n.joinTailnet = false
 			vnetOpts = append(vnetOpts, vnet.DontJoinTailnet)
+		case nodeOptTailscaleSSH:
+			n.runSSH = true
+		case nodeOptNoAgent:
+			n.noAgent = true
+		case nodeOptSystemdUnit:
+			n.systemdUnit = true
 		case nodeOptAdvertiseRoutes:
 			n.advertiseRoutes = string(o)
+		case nodeOptSNATSubnetRoutes:
+			v := bool(o)
+			n.snatSubnetRoutes = &v
 		case nodeOptWebServer:
 			n.webServerPort = int(o)
+		case nodeOptDNSMode:
+			switch DNSMode(o) {
+			case DNSDefault, DNSDirect:
+			default:
+				e.t.Fatalf("AddNode(%q): unsupported DNSMode %q", name, DNSMode(o))
+			}
+			n.dnsMode = DNSMode(o)
 		default:
 			// Pass through to vnet (TailscaledEnv, NodeOption, MAC, etc.)
 			vnetOpts = append(vnetOpts, o)
 		}
 	}
+	if e.fakeACME {
+		vnetOpts = append(vnetOpts, vnet.TailscaledEnv{
+			Key:   "TS_DEBUG_ACME_DIRECTORY_URL",
+			Value: "http://acme.example/directory",
+		})
+	}
+
+	if n.systemdUnit && (n.os.IsGokrazy || n.os.GOOS() != "linux") {
+		e.t.Fatalf("SystemdUnit is only supported on Linux cloud VMs; node %s is %s", name, n.os.Name)
+	}
+
+	// macOS VMs require a macOS arm64 host (Apple Virtualization.framework via
+	// tailmac). Skip the test now rather than letting it proceed through the
+	// rest of the setup only to fail later.
+	if n.os.IsMacOS && (runtime.GOOS != "darwin" || runtime.GOARCH != "arm64") {
+		e.t.Skipf("macOS VM tests require a macOS arm64 host (got %s/%s)", runtime.GOOS, runtime.GOARCH)
+	}
+
+	// Linux cloud images must declare a family; it drives distro-specific
+	// cloud-init provisioning. gokrazy and non-Linux images don't use that path.
+	if n.os.isLinuxCloudImage() && n.os.Family == "" {
+		e.t.Fatalf("AddNode(%q): Linux cloud image %q has no LinuxFamily set", name, n.os.Name)
+	}
 
 	n.vnetNode = e.cfg.AddNode(vnetOpts...)
 	n.num = n.vnetNode.Num()
 	return n
 }
 
+// Name returns the name of the Node.
+func (n *Node) Name() string {
+	return n.name
+}
+
 // LanIP returns the LAN IPv4 address of this node on the given network.
 // This is only valid after Env.Start() has been called.
+// Name returns the node's name as set in [Env.AddNode].
 func (n *Node) LanIP(net *vnet.Network) netip.Addr {
 	return n.vnetNode.LanIP(net)
 }
 
+// DropControlTraffic sets up a blackhole for control traffic for just this
+// node on all the networks belonging to the node.
+func (n *Node) DropControlTraffic() {
+	for _, network := range n.nets {
+		network.BlackholeControlForAddr(n.LanIP(network))
+	}
+}
+
 // NodeOption types for configuring nodes.
 
 type nodeOptOS OSImage
 type nodeOptNoTailscale struct{}
+type nodeOptTailscaleSSH struct{}
+type nodeOptNoAgent struct{}
+type nodeOptSystemdUnit struct{}
 type nodeOptAdvertiseRoutes string
+type nodeOptSNATSubnetRoutes bool
 type nodeOptWebServer int
+type nodeOptDNSMode DNSMode
+
+// DNSMode is a provisioning directive, not a DNS-backend name: it says what, if
+// anything, to do to the guest's DNS before tailscaled starts, letting one
+// distro image cover multiple backends. DNSDefault leaves DNS untouched (the
+// resulting backend is image-dependent); the other modes provision the guest to
+// force a specific backend, and are named to match the mode strings in
+// net/dns/manager_linux.go so the result can be checked with
+// [Env.AssertDNSBackend].
+type DNSMode string
+
+const (
+	// DNSDefault leaves the image's DNS configuration untouched, so the backend
+	// is whatever the image runs by default (typically systemd-resolved on
+	// modern distros). It has no [Env.AssertDNSBackend] counterpart because the
+	// result isn't forced.
+	DNSDefault DNSMode = ""
+
+	// DNSDirect masks systemd-resolved and installs a plain /etc/resolv.conf
+	// so tailscaled selects the "direct" manager (rewrites resolv.conf itself).
+	DNSDirect DNSMode = "direct"
+)
 
 // OS returns a NodeOption that sets the node's operating system image.
 func OS(img OSImage) nodeOptOS { return nodeOptOS(img) }
@@ -162,132 +587,149 @@ func OS(img OSImage) nodeOptOS { return nodeOptOS(img) }
 // DontJoinTailnet returns a NodeOption that prevents the node from running tailscale up.
 func DontJoinTailnet() nodeOptNoTailscale { return nodeOptNoTailscale{} }
 
+// TailscaleSSH returns a NodeOption that enables the node's Tailscale SSH
+// server by passing --ssh to tailscale up. If any node has this option, the
+// test control server is configured with a permissive SSH policy that lets
+// any tailnet node connect as any SSH user, mapped to the same-named local
+// user.
+func TailscaleSSH() nodeOptTailscaleSSH { return nodeOptTailscaleSSH{} }
+
+// NoAgent returns a NodeOption that skips TTA agent setup. The node will not
+// have a test agent, so agent-dependent operations (Status, ExecOnNode, etc.)
+// won't work. Useful for VMs that just need to boot and respond to ICMP.
+func NoAgent() nodeOptNoAgent { return nodeOptNoAgent{} }
+
+// SystemdUnit returns a NodeOption that makes the node run tailscaled via the
+// stock systemd unit that Linux packages ship (cmd/tailscaled/tailscaled.service
+// with cmd/tailscaled/tailscaled.defaults as its EnvironmentFile), instead of
+// launching tailscaled directly as a background process. This exercises the
+// unit's sandboxing directives and its Type=notify readiness handshake.
+// It is only supported on Linux cloud VMs (e.g. Ubuntu, Debian).
+func SystemdUnit() nodeOptSystemdUnit { return nodeOptSystemdUnit{} }
+
 // AdvertiseRoutes returns a NodeOption that configures the node to advertise
 // the given routes (comma-separated CIDRs) when joining the tailnet.
 func AdvertiseRoutes(routes string) nodeOptAdvertiseRoutes {
 	return nodeOptAdvertiseRoutes(routes)
 }
 
+// SNATSubnetRoutes returns a NodeOption that sets whether the node should
+// source NAT traffic to advertised subnet routes. The default is true.
+// Setting this to false preserves original source IPs, which is needed
+// for site-to-site configurations.
+func SNATSubnetRoutes(v bool) nodeOptSNATSubnetRoutes { return nodeOptSNATSubnetRoutes(v) }
+
 // WebServer returns a NodeOption that starts a webserver on the given port.
-// The webserver responds with "Hello world I am <nodename>" on all requests.
+// The webserver responds with "Hello world I am <nodename> from <sourceIP>" on all requests.
 func WebServer(port int) nodeOptWebServer { return nodeOptWebServer(port) }
 
-// Start initializes the virtual network, builds/downloads images, compiles
-// binaries, launches QEMU processes, and waits for all TTA agents to connect.
-// It should be called after all AddNetwork/AddNode calls.
+// WithDNSMode returns a NodeOption that provisions the (Linux) node so
+// tailscaled selects the given DNS backend. Only meaningful for Linux cloud
+// images; ignored for gokrazy/macOS. See [DNSMode].
+func WithDNSMode(m DNSMode) nodeOptDNSMode { return nodeOptDNSMode(m) }
+
+// Start initializes the virtual network, boots all VMs in parallel, and waits
+// for all TTA agents to connect. It should be called after all AddNetwork/AddNode calls.
 func (e *Env) Start() {
 	t := e.t
+
+	// Give bring-up (image build, boot, agent wait) a generous budget measured
+	// from now. We deliberately do NOT derive this from the test deadline: on
+	// CI, per-test timeouts can be tight (a few minutes), and reserving headroom
+	// under the deadline was observed to steal time bring-up legitimately needs,
+	// failing slow-but-healthy runs. If bring-up genuinely exceeds this, the
+	// `go test -timeout` panic is an acceptable (if blunt) backstop.
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Minute)
 	t.Cleanup(cancel)
+	e.ctx = ctx
+
+	e.initNodeStatus()
+	e.maybeStartWebServer()
 
 	if err := os.MkdirAll(e.binDir, 0755); err != nil {
 		t.Fatal(err)
 	}
 
-	// Determine which GOOS/GOARCH pairs need compiled binaries (non-gokrazy
-	// images). Gokrazy has binaries built-in, so doesn't need compilation.
-	type platform struct{ goos, goarch string }
-	needPlatform := set.Set[platform]{}
-	for _, n := range e.nodes {
-		if !n.os.IsGokrazy {
-			needPlatform.Add(platform{n.os.GOOS(), n.os.GOARCH()})
+	if *testVersion != "" {
+		v, err := resolveTestVersion(ctx, *testVersion)
+		if err != nil {
+			t.Fatalf("resolving --test-version=%q: %v", *testVersion, err)
 		}
+		e.testVersion = v
+		t.Logf("using Tailscale release version %s (from --test-version=%q)", v, *testVersion)
 	}
 
-	// Compile binaries and download/build images in parallel.
-	// Any failure cancels the others via the errgroup context.
-	eg, egCtx := errgroup.WithContext(ctx)
-	for _, p := range needPlatform.Slice() {
-		eg.Go(func() error {
-			return e.compileBinariesForOS(egCtx, p.goos, p.goarch)
+	// Dry-run: let each platform register its steps with the web UI.
+	userSteps := e.steps
+	e.steps = nil
+	for _, n := range e.nodes {
+		n.platform().planSteps(e, n)
+	}
+	for _, n := range e.nodes {
+		if !n.noAgent {
+			e.Step("Wait for agent: " + n.name)
+		}
+		if n.joinTailnet {
+			e.Step("Tailscale up: " + n.name)
+		}
+	}
+	for _, s := range userSteps {
+		s.index = len(e.steps)
+		e.steps = append(e.steps, s)
+	}
+
+	// Boot all nodes in parallel. Each platform handles its own
+	// dependencies (image prep, binary compilation, socket setup)
+	// via sync.Once, so independent work overlaps naturally.
+	//
+	// Under TCG, concurrent boots oversubscribe the host CPUs and a heavy
+	// guest can starve its siblings past the stuck-detector; serialize boots
+	// there so each clears that gate before the next starts. KVM stays parallel.
+	var bootEg errgroup.Group
+	if !hardwareAccelAvailable() {
+		bootEg.SetLimit(1)
+	}
+	for _, n := range e.nodes {
+		bootEg.Go(func() error {
+			return n.platform().boot(ctx, e, n)
 		})
 	}
-	didOS := set.Set[string]{} // dedup by image name
-	for _, n := range e.nodes {
-		if didOS.Contains(n.os.Name) {
-			continue
-		}
-		didOS.Add(n.os.Name)
-		if n.os.IsGokrazy {
-			eg.Go(func() error {
-				return e.ensureGokrazy(egCtx)
-			})
-		} else {
-			eg.Go(func() error {
-				return ensureImage(egCtx, n.os)
-			})
-		}
-	}
-	if err := eg.Wait(); err != nil {
-		t.Fatalf("setup: %v", err)
-	}
-
-	// Create the vnet server.
-	var err error
-	e.server, err = vnet.New(&e.cfg)
-	if err != nil {
-		t.Fatalf("vnet.New: %v", err)
-	}
-	t.Cleanup(func() { e.server.Close() })
-
-	// Register compiled binaries with the file server VIP.
-	// Binaries are registered at <goos>_<goarch>/<name> (e.g. "linux_amd64/tta").
-	for _, p := range needPlatform.Slice() {
-		dir := p.goos + "_" + p.goarch
-		for _, name := range []string{"tta", "tailscale", "tailscaled"} {
-			data, err := os.ReadFile(filepath.Join(e.binDir, dir, name))
-			if err != nil {
-				t.Fatalf("reading compiled %s/%s: %v", dir, name, err)
-			}
-			e.server.RegisterFile(dir+"/"+name, data)
-		}
-	}
-
-	// Cloud-init config is delivered via local seed ISOs (created in startCloudQEMU),
-	// not via the cloud-init HTTP VIP, because network-config must be available
-	// during init-local before systemd-networkd-wait-online blocks.
-
-	// Start Unix socket listener.
-	e.sockAddr = filepath.Join(e.tempDir, "vnet.sock")
-	srv, err := net.Listen("unix", e.sockAddr)
-	if err != nil {
-		t.Fatalf("listen unix: %v", err)
-	}
-	t.Cleanup(func() { srv.Close() })
-
-	go func() {
-		for {
-			c, err := srv.Accept()
-			if err != nil {
-				return
-			}
-			go e.server.ServeUnixConn(c.(*net.UnixConn), vnet.ProtocolQEMU)
-		}
-	}()
-
-	// Launch QEMU processes.
-	for _, n := range e.nodes {
-		if err := e.startQEMU(n); err != nil {
-			t.Fatalf("startQEMU(%s): %v", n.name, err)
-		}
+	if err := bootEg.Wait(); err != nil {
+		t.Fatalf("boot: %v", err)
 	}
 
 	// Set up agent clients and wait for all agents to connect.
 	for _, n := range e.nodes {
+		if n.noAgent {
+			continue
+		}
+		e.initVnet() // ensure vnet is ready for agent clients
 		n.agent = e.server.NodeAgentClient(n.vnetNode)
 		n.vnetNode.SetClient(n.agent)
 	}
 
-	// Wait for agents, then bring up tailscale.
 	var agentEg errgroup.Group
 	for _, n := range e.nodes {
+		if n.noAgent {
+			continue
+		}
 		agentEg.Go(func() error {
+			aStep := e.Step("Wait for agent: " + n.name)
+			aStep.Begin()
 			t.Logf("[%s] waiting for agent...", n.name)
-			st, err := n.agent.Status(ctx)
-			if err != nil {
-				return fmt.Errorf("[%s] agent status: %w", n.name, err)
+			if n.joinTailnet {
+				st, err := n.agent.Status(ctx)
+				if err != nil {
+					return fmt.Errorf("[%s] agent status: %w", n.name, err)
+				}
+				t.Logf("[%s] agent connected, backend state: %s", n.name, st.BackendState)
+			} else {
+				if err := e.waitForAgentConn(ctx, n); err != nil {
+					return fmt.Errorf("[%s] agent connect: %w", n.name, err)
+				}
+				t.Logf("[%s] agent connected (no tailscale)", n.name)
 			}
-			t.Logf("[%s] agent connected, backend state: %s", n.name, st.BackendState)
+			aStep.End(nil)
 
 			if n.vnetNode.HostFirewall() {
 				if err := n.agent.EnableHostFirewall(ctx); err != nil {
@@ -296,17 +738,47 @@ func (e *Env) Start() {
 			}
 
 			if n.joinTailnet {
+				tsStep := e.Step("Tailscale up: " + n.name)
+				tsStep.Begin()
 				if err := e.tailscaleUp(ctx, n); err != nil {
 					return fmt.Errorf("[%s] tailscale up: %w", n.name, err)
 				}
-				st, err = n.agent.Status(ctx)
+				st2, err := n.agent.Status(ctx)
 				if err != nil {
 					return fmt.Errorf("[%s] status after up: %w", n.name, err)
 				}
-				if st.BackendState != "Running" {
-					return fmt.Errorf("[%s] state = %q, want Running", n.name, st.BackendState)
+				if st2.BackendState != "Running" {
+					return fmt.Errorf("[%s] state = %q, want Running", n.name, st2.BackendState)
 				}
-				t.Logf("[%s] up with %v", n.name, st.Self.TailscaleIPs)
+
+				// Apply any capabilities for the node to the map.
+				// SetNodeCapMap pushes an updated map response immediately, then wait
+				// until the node reports the capability in its status.
+				if cm := n.vnetNode.WantCapMap(); cm != nil {
+					e.server.ControlServer().SetNodeCapMap(st2.Self.PublicKey, cm)
+					if err := tstest.WaitFor(15*time.Second, func() error {
+						st, err := n.agent.Status(ctx)
+						if err != nil {
+							return err
+						}
+						if st.Self == nil {
+							return fmt.Errorf("self is nil")
+						}
+						for c := range cm {
+							if !st.Self.HasCap(c) {
+								return fmt.Errorf("cap %v not yet received", c)
+							}
+						}
+						return nil
+					}); err != nil {
+						return fmt.Errorf("[%s] waiting for capabilities: %w", n.name, err)
+					}
+				}
+
+				ips := fmt.Sprintf("%v", st2.Self.TailscaleIPs)
+				e.setNodeTailscale(n.name, "Running "+ips)
+				t.Logf("[%s] up with %v", n.name, st2.Self.TailscaleIPs)
+				tsStep.End(nil)
 			}
 
 			return nil
@@ -332,6 +804,16 @@ func (e *Env) tailscaleUp(ctx context.Context, n *Node) error {
 	if n.advertiseRoutes != "" {
 		url += "&advertise-routes=" + n.advertiseRoutes
 	}
+	if n.runSSH {
+		url += "&ssh=true"
+	}
+	if n.snatSubnetRoutes != nil {
+		if *n.snatSubnetRoutes {
+			url += "&snat-subnet-routes=true"
+		} else {
+			url += "&snat-subnet-routes=false"
+		}
+	}
 	req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
 	if err != nil {
 		return err
@@ -368,6 +850,273 @@ func (e *Env) startWebServer(ctx context.Context, n *Node) error {
 	return nil
 }
 
+// SetExitNode sets the client node's exit node to use for internet traffic.
+// If exitNode is nil, the client's exit node is cleared (i.e., turned off).
+// Otherwise exitNode must be a tailnet node with an approved 0.0.0.0/0 (and
+// ::/0) route, typically configured via [AdvertiseRoutes] and
+// [Env.ApproveRoutes].
+func (e *Env) SetExitNode(client, exitNode *Node) {
+	e.t.Helper()
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	var ip netip.Addr
+	if exitNode != nil {
+		st, err := exitNode.agent.Status(ctx)
+		if err != nil {
+			e.t.Fatalf("SetExitNode: status for %s: %v", exitNode.name, err)
+		}
+		if len(st.Self.TailscaleIPs) == 0 {
+			e.t.Fatalf("SetExitNode: %s has no Tailscale IPs", exitNode.name)
+		}
+		ip = st.Self.TailscaleIPs[0]
+	}
+
+	if _, err := client.agent.EditPrefs(ctx, &ipn.MaskedPrefs{
+		Prefs: ipn.Prefs{
+			ExitNodeID: "",
+			ExitNodeIP: ip,
+		},
+		ExitNodeIDSet: true,
+		ExitNodeIPSet: true,
+	}); err != nil {
+		e.t.Fatalf("SetExitNode(%s -> %v): %v", client.name, exitNode, err)
+	}
+	if exitNode == nil {
+		e.t.Logf("[%s] cleared exit node", client.name)
+	} else {
+		e.t.Logf("[%s] using exit node %s (%v)", client.name, exitNode.name, ip)
+	}
+}
+
+// SetExitNodeIP sets the client's ExitNodeIP preference directly, by IP.
+// This is the right helper for plain-WireGuard exit nodes (Mullvad-style)
+// that aren't on the tailnet — pass an invalid netip.Addr{} to clear.
+// For tailnet exit nodes whose Tailscale IP is discoverable via TTA, use
+// [Env.SetExitNode] instead.
+func (e *Env) SetExitNodeIP(client *Node, ip netip.Addr) {
+	e.t.Helper()
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+	if _, err := client.agent.EditPrefs(ctx, &ipn.MaskedPrefs{
+		Prefs: ipn.Prefs{
+			ExitNodeID: "",
+			ExitNodeIP: ip,
+		},
+		ExitNodeIDSet: true,
+		ExitNodeIPSet: true,
+	}); err != nil {
+		e.t.Fatalf("SetExitNodeIP(%s, %v): %v", client.name, ip, err)
+	}
+	if !ip.IsValid() {
+		e.t.Logf("[%s] cleared exit node", client.name)
+	} else {
+		e.t.Logf("[%s] using exit-node IP %v", client.name, ip)
+	}
+}
+
+// ControlServer returns the underlying test control server, for tests that
+// need to inject custom peers, masquerade pairs, etc. The returned server's
+// Node store is shared with the running tailnet, so changes take effect on
+// the next netmap update sent to peers.
+func (e *Env) ControlServer() *testcontrol.Server {
+	return e.server.ControlServer()
+}
+
+// FakeACMERootPEM returns the root certificate for vnet's fake ACME CA.
+func (e *Env) FakeACMERootPEM() []byte {
+	e.initVnet()
+	return e.server.FakeACMERootPEM()
+}
+
+// BringUpMullvadWGServer brings up a userspace WireGuard server on n,
+// configured as a single-peer "Mullvad-style" exit-node target. The
+// server runs inside n's TTA process on a Linux TUN named "wg0".
+//
+// gw is the WG interface address (e.g. 10.64.0.1/24). The server listens
+// on listenPort, accepts only the single peer whose public key is peerPub
+// at peerAllowedIP, and MASQUERADEs egress traffic from masqSrc so that
+// decrypted packets from the peer egress with n's WAN IP.
+//
+// It returns the freshly generated public key of the WG server, which
+// the caller must pin as the peer key on the [tailcfg.Node] it injects
+// into the netmap to advertise this server as a plain-WireGuard exit
+// node. It fatals the test on error.
+func (e *Env) BringUpMullvadWGServer(n *Node, gw netip.Prefix, listenPort uint16, peerPub key.NodePublic, peerAllowedIP, masqSrc netip.Prefix) key.NodePublic {
+	e.t.Helper()
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	peerPubRaw := peerPub.Raw32()
+	v := url.Values{
+		"addr":            {gw.String()},
+		"listen-port":     {strconv.Itoa(int(listenPort))},
+		"peer-pub-b64":    {base64.StdEncoding.EncodeToString(peerPubRaw[:])},
+		"peer-allowed-ip": {peerAllowedIP.String()},
+		"masq-src":        {masqSrc.String()},
+	}
+	reqURL := "http://unused/wg-server-up?" + v.Encode()
+	req, err := http.NewRequestWithContext(ctx, "GET", reqURL, nil)
+	if err != nil {
+		e.t.Fatalf("BringUpMullvadWGServer: %v", err)
+	}
+	res, err := n.agent.HTTPClient.Do(req)
+	if err != nil {
+		e.t.Fatalf("BringUpMullvadWGServer(%s): %v", n.name, err)
+	}
+	defer res.Body.Close()
+	body, _ := io.ReadAll(res.Body)
+	if res.StatusCode != 200 {
+		e.t.Fatalf("BringUpMullvadWGServer(%s): %s: %s", n.name, res.Status, body)
+	}
+	var pubB64 string
+	for line := range strings.SplitSeq(string(body), "\n") {
+		if s, ok := strings.CutPrefix(strings.TrimSpace(line), "PUBKEY="); ok {
+			pubB64 = s
+			break
+		}
+	}
+	if pubB64 == "" {
+		e.t.Fatalf("BringUpMullvadWGServer(%s): no PUBKEY in response: %q", n.name, body)
+	}
+	pubRaw, err := base64.StdEncoding.DecodeString(pubB64)
+	if err != nil || len(pubRaw) != 32 {
+		e.t.Fatalf("BringUpMullvadWGServer(%s): bad PUBKEY %q: %v", n.name, pubB64, err)
+	}
+	return key.NodePublicFromRaw32(mem.B(pubRaw))
+}
+
+// Status returns the tailscale status of the given node, fetched from its
+// TTA agent. It fatals the test on error.
+func (e *Env) Status(n *Node) *ipnstate.Status {
+	e.t.Helper()
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+	st, err := n.agent.Status(ctx)
+	if err != nil {
+		e.t.Fatalf("Status(%s): %v", n.name, err)
+	}
+	return st
+}
+
+// ClientMetrics returns the client metrics exported by the given node.
+func (e *Env) ClientMetrics(n *Node) ClientMetrics {
+	e.t.Helper()
+	raw, err := n.Agent().DaemonMetrics(e.t.Context())
+	if err != nil {
+		e.t.Fatalf("Node %q DaemonMetrics: %v", n.Name(), err)
+	}
+
+	// Metrics are reported in Prometheus exposition format.
+	// prometheus/common v0.67 made the validation scheme mandatory;
+	// the zero-value parser now panics. LegacyValidation matches the
+	// classic ASCII metric/label name rules that the tailscaled
+	// client exporter uses.
+	parser := expfmt.NewTextParser(model.LegacyValidation)
+	mfs, err := parser.TextToMetricFamilies(bytes.NewReader(raw))
+	if err != nil {
+		e.t.Fatalf("Node %q parse client metrics: %v", n.Name(), err)
+	}
+
+	// Tailscale client metrics are all unlabelled integer-valued counters and
+	// gauges, so we don't need to handle the full generality of the Prometheus
+	// representation. If we see anything else, we'll log and skip it.
+	out := make(ClientMetrics)
+	for _, mf := range mfs {
+		name := mf.GetName()
+		if _, ok := out[name]; ok {
+			e.t.Logf("Node %q: duplicate client metric %q (ignored)", n.Name(), name)
+			continue
+		} else if len(mf.Metric) != 1 {
+			e.t.Logf("Node %q: got %d values for client metric %q, want 1 (ignored)", n.Name(), len(mf.Metric), name)
+			continue
+		}
+
+		var mtype string
+		var value int64
+		switch mf.GetType() {
+		case dto.MetricType_COUNTER:
+			mtype = "counter"
+			value = int64(mf.Metric[0].GetCounter().GetValue())
+		case dto.MetricType_GAUGE:
+			mtype = "gauge"
+			value = int64(mf.Metric[0].GetGauge().GetValue())
+		default:
+			e.t.Logf("Node %q unexpected client metric %q type %q (ignored)", n.Name(), name, mf.GetType().String())
+			continue
+		}
+		out[name] = ClientMetric{
+			Name:  name,
+			Type:  mtype,
+			Value: value,
+		}
+	}
+	return out
+}
+
+// dnsBackendMetricPrefix is the prefix of the clientmetric gauge that
+// tailscaled sets to 1 for the Linux DNS mode it selected. See
+// net/dns/manager_linux.go.
+const dnsBackendMetricPrefix = "dns_manager_linux_mode_"
+
+// DNSBackend returns the Linux DNS backend ("mode") the node's tailscaled
+// selected (e.g. "systemd-resolved", "direct"). tailscaled sets a single gauge
+// named dns_manager_linux_mode_<mode> to 1 for its selected mode (see
+// net/dns/manager_linux.go); this finds that gauge and returns <mode>. It fails
+// the test if none is set (non-Linux node, or DNS not yet configured).
+func (e *Env) DNSBackend(n *Node) string {
+	e.t.Helper()
+	for name, m := range e.ClientMetrics(n) {
+		mode, ok := strings.CutPrefix(name, dnsBackendMetricPrefix)
+		if !ok || m.Value != 1 {
+			continue
+		}
+		// tailscaled sanitizes "-" to "_" when forming the metric name;
+		// reverse it so we return net/dns's spelling ("systemd-resolved").
+		return strings.ReplaceAll(mode, "_", "-")
+	}
+	e.t.Fatalf("Node %q: no %s* gauge set (non-Linux node, or DNS not yet configured)", n.Name(), dnsBackendMetricPrefix)
+	return ""
+}
+
+// AssertDNSBackend fails the test unless the node's selected Linux DNS backend
+// matches want (see [Env.DNSBackend] for the mode strings). Use it in distro
+// tests to prove the node exercises the intended DNS manager.
+func (e *Env) AssertDNSBackend(n *Node, want string) {
+	e.t.Helper()
+	if got := e.DNSBackend(n); got != want {
+		e.t.Fatalf("Node %q: DNS backend = %q, want %q", n.Name(), got, want)
+	}
+}
+
+// ClientMetrics is a view of the client metrics exported by a node.
+// The keys of the map are the metric names.
+type ClientMetrics map[string]ClientMetric
+
+// ClientMetric is a view of a node client metric.
+type ClientMetric struct {
+	Name  string // as published to the clientmetrics package
+	Type  string // either "gauge" or "counter"
+	Value int64  // the gauge or counter value
+}
+
+// SetAcceptRoutes toggles the node's RouteAll preference (the
+// --accept-routes flag), controlling whether it installs subnet routes
+// advertised by peers.
+func (e *Env) SetAcceptRoutes(n *Node, on bool) {
+	e.t.Helper()
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	if _, err := n.agent.EditPrefs(ctx, &ipn.MaskedPrefs{
+		Prefs:       ipn.Prefs{RouteAll: on},
+		RouteAllSet: true,
+	}); err != nil {
+		e.t.Fatalf("SetAcceptRoutes(%s, %v): %v", n.name, on, err)
+	}
+	e.t.Logf("[%s] accept-routes=%v", n.name, on)
+}
+
 // ApproveRoutes tells the test control server to approve subnet routes
 // for the given node. The routes should be CIDR strings.
 func (e *Env) ApproveRoutes(n *Node, routes ...string) {
@@ -432,53 +1181,302 @@ func (e *Env) ApproveRoutes(n *Node, routes ...string) {
 	}
 }
 
-// ping pings from one node to another's Tailscale IP, retrying until it succeeds
-// or the timeout expires. This establishes the WireGuard tunnel between the nodes.
+// ping does a disco ping from one node to another's Tailscale IP, retrying
+// for up to 30 seconds, fataling on failure. It is used internally to wake
+// up magicsock peer state before a test runs; tests that want to assert
+// connectivity should use [Env.Ping] with the appropriate ping type and
+// timeout.
 func (e *Env) ping(from, to *Node) {
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	e.t.Helper()
+	if err := e.Ping(from, to, tailcfg.PingDisco, 30*time.Second); err != nil {
+		e.t.Fatal(err)
+	}
+}
+
+// Ping pings from one node to another's Tailscale IP using the given ping
+// type, retrying until it succeeds or timeout expires. It returns the error
+// from the last attempt if the timeout expires. Unlike the internal ping
+// helper, it does not fatal the test on failure; callers can check the error
+// to assert on timing.
+//
+// [tailcfg.PingTSMP] actually flows packets across the WireGuard tunnel and is
+// the right choice for asserting end-to-end connectivity.
+// [tailcfg.PingDisco] only exchanges disco messages between magicsock layers
+// and is useful for warming up peer state without requiring a working tunnel.
+func (e *Env) Ping(from, to *Node, ptype tailcfg.PingType, timeout time.Duration) error {
+	e.t.Helper()
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
 	defer cancel()
 
 	toSt, err := to.agent.Status(ctx)
 	if err != nil {
-		e.t.Fatalf("ping: can't get %s status: %v", to.name, err)
+		return fmt.Errorf("ping: can't get %s status: %w", to.name, err)
 	}
 	if len(toSt.Self.TailscaleIPs) == 0 {
-		e.t.Fatalf("ping: %s has no Tailscale IPs", to.name)
+		return fmt.Errorf("ping: %s has no Tailscale IPs", to.name)
 	}
 	targetIP := toSt.Self.TailscaleIPs[0]
 
+	var lastErr error
 	for {
-		pingCtx, pingCancel := context.WithTimeout(ctx, 3*time.Second)
-		pr, err := from.agent.PingWithOpts(pingCtx, targetIP, tailcfg.PingDisco, local.PingOpts{})
+		// Per-attempt timeout: cap at 3s but never exceed the remaining budget.
+		attemptTimeout := 3 * time.Second
+		if d := time.Until(deadline(ctx)); d < attemptTimeout {
+			attemptTimeout = d
+		}
+		if attemptTimeout <= 0 {
+			break
+		}
+		pingCtx, pingCancel := context.WithTimeout(ctx, attemptTimeout)
+		pr, err := from.agent.PingWithOpts(pingCtx, targetIP, ptype, local.PingOpts{})
 		pingCancel()
 		if err == nil && pr.Err == "" {
-			e.logVerbosef("ping: %s -> %s OK", from.name, targetIP)
-			return
+			e.logVerbosef("ping(%s): %s -> %s OK", ptype, from.name, targetIP)
+			return nil
+		}
+		switch {
+		case err != nil:
+			lastErr = err
+		case pr.Err != "":
+			lastErr = fmt.Errorf("%s", pr.Err)
 		}
 		if ctx.Err() != nil {
-			e.t.Fatalf("ping: %s -> %s timed out", from.name, targetIP)
+			break
 		}
-		time.Sleep(time.Second)
+		time.Sleep(500 * time.Millisecond)
+	}
+	if lastErr == nil {
+		lastErr = ctx.Err()
+	}
+	return fmt.Errorf("ping(%s): %s -> %s (%s) timed out after %v: %w", ptype, from.name, to.name, targetIP, timeout, lastErr)
+}
+
+// deadline returns ctx's deadline, or a zero Time if it has none.
+func deadline(ctx context.Context) time.Time {
+	d, _ := ctx.Deadline()
+	return d
+}
+
+// PeerDiscoKey returns n's view of the given peer's disco key. It returns a
+// non-nil error if the LocalAPI request fails (e.g. tailscaled briefly
+// unavailable during a restart). It returns (zero, false, nil) if n is
+// reachable but has no record of the given peer in its current netmap.
+//
+// PeerDiscoKey is suitable for use inside a [tstest.WaitFor] poll loop: it
+// does not fatal the test on transient errors.
+//
+// The disco key is fetched from the debug-only "peer-disco-keys" LocalAPI
+// action ([ipnlocal.LocalBackend.DebugPeerDiscoKeys]) rather than via
+// [ipnstate.Status], to keep the production PeerStatus struct free of disco
+// keys (and free of non-comparable fields like [key.DiscoPublic] that break
+// reflect-based test helpers).
+func (e *Env) PeerDiscoKey(n *Node, peer key.NodePublic) (key.DiscoPublic, bool, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	got, err := n.agent.DebugResultJSON(ctx, "peer-disco-keys")
+	if err != nil {
+		return key.DiscoPublic{}, false, err
+	}
+	// DebugResultJSON returns the result as a generic any (the body is
+	// re-decoded into any), so the map comes back keyed by string text-
+	// encoded node keys. Re-marshal+unmarshal into a typed map for cleaner
+	// lookup. (Roundtripping through JSON is fine for a test helper.)
+	raw, err := json.Marshal(got)
+	if err != nil {
+		return key.DiscoPublic{}, false, fmt.Errorf("re-marshal: %w", err)
+	}
+	var m map[key.NodePublic]key.DiscoPublic
+	if err := json.Unmarshal(raw, &m); err != nil {
+		return key.DiscoPublic{}, false, fmt.Errorf("unmarshal peer-disco-keys: %w", err)
+	}
+	d, ok := m[peer]
+	return d, ok, nil
+}
+
+// RotateDiscoKey asks tailscaled on n to rotate its discovery (magicsock) key
+// in place via the LocalAPI debug action. The node key, control connection,
+// and other tailscaled state are unaffected. It fatals the test on error.
+func (e *Env) RotateDiscoKey(n *Node) {
+	e.t.Helper()
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+	if err := n.agent.DebugAction(ctx, "rotate-disco-key"); err != nil {
+		e.t.Fatalf("RotateDiscoKey(%s): %v", n.name, err)
+	}
+}
+
+// ForcePreferredDERP pins n's home DERP to the given region via the
+// "force-prefer-derp" debug action, so its reported NetInfo.PreferredDERP is
+// deterministic. The force lives on the long-lived magicsock.Conn and so
+// persists across an in-process profile switch. It fatals the test on error.
+func (e *Env) ForcePreferredDERP(n *Node, region int) {
+	e.t.Helper()
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+	b, err := json.Marshal(region)
+	if err != nil {
+		e.t.Fatalf("ForcePreferredDERP(%s): %v", n.name, err)
+	}
+	if err := n.agent.DebugActionBody(ctx, "force-prefer-derp", bytes.NewReader(b)); err != nil {
+		e.t.Fatalf("ForcePreferredDERP(%s, %d): %v", n.name, region, err)
+	}
+}
+
+// Relogin switches n to a fresh login profile on the same test control server,
+// in-process (no daemon restart), so it comes up under a NEW node identity while
+// keeping the same long-lived magicsock.Conn. This is the control-client swap
+// that an interactive login or profile switch performs, and is what the
+// home-DERP re-report fix guards (see [magicsock.Conn.ResetNetInfoLast]).
+//
+// It switches to an empty profile (the in-process control-client swap the
+// LocalAPI PUT /profiles/ performs) and then logs back in with "tailscale up",
+// which both points the new control client at the test control and drives
+// registration to completion. It waits for the node to return to Running and
+// fatals the test on error.
+func (e *Env) Relogin(n *Node) {
+	e.t.Helper()
+	// Generous timeout: the profile switch triggers a fresh registration +
+	// netcheck + DERP connect, which is slow under TCG (no KVM).
+	ctx, cancel := context.WithTimeout(context.Background(), 4*time.Minute)
+	defer cancel()
+
+	// Switch to a fresh, empty login profile. This runs the in-process control-
+	// client swap (resetForProfileChangeLocked -> setControlClientLocked) that
+	// clears the home-DERP dedup cache under test, while preserving the existing
+	// magicsock.Conn (and any forced home DERP from [Env.ForcePreferredDERP]).
+	if err := n.agent.SwitchToEmptyProfile(ctx); err != nil {
+		e.t.Fatalf("Relogin(%s): SwitchToEmptyProfile: %v", n.name, err)
+	}
+	// Log back in to the same test control. "tailscale up --login-server" points
+	// the new control client at the test control and drives registration to
+	// completion (testcontrol auto-authorizes), the same path Env.Start uses.
+	if err := e.tailscaleUp(ctx, n); err != nil {
+		e.t.Fatalf("Relogin(%s): up: %v", n.name, err)
+	}
+	if err := tstest.WaitFor(60*time.Second, func() error {
+		st, err := n.agent.Status(ctx)
+		if err != nil {
+			return err
+		}
+		if st.BackendState != "Running" {
+			return fmt.Errorf("backend state = %q, want Running", st.BackendState)
+		}
+		return nil
+	}); err != nil {
+		e.t.Fatalf("Relogin(%s): %v", n.name, err)
+	}
+}
+
+// RestartTailscaled signals tailscaled on n to die so that its supervisor
+// (gokrazy) restarts it. It then waits for tailscaled to come back to the
+// "Running" backend state. It fatals the test on error.
+//
+// Restarting tailscaled is currently only supported on gokrazy nodes.
+func (e *Env) RestartTailscaled(n *Node) {
+	e.t.Helper()
+	if !n.os.IsGokrazy {
+		e.t.Fatalf("RestartTailscaled(%s): only supported on gokrazy nodes (have %q)", n.name, n.os.Name)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
+	defer cancel()
+
+	req, err := http.NewRequestWithContext(ctx, "GET", "http://unused/restart-tailscaled", nil)
+	if err != nil {
+		e.t.Fatalf("RestartTailscaled(%s): %v", n.name, err)
+	}
+	res, err := n.agent.HTTPClient.Do(req)
+	if err != nil {
+		e.t.Fatalf("RestartTailscaled(%s): %v", n.name, err)
+	}
+	body, _ := io.ReadAll(res.Body)
+	res.Body.Close()
+	if res.StatusCode != 200 {
+		e.t.Fatalf("RestartTailscaled(%s): %s: %s", n.name, res.Status, body)
+	}
+	e.t.Logf("[%s] %s", n.name, strings.TrimSpace(string(body)))
+
+	// Wait for tailscaled to come back. Status calls will fail while the unix
+	// socket is gone, then return Starting/NeedsLogin briefly before settling
+	// on Running.
+	if err := tstest.WaitFor(45*time.Second, func() error {
+		st, err := n.agent.Status(ctx)
+		if err != nil {
+			return err
+		}
+		if st.BackendState != "Running" {
+			return fmt.Errorf("backend state = %q", st.BackendState)
+		}
+		return nil
+	}); err != nil {
+		e.t.Fatalf("RestartTailscaled(%s): waiting for Running: %v", n.name, err)
+	}
+}
+
+// AddRoute adds a kernel static route on the given node, pointing prefix at
+// via. It uses TTA's /add-route handler, so it works on any node where TTA
+// is running (which is all of them — DontJoinTailnet only skips
+// `tailscale up`; the agent runs regardless). Currently Linux-only in TTA.
+//
+// It fatals the test on error.
+func (e *Env) AddRoute(n *Node, prefix, via string) {
+	e.t.Helper()
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	reqURL := fmt.Sprintf("http://unused/add-route?prefix=%s&via=%s", prefix, via)
+	req, err := http.NewRequestWithContext(ctx, "GET", reqURL, nil)
+	if err != nil {
+		e.t.Fatalf("AddRoute: %v", err)
+	}
+	resp, err := n.agent.HTTPClient.Do(req)
+	if err != nil {
+		e.t.Fatalf("AddRoute(%s, %s → %s): %v", n.name, prefix, via, err)
+	}
+	defer resp.Body.Close()
+	body, _ := io.ReadAll(resp.Body)
+	if resp.StatusCode != 200 {
+		e.t.Fatalf("AddRoute(%s, %s → %s): %s: %s", n.name, prefix, via, resp.Status, body)
 	}
 }
 
 // SSHExec runs a command on a cloud VM via its debug SSH NIC.
 // Only works for cloud VMs that have the debug NIC and SSH key configured.
 // Returns stdout and any error.
+//
+// SSH transport-level errors (exit code 255: connection refused, auth
+// failure, etc.) are retried for up to ~30s to absorb the race window
+// between Env.Start() returning (when tta reports the tailscale backend
+// as Running) and cloud-init finishing the user/SSH-key setup. The remote
+// command's own non-zero exit codes are returned to the caller without
+// retry.
 func (e *Env) SSHExec(n *Node, cmd string) (string, error) {
 	if n.sshPort == 0 {
 		return "", fmt.Errorf("node %s has no SSH debug port", n.name)
 	}
-	sshCmd := exec.Command("ssh",
-		"-o", "StrictHostKeyChecking=no",
-		"-o", "UserKnownHostsFile=/dev/null",
-		"-o", "ConnectTimeout=5",
-		"-i", "/tmp/vmtest_key",
-		"-p", fmt.Sprintf("%d", n.sshPort),
-		"root@127.0.0.1",
-		cmd)
-	out, err := sshCmd.CombinedOutput()
-	return string(out), err
+	deadline := time.Now().Add(30 * time.Second)
+	for {
+		sshCmd := exec.Command("ssh",
+			"-o", "StrictHostKeyChecking=no",
+			"-o", "UserKnownHostsFile=/dev/null",
+			"-o", "BatchMode=yes",
+			"-o", "ConnectTimeout=5",
+			"-o", "LogLevel=ERROR",
+			"-i", "/tmp/vmtest_key",
+			"-p", fmt.Sprintf("%d", n.sshPort),
+			"root@127.0.0.1",
+			cmd)
+		out, err := sshCmd.CombinedOutput()
+		if err == nil {
+			return string(out), nil
+		}
+		var exitErr *exec.ExitError
+		if !errors.As(err, &exitErr) || exitErr.ExitCode() != 255 {
+			return string(out), err
+		}
+		if time.Now().After(deadline) {
+			return string(out), err
+		}
+		time.Sleep(500 * time.Millisecond)
+	}
 }
 
 // DumpStatus logs the tailscale status of a node, including its peers and their
@@ -575,7 +1573,491 @@ func (e *Env) HTTPGet(from *Node, targetURL string) string {
 	return ""
 }
 
-// ensureGokrazy finds or builds the gokrazy base image and kernel.
+// HTTPResponse is the result of a successful [Env.HTTPGetStatus] call.
+type HTTPResponse struct {
+	// Status is the upstream HTTP status code.
+	Status int
+	// Body is the upstream response body.
+	Body string
+	// SetCookies is the parsed list of cookies the upstream set, if any.
+	SetCookies []*http.Cookie
+}
+
+// HTTPGetStatus is like [Env.HTTPGet] but returns the upstream HTTP status
+// code, body, and any Set-Cookie response cookies, so callers can assert on
+// rejection responses (e.g. 401, 403) and drive multi-request flows that need
+// cookie continuity (e.g. session-based authentication).
+//
+// Any sendCookies are sent on the upstream request via the Cookie header.
+//
+// The request is proxied through TTA's /http-get handler, which dials via
+// Tailscale's UserDial; this works on any OS the test agent runs on.
+//
+// Like [Env.HTTPGet], HTTPGetStatus retries up to 3 times on TTA-level
+// connection failures (502 / 503 from TTA when it cannot reach upstream).
+// Upstream responses (including 4xx) are returned to the caller without retry.
+func (e *Env) HTTPGetStatus(from *Node, targetURL string, sendCookies ...*http.Cookie) (*HTTPResponse, error) {
+	cookieHeader := ""
+	if len(sendCookies) > 0 {
+		parts := make([]string, 0, len(sendCookies))
+		for _, c := range sendCookies {
+			parts = append(parts, c.Name+"="+c.Value)
+		}
+		cookieHeader = strings.Join(parts, "; ")
+	}
+
+	var lastErr error
+	for attempt := range 3 {
+		ctx, cancel := context.WithTimeout(context.Background(), 6*time.Second)
+		reqURL := "http://unused/http-get?url=" + url.QueryEscape(targetURL)
+		req, err := http.NewRequestWithContext(ctx, "GET", reqURL, nil)
+		if err != nil {
+			cancel()
+			return nil, err
+		}
+		if cookieHeader != "" {
+			req.Header.Set("Cookie", cookieHeader)
+		}
+		res, err := from.agent.HTTPClient.Do(req)
+		cancel()
+		if err != nil {
+			e.logVerbosef("HTTPGetStatus attempt %d from %s: %v", attempt+1, from.name, err)
+			lastErr = err
+			time.Sleep(2 * time.Second)
+			continue
+		}
+		b, _ := io.ReadAll(res.Body)
+		res.Body.Close()
+		// A bare 502/503 with no X-Upstream-Status means TTA itself couldn't
+		// reach upstream; retry. If the header is set, the upstream really
+		// did answer with that status and we should pass it through.
+		if (res.StatusCode == http.StatusBadGateway || res.StatusCode == http.StatusServiceUnavailable) &&
+			res.Header.Get("X-Upstream-Status") == "" {
+			e.logVerbosef("HTTPGetStatus attempt %d from %s: TTA %d: %s", attempt+1, from.name, res.StatusCode, string(b))
+			lastErr = fmt.Errorf("TTA %d: %s", res.StatusCode, strings.TrimSpace(string(b)))
+			time.Sleep(2 * time.Second)
+			continue
+		}
+		return &HTTPResponse{
+			Status:     res.StatusCode,
+			Body:       string(b),
+			SetCookies: res.Cookies(),
+		}, nil
+	}
+	return nil, fmt.Errorf("HTTPGetStatus from %s to %s: gave up: %w", from.name, targetURL, lastErr)
+}
+
+// Tailscale runs the tailscale CLI on the given node via TTA.
+func (e *Env) Tailscale(n *Node, args ...string) (string, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+	q := url.Values{}
+	for _, arg := range args {
+		q.Add("arg", arg)
+	}
+	req, err := http.NewRequestWithContext(ctx, "GET", "http://unused/tailscale?"+q.Encode(), nil)
+	if err != nil {
+		return "", err
+	}
+	res, err := n.agent.HTTPClient.Do(req)
+	if err != nil {
+		return "", err
+	}
+	defer res.Body.Close()
+	body, _ := io.ReadAll(res.Body)
+	if res.StatusCode != http.StatusOK {
+		return string(body), fmt.Errorf("tailscale %q: %s: %s", args, res.Status, res.Header.Get("Exec-Err"))
+	}
+	return string(body), nil
+}
+
+// GokrazyRoot returns the kernel root= argument from a Gokrazy node.
+func (e *Env) GokrazyRoot(n *Node) (string, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	req, err := http.NewRequestWithContext(ctx, "GET", "http://unused/gokrazy-root", nil)
+	if err != nil {
+		return "", err
+	}
+	res, err := n.agent.HTTPClient.Do(req)
+	if err != nil {
+		return "", err
+	}
+	defer res.Body.Close()
+	body, _ := io.ReadAll(res.Body)
+	if res.StatusCode != http.StatusOK {
+		return "", fmt.Errorf("gokrazy-root: %s: %s", res.Status, strings.TrimSpace(string(body)))
+	}
+	return strings.TrimSpace(string(body)), nil
+}
+
+// setNodeScreenshot stores the latest screenshot data URI for a node.
+func (e *Env) setNodeScreenshot(name, dataURI string) {
+	e.nodeStatusMu.Lock()
+	if ns := e.nodeStatus[name]; ns != nil {
+		ns.Screenshot = dataURI
+	}
+	e.nodeStatusMu.Unlock()
+}
+
+// setNodeScreenshotPort stores the Host.app screenshot server port for a node.
+func (e *Env) setNodeScreenshotPort(name string, port int) {
+	e.nodeStatusMu.Lock()
+	if ns := e.nodeStatus[name]; ns != nil {
+		ns.ScreenshotPort = port
+	}
+	e.nodeStatusMu.Unlock()
+}
+
+// nodeScreenshotPort returns the Host.app screenshot server port for a node, or 0.
+func (e *Env) nodeScreenshotPort(name string) int {
+	e.nodeStatusMu.Lock()
+	defer e.nodeStatusMu.Unlock()
+	if ns := e.nodeStatus[name]; ns != nil {
+		return ns.ScreenshotPort
+	}
+	return 0
+}
+
+// initVnet creates the vnet server. Called once via sync.Once.
+func (e *Env) initVnet() {
+	e.vnetOnce.Do(func() {
+		var err error
+		e.server, err = vnet.New(&e.cfg)
+		if err != nil {
+			e.t.Fatalf("vnet.New: %v", err)
+		}
+		e.t.Cleanup(func() { e.server.Close() })
+
+		e.server.SetDHCPCallback(func(mac vnet.MAC, nodeNum int, msgType layers.DHCPMsgType, ip netip.Addr) {
+			name := e.nodeNameByNum(nodeNum)
+			nicIdx := e.nicIndexForMAC(name, mac)
+			ipStr := ip.String()
+			switch msgType {
+			case layers.DHCPMsgTypeDiscover:
+				e.setNodeDHCP(name, nicIdx, "Discover sent")
+				e.eventBus.Publish(VMEvent{NodeName: name, Type: EventDHCPDiscover, Message: "DHCP Discover sent", NIC: nicIdx})
+			case layers.DHCPMsgTypeOffer:
+				e.setNodeDHCP(name, nicIdx, "Offered "+ipStr)
+				e.eventBus.Publish(VMEvent{NodeName: name, Type: EventDHCPOffer, Message: "DHCP Offer received", Detail: ipStr, NIC: nicIdx})
+			case layers.DHCPMsgTypeRequest:
+				e.setNodeDHCP(name, nicIdx, "Requesting "+ipStr)
+				e.eventBus.Publish(VMEvent{NodeName: name, Type: EventDHCPRequest, Message: "DHCP Request sent", Detail: ipStr, NIC: nicIdx})
+			case layers.DHCPMsgTypeAck:
+				e.setNodeDHCP(name, nicIdx, "Got "+ipStr)
+				e.eventBus.Publish(VMEvent{NodeName: name, Type: EventDHCPAck, Message: "DHCP Ack: got " + ipStr, Detail: ipStr, NIC: nicIdx})
+			}
+		})
+
+		if e.sameTailnetUser {
+			e.server.ControlServer().AllNodesSameUser = true
+		}
+		if e.allOnline {
+			e.server.ControlServer().AllOnline = true
+		}
+		if e.peerRelayGrants {
+			e.server.ControlServer().PeerRelayGrants = true
+		}
+		if e.selfSignedDERPCertPinning {
+			e.server.ControlServer().DERPMap = e.buildSelfSignedDERPMap()
+		}
+		if e.controlDNS != nil {
+			cs := e.server.ControlServer()
+			cs.MagicDNSDomain = e.controlDNSDomain
+			cs.DNSConfig = e.controlDNS.Clone()
+		}
+		if e.fakeACME {
+			cs := e.server.ControlServer()
+			cs.MagicDNSDomain = "tailnet.test"
+			if cs.DNSConfig == nil {
+				cs.DNSConfig = new(tailcfg.DNSConfig)
+			}
+			cs.DNSConfig.Proxied = true
+		}
+		for _, n := range e.nodes {
+			if n.runSSH {
+				e.server.ControlServer().SSHPolicy = &tailcfg.SSHPolicy{
+					Rules: []*tailcfg.SSHRule{{
+						Principals: []*tailcfg.SSHPrincipal{{Any: true}},
+						// Allow permissive login + root login by default
+						SSHUsers: map[string]string{"*": "=", "root": "root"},
+						Action:   &tailcfg.SSHAction{Accept: true},
+					}},
+				}
+				break
+			}
+		}
+	})
+}
+
+// buildSelfSignedDERPMap returns a DERP map identical in structure to the
+// stock test map (same regions, hostnames, virtual IPs) but with each node's
+// CertName set to "sha256-raw:<hex>" pinning the actual self-signed cert
+// served by vnet's fake DERP server, and InsecureForTests cleared so the
+// pin is actually exercised. Nodes are matched to certs by HostName.
+func (e *Env) buildSelfSignedDERPMap() *tailcfg.DERPMap {
+	hostToHash := make(map[string]string, 2)
+	for i := range 2 {
+		hostToHash[e.server.DERPHostname(i)] = e.server.DERPCertSHA256Hex(i)
+	}
+	src := e.server.ControlServer().DERPMap
+	dm := &tailcfg.DERPMap{
+		Regions: make(map[int]*tailcfg.DERPRegion, len(src.Regions)),
+	}
+	for id, srcRegion := range src.Regions {
+		r := *srcRegion
+		r.Nodes = make([]*tailcfg.DERPNode, len(srcRegion.Nodes))
+		for i, srcNode := range srcRegion.Nodes {
+			n := *srcNode
+			hash, ok := hostToHash[n.HostName]
+			if !ok {
+				e.t.Fatalf("buildSelfSignedDERPMap: no cert hash for HostName %q", n.HostName)
+			}
+			n.InsecureForTests = false
+			n.CertName = "sha256-raw:" + hash
+			r.Nodes[i] = &n
+		}
+		dm.Regions[id] = &r
+	}
+	return dm
+}
+
+// ensureQEMUSocket creates the Unix stream socket for QEMU VMs. Called once.
+func (e *Env) ensureQEMUSocket() {
+	e.qemuSockOnce.Do(func() {
+		e.initVnet()
+		e.sockAddr = filepath.Join(e.sockDir, "vnet.sock")
+		srv, err := net.Listen("unix", e.sockAddr)
+		if err != nil {
+			e.t.Fatalf("listen unix: %v", err)
+		}
+		e.t.Cleanup(func() { srv.Close() })
+		go func() {
+			for {
+				c, err := srv.Accept()
+				if err != nil {
+					return
+				}
+				go e.server.ServeUnixConn(c.(*net.UnixConn), vnet.ProtocolQEMU)
+			}
+		}()
+	})
+}
+
+// ensureDgramSocket creates the Unix dgram socket for macOS VMs. Called once.
+func (e *Env) ensureDgramSocket() {
+	e.dgramSockOnce.Do(func() {
+		e.initVnet()
+		e.dgramSockAddr = filepath.Join(e.sockDir, "dgram.sock")
+		dgramAddr, err := net.ResolveUnixAddr("unixgram", e.dgramSockAddr)
+		if err != nil {
+			e.t.Fatalf("resolve dgram addr: %v", err)
+		}
+		uc, err := net.ListenUnixgram("unixgram", dgramAddr)
+		if err != nil {
+			e.t.Fatalf("listen unixgram: %v", err)
+		}
+		e.t.Cleanup(func() { uc.Close() })
+		go e.server.ServeUnixConn(uc, vnet.ProtocolUnixDGRAM)
+	})
+}
+
+// ensureCompiled compiles binaries for the given platform and registers them
+// with the vnet file server. Safe for concurrent use; only compiles once per platform.
+func (e *Env) ensureCompiled(ctx context.Context, goos, goarch string) {
+	key := goos + "_" + goarch
+
+	e.compileMu.Lock()
+	once, ok := e.compileOnce[key]
+	if !ok {
+		once = new(sync.Once)
+		mak.Set(&e.compileOnce, key, once)
+	}
+	e.compileMu.Unlock()
+
+	once.Do(func() {
+		step := e.Step(fmt.Sprintf("Compile %s_%s binaries", goos, goarch))
+		step.Begin()
+		if err := e.compileBinariesForOS(ctx, goos, goarch); err != nil {
+			step.End(err)
+			e.t.Fatalf("compileBinariesForOS(%s, %s): %v", goos, goarch, err)
+		}
+		step.End(nil)
+		e.registerBinaries(goos, goarch)
+	})
+}
+
+// ensureImage prepares the cloud image for os and returns any error from the
+// preparation. Safe for concurrent use; only prepares once per OS name.
+func (e *Env) ensureImage(ctx context.Context, os OSImage) error {
+	e.compileMu.Lock()
+	once, ok := e.imageOnce[os.Name]
+	if !ok {
+		once = new(sync.Once)
+		mak.Set(&e.imageOnce, os.Name, once)
+	}
+	e.compileMu.Unlock()
+
+	var err error
+	once.Do(func() {
+		step := e.Step(fmt.Sprintf("Prepare %s image", os.Name))
+		step.Begin()
+		err = ensureImage(ctx, os)
+		step.End(err)
+	})
+	return err
+}
+
+// registerBinaries registers compiled binaries with the vnet file server.
+// Safe for concurrent use.
+func (e *Env) registerBinaries(goos, goarch string) {
+	e.initVnet()
+	dir := goos + "_" + goarch
+	for _, name := range []string{"tta", "tailscale", "tailscaled"} {
+		data, err := os.ReadFile(filepath.Join(e.binDir, dir, name))
+		if err != nil {
+			e.t.Fatalf("reading compiled %s/%s: %v", dir, name, err)
+		}
+		e.server.RegisterFile(dir+"/"+name, data)
+	}
+}
+
+// waitForAgentConn waits for a TTA agent to connect by issuing a simple
+// HTTP GET to the root endpoint, without requiring tailscaled.
+func (e *Env) waitForAgentConn(ctx context.Context, n *Node) error {
+	for {
+		reqCtx, cancel := context.WithTimeout(ctx, 2*time.Second)
+		req, err := http.NewRequestWithContext(reqCtx, "GET", "http://unused/", nil)
+		if err != nil {
+			cancel()
+			return err
+		}
+		res, err := n.agent.HTTPClient.Do(req)
+		cancel()
+		if err == nil {
+			res.Body.Close()
+			return nil
+		}
+		if ctx.Err() != nil {
+			return ctx.Err()
+		}
+		time.Sleep(500 * time.Millisecond)
+	}
+}
+
+// Agent returns the node's TTA agent client, or nil if NoAgent is set.
+func (n *Node) Agent() *vnet.NodeAgentClient {
+	return n.agent
+}
+
+// LANPing pings a LAN IP from the given node using TTA's /ping endpoint.
+// It retries for up to 2 minutes, which is enough for a macOS VM to boot
+// and acquire a DHCP lease.
+func (e *Env) LANPing(from *Node, targetIP netip.Addr) {
+	if from.agent == nil {
+		e.t.Fatalf("LANPing: node %s has no agent (NoAgent set?)", from.name)
+	}
+	e.t.Logf("LANPing: %s -> %s", from.name, targetIP)
+	deadline := time.Now().Add(2 * time.Minute)
+	for attempt := 0; time.Now().Before(deadline); attempt++ {
+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		reqURL := fmt.Sprintf("http://unused/ping?host=%s", targetIP)
+		req, err := http.NewRequestWithContext(ctx, "GET", reqURL, nil)
+		if err != nil {
+			cancel()
+			e.t.Fatalf("LANPing: %v", err)
+		}
+		res, err := from.agent.HTTPClient.Do(req)
+		cancel()
+		if err != nil {
+			if attempt%10 == 0 {
+				e.t.Logf("LANPing attempt %d: %v", attempt+1, err)
+			}
+			time.Sleep(2 * time.Second)
+			continue
+		}
+		body, _ := io.ReadAll(res.Body)
+		res.Body.Close()
+		if res.StatusCode == 200 {
+			e.t.Logf("LANPing: %s -> %s succeeded on attempt %d", from.name, targetIP, attempt+1)
+			return
+		}
+		if attempt%10 == 0 {
+			e.t.Logf("LANPing attempt %d: status %d, body: %s", attempt+1, res.StatusCode, string(body))
+		}
+		time.Sleep(2 * time.Second)
+	}
+	e.t.Fatalf("LANPing: %s -> %s timed out after 2 minutes", from.name, targetIP)
+}
+
+// SendTaildropFile sends a file via Taildrop from one node to another.
+// The to node must be on the tailnet. It fatals on error.
+func (e *Env) SendTaildropFile(from, to *Node, name string, content []byte) {
+	e.t.Helper()
+	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
+	defer cancel()
+
+	st, err := to.agent.Status(ctx)
+	if err != nil {
+		e.t.Fatalf("SendTaildropFile: status for %s: %v", to.name, err)
+	}
+	if len(st.Self.TailscaleIPs) == 0 {
+		e.t.Fatalf("SendTaildropFile: %s has no Tailscale IPs", to.name)
+	}
+	target := st.Self.TailscaleIPs[0].String()
+
+	reqURL := fmt.Sprintf("http://unused/taildrop-send?to=%s&name=%s", target, name)
+	req, err := http.NewRequestWithContext(ctx, "POST", reqURL, bytes.NewReader(content))
+	if err != nil {
+		e.t.Fatalf("SendTaildropFile: %v", err)
+	}
+	res, err := from.agent.HTTPClient.Do(req)
+	if err != nil {
+		e.t.Fatalf("SendTaildropFile(%s -> %s): %v", from.name, to.name, err)
+	}
+	defer res.Body.Close()
+	body, _ := io.ReadAll(res.Body)
+	if res.StatusCode != 200 {
+		e.t.Fatalf("SendTaildropFile(%s -> %s): %s: %s", from.name, to.name, res.Status, body)
+	}
+	if msg := strings.TrimSpace(string(body)); msg != "" {
+		e.t.Logf("[%s] %s", from.name, msg)
+	}
+	e.t.Logf("[%s] sent Taildrop %q (%d bytes) to %s", from.name, name, len(content), to.name)
+}
+
+// RecvTaildropFile waits for an incoming Taildrop file on the node and
+// returns the filename and contents. The provided context bounds the wait;
+// in addition, RecvTaildropFile imposes its own 90s upper bound. It fatals
+// on error or timeout.
+func (e *Env) RecvTaildropFile(ctx context.Context, n *Node) (name string, content []byte) {
+	e.t.Helper()
+	ctx, cancel := context.WithTimeout(ctx, 90*time.Second)
+	defer cancel()
+
+	req, err := http.NewRequestWithContext(ctx, "GET", "http://unused/taildrop-recv", nil)
+	if err != nil {
+		e.t.Fatalf("RecvTaildropFile: %v", err)
+	}
+	res, err := n.agent.HTTPClient.Do(req)
+	if err != nil {
+		e.t.Fatalf("RecvTaildropFile(%s): %v", n.name, err)
+	}
+	defer res.Body.Close()
+	body, _ := io.ReadAll(res.Body)
+	if res.StatusCode != 200 {
+		e.t.Fatalf("RecvTaildropFile(%s): %s: %s", n.name, res.Status, body)
+	}
+	name = res.Header.Get("Taildrop-Filename")
+	e.t.Logf("[%s] received Taildrop %q (%d bytes)", n.name, name, len(body))
+	return name, body
+}
+
+var buildGokrazy sync.Once
+
+// ensureGokrazy builds the gokrazy base image (once per test process) and
+// locates the kernel. The build is fast (~4s) so we always rebuild to ensure
+// the baked-in binaries (tta, tailscale, tailscaled) match the current source.
 func (e *Env) ensureGokrazy(ctx context.Context) error {
 	if e.gokrazyBase != "" {
 		return nil // already found
@@ -586,21 +2068,23 @@ func (e *Env) ensureGokrazy(ctx context.Context) error {
 		return err
 	}
 
-	e.gokrazyBase = filepath.Join(modRoot, "gokrazy/natlabapp.qcow2")
-	if _, err := os.Stat(e.gokrazyBase); err != nil {
-		if !os.IsNotExist(err) {
-			return err
-		}
+	var buildErr error
+	buildGokrazy.Do(func() {
 		e.t.Logf("building gokrazy natlab image...")
 		cmd := exec.CommandContext(ctx, "make", "natlab")
 		cmd.Dir = filepath.Join(modRoot, "gokrazy")
 		cmd.Stderr = os.Stderr
 		cmd.Stdout = os.Stdout
 		if err := cmd.Run(); err != nil {
-			return fmt.Errorf("make natlab: %w", err)
+			buildErr = fmt.Errorf("make natlab: %w", err)
 		}
+	})
+	if buildErr != nil {
+		return buildErr
 	}
 
+	e.gokrazyBase = filepath.Join(modRoot, "gokrazy/natlabapp.qcow2")
+
 	kernel, err := findKernelPath(filepath.Join(modRoot, "go.mod"))
 	if err != nil {
 		return fmt.Errorf("finding kernel: %w", err)
@@ -609,8 +2093,13 @@ func (e *Env) ensureGokrazy(ctx context.Context) error {
 	return nil
 }
 
-// compileBinariesForOS cross-compiles tta, tailscale, and tailscaled for the
-// given GOOS/GOARCH and places them in e.binDir/<goos>_<goarch>/.
+// compileBinariesForOS prepares the tta, tailscale, and tailscaled binaries
+// for the given GOOS/GOARCH and places them in e.binDir/<goos>_<goarch>/.
+//
+// tta is always built from the local source tree (the test agent must match
+// the test framework). When --test-version is set, tailscale and tailscaled
+// are taken from the downloaded release tarball instead of being compiled
+// from source.
 func (e *Env) compileBinariesForOS(ctx context.Context, goos, goarch string) error {
 	modRoot, err := findModRoot()
 	if err != nil {
@@ -623,14 +2112,20 @@ func (e *Env) compileBinariesForOS(ctx context.Context, goos, goarch string) err
 		return err
 	}
 
-	binaries := []struct{ name, pkg string }{
-		{"tta", "./cmd/tta"},
-		{"tailscale", "./cmd/tailscale"},
-		{"tailscaled", "./cmd/tailscaled"},
+	// Use downloaded release binaries only on Linux: pkgs.tailscale.com only
+	// publishes Linux tarballs, so other GOOS values still build from source.
+	useDownloaded := e.testVersion != "" && goos == "linux"
+
+	type binary struct{ name, pkg string }
+	buildBins := []binary{{"tta", "./cmd/tta"}}
+	if !useDownloaded {
+		buildBins = append(buildBins,
+			binary{"tailscale", "./cmd/tailscale"},
+			binary{"tailscaled", "./cmd/tailscaled"})
 	}
 
 	var eg errgroup.Group
-	for _, bin := range binaries {
+	for _, bin := range buildBins {
 		eg.Go(func() error {
 			outPath := filepath.Join(outDir, bin.name)
 			e.t.Logf("compiling %s/%s...", dir, bin.name)
@@ -644,9 +2139,36 @@ func (e *Env) compileBinariesForOS(ctx context.Context, goos, goarch string) err
 			return nil
 		})
 	}
+
+	if useDownloaded {
+		eg.Go(func() error {
+			srcDir, err := ensureVersionBinaries(ctx, e.testVersion, goarch, e.t.Logf)
+			if err != nil {
+				return err
+			}
+			for _, name := range []string{"tailscale", "tailscaled"} {
+				if err := copyFile(filepath.Join(srcDir, name), filepath.Join(outDir, name), 0755); err != nil {
+					return fmt.Errorf("staging %s/%s: %w", dir, name, err)
+				}
+			}
+			e.t.Logf("staged version %s tailscale & tailscaled for %s", e.testVersion, dir)
+			return nil
+		})
+	}
+
 	return eg.Wait()
 }
 
+// copyFile copies src to dst with the given permission bits.
+func copyFile(src, dst string, perm os.FileMode) error {
+	in, err := os.Open(src)
+	if err != nil {
+		return err
+	}
+	defer in.Close()
+	return writeAtomic(dst, in, perm)
+}
+
 // findModRoot returns the root of the Go module (where go.mod is).
 func findModRoot() (string, error) {
 	out, err := exec.Command("go", "env", "GOMOD").CombinedOutput()
@@ -674,15 +2196,85 @@ func findKernelPath(goMod string) (string, error) {
 	}
 	goModCache := strings.TrimSpace(string(goModCacheB))
 
-	// Parse go.mod to find gokrazy-kernel version.
-	for _, line := range strings.Split(string(b), "\n") {
+	// Parse go.mod to find kernel version.
+	for line := range strings.SplitSeq(string(b), "\n") {
 		line = strings.TrimSpace(line)
-		if strings.HasPrefix(line, "github.com/tailscale/gokrazy-kernel") {
+		if strings.HasPrefix(line, "github.com/gokrazy/kernel.amd64") {
 			parts := strings.Fields(line)
 			if len(parts) >= 2 {
 				return filepath.Join(goModCache, parts[0]+"@"+parts[1], "vmlinuz"), nil
 			}
 		}
 	}
-	return "", fmt.Errorf("gokrazy-kernel not found in %s", goMod)
+	return "", fmt.Errorf("kernel.amd64 not found in %s", goMod)
+}
+
+// PingRoute describes what connection type was used to transfer a Disco ping.
+type PingRoute string
+
+const (
+	PingRouteDirect PingRoute = "direct"
+	PingRouteDERP   PingRoute = "derp"
+	PingRouteLocal  PingRoute = "local"
+	PingRouteNil    PingRoute = "nil"
+)
+
+// classifyPing finds what kind of route has been used on a ping path.
+// It is only really relevant for DiscoPings.
+func classifyPing(pr *ipnstate.PingResult) PingRoute {
+	if pr == nil {
+		return PingRouteNil
+	}
+
+	if pr.Endpoint == "" {
+		return PingRouteDERP
+	}
+
+	ap, err := netip.ParseAddrPort(pr.Endpoint)
+	if err == nil && ap.Addr().IsPrivate() {
+		return PingRouteLocal
+	}
+	return PingRouteDirect
+}
+
+// PingExpect retries disco pings until the result matches wantRoute or the
+// timeout is reached. It is using DiscoPings as this is the only ping type
+// that can classify the connection type.
+func (e *Env) PingExpect(from, to *Node, wantRoute PingRoute, timeout time.Duration) error {
+	e.t.Helper()
+	ctx, cancel := context.WithTimeout(e.t.Context(), timeout)
+	defer cancel()
+	var lastRoute PingRoute
+	toSt, err := to.agent.Status(ctx)
+	if err != nil {
+		return fmt.Errorf("ping: can't get %s status: %w", to.name, err)
+	}
+	if len(toSt.Self.TailscaleIPs) == 0 {
+		return fmt.Errorf("ping: %s has no Tailscale IPs", to.name)
+	}
+	targetIP := toSt.Self.TailscaleIPs[0]
+	for ctx.Err() == nil {
+		pingCtx, pingCancel := context.WithTimeout(ctx, 3*time.Second)
+		pr, err := from.agent.PingWithOpts(pingCtx, targetIP, tailcfg.PingDisco, local.PingOpts{})
+		pingCancel()
+		if err == nil && pr.Err == "" {
+			if got := classifyPing(pr); got == wantRoute {
+				e.t.Logf("Saw ping type %q", got)
+				return nil
+			} else {
+				e.t.Logf("Saw ping type %q", got)
+				lastRoute = got
+			}
+		}
+		select {
+		case <-time.After(500 * time.Millisecond):
+		case <-ctx.Done():
+		}
+	}
+	return fmt.Errorf("ping route = %q, want %q (after %v)", lastRoute, wantRoute, timeout)
+}
+
+// NumNodes returns the current number of nodes configured in the env.
+func (env *Env) NumNodes() int {
+	return len(env.nodes)
 }
diff --git a/tstest/natlab/vmtest/vmtest_test.go b/tstest/natlab/vmtest/vmtest_test.go
index 91c8359f1..0daae92fa 100644
--- a/tstest/natlab/vmtest/vmtest_test.go
+++ b/tstest/natlab/vmtest/vmtest_test.go
@@ -4,14 +4,78 @@
 package vmtest_test
 
 import (
+	"bytes"
+	"context"
 	"fmt"
+	"net/netip"
+	"runtime"
 	"strings"
 	"testing"
+	"time"
 
+	"tailscale.com/client/local"
+	"tailscale.com/ipn"
+	"tailscale.com/net/udprelay/status"
+	"tailscale.com/tailcfg"
+	"tailscale.com/tstest"
+	"tailscale.com/tstest/integration/testcontrol"
 	"tailscale.com/tstest/natlab/vmtest"
 	"tailscale.com/tstest/natlab/vnet"
+	"tailscale.com/types/key"
+	"tailscale.com/types/netmap"
+	"tailscale.com/util/set"
 )
 
+// skipIfNotMacOSArm64 skips the test when the host isn't a macOS arm64 host.
+// macOS VM tests require Apple Virtualization.framework via tailmac.
+// AddNode also enforces this when a macOS node is added, but having an
+// explicit skip at the top of macOS-only tests makes the requirement
+// obvious to readers.
+func skipIfNotMacOSArm64(t *testing.T) {
+	t.Helper()
+	if runtime.GOOS != "darwin" || runtime.GOARCH != "arm64" {
+		t.Skipf("macOS VM tests require a macOS arm64 host (got %s/%s)", runtime.GOOS, runtime.GOARCH)
+	}
+}
+
+func TestMacOSAndLinuxCanPing(t *testing.T) {
+	skipIfNotMacOSArm64(t)
+	env := vmtest.New(t)
+
+	lan := env.AddNetwork("192.168.1.1/24")
+
+	linux := env.AddNode("linux", lan,
+		vmtest.OS(vmtest.Gokrazy),
+		vmtest.DontJoinTailnet())
+	macos := env.AddNode("macos", lan,
+		vmtest.OS(vmtest.MacOS),
+		vmtest.DontJoinTailnet())
+
+	env.Start()
+
+	env.LANPing(linux, macos.LanIP(lan))
+}
+
+func TestTwoMacOSVMsCanPing(t *testing.T) {
+	skipIfNotMacOSArm64(t)
+	env := vmtest.New(t)
+
+	lan := env.AddNetwork("192.168.1.1/24")
+
+	mac1 := env.AddNode("mac1", lan,
+		vmtest.OS(vmtest.MacOS),
+		vmtest.DontJoinTailnet())
+	mac2 := env.AddNode("mac2", lan,
+		vmtest.OS(vmtest.MacOS),
+		vmtest.DontJoinTailnet())
+
+	env.Start()
+
+	// Both macOS VMs have TTA. Ping from mac1 to mac2 and vice versa.
+	env.LANPing(mac1, mac2.LanIP(lan))
+	env.LANPing(mac2, mac1.LanIP(lan))
+}
+
 func TestSubnetRouter(t *testing.T) {
 	testSubnetRouterForOS(t, vmtest.Ubuntu2404)
 }
@@ -20,6 +84,28 @@ func TestSubnetRouterFreeBSD(t *testing.T) {
 	testSubnetRouterForOS(t, vmtest.FreeBSD150)
 }
 
+func TestSubnetRouterFedora(t *testing.T) {
+	testSubnetRouterForOS(t, vmtest.Fedora43)
+}
+
+// TestFedoraDNSDirect verifies that provisioning a Fedora node with
+// WithDNSMode(DNSDirect) — which masks systemd-resolved — makes tailscaled
+// select the "direct" DNS backend instead of the image default
+// ("systemd-resolved"). This is what lets one distro image cover multiple DNS
+// backends, so adding a distro isn't "basically equivalent" to the others.
+func TestFedoraDNSDirect(t *testing.T) {
+	env := vmtest.New(t)
+
+	net := env.AddNetwork("2.1.1.1", "192.168.1.1/24", vnet.EasyNAT)
+	node := env.AddNode("fedora", net,
+		vmtest.OS(vmtest.Fedora43),
+		vmtest.WithDNSMode(vmtest.DNSDirect))
+
+	env.Start()
+
+	env.AssertDNSBackend(node, "direct")
+}
+
 func testSubnetRouterForOS(t testing.TB, srOS vmtest.OSImage) {
 	t.Helper()
 	env := vmtest.New(t)
@@ -37,11 +123,1356 @@ func testSubnetRouterForOS(t testing.TB, srOS vmtest.OSImage) {
 		vmtest.DontJoinTailnet(),
 		vmtest.WebServer(8080))
 
-	env.Start()
-	env.ApproveRoutes(sr, "10.0.0.0/24")
+	// Declare test-specific steps for the web UI.
+	approveStep := env.AddStep("Approve subnet routes")
+	httpStep := env.AddStep("HTTP GET through subnet router")
 
+	env.Start()
+
+	// Log which DNS backend the (Linux) subnet router selected. This is the
+	// whole point of testing multiple distros: they should exercise different
+	// DNS managers. Once we've confirmed the expected value per distro, this
+	// can become an AssertDNSBackend. FreeBSD has no Linux DNS gauge, so skip.
+	if srOS.GOOS() == "linux" {
+		t.Logf("subnet-router (%s) DNS backend: %s", srOS.Name, env.DNSBackend(sr))
+	}
+
+	approveStep.Begin()
+	env.ApproveRoutes(sr, "10.0.0.0/24")
+	approveStep.End(nil)
+
+	httpStep.Begin()
 	body := env.HTTPGet(client, fmt.Sprintf("http://%s:8080/", backend.LanIP(internalNet)))
 	if !strings.Contains(body, "Hello world I am backend") {
-		t.Fatalf("got %q", body)
+		httpStep.Fatalf("got %q", body)
+	}
+	httpStep.End(nil)
+}
+
+func TestSiteToSite(t *testing.T) {
+	testSiteToSite(t, vmtest.Ubuntu2404)
+}
+
+// testSiteToSite runs a site-to-site subnet routing test with
+// --snat-subnet-routes=false, verifying that original source IPs are preserved
+// across Tailscale subnet routes.
+//
+// Topology:
+//
+//	Site A:  backend-a (10.1.0.0/24) ← → sr-a (WAN + LAN-A)
+//	Site B:  backend-b (10.2.0.0/24) ← → sr-b (WAN + LAN-B)
+//
+// Both subnet routers are on Tailscale with --snat-subnet-routes=false.
+// The test sends HTTP from backend-a to backend-b through the subnet routers
+// and verifies that backend-b sees backend-a's LAN IP (not the subnet router's).
+func testSiteToSite(t *testing.T, srOS vmtest.OSImage) {
+	env := vmtest.New(t)
+
+	// WAN networks for each site (each behind NAT).
+	wanA := env.AddNetwork("2.1.1.1", "192.168.1.1/24", vnet.EasyNAT)
+	wanB := env.AddNetwork("3.1.1.1", "192.168.2.1/24", vnet.EasyNAT)
+
+	// Internal LAN for each site.
+	lanA := env.AddNetwork("10.1.0.1/24")
+	lanB := env.AddNetwork("10.2.0.1/24")
+
+	// Subnet routers: each on its WAN + LAN, advertising the local LAN,
+	// with SNAT disabled to preserve source IPs.
+	srA := env.AddNode("sr-a", wanA, lanA,
+		vmtest.OS(srOS),
+		vmtest.AdvertiseRoutes("10.1.0.0/24"),
+		vmtest.SNATSubnetRoutes(false))
+	srB := env.AddNode("sr-b", wanB, lanB,
+		vmtest.OS(srOS),
+		vmtest.AdvertiseRoutes("10.2.0.0/24"),
+		vmtest.SNATSubnetRoutes(false))
+
+	// Backend servers on each site's LAN (not on Tailscale).
+	// Use Ubuntu so we can SSH in to add static routes.
+	backendA := env.AddNode("backend-a", lanA,
+		vmtest.OS(vmtest.Ubuntu2404),
+		vmtest.DontJoinTailnet(),
+		vmtest.WebServer(8080))
+	backendB := env.AddNode("backend-b", lanB,
+		vmtest.OS(vmtest.Ubuntu2404),
+		vmtest.DontJoinTailnet(),
+		vmtest.WebServer(8080))
+
+	// Declare test-specific steps for the web UI.
+	approveStep := env.AddStep("Approve subnet routes (sr-a, sr-b)")
+	staticRouteStep := env.AddStep("Add static routes on backends")
+	httpStep := env.AddStep("HTTP GET through site-to-site")
+
+	env.Start()
+
+	approveStep.Begin()
+	env.ApproveRoutes(srA, "10.1.0.0/24")
+	env.ApproveRoutes(srB, "10.2.0.0/24")
+	approveStep.End(nil)
+
+	// Add static routes on the backends so that traffic to the remote site's
+	// subnet goes through the local subnet router. This mirrors how a real
+	// site-to-site deployment is configured.
+	srALanIP := srA.LanIP(lanA).String()
+	srBLanIP := srB.LanIP(lanB).String()
+	t.Logf("sr-a LAN IP: %s, sr-b LAN IP: %s", srALanIP, srBLanIP)
+	t.Logf("backend-a LAN IP: %s, backend-b LAN IP: %s", backendA.LanIP(lanA), backendB.LanIP(lanB))
+
+	staticRouteStep.Begin()
+	env.AddRoute(backendA, "10.2.0.0/24", srALanIP)
+	env.AddRoute(backendB, "10.1.0.0/24", srBLanIP)
+	staticRouteStep.End(nil)
+
+	// Make an HTTP request from backend-a to backend-b through the subnet routers.
+	// TTA's /http-get falls back to direct dial on non-Tailscale nodes.
+	httpStep.Begin()
+	backendBIP := backendB.LanIP(lanB)
+	body := env.HTTPGet(backendA, fmt.Sprintf("http://%s:8080/", backendBIP))
+	t.Logf("response: %s", body)
+
+	if !strings.Contains(body, "Hello world I am backend-b") {
+		httpStep.Fatalf("expected response from backend-b, got %q", body)
+	}
+
+	// Verify the source IP was preserved. With --snat-subnet-routes=false,
+	// backend-b should see backend-a's LAN IP as the source, not sr-b's LAN IP.
+	backendAIP := backendA.LanIP(lanA).String()
+	if !strings.Contains(body, "from "+backendAIP) {
+		httpStep.Fatalf("source IP not preserved: expected %q in response, got %q", backendAIP, body)
+	}
+	httpStep.End(nil)
+}
+
+// TestInterNetworkTCP verifies that vnet routes raw TCP between simulated
+// networks: a non-Tailscale VM on one NAT'd LAN can reach a webserver on a
+// different network using a 1:1 NAT, and the webserver sees the client's
+// network's WAN IP as the source (post-NAT).
+func TestInterNetworkTCP(t *testing.T) {
+	env := vmtest.New(t)
+
+	const (
+		clientWAN = "1.0.0.1"
+		webWAN    = "5.0.0.1"
+	)
+
+	clientNet := env.AddNetwork(clientWAN, "192.168.1.1/24", vnet.EasyNAT)
+	webNet := env.AddNetwork(webWAN, "192.168.5.1/24", vnet.One2OneNAT)
+
+	client := env.AddNode("client", clientNet,
+		vmtest.OS(vmtest.Gokrazy),
+		vmtest.DontJoinTailnet())
+	env.AddNode("webserver", webNet,
+		vmtest.OS(vmtest.Gokrazy),
+		vmtest.DontJoinTailnet(),
+		vmtest.WebServer(8080))
+
+	// Declare test-specific steps for the web UI.
+	httpStep := env.AddStep("HTTP GET across networks via NAT")
+
+	env.Start()
+
+	httpStep.Begin()
+	body := env.HTTPGet(client, fmt.Sprintf("http://%s:8080/", webWAN))
+	t.Logf("response: %s", body)
+	if !strings.Contains(body, "Hello world I am webserver") {
+		httpStep.Fatalf("unexpected response: %q", body)
+	}
+	if !strings.Contains(body, "from "+clientWAN) {
+		httpStep.Fatalf("expected source %q in response, got %q", clientWAN, body)
+	}
+	httpStep.End(nil)
+}
+
+// TestSubnetRouterPublicIP verifies that toggling --accept-routes on the
+// client switches between dialing a webserver directly and routing through a
+// subnet router that advertises the webserver's public IP range.
+//
+// Topology: client, subnet router, and webserver each live behind their own
+// NAT'd network with distinct WAN IPs; the subnet router advertises the
+// webserver's network as a route. The webserver echoes the source IP it
+// sees:
+//   - accept-routes=off: client dials webserver directly; source is client's WAN.
+//   - accept-routes=on:  client tunnels to the subnet router, which forwards
+//     and SNATs; source is subnet router's WAN.
+func TestSubnetRouterPublicIP(t *testing.T) {
+	env := vmtest.New(t)
+
+	const (
+		clientWAN = "1.0.0.1"
+		routerWAN = "2.0.0.1"
+		webWAN    = "5.0.0.1"
+		webRoute  = "5.0.0.0/24"
+	)
+
+	clientNet := env.AddNetwork(clientWAN, "192.168.1.1/24", vnet.EasyNAT)
+	routerNet := env.AddNetwork(routerWAN, "192.168.2.1/24", vnet.EasyNAT)
+	webNet := env.AddNetwork(webWAN, "192.168.5.1/24", vnet.One2OneNAT)
+
+	client := env.AddNode("client", clientNet,
+		vmtest.OS(vmtest.Gokrazy))
+	sr := env.AddNode("subnet-router", routerNet,
+		vmtest.OS(vmtest.Gokrazy),
+		vmtest.AdvertiseRoutes(webRoute))
+	env.AddNode("webserver", webNet,
+		vmtest.OS(vmtest.Gokrazy),
+		vmtest.DontJoinTailnet(),
+		vmtest.WebServer(8080))
+
+	// Declare test-specific steps for the web UI.
+	approveStep := env.AddStep("Approve subnet route (public IP)")
+	checkOn1Step := env.AddStep("HTTP GET (accept-routes=on)")
+	checkOffStep := env.AddStep("HTTP GET (accept-routes=off)")
+	checkOn2Step := env.AddStep("HTTP GET (accept-routes=on, again)")
+
+	env.Start()
+	// ApproveRoutes also turns on RouteAll on the client.
+	approveStep.Begin()
+	env.ApproveRoutes(sr, webRoute)
+	approveStep.End(nil)
+
+	webURL := fmt.Sprintf("http://%s:8080/", webWAN)
+	check := func(step *vmtest.Step, label, wantSrc string) {
+		t.Helper()
+		step.Begin()
+		body := env.HTTPGet(client, webURL)
+		t.Logf("[%s] response: %s", label, body)
+		if !strings.Contains(body, "Hello world I am webserver") {
+			step.Fatalf("[%s] unexpected webserver response: %q", label, body)
+		}
+		if !strings.Contains(body, "from "+wantSrc) {
+			step.Fatalf("[%s] expected source %q in response, got %q", label, wantSrc, body)
+		}
+		step.End(nil)
+	}
+
+	// accept-routes=on (set by ApproveRoutes): traffic flows via the subnet router.
+	check(checkOn1Step, "accept-routes=on", routerWAN)
+
+	// accept-routes=off: client dials the webserver directly.
+	env.SetAcceptRoutes(client, false)
+	check(checkOffStep, "accept-routes=off", clientWAN)
+
+	// Toggle back on to confirm the transition works in both directions.
+	env.SetAcceptRoutes(client, true)
+	check(checkOn2Step, "accept-routes=on (again)", routerWAN)
+}
+
+// TestSubnetRouterAndExitNode checks how the subnet router and exit node
+// preferences interact. Topology: client, subnet router, exit node, and
+// webserver, each on its own NAT'd network with distinct WAN IPs. The subnet
+// router advertises the webserver's network (5.0.0.0/24); the exit node
+// advertises 0.0.0.0/0 + ::/0. The webserver echoes the source IP it sees:
+//
+//	exit=off, subnet=off → client's WAN  (direct dial)
+//	exit=off, subnet=on  → subnet router's WAN
+//	exit=on,  subnet=off → exit node's WAN
+//	exit=on,  subnet=on  → subnet router's WAN  (more-specific /24 beats /0)
+func TestSubnetRouterAndExitNode(t *testing.T) {
+	env := vmtest.New(t)
+
+	const (
+		clientWAN = "1.0.0.1"
+		routerWAN = "2.0.0.1"
+		exitWAN   = "3.0.0.1"
+		webWAN    = "5.0.0.1"
+		webRoute  = "5.0.0.0/24"
+	)
+
+	clientNet := env.AddNetwork(clientWAN, "192.168.1.1/24", vnet.EasyNAT)
+	routerNet := env.AddNetwork(routerWAN, "192.168.2.1/24", vnet.EasyNAT)
+	exitNet := env.AddNetwork(exitWAN, "192.168.3.1/24", vnet.EasyNAT)
+	webNet := env.AddNetwork(webWAN, "192.168.5.1/24", vnet.One2OneNAT)
+
+	client := env.AddNode("client", clientNet,
+		vmtest.OS(vmtest.Gokrazy))
+	sr := env.AddNode("subnet-router", routerNet,
+		vmtest.OS(vmtest.Gokrazy),
+		vmtest.AdvertiseRoutes(webRoute))
+	exit := env.AddNode("exit", exitNet,
+		vmtest.OS(vmtest.Gokrazy),
+		vmtest.AdvertiseRoutes("0.0.0.0/0,::/0"))
+	env.AddNode("webserver", webNet,
+		vmtest.OS(vmtest.Gokrazy),
+		vmtest.DontJoinTailnet(),
+		vmtest.WebServer(8080))
+
+	// Declare test-specific steps for the web UI.
+	approveStep := env.AddStep("Approve subnet & exit routes")
+
+	webURL := fmt.Sprintf("http://%s:8080/", webWAN)
+	tests := []struct {
+		name    string // subtest name; describes (exit, subnet) toggles
+		exit    *vmtest.Node
+		subnet  bool
+		wantSrc string
+		step    *vmtest.Step
+	}{
+		{"exit-off,subnet-off", nil, false, clientWAN, nil},
+		{"exit-off,subnet-on", nil, true, routerWAN, nil},
+		{"exit-on,subnet-off", exit, false, exitWAN, nil},
+		// More-specific 5.0.0.0/24 from sr beats 0.0.0.0/0 from exit.
+		{"exit-on,subnet-on", exit, true, routerWAN, nil},
+	}
+	for i := range tests {
+		tests[i].step = env.AddStep("HTTP GET: " + tests[i].name)
+	}
+
+	env.Start()
+	approveStep.Begin()
+	env.ApproveRoutes(sr, webRoute)
+	env.ApproveRoutes(exit, "0.0.0.0/0", "::/0")
+	// Don't let the exit node itself forward via the subnet router: when the
+	// client is using the exit node only, we want the exit node to egress to
+	// the simulated internet directly so the webserver sees the exit's WAN.
+	env.SetAcceptRoutes(exit, false)
+	approveStep.End(nil)
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			tc.step.Begin()
+			env.SetExitNode(client, tc.exit)
+			env.SetAcceptRoutes(client, tc.subnet)
+			body := env.HTTPGet(client, webURL)
+			t.Logf("response: %s", body)
+			if !strings.Contains(body, "Hello world I am webserver") {
+				tc.step.End(fmt.Errorf("unexpected webserver response: %q", body))
+				t.Fatalf("unexpected webserver response: %q", body)
+			}
+			if !strings.Contains(body, "from "+tc.wantSrc) {
+				tc.step.End(fmt.Errorf("expected source %q in response, got %q", tc.wantSrc, body))
+				t.Fatalf("expected source %q in response, got %q", tc.wantSrc, body)
+			}
+			tc.step.End(nil)
+		})
 	}
 }
+
+// TestTaildrop verifies that one Ubuntu node can send a file to another
+// Ubuntu node via Taildrop, and the receiver gets the same content.
+//
+// Topology: two Ubuntu nodes, each behind its own EasyNAT, both joined to the
+// tailnet. The sender runs `tailscale file cp` to push to the receiver's
+// Tailscale IP; the receiver then runs `tailscale file get --wait` to fetch
+// it.
+func TestTaildrop(t *testing.T) {
+	env := vmtest.New(t, vmtest.SameTailnetUser())
+
+	senderNet := env.AddNetwork("1.0.0.1", "192.168.1.1/24", vnet.EasyNAT)
+	receiverNet := env.AddNetwork("2.0.0.1", "192.168.2.1/24", vnet.EasyNAT)
+
+	sender := env.AddNode("sender", senderNet,
+		vmtest.OS(vmtest.Ubuntu2404))
+	receiver := env.AddNode("receiver", receiverNet,
+		vmtest.OS(vmtest.Ubuntu2404))
+
+	// Declare test-specific steps for the web UI.
+	sendStep := env.AddStep("Taildrop send (sender -> receiver)")
+	recvStep := env.AddStep("Taildrop receive (on receiver)")
+	verifyStep := env.AddStep("Verify received name and contents")
+
+	env.Start()
+
+	const filename = "hello.txt"
+	want := []byte("hello world this is a Taildrop test\n")
+
+	sendStep.Begin()
+	env.SendTaildropFile(sender, receiver, filename, want)
+	sendStep.End(nil)
+
+	recvStep.Begin()
+	gotName, gotContent := env.RecvTaildropFile(t.Context(), receiver)
+	recvStep.End(nil)
+
+	verifyStep.Begin()
+	if gotName != filename {
+		verifyStep.Fatalf("received name = %q; want %q", gotName, filename)
+		return
+	}
+	if !bytes.Equal(gotContent, want) {
+		verifyStep.Fatalf("received content = %q; want %q", gotContent, want)
+		return
+	}
+	verifyStep.End(nil)
+}
+
+// TestExitNode verifies that switching the client's exit node setting between
+// off, exit1, and exit2 correctly routes the client's internet traffic.
+//
+// Topology: each of the client and the two exit nodes lives behind its own NAT
+// with a unique WAN IP, and a webserver lives on yet another network using a
+// 1:1 NAT so it's reachable from the simulated internet at a stable address.
+// The webserver echoes the source IP of incoming requests, so we can tell
+// which network's NAT the client's traffic egressed through:
+//   - off:  source is the client's network WAN IP.
+//   - exit1: source is exit1's network WAN IP.
+//   - exit2: source is exit2's network WAN IP.
+func TestExitNode(t *testing.T) {
+	env := vmtest.New(t)
+
+	const (
+		clientWAN = "1.0.0.1"
+		exit1WAN  = "2.0.0.1"
+		exit2WAN  = "3.0.0.1"
+		webWAN    = "5.0.0.1"
+	)
+
+	clientNet := env.AddNetwork(clientWAN, "192.168.1.1/24", vnet.EasyNAT)
+	exit1Net := env.AddNetwork(exit1WAN, "192.168.2.1/24", vnet.EasyNAT)
+	exit2Net := env.AddNetwork(exit2WAN, "192.168.3.1/24", vnet.EasyNAT)
+	webNet := env.AddNetwork(webWAN, "192.168.5.1/24", vnet.One2OneNAT)
+
+	client := env.AddNode("client", clientNet,
+		vmtest.OS(vmtest.Gokrazy))
+	exit1 := env.AddNode("exit1", exit1Net,
+		vmtest.OS(vmtest.Gokrazy),
+		vmtest.AdvertiseRoutes("0.0.0.0/0,::/0"))
+	exit2 := env.AddNode("exit2", exit2Net,
+		vmtest.OS(vmtest.Gokrazy),
+		vmtest.AdvertiseRoutes("0.0.0.0/0,::/0"))
+	env.AddNode("webserver", webNet,
+		vmtest.OS(vmtest.Gokrazy),
+		vmtest.DontJoinTailnet(),
+		vmtest.WebServer(8080))
+
+	// Declare test-specific steps for the web UI.
+	approveStep := env.AddStep("Approve exit-node routes (exit1, exit2)")
+
+	webURL := fmt.Sprintf("http://%s:8080/", webWAN)
+	tests := []struct {
+		name    string // subtest name
+		exit    *vmtest.Node
+		wantSrc string
+		step    *vmtest.Step
+	}{
+		{"off", nil, clientWAN, nil},
+		{"exit1", exit1, exit1WAN, nil},
+		{"exit2", exit2, exit2WAN, nil},
+	}
+	for i := range tests {
+		tests[i].step = env.AddStep("HTTP GET: exit=" + tests[i].name)
+	}
+
+	env.Start()
+	approveStep.Begin()
+	env.ApproveRoutes(exit1, "0.0.0.0/0", "::/0")
+	env.ApproveRoutes(exit2, "0.0.0.0/0", "::/0")
+	approveStep.End(nil)
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			tt.step.Begin()
+			env.SetExitNode(client, tt.exit)
+			body := env.HTTPGet(client, webURL)
+			t.Logf("response: %s", body)
+			if !strings.Contains(body, "Hello world I am webserver") {
+				tt.step.Fatalf("unexpected webserver response: %q", body)
+			}
+			if !strings.Contains(body, "from "+tt.wantSrc) {
+				tt.step.Fatalf("expected source %q in response, got %q", tt.wantSrc, body)
+			}
+			tt.step.End(nil)
+		})
+	}
+}
+
+// TestExitNodeV4Only verifies that when an exit node is on an
+// IPv4-only network, a client can still connect through it to a
+// webserver whose DNS name has both A and AAAA records. This
+// exercises the happy-eyeballs race dial in net/tsdial.UserDial:
+// the AAAA connect attempt fails (exit node has no IPv6 egress),
+// but the A attempt succeeds.
+//
+// Fixes tailscale/tailscale#13257 and #19792.
+func TestExitNodeV4Only(t *testing.T) {
+	env := vmtest.New(t)
+
+	// Exit node network: IPv4 only (no IPv6 prefix → CanV6()=false).
+	// It advertises both 0.0.0.0/0 and ::/0 (required by tailscale up)
+	// but the network has no IPv6 WAN, so v6 traffic will be dropped.
+	exitNet := env.AddNetwork("2.0.0.1", "192.168.2.1/24", vnet.EasyNAT)
+	// Client network: dual-stack so Go's net.Resolver prefers AAAA.
+	clientNet := env.AddNetwork("1.0.0.1", "2000:1::1/64", "192.168.1.1/24", vnet.EasyNAT)
+	// Web server network: use the FakeDualStackWeb VIP's v4 as WAN.
+	webNet := env.AddNetwork("5.0.0.100", "192.168.5.1/24", vnet.One2OneNAT)
+
+	client := env.AddNode("client", clientNet,
+		vmtest.OS(vmtest.Gokrazy),
+		// Force AAAA addresses first in userDialResolveAll results so
+		// the old single-IP code path would pick an unreachable v6 addr.
+		vnet.TailscaledEnv{Key: "TS_DEBUG_PREFER_IPV6_USERDIAL", Value: "1"})
+	exit := env.AddNode("exit", exitNet,
+		vmtest.OS(vmtest.Gokrazy),
+		vmtest.AdvertiseRoutes("0.0.0.0/0,::/0"))
+	env.AddNode("webserver", webNet,
+		vmtest.OS(vmtest.Gokrazy),
+		vmtest.DontJoinTailnet(),
+		vmtest.WebServer(8080))
+
+	approveStep := env.AddStep("Approve exit-node routes")
+	fetchStep := env.AddStep("HTTP GET via exit node using dual-stack DNS name")
+
+	env.Start()
+
+	approveStep.Begin()
+	env.ApproveRoutes(exit, "0.0.0.0/0", "::/0")
+	approveStep.End(nil)
+
+	fetchStep.Begin()
+	env.SetExitNode(client, exit)
+	// Use the VIP hostname so DNS returns both A (5.0.0.100) and AAAA
+	// (2052::5:100). The exit node's network has no IPv6 WAN, so the
+	// AAAA connect attempt will fail and the dialer must fall back to
+	// the A record via happy eyeballs.
+	body := env.HTTPGet(client, "http://dualstack-web.example.com:8080/")
+	t.Logf("response: %s", body)
+	if !strings.Contains(body, "Hello world I am webserver") {
+		fetchStep.Fatalf("unexpected webserver response: %q", body)
+	}
+	if !strings.Contains(body, "from 2.0.0.1") {
+		fetchStep.Fatalf("expected traffic from exit node WAN (2.0.0.1), got: %q", body)
+	}
+	fetchStep.End(nil)
+}
+
+// TestDiscoKeyChange verifies that when one node's disco key rotates without
+// its WireGuard node key changing, peers detect the change, tear down stale
+// WireGuard session state for that peer, and re-establish the tunnel in both
+// directions. This exercises the disco-key-change handling that the
+// bradfitz/rm_lazy_wg branch relies on for traffic to and from a peer whose
+// magicsock state has been reset.
+//
+// Topology: two gokrazy nodes A and B, each on its own One2OneNAT network so
+// every connection between them is a direct UDP path with no port-mapping or
+// filtering. With NAT effects out of the way, what we measure here is the
+// speed of disco-key-change reconciliation in wgengine/magicsock alone. The
+// test control server is also configured with [testcontrol.Server.AllOnline]
+// (via [vmtest.AllOnline]) so the controlclient/wgengine fast paths that
+// branch on Online actually fire — without that flag the test exercises
+// only the offline-peer code paths, which mask separate latent issues and
+// are several seconds slower.
+//
+// The test runs four B-side rotations followed by a TSMP ping in the
+// requested direction:
+//
+//	rotate (LocalAPI rotate-disco-key) → ping B → A
+//	rotate (LocalAPI rotate-disco-key) → ping A → B
+//	restart  (SIGKILL tailscaled)      → ping B → A
+//	restart  (SIGKILL tailscaled)      → ping A → B
+//
+// Plus an initial A→B TSMP ping with a generous 30s budget to bring up the
+// WireGuard tunnel before the rotations begin (so the post-rotation pings
+// measure stale-state recovery, not first-time setup). All pings are TSMP
+// because TSMP traverses the actual WireGuard data plane; PingDisco only
+// exercises the magicsock disco layer and would mask any stale WG session
+// problems.
+//
+// Two rotation methods are exercised:
+//
+//   - LocalAPI rotate-disco-key (debug action): rolls B's magicsock disco
+//     private key in place, then bounces WantRunning to force wgengine to
+//     drop wireguard-go session keys for every peer (RotateDiscoKey alone
+//     only touches local disco state; without the WantRunning bounce, B
+//     keeps using stale per-peer session keys against A and A drops
+//     everything until B's WG rekey timer eventually fires).
+//   - SIGKILL of tailscaled (via TTA's /kill-tailscaled): the gokrazy
+//     supervisor respawns tailscaled, fully resetting B's magicsock and
+//     wgengine state in addition to rotating the disco key.
+//
+// Each post-rotation ping currently gets a 15-second budget. On a
+// hypothetical perfect build it should take well under a second. In
+// practice today there are two unavoidable multi-second waits:
+//
+//   - The rotate-then-a→b phase on main takes ~10s for LazyWG. After
+//     B's WantRunning bounce, B's wgengine resets its sentActivityAt/
+//     recvActivityAt maps and trims A out of the wireguard-go config
+//     as an "idle peer"; B only re-adds A on inbound activity, by
+//     which point A's first few TSMP packets have been silently
+//     dropped at B's tundev. The bradfitz/rm_lazy_wg branch removes
+//     that trimming entirely (verified locally), so this phase will
+//     drop to <100ms once that branch lands.
+//
+//   - The restart phases take ~5s for the wireguard-go handshake retry
+//     timer. After SIGKILL+respawn the first WG handshake init from
+//     the restarted node sometimes goes into the void (likely the
+//     brief peer-removed window in the receiver's two-step
+//     [wgengine.userspaceEngine.maybeReconfigWireguardLocked] reconfig
+//     during which the peer is absent from wireguard-go), and wg-go's
+//     [device.RekeyTimeout] of 5s + jitter is the next opportunity to
+//     retry. That retry succeeds and the staged TSMP packet flushes.
+//     This is intrinsic to the protocol's retransmit policy.
+//
+// Once LazyWG is removed and the first-handshake-after-reconfig race
+// is fixed, this budget should be tightened to 5s (or less).
+//
+// All four rotations also assert that B's WireGuard node key is unchanged.
+func TestDiscoKeyChange(t *testing.T) {
+	// AllOnline makes the test control server mark every peer as Online=true
+	// in its MapResponses. Several disco-key handling fast paths
+	// (controlclient.removeUnwantedDiscoUpdates,
+	// removeUnwantedDiscoUpdatesFromFullNetmapUpdate, and the wgengine
+	// tsmpLearnedDisco fast path) only fire for online peers. Production
+	// control servers always populate Online; without this flag the test
+	// would only exercise the offline-peer paths.
+	env := vmtest.New(t, vmtest.AllOnline())
+
+	// One2OneNAT so each node has a 1:1 mapping to a public WAN IP with no
+	// port-translation or address-port filtering. This makes A↔B traffic
+	// behave like two unfirewalled hosts on the public internet, so any
+	// slowness we observe in this test cannot be blamed on NAT traversal.
+	aNet := env.AddNetwork("1.0.0.1", "192.168.1.1/24", vnet.One2OneNAT)
+	bNet := env.AddNetwork("2.0.0.1", "192.168.2.1/24", vnet.One2OneNAT)
+
+	a := env.AddNode("a", aNet, vmtest.OS(vmtest.Gokrazy))
+	b := env.AddNode("b", bNet, vmtest.OS(vmtest.Gokrazy))
+
+	type phase struct {
+		name      string
+		rotate    func()
+		pingFrom  *vmtest.Node
+		pingTo    *vmtest.Node
+		applyStep *vmtest.Step
+		verify    *vmtest.Step
+		wait      *vmtest.Step
+		ping      *vmtest.Step
+	}
+	phases := []*phase{
+		{name: "rotate (LocalAPI), b → a", pingFrom: b, pingTo: a, rotate: func() { env.RotateDiscoKey(b) }},
+		{name: "rotate (LocalAPI), a → b", pingFrom: a, pingTo: b, rotate: func() { env.RotateDiscoKey(b) }},
+		{name: "restart, b → a", pingFrom: b, pingTo: a, rotate: func() { env.RestartTailscaled(b) }},
+		{name: "restart, a → b", pingFrom: a, pingTo: b, rotate: func() { env.RestartTailscaled(b) }},
+	}
+
+	pingABStep := env.AddStep("Ping a → b TSMP (establish tunnel)")
+	for _, p := range phases {
+		p.applyStep = env.AddStep("Apply: " + p.name)
+		p.verify = env.AddStep("Verify b: same node key, new disco key (" + p.name + ")")
+		p.wait = env.AddStep("Wait for a to see b's new disco key (" + p.name + ")")
+		p.ping = env.AddStep("Ping " + p.pingFrom.Name() + " → " + p.pingTo.Name() + " TSMP (" + p.name + ")")
+	}
+
+	env.Start()
+
+	pingABStep.Begin()
+	if err := env.Ping(a, b, tailcfg.PingTSMP, 30*time.Second); err != nil {
+		pingABStep.Fatal(err)
+	}
+	pingABStep.End(nil)
+
+	bStInitial := env.Status(b)
+	bNodeKey := bStInitial.Self.PublicKey
+	cs := env.ControlServer()
+	bCtlNode := cs.Node(bNodeKey)
+	if bCtlNode == nil {
+		t.Fatalf("control server has no node for b's key %v", bNodeKey)
+	}
+	prevDisco := bCtlNode.DiscoKey
+	if prevDisco.IsZero() {
+		t.Fatalf("control server has no disco key for b before rotation")
+	}
+	t.Logf("[b] initial: nodekey=%s discokey=%s", bNodeKey.ShortString(), prevDisco.ShortString())
+
+	for _, p := range phases {
+		p.applyStep.Begin()
+		p.rotate()
+		p.applyStep.End(nil)
+		prevDisco = checkDiscoRotated(t, env, a, b, p.pingFrom, p.pingTo, bNodeKey, prevDisco, p.name,
+			p.verify, p.wait, p.ping)
+	}
+}
+
+// checkDiscoRotated verifies that after some action that should have rotated
+// b's disco key, control has learned the new key, b's node key is unchanged,
+// a's local view picks up the new disco key, and pingFrom can ping pingTo
+// (TSMP) within the budget. It returns b's new disco key and fatals on
+// failure.
+//
+// The TSMP ping budget is 15 seconds rather than the few hundred ms it
+// ought to take. See the top-level test docstring for a full breakdown:
+// it has to absorb LazyWG's trim+re-add for the rotate-a→b phase (~10s)
+// and wireguard-go's RekeyTimeout retry for the SIGKILL+restart phases
+// (~5s). Tighten this once both are addressed.
+func checkDiscoRotated(t *testing.T, env *vmtest.Env, a, b, pingFrom, pingTo *vmtest.Node, bNodeKey key.NodePublic, oldDisco key.DiscoPublic, label string, verifyStep, waitStep, pingStep *vmtest.Step) key.DiscoPublic {
+	t.Helper()
+	cs := env.ControlServer()
+
+	verifyStep.Begin()
+	bSt := env.Status(b)
+	if got := bSt.Self.PublicKey; got != bNodeKey {
+		verifyStep.Fatalf("[%s] b's node key changed: %v -> %v", label, bNodeKey, got)
+	}
+	var newDisco key.DiscoPublic
+	if err := tstest.WaitFor(15*time.Second, func() error {
+		n := cs.Node(bNodeKey)
+		if n == nil {
+			return fmt.Errorf("control server has no node for b")
+		}
+		if n.DiscoKey.IsZero() || n.DiscoKey == oldDisco {
+			return fmt.Errorf("control still has old disco key %v for b", n.DiscoKey)
+		}
+		newDisco = n.DiscoKey
+		return nil
+	}); err != nil {
+		verifyStep.Fatalf("[%s] %v", label, err)
+	}
+	t.Logf("[b] after %s: nodekey=%s discokey=%s", label, bNodeKey.ShortString(), newDisco.ShortString())
+	verifyStep.End(nil)
+
+	waitStep.Begin()
+	if err := tstest.WaitFor(30*time.Second, func() error {
+		d, ok, err := env.PeerDiscoKey(a, bNodeKey)
+		if err != nil {
+			return err
+		}
+		if !ok {
+			return fmt.Errorf("a doesn't yet have b in its status")
+		}
+		if d != newDisco {
+			return fmt.Errorf("a still sees b's old disco %v, want %v", d.ShortString(), newDisco.ShortString())
+		}
+		return nil
+	}); err != nil {
+		waitStep.End(err)
+		env.DumpStatus(a)
+		t.Fatalf("[%s] %v", label, err)
+	}
+	waitStep.End(nil)
+
+	pingStep.Begin()
+	t0 := time.Now()
+	if err := env.Ping(pingFrom, pingTo, tailcfg.PingTSMP, 15*time.Second); err != nil {
+		pingStep.End(err)
+		env.DumpStatus(a)
+		env.DumpStatus(b)
+		t.Fatalf("[%s] %v", label, err)
+	}
+	t.Logf("[%s] ping %s -> %s succeeded in %v", label, pingFrom.Name(), pingTo.Name(), time.Since(t0).Round(100*time.Millisecond))
+	pingStep.End(nil)
+	return newDisco
+}
+
+// TestHomeDERPReportedAfterRelogin is a regression test for the bug where, after
+// an in-process control-client swap (an interactive login or profile switch),
+// magicsock's NetInfo de-dup cache (netInfoLast) survived the swap. Because the
+// post-relogin NetInfo was structurally identical (same PreferredDERP, same NAT
+// shape), it was suppressed as unchanged and never re-reported to the new
+// control session, so control never learned the node's home DERP and peers
+// couldn't reach it over DERP. See ipn/ipnlocal:
+// setControlClientLocked -> MagicConn().ResetNetInfoLast.
+//
+// The test brings a node up, records the home DERP region the test control
+// learned, re-logs the node in (new node identity, same control/network/NAT/
+// DERP), and asserts control re-learns the same non-zero home DERP for the new
+// identity. Without the fix this assertion times out at HomeDERP==0.
+func TestHomeDERPReportedAfterRelogin(t *testing.T) {
+	env := vmtest.New(t)
+	net := env.AddNetwork("2.1.1.1", "192.168.1.1/24", vnet.EasyNAT)
+	n := env.AddNode("node", net, vmtest.OS(vmtest.Gokrazy))
+
+	baseStep := env.AddStep("Record initial home DERP from control")
+	switchStep := env.AddStep("Re-login (logout + up)")
+	verifyStep := env.AddStep("Verify home DERP re-reported to control after relogin")
+
+	env.Start()
+
+	cs := env.ControlServer()
+
+	// Pin the home DERP region so the reported NetInfo (including PreferredDERP)
+	// is identical before and after the switch. natlab has two DERP regions with
+	// no latency differentiation, so the natural pick could differ across the
+	// switch; a changed PreferredDERP would NOT be de-duped and would mask the
+	// regression. The force persists on the long-lived magicsock.Conn across the
+	// in-process profile switch.
+	const region = 1
+	env.ForcePreferredDERP(n, region)
+
+	// Baseline: control learned the (forced) home DERP for the initial identity.
+	baseStep.Begin()
+	st := env.Status(n)
+	oldKey := st.Self.PublicKey
+	if err := tstest.WaitFor(30*time.Second, func() error {
+		cn := cs.Node(oldKey)
+		if cn == nil {
+			return fmt.Errorf("control has no node for initial key %v", oldKey.ShortString())
+		}
+		if cn.HomeDERP != region {
+			return fmt.Errorf("control home DERP for initial identity = %d, want %d", cn.HomeDERP, region)
+		}
+		return nil
+	}); err != nil {
+		baseStep.Fatal(err)
+	}
+	t.Logf("[node] initial: key=%s homeDERP=%d", oldKey.ShortString(), region)
+	baseStep.End(nil)
+
+	// Re-login on the same control/network/NAT/DERP. The new identity reports a
+	// structurally-identical NetInfo, which the buggy de-dup would have
+	// suppressed. (logout + up funnels through the same
+	// resetForProfileChangeLocked -> setControlClientLocked path as a
+	// localapi PUT /profiles/ switch.)
+	switchStep.Begin()
+	env.Relogin(n)
+	st2 := env.Status(n)
+	newKey := st2.Self.PublicKey
+	if newKey == oldKey {
+		switchStep.Fatalf("node key unchanged after relogin: %v", newKey.ShortString())
+	}
+	t.Logf("[node] after relogin: key=%s", newKey.ShortString())
+	switchStep.End(nil)
+
+	// Regression assertion: control must re-learn the same non-zero home DERP for
+	// the new identity. Times out at HomeDERP==0 without ResetNetInfoLast.
+	verifyStep.Begin()
+	if err := tstest.WaitFor(60*time.Second, func() error {
+		cn := cs.Node(newKey)
+		if cn == nil {
+			return fmt.Errorf("control has no node for new key %v yet", newKey.ShortString())
+		}
+		if cn.HomeDERP == 0 {
+			return fmt.Errorf("home DERP not re-reported after profile switch (HomeDERP=0)")
+		}
+		if cn.HomeDERP != region {
+			return fmt.Errorf("home DERP region changed across switch: was %d, now %d", region, cn.HomeDERP)
+		}
+		return nil
+	}); err != nil {
+		env.DumpStatus(n)
+		verifyStep.Fatal(err)
+	}
+	t.Logf("[node] home DERP %d re-reported to control after profile switch", region)
+	verifyStep.End(nil)
+}
+
+// TestMullvadExitNode verifies that a Tailscale client whose netmap contains
+// a plain-WireGuard exit node (the way Mullvad exit nodes are wired up by
+// the control plane) can route internet traffic through it, with the source
+// IP rewritten to the per-client Mullvad-assigned address.
+//
+// Topology:
+//
+//	client (Tailscale, gokrazy)         — clientNet (EasyNAT)     WAN 1.0.0.1
+//	mullvad (Ubuntu, userspace WG)      — mullvadNet (One2OneNAT) WAN 2.0.0.1
+//	webserver (no Tailscale, gokrazy)   — webNet     (One2OneNAT) WAN 5.0.0.1
+//
+// The mullvad VM impersonates a Mullvad WireGuard server. After boot, the
+// test asks its TTA agent to bring up a userspace WireGuard interface (a
+// real Linux TUN driven by wireguard-go) that pins the client's Tailscale
+// node public key as its only allowed peer, sets up IP-forwarding + a
+// MASQUERADE rule, and reports the WG server's freshly generated public
+// key back. Userspace vs kernel WireGuard makes no difference on the wire
+// — what's being tested is Tailscale's plain-WireGuard exit-node code
+// path, not the kernel module.
+//
+// The test then injects a netmap peer with IsWireGuardOnly=true,
+// AllowedIPs=[gw/32, 0.0.0.0/0, ::/0], the WG endpoint, and a per-client
+// SelfNodeV4MasqAddrForThisPeer (the mock equivalent of the per-client IP
+// Mullvad's API hands out at registration time).
+//
+// The webserver echoes the source IP it sees:
+//   - exit-node off:  source is client's WAN  (direct egress)
+//   - exit-node on:   source is mullvad's WAN (egress via WG + MASQUERADE)
+func TestMullvadExitNode(t *testing.T) {
+	env := vmtest.New(t)
+
+	const (
+		clientWAN  = "1.0.0.1"
+		mullvadWAN = "2.0.0.1"
+		webWAN     = "5.0.0.1"
+	)
+	// Mullvad-side WG network. The client appears as clientMasqIP to
+	// mullvad's wg0; mullvad terminates the tunnel at gw.
+	var (
+		mullvadWGNet = netip.MustParsePrefix("10.64.0.0/24")
+		gw           = netip.MustParsePrefix("10.64.0.1/24")
+		clientMasq   = netip.MustParsePrefix("10.64.0.2/32")
+	)
+	const wgListenPort uint16 = 51820
+
+	clientNet := env.AddNetwork(clientWAN, "192.168.1.1/24", vnet.EasyNAT)
+	mullvadNet := env.AddNetwork(mullvadWAN, "192.168.2.1/24", vnet.One2OneNAT)
+	webNet := env.AddNetwork(webWAN, "192.168.5.1/24", vnet.One2OneNAT)
+
+	client := env.AddNode("client", clientNet, vmtest.OS(vmtest.Gokrazy))
+	mullvad := env.AddNode("mullvad", mullvadNet,
+		vmtest.OS(vmtest.Ubuntu2404),
+		vmtest.DontJoinTailnet())
+	env.AddNode("webserver", webNet,
+		vmtest.OS(vmtest.Gokrazy),
+		vmtest.DontJoinTailnet(),
+		vmtest.WebServer(8080))
+
+	// Declare test-specific steps for the web UI.
+	wgUpStep := env.AddStep("Bring up Mullvad WG server")
+	injectStep := env.AddStep("Inject Mullvad netmap peer")
+	checkOff1Step := env.AddStep("HTTP GET (exit off)")
+	checkMullvadStep := env.AddStep("HTTP GET (exit=mullvad)")
+	checkOff2Step := env.AddStep("HTTP GET (exit off, again)")
+
+	env.Start()
+
+	// Bring up the WG server inside mullvad's TTA, pinning the client's
+	// Tailscale node public key as the sole allowed peer.
+	wgUpStep.Begin()
+	clientStatus := env.Status(client)
+	mullvadPub := env.BringUpMullvadWGServer(mullvad,
+		gw, wgListenPort,
+		clientStatus.Self.PublicKey, clientMasq, mullvadWGNet)
+	wgUpStep.End(nil)
+
+	// Inject the mullvad node into the netmap as a plain-WireGuard exit
+	// node. This mirrors how the control plane describes Mullvad exit
+	// nodes to clients (see control/cmullvad in the closed repo): a
+	// peer with IsWireGuardOnly=true, an Endpoints entry pointing at
+	// the public WG host:port, and AllowedIPs covering both the gateway
+	// /32 and the 0.0.0.0/0+::/0 exit-node routes.
+	injectStep.Begin()
+	mullvadEndpoint := netip.AddrPortFrom(netip.MustParseAddr(mullvadWAN), wgListenPort)
+	gwHost := netip.PrefixFrom(gw.Addr(), gw.Addr().BitLen())
+	mullvadNode := &tailcfg.Node{
+		ID:                999_001,
+		StableID:          "mullvad-test",
+		Name:              "mullvad-test.fake-control.example.net.",
+		Key:               mullvadPub,
+		MachineAuthorized: true,
+		IsWireGuardOnly:   true,
+		Endpoints:         []netip.AddrPort{mullvadEndpoint},
+		Addresses:         []netip.Prefix{gwHost},
+		AllowedIPs: []netip.Prefix{
+			gwHost,
+			netip.MustParsePrefix("0.0.0.0/0"),
+			netip.MustParsePrefix("::/0"),
+		},
+		Hostinfo: (&tailcfg.Hostinfo{
+			Hostname: "mullvad-test",
+		}).View(),
+	}
+	cs := env.ControlServer()
+	cs.UpdateNode(mullvadNode)
+
+	// Set the per-peer source-IP masquerade. The control plane normally
+	// derives this from the Mullvad API's per-client registration; here
+	// we just pin it to the address mullvad's wg0 was told to accept.
+	cs.SetMasqueradeAddresses([]testcontrol.MasqueradePair{{
+		Node:              clientStatus.Self.PublicKey,
+		Peer:              mullvadPub,
+		NodeMasqueradesAs: clientMasq.Addr(),
+	}})
+	injectStep.End(nil)
+
+	webURL := fmt.Sprintf("http://%s:8080/", webWAN)
+	check := func(step *vmtest.Step, label, wantSrc string) {
+		t.Helper()
+		step.Begin()
+		body := env.HTTPGet(client, webURL)
+		t.Logf("[%s] response: %s", label, body)
+		if !strings.Contains(body, "Hello world I am webserver") {
+			step.Fatalf("[%s] unexpected webserver response: %q", label, body)
+		}
+		if !strings.Contains(body, "from "+wantSrc) {
+			step.Fatalf("[%s] expected source %q in response, got %q", label, wantSrc, body)
+		}
+		step.End(nil)
+	}
+
+	// Exit-node off: client routes 0.0.0.0/0 directly via its host stack,
+	// so the webserver sees client's WAN IP.
+	check(checkOff1Step, "exit-off", clientWAN)
+
+	// Switch to the Mullvad WG-only peer as exit node. The client should
+	// now route 0.0.0.0/0 through the WG tunnel; mullvad MASQUERADEs to
+	// its WAN; the webserver sees the mullvad VM's WAN IP.
+	env.SetExitNodeIP(client, gw.Addr())
+	check(checkMullvadStep, "exit-mullvad", mullvadWAN)
+
+	// And back off again, to make sure the transition works in both
+	// directions.
+	env.SetExitNodeIP(client, netip.Addr{})
+	check(checkOff2Step, "exit-off (again)", clientWAN)
+}
+
+// checkClientMetrics verifies that each entry in want exists and has the given
+// value in metrics.
+func checkClientMetrics(t *testing.T, label string, metrics vmtest.ClientMetrics, want map[string]int64) {
+	t.Helper()
+	for name, wantValue := range want {
+		got, ok := metrics[name]
+		if !ok {
+			t.Errorf("%s: required metric %q not found", label, name)
+		} else if got.Value != wantValue {
+			t.Errorf("%s: metric %q: got %v, want %v", label, name, got.Value, wantValue)
+		}
+	}
+}
+
+// TestCachedNetmapAfterRestart verifies that two nodes with netmap
+// caching enabled (NodeAttrCacheNetworkMaps) can re-establish a direct
+// WireGuard tunnel after both are restarted while the control server is
+// unreachable. After restart the nodes must use only their on-disk cached
+// netmaps to re-connect.
+func TestCachedNetmapAfterRestart(t *testing.T) {
+	env := vmtest.New(t)
+
+	aNet := env.AddNetwork("1.0.0.1", "192.168.1.1/24", vnet.EasyNAT)
+	bNet := env.AddNetwork("2.0.0.1", "192.168.2.1/24", vnet.EasyNAT)
+
+	a := env.AddNode("a", aNet,
+		vmtest.OS(vmtest.Gokrazy),
+		tailcfg.NodeCapMap{tailcfg.NodeAttrCacheNetworkMaps: nil})
+	b := env.AddNode("b", bNet,
+		vmtest.OS(vmtest.Gokrazy),
+		tailcfg.NodeCapMap{tailcfg.NodeAttrCacheNetworkMaps: nil})
+
+	connectStep := env.AddStep("Establish initial TSMP tunnel")
+	cutControlStep := env.AddStep("Cut control server access")
+	restartStep := env.AddStep("Restart tailscaled on both nodes")
+	netmapCheckStep := env.AddStep("Check netmap loaded is cached")
+	pingStep := env.AddStep("Ping a → b TSMP (cached netmap, no control)")
+
+	env.Start()
+
+	connectStep.Begin()
+	if err := env.Ping(a, b, tailcfg.PingTSMP, 30*time.Second); err != nil {
+		connectStep.Fatal(err)
+	}
+	connectStep.End(nil)
+
+	cutControlStep.Begin()
+	// Both nodes lose connection to control
+	a.DropControlTraffic()
+	b.DropControlTraffic()
+	env.ControlServer().SetOnMapRequest(func(nk key.NodePublic) {
+		panic(fmt.Sprintf("got connection from %v", nk))
+	})
+	cutControlStep.End(nil)
+
+	restartStep.Begin()
+	env.RestartTailscaled(a)
+	env.RestartTailscaled(b)
+	restartStep.End(nil)
+
+	netmapCheckStep.Begin()
+	for _, node := range []*vmtest.Node{a, b} {
+		nm, err := local.GetDebugResultJSON[netmap.NetworkMap](t.Context(), node.Agent().Client, "current-netmap")
+		if err != nil {
+			netmapCheckStep.Fatalf("[%s] got err fetching netmap %q", node.Name(), err)
+		}
+		if !nm.Cached {
+			netmapCheckStep.Fatalf("[%s] expected netmap.Cached = true, got: %t", node.Name(), nm.Cached)
+		}
+	}
+	netmapCheckStep.End(nil)
+
+	// 90s is generous on purpose. After both nodes restart with stale cached
+	// netmap entries, a's first WG handshake to b's pre-restart endpoint
+	// hits the dead NAT mapping on b's side and is silently dropped (we
+	// see this as "no recent outgoing packet" NAT drops in the vnet log).
+	// Recovery then waits on wireguard-go's REKEY_TIMEOUT (~5s) before the
+	// next handshake attempt, and on disco-via-DERP to teach each side the
+	// other's new endpoint. On an idle host this converges in well under
+	// 15s; on a contended host (a 14/16-CPU-loaded local repro, or any
+	// shared CI runner) the same sequence has been observed at 50-60s
+	// because every timer fires multiple times under scheduling jitter.
+	pingStep.Begin()
+	if err := env.Ping(a, b, tailcfg.PingTSMP, 90*time.Second); err != nil {
+		pingStep.Fatal(err)
+	}
+	pingStep.End(nil)
+}
+
+// TestDirectConnectionWithCachedNetmap verifies that two nodes with netmap
+// caching enabled (NodeAttrCacheNetworkMaps) can re-establish a direct
+// WireGuard tunnel after one is restarted while the control server is
+// unreachable. After restart the node must use only its on-disk cached
+// netmaps to re-connect and ping the other (still online) node.
+//
+// The test has two modes, pinging from the offline node to the online node,
+// and pinging from the online node to the offline node.
+//
+// TODO(cmol): The online -> offline test is skipped for now (as of 2026-06-12).
+// The TSMP disco key exchange currently relies on disco ping messages being
+// sent. These will however not be sent if there is not endpoints on the online
+// node which is possible in the event where a node has registered but not
+// finished STUN.
+func TestDirectConnectionWithCachedNetmapOnOneNode(t *testing.T) {
+	for _, testPingFrom := range []string{"offline", "online"} {
+		t.Run(fmt.Sprintf("ping_from_%s", testPingFrom), func(t *testing.T) {
+			if testPingFrom == "online" {
+				t.Skip("https://github.com/tailscale/tailscale/issues/19843")
+			}
+			env := vmtest.New(t)
+
+			aNet := env.AddNetwork("1.0.0.1", "192.168.1.1/24", vnet.EasyNAT)
+			bNet := env.AddNetwork("2.0.0.1", "192.168.2.1/24", vnet.EasyNAT)
+
+			// Node "a" is the offline peer, node "b" is the online peer.
+			a := env.AddNode("a", aNet,
+				vmtest.OS(vmtest.Gokrazy),
+				tailcfg.NodeCapMap{tailcfg.NodeAttrCacheNetworkMaps: nil})
+			b := env.AddNode("b", bNet,
+				vmtest.OS(vmtest.Gokrazy),
+				tailcfg.NodeCapMap{tailcfg.NodeAttrCacheNetworkMaps: nil})
+
+			pStr := "Ping a → b"
+			if testPingFrom == "online" {
+				pStr = "Ping b → a"
+			}
+			checkInitialMetrics := env.AddStep("Check initial client metrics")
+			cutControlStep := env.AddStep("Cut control server access from a")
+			restartStep := env.AddStep("Restart tailscaled on a")
+			tsmpPingStep := env.AddStep(fmt.Sprintf("%s TSMP (cached netmap, no control)", pStr))
+			discoPingStep := env.AddStep(fmt.Sprintf("%s Disco (want Direct)", pStr))
+			checkFinalMetrics := env.AddStep("Check final client metrics")
+
+			env.Start()
+
+			// Before: Verify that we have not recorded any cached contacts.
+			checkInitialMetrics.Begin()
+			checkClientMetrics(t, "Node A", env.ClientMetrics(a), map[string]int64{
+				"magicsock_cached_peer_contact_derp":   0,
+				"magicsock_cached_peer_contact_direct": 0,
+			})
+			checkInitialMetrics.End(nil)
+
+			cutControlStep.Begin()
+			a.DropControlTraffic()
+			env.ControlServer().SetOnMapRequest(func(nk key.NodePublic) {
+				if env.ControlServer().Node(nk).Name == a.Name() {
+					panic(fmt.Sprintf("got connection from %v", a.Name()))
+				}
+			})
+			cutControlStep.End(nil)
+
+			restartStep.Begin()
+			env.RestartTailscaled(a)
+			restartStep.End(nil)
+
+			// Set the direction of the ping.
+			pFrom, pTo := a, b
+			if testPingFrom == "online" {
+				pFrom, pTo = b, a
+			}
+
+			tsmpPingStep.Begin()
+			if err := env.Ping(pFrom, pTo, tailcfg.PingTSMP, 30*time.Second); err != nil {
+				tsmpPingStep.Fatal(err)
+			}
+			tsmpPingStep.End(nil)
+
+			discoPingStep.Begin()
+			if err := env.PingExpect(pFrom, pTo, vmtest.PingRouteDirect, 90*time.Second); err != nil {
+				discoPingStep.Fatal(err)
+			}
+			// Ping back, mostly to give time for the metrics to be set.
+			if err := env.PingExpect(pTo, pFrom, vmtest.PingRouteDirect, 30*time.Second); err != nil {
+				discoPingStep.Fatal(err)
+			}
+			discoPingStep.End(nil)
+
+			// After: Verify that we recorded a direct contact on the disconnected node.
+			checkFinalMetrics.Begin()
+			checkClientMetrics(t, "Node A", env.ClientMetrics(a), map[string]int64{
+				"magicsock_cached_peer_contact_direct": 1,
+			})
+			checkFinalMetrics.End(nil)
+		})
+	}
+}
+
+// TestDirectWithCachedNetmapOnTwoNodes verifies that two nodes with netmap
+// caching enabled (NodeAttrCacheNetworkMaps) can re-establish a direct
+// WireGuard tunnel after both restarted while the control server is
+// unreachable. After restart one node must use only its on-disk cached
+// netmaps to re-connect and ping the other node.
+// TODO(cmol): The test is skipped for now (as of 2026-06-12). The TSMP disco
+// key exchange currently relies on disco ping messages being sent. These will
+// however not be sent if there is not endpoints on the online node which is
+// possible in the event where a node has registered but not finished STUN.
+func TestDirectConnectionWithCachedNetmapOnTwoNodes(t *testing.T) {
+	t.Skip("https://github.com/tailscale/tailscale/issues/19843")
+	env := vmtest.New(t)
+
+	aNet := env.AddNetwork("1.0.0.1", "192.168.1.1/24", vnet.EasyNAT)
+	bNet := env.AddNetwork("2.0.0.1", "192.168.2.1/24", vnet.EasyNAT)
+
+	a := env.AddNode("a", aNet,
+		vmtest.OS(vmtest.Gokrazy),
+		tailcfg.NodeCapMap{tailcfg.NodeAttrCacheNetworkMaps: nil})
+	b := env.AddNode("b", bNet,
+		vmtest.OS(vmtest.Gokrazy),
+		tailcfg.NodeCapMap{tailcfg.NodeAttrCacheNetworkMaps: nil})
+
+	checkInitialMetrics := env.AddStep("Check initial client metrics")
+	cutControlStep := env.AddStep("Cut control server access")
+	restartStep := env.AddStep("Restart tailscaled on a")
+	tsmpPingStep := env.AddStep("Ping a → b TSMP (cached netmap, no control)")
+	discoPingStep := env.AddStep("Ping a → b Disco (want Direct)")
+	checkFinalMetrics := env.AddStep("Check final client metrics")
+
+	env.Start()
+
+	// Before: Verify that we have not recorded any cached contacts.
+	checkInitialMetrics.Begin()
+	checkClientMetrics(t, "Node A", env.ClientMetrics(a), map[string]int64{
+		"magicsock_cached_peer_contact_derp":   0,
+		"magicsock_cached_peer_contact_direct": 0,
+	})
+	checkInitialMetrics.End(nil)
+
+	cutControlStep.Begin()
+	a.DropControlTraffic()
+	b.DropControlTraffic()
+	env.ControlServer().SetOnMapRequest(func(nk key.NodePublic) {
+		nodeName := env.ControlServer().Node(nk).Name
+		if nodeName == a.Name() || nodeName == b.Name() {
+			panic(fmt.Sprintf("got connection from %v", nodeName))
+		}
+	})
+	cutControlStep.End(nil)
+
+	restartStep.Begin()
+	env.RestartTailscaled(a)
+	env.RestartTailscaled(b)
+	restartStep.End(nil)
+
+	tsmpPingStep.Begin()
+	if err := env.Ping(a, b, tailcfg.PingTSMP, 30*time.Second); err != nil {
+		tsmpPingStep.Fatal(err)
+	}
+	tsmpPingStep.End(nil)
+
+	discoPingStep.Begin()
+	if err := env.PingExpect(a, b, vmtest.PingRouteDirect, 30*time.Second); err != nil {
+		discoPingStep.Fatal(err)
+	}
+	discoPingStep.End(nil)
+
+	// After: Verify that we recorded a direct contact on the disconnected node.
+	checkFinalMetrics.Begin()
+	checkClientMetrics(t, "Node A", env.ClientMetrics(a), map[string]int64{
+		"magicsock_cached_peer_contact_direct": 1,
+	})
+	checkFinalMetrics.End(nil)
+}
+
+// TestPeerRelay verifies that two Tailscale nodes whose direct UDP path is
+// impossible at the network layer (both behind HardNAT, with no port-mapping
+// services on either of their networks) can still communicate via a third
+// Tailscale node configured as a peer-relay server.
+//
+// Topology:
+//
+//	a     (gokrazy, HardNAT)     — aNet      WAN 1.0.0.1
+//	b     (gokrazy, HardNAT)     — bNet      WAN 2.0.0.1
+//	relay (gokrazy, One2OneNAT)  — relayNet  WAN 3.0.0.1
+//
+// HardNAT in natlab is endpoint-dependent (each (src, dst) tuple gets a fresh
+// outbound port, and the inbound table keys on (wanPort, src)). Without
+// NAT-PMP/UPnP a→b and b→a direct UDP paths cannot be established. The relay
+// uses One2OneNAT so its STUN-discovered WAN endpoint is reachable from both
+// peers. The test then asserts that magicsock chose the peer-relay path
+// (not DERP) and that the relay reports the session.
+func TestPeerRelay(t *testing.T) {
+	env := vmtest.New(t, vmtest.PeerRelayGrants())
+
+	aNet := env.AddNetwork("1.0.0.1", "192.168.1.1/24", vnet.HardNAT)
+	bNet := env.AddNetwork("2.0.0.1", "192.168.2.1/24", vnet.HardNAT)
+	relayNet := env.AddNetwork("3.0.0.1", "192.168.3.1/24", vnet.One2OneNAT)
+
+	a := env.AddNode("a", aNet, vmtest.OS(vmtest.Gokrazy))
+	b := env.AddNode("b", bNet, vmtest.OS(vmtest.Gokrazy))
+	relay := env.AddNode("relay", relayNet, vmtest.OS(vmtest.Gokrazy))
+
+	enableRelayStep := env.AddStep("Enable peer-relay server on relay")
+	pingStep := env.AddStep("Disco ping a → b (want peer-relay path)")
+	sessionsStep := env.AddStep("Check DebugPeerRelaySessions on relay")
+
+	env.Start()
+
+	// Turn on the relay server. Port 0 picks an unused port.
+	enableRelayStep.Begin()
+	editCtx, editCancel := context.WithTimeout(t.Context(), 30*time.Second)
+	_, err := relay.Agent().EditPrefs(editCtx, &ipn.MaskedPrefs{
+		Prefs:              ipn.Prefs{RelayServerPort: new(uint16(0))},
+		RelayServerPortSet: true,
+	})
+	editCancel()
+	if err != nil {
+		enableRelayStep.Fatalf("EditPrefs(relay, RelayServerPort=0): %v", err)
+	}
+	enableRelayStep.End(nil)
+
+	// Wait for the relay to start, peers to learn about it via netmap,
+	// and the a→b disco ping to traverse it.
+	// PingResult.PeerRelay is set by magicsock to "ip:port:vni:N" when the
+	// disco probe rode a peer relay (vs Endpoint for direct UDP or
+	// DERPRegionID for DERP).
+	pingStep.Begin()
+	bIP := env.Status(b).Self.TailscaleIPs[0]
+	var lastDetail string
+	err = tstest.WaitFor(60*time.Second, func() error {
+		ctx, cancel := context.WithTimeout(t.Context(), 5*time.Second)
+		defer cancel()
+		pr, err := a.Agent().PingWithOpts(ctx, bIP, tailcfg.PingDisco, local.PingOpts{})
+		if err != nil {
+			return fmt.Errorf("ping: %w", err)
+		}
+		if pr.Err != "" {
+			return fmt.Errorf("ping err: %s", pr.Err)
+		}
+		if pr.PeerRelay == "" {
+			lastDetail = fmt.Sprintf("endpoint=%q derp=%d", pr.Endpoint, pr.DERPRegionID)
+			return fmt.Errorf("ping did not use a peer relay; %s", lastDetail)
+		}
+		t.Logf("a → b disco ping rode peer-relay %s", pr.PeerRelay)
+		return nil
+	})
+	if err != nil {
+		env.DumpStatus(a)
+		env.DumpStatus(b)
+		env.DumpStatus(relay)
+		pingStep.Fatalf("waiting for peer-relay path a → b: %v (last: %s)", err, lastDetail)
+	}
+	pingStep.End(nil)
+
+	// The relay's local debug-peer-relay-sessions LocalAPI should now
+	// report a single session for the a↔b disco probe. Cross-check the
+	// session's client disco keys against control's view of a and b, and
+	// confirm both sides recorded non-zero packet/byte counts (the disco
+	// ping + pong each take one underlay packet through the relay).
+	sessionsStep.Begin()
+	ctx, cancel := context.WithTimeout(t.Context(), 5*time.Second)
+	defer cancel()
+	srv, err := relay.Agent().DebugPeerRelaySessions(ctx)
+	if err != nil {
+		sessionsStep.Fatalf("DebugPeerRelaySessions: %v", err)
+	}
+	if srv.UDPPort == nil {
+		sessionsStep.Fatalf("relay UDPPort is nil; want set")
+	}
+	if got, want := len(srv.Sessions), 1; got != want {
+		sessionsStep.Fatalf("relay sessions = %d; want %d: %+v", got, want, srv.Sessions)
+	}
+	cs := env.ControlServer()
+	wantShorts := set.Of(
+		cs.Node(env.Status(a).Self.PublicKey).DiscoKey.ShortString(),
+		cs.Node(env.Status(b).Self.PublicKey).DiscoKey.ShortString(),
+	)
+	session := srv.Sessions[0]
+	gotShorts := set.Of(session.Client1.ShortDisco, session.Client2.ShortDisco)
+	if !gotShorts.Equal(wantShorts) {
+		sessionsStep.Fatalf("session disco shorts = %v; want %v", gotShorts, wantShorts)
+	}
+	for _, ci := range []status.ClientInfo{session.Client1, session.Client2} {
+		if !ci.Endpoint.IsValid() {
+			sessionsStep.Fatalf("session client %s: invalid Endpoint", ci.ShortDisco)
+		}
+		if ci.PacketsTx == 0 {
+			sessionsStep.Fatalf("session client %s: PacketsTx = 0; want >0", ci.ShortDisco)
+		}
+		if ci.BytesTx == 0 {
+			sessionsStep.Fatalf("session client %s: BytesTx = 0; want >0", ci.ShortDisco)
+		}
+	}
+	t.Logf("relay session VNI=%d %s <-> %s on UDP port %d",
+		session.VNI, session.Client1.ShortDisco, session.Client2.ShortDisco, *srv.UDPPort)
+	sessionsStep.End(nil)
+}
diff --git a/tstest/natlab/vmtest/vnetperf_test.go b/tstest/natlab/vmtest/vnetperf_test.go
new file mode 100644
index 000000000..5143aa0d4
--- /dev/null
+++ b/tstest/natlab/vmtest/vnetperf_test.go
@@ -0,0 +1,61 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package vmtest
+
+import (
+	"flag"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"tailscale.com/tstest/natlab/vnet"
+)
+
+var (
+	runPerfTests = flag.Bool("run-perf-tests", false, "run performance measurement tests that are not pass/fail regression tests; wasteful to run in CI")
+	perfPCAP     = flag.String("perf-pcap", "", "if non-empty, write a pcap of vnet traffic to this file during TestVnetPerfFreeBSDDownload")
+	perfLatency  = flag.Duration("perf-latency", 0, "simulated latency to add to the vnet network in TestVnetPerfFreeBSDDownload")
+)
+
+// TestVnetPerfFreeBSDDownload is a benchmark harness for vnet TCP
+// throughput, opt-in via --run-perf-tests (in addition to
+// --run-vm-tests). It boots a single FreeBSD VM on one vnet network and
+// waits only for its TTA agent to connect, which requires the VM to have
+// downloaded tailscaled, tailscale, and tta from the vnet's
+// files.tailscale VIP. The elapsed time is dominated by that download,
+// so the test duration is the benchmark metric.
+func TestVnetPerfFreeBSDDownload(t *testing.T) {
+	if !*runPerfTests {
+		t.Skip("skipping perf test; set --run-perf-tests to run")
+	}
+	env := New(t)
+
+	lan := env.AddNetwork("2.1.1.1", "192.168.1.1/24", vnet.EasyNAT)
+	if *perfPCAP != "" {
+		env.cfg.SetPCAPFile(*perfPCAP)
+	}
+	if *perfLatency > 0 {
+		lan.SetLatency(*perfLatency)
+	}
+	env.AddNode("fbsd", lan, OS(FreeBSD150), DontJoinTailnet())
+
+	t0 := time.Now()
+	env.Start()
+	t.Logf("Start took %v (boot + binary downloads over vnet)", time.Since(t0).Round(time.Second))
+
+	// Surface fetch(1)'s final progress lines (size, rate, duration per
+	// binary) from the serial console log.
+	console, err := os.ReadFile(filepath.Join(env.tempDir, "fbsd.log"))
+	if err != nil {
+		t.Logf("reading console log: %v", err)
+		return
+	}
+	for line := range strings.Lines(string(console)) {
+		if strings.Contains(line, "Bps") {
+			t.Logf("fetch: %s", strings.TrimSpace(line))
+		}
+	}
+}
diff --git a/tstest/natlab/vmtest/web.go b/tstest/natlab/vmtest/web.go
new file mode 100644
index 000000000..d512740e6
--- /dev/null
+++ b/tstest/natlab/vmtest/web.go
@@ -0,0 +1,209 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package vmtest
+
+import (
+	"embed"
+	"flag"
+	"fmt"
+	"hash/crc32"
+	"html/template"
+	"io"
+	"io/fs"
+	"net"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/coder/websocket"
+	"github.com/robert-nix/ansihtml"
+)
+
+var vmtestWeb = flag.String("vmtest-web", "", "listen address for vmtest web UI (e.g. :0, localhost:0, :8080)")
+
+//go:embed assets/*.html
+var templatesSrc embed.FS
+
+//go:embed assets/*.css
+var staticAssets embed.FS
+
+var tmpl = sync.OnceValue(func() *template.Template {
+	d, err := fs.Sub(templatesSrc, "assets")
+	if err != nil {
+		panic(fmt.Errorf("getting vmtest web templates subdir: %w", err))
+	}
+	return template.Must(template.New("").Funcs(template.FuncMap{
+		"formatDuration": formatDuration,
+		"ansi":           ansiToHTML,
+	}).ParseFS(d, "*"))
+})
+
+// ansiToHTML converts a string with ANSI escape sequences to HTML with
+// inline styles. Returns template.HTML so html/template doesn't double-escape it.
+func ansiToHTML(s string) template.HTML {
+	return template.HTML(ansihtml.ConvertToHTML([]byte(s)))
+}
+
+// formatDuration returns a human-readable duration like "1.2s" or "45.3s".
+func formatDuration(d time.Duration) string {
+	if d < time.Second {
+		return fmt.Sprintf("%dms", d.Milliseconds())
+	}
+	return fmt.Sprintf("%.1fs", d.Seconds())
+}
+
+// deterministicPort returns a deterministic port in the range [20000, 40000)
+// based on the test name, so re-running the same test gets the same URL.
+func deterministicPort(testName string) int {
+	return int(crc32.ChecksumIEEE([]byte(testName)))%20000 + 20000
+}
+
+// listenWeb listens on the given address. If the port is 0, it first tries a
+// deterministic port based on the test name so re-runs get the same URL.
+// Falls back to :0 (OS-assigned) on any listen error.
+func (e *Env) listenWeb(addr string) (net.Listener, error) {
+	host, port, _ := net.SplitHostPort(addr)
+	if port == "0" {
+		detPort := deterministicPort(e.t.Name())
+		detAddr := net.JoinHostPort(host, fmt.Sprintf("%d", detPort))
+		if ln, err := net.Listen("tcp", detAddr); err == nil {
+			return ln, nil
+		}
+		// Deterministic port busy; fall back to OS-assigned.
+	}
+	return net.Listen("tcp", addr)
+}
+
+// maybeStartWebServer starts the web UI if --vmtest-web is set.
+// Called at the very top of Env.Start(), before compilation or image downloads.
+func (e *Env) maybeStartWebServer() {
+	addr := *vmtestWeb
+	if addr == "" {
+		return
+	}
+
+	ln, err := e.listenWeb(addr)
+	if err != nil {
+		e.t.Fatalf("vmtest-web listen: %v", err)
+	}
+	e.t.Cleanup(func() { ln.Close() })
+
+	actualAddr := ln.Addr().(*net.TCPAddr)
+
+	host, _, _ := net.SplitHostPort(addr)
+	if host == "" || host == "0.0.0.0" || host == "::" {
+		hostname, err := os.Hostname()
+		if err != nil {
+			hostname = "localhost"
+		}
+		e.t.Logf("Status at http://%s:%d/", hostname, actualAddr.Port)
+	} else {
+		e.t.Logf("Status at http://%s/", actualAddr.String())
+	}
+
+	mux := http.NewServeMux()
+	mux.HandleFunc("GET /", e.serveIndex)
+	mux.HandleFunc("GET /ws", e.serveWebSocket)
+	mux.HandleFunc("GET /screenshot/{node}", e.serveScreenshot)
+	mux.HandleFunc("GET /style.css", serveStaticAsset("style.css"))
+
+	srv := &http.Server{Handler: mux}
+	go srv.Serve(ln)
+	e.t.Cleanup(func() { srv.Close() })
+}
+
+func serveStaticAsset(name string) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		if !strings.HasSuffix(name, ".css") {
+			http.Error(w, "not found", http.StatusNotFound)
+			return
+		}
+		w.Header().Set("Content-Type", "text/css")
+		f, err := staticAssets.Open(filepath.Join("assets", name))
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+		defer f.Close()
+		io.Copy(w, f)
+	}
+}
+
+func (e *Env) serveIndex(w http.ResponseWriter, r *http.Request) {
+	type indexData struct {
+		TestName   string
+		TestStatus *TestStatus
+		Steps      []*Step
+		Nodes      []NodeStatus
+	}
+
+	data := indexData{
+		TestName:   e.t.Name(),
+		TestStatus: e.testStatus,
+		Steps:      e.Steps(),
+	}
+	for _, n := range e.nodes {
+		data.Nodes = append(data.Nodes, e.getNodeStatus(n.name))
+	}
+
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	if err := tmpl().ExecuteTemplate(w, "index.html", data); err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+	}
+}
+
+// serveScreenshot proxies a full-resolution screenshot from the Host.app
+// screenshot server. Returns raw JPEG with no HTML wrapper.
+func (e *Env) serveScreenshot(w http.ResponseWriter, r *http.Request) {
+	name := r.PathValue("node")
+	port := e.nodeScreenshotPort(name)
+	if port == 0 {
+		http.Error(w, "no screenshot server for node", http.StatusNotFound)
+		return
+	}
+	resp, err := http.Get(fmt.Sprintf("http://127.0.0.1:%d/screenshot?full=1", port))
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusBadGateway)
+		return
+	}
+	defer resp.Body.Close()
+	w.Header().Set("Content-Type", "image/jpeg")
+	io.Copy(w, resp.Body)
+}
+
+func (e *Env) serveWebSocket(w http.ResponseWriter, r *http.Request) {
+	conn, err := websocket.Accept(w, r, nil)
+	if err != nil {
+		return
+	}
+	defer conn.CloseNow()
+	wsCtx := conn.CloseRead(r.Context())
+
+	sub := e.eventBus.Subscribe()
+	defer sub.Close()
+
+	for {
+		select {
+		case <-wsCtx.Done():
+			return
+		case <-sub.Done():
+			return
+		case ev := <-sub.Events():
+			msg, err := conn.Writer(r.Context(), websocket.MessageText)
+			if err != nil {
+				return
+			}
+			if err := tmpl().ExecuteTemplate(msg, "event.html", ev); err != nil {
+				msg.Close()
+				return
+			}
+			if err := msg.Close(); err != nil {
+				return
+			}
+		}
+	}
+}
diff --git a/tstest/natlab/vmtest/webclient_test.go b/tstest/natlab/vmtest/webclient_test.go
new file mode 100644
index 000000000..bb6811da5
--- /dev/null
+++ b/tstest/natlab/vmtest/webclient_test.go
@@ -0,0 +1,175 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package vmtest_test
+
+import (
+	"fmt"
+	"net/http"
+	"strings"
+	"testing"
+
+	"tailscale.com/tstest/natlab/vmtest"
+)
+
+// TestWebClientLocalAccess verifies that, after enabling the web client on a
+// single node, the node's own Tailscale IP responds on port 5252 and that a
+// same-node session can be created and used to access the management UI as
+// the owner.
+func TestWebClientLocalAccess(t *testing.T) {
+	env := vmtest.New(t)
+	node := easy(env)
+	env.Start()
+
+	enableWebClient(t, env, node)
+	assertOwnerSessionFlow(t, env, node, webClientBaseURL(t, env, node), viewerName(t, env, node))
+}
+
+// TestWebClientRemoteAccess verifies that a peer node on the same tailnet can
+// create a session on a target's web client and then use it to access the
+// management UI as the owner, and that after re-logging-in under a different
+// user the target rejects new session attempts with 401 "not-owner".
+//
+// This exercises:
+//   - netstack interception of incoming :5252 traffic, gated by
+//     ShouldExposeRemoteWebClient (ipn/ipnlocal/netstack.go)
+//   - cross-node WhoIs identifying the caller (client/web/web.go)
+//   - cookie issuance + the same-user "owner" path through getSession +
+//     authorizeRequest (client/web/auth.go)
+//   - the not-owner rejection path (client/web/auth.go)
+func TestWebClientRemoteAccess(t *testing.T) {
+	env := vmtest.New(t, vmtest.SameTailnetUser(), vmtest.AllOnline())
+	target := easy(env)
+	client := easy(env)
+	env.Start()
+
+	enableWebClient(t, env, target)
+	baseURL := webClientBaseURL(t, env, target)
+
+	assertOwnerSessionFlow(t, env, client, baseURL, viewerName(t, env, client))
+
+	// Re-log-in the client under a fresh identity that is no longer the
+	// target's owner, and assert /api/auth/session/new is rejected.
+	env.ControlServer().AllNodesSameUser = false
+	env.Relogin(client)
+	assertSessionRejectedNotOwner(t, env, client, baseURL)
+}
+
+// enableWebClient turns on the management web client on n via "tailscale set
+// --webclient", fataling the test on error.
+func enableWebClient(t *testing.T, env *vmtest.Env, n *vmtest.Node) {
+	t.Helper()
+	if out, err := env.Tailscale(n, "set", "--webclient"); err != nil {
+		t.Fatalf("tailscale set --webclient on %s: %v\n%s", n.Name(), err, out)
+	}
+}
+
+// webClientBaseURL returns the http://<tsip>:5252 base URL for n's management
+// web client.
+func webClientBaseURL(t *testing.T, env *vmtest.Env, n *vmtest.Node) string {
+	t.Helper()
+	st := env.Status(n)
+	if st.Self == nil || len(st.Self.TailscaleIPs) == 0 {
+		t.Fatalf("%s has no Tailscale IPs; status=%+v", n.Name(), st)
+	}
+	return fmt.Sprintf("http://%s:5252", st.Self.TailscaleIPs[0])
+}
+
+// viewerName returns the DNS-name form (no trailing dot) that the web client
+// uses in viewerIdentity.nodeName for a request from n.
+func viewerName(t *testing.T, env *vmtest.Env, n *vmtest.Node) string {
+	t.Helper()
+	st := env.Status(n)
+	if st.Self == nil {
+		t.Fatalf("%s has no Self status", n.Name())
+	}
+	return strings.TrimSuffix(st.Self.DNSName, ".")
+}
+
+// assertOwnerSessionFlow exercises the canonical owner flow against the
+// management web client at baseURL, calling from `from`:
+//
+//  1. GET /api/auth without a cookie: the server is reachable, identifies the
+//     caller as expectViewer, and reports authorized=false (no session yet).
+//  2. GET /api/auth/session/new: the web client posts to
+//     /machine/webclient/init on the test control server via Noise; control
+//     returns a placeholder auth URL; the response sets a TS-Web-Session
+//     cookie with PendingAuth=true.
+//  3. GET /api/auth with the cookie: awaitUserAuth posts to
+//     /machine/webclient/wait on the test control server, which returns
+//     Complete=true; the session is marked Authenticated and the response
+//     reports authorized=true.
+//
+// This exercises the check-mode path in client/web/auth.go (the
+// controlSupportsCheckMode branch), which fires for the natlab test control
+// server's hostname (control.tailscale).
+//
+// Use this for both same-node (self-as-owner) and cross-node-same-user
+// (peer-as-owner) paths: the assertions are identical.
+func assertOwnerSessionFlow(t *testing.T, env *vmtest.Env, from *vmtest.Node, baseURL, expectViewer string) {
+	t.Helper()
+
+	res, err := env.HTTPGetStatus(from, baseURL+"/api/auth")
+	if err != nil {
+		t.Fatalf("GET /api/auth: %v", err)
+	}
+	if res.Status != 200 {
+		t.Fatalf("GET /api/auth: status = %d, want 200; body=%s", res.Status, res.Body)
+	}
+	if !strings.Contains(res.Body, `"serverMode":"manage"`) {
+		t.Errorf("/api/auth response missing serverMode=manage: %s", res.Body)
+	}
+	if expectViewer != "" && !strings.Contains(res.Body, fmt.Sprintf(`"nodeName":%q`, expectViewer)) {
+		t.Errorf("/api/auth viewerIdentity does not name %q: %s", expectViewer, res.Body)
+	}
+	if strings.Contains(res.Body, `"authorized":true`) {
+		t.Errorf("unauthenticated /api/auth should not report authorized=true: %s", res.Body)
+	}
+
+	res, err = env.HTTPGetStatus(from, baseURL+"/api/auth/session/new")
+	if err != nil {
+		t.Fatalf("GET /api/auth/session/new: %v", err)
+	}
+	if res.Status != 200 {
+		t.Fatalf("GET /api/auth/session/new: status = %d, want 200; body=%s", res.Status, res.Body)
+	}
+	var cookie *http.Cookie
+	for _, c := range res.SetCookies {
+		if c.Name == "TS-Web-Session" {
+			cookie = c
+			break
+		}
+	}
+	if cookie == nil {
+		t.Fatalf("/api/auth/session/new did not set a TS-Web-Session cookie; got %v", res.SetCookies)
+	}
+
+	res, err = env.HTTPGetStatus(from, baseURL+"/api/auth", cookie)
+	if err != nil {
+		t.Fatalf("GET /api/auth (authed): %v", err)
+	}
+	if res.Status != 200 {
+		t.Fatalf("GET /api/auth (authed): status = %d, want 200; body=%s", res.Status, res.Body)
+	}
+	if !strings.Contains(res.Body, `"authorized":true`) {
+		t.Errorf("authenticated /api/auth should report authorized=true: %s", res.Body)
+	}
+}
+
+// assertSessionRejectedNotOwner asserts that /api/auth/session/new from `from`
+// against baseURL returns 401 with body "not-owner" -- the rejection path in
+// client/web/auth.go's getSession for a source node whose user is not the
+// web client owner.
+func assertSessionRejectedNotOwner(t *testing.T, env *vmtest.Env, from *vmtest.Node, baseURL string) {
+	t.Helper()
+	res, err := env.HTTPGetStatus(from, baseURL+"/api/auth/session/new")
+	if err != nil {
+		t.Fatalf("GET /api/auth/session/new from non-owner: %v", err)
+	}
+	if res.Status != 401 {
+		t.Errorf("GET /api/auth/session/new from non-owner: status = %d, want 401; body=%s", res.Status, res.Body)
+	}
+	if !strings.Contains(res.Body, "not-owner") {
+		t.Errorf("non-owner response body does not contain \"not-owner\": %s", res.Body)
+	}
+}
diff --git a/tstest/natlab/vnet/conf.go b/tstest/natlab/vnet/conf.go
index 64f28fbc9..191de9e18 100644
--- a/tstest/natlab/vnet/conf.go
+++ b/tstest/natlab/vnet/conf.go
@@ -15,6 +15,7 @@ import (
 
 	"github.com/google/gopacket/layers"
 	"github.com/google/gopacket/pcapgo"
+	"tailscale.com/tailcfg"
 	"tailscale.com/types/logger"
 	"tailscale.com/util/must"
 	"tailscale.com/util/set"
@@ -137,6 +138,8 @@ func (c *Config) AddNode(opts ...any) *Node {
 			}
 		case MAC:
 			n.mac = o
+		case tailcfg.NodeCapMap:
+			n.capMap = o
 		default:
 			if n.err == nil {
 				n.err = fmt.Errorf("unknown AddNode option type %T", o)
@@ -225,6 +228,7 @@ type Node struct {
 	preICMPPing     bool
 	verboseSyslog   bool
 	dontJoinTailnet bool
+	capMap          tailcfg.NodeCapMap
 
 	// TODO(bradfitz): this is halfway converted to supporting multiple NICs
 	// but not done. We need a MAC-per-Network.
@@ -318,6 +322,12 @@ func (n *Node) ShouldJoinTailnet() bool {
 	return !n.dontJoinTailnet
 }
 
+// WantCapMap returns the [tailcfg.NodeCapMap] that control should send down to
+// this node, if any.
+func (n *Node) WantCapMap() tailcfg.NodeCapMap {
+	return n.capMap
+}
+
 // IsV6Only reports whether this node is only connected to IPv6 networks.
 func (n *Node) IsV6Only() bool {
 	for _, net := range n.nets {
@@ -435,6 +445,12 @@ func (n *Network) PostConnectedToControl() {
 	n.network.SetControlBlackholed(n.postConnectBlackholeControl)
 }
 
+// BlackholeControlForAddr sets weither the network should drop all control
+// traffic for the specified addr starting immediately.
+func (n *Network) BlackholeControlForAddr(addr netip.Addr) {
+	n.network.BlackholeControlForAddr(addr)
+}
+
 // NetworkService is a service that can be added to a network.
 type NetworkService string
 
diff --git a/tstest/natlab/vnet/fake_acme.go b/tstest/natlab/vnet/fake_acme.go
new file mode 100644
index 000000000..b14c00d6d
--- /dev/null
+++ b/tstest/natlab/vnet/fake_acme.go
@@ -0,0 +1,528 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package vnet
+
+// This file implements a minimal fake ACME (RFC 8555) certificate authority
+// used by TestACMECertServeHTTPS in tstest/natlab/vmtest. It exists so that
+// natlab VM tests can exercise `tailscale cert` and `tailscale serve` end to
+// end without reaching out to Let's Encrypt.
+//
+// Only the parts of ACME exercised by that test are implemented: the dns-01
+// challenge flow, a single hard-coded account, no JWS signature verification,
+// no key rollover, no nonce tracking, no rate limiting. The TLS root is
+// freshly generated per server.
+//
+// If a future test needs more of the protocol, prefer switching to
+// https://github.com/letsencrypt/pebble (the official Let's Encrypt test
+// ACME server) rather than fleshing this file out further. The threshold for
+// "more complicated" should be low.
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	crand "crypto/rand"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/base64"
+	"encoding/json"
+	"encoding/pem"
+	"fmt"
+	"io"
+	"math/big"
+	"net/http"
+	"strings"
+	"sync"
+	"time"
+
+	"tailscale.com/util/httpm"
+)
+
+// fakeACMEServer is an in-process fake ACME (RFC 8555) CA used by natlab
+// VM tests. See the file-level comment for scope and limitations.
+//
+// The zero value is not usable; construct via [newFakeACMEServer].
+type fakeACMEServer struct {
+	// baseURL is the externally visible URL prefix at which the server is
+	// reachable (no trailing slash). All issued URLs are formed by appending
+	// to baseURL.
+	baseURL string
+
+	mu      sync.Mutex
+	rootKey *ecdsa.PrivateKey // CA signing key
+	rootDER []byte            // CA cert, DER-encoded
+	nextID  int64             // monotonically increasing ID source for orders/authzs/challenges/certs
+	// lookupTXT, if non-nil, returns the TXT records visible to the CA for
+	// dns-01 challenge validation. It is set by the surrounding [Server]
+	// after construction.
+	lookupTXT func(string) []string
+	orders    map[string]*fakeACMEOrder // order ID → order
+	authzs    map[string]*fakeACMEAuthz // authz ID → authz
+	certsPEM  map[string][]byte         // cert ID → issued cert chain PEM
+}
+
+// fakeACMEOrder is the in-memory state for one ACME order.
+//
+// Status is one of "pending", "ready", or "valid", matching RFC 8555 §7.1.6.
+// The terminal "invalid" state is not modeled.
+type fakeACMEOrder struct {
+	id          string
+	status      string
+	identifiers []fakeACMEIdentifier
+	authzURLs   []string
+	finalizeURL string
+	certURL     string // empty until status == "valid"
+}
+
+// fakeACMEAuthz is the in-memory state for one ACME authorization. Each
+// authorization carries a single dns-01 challenge; other challenge types
+// are not modeled.
+type fakeACMEAuthz struct {
+	id         string
+	status     string // "pending" or "valid"
+	identifier fakeACMEIdentifier
+	challenge  fakeACMEChallenge
+}
+
+// fakeACMEIdentifier identifies a domain to be authorized.
+// It is serialized as the ACME "identifier" JSON object.
+type fakeACMEIdentifier struct {
+	Type  string `json:"type"`  // always "dns" in practice
+	Value string `json:"value"` // domain name, possibly with a "*." wildcard prefix
+}
+
+// fakeACMEChallenge is the JSON shape of a single ACME challenge,
+// per RFC 8555 §8.
+type fakeACMEChallenge struct {
+	URL    string `json:"url"`
+	Type   string `json:"type"`  // always "dns-01"
+	Token  string `json:"token"` // not used to derive a real key authorization; just echoed back
+	Status string `json:"status"`
+}
+
+// newFakeACMEServer returns a new fake ACME server that will advertise
+// itself at baseURL. A fresh ECDSA P-256 CA key and a self-signed root
+// certificate are generated. The caller is responsible for actually serving
+// HTTP at baseURL and routing requests to [fakeACMEServer.ServeHTTP].
+func newFakeACMEServer(baseURL string) *fakeACMEServer {
+	key, err := ecdsa.GenerateKey(elliptic.P256(), crand.Reader)
+	if err != nil {
+		panic(fmt.Sprintf("vnet: generating fake ACME root key: %v", err))
+	}
+	tmpl := &x509.Certificate{
+		SerialNumber:          big.NewInt(1),
+		Subject:               pkix.Name{CommonName: "natlab fake ACME root"},
+		NotBefore:             time.Now().Add(-time.Hour),
+		NotAfter:              time.Now().Add(365 * 24 * time.Hour),
+		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageCRLSign,
+		BasicConstraintsValid: true,
+		IsCA:                  true,
+	}
+	der, err := x509.CreateCertificate(crand.Reader, tmpl, tmpl, &key.PublicKey, key)
+	if err != nil {
+		panic(fmt.Sprintf("vnet: creating fake ACME root: %v", err))
+	}
+	return &fakeACMEServer{
+		baseURL:  strings.TrimRight(baseURL, "/"),
+		rootKey:  key,
+		rootDER:  der,
+		nextID:   1,
+		orders:   map[string]*fakeACMEOrder{},
+		authzs:   map[string]*fakeACMEAuthz{},
+		certsPEM: map[string][]byte{},
+	}
+}
+
+// directoryURL returns the ACME directory URL for s, suitable for setting
+// TS_DEBUG_ACME_DIRECTORY_URL in a tailscaled under test.
+func (s *fakeACMEServer) directoryURL() string {
+	return s.baseURL + "/directory"
+}
+
+// rootPEM returns the PEM-encoded root certificate that signs all certs
+// issued by s. Clients that want to verify those certs must trust it.
+func (s *fakeACMEServer) rootPEM() []byte {
+	return pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: s.rootDER})
+}
+
+// ServeHTTP routes ACME protocol requests to the appropriate handler.
+// It is intended to be installed as the [http.Handler] for s.baseURL.
+func (s *fakeACMEServer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	w.Header().Set("Replay-Nonce", fmt.Sprintf("nonce-%d", time.Now().UnixNano()))
+	switch {
+	case r.Method == httpm.GET && r.URL.Path == "/directory":
+		writeACMEJSON(w, http.StatusOK, struct {
+			NewNonce   string `json:"newNonce"`
+			NewAccount string `json:"newAccount"`
+			NewOrder   string `json:"newOrder"`
+			RevokeCert string `json:"revokeCert"`
+		}{
+			NewNonce:   s.baseURL + "/new-nonce",
+			NewAccount: s.baseURL + "/new-account",
+			NewOrder:   s.baseURL + "/new-order",
+			RevokeCert: s.baseURL + "/revoke-cert",
+		})
+	case (r.Method == httpm.HEAD || r.Method == httpm.GET) && r.URL.Path == "/new-nonce":
+		w.WriteHeader(http.StatusOK)
+	case r.Method == httpm.POST && r.URL.Path == "/new-account":
+		s.serveNewAccount(w, r)
+	case r.Method == httpm.POST && r.URL.Path == "/new-order":
+		s.serveNewOrder(w, r)
+	case r.Method == httpm.POST && strings.HasPrefix(r.URL.Path, "/authz/"):
+		s.serveAuthz(w, r)
+	case r.Method == httpm.POST && strings.HasPrefix(r.URL.Path, "/challenge/"):
+		s.serveChallenge(w, r)
+	case r.Method == httpm.POST && strings.HasPrefix(r.URL.Path, "/order/") && strings.HasSuffix(r.URL.Path, "/finalize"):
+		s.serveFinalize(w, r)
+	case r.Method == httpm.POST && strings.HasPrefix(r.URL.Path, "/order/"):
+		s.serveOrder(w, r)
+	case r.Method == httpm.POST && strings.HasPrefix(r.URL.Path, "/cert/"):
+		s.serveCert(w, r)
+	default:
+		http.NotFound(w, r)
+	}
+}
+
+// serveNewAccount handles the ACME newAccount endpoint.
+//
+// The fake only supports a single account: every newAccount request returns
+// the same /account/1 URL, and no per-account state is tracked. Tests that
+// need multiple distinct accounts will need to extend this.
+func (s *fakeACMEServer) serveNewAccount(w http.ResponseWriter, r *http.Request) {
+	var req struct {
+		OnlyReturnExisting bool `json:"onlyReturnExisting"`
+	}
+	if err := decodeJWSPayload(r, &req); err != nil {
+		io.Copy(io.Discard, r.Body)
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
+	if req.OnlyReturnExisting {
+		writeACMEProblemType(w, http.StatusBadRequest, "accountDoesNotExist", "account does not exist")
+		return
+	}
+	w.Header().Set("Location", s.baseURL+"/account/1")
+	writeACMEJSON(w, http.StatusCreated, struct {
+		Status string `json:"status"`
+	}{Status: "valid"})
+}
+
+// serveNewOrder handles the ACME newOrder endpoint. It allocates an order
+// and one authorization (with a single dns-01 challenge) per identifier in
+// the request, all in "pending" status.
+func (s *fakeACMEServer) serveNewOrder(w http.ResponseWriter, r *http.Request) {
+	var req struct {
+		Identifiers []fakeACMEIdentifier `json:"identifiers"`
+	}
+	if err := decodeJWSPayload(r, &req); err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
+
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	orderID := s.allocIDLocked()
+	orderURL := s.baseURL + "/order/" + orderID
+	o := &fakeACMEOrder{
+		id:          orderID,
+		status:      "pending",
+		identifiers: req.Identifiers,
+		finalizeURL: orderURL + "/finalize",
+	}
+	for _, ident := range req.Identifiers {
+		authzID := s.allocIDLocked()
+		chalID := s.allocIDLocked()
+		chal := fakeACMEChallenge{
+			URL:    s.baseURL + "/challenge/" + chalID,
+			Type:   "dns-01",
+			Token:  "token-" + chalID,
+			Status: "pending",
+		}
+		az := &fakeACMEAuthz{
+			id:         authzID,
+			status:     "pending",
+			identifier: ident,
+			challenge:  chal,
+		}
+		authzURL := s.baseURL + "/authz/" + authzID
+		s.authzs[authzID] = az
+		o.authzURLs = append(o.authzURLs, authzURL)
+	}
+	s.orders[orderID] = o
+	w.Header().Set("Location", orderURL)
+	writeACMEJSON(w, http.StatusCreated, s.orderResponseLocked(o))
+}
+
+// serveAuthz handles GET-via-POST of an authorization object.
+func (s *fakeACMEServer) serveAuthz(w http.ResponseWriter, r *http.Request) {
+	id := strings.TrimPrefix(r.URL.Path, "/authz/")
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	az := s.authzs[id]
+	if az == nil {
+		http.NotFound(w, r)
+		return
+	}
+	writeACMEJSON(w, http.StatusOK, s.authzResponseLocked(az))
+}
+
+// serveChallenge handles the client's "I'm ready, please validate" POST to
+// a challenge URL. It looks up the expected TXT record via s.lookupTXT and,
+// if any record is present, marks both the challenge and its enclosing
+// authorization as valid (and re-evaluates any pending orders).
+//
+// The TXT record contents are not validated against the JWK thumbprint; any
+// non-empty record satisfies the challenge. That is intentional for these
+// tests but is not how a real ACME server behaves.
+func (s *fakeACMEServer) serveChallenge(w http.ResponseWriter, r *http.Request) {
+	// Keep issuance pending long enough for `tailscale cert` to print the
+	// cert-pending health warning it is watching for.
+	time.Sleep(3 * time.Second)
+
+	id := strings.TrimPrefix(r.URL.Path, "/challenge/")
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	var az *fakeACMEAuthz
+	for _, a := range s.authzs {
+		if strings.TrimPrefix(a.challenge.URL, s.baseURL+"/challenge/") == id {
+			az = a
+			break
+		}
+	}
+	if az == nil {
+		http.NotFound(w, r)
+		return
+	}
+	name := "_acme-challenge." + strings.TrimPrefix(az.identifier.Value, "*.")
+	if s.lookupTXT == nil || len(s.lookupTXT(name)) == 0 {
+		writeACMEProblem(w, http.StatusForbidden, "dns TXT record not found")
+		return
+	}
+	az.status = "valid"
+	az.challenge.Status = "valid"
+	s.updateOrdersLocked()
+	writeACMEJSON(w, http.StatusOK, az.challenge)
+}
+
+// serveOrder handles GET-via-POST of an order object.
+func (s *fakeACMEServer) serveOrder(w http.ResponseWriter, r *http.Request) {
+	id := strings.TrimPrefix(r.URL.Path, "/order/")
+	id = strings.TrimSuffix(id, "/finalize")
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	o := s.orders[id]
+	if o == nil {
+		http.NotFound(w, r)
+		return
+	}
+	w.Header().Set("Location", s.baseURL+"/order/"+id)
+	writeACMEJSON(w, http.StatusOK, s.orderResponseLocked(o))
+}
+
+// serveFinalize handles a POST to /order/<id>/finalize. It parses the
+// supplied CSR, issues a leaf certificate signed by the fake root, and
+// transitions the order to "valid".
+func (s *fakeACMEServer) serveFinalize(w http.ResponseWriter, r *http.Request) {
+	id := strings.TrimSuffix(strings.TrimPrefix(r.URL.Path, "/order/"), "/finalize")
+	var req struct {
+		CSR string `json:"csr"`
+	}
+	if err := decodeJWSPayload(r, &req); err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
+	csrDER, err := base64.RawURLEncoding.DecodeString(req.CSR)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
+	csr, err := x509.ParseCertificateRequest(csrDER)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
+	if err := csr.CheckSignature(); err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
+
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	o := s.orders[id]
+	if o == nil {
+		http.NotFound(w, r)
+		return
+	}
+	if o.status != "ready" && o.status != "valid" {
+		writeACMEProblem(w, http.StatusForbidden, "order is not ready")
+		return
+	}
+	certPEM, err := s.issueCertLocked(csr)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	certID := s.allocIDLocked()
+	o.status = "valid"
+	o.certURL = s.baseURL + "/cert/" + certID
+	s.certsPEM[certID] = certPEM
+	w.Header().Set("Location", s.baseURL+"/order/"+id)
+	writeACMEJSON(w, http.StatusOK, s.orderResponseLocked(o))
+}
+
+// serveCert returns the PEM-encoded issued certificate chain (leaf + root)
+// for a previously finalized order.
+func (s *fakeACMEServer) serveCert(w http.ResponseWriter, r *http.Request) {
+	id := strings.TrimPrefix(r.URL.Path, "/cert/")
+	s.mu.Lock()
+	cert := append([]byte(nil), s.certsPEM[id]...)
+	s.mu.Unlock()
+	if len(cert) == 0 {
+		http.NotFound(w, r)
+		return
+	}
+	w.Header().Set("Content-Type", "application/pem-certificate-chain")
+	w.WriteHeader(http.StatusOK)
+	w.Write(cert)
+}
+
+// allocIDLocked returns a fresh decimal ID. s.mu must be held.
+func (s *fakeACMEServer) allocIDLocked() string {
+	id := s.nextID
+	s.nextID++
+	return fmt.Sprint(id)
+}
+
+// updateOrdersLocked promotes any pending order whose authorizations are
+// all valid to the "ready" state. s.mu must be held.
+func (s *fakeACMEServer) updateOrdersLocked() {
+	for _, o := range s.orders {
+		if o.status != "pending" {
+			continue
+		}
+		ready := true
+		for _, u := range o.authzURLs {
+			id := strings.TrimPrefix(u, s.baseURL+"/authz/")
+			if s.authzs[id].status != "valid" {
+				ready = false
+			}
+		}
+		if ready {
+			o.status = "ready"
+		}
+	}
+}
+
+// orderResponseLocked returns the JSON-shaped view of o that ACME clients
+// expect. s.mu must be held.
+func (s *fakeACMEServer) orderResponseLocked(o *fakeACMEOrder) any {
+	return struct {
+		Status         string               `json:"status"`
+		Identifiers    []fakeACMEIdentifier `json:"identifiers"`
+		Authorizations []string             `json:"authorizations"`
+		Finalize       string               `json:"finalize"`
+		Certificate    string               `json:"certificate"`
+	}{
+		Status:         o.status,
+		Identifiers:    o.identifiers,
+		Authorizations: o.authzURLs,
+		Finalize:       o.finalizeURL,
+		Certificate:    o.certURL,
+	}
+}
+
+// authzResponseLocked returns the JSON-shaped view of az that ACME clients
+// expect. s.mu must be held.
+func (s *fakeACMEServer) authzResponseLocked(az *fakeACMEAuthz) any {
+	return struct {
+		Status     string              `json:"status"`
+		Identifier fakeACMEIdentifier  `json:"identifier"`
+		Challenges []fakeACMEChallenge `json:"challenges"`
+	}{
+		Status:     az.status,
+		Identifier: az.identifier,
+		Challenges: []fakeACMEChallenge{az.challenge},
+	}
+}
+
+// issueCertLocked signs a 24-hour leaf cert for csr using s's root and
+// returns the leaf-then-root PEM chain. s.mu must be held.
+func (s *fakeACMEServer) issueCertLocked(csr *x509.CertificateRequest) ([]byte, error) {
+	serial := big.NewInt(time.Now().UnixNano())
+	tmpl := &x509.Certificate{
+		SerialNumber: serial,
+		Subject:      csr.Subject,
+		NotBefore:    time.Now().Add(-time.Hour),
+		NotAfter:     time.Now().Add(24 * time.Hour),
+		KeyUsage:     x509.KeyUsageDigitalSignature,
+		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+		DNSNames:     csr.DNSNames,
+	}
+	root, err := x509.ParseCertificate(s.rootDER)
+	if err != nil {
+		return nil, err
+	}
+	der, err := x509.CreateCertificate(crand.Reader, tmpl, root, csr.PublicKey, s.rootKey)
+	if err != nil {
+		return nil, err
+	}
+	var b []byte
+	b = pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der})
+	b = append(b, s.rootPEM()...)
+	return b, nil
+}
+
+// decodeJWSPayload extracts the inner JSON payload from an ACME JWS-wrapped
+// request body and unmarshals it into v. The JWS signature, protected
+// header, and key are not inspected: this is a fake server, and we trust
+// whatever the client sends.
+//
+// ACME (RFC 8555) JWS payloads use unpadded base64url encoding, so we
+// decode Payload as a string with [base64.RawURLEncoding] rather than as a
+// []byte field (which encoding/json would decode with [base64.StdEncoding]).
+func decodeJWSPayload(r *http.Request, v any) error {
+	var jws struct {
+		Payload string `json:"payload"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&jws); err != nil {
+		return err
+	}
+	if jws.Payload == "" {
+		return nil
+	}
+	payload, err := base64.RawURLEncoding.DecodeString(jws.Payload)
+	if err != nil {
+		return err
+	}
+	return json.Unmarshal(payload, v)
+}
+
+// writeACMEJSON serializes v as JSON and writes it as an ACME response with
+// the given status code.
+func writeACMEJSON(w http.ResponseWriter, code int, v any) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(code)
+	json.NewEncoder(w).Encode(v)
+}
+
+// writeACMEProblem writes an ACME "rejectedIdentifier" problem document.
+// This is the catch-all error used when no more specific ACME error type
+// fits.
+func writeACMEProblem(w http.ResponseWriter, code int, detail string) {
+	writeACMEProblemType(w, code, "rejectedIdentifier", detail)
+}
+
+// writeACMEProblemType writes an ACME problem document with the given
+// problem type (the trailing component of urn:ietf:params:acme:error:*)
+// and detail message.
+func writeACMEProblemType(w http.ResponseWriter, code int, problemType, detail string) {
+	writeACMEJSON(w, code, struct {
+		Status int    `json:"status"`
+		Type   string `json:"type"`
+		Detail string `json:"detail"`
+	}{
+		Status: code,
+		Type:   "urn:ietf:params:acme:error:" + problemType,
+		Detail: detail,
+	})
+}
diff --git a/tstest/natlab/vnet/pcap.go b/tstest/natlab/vnet/pcap.go
index 3a766b375..34870fd29 100644
--- a/tstest/natlab/vnet/pcap.go
+++ b/tstest/natlab/vnet/pcap.go
@@ -39,10 +39,14 @@ func (p *pcapWriter) WritePacket(ci gopacket.CaptureInfo, data []byte) error {
 	if p.w == nil {
 		return io.ErrClosedPipe
 	}
+	// Flush per packet so the file is readable if the process dies
+	// mid-test, but don't fsync: an fsync per packet serializes every
+	// packet behind a disk write and caps vnet TCP throughput at a few
+	// hundred kB/s (each data segment pays a couple of milliseconds
+	// before the receiver can ACK it).
 	return do(
 		func() error { return p.w.WritePacket(ci, data) },
 		p.w.Flush,
-		p.f.Sync,
 	)
 }
 
diff --git a/tstest/natlab/vnet/vip.go b/tstest/natlab/vnet/vip.go
index a6973ed50..0d649af8d 100644
--- a/tstest/natlab/vnet/vip.go
+++ b/tstest/natlab/vnet/vip.go
@@ -21,6 +21,12 @@ var (
 	fakeSyslog            = newVIP("syslog.tailscale", 9)
 	fakeCloudInit         = newVIP("cloud-init.tailscale", 5) // serves cloud-init metadata/userdata per node
 	fakeFiles             = newVIP("files.tailscale", 6)      // serves binary files (tta, tailscale, tailscaled) to VMs
+	fakeACME              = newVIP("acme.example", 7)         // fake ACME CA for vmtests
+
+	// FakeDualStackWeb is a dual-stack webserver VIP used by
+	// TestExitNodeV4Only to verify that traffic works through an
+	// IPv4-only exit node even when DNS returns both A and AAAA.
+	FakeDualStackWeb = newVIP("dualstack-web.example.com", "5.0.0.100", "2052::5:100")
 )
 
 type virtualIP struct {
@@ -33,6 +39,13 @@ func (v virtualIP) Match(a netip.Addr) bool {
 	return v.v4 == a.Unmap() || v.v6 == a
 }
 
+// TestDriverIPv4 returns the IPv4 address of the test driver VIP (52.52.0.2).
+// TTA agents dial this IP on port TestDriverPort to connect to the test harness.
+func TestDriverIPv4() netip.Addr { return fakeTestAgent.v4 }
+
+// TestDriverPort is the port the test driver listens on.
+const TestDriverPort = 8008
+
 // FakeDNSIPv4 returns the fake DNS IPv4 address.
 func FakeDNSIPv4() netip.Addr { return fakeDNS.v4 }
 
diff --git a/tstest/natlab/vnet/vnet.go b/tstest/natlab/vnet/vnet.go
index 43256dafe..4e643c6f9 100644
--- a/tstest/natlab/vnet/vnet.go
+++ b/tstest/natlab/vnet/vnet.go
@@ -14,7 +14,13 @@ package vnet
 import (
 	"bytes"
 	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	crand "crypto/rand"
+	"crypto/sha256"
 	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
 	"encoding/binary"
 	"encoding/json"
 	"errors"
@@ -23,11 +29,12 @@ import (
 	"iter"
 	"log"
 	"maps"
+	"math/big"
 	"math/rand/v2"
 	"net"
 	"net/http"
-	"net/http/httptest"
 	"net/netip"
+	"os"
 	"os/exec"
 	"strconv"
 	"strings"
@@ -148,7 +155,43 @@ func (n *network) initStack() error {
 	if tcpipErr != nil {
 		return fmt.Errorf("SetTransportProtocolOption SACK: %v", tcpipErr)
 	}
-	n.linkEP = channel.New(512, 1500, tcpip.LinkAddress(n.mac.HWAddr()))
+	// Raise the TCP buffer limits (defaults: 1 MB send, 1 MB receive)
+	// so that netstack-terminated connections (the fake control plane,
+	// DERP, log catcher, file servers) can keep a large window's worth
+	// of data in flight. In slow environments (oversubscribed CI
+	// runners) the effective RTT of the userspace data path reaches
+	// tens or hundreds of milliseconds, and throughput is capped at
+	// window/RTT.
+	//
+	// The send buffer default deliberately stays at 1 MB: the send
+	// buffer caps how much un-ACKed data one connection can burst into
+	// the QEMU socket and the guest's virtio RX ring. Bursting more
+	// than the downstream path can buffer mass-drops segments, and
+	// netstack's loss recovery handles wide holes so poorly (one or two
+	// segments per 200 ms RTO, for minutes) that transfers effectively
+	// wedge. 1 MB of in-flight data fits within the socket buffer plus
+	// the (enlarged, see qemu.go) virtio ring, and still allows 10 MB/s
+	// at a 100 ms effective RTT.
+	sndBufOpt := tcpip.TCPSendBufferSizeRangeOption{Min: 4 << 10, Default: 1 << 20, Max: 4 << 20}
+	if err := n.ns.SetTransportProtocolOption(tcp.ProtocolNumber, &sndBufOpt); err != nil {
+		return fmt.Errorf("SetTransportProtocolOption send buf: %v", err)
+	}
+	rcvBufOpt := tcpip.TCPReceiveBufferSizeRangeOption{Min: 4 << 10, Default: 4 << 20, Max: 16 << 20}
+	if err := n.ns.SetTransportProtocolOption(tcp.ProtocolNumber, &rcvBufOpt); err != nil {
+		return fmt.Errorf("SetTransportProtocolOption recv buf: %v", err)
+	}
+	// Enable receive buffer moderation (auto-tuning) so idle
+	// connections don't hold the full 4 MB.
+	modRcvBufOpt := tcpip.TCPModerateReceiveBufferOption(true)
+	if err := n.ns.SetTransportProtocolOption(tcp.ProtocolNumber, &modRcvBufOpt); err != nil {
+		return fmt.Errorf("SetTransportProtocolOption moderate recv buf: %v", err)
+	}
+	// The queue is sized to hold a full TCP send buffer's worth of
+	// 1500-byte frames (see the send buffer sizing above) so that a
+	// burst from one netstack connection can't overflow it; overflow
+	// here is silent packet loss. It's a channel of pointers, so the
+	// memory cost of the headroom is trivial.
+	n.linkEP = channel.New(4096, 1500, tcpip.LinkAddress(n.mac.HWAddr()))
 	if tcpipProblem := n.ns.CreateNIC(nicID, n.linkEP); tcpipProblem != nil {
 		return fmt.Errorf("CreateNIC: %v", tcpipProblem)
 	}
@@ -194,6 +237,8 @@ func (n *network) initStack() error {
 			Destination: ipv6Subnet,
 			NIC:         nicID,
 		})
+
+		n.startUnsolicitedRAs()
 	}
 
 	n.ns.SetRouteTable(routes)
@@ -205,7 +250,7 @@ func (n *network) initStack() error {
 		return tcpFwd.HandlePacket(tei, pb)
 	})
 
-	go func() {
+	n.s.wg.Go(func() {
 		for {
 			pkt := n.linkEP.ReadContext(n.s.shutdownCtx)
 			if pkt == nil {
@@ -217,7 +262,7 @@ func (n *network) initStack() error {
 			}
 			n.handleIPPacketFromGvisor(pkt.ToView().AsSlice())
 		}
-	}()
+	})
 	return nil
 }
 
@@ -272,7 +317,12 @@ func (n *network) handleIPPacketFromGvisor(ipRaw []byte) {
 	// where the primary MAC may be on a different network).
 	mac := node.macForNet(n)
 	if nw, ok := n.writers.Load(mac); ok {
-		nw.write(resPkt)
+		// conditionedWrite (rather than nw.write) so that the network's
+		// simulated latency and packet loss also apply to traffic
+		// originating from the router's own netstack (the fake control
+		// plane, DERP, DNS, file servers, etc), not just to forwarded
+		// node-to-node traffic.
+		n.conditionedWrite(nw, resPkt)
 	} else {
 		n.logf("gvisor write: no writeFunc for %v (node %v on net %v)", mac, node, n.mac)
 	}
@@ -288,6 +338,32 @@ func netaddrIPFromNetstackIP(s tcpip.Address) netip.Addr {
 	return netip.Addr{}
 }
 
+// debugSampleTCPInfo periodically logs the TCP sender state (cwnd, RTO,
+// RTT, congestion state) of ep plus stack-wide TCP counters, for
+// debugging vnet throughput. Enabled by VNET_TCP_DEBUG=1. It returns
+// when the endpoint leaves the established state.
+func (n *network) debugSampleTCPInfo(ep tcpip.Endpoint) {
+	st := n.ns.Stats().TCP
+	for {
+		time.Sleep(500 * time.Millisecond)
+		var info tcpip.TCPInfoOption
+		if err := ep.GetSockOpt(&info); err != nil {
+			log.Printf("tcpdebug: GetSockOpt: %v", err)
+			return
+		}
+		log.Printf("tcpdebug: state=%v cc=%v cwnd=%v ssthresh=%v rtt=%v rttvar=%v rto=%v reorderSeen=%v | stack: retrans=%v rtoTimeouts=%v fastRetrans=%v fastRecovery=%v sackRecovery=%v spuriousRecovery=%v sendErrs=%v qDrops=%v",
+			info.State, info.CcState, info.SndCwnd, info.SndSsthresh,
+			info.RTT.Round(time.Microsecond), info.RTTVar.Round(time.Microsecond), info.RTO,
+			info.ReorderSeen,
+			st.Retransmits.Value(), st.Timeouts.Value(), st.FastRetransmit.Value(),
+			st.FastRecovery.Value(), st.SACKRecovery.Value(), st.SpuriousRecovery.Value(),
+			st.SegmentSendErrors.Value(), n.ns.Stats().DroppedPackets.Value())
+		if info.State != tcpip.EndpointState(tcp.StateEstablished) {
+			return
+		}
+	}
+}
+
 func stringifyTEI(tei stack.TransportEndpointID) string {
 	localHostPort := net.JoinHostPort(tei.LocalAddress.String(), strconv.Itoa(int(tei.LocalPort)))
 	remoteHostPort := net.JoinHostPort(tei.RemoteAddress.String(), strconv.Itoa(int(tei.RemotePort)))
@@ -352,7 +428,7 @@ func (n *network) acceptTCP(r *tcp.ForwarderRequest) {
 		return
 	}
 
-	if destPort == 8008 && fakeTestAgent.Match(destIP) {
+	if destPort == TestDriverPort && fakeTestAgent.Match(destIP) {
 		node, ok := n.nodeByIP(clientRemoteIP)
 		if !ok {
 			n.logf("unknown client IP %v trying to connect to test driver", clientRemoteIP)
@@ -366,11 +442,23 @@ func (n *network) acceptTCP(r *tcp.ForwarderRequest) {
 		return
 	}
 
-	if destPort == 80 && fakeControl.Match(destIP) {
+	if fakeControl.Match(destIP) && (destPort == 80 || destPort == 443) {
 		r.Complete(false)
 		tc := gonet.NewTCPConn(&wq, ep)
+		context.AfterFunc(n.s.shutdownCtx, func() { tc.SetDeadline(time.Now()) })
+		// The control client's noise dialer forces an HTTPS (port 443) dial when
+		// it made a noise dial recently — e.g. an immediate re-login or profile
+		// switch; see controlhttp.Dialer.forceNoise443. Serve the test control
+		// over TLS on 443 too so that path reaches it. (The cert isn't
+		// validated: noise dials authenticate via the Noise handshake.)
+		var ln net.Listener = netutil.NewOneConnListener(tc, nil)
+		if destPort == 443 {
+			ln = netutil.NewOneConnListener(tls.Server(tc, n.s.controlTLS), nil)
+		}
 		hs := &http.Server{Handler: n.s.control}
-		go hs.Serve(netutil.NewOneConnListener(tc, nil))
+		n.s.wg.Go(func() {
+			hs.Serve(ln)
+		})
 		return
 	}
 
@@ -383,39 +471,68 @@ func (n *network) acceptTCP(r *tcp.ForwarderRequest) {
 
 			r.Complete(false)
 			tc := gonet.NewTCPConn(&wq, ep)
+			context.AfterFunc(n.s.shutdownCtx, func() { tc.SetDeadline(time.Now()) })
 			tlsConn := tls.Server(tc, ds.tlsConfig)
 			hs := &http.Server{Handler: ds.handler}
-			go hs.Serve(netutil.NewOneConnListener(tlsConn, nil))
+			n.s.wg.Go(func() {
+				hs.Serve(netutil.NewOneConnListener(tlsConn, nil))
+			})
 			return
 		}
 		if destPort == 80 {
 			r.Complete(false)
 			tc := gonet.NewTCPConn(&wq, ep)
+			context.AfterFunc(n.s.shutdownCtx, func() { tc.SetDeadline(time.Now()) })
 			hs := &http.Server{Handler: n.s.derps[0].handler}
-			go hs.Serve(netutil.NewOneConnListener(tc, nil))
+			n.s.wg.Go(func() {
+				hs.Serve(netutil.NewOneConnListener(tc, nil))
+			})
 			return
 		}
 	}
 	if destPort == 443 && fakeLogCatcher.Match(destIP) {
 		r.Complete(false)
 		tc := gonet.NewTCPConn(&wq, ep)
-		go n.serveLogCatcherConn(clientRemoteIP, tc)
+		context.AfterFunc(n.s.shutdownCtx, func() { tc.SetDeadline(time.Now()) })
+		n.s.wg.Go(func() {
+			n.serveLogCatcherConn(clientRemoteIP, tc)
+		})
 		return
 	}
 
 	if destPort == 80 && fakeCloudInit.Match(destIP) {
 		r.Complete(false)
 		tc := gonet.NewTCPConn(&wq, ep)
+		context.AfterFunc(n.s.shutdownCtx, func() { tc.SetDeadline(time.Now()) })
 		hs := &http.Server{Handler: n.s.cloudInitHandler()}
-		go hs.Serve(netutil.NewOneConnListener(tc, nil))
+		n.s.wg.Go(func() {
+			hs.Serve(netutil.NewOneConnListener(tc, nil))
+		})
 		return
 	}
 
 	if destPort == 80 && fakeFiles.Match(destIP) {
 		r.Complete(false)
 		tc := gonet.NewTCPConn(&wq, ep)
+		context.AfterFunc(n.s.shutdownCtx, func() { tc.SetDeadline(time.Now()) })
+		if os.Getenv("VNET_TCP_DEBUG") == "1" {
+			go n.debugSampleTCPInfo(ep)
+		}
 		hs := &http.Server{Handler: n.s.fileServerHandler()}
-		go hs.Serve(netutil.NewOneConnListener(tc, nil))
+		n.s.wg.Go(func() {
+			hs.Serve(netutil.NewOneConnListener(tc, nil))
+		})
+		return
+	}
+
+	if destPort == 80 && fakeACME.Match(destIP) && n.s.fakeACME != nil {
+		r.Complete(false)
+		tc := gonet.NewTCPConn(&wq, ep)
+		context.AfterFunc(n.s.shutdownCtx, func() { tc.SetDeadline(time.Now()) })
+		hs := &http.Server{Handler: n.s.fakeACME}
+		n.s.wg.Go(func() {
+			hs.Serve(netutil.NewOneConnListener(tc, nil))
+		})
 		return
 	}
 
@@ -588,6 +705,15 @@ type network struct {
 	// writers is a map of MAC -> networkWriters to write packets to that MAC.
 	// It contains entries for connected nodes only.
 	writers syncs.Map[MAC, networkWriter] // MAC -> to networkWriter for that MAC
+
+	blackholeMu  sync.Mutex
+	blackholeMap map[netip.Addr]netip.Addr // blackholeMap contains address pairs for dropping traffic (in either direction)
+
+	// raStopMu guards raStopped and serializes with the unsolicited RA
+	// goroutine's send so that StopUnsolicitedRAsForTest can deterministically
+	// silence the background traffic.
+	raStopMu  sync.Mutex
+	raStopped bool
 }
 
 // registerWriter registers a client address with a MAC address.
@@ -600,6 +726,17 @@ func (n *network) registerWriter(mac MAC, c vmClient) {
 		nw.interfaceID = node.interfaceID
 	}
 	n.writers.Store(mac, nw)
+
+	// As soon as a host appears on the wire, hand it a Router Advertisement
+	// so its kernel installs the prefix + default route. Without this, hosts
+	// that never emit a Router Solicitation (e.g. gokrazy with DHCPv4 doing
+	// link bringup) would have to wait for the next periodic RA, by which
+	// point the test may have already failed.
+	if n.v6 {
+		if pkt, err := n.buildIPv6RouterAdvertisement(mac, ipv6AllNodes); err == nil {
+			n.writeEth(pkt)
+		}
+	}
 }
 
 func (n *network) unregisterWriter(mac MAC) {
@@ -635,6 +772,19 @@ func (n *network) SetControlBlackholed(v bool) {
 	n.blackholeControl = v
 }
 
+// BlackholeControlForAddr sets up a map entry, ensuring that traffic to or from
+// control from the addr is dropped.
+func (n *network) BlackholeControlForAddr(addr netip.Addr) {
+	n.blackholeMu.Lock()
+	defer n.blackholeMu.Unlock()
+
+	if addr.Is6() {
+		mak.Set(&n.blackholeMap, addr, fakeControl.v6)
+	} else {
+		mak.Set(&n.blackholeMap, addr, fakeControl.v4)
+	}
+}
+
 // nodeNIC represents a single network interface on a node.
 // For multi-homed nodes, additional NICs beyond the primary are stored in node.extraNICs.
 type nodeNIC struct {
@@ -700,16 +850,23 @@ type derpServer struct {
 	srv       *derpserver.Server
 	handler   http.Handler
 	tlsConfig *tls.Config
+	// certSHA256Hex is the SHA-256 hex fingerprint of the leaf certificate
+	// served by this DERP server. It is the value tests pin against when
+	// they configure a custom DERP map with CertName="sha256-raw:<hex>".
+	certSHA256Hex string
 }
 
-func newDERPServer() *derpServer {
-	// Just to get a self-signed TLS cert:
-	ts := httptest.NewTLSServer(nil)
-	ts.Close()
-
+// newDERPServer returns a derpServer whose TLS cert is a freshly generated
+// self-signed ECDSA cert valid for hostname. Tests that use a stock test DERP
+// map with InsecureForTests=true ignore the cert content entirely; tests that
+// want to exercise sha256-raw cert pinning can read the certSHA256Hex via
+// [Server.DERPCertSHA256Hex].
+func newDERPServer(hostname string) *derpServer {
+	tlsConfig, certHex := selfSignedCert(hostname)
 	ds := &derpServer{
-		srv:       derpserver.New(key.NewNode(), logger.Discard),
-		tlsConfig: ts.TLS, // self-signed; test client configure to not check
+		srv:           derpserver.New(key.NewNode(), logger.Discard),
+		tlsConfig:     tlsConfig,
+		certSHA256Hex: certHex,
 	}
 	var mux http.ServeMux
 	mux.Handle("/derp", derpserver.Handler(ds.srv))
@@ -719,6 +876,40 @@ func newDERPServer() *derpServer {
 	return ds
 }
 
+// selfSignedCert builds a self-signed ECDSA P-256 cert valid for hostname and
+// returns a *tls.Config that serves it, along with the SHA-256 hex digest of
+// the cert's DER bytes (used by DERP for sha256-raw cert pinning).
+func selfSignedCert(hostname string) (*tls.Config, string) {
+	key, err := ecdsa.GenerateKey(elliptic.P256(), crand.Reader)
+	if err != nil {
+		panic(fmt.Sprintf("vnet: generating DERP cert key: %v", err))
+	}
+	tmpl := &x509.Certificate{
+		SerialNumber: big.NewInt(1),
+		Subject:      pkix.Name{CommonName: hostname},
+		NotBefore:    time.Now().Add(-time.Hour),
+		NotAfter:     time.Now().Add(365 * 24 * time.Hour),
+		KeyUsage:     x509.KeyUsageDigitalSignature,
+		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+		DNSNames:     []string{hostname},
+	}
+	if ip := net.ParseIP(hostname); ip != nil {
+		tmpl.IPAddresses = []net.IP{ip}
+		tmpl.DNSNames = nil
+	}
+	der, err := x509.CreateCertificate(crand.Reader, tmpl, tmpl, &key.PublicKey, key)
+	if err != nil {
+		panic(fmt.Sprintf("vnet: creating DERP cert: %v", err))
+	}
+	cfg := &tls.Config{
+		Certificates: []tls.Certificate{{
+			Certificate: [][]byte{der},
+			PrivateKey:  key,
+		}},
+	}
+	return cfg, fmt.Sprintf("%x", sha256.Sum256(der))
+}
+
 type Server struct {
 	shutdownCtx    context.Context
 	shutdownCancel context.CancelFunc
@@ -735,21 +926,37 @@ type Server struct {
 	networks     set.Set[*network]
 	networkByWAN *bart.Table[*network]
 
-	control    *testcontrol.Server
+	control *testcontrol.Server
+	// controlTLS is a self-signed cert for serving the test control over HTTPS
+	// (port 443) in addition to plaintext HTTP. The control client does not
+	// validate this cert (noise dials authenticate via the Noise handshake, not
+	// the outer TLS); it exists only so the forced-443 dial path has a TLS peer.
+	controlTLS *tls.Config
 	derps      []*derpServer
+	fakeACME   *fakeACMEServer
 	pcapWriter *pcapWriter
 
-	// writeMu serializes all writes to VM clients.
-	writeMu sync.Mutex
-	scratch []byte
+	// vmWriteState holds per-VM-connection write state, serializing
+	// writes of length-prefixed frames so concurrent writers can't
+	// interleave them mid-frame. It is deliberately per-connection
+	// rather than one global lock: a VM that is slow to drain its
+	// socket (common on contended CI hosts) must not stall writes to
+	// every other VM on the server.
+	vmWriteState syncs.Map[*net.UnixConn, *vmWriteState]
 
 	mu              sync.Mutex
 	agentConnWaiter map[*node]chan<- struct{} // signaled after added to set
 	agentConns      set.Set[*agentConn]       //  not keyed by node; should be small/cheap enough to scan all
 	agentDialer     map[*node]netx.DialFunc
+	gotFirstPacket  map[MAC]chan struct{} // closed on first packet from each MAC
 
 	cloudInitData map[int]*CloudInitData // node num → cloud-init config
 	fileContents  map[string][]byte      // filename → file bytes
+	dnsTXTRecords map[string][]string
+
+	// onDHCPEvent, if non-nil, is called when DHCP messages are processed.
+	// Parameters are: source MAC, node number, DHCP message type, assigned IP.
+	onDHCPEvent func(nodeMAC MAC, nodeNum int, msgType layers.DHCPMsgType, assignedIP netip.Addr)
 }
 
 func (s *Server) logf(format string, args ...any) {
@@ -764,6 +971,21 @@ func (s *Server) SetLoggerForTest(logf func(format string, args ...any)) {
 	s.optLogf = logf
 }
 
+// SetDHCPCallback registers a function to be called when DHCP messages are
+// processed. The callback receives the source MAC, node number, DHCP message
+// type (Discover, Offer, Request, Ack), and the assigned IP address.
+func (s *Server) SetDHCPCallback(fn func(MAC, int, layers.DHCPMsgType, netip.Addr)) {
+	s.onDHCPEvent = fn
+}
+
+// derpHostnames are the SNI/HostName values vnet's fake DERP servers identify
+// as. They are also used to issue the per-DERP self-signed certificate so that
+// hostname verification succeeds for tests that pin via sha256-raw.
+var derpHostnames = []string{"derp1.tailscale", "derp2.tailscale"}
+
+// controlHostname is the hostname the fake control server is reached at.
+const controlHostname = "control.tailscale"
+
 var derpMap = &tailcfg.DERPMap{
 	Regions: map[int]*tailcfg.DERPRegion{
 		1: {
@@ -774,7 +996,7 @@ var derpMap = &tailcfg.DERPMap{
 				{
 					Name:             "1a",
 					RegionID:         1,
-					HostName:         "derp1.tailscale",
+					HostName:         derpHostnames[0],
 					IPv4:             fakeDERP1.v4.String(),
 					IPv6:             fakeDERP1.v6.String(),
 					InsecureForTests: true,
@@ -790,7 +1012,7 @@ var derpMap = &tailcfg.DERPMap{
 				{
 					Name:             "2a",
 					RegionID:         2,
-					HostName:         "derp2.tailscale",
+					HostName:         derpHostnames[1],
 					IPv4:             fakeDERP2.v4.String(),
 					IPv6:             fakeDERP2.v6.String(),
 					InsecureForTests: true,
@@ -809,22 +1031,34 @@ func New(c *Config) (*Server, error) {
 
 		control: &testcontrol.Server{
 			DERPMap:         derpMap,
-			ExplicitBaseURL: "http://control.tailscale",
+			ExplicitBaseURL: "http://" + controlHostname,
 		},
+		fakeACME: newFakeACMEServer("http://acme.example"),
 
 		blendReality: c.blendReality,
 		derpIPs:      set.Of[netip.Addr](),
 
-		nodeByMAC:    map[MAC]*node{},
-		networkByWAN: &bart.Table[*network]{},
-		networks:     set.Of[*network](),
+		nodeByMAC:     map[MAC]*node{},
+		networkByWAN:  &bart.Table[*network]{},
+		networks:      set.Of[*network](),
+		dnsTXTRecords: map[string][]string{},
 	}
-	for range 2 {
-		s.derps = append(s.derps, newDERPServer())
+	s.control.OnSetDNS = func(req *tailcfg.SetDNSRequest) error {
+		s.setDNSRecord(req.Name, req.Value)
+		return nil
+	}
+	s.fakeACME.lookupTXT = s.lookupTXT
+	s.controlTLS, _ = selfSignedCert(controlHostname)
+	for _, host := range derpHostnames {
+		s.derps = append(s.derps, newDERPServer(host))
 	}
 	if err := s.initFromConfig(c); err != nil {
 		return nil, err
 	}
+	s.gotFirstPacket = make(map[MAC]chan struct{})
+	for mac := range s.nodeByMAC {
+		s.gotFirstPacket[mac] = make(chan struct{})
+	}
 	for n := range s.networks {
 		if err := n.initStack(); err != nil {
 			return nil, fmt.Errorf("newServer: initStack: %v", err)
@@ -839,6 +1073,42 @@ func (s *Server) ControlServer() *testcontrol.Server {
 	return s.control
 }
 
+// DERPHostname returns the SNI/HostName used by vnet's idx'th fake DERP
+// server. idx must be 0 or 1.
+func (s *Server) DERPHostname(idx int) string {
+	return derpHostnames[idx]
+}
+
+// DERPCertSHA256Hex returns the SHA-256 hex fingerprint of the self-signed
+// TLS certificate served by vnet's idx'th fake DERP server. It is the value
+// to pin against in a [tailcfg.DERPNode.CertName] formatted as
+// "sha256-raw:<hex>". idx must be 0 or 1.
+func (s *Server) DERPCertSHA256Hex(idx int) string {
+	return s.derps[idx].certSHA256Hex
+}
+
+// FakeACMEDirectoryURL returns the directory URL for vnet's in-process ACME CA.
+func (s *Server) FakeACMEDirectoryURL() string {
+	return s.fakeACME.directoryURL()
+}
+
+// FakeACMERootPEM returns the PEM-encoded root certificate for vnet's fake ACME CA.
+func (s *Server) FakeACMERootPEM() []byte {
+	return s.fakeACME.rootPEM()
+}
+
+func (s *Server) setDNSRecord(name, value string) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.dnsTXTRecords[name] = append(s.dnsTXTRecords[name], value)
+}
+
+func (s *Server) lookupTXT(name string) []string {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return append([]string(nil), s.dnsTXTRecords[name]...)
+}
+
 // CloudInitData holds the cloud-init configuration for a node.
 type CloudInitData struct {
 	MetaData      string
@@ -932,11 +1202,39 @@ func (s *Server) Close() {
 	s.wg.Wait()
 }
 
+// AwaitFirstPacket waits until the first ethernet frame is received from the
+// given MAC address, indicating the VM has booted far enough to send network
+// traffic. It returns an error if the context expires first.
+func (s *Server) AwaitFirstPacket(ctx context.Context, mac MAC) error {
+	ch, ok := s.gotFirstPacket[mac]
+	if !ok {
+		return fmt.Errorf("unknown MAC %v", mac)
+	}
+	select {
+	case <-ch:
+		return nil
+	case <-ctx.Done():
+		return fmt.Errorf("no network packets received from %v: %w", mac, ctx.Err())
+	}
+}
+
 // MACs returns the MAC addresses of the configured nodes.
 func (s *Server) MACs() iter.Seq[MAC] {
 	return maps.Keys(s.nodeByMAC)
 }
 
+// StopUnsolicitedRAsForTest stops all networks from sending periodic
+// unsolicited IPv6 Router Advertisements. It blocks until any in-progress
+// send has finished, so callers may safely register sinks afterwards
+// without races against background RA traffic.
+func (s *Server) StopUnsolicitedRAsForTest() {
+	for n := range s.networks {
+		n.raStopMu.Lock()
+		n.raStopped = true
+		n.raStopMu.Unlock()
+	}
+}
+
 func (s *Server) RegisterSinkForTest(mac MAC, fn func(eth []byte)) {
 	n, ok := s.nodeByMAC[mac]
 	if !ok {
@@ -961,22 +1259,31 @@ const (
 	ProtocolUnixDGRAM // for macOS Virtualization.Framework and VZFileHandleNetworkDeviceAttachment
 )
 
-func (s *Server) writeEthernetFrameToVM(c vmClient, ethPkt []byte, interfaceID int) {
-	s.writeMu.Lock()
-	defer s.writeMu.Unlock()
+// vmWriteState is a VM connection's write serialization state.
+// See the Server.vmWriteState field comment.
+type vmWriteState struct {
+	mu      sync.Mutex
+	scratch []byte // length-prefixed frame being written; owned by mu
+}
 
+func (s *Server) writeEthernetFrameToVM(c vmClient, ethPkt []byte, interfaceID int) {
 	if ethPkt == nil {
 		return
 	}
 	switch c.proto() {
 	case ProtocolQEMU:
-		s.scratch = binary.BigEndian.AppendUint32(s.scratch[:0], uint32(len(ethPkt)))
-		s.scratch = append(s.scratch, ethPkt...)
-		if _, err := c.uc.Write(s.scratch); err != nil {
+		ws, _ := s.vmWriteState.LoadOrInit(c.uc, func() *vmWriteState { return new(vmWriteState) })
+		ws.mu.Lock()
+		ws.scratch = binary.BigEndian.AppendUint32(ws.scratch[:0], uint32(len(ethPkt)))
+		ws.scratch = append(ws.scratch, ethPkt...)
+		_, err := c.uc.Write(ws.scratch)
+		ws.mu.Unlock()
+		if err != nil {
 			s.logf("Write pkt: %v", err)
 		}
 
 	case ProtocolUnixDGRAM:
+		// Datagram writes are atomic; no locking needed.
 		if _, err := c.uc.WriteToUnix(ethPkt, c.raddr); err != nil {
 			s.logf("Write pkt : %v", err)
 			return
@@ -1034,6 +1341,15 @@ func (s *Server) ServeUnixConn(uc *net.UnixConn, proto Protocol) {
 	s.logf("Got conn %T %p", uc, uc)
 	defer uc.Close()
 
+	// Enlarge the socket buffers (best effort; the kernel caps these at
+	// net.core.{w,r}mem_max). The write buffer sits between vnet and a
+	// QEMU process that may be slow to drain on a contended host; the
+	// deeper it is, the more of a TCP flow's in-flight data queues here
+	// (lossless backpressure) instead of overrunning the guest's virtio
+	// RX ring and getting dropped.
+	uc.SetWriteBuffer(4 << 20)
+	uc.SetReadBuffer(4 << 20)
+
 	buf := make([]byte, 16<<10)
 	didReg := map[MAC]bool{}
 	for {
@@ -1045,8 +1361,7 @@ func (s *Server) ServeUnixConn(uc *net.UnixConn, proto Protocol) {
 			n, addr, err := uc.ReadFromUnix(buf)
 			raddr = addr
 			if err != nil {
-				if s.shutdownCtx.Err() != nil {
-					// Return without logging.
+				if s.shutdownCtx.Err() != nil || errors.Is(err, net.ErrClosed) {
 					return
 				}
 				s.logf("ReadFromUnix: %#v", err)
@@ -1088,6 +1403,13 @@ func (s *Server) ServeUnixConn(uc *net.UnixConn, proto Protocol) {
 		}
 		if !didReg[srcMAC] {
 			didReg[srcMAC] = true
+			if ch, ok := s.gotFirstPacket[srcMAC]; ok {
+				select {
+				case <-ch: // already closed
+				default:
+					close(ch)
+				}
+			}
 			srcNet := srcNode.netForMAC(srcMAC)
 			if srcNet == nil {
 				s.logf("[conn %p] node %v has no network for MAC %v", c.uc, srcNode, srcMAC)
@@ -1133,6 +1455,23 @@ func (s *Server) handleEthernetFrameFromVM(packetRaw []byte) error {
 	return nil
 }
 
+// routeTCPPacket forwards a TCP packet to the network owning the
+// destination IP (looked up by WAN IP). Used for inter-network TCP
+// forwarding so guest VM TCP stacks talk end-to-end through vnet's
+// packet-level NAT.
+func (s *Server) routeTCPPacket(tp TCPPacket) {
+	dstIP := tp.Dst.Addr()
+	netw, ok := s.networkByWAN.Lookup(dstIP)
+	if !ok {
+		if dstIP.IsPrivate() {
+			return
+		}
+		log.Printf("no network to route TCP packet for %v", tp.Dst)
+		return
+	}
+	netw.HandleTCPPacket(tp)
+}
+
 func (s *Server) routeUDPPacket(up UDPPacket) {
 	// Find which network owns this based on the destination IP
 	// and all the known networks' wan IPs.
@@ -1369,6 +1708,65 @@ func (n *network) nodeByIP(ip netip.Addr) (node *node, ok bool) {
 	return node, ok
 }
 
+// HandleTCPPacket handles a TCP packet arriving from the simulated
+// internet, addressed to the network's WAN IP. It NATs the destination
+// back to a LAN node and writes the rewritten packet onto the LAN.
+func (n *network) HandleTCPPacket(p TCPPacket) {
+	buf, err := n.serializedTCPPacket(p.Src, p.Dst, p.TCP, nil)
+	if err != nil {
+		n.logf("serializing TCP packet: %v", err)
+		return
+	}
+	n.s.pcapWriter.WritePacket(gopacket.CaptureInfo{
+		Timestamp:      time.Now(),
+		CaptureLength:  len(buf),
+		Length:         len(buf),
+		InterfaceIndex: n.wanInterfaceID,
+	}, buf)
+	if p.Dst.Addr().Is4() && n.breakWAN4 {
+		return
+	}
+	dst := n.doNATIn(p.Src, p.Dst)
+	if !dst.IsValid() {
+		n.logf("Warning: NAT dropped TCP packet; no mapping for %v=>%v", p.Src, p.Dst)
+		return
+	}
+	p.Dst = dst
+	buf, err = n.serializedTCPPacket(p.Src, p.Dst, p.TCP, nil)
+	if err != nil {
+		n.logf("serializing TCP packet: %v", err)
+		return
+	}
+	n.s.pcapWriter.WritePacket(gopacket.CaptureInfo{
+		Timestamp:      time.Now(),
+		CaptureLength:  len(buf),
+		Length:         len(buf),
+		InterfaceIndex: n.lanInterfaceID,
+	}, buf)
+	n.WriteTCPPacketNoNAT(p)
+}
+
+// WriteTCPPacketNoNAT writes a TCP packet to the network without doing
+// any NAT translation. The src/dst in p must already be in their final
+// form for the LAN.
+func (n *network) WriteTCPPacketNoNAT(p TCPPacket) {
+	node, ok := n.nodeByIP(p.Dst.Addr())
+	if !ok {
+		n.logf("no node for dest IP %v in TCP packet %v=>%v", p.Dst.Addr(), p.Src, p.Dst)
+		return
+	}
+	eth := &layers.Ethernet{
+		SrcMAC: n.mac.HWAddr(),
+		DstMAC: node.macForNet(n).HWAddr(),
+	}
+	ethRaw, err := n.serializedTCPPacket(p.Src, p.Dst, p.TCP, eth)
+	if err != nil {
+		n.logf("serializing TCP packet: %v", err)
+		return
+	}
+	n.writeEth(ethRaw)
+}
+
 // WriteUDPPacketNoNAT writes a UDP packet to the network, without
 // doing any NAT translation.
 //
@@ -1418,6 +1816,27 @@ func mkIPLayer(proto layers.IPProtocol, src, dst netip.Addr) serializableNetwork
 	panic("invalid src IP")
 }
 
+// serializedTCPPacket serializes a TCP packet with the given src/dst,
+// using the provided TCP layer (its flags, seq/ack, window, options,
+// and payload are preserved; only the src/dst ports are overwritten).
+//
+// If eth is non-nil, it is used as the Ethernet layer, otherwise the
+// Ethernet layer is omitted.
+func (n *network) serializedTCPPacket(src, dst netip.AddrPort, tcp *layers.TCP, eth *layers.Ethernet) ([]byte, error) {
+	ip := mkIPLayer(layers.IPProtocolTCP, src.Addr(), dst.Addr())
+	// Copy the TCP layer with new ports and a zeroed checksum so
+	// gopacket recomputes it against the new IP pseudo-header.
+	newTCP := *tcp
+	newTCP.SrcPort = layers.TCPPort(src.Port())
+	newTCP.DstPort = layers.TCPPort(dst.Port())
+	newTCP.Checksum = 0
+	payload := gopacket.Payload(tcp.Payload)
+	if eth == nil {
+		return mkPacket(ip, &newTCP, payload)
+	}
+	return mkPacket(eth, ip, &newTCP, payload)
+}
+
 // serializedUDPPacket serializes a UDP packet with the given source and
 // destination IP:port pairs, and payload.
 //
@@ -1468,6 +1887,17 @@ func (n *network) HandleEthernetPacketForRouter(ep EthernetPacket) {
 			// Blackhole the packet.
 			return
 		}
+
+		// Drop traffic to/from address pairs in the blackholeMap.
+		n.blackholeMu.Lock()
+		defer n.blackholeMu.Unlock()
+		if src, ok := n.blackholeMap[flow.dst]; ok && flow.src == src {
+			return
+		}
+		if dst, ok := n.blackholeMap[flow.src]; ok && flow.dst == dst {
+			return
+		}
+
 		var base *layers.BaseLayer
 		proto := header.IPv4ProtocolNumber
 		if v4, ok := packet.Layer(layers.LayerTypeIPv4).(*layers.IPv4); ok {
@@ -1489,6 +1919,19 @@ func (n *network) HandleEthernetPacketForRouter(ep EthernetPacket) {
 		return
 	}
 
+	// Inter-network TCP forwarding: a guest VM is sending TCP to another
+	// simulated network's WAN IP. Apply egress NAT (rewriting src) and
+	// hand the packet off to the destination network for ingress NAT and
+	// LAN delivery, so the two guest TCP stacks talk end-to-end.
+	if toForward && flow.dst.Is4() {
+		if tcp, ok := packet.Layer(layers.LayerTypeTCP).(*layers.TCP); ok {
+			if _, ok := n.s.networkByWAN.Lookup(flow.dst); ok {
+				n.handleTCPPacketForRouter(tcp, flow)
+				return
+			}
+		}
+	}
+
 	if flow.src.Is6() && flow.src.IsLinkLocalUnicast() && !flow.dst.IsLinkLocalUnicast() {
 		// Don't log.
 		return
@@ -1503,6 +1946,54 @@ func (n *network) HandleEthernetPacketForRouter(ep EthernetPacket) {
 	n.logf("router got unknown packet: %v", packet)
 }
 
+// handleTCPPacketForRouter handles a TCP packet from a LAN node that
+// targets another simulated network's WAN IP. It rewrites src via the
+// local NAT, then routes the packet to the destination network where
+// HandleTCPPacket rewrites dst and delivers it to the LAN.
+func (n *network) handleTCPPacketForRouter(tcp *layers.TCP, flow ipSrcDst) {
+	if flow.dst.Is4() && n.breakWAN4 {
+		return
+	}
+	src := netip.AddrPortFrom(flow.src, uint16(tcp.SrcPort))
+	dst := netip.AddrPortFrom(flow.dst, uint16(tcp.DstPort))
+
+	buf, err := n.serializedTCPPacket(src, dst, tcp, nil)
+	if err != nil {
+		n.logf("serializing TCP packet: %v", err)
+		return
+	}
+	n.s.pcapWriter.WritePacket(gopacket.CaptureInfo{
+		Timestamp:      time.Now(),
+		CaptureLength:  len(buf),
+		Length:         len(buf),
+		InterfaceIndex: n.lanInterfaceID,
+	}, buf)
+
+	lanSrc := src
+	src = n.doNATOut(src, dst)
+	if !src.IsValid() {
+		n.logf("warning: NAT dropped TCP packet; no NAT out mapping for %v=>%v", lanSrc, dst)
+		return
+	}
+	buf, err = n.serializedTCPPacket(src, dst, tcp, nil)
+	if err != nil {
+		n.logf("serializing TCP packet: %v", err)
+		return
+	}
+	n.s.pcapWriter.WritePacket(gopacket.CaptureInfo{
+		Timestamp:      time.Now(),
+		CaptureLength:  len(buf),
+		Length:         len(buf),
+		InterfaceIndex: n.wanInterfaceID,
+	}, buf)
+
+	n.s.routeTCPPacket(TCPPacket{
+		Src: src,
+		Dst: dst,
+		TCP: tcp,
+	})
+}
+
 func (n *network) handleUDPPacketForRouter(ep EthernetPacket, udp *layers.UDP, toForward bool, flow ipSrcDst) {
 	packet := ep.gp
 	srcIP, dstIP := flow.src, flow.dst
@@ -1619,21 +2110,36 @@ func (n *network) handleUDPPacketForRouter(ep EthernetPacket, udp *layers.UDP, t
 	n.logf("router got unknown UDP packet: %v", packet)
 }
 
-func (n *network) handleIPv6RouterSolicitation(ep EthernetPacket, rs *layers.ICMPv6RouterSolicitation) {
-	v6 := ep.gp.Layer(layers.LayerTypeIPv6).(*layers.IPv6)
+// ipv6AllNodes is the IPv6 link-local "all nodes" multicast address (ff02::1).
+// Unsolicited Router Advertisements are sent here so that every connected
+// host on the LAN sees them without the router having to know each host's
+// unicast address.
+var ipv6AllNodes = net.ParseIP("ff02::1")
 
-	// Send a router advertisement back.
+// unsolicitedRAInterval is how often vnet sends an unsolicited IPv6 Router
+// Advertisement on each v6-enabled network. Real routers default to 200s
+// (RFC 4861 §6.2.1, MaxRtrAdvInterval). We pick a much smaller value so
+// short-lived tests don't have to wait: the first RA goes out as soon as
+// a VM connects, and any subsequent gokrazy/Linux init paths that miss the
+// initial RA pick one up quickly.
+const unsolicitedRAInterval = 5 * time.Second
+
+// buildIPv6RouterAdvertisement serializes a Router Advertisement frame
+// addressed to (dstMAC, dstIP), advertising n.wanIP6's /64 as on-link and
+// fe80::1 as a default router. dstMAC/dstIP are typically the soliciting
+// host (for a solicited reply) or the link-local all-nodes group (for an
+// unsolicited periodic RA).
+func (n *network) buildIPv6RouterAdvertisement(dstMAC MAC, dstIP net.IP) ([]byte, error) {
 	eth := &layers.Ethernet{
 		SrcMAC:       n.mac.HWAddr(),
-		DstMAC:       ep.SrcMAC().HWAddr(),
+		DstMAC:       dstMAC.HWAddr(),
 		EthernetType: layers.EthernetTypeIPv6,
 	}
-	n.logf("sending IPv6 router advertisement to %v from %v", eth.DstMAC, eth.SrcMAC)
 	ip := &layers.IPv6{
 		NextHeader: layers.IPProtocolICMPv6,
 		HopLimit:   255, // per RFC 4861, 7.1.1 etc (all NDP messages); don't use mkPacket's default of 64
 		SrcIP:      net.ParseIP("fe80::1"),
-		DstIP:      v6.SrcIP,
+		DstIP:      dstIP,
 	}
 	icmp := &layers.ICMPv6{
 		TypeCode: layers.CreateICMPv6TypeCode(layers.ICMPv6TypeRouterAdvertisement, 0),
@@ -1656,7 +2162,13 @@ func (n *network) handleIPv6RouterSolicitation(ep EthernetPacket, rs *layers.ICM
 			},
 		},
 	}
-	pkt, err := mkPacket(eth, ip, icmp, ra)
+	return mkPacket(eth, ip, icmp, ra)
+}
+
+func (n *network) handleIPv6RouterSolicitation(ep EthernetPacket, _ *layers.ICMPv6RouterSolicitation) {
+	v6 := ep.gp.Layer(layers.LayerTypeIPv6).(*layers.IPv6)
+	n.logf("sending IPv6 router advertisement to %v from %v", ep.SrcMAC(), n.mac)
+	pkt, err := n.buildIPv6RouterAdvertisement(ep.SrcMAC(), v6.SrcIP)
 	if err != nil {
 		n.logf("serializing ICMPv6 RA: %v", err)
 		return
@@ -1664,6 +2176,46 @@ func (n *network) handleIPv6RouterSolicitation(ep EthernetPacket, rs *layers.ICM
 	n.writeEth(pkt)
 }
 
+// startUnsolicitedRAs sends an unsolicited Router Advertisement to the
+// link-local all-nodes group every unsolicitedRAInterval until the vnet
+// server shuts down. This ensures hosts on the LAN install vnet's default
+// IPv6 route even if their stack never emits a Router Solicitation, which
+// is what gokrazy's dual-stack init does in practice: it brings the link
+// up via DHCPv4 and then leaves IPv6 to the kernel, which under our
+// configuration never sends an RS.
+func (n *network) startUnsolicitedRAs() {
+	n.s.wg.Go(func() {
+		send := func() {
+			// Hold raStopMu across the writeEth so that
+			// StopUnsolicitedRAsForTest can synchronize with any
+			// in-progress send: once StopUnsolicitedRAsForTest returns,
+			// no further unsolicited RAs will be delivered to writers.
+			n.raStopMu.Lock()
+			defer n.raStopMu.Unlock()
+			if n.raStopped {
+				return
+			}
+			pkt, err := n.buildIPv6RouterAdvertisement(macAllNodes, ipv6AllNodes)
+			if err != nil {
+				n.logf("building unsolicited RA: %v", err)
+				return
+			}
+			n.writeEth(pkt)
+		}
+		send()
+		t := time.NewTicker(unsolicitedRAInterval)
+		defer t.Stop()
+		for {
+			select {
+			case <-n.s.shutdownCtx.Done():
+				return
+			case <-t.C:
+				send()
+			}
+		}
+	})
+}
+
 func (n *network) handleIPv6NeighborSolicitation(ep EthernetPacket, ns *layers.ICMPv6NeighborSolicitation) {
 	v6 := ep.gp.Layer(layers.LayerTypeIPv6).(*layers.IPv6)
 
@@ -1804,6 +2356,10 @@ func (s *Server) createDHCPResponse(request gopacket.Packet) ([]byte, error) {
 				Length: 4,
 			},
 		)
+		if s.onDHCPEvent != nil {
+			s.onDHCPEvent(srcMAC, node.num, layers.DHCPMsgTypeDiscover, clientIP)
+			s.onDHCPEvent(srcMAC, node.num, layers.DHCPMsgTypeOffer, clientIP)
+		}
 	case layers.DHCPMsgTypeRequest:
 		response.Options = append(response.Options,
 			layers.DHCPOption{
@@ -1832,6 +2388,10 @@ func (s *Server) createDHCPResponse(request gopacket.Packet) ([]byte, error) {
 				Length: 4,
 			},
 		)
+		if s.onDHCPEvent != nil {
+			s.onDHCPEvent(srcMAC, node.num, layers.DHCPMsgTypeRequest, clientIP)
+			s.onDHCPEvent(srcMAC, node.num, layers.DHCPMsgTypeAck, clientIP)
+		}
 	}
 
 	eth := &layers.Ethernet{
@@ -1890,7 +2450,7 @@ func (s *Server) shouldInterceptTCP(pkt gopacket.Packet) bool {
 	}
 
 	if tcp.DstPort == 80 || tcp.DstPort == 443 {
-		for _, v := range []virtualIP{fakeControl, fakeDERP1, fakeDERP2, fakeLogCatcher, fakeCloudInit, fakeFiles} {
+		for _, v := range []virtualIP{fakeControl, fakeDERP1, fakeDERP2, fakeLogCatcher, fakeCloudInit, fakeFiles, fakeACME} {
 			if v.Match(flow.dst) {
 				return true
 			}
@@ -1902,7 +2462,7 @@ func (s *Server) shouldInterceptTCP(pkt gopacket.Packet) bool {
 			return true
 		}
 	}
-	if tcp.DstPort == 8008 && fakeTestAgent.Match(flow.dst) {
+	if tcp.DstPort == TestDriverPort && fakeTestAgent.Match(flow.dst) {
 		// Connection from cmd/tta.
 		return true
 	}
@@ -2019,6 +2579,17 @@ func (s *Server) createDNSResponse(pkt gopacket.Packet) ([]byte, error) {
 					TTL:   60,
 				})
 			}
+		} else if q.Type == layers.DNSTypeTXT {
+			for _, txt := range s.lookupTXT(string(q.Name)) {
+				response.ANCount++
+				response.Answers = append(response.Answers, layers.DNSResourceRecord{
+					Name:  q.Name,
+					Type:  q.Type,
+					Class: q.Class,
+					TXTs:  [][]byte{[]byte(txt)},
+					TTL:   60,
+				})
+			}
 		}
 	}
 
@@ -2292,6 +2863,17 @@ type UDPPacket struct {
 	Payload []byte // everything after UDP header
 }
 
+// TCPPacket is a TCP packet flowing through vnet's NAT, used for
+// packet-level TCP forwarding between simulated networks. Unlike UDP
+// (which only needs ports + payload), TCP carries flags, sequence
+// numbers, and options that must be preserved end-to-end so the guest
+// VM kernels' TCP state machines stay in sync.
+type TCPPacket struct {
+	Src netip.AddrPort
+	Dst netip.AddrPort
+	TCP *layers.TCP // full parsed TCP layer (header + options + payload)
+}
+
 func (s *Server) WriteStartingBanner(w io.Writer) {
 	fmt.Fprintf(w, "vnet serving clients:\n")
 
@@ -2323,14 +2905,24 @@ func (s *Server) addIdleAgentConn(ac *agentConn) {
 
 func (s *Server) takeAgentConn(ctx context.Context, n *node) (_ *agentConn, ok bool) {
 	const debug = false
+	// stuckThreshold is how long we wait before deciding the agent is slow
+	// enough to warrant a log line. Below this we stay quiet because, in
+	// healthy runs with many agent dials in flight, even a few-millisecond
+	// wait would otherwise log every poll for every concurrent waiter.
+	const stuckThreshold = 10 * time.Second
+	start := time.Now()
+	var lastWarn time.Time
 	for {
-		ac, ok := s.takeAgentConnOne(n)
-		if ok {
+		ac, miss := s.takeAgentConnOne(n)
+		if ac != nil {
 			if debug {
 				log.Printf("takeAgentConn: got agent conn for %v", n.mac)
 			}
 			return ac, true
 		}
+		if debug && miss > 0 {
+			log.Printf("takeAgentConnOne: missed %d times for %v", miss, n.mac)
+		}
 		s.mu.Lock()
 		ready := make(chan struct{})
 		mak.Set(&s.agentConnWaiter, n, ready)
@@ -2339,6 +2931,10 @@ func (s *Server) takeAgentConn(ctx context.Context, n *node) (_ *agentConn, ok b
 		if debug {
 			log.Printf("takeAgentConn: waiting for agent conn for %v", n.mac)
 		}
+		if elapsed := time.Since(start); elapsed > stuckThreshold && time.Since(lastWarn) > stuckThreshold {
+			log.Printf("takeAgentConn: still waiting for agent conn for %v after %v (%d idle conns for other nodes)", n.mac, elapsed.Round(time.Second), miss)
+			lastWarn = time.Now()
+		}
 		select {
 		case <-ctx.Done():
 			return nil, false
@@ -2351,21 +2947,21 @@ func (s *Server) takeAgentConn(ctx context.Context, n *node) (_ *agentConn, ok b
 	}
 }
 
-func (s *Server) takeAgentConnOne(n *node) (_ *agentConn, ok bool) {
+// takeAgentConnOne returns an idle agent conn for n if one is available,
+// otherwise nil. miss is the number of idle agent conns for other nodes that
+// were walked over while looking; the caller may use it for diagnostics when
+// a wait drags on.
+func (s *Server) takeAgentConnOne(n *node) (ac *agentConn, miss int) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
-	miss := 0
 	for ac := range s.agentConns {
 		if ac.node == n {
 			s.agentConns.Delete(ac)
-			return ac, true
+			return ac, 0
 		}
 		miss++
 	}
-	if miss > 0 {
-		log.Printf("takeAgentConnOne: missed %d times for %v", miss, n.mac)
-	}
-	return nil, false
+	return nil, miss
 }
 
 type NodeAgentClient struct {
diff --git a/tstest/natlab/vnet/vnet_test.go b/tstest/natlab/vnet/vnet_test.go
index 9d7c78c45..53490ca98 100644
--- a/tstest/natlab/vnet/vnet_test.go
+++ b/tstest/natlab/vnet/vnet_test.go
@@ -8,6 +8,7 @@ import (
 	"encoding/binary"
 	"errors"
 	"fmt"
+	"io"
 	"net"
 	"net/netip"
 	"path/filepath"
@@ -194,6 +195,10 @@ func TestPacketSideEffects(t *testing.T) {
 			if err != nil {
 				t.Fatal(err)
 			}
+			// Silence the periodic unsolicited Router Advertisements
+			// before registering sinks; otherwise a background RA can
+			// race with the synchronous packet-count assertions below.
+			s.StopUnsolicitedRAsForTest()
 			defer s.Close()
 
 			for _, tt := range tt.tests {
@@ -558,7 +563,7 @@ func TestProtocolQEMU(t *testing.T) {
 		go s.ServeUnixConn(conn.(*net.UnixConn), ProtocolQEMU)
 	}
 
-	sendBetweenClients(t, clientc, s, mkLenPrefixed)
+	sendBetweenClients(t, clientc, s, ProtocolQEMU)
 }
 
 // TestProtocolUnixDgram tests the protocol that macOS Virtualization.framework
@@ -601,11 +606,11 @@ func TestProtocolUnixDgram(t *testing.T) {
 		clientc[i] = c
 	}
 
-	sendBetweenClients(t, clientc, s, nil)
+	sendBetweenClients(t, clientc, s, ProtocolUnixDGRAM)
 }
 
 // sendBetweenClients is a test helper that tries to send an ethernet frame from
-// one client to another.
+// one client to another using the given vnet wire protocol.
 //
 // It first makes the two clients send a packet to a fictitious node 3, which
 // forces their src MACs to be registered with a networkWriter internally so
@@ -615,12 +620,11 @@ func TestProtocolUnixDgram(t *testing.T) {
 // effect here, so this does it manually.
 //
 // It also then waits for them to be registered.
-//
-// wrap is an optional function that wraps the packet before sending it.
-func sendBetweenClients(t testing.TB, clientc [2]*net.UnixConn, s *Server, wrap func([]byte) []byte) {
+func sendBetweenClients(t testing.TB, clientc [2]*net.UnixConn, s *Server, proto Protocol) {
 	t.Helper()
-	if wrap == nil {
-		wrap = func(b []byte) []byte { return b }
+	wrap := func(b []byte) []byte { return b }
+	if proto == ProtocolQEMU {
+		wrap = mkLenPrefixed
 	}
 	for i, c := range clientc {
 		must.Get(c.Write(wrap(mkEth(nodeMac(3), nodeMac(i+1), testingEthertype, []byte("hello")))))
@@ -637,15 +641,45 @@ func sendBetweenClients(t testing.TB, clientc [2]*net.UnixConn, s *Server, wrap
 	t.Logf("writing % 02x", pkt)
 	must.Get(clientc[0].Write(pkt))
 
-	buf := make([]byte, len(pkt))
-	clientc[1].SetReadDeadline(time.Now().Add(5 * time.Second))
-	n, err := clientc[1].Read(buf)
-	if err != nil {
-		t.Fatal(err)
+	// vnet sends a Router Advertisement at writer-register time on v6-enabled
+	// networks (and may also send periodic unsolicited RAs). Loop until we
+	// see the test packet, skipping any noise that arrived first.
+	//
+	// For the QEMU stream protocol the kernel is free to coalesce multiple
+	// length-prefixed frames into one Read, so the reader must parse the
+	// framing or it may swallow the test packet alongside an RA.
+	deadline := time.Now().Add(5 * time.Second)
+	clientc[1].SetReadDeadline(deadline)
+	readFrame := func() ([]byte, error) {
+		if proto == ProtocolUnixDGRAM {
+			buf := make([]byte, 2048)
+			n, err := clientc[1].Read(buf)
+			if err != nil {
+				return nil, err
+			}
+			return buf[:n], nil
+		}
+		var hdr [4]byte
+		if _, err := io.ReadFull(clientc[1], hdr[:]); err != nil {
+			return nil, err
+		}
+		n := binary.BigEndian.Uint32(hdr[:])
+		frame := make([]byte, 4+n)
+		copy(frame, hdr[:])
+		if _, err := io.ReadFull(clientc[1], frame[4:]); err != nil {
+			return nil, err
+		}
+		return frame, nil
 	}
-	got := buf[:n]
-	if !bytes.Equal(got, pkt) {
-		t.Errorf("bad packet\n got: % 02x\nwant: % 02x", got, pkt)
+	for {
+		got, err := readFrame()
+		if err != nil {
+			t.Fatalf("did not receive test packet: %v", err)
+		}
+		if bytes.Equal(got, pkt) {
+			return
+		}
+		t.Logf("ignoring unexpected packet (% 02x...)", got[:min(len(got), 16)])
 	}
 }
 
diff --git a/tstest/reflect.go b/tstest/reflect.go
index 4ba1f96c3..19142af58 100644
--- a/tstest/reflect.go
+++ b/tstest/reflect.go
@@ -6,8 +6,9 @@ package tstest
 import (
 	"net/netip"
 	"reflect"
-	"testing"
 	"time"
+
+	"tailscale.com/util/testenv"
 )
 
 // IsZeroable is the interface for things with an IsZero method.
@@ -30,7 +31,7 @@ var (
 // The nonzeroValues map should contain non-zero values for each type that
 // exists in the type T or any contained types. Basic types like string, bool,
 // and numeric types are handled automatically.
-func CheckIsZero[T IsZeroable](t testing.TB, nonzeroValues map[reflect.Type]any) {
+func CheckIsZero[T IsZeroable](t testenv.TB, nonzeroValues map[reflect.Type]any) {
 	t.Helper()
 
 	var zero T
diff --git a/tstest/resource.go b/tstest/resource.go
index 867925b7d..72397c2d0 100644
--- a/tstest/resource.go
+++ b/tstest/resource.go
@@ -9,8 +9,9 @@ import (
 	"runtime/pprof"
 	"slices"
 	"strings"
-	"testing"
 	"time"
+
+	"tailscale.com/util/testenv"
 )
 
 // ResourceCheck takes a snapshot of the current goroutines and registers a
@@ -19,7 +20,7 @@ import (
 // can look at specific routines).
 //
 // It panics if called from a parallel test.
-func ResourceCheck(tb testing.TB) {
+func ResourceCheck(tb testenv.TB) {
 	tb.Helper()
 
 	// Set an environment variable (anything at all) just for the
@@ -48,7 +49,7 @@ func ResourceCheck(tb testing.TB) {
 		// Parse and print goroutines.
 		start := parseGoroutines(startStacks)
 		end := parseGoroutines(endStacks)
-		if testing.Verbose() {
+		if testenv.Verbose() {
 			tb.Logf("goroutines start:\n%s", printGoroutines(start))
 			tb.Logf("goroutines end:\n%s", printGoroutines(end))
 		}
diff --git a/tstest/tailmac/Makefile b/tstest/tailmac/Makefile
index b87e44ed1..303f72c1f 100644
--- a/tstest/tailmac/Makefile
+++ b/tstest/tailmac/Makefile
@@ -5,12 +5,12 @@ endif
 
 .PHONY: tailmac
 tailmac:
-	xcodebuild -scheme tailmac -destination 'platform=macOS,arch=arm64' -derivedDataPath build -configuration Release build | $(XCPRETTIFIER)
+	set -o pipefail && xcodebuild -scheme tailmac -destination 'platform=macOS,arch=arm64' -derivedDataPath build -configuration Release build | $(XCPRETTIFIER)
 	cp -r ./build/Build/Products/Release/tailmac ./bin/tailmac
 
 .PHONY: host
 host:
-	xcodebuild -scheme host -destination 'platform=macOS,arch=arm64'  -derivedDataPath build -configuration Release build | $(XCPRETTIFIER)
+	set -o pipefail && xcodebuild -scheme host -destination 'platform=macOS,arch=arm64'  -derivedDataPath build -configuration Release build | $(XCPRETTIFIER)
 	cp -r ./build/Build/Products/Release/Host.app ./bin/Host.app
 
 .PHONY: clean
diff --git a/tstest/tailmac/Swift/Common/Config.swift b/tstest/tailmac/Swift/Common/Config.swift
index 53d768020..53281628a 100644
--- a/tstest/tailmac/Swift/Common/Config.swift
+++ b/tstest/tailmac/Swift/Common/Config.swift
@@ -103,10 +103,10 @@ class Config: Codable {
 
 }
 
-// The VM Bundle URL holds the restore image and a set of VM images
-// By default, VM's are persisted at ~/VM.bundle
+// The VM Bundle URL holds the restore image and a set of VM images.
+// VMs are stored under ~/.cache/tailscale/vmtest/macos/.
 var vmBundleURL: URL = {
-    let vmBundlePath = NSHomeDirectory() + "/VM.bundle/"
+    let vmBundlePath = NSHomeDirectory() + "/.cache/tailscale/vmtest/macos/"
     createDir(vmBundlePath)
     let bundleURL = URL(fileURLWithPath: vmBundlePath)
     return bundleURL
diff --git a/tstest/tailmac/Swift/Common/TailMacConfigHelper.swift b/tstest/tailmac/Swift/Common/TailMacConfigHelper.swift
index fc7f2d89d..562eae1fa 100644
--- a/tstest/tailmac/Swift/Common/TailMacConfigHelper.swift
+++ b/tstest/tailmac/Swift/Common/TailMacConfigHelper.swift
@@ -74,18 +74,31 @@ struct TailMacConfigHelper {
         return networkDevice
     }
 
+    /// Creates a NIC configuration connected to the vnet dgram socket.
     func createSocketNetworkDeviceConfiguration() -> VZVirtioNetworkDeviceConfiguration {
         let networkDevice = VZVirtioNetworkDeviceConfiguration()
         networkDevice.macAddress = VZMACAddress(string: config.mac)!
+        if let attachment = createDgramAttachment(serverSocket: config.serverSocket, clientID: config.vmID) {
+            networkDevice.attachment = attachment
+        }
+        return networkDevice
+    }
 
+    /// Creates a NIC configuration with no attachment (disconnected).
+    /// The attachment can be hot-swapped later via VZNetworkDevice.attachment.
+    func createDisconnectedNetworkDeviceConfiguration() -> VZVirtioNetworkDeviceConfiguration {
+        let networkDevice = VZVirtioNetworkDeviceConfiguration()
+        networkDevice.macAddress = VZMACAddress(string: config.mac)!
+        // No attachment — NIC appears disconnected to the guest.
+        return networkDevice
+    }
+
+    /// Creates a dgram socket attachment for connecting to a vnet server.
+    /// Returns nil on error.
+    func createDgramAttachment(serverSocket: String, clientID: String) -> VZFileHandleNetworkDeviceAttachment? {
         let socket = Darwin.socket(AF_UNIX, SOCK_DGRAM, 0)
 
-        // Outbound network packets
-        let serverSocket = config.serverSocket
-
-        // Inbound network packets
-        let clientSockId = config.vmID
-        let clientSocket = "/tmp/qemu-dgram-\(clientSockId).sock"
+        let clientSocket = "/tmp/qemu-dgram-\(clientID).sock"
 
         unlink(clientSocket)
         var clientAddr = sockaddr_un()
@@ -102,7 +115,7 @@ struct TailMacConfigHelper {
 
         if bindRes == -1 {
             print("Error binding virtual network client socket - \(String(cString: strerror(errno)))")
-            return networkDevice
+            return nil
         }
 
         var serverAddr = sockaddr_un()
@@ -118,20 +131,16 @@ struct TailMacConfigHelper {
                                         socklen_t(MemoryLayout<sockaddr_un>.size))
 
         if connectRes == -1 {
-            print("Error binding virtual network server socket - \(String(cString: strerror(errno)))")
-            return networkDevice
+            print("Error connecting to server socket \(serverSocket) - \(String(cString: strerror(errno)))")
+            return nil
         }
 
         print("Virtual if mac address is \(config.mac)")
         print("Client bound to \(clientSocket)")
         print("Connected to server at \(serverSocket)")
-        print("Socket fd is \(socket)")
-
 
         let handle = FileHandle(fileDescriptor: socket)
-        let device = VZFileHandleNetworkDeviceAttachment(fileHandle: handle)
-        networkDevice.attachment = device
-        return networkDevice
+        return VZFileHandleNetworkDeviceAttachment(fileHandle: handle)
     }
 
     func createPointingDeviceConfiguration() -> VZPointingDeviceConfiguration {
diff --git a/tstest/tailmac/Swift/Host/HostCli.swift b/tstest/tailmac/Swift/Host/HostCli.swift
index 9c9ae6fa0..16711b2aa 100644
--- a/tstest/tailmac/Swift/Host/HostCli.swift
+++ b/tstest/tailmac/Swift/Host/HostCli.swift
@@ -20,13 +20,291 @@ extension HostCli {
     struct Run: ParsableCommand {
         @Option var id: String
         @Option var share: String?
+        @Flag(help: "Run without GUI (for automated testing)") var headless: Bool = false
+        @Flag(help: "Create NIC with no attachment (for later hot-swap)") var disconnectedNic: Bool = false
+        @Flag(help: "Use NAT NIC instead of socket NIC (for snapshot prep)") var natNic: Bool = false
+        @Option(help: "Hot-swap NIC to this dgram socket path after boot/restore") var attachNetwork: String?
+        @Option(help: "Serve screenshots on this localhost port (0 = auto)") var screenshotPort: Int?
+        @Option(help: "Assign IP/mask/gw to guest via vsock (e.g. 192.168.1.2/255.255.255.0/192.168.1.1)") var assignIp: String?
 
         mutating func run() {
             config = Config(id)
             config.sharedDir = share
             print("Running vm with identifier \(id) and sharedDir \(share ?? "<none>")")
-            _ = NSApplicationMain(CommandLine.argc, CommandLine.unsafeArgv)
+
+            if headless {
+                let attachSocket = attachNetwork
+                let useNatNIC = natNic
+                let disconnected = !useNatNIC && (disconnectedNic || attachSocket != nil)
+                let wantScreenshots = screenshotPort != nil
+                let requestedPort = UInt16(screenshotPort ?? 0)
+                let ipConfig = assignIp
+
+                // Set up SIGINT handler before entering the event loop.
+                // The dispatch source must be stored in a global to prevent ARC deallocation.
+                signal(SIGINT, SIG_IGN)
+                let sigintSource = DispatchSource.makeSignalSource(signal: SIGINT, queue: .main)
+                retainedSigintSource = sigintSource
+
+                DispatchQueue.main.async {
+                    let controller = VMController()
+                    controller.createVirtualMachine(headless: true, disconnectedNIC: disconnected, natNIC: useNatNIC)
+
+                    // Start vsock listener for IP assignment.
+                    // If --assign-ip is set, the listener replies with the IP config JSON.
+                    // If not set (snapshot prep), it replies "wait" so TTA keeps polling.
+                    if let ipCfg = ipConfig {
+                        let parts = ipCfg.split(separator: "/")
+                        if parts.count == 3 {
+                            let response = "{\"ip\":\"\(parts[0])\",\"mask\":\"\(parts[1])\",\"gw\":\"\(parts[2])\"}"
+                            controller.startIPConfigListener(response: response)
+                        }
+                    } else {
+                        controller.startIPConfigListener(response: "wait")
+                    }
+
+                    sigintSource.setEventHandler {
+                        print("SIGINT received, disconnecting NIC and saving VM state...")
+                        controller.disconnectNetwork()
+                        controller.pauseAndSaveVirtualMachine {
+                            print("VM state saved, exiting.")
+                            Foundation.exit(0)
+                        }
+                    }
+                    sigintSource.resume()
+
+                    // Set up screenshot HTTP server if requested.
+                    // The window must be ordered on-screen for the window server
+                    // to composite VZVirtualMachineView's content. We place it
+                    // behind all other windows and make it tiny (1x1) so it's
+                    // effectively invisible.
+                    if wantScreenshots {
+                        let vmView = VZVirtualMachineView()
+                        vmView.virtualMachine = controller.virtualMachine
+                        vmView.frame = NSRect(x: 0, y: 0, width: 1920, height: 1200)
+
+                        let window = NSWindow(
+                            contentRect: NSRect(x: 0, y: 0, width: 1920, height: 1200),
+                            styleMask: [.borderless],
+                            backing: .buffered,
+                            defer: false
+                        )
+                        window.isReleasedWhenClosed = false
+                        window.contentView = vmView
+                        // Place behind all other windows so it's not visible to the user.
+                        window.level = NSWindow.Level(rawValue: Int(CGWindowLevelForKey(.minimumWindow)) - 1)
+                        window.orderFront(nil)
+
+                        startScreenshotServer(view: vmView, port: requestedPort)
+                    }
+
+                    let doAttach = {
+                        if let sock = attachSocket {
+                            controller.attachNetwork(serverSocket: sock, clientID: config.vmID)
+                        }
+                    }
+
+                    let fileManager = FileManager.default
+                    if fileManager.fileExists(atPath: config.saveFileURL.path) {
+                        print("Restoring virtual machine state from \(config.saveFileURL)")
+                        controller.restoreVirtualMachine()
+                        doAttach()
+                    } else {
+                        print("Starting virtual machine")
+                        controller.startVirtualMachine()
+                        doAttach()
+                    }
+                }
+
+                if wantScreenshots {
+                    // NSApp event loop needed for VZVirtualMachineView rendering.
+                    let app = NSApplication.shared
+                    app.setActivationPolicy(.accessory)
+                    print("STARTING_NSAPP")
+                    fflush(stdout)
+                    app.run()
+                } else {
+                    // Use dispatchMain() instead of RunLoop.main.run() so that
+                    // GCD dispatch sources (like the SIGINT handler) are processed.
+                    dispatchMain()
+                }
+            } else {
+                _ = NSApplicationMain(CommandLine.argc, CommandLine.unsafeArgv)
+            }
         }
     }
 }
 
+// startScreenshotServer starts a localhost HTTP server that serves VM display
+// screenshots on GET /screenshot as JPEG. The port is printed to stdout as
+// "SCREENSHOT_PORT=<port>" so the Go test harness can discover it.
+var retainedSigintSource: DispatchSourceSignal? // prevent ARC deallocation
+var screenshotServer: ScreenshotHTTPServer? // prevent GC
+
+func startScreenshotServer(view: NSView, port: UInt16) {
+    let server = ScreenshotHTTPServer(view: view)
+    screenshotServer = server
+    server.start(port: port)
+}
+
+/// Minimal HTTP server that serves screenshots of a VZVirtualMachineView.
+class ScreenshotHTTPServer: NSObject {
+    let view: NSView
+    var acceptSource: DispatchSourceRead? // prevent GC
+
+    init(view: NSView) {
+        self.view = view
+    }
+
+    private func log(_ msg: String) {
+        let s = msg + "\n"
+        FileHandle.standardError.write(Data(s.utf8))
+    }
+
+    func start(port: UInt16) {
+        let queue = DispatchQueue(label: "screenshot-server")
+
+        let fd = socket(AF_INET, SOCK_STREAM, 0)
+        guard fd >= 0 else {
+            log("screenshot server: socket() failed")
+            return
+        }
+        var yes: Int32 = 1
+        setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &yes, socklen_t(MemoryLayout<Int32>.size))
+
+        var addr = sockaddr_in()
+        addr.sin_len = UInt8(MemoryLayout<sockaddr_in>.size)
+        addr.sin_family = sa_family_t(AF_INET)
+        addr.sin_port = port.bigEndian
+        addr.sin_addr.s_addr = UInt32(0x7f000001).bigEndian // 127.0.0.1
+
+        let bindResult = withUnsafePointer(to: &addr) { ptr in
+            ptr.withMemoryRebound(to: sockaddr.self, capacity: 1) { sockPtr in
+                Darwin.bind(fd, sockPtr, socklen_t(MemoryLayout<sockaddr_in>.size))
+            }
+        }
+        guard bindResult == 0 else {
+            log("screenshot server: bind() failed: \(errno)")
+            close(fd)
+            return
+        }
+        guard Darwin.listen(fd, 4) == 0 else {
+            log("screenshot server: listen() failed")
+            close(fd)
+            return
+        }
+
+        var boundAddr = sockaddr_in()
+        var boundLen = socklen_t(MemoryLayout<sockaddr_in>.size)
+        withUnsafeMutablePointer(to: &boundAddr) { ptr in
+            ptr.withMemoryRebound(to: sockaddr.self, capacity: 1) { sockPtr in
+                getsockname(fd, sockPtr, &boundLen)
+            }
+        }
+        let actualPort = UInt16(bigEndian: boundAddr.sin_port)
+        print("SCREENSHOT_PORT=\(actualPort)")
+        fflush(stdout)
+
+        let source = DispatchSource.makeReadSource(fileDescriptor: fd, queue: queue)
+        source.setEventHandler { [self] in
+            let clientFd = accept(fd, nil, nil)
+            self.log("screenshot: accept fd=\(clientFd)")
+            guard clientFd >= 0 else { return }
+            self.handleConnection(clientFd)
+        }
+        source.setCancelHandler { close(fd) }
+        source.resume()
+        self.acceptSource = source
+    }
+
+    private func handleConnection(_ fd: Int32) {
+        var buf = [UInt8](repeating: 0, count: 4096)
+        let n = read(fd, &buf, buf.count)
+        let requestLine = n > 0 ? String(bytes: buf[..<n], encoding: .utf8) ?? "" : ""
+
+        // Route: GET /screenshot — capture the VM display.
+        let wantFull = requestLine.contains("full=1")
+
+        let sem = DispatchSemaphore(value: 0)
+        var jpegData: Data?
+        DispatchQueue.main.async { [self] in
+            jpegData = self.captureScreenshot(fullSize: wantFull)
+            sem.signal()
+        }
+        sem.wait()
+
+        guard let data = jpegData else {
+            let resp = Data("HTTP/1.1 503 Service Unavailable\r\nContent-Length: 0\r\n\r\n".utf8)
+            resp.withUnsafeBytes { write(fd, $0.baseAddress!, resp.count) }
+            close(fd)
+            return
+        }
+
+        var response = Data("HTTP/1.1 200 OK\r\nContent-Type: image/jpeg\r\nContent-Length: \(data.count)\r\nConnection: close\r\n\r\n".utf8)
+        response.append(data)
+        response.withUnsafeBytes { ptr in
+            var total = 0
+            while total < response.count {
+                let n = write(fd, ptr.baseAddress! + total, response.count - total)
+                if n <= 0 { break }
+                total += n
+            }
+        }
+        close(fd)
+        log("screenshot: served \(data.count) bytes")
+    }
+
+    private func captureScreenshot(fullSize: Bool = false) -> Data? {
+        guard let window = view.window else {
+            log("screenshot: no window")
+            return nil
+        }
+
+        // Use CGWindowListCreateImage to capture the composited window content,
+        // which includes GPU-rendered layers like VZVirtualMachineView's Metal surface.
+        let windowID = CGWindowID(window.windowNumber)
+        guard let cgImage = CGWindowListCreateImage(
+            .null,
+            .optionIncludingWindow,
+            windowID,
+            [.boundsIgnoreFraming, .bestResolution]
+        ) else {
+            log("screenshot: CGWindowListCreateImage returned nil")
+            return nil
+        }
+
+        if fullSize {
+            let bitmapRep = NSBitmapImageRep(cgImage: cgImage)
+            return bitmapRep.representation(using: .jpeg, properties: [.compressionFactor: 0.85])
+        }
+
+        // Resize to ~800px wide for thumbnails.
+        let targetWidth = 800
+        let scale = Double(targetWidth) / Double(cgImage.width)
+        let targetHeight = Int(Double(cgImage.height) * scale)
+
+        guard let ctx = CGContext(
+            data: nil,
+            width: targetWidth,
+            height: targetHeight,
+            bitsPerComponent: 8,
+            bytesPerRow: 0,
+            space: CGColorSpaceCreateDeviceRGB(),
+            bitmapInfo: CGImageAlphaInfo.premultipliedFirst.rawValue
+        ) else {
+            log("screenshot: CGContext creation failed")
+            return nil
+        }
+        ctx.interpolationQuality = .high
+        ctx.draw(cgImage, in: CGRect(x: 0, y: 0, width: targetWidth, height: targetHeight))
+
+        guard let resized = ctx.makeImage() else {
+            log("screenshot: makeImage failed")
+            return nil
+        }
+
+        let bitmapRep = NSBitmapImageRep(cgImage: resized)
+        return bitmapRep.representation(using: .jpeg, properties: [.compressionFactor: 0.6])
+    }
+}
+
diff --git a/tstest/tailmac/Swift/Host/VMController.swift b/tstest/tailmac/Swift/Host/VMController.swift
index a19d7222e..c2014009a 100644
--- a/tstest/tailmac/Swift/Host/VMController.swift
+++ b/tstest/tailmac/Swift/Host/VMController.swift
@@ -81,7 +81,7 @@ class VMController: NSObject, VZVirtualMachineDelegate {
         return macPlatform
     }
 
-    func createVirtualMachine() {
+    func createVirtualMachine(headless: Bool = false, disconnectedNIC: Bool = false, natNIC: Bool = false) {
         let virtualMachineConfiguration = VZVirtualMachineConfiguration()
 
         virtualMachineConfiguration.platform = createMacPlaform()
@@ -90,7 +90,21 @@ class VMController: NSObject, VZVirtualMachineDelegate {
         virtualMachineConfiguration.memorySize = helper.computeMemorySize()
         virtualMachineConfiguration.graphicsDevices = [helper.createGraphicsDeviceConfiguration()]
         virtualMachineConfiguration.storageDevices = [helper.createBlockDeviceConfiguration()]
-        virtualMachineConfiguration.networkDevices = [helper.createNetworkDeviceConfiguration(), helper.createSocketNetworkDeviceConfiguration()]
+        if headless {
+            if natNIC {
+                // NAT NIC for SSH access during snapshot preparation.
+                virtualMachineConfiguration.networkDevices = [helper.createNetworkDeviceConfiguration()]
+            } else if disconnectedNIC {
+                // Create a NIC with no attachment. The NIC exists in the hardware
+                // config (so saved state is compatible) but appears disconnected.
+                // Call attachNetwork() after restore to hot-swap the attachment.
+                virtualMachineConfiguration.networkDevices = [helper.createDisconnectedNetworkDeviceConfiguration()]
+            } else {
+                virtualMachineConfiguration.networkDevices = [helper.createSocketNetworkDeviceConfiguration()]
+            }
+        } else {
+            virtualMachineConfiguration.networkDevices = [helper.createNetworkDeviceConfiguration(), helper.createSocketNetworkDeviceConfiguration()]
+        }
         virtualMachineConfiguration.pointingDevices = [helper.createPointingDeviceConfiguration()]
         virtualMachineConfiguration.keyboards = [helper.createKeyboardConfiguration()]
         virtualMachineConfiguration.socketDevices = [helper.createSocketDeviceConfiguration()]
@@ -109,6 +123,33 @@ class VMController: NSObject, VZVirtualMachineDelegate {
         virtualMachine.delegate = self
     }
 
+    /// Disconnect the NIC by setting its attachment to nil.
+    /// Call before saving state so the snapshot has no active link.
+    func disconnectNetwork() {
+        guard let nic = virtualMachine.networkDevices.first else {
+            print("disconnectNetwork: no network devices")
+            return
+        }
+        nic.attachment = nil
+        print("disconnectNetwork: NIC attachment set to nil")
+    }
+
+    /// Hot-swap the NIC attachment on a running VM. The VM must have been
+    /// created with disconnectedNIC=true. After calling this, the guest
+    /// sees the link come up and does DHCP.
+    func attachNetwork(serverSocket: String, clientID: String) {
+        guard let nic = virtualMachine.networkDevices.first else {
+            print("attachNetwork: no network devices")
+            return
+        }
+        guard let attachment = helper.createDgramAttachment(serverSocket: serverSocket, clientID: clientID) else {
+            print("attachNetwork: failed to create attachment")
+            return
+        }
+        nic.attachment = attachment
+        print("attachNetwork: NIC attachment swapped to \(serverSocket)")
+    }
+
 
     func startVirtualMachine() {
         virtualMachine.start(completionHandler: { (result) in
@@ -130,6 +171,21 @@ class VMController: NSObject, VZVirtualMachineDelegate {
         }
     }
 
+    /// Start a vsock listener that tells the guest TTA agent what IP to configure.
+    /// If response is nil, the listener replies "wait" (snapshot prep mode).
+    func startIPConfigListener(response: String) {
+        guard let device = virtualMachine.socketDevices.first as? VZVirtioSocketDevice else {
+            print("startIPConfigListener: no socket device")
+            return
+        }
+        let listener = IPConfigListener(response: response)
+        retainedIPConfigListener = listener
+        let vsockListener = VZVirtioSocketListener()
+        vsockListener.delegate = listener
+        device.setSocketListener(vsockListener, forPort: 51011)
+        print("startIPConfigListener: listening on vsock port 51011")
+    }
+
     func resumeVirtualMachine() {
         virtualMachine.resume(completionHandler: { (result) in
             if case let .failure(error) = result {
@@ -184,3 +240,28 @@ class VMController: NSObject, VZVirtualMachineDelegate {
         exit(0)
     }
 }
+
+// Global to prevent ARC deallocation of the vsock listener.
+var retainedIPConfigListener: IPConfigListener?
+
+/// Listens on vsock port 51011 for TTA connections and replies with
+/// an IP configuration JSON string (or "wait" during snapshot prep).
+class IPConfigListener: NSObject, VZVirtioSocketListenerDelegate {
+    let response: String
+
+    init(response: String) {
+        self.response = response
+    }
+
+    func listener(_ listener: VZVirtioSocketListener,
+                  shouldAcceptNewConnection connection: VZVirtioSocketConnection,
+                  from socketDevice: VZVirtioSocketDevice) -> Bool {
+        let fd = connection.fileDescriptor
+        let data = Array((response + "\n").utf8)
+        data.withUnsafeBufferPointer { buf in
+            _ = write(fd, buf.baseAddress!, buf.count)
+        }
+        connection.close()
+        return true
+    }
+}
diff --git a/tstest/tailmac/Swift/TailMac/TailMac.swift b/tstest/tailmac/Swift/TailMac/TailMac.swift
index 3859b9b0b..2271d3bb2 100644
--- a/tstest/tailmac/Swift/TailMac/TailMac.swift
+++ b/tstest/tailmac/Swift/TailMac/TailMac.swift
@@ -329,7 +329,7 @@ extension Tailmac {
                 }
             }
 
-            dispatchMain()
+            RunLoop.main.run()
         }
     }
 }
diff --git a/tstest/tstest.go b/tstest/tstest.go
index 4e00fbaa3..10316e4a5 100644
--- a/tstest/tstest.go
+++ b/tstest/tstest.go
@@ -2,27 +2,42 @@
 // SPDX-License-Identifier: BSD-3-Clause
 
 // Package tstest provides utilities for use in unit tests.
+//
+// It intentionally does not depend on the "testing" package (using
+// [testenv.TB] instead of testing.TB) so that importing it from
+// non-test code doesn't link the testing package and its flag
+// registration side effects into the binary.
 package tstest
 
 import (
 	"context"
 	"fmt"
 	"os"
-	"strconv"
-	"strings"
-	"sync/atomic"
-	"testing"
 	"time"
 
 	"tailscale.com/envknob"
 	"tailscale.com/types/logger"
 	"tailscale.com/util/backoff"
-	"tailscale.com/util/cibuild"
+	"tailscale.com/util/testenv"
 )
 
+// AssertNotParallel asserts that t has not been marked as parallel.
+// It panics (via t.Setenv) if t.Parallel has already been called.
+//
+// Use this when a test modifies package-level globals or other shared
+// state that would be unsafe to modify concurrently with other tests.
+func AssertNotParallel(t testenv.TB) {
+	t.Helper()
+	t.Setenv("ASSERT_NOT_PARALLEL_TEST", "1") // panics if t.Parallel was called
+}
+
 // Replace replaces the value of target with val.
 // The old value is restored when the test ends.
-func Replace[T any](t testing.TB, target *T, val T) {
+//
+// When target is a package-level variable, the caller should also call
+// [AssertNotParallel] to ensure the test is not running in parallel with
+// other tests that may access the same variable.
+func Replace[T any](t testenv.TB, target *T, val T) {
 	t.Helper()
 	if target == nil {
 		t.Fatalf("Replace: nil pointer")
@@ -34,7 +49,6 @@ func Replace[T any](t testing.TB, target *T, val T) {
 	})
 
 	*target = val
-	return
 }
 
 // WaitFor retries try for up to maxWait.
@@ -54,50 +68,26 @@ func WaitFor(maxWait time.Duration, try func() error) error {
 	return err
 }
 
-var testNum atomic.Int32
-
-// Shard skips t if it's not running if the TS_TEST_SHARD test shard is set to
-// "n/m" and this test execution number in the process mod m is not equal to n-1.
-// That is, to run with 4 shards, set TS_TEST_SHARD=1/4, ..., TS_TEST_SHARD=4/4
-// for the four jobs.
-func Shard(t testing.TB) {
-	e := os.Getenv("TS_TEST_SHARD")
-	a, b, ok := strings.Cut(e, "/")
-	if !ok {
-		return
-	}
-	wantShard, _ := strconv.ParseInt(a, 10, 32)
-	shards, _ := strconv.ParseInt(b, 10, 32)
-	if wantShard == 0 || shards == 0 {
-		return
-	}
-
-	shard := ((testNum.Add(1) - 1) % int32(shards)) + 1
-	if shard != int32(wantShard) {
-		t.Skipf("skipping shard %d/%d (process has TS_TEST_SHARD=%q)", shard, shards, e)
-	}
-}
-
-// SkipOnUnshardedCI skips t if we're in CI and the TS_TEST_SHARD
-// environment variable isn't set.
-func SkipOnUnshardedCI(t testing.TB) {
-	if cibuild.On() && os.Getenv("TS_TEST_SHARD") == "" {
-		t.Skip("skipping on CI without TS_TEST_SHARD")
-	}
-}
-
 var serializeParallel = envknob.RegisterBool("TS_SERIAL_TESTS")
 
 // Parallel calls t.Parallel, unless TS_SERIAL_TESTS is set true.
-func Parallel(t *testing.T) {
+func Parallel(t interface{ Parallel() }) {
 	if !serializeParallel() {
 		t.Parallel()
 	}
 }
 
+// RequireRoot skips the test if the current user is not root.
+func RequireRoot(tb testenv.TB) {
+	tb.Helper()
+	if os.Getuid() != 0 {
+		tb.Skip("skipping test; requires root")
+	}
+}
+
 // SkipOnKernelVersions skips the test if the current
 // kernel version is in the specified list.
-func SkipOnKernelVersions(t testing.TB, issue string, versions ...string) {
+func SkipOnKernelVersions(t testenv.TB, issue string, versions ...string) {
 	major, minor, patch := KernelVersion()
 	if major == 0 && minor == 0 && patch == 0 {
 		t.Logf("could not determine kernel version")
diff --git a/tstest/tstest_test.go b/tstest/tstest_test.go
index 0c281d235..e0e7b2e54 100644
--- a/tstest/tstest_test.go
+++ b/tstest/tstest_test.go
@@ -6,8 +6,18 @@ package tstest
 import (
 	"runtime"
 	"testing"
+
+	"tailscale.com/tstest/deptest"
 )
 
+func TestDeps(t *testing.T) {
+	deptest.DepChecker{
+		BadDeps: map[string]string{
+			"testing": "do not link the testing package and its flag side effects into non-test binaries; use testenv.TB",
+		},
+	}.Check(t)
+}
+
 func TestReplace(t *testing.T) {
 	before := "before"
 	done := false
diff --git a/tstime/format.go b/tstime/format.go
new file mode 100644
index 000000000..dd1a956d7
--- /dev/null
+++ b/tstime/format.go
@@ -0,0 +1,26 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package tstime
+
+import "time"
+
+// These are additional layouts for use in [time.Format] and [time.Parse].
+// For additional details, see [time.Layout].
+const (
+	// time.RFC3339 = "2006-01-02T15:04:05Z07:00"
+	DateTTimeMilliZ = "2006-01-02T15:04:05.000Z07:00" // RFC3339 with fixed milliseconds
+
+	// time.DateTime = "2006-01-02 15:04:05"
+	DateSpTimeZ      = time.DateTime + "Z07:00" // RFC3339 with space instead of 'T'
+	DateSpTimeMilliZ = time.DateTime + ".999Z07:00"
+	DateSpTimeNanoZ  = time.DateTime + ".999999999Z07:00"
+
+	// ISO8601 basic format: without punctuation
+	BasicDateTTime  = "20060102T150405"
+	BasicDateTTimeZ = "20060102T150405Z07:00"
+
+	// ISO8601 numeric format: removed in 2019
+	NumericDateTime  = "20060102150405"
+	NumericDateTimeZ = "20060102150405Z07:00"
+)
diff --git a/tsweb/request_id.go b/tsweb/request_id.go
index 351ed1710..c32c3d9bb 100644
--- a/tsweb/request_id.go
+++ b/tsweb/request_id.go
@@ -8,6 +8,7 @@ import (
 	"net/http"
 	"time"
 
+	"tailscale.com/tstime"
 	"tailscale.com/util/ctxkey"
 	"tailscale.com/util/rands"
 )
@@ -47,7 +48,7 @@ func GenerateRequestID() RequestID {
 	// Now we return "REQ-2" version, where the "2" doubles as the year 2YYY
 	// in a leading date.
 	now := time.Now().UTC()
-	return RequestID("REQ-" + now.Format("20060102150405") + rands.HexString(16))
+	return RequestID("REQ-" + now.Format(tstime.NumericDateTime) + rands.HexString(16))
 }
 
 // SetRequestID is an HTTP middleware that injects a RequestID in the
diff --git a/tsweb/tsweb.go b/tsweb/tsweb.go
index 101512b89..c635809b2 100644
--- a/tsweb/tsweb.go
+++ b/tsweb/tsweb.go
@@ -74,7 +74,7 @@ func parseTrustedCIDRs(raw string) []netip.Prefix {
 		return nil
 	}
 	var prefixes []netip.Prefix
-	for _, s := range strings.Split(raw, ",") {
+	for s := range strings.SplitSeq(raw, ",") {
 		s = strings.TrimSpace(s)
 		if s == "" {
 			continue
@@ -784,6 +784,12 @@ func (h errorHandler) handleError(w http.ResponseWriter, r *http.Request, lw *lo
 	// Extract a presentable, loggable error.
 	var hOK bool
 	hErr, hAsOK := errors.AsType[HTTPError](err)
+	if !hAsOK {
+		if hs, ok := errors.AsType[HTTPStatuser](err); ok {
+			hErr = hs.HTTPStatus()
+			hAsOK = true
+		}
+	}
 	if hAsOK {
 		hOK = true
 		if hErr.Code == 0 {
@@ -919,6 +925,15 @@ func WriteHTTPError(w http.ResponseWriter, r *http.Request, e HTTPError) {
 	}
 }
 
+// HTTPStatuser is an optional interface implemented by errors that
+// carry an intended HTTP response. Handlers translating errors to
+// HTTP should honour the returned HTTPError rather than defaulting to
+// 500.
+type HTTPStatuser interface {
+	error
+	HTTPStatus() HTTPError
+}
+
 // HTTPError is an error with embedded HTTP response information.
 //
 // It is the error type to be (optionally) used by Handler.ServeHTTPReturn.
diff --git a/tsweb/varz/varz.go b/tsweb/varz/varz.go
index 0df6e5775..0e2721ebb 100644
--- a/tsweb/varz/varz.go
+++ b/tsweb/varz/varz.go
@@ -42,8 +42,34 @@ func init() {
 	expvar.Publish("go_version", StaticStringVar(runtime.Version()))
 	expvar.Publish("counter_uptime_sec", expvar.Func(func() any { return int64(Uptime().Seconds()) }))
 	expvar.Publish("gauge_goroutines", expvar.Func(func() any { return runtime.NumGoroutine() }))
+	if v := nodeBootTime(); v != 0 {
+		var vi any = v // box once
+		// The name matches what Prometheus's node exporter uses
+		// for the same value.
+		expvar.Publish("node_boot_time_seconds", expvar.Func(func() any { return vi }))
+	}
 }
 
+// nodeBootTime returns the machine's boot time in Unix seconds,
+// as reported by the "btime" line of Linux's /proc/stat.
+// It returns 0 if unavailable, such as on non-Linux systems.
+var nodeBootTime = sync.OnceValue(func() int64 {
+	stat, err := os.ReadFile("/proc/stat")
+	if err != nil {
+		return 0
+	}
+	for line := range strings.Lines(string(stat)) {
+		if rest, ok := strings.CutPrefix(line, "btime "); ok {
+			sec, err := strconv.ParseInt(strings.TrimSpace(rest), 10, 64)
+			if err != nil {
+				return 0
+			}
+			return sec
+		}
+	}
+	return 0
+})
+
 const (
 	gaugePrefix     = "gauge_"
 	counterPrefix   = "counter_"
diff --git a/tsweb/varz/varz_test.go b/tsweb/varz/varz_test.go
index d041edb4b..27094e77b 100644
--- a/tsweb/varz/varz_test.go
+++ b/tsweb/varz/varz_test.go
@@ -205,7 +205,7 @@ func TestVarzHandler(t *testing.T) {
 			"string_map",
 			func() *expvar.Map {
 				m := new(expvar.Map)
-				m.Set("a", expvar.NewString("foo"))
+				m.Set("a", new(expvar.String))
 				return m
 			}(),
 			"# skipping \"string_map\" expvar map key \"a\" with unknown value type *expvar.String\n",
diff --git a/types/appctype/appconnector.go b/types/appctype/appconnector.go
index b0fd5e65a..6be5d51b5 100644
--- a/types/appctype/appconnector.go
+++ b/types/appctype/appconnector.go
@@ -7,9 +7,11 @@ package appctype
 
 import (
 	"net/netip"
+	"time"
 
 	"go4.org/netipx"
 	"tailscale.com/tailcfg"
+	"tailscale.com/util/dnsname"
 )
 
 // ConfigID is an opaque identifier for a configuration.
@@ -104,9 +106,90 @@ type Conn25Attr struct {
 	// Connectors enumerates the app connectors which service these domains.
 	// These can either be "*" to match any advertising connector, or a
 	// tag of the form tag:<tag-name>.
-	Connectors      []string         `json:"connectors,omitempty"`
+	Connectors []string `json:"connectors,omitempty"`
+}
+
+type Conn25PoolsAttr struct {
 	V4MagicIPPool   []netipx.IPRange `json:"v4MagicIPPool,omitempty"`
 	V4TransitIPPool []netipx.IPRange `json:"v4TransitIPPool,omitempty"`
 	V6MagicIPPool   []netipx.IPRange `json:"v6MagicIPPool,omitempty"`
 	V6TransitIPPool []netipx.IPRange `json:"v6TransitIPPool,omitempty"`
 }
+
+// Conn25ActiveState holds the active client and connector state.
+type Conn25ActiveState struct {
+	Configured bool                 `json:"configured"`
+	Client     Conn25ClientState    `json:"client,omitzero"`
+	Connector  Conn25ConnectorState `json:"connector,omitzero"`
+}
+
+// Conn25ClientState holds the active client state.
+type Conn25ClientState struct {
+	Apps        []Conn25ClientAppState  `json:"apps,omitempty"`
+	IPPoolStats Conn25ClientIPPoolStats `json:"ipPoolStats,omitzero"`
+}
+
+// Conn25ClientIPPoolStats holds the in-use and total capacity counts for the
+// client's magic and transit IP pools, split by address family. If a count
+// exceeds [math.MaxInt64], that maximum is used instead.
+type Conn25ClientIPPoolStats struct {
+	IPv4MagicIPsInUse      int64 `json:"ipv4MagicIPsInUse"`
+	IPv4MagicIPsCapacity   int64 `json:"ipv4MagicIPsCapacity"`
+	IPv6MagicIPsInUse      int64 `json:"ipv6MagicIPsInUse"`
+	IPv6MagicIPsCapacity   int64 `json:"ipv6MagicIPsCapacity"`
+	IPv4TransitIPsInUse    int64 `json:"ipv4TransitIPsInUse"`
+	IPv4TransitIPsCapacity int64 `json:"ipv4TransitIPsCapacity"`
+	IPv6TransitIPsInUse    int64 `json:"ipv6TransitIPsInUse"`
+	IPv6TransitIPsCapacity int64 `json:"ipv6TransitIPsCapacity"`
+}
+
+// Conn25ClientAppState holds the active client state for a single app,
+// grouped by domain.
+type Conn25ClientAppState struct {
+	App     string                    `json:"app,omitempty"`
+	Domains []Conn25ClientDomainState `json:"domains,omitempty"`
+}
+
+// Conn25ClientDomainState holds the address mappings the client has allocated
+// for a single domain.
+type Conn25ClientDomainState struct {
+	Domain    dnsname.FQDN               `json:"domain"`
+	Addresses []Conn25ClientAddressState `json:"addresses,omitempty"`
+}
+
+// Conn25ClientAddressState describes a single address mapping the client has
+// allocated: the destination it resolves to, the magic and transit IPs handed
+// out for it, its active flow count, and when the mapping expires.
+type Conn25ClientAddressState struct {
+	ActiveFlowCount int       `json:"activeFlowCount"`
+	DestinationIP   string    `json:"destinationIP,omitempty"`
+	MagicIP         string    `json:"magicIP,omitempty"`
+	TransitIP       string    `json:"transitIP,omitempty"`
+	ExpiresAt       time.Time `json:"expiresAt,omitzero"`
+}
+
+// Conn25ConnectorState holds the active connector state.
+type Conn25ConnectorState struct {
+	Peers []Conn25ConnectorPeerState `json:"peers,omitempty"`
+}
+
+// Conn25ConnectorPeerState holds the active connector state for a single peer
+// (client) that has registered addresses with the connector, grouped by app.
+type Conn25ConnectorPeerState struct {
+	ClientIP string                    `json:"clientIP,omitempty"`
+	Apps     []Conn25ConnectorAppState `json:"apps,omitempty"`
+}
+
+// Conn25ConnectorAppState holds the address mappings a peer has registered
+// with the connector for a single app.
+type Conn25ConnectorAppState struct {
+	App       string                        `json:"app,omitempty"`
+	Addresses []Conn25ConnectorAddressState `json:"addresses,omitempty"`
+}
+
+// Conn25ConnectorAddressState describes a single transit-to-destination IP
+// mapping the connector routes on behalf of a peer.
+type Conn25ConnectorAddressState struct {
+	DestinationIP string `json:"destinationIP,omitempty"`
+	TransitIP     string `json:"transitIP,omitempty"`
+}
diff --git a/types/geo/point.go b/types/geo/point.go
index d039ea1fa..b4a7a384b 100644
--- a/types/geo/point.go
+++ b/types/geo/point.go
@@ -166,7 +166,7 @@ func (p Point) AppendBinary(b []byte) ([]byte, error) {
 	return b, nil
 }
 
-// MarshalBinary implements [encoding.BinaryMarshaller]. The output matches that
+// MarshalBinary implements [encoding.BinaryMarshaler]. The output matches that
 // of calling [Point.AppendBinary].
 func (p Point) MarshalBinary() ([]byte, error) {
 	var b [8]byte
@@ -223,25 +223,43 @@ func (p Point) AppendText(b []byte) ([]byte, error) {
 	return b, nil
 }
 
-// MarshalText implements [encoding.TextMarshaller]. The output matches that
+// MarshalText implements [encoding.TextMarshaler]. The output matches that
 // of calling [Point.AppendText].
 func (p Point) MarshalText() ([]byte, error) {
 	var b [8]byte
 	return p.AppendText(b[:0])
 }
 
-// MarshalUint64 produces the same output as MashalBinary, encoded in a uint64.
-func (p Point) MarshalUint64() (uint64, error) {
+// MarshalScalar implements [encoding.ScalarMarshaler].
+// It produces the same output as MashalBinary, encoded in a uint64.
+func (p Point) MarshalScalar() (uint64, error) {
 	b, err := p.MarshalBinary()
 	return binary.NativeEndian.Uint64(b), err
 }
 
-// UnmarshalUint64 expects input formatted by MarshalUint64.
-func (p *Point) UnmarshalUint64(v uint64) error {
+// UnmarshalScalar implements [encoding.ScalarUnmarshaler].
+// It expects input formatted by MarshalScalar.
+func (p *Point) UnmarshalScalar(v uint64) error {
 	b := binary.NativeEndian.AppendUint64(nil, v)
 	return p.UnmarshalBinary(b)
 }
 
+// MarshalUint64 produces the same output as MashalBinary, encoded in a uint64.
+// Deprecated: this function simply calls [Point.MarshalScalar].
+//
+//go:fix inline
+func (p Point) MarshalUint64() (uint64, error) {
+	return p.MarshalScalar()
+}
+
+// UnmarshalUint64 expects input formatted by MarshalUint64.
+// Deprecated: this function simply calls [Point.UnmarshalScalar].
+//
+//go:fix inline
+func (p *Point) UnmarshalUint64(v uint64) error {
+	return p.UnmarshalScalar(v)
+}
+
 // IsZero reports if p is the zero value.
 func (p Point) IsZero() bool {
 	return p == Point{}
diff --git a/types/geo/point_test.go b/types/geo/point_test.go
index 32a73180a..fceb740ec 100644
--- a/types/geo/point_test.go
+++ b/types/geo/point_test.go
@@ -41,7 +41,7 @@ func TestPointZero(t *testing.T) {
 	}
 
 	wantI := uint64(0x00000000)
-	if i, err := zero.MarshalUint64(); err != nil {
+	if i, err := zero.MarshalScalar(); err != nil {
 		t.Errorf("MarshalUint64() err %q, want nil", err)
 	} else if i != wantI {
 		t.Errorf("MarshalUint64 got %v, want %v", i, wantI)
@@ -358,13 +358,13 @@ func TestPoint(t *testing.T) {
 				t.Errorf("UnmarshalBinary: roundtrip failed: %#v != %#v", q, p)
 			}
 
-			i, err := p.MarshalUint64()
+			i, err := p.MarshalScalar()
 			if err != nil {
 				t.Fatalf("MarshalUint64: err %q, expected nil", err)
 			}
 
 			var r geo.Point
-			if err := r.UnmarshalUint64(i); err != nil {
+			if err := r.UnmarshalScalar(i); err != nil {
 				t.Fatalf("UnmarshalUint64: err %r, expected nil", err)
 			}
 			if !q.EqualApprox(r, -1) {
@@ -414,12 +414,12 @@ func TestPointMarshalBinary(t *testing.T) {
 func TestPointMarshalUint64(t *testing.T) {
 	t.Skip("skip")
 	roundtrip := func(p geo.Point) error {
-		i, err := p.MarshalUint64()
+		i, err := p.MarshalScalar()
 		if err != nil {
 			return fmt.Errorf("marshal: %v", err)
 		}
 		var q geo.Point
-		if err := q.UnmarshalUint64(i); err != nil {
+		if err := q.UnmarshalScalar(i); err != nil {
 			return fmt.Errorf("unmarshal: %v", err)
 		}
 		if q != p {
diff --git a/types/key/machine.go b/types/key/machine.go
index 9ad73bec1..d20f62643 100644
--- a/types/key/machine.go
+++ b/types/key/machine.go
@@ -167,7 +167,7 @@ func (k MachinePrivate) OpenFrom(p MachinePublic, ciphertext []byte) (cleartext
 	return box.Open(nil, ciphertext[len(nonce):], &nonce, &p.k, &k.k)
 }
 
-// MachinePublic is the public portion of a a MachinePrivate.
+// MachinePublic is the public portion of a MachinePrivate.
 type MachinePublic struct {
 	k [32]byte
 }
diff --git a/types/key/nl.go b/types/key/nl.go
index 0e8c5ed96..0c1b48f49 100644
--- a/types/key/nl.go
+++ b/types/key/nl.go
@@ -29,7 +29,7 @@ const (
 	nlPublicHexPrefixCLI = "tlpub:"
 )
 
-// NLPrivate is a node-managed network-lock key, used for signing
+// NLPrivate is a node-managed tailnet-lock key, used for signing
 // node-key signatures and authority update messages.
 type NLPrivate struct {
 	_ structs.Incomparable // because == isn't constant-time
@@ -42,7 +42,7 @@ func (k NLPrivate) IsZero() bool {
 	return subtle.ConstantTimeCompare(k.k[:], empty.k[:]) == 1
 }
 
-// NewNLPrivate creates and returns a new network-lock key.
+// NewNLPrivate creates and returns a new tailnet-lock key.
 func NewNLPrivate() NLPrivate {
 	// ed25519.GenerateKey 'clamps' the key, not that it
 	// matters given we don't do Diffie-Hellman.
@@ -111,7 +111,7 @@ func (k NLPrivate) SignNKS(sigHash tkatype.NKSSigHash) ([]byte, error) {
 	return ed25519.Sign(ed25519.PrivateKey(k.k[:]), sigHash[:]), nil
 }
 
-// NLPublic is the public portion of a a NLPrivate.
+// NLPublic is the public portion of a NLPrivate.
 type NLPublic struct {
 	k [ed25519.PublicKeySize]byte
 }
@@ -120,7 +120,7 @@ type NLPublic struct {
 // a type of NLPublic.
 //
 // New uses of this function should be avoided, as it's possible to
-// accidentally construct an NLPublic from a non network-lock key.
+// accidentally construct an NLPublic from a non tailnet-lock key.
 func NLPublicFromEd25519Unsafe(public ed25519.PublicKey) NLPublic {
 	var out NLPublic
 	copy(out.k[:], public)
diff --git a/types/key/node.go b/types/key/node.go
index 98f72c719..a1d8e47ba 100644
--- a/types/key/node.go
+++ b/types/key/node.go
@@ -65,6 +65,11 @@ func NewNode() NodePrivate {
 // Raw32 returns k as 32 raw bytes.
 func (k NodePrivate) Raw32() [32]byte { return k.k }
 
+// NodePrivateAs returns a NodePrivate as a named fixed-size array of bytes.
+// It's intended for interoperability with wireguard-go's
+// device.NoisePrivateKey type.
+func NodePrivateAs[T ~[32]byte](k NodePrivate) T { return k.k }
+
 // NodePrivateFromRaw32 parses a 32-byte raw value as a NodePrivate.
 //
 // Deprecated: only needed to cast from legacy node private key types,
diff --git a/types/logger/logger.go b/types/logger/logger.go
index 71086e87d..e74cb8a65 100644
--- a/types/logger/logger.go
+++ b/types/logger/logger.go
@@ -21,6 +21,8 @@ import (
 
 	"context"
 
+	jsonv2 "github.com/go-json-experiment/json"
+	jsonv1 "github.com/go-json-experiment/json/v1"
 	"go4.org/mem"
 	"tailscale.com/envknob"
 	"tailscale.com/util/ctxkey"
@@ -141,6 +143,7 @@ var rateFree = []string{
 	"magicsock: disco: ",
 	"magicsock: ParseEndpoint:",
 	// grinder stats lines
+	"magicsock: new contact: ",
 	"SetPrefs: %v",
 	"peer keys: %s",
 	"v%v peers: %v",
@@ -378,12 +381,13 @@ func AsJSON(v any) fmt.Formatter {
 type asJSONResult struct{ v any }
 
 func (a asJSONResult) Format(s fmt.State, verb rune) {
-	v, err := json.Marshal(a.v)
+	// Write directly to s rather than going through json.Marshal's
+	// returned []byte to avoid an allocation. The explicit v1
+	// options keep the output identical to encoding/json.
+	err := jsonv2.MarshalWrite(s, a.v, jsonv1.DefaultOptionsV1())
 	if err != nil {
 		fmt.Fprintf(s, "%%!JSON-ERROR:%v", err)
-		return
 	}
-	s.Write(v)
 }
 
 // TestLogger returns a logger that logs to tb.Logf
diff --git a/types/logger/rusage.go b/types/logger/rusage.go
deleted file mode 100644
index c1bbbaa53..000000000
--- a/types/logger/rusage.go
+++ /dev/null
@@ -1,23 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-package logger
-
-import (
-	"fmt"
-	"runtime"
-)
-
-// RusagePrefixLog returns a Logf func wrapping the provided logf func that adds
-// a prefixed log message to each line with the current binary memory usage
-// and max RSS.
-func RusagePrefixLog(logf Logf) Logf {
-	return func(f string, argv ...any) {
-		var m runtime.MemStats
-		runtime.ReadMemStats(&m)
-		goMem := float64(m.HeapInuse+m.StackInuse) / (1 << 20)
-		maxRSS := rusageMaxRSS()
-		pf := fmt.Sprintf("%.1fM/%.1fM %s", goMem, maxRSS, f)
-		logf(pf, argv...)
-	}
-}
diff --git a/types/logger/rusage_stub.go b/types/logger/rusage_stub.go
deleted file mode 100644
index e94478ef7..000000000
--- a/types/logger/rusage_stub.go
+++ /dev/null
@@ -1,11 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-//go:build windows || wasm || plan9 || tamago
-
-package logger
-
-func rusageMaxRSS() float64 {
-	// TODO(apenwarr): Substitute Windows equivalent of Getrusage() here.
-	return 0
-}
diff --git a/types/logger/rusage_syscall.go b/types/logger/rusage_syscall.go
deleted file mode 100644
index 25b026994..000000000
--- a/types/logger/rusage_syscall.go
+++ /dev/null
@@ -1,29 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-//go:build !windows && !wasm && !plan9 && !tamago
-
-package logger
-
-import (
-	"runtime"
-
-	"golang.org/x/sys/unix"
-)
-
-func rusageMaxRSS() float64 {
-	var ru unix.Rusage
-	err := unix.Getrusage(unix.RUSAGE_SELF, &ru)
-	if err != nil {
-		return 0
-	}
-
-	rss := float64(ru.Maxrss)
-	if runtime.GOOS == "darwin" || runtime.GOOS == "ios" {
-		rss /= 1 << 20 // ru_maxrss is bytes on darwin
-	} else {
-		// ru_maxrss is kilobytes elsewhere (linux, openbsd, etc)
-		rss /= 1 << 10
-	}
-	return rss
-}
diff --git a/types/logger/tokenbucket.go b/types/logger/tokenbucket.go
index fdee56237..7f7d3f35a 100644
--- a/types/logger/tokenbucket.go
+++ b/types/logger/tokenbucket.go
@@ -43,12 +43,7 @@ func (tb *tokenBucket) Get() bool {
 }
 
 func (tb *tokenBucket) Refund(n int) {
-	b := tb.remaining + n
-	if b > tb.max {
-		tb.remaining = tb.max
-	} else {
-		tb.remaining = b
-	}
+	tb.remaining = min(tb.remaining+n, tb.max)
 }
 
 func (tb *tokenBucket) AdvanceTo(t time.Time) {
diff --git a/types/mapx/repopulate.go b/types/mapx/repopulate.go
new file mode 100644
index 000000000..a9e48638b
--- /dev/null
+++ b/types/mapx/repopulate.go
@@ -0,0 +1,28 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package mapx
+
+// RepopulateNonzero re-uses an existing map (preserving its allocated
+// buckets) by zeroing all values, calling populate to re-fill it, and
+// then deleting any entries still at their zero value. If *m is nil it
+// is lazily initialized.
+//
+// This avoids the allocation cost of creating a new map on every call,
+// which matters for maps that are rebuilt frequently (e.g. on every
+// netmap update).
+func RepopulateNonzero[K comparable, V comparable](m *map[K]V, populate func()) {
+	if *m == nil {
+		*m = make(map[K]V)
+	}
+	var zero V
+	for k := range *m {
+		(*m)[k] = zero
+	}
+	populate()
+	for k, v := range *m {
+		if v == zero {
+			delete(*m, k)
+		}
+	}
+}
diff --git a/types/mapx/repopulate_test.go b/types/mapx/repopulate_test.go
new file mode 100644
index 000000000..14134697e
--- /dev/null
+++ b/types/mapx/repopulate_test.go
@@ -0,0 +1,93 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package mapx
+
+import (
+	"fmt"
+	"testing"
+)
+
+func TestRepopulateNonzero(t *testing.T) {
+	var m map[string]int
+
+	// First call: nil map gets initialized and populated.
+	RepopulateNonzero(&m, func() {
+		m["a"] = 1
+		m["b"] = 2
+	})
+	if got, want := len(m), 2; got != want {
+		t.Fatalf("len = %d, want %d", got, want)
+	}
+	if m["a"] != 1 || m["b"] != 2 {
+		t.Fatalf("got %v, want map[a:1 b:2]", m)
+	}
+
+	// Second call: "b" is no longer populated, so it should be removed.
+	RepopulateNonzero(&m, func() {
+		m["a"] = 3
+		m["c"] = 4
+	})
+	if got, want := len(m), 2; got != want {
+		t.Fatalf("len = %d, want %d", got, want)
+	}
+	if m["a"] != 3 || m["c"] != 4 {
+		t.Fatalf("got %v, want map[a:3 c:4]", m)
+	}
+	if _, ok := m["b"]; ok {
+		t.Fatal("key 'b' should have been removed")
+	}
+
+	// Populating nothing should clear the map.
+	RepopulateNonzero(&m, func() {})
+	if got := len(m); got != 0 {
+		t.Fatalf("len = %d after empty populate, want 0", got)
+	}
+}
+
+func BenchmarkRepopulateNonzero(b *testing.B) {
+	for _, size := range []int{5, 100, 100_000} {
+		b.Run(fmt.Sprintf("size=%d", size), func(b *testing.B) {
+			b.Run("RepopulateNonzero", func(b *testing.B) {
+				var m map[string]int
+				keys := makeKeys(size)
+				// Seed the map so the first iteration isn't special.
+				RepopulateNonzero(&m, func() {
+					for i, k := range keys {
+						m[k] = i + 1
+					}
+				})
+				b.ResetTimer()
+				for range b.N {
+					RepopulateNonzero(&m, func() {
+						for i, k := range keys {
+							m[k] = i + 1
+						}
+					})
+				}
+			})
+			b.Run("clear", func(b *testing.B) {
+				m := make(map[string]int, size)
+				keys := makeKeys(size)
+				for i, k := range keys {
+					m[k] = i + 1
+				}
+				b.ResetTimer()
+				for range b.N {
+					m = make(map[string]int, size)
+					for i, k := range keys {
+						m[k] = i + 1
+					}
+				}
+			})
+		})
+	}
+}
+
+func makeKeys(n int) []string {
+	keys := make([]string, n)
+	for i := range keys {
+		keys[i] = fmt.Sprintf("key-%d", i)
+	}
+	return keys
+}
diff --git a/types/netmap/netmap.go b/types/netmap/netmap.go
index ac95254da..fbf415be0 100644
--- a/types/netmap/netmap.go
+++ b/types/netmap/netmap.go
@@ -146,6 +146,34 @@ func (nm *NetworkMap) GetIPVIPServiceMap() IPServiceMappings {
 	return res
 }
 
+// Services returns the Services visible (accessible) to this node,
+// decoded from [tailcfg.NodeAttrPrefixServices] entries in the self node's
+// CapMap. The returned map is keyed by [tailcfg.ServiceDetails.Name],
+// which is the canonical service name. It returns nil if nm is nil
+// or SelfNode is invalid.
+//
+// TODO(adrianosela): cache the result of decoding the capmap so
+// we don't have to decode it multiple times after each netmap update.
+func (nm *NetworkMap) Services() map[tailcfg.ServiceName]tailcfg.ServiceDetails {
+	if nm == nil || !nm.SelfNode.Valid() {
+		return nil
+	}
+	result := make(map[tailcfg.ServiceName]tailcfg.ServiceDetails)
+	for cap := range nm.SelfNode.CapMap().All() {
+		if !strings.HasPrefix(string(cap), string(tailcfg.NodeAttrPrefixServices)) {
+			continue
+		}
+		svcs, err := tailcfg.UnmarshalNodeCapViewJSON[tailcfg.ServiceDetails](nm.SelfNode.CapMap(), cap)
+		if err != nil || len(svcs) < 1 {
+			continue
+		}
+		// NOTE(adrianosela): the NodeCapMap key suffix is opaque and MUST not
+		// be parsed or relied upon (so we extract name from the inner field).
+		result[svcs[0].Name] = svcs[0]
+	}
+	return result
+}
+
 // SelfNodeOrZero returns the self node, or a zero value if nm is nil.
 func (nm *NetworkMap) SelfNodeOrZero() tailcfg.NodeView {
 	if nm == nil {
@@ -284,13 +312,6 @@ func (nm *NetworkMap) TailnetDisplayName() string {
 	return tailnetDisplayNames[0]
 }
 
-// HasSelfCapability reports whether nm.SelfNode contains capability c.
-//
-// It exists to satisify an unused (as of 2025-01-04) interface in the logknob package.
-func (nm *NetworkMap) HasSelfCapability(c tailcfg.NodeCapability) bool {
-	return nm.AllCaps.Contains(c)
-}
-
 func (nm *NetworkMap) String() string {
 	return nm.Concise()
 }
diff --git a/types/netmap/nodemut.go b/types/netmap/nodemut.go
index 901296b1f..3ea822b66 100644
--- a/types/netmap/nodemut.go
+++ b/types/netmap/nodemut.go
@@ -68,6 +68,34 @@ func (m NodeMutationLastSeen) Apply(n *tailcfg.Node) {
 	n.LastSeen = new(m.LastSeen)
 }
 
+// NodeMutationUpsert is a NodeMutation that says a peer's full Node value
+// should be inserted or replaced.
+//
+// Apply is a no-op: consumers of NodeMutationUpsert must type-switch to handle
+// upserts by storing Node in their peer map.
+type NodeMutationUpsert struct {
+	Node tailcfg.NodeView
+}
+
+func (m NodeMutationUpsert) NodeIDBeingMutated() tailcfg.NodeID { return m.Node.ID() }
+func (m NodeMutationUpsert) Apply(*tailcfg.Node)                {}
+
+// NodeMutationRemove is a NodeMutation that says a peer has been removed.
+// Apply is a no-op: consumers of NodeMutationRemove must type-switch to handle
+// removes by deleting the node from their peer map.
+type NodeMutationRemove struct {
+	mutatingNodeID
+}
+
+func (m NodeMutationRemove) Apply(*tailcfg.Node) {}
+
+// MakeNodeMutationRemove returns a NodeMutationRemove that targets nodeID.
+// It is the constructor for NodeMutationRemove for callers outside this
+// package, since the embedded ID field is unexported.
+func MakeNodeMutationRemove(nodeID tailcfg.NodeID) NodeMutationRemove {
+	return NodeMutationRemove{mutatingNodeID(nodeID)}
+}
+
 var peerChangeFields = sync.OnceValue(func() []reflect.StructField {
 	var fields []reflect.StructField
 	rt := reflect.TypeFor[tailcfg.PeerChange]()
@@ -110,8 +138,14 @@ func NodeMutationsFromPatch(p *tailcfg.PeerChange) (_ []NodeMutation, ok bool) {
 }
 
 // MutationsFromMapResponse returns all the discrete node mutations described
-// by res. It returns ok=false if res contains any non-patch field as defined
+// by res. It returns ok=false if res contains any non-delta field as defined
 // by mapResponseContainsNonPatchFields.
+//
+// Upserts and removes (from res.PeersChanged / res.PeersRemoved) are emitted
+// as NodeMutationUpsert / NodeMutationRemove entries. A PeersChanged entry can
+// be either a new peer or a full replacement for an existing peer that couldn't
+// be represented as PeerChangedPatch. Callers must type-switch to handle those
+// alongside field mutations.
 func MutationsFromMapResponse(res *tailcfg.MapResponse, now time.Time) (ret []NodeMutation, ok bool) {
 	if now.IsZero() {
 		now = time.Now()
@@ -119,8 +153,15 @@ func MutationsFromMapResponse(res *tailcfg.MapResponse, now time.Time) (ret []No
 	if mapResponseContainsNonPatchFields(res) {
 		return nil, false
 	}
-	// All that remains is PeersChangedPatch, OnlineChange, and LastSeenChange.
 
+	for _, id := range res.PeersRemoved {
+		ret = append(ret, NodeMutationRemove{mutatingNodeID(id)})
+	}
+	for _, n := range res.PeersChanged {
+		// Any n still in PeersChanged after patchifyPeersChanged is a
+		// truly-new (or replaced) peer.
+		ret = append(ret, NodeMutationUpsert{Node: n.View()})
+	}
 	for _, p := range res.PeersChangedPatch {
 		deltas, ok := NodeMutationsFromPatch(p)
 		if !ok {
@@ -142,25 +183,26 @@ func MutationsFromMapResponse(res *tailcfg.MapResponse, now time.Time) (ret []No
 	return ret, true
 }
 
-// mapResponseContainsNonPatchFields reports whether res contains only "patch"
-// fields set (PeersChangedPatch primarily, but also including the legacy
-// PeerSeenChange and OnlineChange fields).
+// mapResponseContainsNonPatchFields reports whether res contains any field
+// that can't be expressed as a per-peer NodeMutation (including the new
+// NodeMutationUpsert / NodeMutationRemove variants) or via the sibling narrow
+// setter methods on the map-session backend (e.g. UpdatePacketFilter).
 //
-// It ignores any of the meta fields that are handled by PollNetMap before the
-// peer change handling gets involved.
+// When this returns true, the caller must fall back to rebuilding and
+// dispatching a full NetworkMap. When it returns false, the response can be
+// handled incrementally.
 //
-// The purpose of this function is to ask whether this is a tricky enough
-// MapResponse to warrant a full netmap update. When this returns false, it
-// means the response can be handled incrementally, patching up the local state.
+// PeersChanged, PeersRemoved, and PacketFilter(s) are intentionally not in
+// this list: upserted/removed peers ride NodeMutationUpsert/Remove, packet
+// filter updates are delivered via the backend's UpdatePacketFilter
+// method, and UserProfile updates ride the backend's UpdateUserProfiles
+// method.
 func mapResponseContainsNonPatchFields(res *tailcfg.MapResponse) bool {
 	return res.Node != nil ||
 		res.DERPMap != nil ||
 		res.DNSConfig != nil ||
 		res.Domain != "" ||
 		res.CollectServices != "" ||
-		res.PacketFilter != nil ||
-		res.PacketFilters != nil ||
-		res.UserProfiles != nil ||
 		res.Health != nil ||
 		res.DisplayMessages != nil ||
 		res.SSHPolicy != nil ||
@@ -170,11 +212,5 @@ func mapResponseContainsNonPatchFields(res *tailcfg.MapResponse) bool {
 		res.ControlDialPlan != nil ||
 		res.ClientVersion != nil ||
 		res.Peers != nil ||
-		res.PeersRemoved != nil ||
-		// PeersChanged is too coarse to be considered a patch. Also, we convert
-		// PeersChanged to PeersChangedPatch in patchifyPeersChanged before this
-		// function is called, so it should never be set anyway. But for
-		// completedness, and for tests, check it too:
-		res.PeersChanged != nil ||
 		res.DeprecatedDefaultAutoUpdate != ""
 }
diff --git a/types/netmap/nodemut_test.go b/types/netmap/nodemut_test.go
index 1ae2ab1f9..406f494f9 100644
--- a/types/netmap/nodemut_test.go
+++ b/types/netmap/nodemut_test.go
@@ -52,7 +52,16 @@ func TestMapResponseContainsNonPatchFields(t *testing.T) {
 			// They should be ignored.
 			want = false
 		case "PeersChangedPatch", "PeerSeenChange", "OnlineChange":
-			// The actual three delta fields we care about handling.
+			// The three legacy delta fields handled via NodeMutation patches.
+			want = false
+		case "PeersChanged", "PeersRemoved":
+			// Now carried as NodeMutationUpsert / NodeMutationRemove entries.
+			want = false
+		case "PacketFilter", "PacketFilters":
+			// Now delivered separately via PacketFilterUpdater.
+			want = false
+		case "UserProfiles":
+			// Now delivered separately via UserProfileUpdater.
 			want = false
 		default:
 			// Everything else should be conseratively handled as a
@@ -175,6 +184,36 @@ func TestMutationsFromMapResponse(t *testing.T) {
 			},
 			want: nil,
 		},
+		{
+			name: "peer-removed",
+			mr: &tailcfg.MapResponse{
+				PeersRemoved: []tailcfg.NodeID{5},
+			},
+			want: muts(NodeMutationRemove{5}),
+		},
+		{
+			name: "peer-added",
+			mr: &tailcfg.MapResponse{
+				PeersChanged: []*tailcfg.Node{{ID: 7}},
+			},
+			want: muts(NodeMutationUpsert{Node: (&tailcfg.Node{ID: 7}).View()}),
+		},
+		{
+			name: "add-and-remove-mixed-with-patch",
+			mr: &tailcfg.MapResponse{
+				PeersRemoved: []tailcfg.NodeID{3},
+				PeersChanged: []*tailcfg.Node{{ID: 7}},
+				PeersChangedPatch: []*tailcfg.PeerChange{{
+					NodeID:     5,
+					DERPRegion: 2,
+				}},
+			},
+			want: muts(
+				NodeMutationRemove{3},
+				NodeMutationDERPHome{5, 2},
+				NodeMutationUpsert{Node: (&tailcfg.Node{ID: 7}).View()},
+			),
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -188,11 +227,13 @@ func TestMutationsFromMapResponse(t *testing.T) {
 			if diff := cmp.Diff(tt.want, got,
 				cmp.Comparer(func(a, b netip.Addr) bool { return a == b }),
 				cmp.Comparer(func(a, b netip.AddrPort) bool { return a == b }),
+				cmp.Comparer(func(a, b tailcfg.NodeView) bool { return a.ID() == b.ID() }),
 				cmp.AllowUnexported(
 					NodeMutationEndpoints{},
 					NodeMutationDERPHome{},
 					NodeMutationOnline{},
 					NodeMutationLastSeen{},
+					NodeMutationRemove{},
 				)); diff != "" {
 				t.Errorf("wrong result (-want +got):\n%s", diff)
 			}
diff --git a/types/opt/bool.go b/types/opt/bool.go
index cecbf5eac..35f598f0b 100644
--- a/types/opt/bool.go
+++ b/types/opt/bool.go
@@ -13,7 +13,7 @@ import (
 // is either "true", "false", or the empty string to mean unset.
 //
 // As a special case, the underlying string may also be the string
-// "unset" as as a synonym for the empty string. This lets the
+// "unset" as a synonym for the empty string. This lets the
 // explicit unset value be exchanged over an encoding/json "omitempty"
 // field without it being dropped.
 type Bool string
diff --git a/types/opt/value.go b/types/opt/value.go
index 1ccdd75a4..4acff5690 100644
--- a/types/opt/value.go
+++ b/types/opt/value.go
@@ -105,7 +105,11 @@ func (o Value[T]) MarshalJSONTo(enc *jsontext.Encoder) error {
 	if !o.set {
 		return enc.WriteToken(jsontext.Null)
 	}
-	return jsonv2.MarshalEncode(enc, &o.value)
+	// Pin v2 semantics so the wire format (e.g. nil slices as "[]",
+	// nil maps as "{}") stays the same even when this method is
+	// reached via encoding/json v1, which as of Go 1.27 dispatches
+	// here with v1 options that would otherwise leak into this call.
+	return jsonv2.MarshalEncode(enc, &o.value, jsonv2.DefaultOptionsV2())
 }
 
 // UnmarshalJSONFrom implements [jsonv2.UnmarshalerFrom].
@@ -116,7 +120,8 @@ func (o *Value[T]) UnmarshalJSONFrom(dec *jsontext.Decoder) error {
 		return err
 	}
 	o.set = true
-	return jsonv2.UnmarshalDecode(dec, &o.value)
+	// Pin v2 semantics; see MarshalJSONTo.
+	return jsonv2.UnmarshalDecode(dec, &o.value, jsonv2.DefaultOptionsV2())
 }
 
 // MarshalJSON implements [json.Marshaler].
diff --git a/types/persist/persist.go b/types/persist/persist.go
index 2a8c2fb82..b181655d6 100644
--- a/types/persist/persist.go
+++ b/types/persist/persist.go
@@ -24,12 +24,16 @@ type Persist struct {
 	PrivateNodeKey    key.NodePrivate
 	OldPrivateNodeKey key.NodePrivate // needed to request key rotation
 	UserProfile       tailcfg.UserProfile
-	NetworkLockKey    key.NLPrivate
-	NodeID            tailcfg.StableNodeID
-	AttestationKey    key.HardwareAttestationKey `json:",omitzero"`
+
+	// NetworkLockKey is the node's Tailnet Lock private key.
+	// "Network Lock" was the pre-release name for Tailnet Lock.
+	NetworkLockKey key.NLPrivate
+
+	NodeID         tailcfg.StableNodeID
+	AttestationKey key.HardwareAttestationKey `json:",omitzero"`
 
 	// DisallowedTKAStateIDs stores the tka.State.StateID values which
-	// this node will not operate network lock on. This is used to
+	// this node will not operate tailnet lock on. This is used to
 	// prevent bootstrapping TKA onto a key authority which was forcibly
 	// disabled.
 	DisallowedTKAStateIDs []string `json:",omitempty"`
diff --git a/types/persist/persist_view.go b/types/persist/persist_view.go
index f33d222c6..09afdf2cc 100644
--- a/types/persist/persist_view.go
+++ b/types/persist/persist_view.go
@@ -91,12 +91,15 @@ func (v PersistView) PrivateNodeKey() key.NodePrivate { return v.ж.PrivateNodeK
 // needed to request key rotation
 func (v PersistView) OldPrivateNodeKey() key.NodePrivate   { return v.ж.OldPrivateNodeKey }
 func (v PersistView) UserProfile() tailcfg.UserProfileView { return v.ж.UserProfile.View() }
+
+// NetworkLockKey is the node's Tailnet Lock private key.
+// "Network Lock" was the pre-release name for Tailnet Lock.
 func (v PersistView) NetworkLockKey() key.NLPrivate        { return v.ж.NetworkLockKey }
 func (v PersistView) NodeID() tailcfg.StableNodeID         { return v.ж.NodeID }
 func (v PersistView) AttestationKey() tailcfg.StableNodeID { panic("unsupported") }
 
 // DisallowedTKAStateIDs stores the tka.State.StateID values which
-// this node will not operate network lock on. This is used to
+// this node will not operate tailnet lock on. This is used to
 // prevent bootstrapping TKA onto a key authority which was forcibly
 // disabled.
 func (v PersistView) DisallowedTKAStateIDs() views.Slice[string] {
diff --git a/types/prefs/prefs.go b/types/prefs/prefs.go
index 3f18886a7..5b8eedbb8 100644
--- a/types/prefs/prefs.go
+++ b/types/prefs/prefs.go
@@ -52,7 +52,15 @@ type serializable[T any] struct {
 	// when the preference has not been configured.
 	Default T `json:",omitzero"`
 	// Metadata is any additional type-agnostic preference metadata to be serialized.
-	Metadata metadata `json:",inline"`
+	//
+	// The `inline` tag option was renamed to `embed` in Go 1.27's
+	// encoding/json/v2, but the pinned go-json-experiment module
+	// (used on older Go versions) only knows `inline`. Each
+	// implementation ignores the option it doesn't know, so specify
+	// both until we require Go 1.27 and drop `inline`.
+	//
+	//lint:ignore SA5008 staticcheck doesn't know Go 1.27's `embed` option yet
+	Metadata metadata `json:",inline,embed"`
 }
 
 // preference is an embeddable type that provides a common implementation for
@@ -165,12 +173,18 @@ var (
 
 // MarshalJSONTo implements [jsonv2.MarshalerTo].
 func (p preference[T]) MarshalJSONTo(out *jsontext.Encoder) error {
-	return jsonv2.MarshalEncode(out, &p.s)
+	// Pin v2 semantics so the wire format (notably the handling of
+	// the `inline` and `omitzero` tag options in [serializable])
+	// stays the same even when this method is reached via
+	// encoding/json v1, which as of Go 1.27 dispatches here with v1
+	// options that would otherwise leak into this call.
+	return jsonv2.MarshalEncode(out, &p.s, jsonv2.DefaultOptionsV2())
 }
 
 // UnmarshalJSONFrom implements [jsonv2.UnmarshalerFrom].
 func (p *preference[T]) UnmarshalJSONFrom(in *jsontext.Decoder) error {
-	return jsonv2.UnmarshalDecode(in, &p.s)
+	// Pin v2 semantics; see MarshalJSONTo.
+	return jsonv2.UnmarshalDecode(in, &p.s, jsonv2.DefaultOptionsV2())
 }
 
 // MarshalJSON implements [json.Marshaler].
diff --git a/types/prefs/prefs_example/prefs_example_clone.go b/types/prefs/prefs_example/prefs_example_clone.go
index c5fdc49fc..9d43fb250 100644
--- a/types/prefs/prefs_example/prefs_example_clone.go
+++ b/types/prefs/prefs_example/prefs_example_clone.go
@@ -61,7 +61,6 @@ var _PrefsCloneNeedsRegeneration = Prefs(struct {
 	PostureChecking        prefs.Item[bool]
 	NetfilterKind          prefs.Item[string]
 	DriveShares            prefs.StructList[*drive.Share]
-	AllowSingleHosts       prefs.Item[marshalAsTrueInJSON]
 	Persist                *persist.Persist
 }{})
 
diff --git a/types/prefs/prefs_example/prefs_example_view.go b/types/prefs/prefs_example/prefs_example_view.go
index 67a284bb5..aa71c1a89 100644
--- a/types/prefs/prefs_example/prefs_example_view.go
+++ b/types/prefs/prefs_example/prefs_example_view.go
@@ -145,7 +145,6 @@ func (v PrefsView) NetfilterKind() prefs.Item[string] { return v.ж.NetfilterKin
 func (v PrefsView) DriveShares() prefs.StructListView[*drive.Share, drive.ShareView] {
 	return prefs.StructListViewOf(&v.ж.DriveShares)
 }
-func (v PrefsView) AllowSingleHosts() prefs.Item[marshalAsTrueInJSON] { return v.ж.AllowSingleHosts }
 
 // Persist is an internal state rather than a preference.
 // It can be kept in the Prefs structure but should not be wrapped
@@ -182,7 +181,6 @@ var _PrefsViewNeedsRegeneration = Prefs(struct {
 	PostureChecking        prefs.Item[bool]
 	NetfilterKind          prefs.Item[string]
 	DriveShares            prefs.StructList[*drive.Share]
-	AllowSingleHosts       prefs.Item[marshalAsTrueInJSON]
 	Persist                *persist.Persist
 }{})
 
diff --git a/types/prefs/prefs_example/prefs_types.go b/types/prefs/prefs_example/prefs_types.go
index d0764c64b..e704e6bef 100644
--- a/types/prefs/prefs_example/prefs_types.go
+++ b/types/prefs/prefs_example/prefs_types.go
@@ -106,8 +106,7 @@ type Prefs struct {
 	// not be modified after the preference is set.
 	// Since the item type (*drive.Share) is mutable and implements [views.ViewCloner],
 	// we need to use [prefs.StructList] instead of [prefs.List].
-	DriveShares      prefs.StructList[*drive.Share]  `json:",omitzero"`
-	AllowSingleHosts prefs.Item[marshalAsTrueInJSON] `json:",omitzero"`
+	DriveShares prefs.StructList[*drive.Share] `json:",omitzero"`
 
 	// Persist is an internal state rather than a preference.
 	// It can be kept in the Prefs structure but should not be wrapped
@@ -162,10 +161,3 @@ func (p Prefs) MarshalJSON() ([]byte, error) {
 func (p *Prefs) UnmarshalJSON(b []byte) error {
 	return jsonv2.Unmarshal(b, p) // uses UnmarshalJSONFrom
 }
-
-type marshalAsTrueInJSON struct{}
-
-var trueJSON = []byte("true")
-
-func (marshalAsTrueInJSON) MarshalJSON() ([]byte, error) { return trueJSON, nil }
-func (*marshalAsTrueInJSON) UnmarshalJSON([]byte) error  { return nil }
diff --git a/update-flake.sh b/update-flake.sh
deleted file mode 100755
index c22572b86..000000000
--- a/update-flake.sh
+++ /dev/null
@@ -1,26 +0,0 @@
-#!/bin/sh
-# Updates SRI hashes for flake.nix.
-
-set -eu
-
-OUT=$(mktemp -d -t nar-hash-XXXXXX)
-rm -rf "$OUT"
-
-./tool/go mod vendor -o "$OUT"
-./tool/go run tailscale.com/cmd/nardump --sri "$OUT" >go.mod.sri
-rm -rf "$OUT"
-
-GOOUT=$(mktemp -d -t gocross-XXXXXX)
-GOREV=$(xargs < ./go.toolchain.rev)
-TARBALL="$GOOUT/go-$GOREV.tar.gz"
-curl -Ls -o "$TARBALL" "https://github.com/tailscale/go/archive/$GOREV.tar.gz"
-tar -xzf "$TARBALL" -C "$GOOUT"
-./tool/go run tailscale.com/cmd/nardump --sri "$GOOUT/go-$GOREV" > go.toolchain.rev.sri
-rm -rf "$GOOUT"
-
-# nix-direnv only watches the top-level nix file for changes. As a
-# result, when we change a referenced SRI file, we have to cause some
-# change to shell.nix and flake.nix as well, so that nix-direnv
-# notices and reevaluates everything. Sigh.
-perl -pi -e "s,# nix-direnv cache busting line:.*,# nix-direnv cache busting line: $(cat go.mod.sri)," shell.nix
-perl -pi -e "s,# nix-direnv cache busting line:.*,# nix-direnv cache busting line: $(cat go.mod.sri)," flake.nix
diff --git a/util/backoff/backoff.go b/util/backoff/backoff.go
index 2edb1e771..d49340b67 100644
--- a/util/backoff/backoff.go
+++ b/util/backoff/backoff.go
@@ -60,10 +60,7 @@ func (b *Backoff) BackOff(ctx context.Context, err error) {
 	b.n++
 	// n^2 backoff timer is a little smoother than the
 	// common choice of 2^n.
-	d := time.Duration(b.n*b.n) * 10 * time.Millisecond
-	if d > b.maxBackoff {
-		d = b.maxBackoff
-	}
+	d := min(time.Duration(b.n*b.n)*10*time.Millisecond, b.maxBackoff)
 	// Randomize the delay between 0.5-1.5 x msec, in order
 	// to prevent accidental "thundering herd" problems.
 	d = time.Duration(float64(d) * (rand.Float64() + 0.5))
diff --git a/util/cibuild/cibuild.go b/util/cibuild/cibuild.go
index 4a4e241ac..a821862b0 100644
--- a/util/cibuild/cibuild.go
+++ b/util/cibuild/cibuild.go
@@ -12,3 +12,15 @@ func On() bool {
 	// https://docs.github.com/en/actions/learn-github-actions/environment-variables#default-environment-variables
 	return os.Getenv("GITHUB_ACTIONS") != "" || os.Getenv("CI") == "true"
 }
+
+// OnTailscaleCI reports whether the current binary is executing on
+// tailscale/tailscale's own GitHub Actions CI, as opposed to a fork's CI
+// or an unrelated downstream CI (such as a Linux distribution's package
+// build infrastructure) that also sets the generic CI=true environment
+// variable.
+func OnTailscaleCI() bool {
+	// GITHUB_REPOSITORY_OWNER is set by GitHub Actions to the owner of
+	// the repository whose workflow is running. For pull requests, this
+	// is the base repository's owner, not the fork's.
+	return os.Getenv("GITHUB_REPOSITORY_OWNER") == "tailscale"
+}
diff --git a/util/clientmetric/clientmetric.go b/util/clientmetric/clientmetric.go
index b67cbbd39..98068b9fa 100644
--- a/util/clientmetric/clientmetric.go
+++ b/util/clientmetric/clientmetric.go
@@ -22,6 +22,7 @@ import (
 
 	"tailscale.com/feature/buildfeatures"
 	"tailscale.com/util/set"
+	"tailscale.com/util/testenv"
 )
 
 var (
@@ -452,6 +453,24 @@ func (b *deltaEncBuf) writeHexVarint(v int64) {
 	b.buf.Write(hexBuf)
 }
 
+// ResetForTest resets all client metric values to zero.
+// It panics if not in a test or if called from a parallel test.
+func ResetForTest(t testenv.TB) {
+	if !testenv.InTest() {
+		panic("clientmetric.ResetForTest called outside a test")
+	}
+	if testenv.InParallelTest(t) {
+		panic("clientmetric.ResetForTest called from a parallel test")
+	}
+	mu.Lock()
+	defer mu.Unlock()
+	for _, m := range metrics {
+		if m.v != nil {
+			atomic.StoreInt64(m.v, 0)
+		}
+	}
+}
+
 var TestHooks testHooks
 
 type testHooks struct{}
diff --git a/util/clientmetric/omit.go b/util/clientmetric/omit.go
index 380205eeb..74018f12a 100644
--- a/util/clientmetric/omit.go
+++ b/util/clientmetric/omit.go
@@ -30,3 +30,5 @@ func NewCounter(string) *Metric                   { return &zeroMetric }
 func NewGauge(string) *Metric                     { return &zeroMetric }
 func NewAggregateCounter(string) *Metric          { return &zeroMetric }
 func NewCounterFunc(string, func() int64) *Metric { return &zeroMetric }
+
+func ResetForTest(any) {}
diff --git a/util/cloudenv/cloudenv.go b/util/cloudenv/cloudenv.go
index aee4bac72..ace70f225 100644
--- a/util/cloudenv/cloudenv.go
+++ b/util/cloudenv/cloudenv.go
@@ -47,6 +47,7 @@ const (
 	Azure        = Cloud("azure")        // Microsoft Azure
 	GCP          = Cloud("gcp")          // Google Cloud
 	DigitalOcean = Cloud("digitalocean") // DigitalOcean
+	Hetzner      = Cloud("hetzner")      // Hetzner Cloud
 )
 
 // ResolverIP returns the cloud host's recursive DNS server or the
@@ -64,6 +65,8 @@ func (c Cloud) ResolverIP() string {
 		return AzureResolverIP
 	case DigitalOcean:
 		return getDigitalOceanResolver()
+	case Hetzner:
+		return getHetznerResolver()
 	}
 	return ""
 }
@@ -82,6 +85,21 @@ func getDigitalOceanResolver() string {
 	})
 }
 
+var (
+	// https://docs.hetzner.com/robot/dedicated-server/general-information/recursive-name-servers/
+	// IPv6 resolvers also exist: 2a01:4ff:ff00::add:1, 2a01:4ff:ff00::add:2.
+	hetznerResolvers = []string{"185.12.64.1", "185.12.64.2"}
+	hetznerResolver  lazy.SyncValue[string]
+)
+
+func getHetznerResolver() string {
+	// Randomly select one of the available resolvers so we don't overload
+	// one of them by sending all traffic there.
+	return hetznerResolver.Get(func() string {
+		return hetznerResolvers[rand.IntN(len(hetznerResolvers))]
+	})
+}
+
 // HasInternalTLD reports whether c is a cloud environment
 // whose ResolverIP serves *.internal records.
 func (c Cloud) HasInternalTLD() bool {
@@ -128,6 +146,9 @@ func getCloud() Cloud {
 		if sysVendor == "DigitalOcean" {
 			return DigitalOcean
 		}
+		if sysVendor == "Hetzner" {
+			return Hetzner
+		}
 		// TODO(andrew): "Vultr" is also valid if we need it
 
 		prod := readFileTrimmed("/sys/class/dmi/id/product_name")
diff --git a/util/cmpver/version_test.go b/util/cmpver/version_test.go
index b3ab1b028..8f13fabf6 100644
--- a/util/cmpver/version_test.go
+++ b/util/cmpver/version_test.go
@@ -91,6 +91,12 @@ func TestCompare(t *testing.T) {
 			v2:   "0.96-105",
 			want: 1,
 		},
+		{
+			name: "tailscale-three-digits",
+			v1:   "1.100.2",
+			v2:   "1.55.0",
+			want: 1,
+		},
 		{
 			// Though ۱ and ۲ both satisfy unicode.IsNumber, our previous use
 			// of strconv.ParseUint with these characters would have lead us to
diff --git a/util/cstruct/cstruct.go b/util/cstruct/cstruct.go
deleted file mode 100644
index afb0150bb..000000000
--- a/util/cstruct/cstruct.go
+++ /dev/null
@@ -1,177 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-// Package cstruct provides a helper for decoding binary data that is in the
-// form of a padded C structure.
-package cstruct
-
-import (
-	"encoding/binary"
-	"errors"
-	"io"
-)
-
-// Size of a pointer-typed value, in bits
-const pointerSize = 32 << (^uintptr(0) >> 63)
-
-// We assume that non-64-bit platforms are 32-bit; we don't expect Go to run on
-// a 16- or 8-bit architecture any time soon.
-const is64Bit = pointerSize == 64
-
-// Decoder reads and decodes padded fields from a slice of bytes. All fields
-// are decoded with native endianness.
-//
-// Methods of a Decoder do not return errors, but rather store any error within
-// the Decoder. The first error can be obtained via the Err method; after the
-// first error, methods will return the zero value for their type.
-type Decoder struct {
-	b    []byte
-	off  int
-	err  error
-	dbuf [8]byte // for decoding
-}
-
-// NewDecoder creates a Decoder from a byte slice.
-func NewDecoder(b []byte) *Decoder {
-	return &Decoder{b: b}
-}
-
-var errUnsupportedSize = errors.New("unsupported size")
-
-func padBytes(offset, size int) int {
-	if offset == 0 || size == 1 {
-		return 0
-	}
-	remainder := offset % size
-	return size - remainder
-}
-
-func (d *Decoder) getField(b []byte) error {
-	size := len(b)
-
-	// We only support fields that are multiples of 2 (or 1-sized)
-	if size != 1 && size&1 == 1 {
-		return errUnsupportedSize
-	}
-
-	// Fields are aligned to their size
-	padBytes := padBytes(d.off, size)
-	if d.off+size+padBytes > len(d.b) {
-		return io.EOF
-	}
-	d.off += padBytes
-
-	copy(b, d.b[d.off:d.off+size])
-	d.off += size
-	return nil
-}
-
-// Err returns the first error that was encountered by this Decoder.
-func (d *Decoder) Err() error {
-	return d.err
-}
-
-// Offset returns the current read offset for data in the buffer.
-func (d *Decoder) Offset() int {
-	return d.off
-}
-
-// Byte returns a single byte from the buffer.
-func (d *Decoder) Byte() byte {
-	if d.err != nil {
-		return 0
-	}
-
-	if err := d.getField(d.dbuf[0:1]); err != nil {
-		d.err = err
-		return 0
-	}
-	return d.dbuf[0]
-}
-
-// Byte returns a number of bytes from the buffer based on the size of the
-// input slice. No padding is applied.
-//
-// If an error is encountered or this Decoder has previously encountered an
-// error, no changes are made to the provided buffer.
-func (d *Decoder) Bytes(b []byte) {
-	if d.err != nil {
-		return
-	}
-
-	// No padding for byte slices
-	size := len(b)
-	if d.off+size >= len(d.b) {
-		d.err = io.EOF
-		return
-	}
-	copy(b, d.b[d.off:d.off+size])
-	d.off += size
-}
-
-// Uint16 returns a uint16 decoded from the buffer.
-func (d *Decoder) Uint16() uint16 {
-	if d.err != nil {
-		return 0
-	}
-
-	if err := d.getField(d.dbuf[0:2]); err != nil {
-		d.err = err
-		return 0
-	}
-	return binary.NativeEndian.Uint16(d.dbuf[0:2])
-}
-
-// Uint32 returns a uint32 decoded from the buffer.
-func (d *Decoder) Uint32() uint32 {
-	if d.err != nil {
-		return 0
-	}
-
-	if err := d.getField(d.dbuf[0:4]); err != nil {
-		d.err = err
-		return 0
-	}
-	return binary.NativeEndian.Uint32(d.dbuf[0:4])
-}
-
-// Uint64 returns a uint64 decoded from the buffer.
-func (d *Decoder) Uint64() uint64 {
-	if d.err != nil {
-		return 0
-	}
-
-	if err := d.getField(d.dbuf[0:8]); err != nil {
-		d.err = err
-		return 0
-	}
-	return binary.NativeEndian.Uint64(d.dbuf[0:8])
-}
-
-// Uintptr returns a uintptr decoded from the buffer.
-func (d *Decoder) Uintptr() uintptr {
-	if d.err != nil {
-		return 0
-	}
-
-	if is64Bit {
-		return uintptr(d.Uint64())
-	} else {
-		return uintptr(d.Uint32())
-	}
-}
-
-// Int16 returns a int16 decoded from the buffer.
-func (d *Decoder) Int16() int16 {
-	return int16(d.Uint16())
-}
-
-// Int32 returns a int32 decoded from the buffer.
-func (d *Decoder) Int32() int32 {
-	return int32(d.Uint32())
-}
-
-// Int64 returns a int64 decoded from the buffer.
-func (d *Decoder) Int64() int64 {
-	return int64(d.Uint64())
-}
diff --git a/util/cstruct/cstruct_example_test.go b/util/cstruct/cstruct_example_test.go
deleted file mode 100644
index a665abe35..000000000
--- a/util/cstruct/cstruct_example_test.go
+++ /dev/null
@@ -1,73 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-// Only built on 64-bit platforms to avoid complexity
-
-//go:build amd64 || arm64 || mips64le || ppc64le || riscv64
-
-package cstruct
-
-import "fmt"
-
-// This test provides a semi-realistic example of how you can
-// use this package to decode a C structure.
-func ExampleDecoder() {
-	// Our example C structure:
-	//    struct mystruct {
-	//      char *p;
-	//      char c;
-	//	/* implicit: char _pad[3]; */
-	//      int x;
-	//    };
-	//
-	// The Go structure definition:
-	type myStruct struct {
-		Ptr    uintptr
-		Ch     byte
-		Intval uint32
-	}
-
-	// Our "in-memory" version of the above structure
-	buf := []byte{
-		1, 2, 3, 4, 0, 0, 0, 0, // ptr
-		5,          // ch
-		99, 99, 99, // padding
-		78, 6, 0, 0, // x
-	}
-	d := NewDecoder(buf)
-
-	// Decode the structure; if one of these function returns an error,
-	// then subsequent decoder functions will return the zero value.
-	var x myStruct
-	x.Ptr = d.Uintptr()
-	x.Ch = d.Byte()
-	x.Intval = d.Uint32()
-
-	// Note that per the Go language spec:
-	//    [...] when evaluating the operands of an expression, assignment,
-	//    or return statement, all function calls, method calls, and
-	//    (channel) communication operations are evaluated in lexical
-	//    left-to-right order
-	//
-	// Since each field is assigned via a function call, one could use the
-	// following snippet to decode the struct.
-	//     x := myStruct{
-	//         Ptr:    d.Uintptr(),
-	//         Ch:     d.Byte(),
-	//         Intval: d.Uint32(),
-	//     }
-	//
-	// However, this means that reordering the fields in the initialization
-	// statement–normally a semantically identical operation–would change
-	// the way the structure is parsed. Thus we do it as above with
-	// explicit ordering.
-
-	// After finishing with the decoder, check errors
-	if err := d.Err(); err != nil {
-		panic(err)
-	}
-
-	// Print the decoder offset and structure
-	fmt.Printf("off=%d struct=%#v\n", d.Offset(), x)
-	// Output: off=16 struct=cstruct.myStruct{Ptr:0x4030201, Ch:0x5, Intval:0x64e}
-}
diff --git a/util/cstruct/cstruct_test.go b/util/cstruct/cstruct_test.go
deleted file mode 100644
index 95d4876ca..000000000
--- a/util/cstruct/cstruct_test.go
+++ /dev/null
@@ -1,150 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-package cstruct
-
-import (
-	"errors"
-	"fmt"
-	"io"
-	"testing"
-)
-
-func TestPadBytes(t *testing.T) {
-	testCases := []struct {
-		offset int
-		size   int
-		want   int
-	}{
-		// No padding at beginning of structure
-		{0, 1, 0},
-		{0, 2, 0},
-		{0, 4, 0},
-		{0, 8, 0},
-
-		// No padding for single bytes
-		{1, 1, 0},
-
-		// Single byte padding
-		{1, 2, 1},
-		{3, 4, 1},
-
-		// Multi-byte padding
-		{1, 4, 3},
-		{2, 8, 6},
-	}
-	for _, tc := range testCases {
-		t.Run(fmt.Sprintf("%d_%d_%d", tc.offset, tc.size, tc.want), func(t *testing.T) {
-			got := padBytes(tc.offset, tc.size)
-			if got != tc.want {
-				t.Errorf("got=%d; want=%d", got, tc.want)
-			}
-		})
-	}
-}
-
-func TestDecoder(t *testing.T) {
-	t.Run("UnsignedTypes", func(t *testing.T) {
-		dec := func(n int) *Decoder {
-			buf := make([]byte, n)
-			buf[0] = 1
-
-			d := NewDecoder(buf)
-
-			// Use t.Cleanup to perform an assertion on this
-			// decoder after the test code is finished with it.
-			t.Cleanup(func() {
-				if err := d.Err(); err != nil {
-					t.Fatal(err)
-				}
-			})
-			return d
-		}
-		if got := dec(2).Uint16(); got != 1 {
-			t.Errorf("uint16: got=%d; want=1", got)
-		}
-		if got := dec(4).Uint32(); got != 1 {
-			t.Errorf("uint32: got=%d; want=1", got)
-		}
-		if got := dec(8).Uint64(); got != 1 {
-			t.Errorf("uint64: got=%d; want=1", got)
-		}
-		if got := dec(pointerSize / 8).Uintptr(); got != 1 {
-			t.Errorf("uintptr: got=%d; want=1", got)
-		}
-	})
-
-	t.Run("SignedTypes", func(t *testing.T) {
-		dec := func(n int) *Decoder {
-			// Make a buffer of the exact size that consists of 0xff bytes
-			buf := make([]byte, n)
-			for i := range n {
-				buf[i] = 0xff
-			}
-
-			d := NewDecoder(buf)
-
-			// Use t.Cleanup to perform an assertion on this
-			// decoder after the test code is finished with it.
-			t.Cleanup(func() {
-				if err := d.Err(); err != nil {
-					t.Fatal(err)
-				}
-			})
-			return d
-		}
-		if got := dec(2).Int16(); got != -1 {
-			t.Errorf("int16: got=%d; want=-1", got)
-		}
-		if got := dec(4).Int32(); got != -1 {
-			t.Errorf("int32: got=%d; want=-1", got)
-		}
-		if got := dec(8).Int64(); got != -1 {
-			t.Errorf("int64: got=%d; want=-1", got)
-		}
-	})
-
-	t.Run("InsufficientData", func(t *testing.T) {
-		dec := func(n int) *Decoder {
-			// Make a buffer that's too small and contains arbitrary bytes
-			buf := make([]byte, n-1)
-			for i := range n - 1 {
-				buf[i] = 0xAD
-			}
-
-			// Use t.Cleanup to perform an assertion on this
-			// decoder after the test code is finished with it.
-			d := NewDecoder(buf)
-			t.Cleanup(func() {
-				if err := d.Err(); err == nil || !errors.Is(err, io.EOF) {
-					t.Errorf("(n=%d) expected io.EOF; got=%v", n, err)
-				}
-			})
-			return d
-		}
-
-		dec(2).Uint16()
-		dec(4).Uint32()
-		dec(8).Uint64()
-		dec(pointerSize / 8).Uintptr()
-
-		dec(2).Int16()
-		dec(4).Int32()
-		dec(8).Int64()
-	})
-
-	t.Run("Bytes", func(t *testing.T) {
-		d := NewDecoder([]byte("hello worldasdf"))
-		t.Cleanup(func() {
-			if err := d.Err(); err != nil {
-				t.Fatal(err)
-			}
-		})
-
-		buf := make([]byte, 11)
-		d.Bytes(buf)
-		if got := string(buf); got != "hello world" {
-			t.Errorf("bytes: got=%q; want=%q", got, "hello world")
-		}
-	})
-}
diff --git a/util/deephash/deephash_test.go b/util/deephash/deephash_test.go
index 7ea83566f..a82203d50 100644
--- a/util/deephash/deephash_test.go
+++ b/util/deephash/deephash_test.go
@@ -59,7 +59,7 @@ func TestHash(t *testing.T) {
 		I16  int16
 		I32  int32
 		I64  int64
-		I    int
+		Int  int
 		U8   uint8
 		U16  uint16
 		U32  uint32
@@ -92,7 +92,7 @@ func TestHash(t *testing.T) {
 		{in: tuple{scalars{I16: math.MinInt16}, scalars{I16: math.MinInt16 / 2}}, wantEq: false},
 		{in: tuple{scalars{I32: math.MinInt32}, scalars{I32: math.MinInt32 / 2}}, wantEq: false},
 		{in: tuple{scalars{I64: math.MinInt64}, scalars{I64: math.MinInt64 / 2}}, wantEq: false},
-		{in: tuple{scalars{I: -1234}, scalars{I: -1234 / 2}}, wantEq: false},
+		{in: tuple{scalars{Int: -1234}, scalars{Int: -1234 / 2}}, wantEq: false},
 		{in: tuple{scalars{U8: math.MaxUint8}, scalars{U8: math.MaxUint8 / 2}}, wantEq: false},
 		{in: tuple{scalars{U16: math.MaxUint16}, scalars{U16: math.MaxUint16 / 2}}, wantEq: false},
 		{in: tuple{scalars{U32: math.MaxUint32}, scalars{U32: math.MaxUint32 / 2}}, wantEq: false},
diff --git a/util/deephash/tailscale_types_test.go b/util/deephash/tailscale_types_test.go
index 7e803c841..7cff5335c 100644
--- a/util/deephash/tailscale_types_test.go
+++ b/util/deephash/tailscale_types_test.go
@@ -86,11 +86,6 @@ func getVal() *tailscaleTypes {
 	return &tailscaleTypes{
 		&wgcfg.Config{
 			Addresses: []netip.Prefix{netip.PrefixFrom(netip.AddrFrom16([16]byte{3: 3}).Unmap(), 5)},
-			Peers: []wgcfg.Peer{
-				{
-					PublicKey: key.NodePublic{},
-				},
-			},
 		},
 		&router.Config{
 			Routes: []netip.Prefix{
diff --git a/util/def/def.go b/util/def/def.go
new file mode 100644
index 000000000..fb4c8d755
--- /dev/null
+++ b/util/def/def.go
@@ -0,0 +1,45 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package def parses strings and environment variables with fallback default values.
+package def
+
+import (
+	"os"
+	"strconv"
+	"time"
+)
+
+// Bool parses s as a bool, returning def when s is empty or invalid.
+func Bool(s string, def bool) bool {
+	if s == "" {
+		return def
+	}
+	v, err := strconv.ParseBool(s)
+	if err != nil {
+		return def
+	}
+	return v
+}
+
+// Duration parses s as a time.Duration, returning def when s is empty or invalid.
+func Duration(s string, def time.Duration) time.Duration {
+	if s == "" {
+		return def
+	}
+	v, err := time.ParseDuration(s)
+	if err != nil {
+		return def
+	}
+	return v
+}
+
+// LookupEnv retrieves the value of the environment variable named by the key.
+// If the variable is present in the environment the value (which may be
+// empty) is returned. Otherwise, it returns def.
+func LookupEnv(key, def string) string {
+	if v, ok := os.LookupEnv(key); ok {
+		return v
+	}
+	return def
+}
diff --git a/util/def/def_test.go b/util/def/def_test.go
new file mode 100644
index 000000000..f9e62d6ed
--- /dev/null
+++ b/util/def/def_test.go
@@ -0,0 +1,148 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package def_test
+
+import (
+	"os"
+	"strconv"
+	"testing"
+	"time"
+
+	"tailscale.com/util/def"
+)
+
+func TestLookupEnv(t *testing.T) {
+	const key = "TS_DEF_TEST_LOOKUPENV"
+	tests := []struct {
+		name  string
+		unset bool
+		value string
+		def   string
+		want  string
+	}{
+		{name: "unset", unset: true, def: "fallback", want: "fallback"},
+		{name: "set", value: "value", def: "fallback", want: "value"},
+		{name: "empty", value: "", def: "fallback", want: ""},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Setenv(key, tt.value)
+			if tt.unset {
+				os.Unsetenv(key)
+			}
+			if got := def.LookupEnv(key, tt.def); got != tt.want {
+				t.Errorf("LookupEnv(%q, %q) = %q; want %q", key, tt.def, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestBool(t *testing.T) {
+	tests := []struct {
+		name string
+		in   string
+		def  bool
+		want bool
+	}{
+		{name: "empty_true", in: "", def: true, want: true},
+		{name: "empty_false", in: "", def: false, want: false},
+		{name: "valid_1", in: "1", def: false, want: true},
+		{name: "valid_t", in: "t", def: false, want: true},
+		{name: "valid_T", in: "T", def: false, want: true},
+		{name: "valid_TRUE", in: "TRUE", def: false, want: true},
+		{name: "valid_true", in: "true", def: false, want: true},
+		{name: "valid_True", in: "True", def: false, want: true},
+		{name: "valid_true_default_true", in: "true", def: true, want: true},
+		{name: "valid_0", in: "0", def: true, want: false},
+		{name: "valid_f", in: "f", def: true, want: false},
+		{name: "valid_F", in: "F", def: true, want: false},
+		{name: "valid_FALSE", in: "FALSE", def: true, want: false},
+		{name: "valid_false", in: "false", def: true, want: false},
+		{name: "valid_False", in: "False", def: true, want: false},
+		{name: "valid_false_default_false", in: "false", def: false, want: false},
+		{name: "invalid_true", in: "sure", def: true, want: true},
+		{name: "invalid_false", in: "sure", def: false, want: false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := def.Bool(tt.in, tt.def); got != tt.want {
+				t.Errorf("Bool(%q, %v) = %v; want %v", tt.in, tt.def, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestDuration(t *testing.T) {
+	tests := []struct {
+		name string
+		in   string
+		def  time.Duration
+		want time.Duration
+	}{
+		{name: "empty_second", in: "", def: time.Second, want: time.Second},
+		{name: "empty_zero", in: "", def: 0, want: 0},
+		{name: "valid", in: "2m30s", def: time.Second, want: 2*time.Minute + 30*time.Second},
+		{name: "valid_zero", in: "0s", def: time.Second, want: 0},
+		{name: "invalid_second", in: "soon", def: time.Second, want: time.Second},
+		{name: "invalid_minute", in: "soon", def: time.Minute, want: time.Minute},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := def.Duration(tt.in, tt.def); got != tt.want {
+				t.Errorf("Duration(%q, %v) = %v; want %v", tt.in, tt.def, got, tt.want)
+			}
+		})
+	}
+}
+
+func FuzzBool(f *testing.F) {
+	for _, tc := range []struct {
+		in  string
+		def bool
+	}{
+		{in: "", def: true},
+		{in: "", def: false},
+		{in: "true", def: false},
+		{in: "false", def: true},
+		{in: "sure", def: true},
+		{in: "sure", def: false},
+	} {
+		f.Add(tc.in, tc.def)
+	}
+	f.Fuzz(func(t *testing.T, in string, fallback bool) {
+		got := def.Bool(in, fallback)
+		want, err := strconv.ParseBool(in)
+		if in == "" || err != nil {
+			want = fallback
+		}
+		if got != want {
+			t.Fatalf("Bool(%q, %v) = %v; want %v", in, fallback, got, want)
+		}
+	})
+}
+
+func FuzzDuration(f *testing.F) {
+	for _, tc := range []struct {
+		in  string
+		def time.Duration
+	}{
+		{in: "", def: time.Second},
+		{in: "", def: 0},
+		{in: "2m30s", def: time.Second},
+		{in: "soon", def: time.Second},
+	} {
+		f.Add(tc.in, int64(tc.def))
+	}
+	f.Fuzz(func(t *testing.T, in string, fallbackN int64) {
+		fallback := time.Duration(fallbackN)
+		got := def.Duration(in, fallback)
+		want, err := time.ParseDuration(in)
+		if in == "" || err != nil {
+			want = fallback
+		}
+		if got != want {
+			t.Fatalf("Duration(%q, %v) = %v; want %v", in, fallback, got, want)
+		}
+	})
+}
diff --git a/util/eventbus/bench_test.go b/util/eventbus/bench_test.go
index 7cd7a4241..9657c4e6f 100644
--- a/util/eventbus/bench_test.go
+++ b/util/eventbus/bench_test.go
@@ -39,6 +39,27 @@ func BenchmarkBasicThroughput(b *testing.B) {
 	bus.Close()
 }
 
+// BenchmarkBasicFuncThroughput is the SubscribeFunc analogue of
+// BenchmarkBasicThroughput: one publisher and one SubscribeFunc
+// callback, shoveling events as fast as they can through the
+// plumbing. Useful for tracking per-event allocation behavior on the
+// SubscribeFunc dispatch path.
+func BenchmarkBasicFuncThroughput(b *testing.B) {
+	bus := eventbus.New()
+	pcli := bus.Client(b.Name() + "-pub")
+	scli := bus.Client(b.Name() + "-sub")
+
+	type emptyEvent [0]byte
+
+	pub := eventbus.Publish[emptyEvent](pcli)
+	eventbus.SubscribeFunc(scli, func(emptyEvent) {})
+
+	for b.Loop() {
+		pub.Publish(emptyEvent{})
+	}
+	bus.Close()
+}
+
 func BenchmarkSubsThroughput(b *testing.B) {
 	bus := eventbus.New()
 	pcli := bus.Client(b.Name() + "-pub")
diff --git a/util/eventbus/bus.go b/util/eventbus/bus.go
index 1bc8aaed6..56738e76d 100644
--- a/util/eventbus/bus.go
+++ b/util/eventbus/bus.go
@@ -103,6 +103,15 @@ func (b *Bus) Debugger() *Debugger {
 	return &Debugger{b}
 }
 
+// ProbeLocks acquires and releases the bus's internal mutexes.
+func (b *Bus) ProbeLocks() {
+	b.topicsMu.Lock()
+	b.topicsMu.Unlock()
+
+	b.clientsMu.Lock()
+	b.clientsMu.Unlock()
+}
+
 // Close closes the bus. It implicitly closes all clients, publishers and
 // subscribers attached to the bus.
 //
diff --git a/util/eventbus/client.go b/util/eventbus/client.go
index f405146ce..54a841b27 100644
--- a/util/eventbus/client.go
+++ b/util/eventbus/client.go
@@ -146,7 +146,10 @@ func Subscribe[T any](c *Client) *Subscriber[T] {
 
 	r := c.subscribeStateLocked()
 	s := newSubscriber[T](r, logfForCaller(c.logger()))
-	r.addSubscriber(s)
+	// Register the non-generic core with the bus rather than the typed facade,
+	// mirroring SubscribeFunc and Publish: this keeps the bus's outputs map
+	// and subscriber-interface itab out of per-T cost.
+	r.addSubscriber(s.core)
 	return s
 }
 
@@ -169,7 +172,11 @@ func SubscribeFunc[T any](c *Client, f func(T)) *SubscriberFunc[T] {
 
 	r := c.subscribeStateLocked()
 	s := newSubscriberFunc[T](r, f, logfForCaller(c.logger()))
-	r.addSubscriber(s)
+	// Register the non-generic core, not the typed facade. Doing
+	// so means the bus's outputs map and the subscriber interface
+	// itab are not parameterized by T, eliminating per-T itab and
+	// dictionary cost.
+	r.addSubscriber(s.core)
 	return s
 }
 
@@ -177,6 +184,11 @@ func SubscribeFunc[T any](c *Client, f func(T)) *SubscriberFunc[T] {
 // It panics if c is closed.
 func Publish[T any](c *Client) *Publisher[T] {
 	p := newPublisher[T](c)
-	c.addPublisher(p)
+	// Register the non-generic core with the client so the
+	// per-Client publisher set, the publisher interface itab, and
+	// the publisher equality function are not parameterized by T.
+	// This eliminates per-T itab/dictionary/eq cost for every new
+	// event type passed through Publish[T].
+	c.addPublisher(p.core)
 	return p
 }
diff --git a/util/eventbus/eventbustest/eventbustest.go b/util/eventbus/eventbustest/eventbustest.go
index b3ef6c884..82436c912 100644
--- a/util/eventbus/eventbustest/eventbustest.go
+++ b/util/eventbus/eventbustest/eventbustest.go
@@ -232,7 +232,7 @@ type Injector struct {
 }
 
 // NewInjector constructs an [Injector] that can be used to inject events into
-// the the stream of events used by code under test. After construction the
+// the stream of events used by code under test. After construction the
 // caller may use [Inject] to insert events into the bus.
 func NewInjector(t *testing.T, b *eventbus.Bus) *Injector {
 	inj := &Injector{
diff --git a/util/eventbus/publish.go b/util/eventbus/publish.go
index f6fd029b7..fd037ac34 100644
--- a/util/eventbus/publish.go
+++ b/util/eventbus/publish.go
@@ -7,8 +7,13 @@ import (
 	"reflect"
 )
 
-// publisher is a uniformly typed wrapper around Publisher[T], so that
-// debugging facilities can look at active publishers.
+// publisher is a uniformly typed wrapper around publisherCore so that
+// debugging facilities can enumerate active publishers on a [Client]
+// and report the types each one publishes. The interface is
+// implemented by the non-generic *publisherCore (not by the typed
+// user-facing *Publisher[T]); this keeps the bus's per-Client
+// publisher set, and the publisher itab/dictionary, free of
+// per-T duplication.
 type publisher interface {
 	publishType() reflect.Type
 	Close()
@@ -16,12 +21,35 @@ type publisher interface {
 
 // A Publisher publishes typed events on a bus.
 type Publisher[T any] struct {
+	// Implementation note: Publisher[T] is a thin user-facing facade over a
+	// non-generic *publisherCore. Carrying T on the public type preserves the
+	// typed API of Publish(v T), but all of the actual state (the *Client
+	// back-pointer, the stop flag, and the cached reflect.Type used by
+	// diagnostic introspection) lives on the core and is not duplicated per T.
+	//
+	// The diagnostic surface that motivates the publisher interface
+	// (Debugger.PublishTypes) is served by *publisherCore directly, so adding
+	// new typed publishers does not pay an itab+dictionary cost just to satisfy
+	// diagnostic enumeration.
+	core *publisherCore
+}
+
+// publisherCore is the non-generic implementation of a Publisher.
+// It implements the package-private publisher interface; the bus's
+// outputs map and itab key on this single type, not on Publisher[T].
+type publisherCore struct {
 	client *Client
 	stop   stopFlag
+	typ    reflect.Type // cached reflect.TypeFor[T]()
 }
 
 func newPublisher[T any](c *Client) *Publisher[T] {
-	return &Publisher[T]{client: c}
+	return &Publisher[T]{
+		core: &publisherCore{
+			client: c,
+			typ:    reflect.TypeFor[T](),
+		},
+	}
 }
 
 // Close closes the publisher.
@@ -31,35 +59,46 @@ func newPublisher[T any](c *Client) *Publisher[T] {
 // If the Bus or Client from which the Publisher was created is closed,
 // the Publisher is implicitly closed and does not need to be closed
 // separately.
-func (p *Publisher[T]) Close() {
+func (p *Publisher[T]) Close() { p.core.Close() }
+
+// Close implements the publisher interface and the user-facing
+// (*Publisher[T]).Close.
+func (c *publisherCore) Close() {
 	// Just unblocks any active calls to Publish, no other
 	// synchronization needed.
-	p.stop.Stop()
-	p.client.deletePublisher(p)
+	c.stop.Stop()
+	c.client.deletePublisher(c)
 }
 
-func (p *Publisher[T]) publishType() reflect.Type {
-	return reflect.TypeFor[T]()
-}
+// publishType implements the publisher interface.
+func (c *publisherCore) publishType() reflect.Type { return c.typ }
 
 // Publish publishes event v on the bus.
 func (p *Publisher[T]) Publish(v T) {
+	publish(p.core, v)
+}
+
+// publish is the non-generic body of Publisher[T].Publish. The only
+// per-T work is the boxing of v into evt.Event (an `any` field) and
+// the construction of the PublishedEvent struct itself; all of the
+// channel/select dance is shared across every T.
+func publish(c *publisherCore, v any) {
 	// Check for just a stopped publisher or bus before trying to
 	// write, so that once closed Publish consistently does nothing.
 	select {
-	case <-p.stop.Done():
+	case <-c.stop.Done():
 		return
 	default:
 	}
 
 	evt := PublishedEvent{
 		Event: v,
-		From:  p.client,
+		From:  c.client,
 	}
 
 	select {
-	case p.client.publish() <- evt:
-	case <-p.stop.Done():
+	case c.client.publish() <- evt:
+	case <-c.stop.Done():
 	}
 }
 
@@ -70,5 +109,5 @@ func (p *Publisher[T]) Publish(v T) {
 // nobody seems to care. Publishers must not assume that someone will
 // definitely receive an event if ShouldPublish returns true.
 func (p *Publisher[T]) ShouldPublish() bool {
-	return p.client.shouldPublish(reflect.TypeFor[T]())
+	return p.core.client.shouldPublish(p.core.typ)
 }
diff --git a/util/eventbus/subscribe.go b/util/eventbus/subscribe.go
index 3edf6deb4..3c3dced1f 100644
--- a/util/eventbus/subscribe.go
+++ b/util/eventbus/subscribe.go
@@ -184,49 +184,62 @@ func (s *subscribeState) closed() <-chan struct{} {
 // A Subscriber delivers one type of event from a [Client].
 // Events are sent to the [Subscriber.Events] channel.
 type Subscriber[T any] struct {
-	stop       stopFlag
-	read       chan T
-	unregister func()
-	logf       logger.Logf
-	slow       *time.Timer // used to detect slow subscriber service
+	// core holds the non-generic subscriber-interface implementation
+	// (Close, subscribeType, dispatch, slow timer, unregister) shared
+	// with [SubscriberFunc] via [subscriberCore]. The only per-T state
+	// owned by the facade itself is the typed delivery channel; the
+	// dispatch loop, unlike SubscriberFunc, must remain per-T — see
+	// [Subscriber.dispatchTyped].
+	core *subscriberCore
+	read chan T
 }
 
 func newSubscriber[T any](r *subscribeState, logf logger.Logf) *Subscriber[T] {
-	slow := time.NewTimer(0)
-	slow.Stop() // reset in dispatch
-	return &Subscriber[T]{
-		read:       make(chan T),
-		unregister: func() { r.deleteSubscriber(reflect.TypeFor[T]()) },
-		logf:       logf,
-		slow:       slow,
+	core := newSubscriberCore(r, logf, reflect.TypeFor[T]())
+	s := &Subscriber[T]{
+		core: core,
+		read: make(chan T),
 	}
-}
-
-func newMonitor[T any](attach func(fn func(T)) (cancel func())) *Subscriber[T] {
-	ret := &Subscriber[T]{
-		read: make(chan T, 100), // arbitrary, large
+	// Subscriber[T] keeps a per-T dispatch loop; see [Subscriber.dispatchTyped]
+	// for why we don't share the non-generic dispatchFunc that SubscriberFunc
+	// uses.
+	core.dispatchFn = func(
+		ctx context.Context,
+		vals *queue[DeliveredEvent],
+		acceptCh func() chan DeliveredEvent,
+		snapshot chan chan []DeliveredEvent,
+	) bool {
+		return s.dispatchTyped(ctx, vals, acceptCh, snapshot)
 	}
-	ret.unregister = attach(ret.monitor)
-	return ret
+	return s
 }
 
-func (s *Subscriber[T]) subscribeType() reflect.Type {
-	return reflect.TypeFor[T]()
-}
-
-func (s *Subscriber[T]) monitor(debugEvent T) {
-	select {
-	case s.read <- debugEvent:
-	case <-s.stop.Done():
-	}
-}
-
-func (s *Subscriber[T]) dispatch(ctx context.Context, vals *queue[DeliveredEvent], acceptCh func() chan DeliveredEvent, snapshot chan chan []DeliveredEvent) bool {
+// dispatchTyped is the per-T dispatch loop for Subscriber[T]. It has to remain
+// generic because the typed channel send `case s.read <- t:` must appear
+// lexically inside the select. The rest of the cases match the non-generic
+// dispatchFunc body to keep behavior aligned between Subscriber and
+// SubscriberFunc.
+//
+// We don't share dispatchFunc (the way SubscriberFunc does) because bridging
+// the typed channel send and the non-generic select would require running the
+// send on its own goroutine on every event delivery. That bridge was measured
+// at ~2.7x throughput regression on BenchmarkBasicThroughput, so we keep
+// dispatchTyped generic and pay the per-shape stencil cost instead (measured
+// at ~1,600 B body + ~1,100 B pclntab per shape on linux/amd64 tailscaled).
+// Only the typed select lives in the per-shape stencil; the surrounding state
+// (slow timer, log function, type name) is reached through the non-generic
+// core.
+func (s *Subscriber[T]) dispatchTyped(
+	ctx context.Context,
+	vals *queue[DeliveredEvent],
+	acceptCh func() chan DeliveredEvent,
+	snapshot chan chan []DeliveredEvent,
+) bool {
 	t := vals.Peek().Event.(T)
 
 	start := time.Now()
-	s.slow.Reset(slowSubscriberTimeout)
-	defer s.slow.Stop()
+	s.core.slow.Reset(slowSubscriberTimeout)
+	defer s.core.slow.Stop()
 
 	for {
 		// Keep the cases in this select in sync with subscribeState.pump
@@ -242,13 +255,35 @@ func (s *Subscriber[T]) dispatch(ctx context.Context, vals *queue[DeliveredEvent
 			return false
 		case ch := <-snapshot:
 			ch <- vals.Snapshot()
-		case <-s.slow.C:
-			s.logf("subscriber for %T is slow (%v elapsed)", t, time.Since(start))
-			s.slow.Reset(slowSubscriberTimeout)
+		case <-s.core.slow.C:
+			s.core.logf("subscriber for %s is slow (%v elapsed)", s.core.typeName, time.Since(start))
+			s.core.slow.Reset(slowSubscriberTimeout)
 		}
 	}
 }
 
+func newMonitor[T any](attach func(fn func(T)) (cancel func())) *Subscriber[T] {
+	s := &Subscriber[T]{
+		// Monitors don't go through the bus's dispatch path (they
+		// are attached directly to the debug hook), so they don't
+		// need a fully-initialized subscriberCore — only the typed
+		// delivery channel and an unregister callback. We give them
+		// a placeholder core so Close() and Done() work uniformly.
+		core: &subscriberCore{},
+		read: make(chan T, 100), // arbitrary, large
+	}
+	cancel := attach(s.monitor)
+	s.core.unregister = func(reflect.Type) { cancel() }
+	return s
+}
+
+func (s *Subscriber[T]) monitor(debugEvent T) {
+	select {
+	case s.read <- debugEvent:
+	case <-s.core.stop.Done():
+	}
+}
+
 // Events returns a channel on which the subscriber's events are
 // delivered.
 func (s *Subscriber[T]) Events() <-chan T {
@@ -258,7 +293,7 @@ func (s *Subscriber[T]) Events() <-chan T {
 // Done returns a channel that is closed when the subscriber is
 // closed.
 func (s *Subscriber[T]) Done() <-chan struct{} {
-	return s.stop.Done()
+	return s.core.stop.Done()
 }
 
 // Close closes the Subscriber, indicating the caller no longer wishes
@@ -268,30 +303,105 @@ func (s *Subscriber[T]) Done() <-chan struct{} {
 // If the Bus from which the Subscriber was created is closed,
 // the Subscriber is implicitly closed and does not need to be closed
 // separately.
-func (s *Subscriber[T]) Close() {
-	s.stop.Stop() // unblock receivers
-	s.unregister()
-}
+func (s *Subscriber[T]) Close() { s.core.Close() }
 
 // A SubscriberFunc delivers one type of event from a [Client].
 // Events are forwarded synchronously to a function provided at construction.
 type SubscriberFunc[T any] struct {
+	// core holds the non-generic subscriber-interface implementation shared
+	// with [Subscriber] via [subscriberCore]. The user callback is captured
+	// in the dispatchFn closure on the core, so SubscriberFunc[T] itself
+	// carries no per-T state beyond the core pointer; per-T cost is limited
+	// to the small forwarding Close method below.
+	core *subscriberCore
+}
+
+// subscriberCore is the non-generic backing for both Subscriber[T] and
+// SubscriberFunc[T]. It implements the package-private subscriber interface
+// so that the bus (and the subscribeState map) can store it without per-T
+// itabs or dictionaries. The per-T behavior (type assertion plus either typed
+// channel send or user callback invocation) is encapsulated in the dispatchFn
+// closure set up by the constructor of the typed facade.
+type subscriberCore struct {
 	stop       stopFlag
-	read       func(T)
-	unregister func()
+	unregister func(reflect.Type)
 	logf       logger.Logf
 	slow       *time.Timer // used to detect slow subscriber service
+
+	// typ is the cached reflect.Type of T. Returned by
+	// subscribeType() and used by the dispatch closure to format
+	// slow-subscriber log messages.
+	typ reflect.Type
+	// typeName is the cached reflect.TypeFor[T]().String() result.
+	// Computed once at construction time so the dispatch closure
+	// (which runs once per delivered event) doesn't allocate a
+	// fresh string on every call. The string is also independent
+	// of T, so it doesn't contribute to per-T stencil cost.
+	typeName string
+
+	// dispatchFn is the per-T dispatch closure. It performs the type
+	// assertion vals.Peek().Event.(T) and runs the typed delivery (either a
+	// user-callback invocation for SubscriberFunc[T] or a typed channel send
+	// for Subscriber[T]). The closure body is non-generic apart from those
+	// two T-bound operations; the bulk of the dispatch work happens in the
+	// non-generic dispatchFunc helper (used by SubscriberFunc) or in the
+	// Subscriber[T].dispatchTyped per-shape stencil.
+	dispatchFn func(
+		ctx context.Context,
+		vals *queue[DeliveredEvent],
+		acceptCh func() chan DeliveredEvent,
+		snapshot chan chan []DeliveredEvent,
+	) bool
 }
 
 func newSubscriberFunc[T any](r *subscribeState, f func(T), logf logger.Logf) *SubscriberFunc[T] {
+	core := newSubscriberCore(r, logf, reflect.TypeFor[T]())
+	// The dispatch closure is the only piece that intrinsically
+	// needs T: it performs the type assertion on the head queue
+	// value and forwards the unboxed value to the user callback.
+	// All non-generic setup (timer, core allocation, unregister
+	// closure) lives in newSubscriberCore so it isn't
+	// duplicated per T.
+	core.dispatchFn = func(
+		ctx context.Context,
+		vals *queue[DeliveredEvent],
+		acceptCh func() chan DeliveredEvent,
+		snapshot chan chan []DeliveredEvent,
+	) bool {
+		t := vals.Peek().Event.(T)
+		callDone := make(chan struct{})
+		// `go runFuncCallback(f, t, callDone)` binds its arguments
+		// directly to the new goroutine's frame; using a closure
+		// (`go func() { f(t) }()`) would allocate a closure on the
+		// heap on every dispatched event.
+		go runFuncCallback(f, t, callDone)
+		return dispatchFunc(ctx, core, vals, acceptCh, snapshot, callDone)
+	}
+	return &SubscriberFunc[T]{core: core}
+}
+
+// newSubscriberCore performs the non-generic portion of subscriber
+// construction: timer setup, core struct allocation, and assignment of the
+// unregister method-value. The caller fills in the per-T dispatchFn
+// afterward.
+//
+// Hoisting this out of the typed constructors (newSubscriber[T] and
+// newSubscriberFunc[T]) eliminates the bulk of their per-T stencil cost; the
+// only T-typed instructions left in each generic constructor are the
+// reflect.TypeFor[T]() call (whose body is shared via the
+// internal/abi.TypeFor[T] dictionary) and the construction of the dispatch
+// closure itself.
+func newSubscriberCore(r *subscribeState, logf logger.Logf, typ reflect.Type) *subscriberCore {
 	slow := time.NewTimer(0)
 	slow.Stop() // reset in dispatch
-	return &SubscriberFunc[T]{
-		read:       f,
-		unregister: func() { r.deleteSubscriber(reflect.TypeFor[T]()) },
-		logf:       logf,
-		slow:       slow,
+	core := &subscriberCore{
+		logf:     logf,
+		slow:     slow,
+		typ:      typ,
+		typeName: typ.String(),
 	}
+	core.unregister = r.deleteSubscriber
+	return core
 }
 
 // Close closes the SubscriberFunc, indicating the caller no longer wishes to
@@ -300,24 +410,54 @@ func newSubscriberFunc[T any](r *subscribeState, f func(T), logf logger.Logf) *S
 //
 // If the [Bus] from which s was created is closed, s is implicitly closed and
 // does not need to be closed separately.
-func (s *SubscriberFunc[T]) Close() { s.stop.Stop(); s.unregister() }
+func (s *SubscriberFunc[T]) Close() { s.core.Close() }
 
-// subscribeType implements part of the subscriber interface.
-func (s *SubscriberFunc[T]) subscribeType() reflect.Type { return reflect.TypeFor[T]() }
+// Close implements the subscriber interface and the user-facing Close on
+// both Subscriber[T] and SubscriberFunc[T].
+func (c *subscriberCore) Close() {
+	c.stop.Stop()
+	c.unregister(c.typ)
+}
 
-// dispatch implements part of the subscriber interface.
-func (s *SubscriberFunc[T]) dispatch(ctx context.Context, vals *queue[DeliveredEvent], acceptCh func() chan DeliveredEvent, snapshot chan chan []DeliveredEvent) bool {
-	t := vals.Peek().Event.(T)
-	callDone := make(chan struct{})
-	go s.runCallback(t, callDone)
+// subscribeType implements the subscriber interface.
+func (c *subscriberCore) subscribeType() reflect.Type { return c.typ }
 
+// dispatch implements the subscriber interface by invoking the
+// per-T dispatch closure that was captured at construction time.
+func (c *subscriberCore) dispatch(
+	ctx context.Context,
+	vals *queue[DeliveredEvent],
+	acceptCh func() chan DeliveredEvent,
+	snapshot chan chan []DeliveredEvent,
+) bool {
+	return c.dispatchFn(ctx, vals, acceptCh, snapshot)
+}
+
+// dispatchFunc is the non-generic body of SubscriberFunc[T].dispatch.
+// It is identical in observable behavior to the original loop; the
+// only differences are that the dispatched value has already been
+// unboxed by the caller (and the user callback is already running
+// on its own goroutine, signaling completion via callDone) and the
+// slow-subscriber timer / cached type name come from the
+// non-generic core, not from a per-T struct.
+//
+// callDone is closed by runFuncCallback when the user callback returns.
+func dispatchFunc(
+	ctx context.Context,
+	core *subscriberCore,
+	vals *queue[DeliveredEvent],
+	acceptCh func() chan DeliveredEvent,
+	snapshot chan chan []DeliveredEvent,
+	callDone chan struct{},
+) bool {
 	start := time.Now()
-	s.slow.Reset(slowSubscriberTimeout)
-	defer s.slow.Stop()
+	core.slow.Reset(slowSubscriberTimeout)
+	defer core.slow.Stop()
 
 	// Keep the cases in this select in sync with subscribeState.pump
 	// above. The only difference should be that this select
-	// delivers a value by calling s.read.
+	// delivers a value by calling the user callback (via the
+	// goroutine spawned by the typed wrapper).
 	for {
 		select {
 		case <-callDone:
@@ -327,30 +467,35 @@ func (s *SubscriberFunc[T]) dispatch(ctx context.Context, vals *queue[DeliveredE
 			vals.Add(val)
 		case <-ctx.Done():
 			// Wait for the callback to be complete, but not forever.
-			s.slow.Reset(5 * slowSubscriberTimeout)
+			core.slow.Reset(5 * slowSubscriberTimeout)
 			select {
-			case <-s.slow.C:
-				s.logf("giving up on subscriber for %T after %v at close", t, time.Since(start))
+			case <-core.slow.C:
+				core.logf("giving up on subscriber for %s after %v at close", core.typeName, time.Since(start))
 				if cibuild.On() {
 					all := make([]byte, 2<<20)
 					n := runtime.Stack(all, true)
-					s.logf("goroutine stacks:\n%s", all[:n])
+					core.logf("goroutine stacks:\n%s", all[:n])
 				}
 			case <-callDone:
 			}
 			return false
 		case ch := <-snapshot:
 			ch <- vals.Snapshot()
-		case <-s.slow.C:
-			s.logf("subscriber for %T is slow (%v elapsed)", t, time.Since(start))
-			s.slow.Reset(slowSubscriberTimeout)
+		case <-core.slow.C:
+			core.logf("subscriber for %s is slow (%v elapsed)", core.typeName, time.Since(start))
+			core.slow.Reset(slowSubscriberTimeout)
 		}
 	}
 }
 
-// runCallback invokes the callback on v and closes ch when it returns.
-// This should be run in a goroutine.
-func (s *SubscriberFunc[T]) runCallback(v T, ch chan struct{}) {
-	defer close(ch)
-	s.read(v)
+// runFuncCallback runs f(t) and closes done when it returns. It is
+// the per-T worker spawned as a goroutine for each dispatched
+// event. Keeping it as a regular generic function (rather than a
+// closure) means `go runFuncCallback(f, t, done)` binds its
+// arguments to the goroutine's frame directly, with no per-event
+// closure allocation. The body is small (defer + one indirect
+// call), so the per-shape stencil cost is minimal.
+func runFuncCallback[T any](f func(T), t T, done chan struct{}) {
+	defer close(done)
+	f(t)
 }
diff --git a/util/execqueue/execqueue.go b/util/execqueue/execqueue.go
index b2c701437..e2681ae77 100644
--- a/util/execqueue/execqueue.go
+++ b/util/execqueue/execqueue.go
@@ -88,6 +88,36 @@ func (q *ExecQueue) Shutdown() {
 	}
 }
 
+// ShutdownAndWait signals the queue to stop, discards any queued
+// functions that have not started, and waits for the currently
+// executing function, if any, to complete or ctx to expire.
+//
+// It must not be called while holding a lock that a queued function
+// may acquire, or it will not return until ctx expires.
+func (q *ExecQueue) ShutdownAndWait(ctx context.Context) error {
+	q.mu.Lock()
+	q.closed = true
+	if q.cancel != nil {
+		q.cancel()
+	}
+	waitCh := q.doneWaiter
+	if q.inFlight && waitCh == nil {
+		waitCh = make(chan struct{})
+		q.doneWaiter = waitCh
+	}
+	q.mu.Unlock()
+
+	if waitCh == nil {
+		return nil
+	}
+	select {
+	case <-waitCh:
+		return nil
+	case <-ctx.Done():
+		return ctx.Err()
+	}
+}
+
 func (q *ExecQueue) initCtxLocked() {
 	if q.ctx == nil {
 		q.ctx, q.cancel = context.WithCancel(context.Background())
diff --git a/util/execqueue/execqueue_test.go b/util/execqueue/execqueue_test.go
index c9f3a449e..1c399e162 100644
--- a/util/execqueue/execqueue_test.go
+++ b/util/execqueue/execqueue_test.go
@@ -7,6 +7,8 @@ import (
 	"context"
 	"sync/atomic"
 	"testing"
+	"testing/synctest"
+	"time"
 )
 
 func TestExecQueue(t *testing.T) {
@@ -29,3 +31,55 @@ func TestExecQueueRunSyncLocking(t *testing.T) {
 		q.Shutdown()
 	})
 }
+
+func TestShutdownAndWait(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		q := &ExecQueue{}
+		started := make(chan struct{})
+		release := make(chan struct{})
+		var finished, ranPending atomic.Bool
+		q.Add(func() {
+			close(started)
+			<-release
+			finished.Store(true)
+		})
+		q.Add(func() { ranPending.Store(true) })
+		<-started
+
+		// The fake clock only advances once ShutdownAndWait below is
+		// blocked, so the release cannot fire early.
+		go func() {
+			time.Sleep(time.Second)
+			close(release)
+		}()
+		if err := q.ShutdownAndWait(context.Background()); err != nil {
+			t.Fatalf("ShutdownAndWait: %v", err)
+		}
+		if !finished.Load() {
+			t.Error("ShutdownAndWait returned before the in-flight function completed")
+		}
+		if ranPending.Load() {
+			t.Error("pending function ran after shutdown")
+		}
+	})
+}
+
+func TestShutdownAndWaitTimeout(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		q := &ExecQueue{}
+		started := make(chan struct{})
+		release := make(chan struct{})
+		q.Add(func() {
+			close(started)
+			<-release
+		})
+		<-started
+
+		ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+		defer cancel()
+		if err := q.ShutdownAndWait(ctx); err == nil {
+			t.Error("ShutdownAndWait = nil; want deadline exceeded")
+		}
+		close(release)
+	})
+}
diff --git a/util/expvarx/expvarx.go b/util/expvarx/expvarx.go
deleted file mode 100644
index 6dc2379b9..000000000
--- a/util/expvarx/expvarx.go
+++ /dev/null
@@ -1,89 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-// Package expvarx provides some extensions to the [expvar] package.
-package expvarx
-
-import (
-	"encoding/json"
-	"expvar"
-	"time"
-
-	"tailscale.com/syncs"
-	"tailscale.com/types/lazy"
-)
-
-// SafeFunc is a wrapper around [expvar.Func] that guards against unbounded call
-// time and ensures that only a single call is in progress at any given time.
-type SafeFunc struct {
-	f      expvar.Func
-	limit  time.Duration
-	onSlow func(time.Duration, any)
-
-	mu       syncs.Mutex
-	inflight *lazy.SyncValue[any]
-}
-
-// NewSafeFunc returns a new SafeFunc that wraps f.
-// If f takes longer than limit to execute then Value calls return nil.
-// If onSlow is non-nil, it is called when f takes longer than limit to execute.
-// onSlow is called with the duration of the slow call and the final computed
-// value.
-func NewSafeFunc(f expvar.Func, limit time.Duration, onSlow func(time.Duration, any)) *SafeFunc {
-	return &SafeFunc{f: f, limit: limit, onSlow: onSlow}
-}
-
-// Value acts similarly to [expvar.Func.Value], but if the underlying function
-// takes longer than the configured limit, all callers will receive nil until
-// the underlying operation completes. On completion of the underlying
-// operation, the onSlow callback is called if set.
-func (s *SafeFunc) Value() any {
-	s.mu.Lock()
-
-	if s.inflight == nil {
-		s.inflight = new(lazy.SyncValue[any])
-	}
-	var inflight = s.inflight
-	s.mu.Unlock()
-
-	// inflight ensures that only a single work routine is spawned at any given
-	// time, but if the routine takes too long inflight is populated with a nil
-	// result. The long running computed value is lost forever.
-	return inflight.Get(func() any {
-		start := time.Now()
-		result := make(chan any, 1)
-
-		// work is spawned in routine so that the caller can timeout.
-		go func() {
-			// Allow new work to be started after this work completes
-			defer func() {
-				s.mu.Lock()
-				s.inflight = nil
-				s.mu.Unlock()
-
-			}()
-
-			v := s.f.Value()
-			result <- v
-		}()
-
-		select {
-		case v := <-result:
-			return v
-		case <-time.After(s.limit):
-			if s.onSlow != nil {
-				go func() {
-					s.onSlow(time.Since(start), <-result)
-				}()
-			}
-			return nil
-		}
-	})
-}
-
-// String implements stringer in the same pattern as [expvar.Func], calling
-// Value and serializing the result as JSON, ignoring errors.
-func (s *SafeFunc) String() string {
-	v, _ := json.Marshal(s.Value())
-	return string(v)
-}
diff --git a/util/expvarx/expvarx_test.go b/util/expvarx/expvarx_test.go
deleted file mode 100644
index f8d2139d3..000000000
--- a/util/expvarx/expvarx_test.go
+++ /dev/null
@@ -1,141 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-package expvarx
-
-import (
-	"expvar"
-	"fmt"
-	"sync"
-	"sync/atomic"
-	"testing"
-	"testing/synctest"
-	"time"
-)
-
-func ExampleNewSafeFunc() {
-	// An artificial blocker to emulate a slow operation.
-	blocker := make(chan struct{})
-
-	// limit is the amount of time a call can take before Value returns nil. No
-	// new calls to the unsafe func will be started until the slow call
-	// completes, at which point onSlow will be called.
-	limit := time.Millisecond
-
-	// onSlow is called with the final call duration and the final value in the
-	// event a slow call.
-	onSlow := func(d time.Duration, v any) {
-		_ = d // d contains the time the call took
-		_ = v // v contains the final value computed by the slow call
-		fmt.Println("slow call!")
-	}
-
-	// An unsafe expvar.Func that blocks on the blocker channel.
-	unsafeFunc := expvar.Func(func() any {
-		for range blocker {
-		}
-		return "hello world"
-	})
-
-	// f implements the same interface as expvar.Func, but returns nil values
-	// when the unsafe func is too slow.
-	f := NewSafeFunc(unsafeFunc, limit, onSlow)
-
-	fmt.Println(f.Value())
-	fmt.Println(f.Value())
-	close(blocker)
-	time.Sleep(time.Millisecond)
-	fmt.Println(f.Value())
-	// Output: <nil>
-	// <nil>
-	// slow call!
-	// hello world
-}
-
-func TestSafeFuncHappyPath(t *testing.T) {
-	synctest.Test(t, func(t *testing.T) {
-		var count int
-		f := NewSafeFunc(expvar.Func(func() any {
-			count++
-			return count
-		}), time.Second, nil)
-
-		if got, want := f.Value(), 1; got != want {
-			t.Errorf("got %v, want %v", got, want)
-		}
-		time.Sleep(5 * time.Second) // (fake time in synctest)
-		if got, want := f.Value(), 2; got != want {
-			t.Errorf("got %v, want %v", got, want)
-		}
-	})
-}
-
-func TestSafeFuncSlow(t *testing.T) {
-	var count int
-	blocker := make(chan struct{})
-	var wg sync.WaitGroup
-	wg.Add(1)
-	f := NewSafeFunc(expvar.Func(func() any {
-		defer wg.Done()
-		count++
-		<-blocker
-		return count
-	}), time.Millisecond, nil)
-
-	if got := f.Value(); got != nil {
-		t.Errorf("got %v; want nil", got)
-	}
-	if got := f.Value(); got != nil {
-		t.Errorf("got %v; want nil", got)
-	}
-
-	close(blocker)
-	wg.Wait()
-
-	if count != 1 {
-		t.Errorf("got count=%d; want 1", count)
-	}
-}
-
-func TestSafeFuncSlowOnSlow(t *testing.T) {
-	var count int
-	blocker := make(chan struct{})
-	var wg sync.WaitGroup
-	wg.Add(2)
-	var slowDuration atomic.Pointer[time.Duration]
-	var slowCallCount atomic.Int32
-	var slowValue atomic.Value
-	f := NewSafeFunc(expvar.Func(func() any {
-		defer wg.Done()
-		count++
-		<-blocker
-		return count
-	}), time.Millisecond, func(d time.Duration, v any) {
-		defer wg.Done()
-		slowDuration.Store(&d)
-		slowCallCount.Add(1)
-		slowValue.Store(v)
-	})
-
-	for range 10 {
-		if got := f.Value(); got != nil {
-			t.Fatalf("got value=%v; want nil", got)
-		}
-	}
-
-	close(blocker)
-	wg.Wait()
-
-	if count != 1 {
-		t.Errorf("got count=%d; want 1", count)
-	}
-	if got, want := *slowDuration.Load(), 1*time.Millisecond; got < want {
-		t.Errorf("got slowDuration=%v; want at least %d", got, want)
-	}
-	if got, want := slowCallCount.Load(), int32(1); got != want {
-		t.Errorf("got slowCallCount=%d; want %d", got, want)
-	}
-	if got, want := slowValue.Load().(int), 1; got != want {
-		t.Errorf("got slowValue=%d, want %d", got, want)
-	}
-}
diff --git a/util/httpm/httpm_test.go b/util/httpm/httpm_test.go
index 4a36a38e1..a381c55d2 100644
--- a/util/httpm/httpm_test.go
+++ b/util/httpm/httpm_test.go
@@ -24,10 +24,23 @@ func TestUsedConsistently(t *testing.T) {
 		t.Skipf("skipping test since .git doesn't exist: %v", err)
 	}
 
+	// Open .git/index so Go's test cache tracks it as an input.
+	// The index file changes on git reset, checkout, pull, etc.,
+	// so the cache is properly invalidated when moving between commits.
+	if f, err := os.Open(filepath.Join(rootDir, ".git", "index")); err == nil {
+		f.Close()
+	}
+
 	cmd := exec.Command("git", "grep", "-l", "-F", "http.Method")
 	cmd.Dir = rootDir
 	matches, _ := cmd.Output()
 	for fn := range strings.SplitSeq(strings.TrimSpace(string(matches)), "\n") {
+		if strings.HasPrefix(fn, "tempfork/") {
+			// Files under tempfork are vendored copies of upstream
+			// code that we want to keep as close to upstream as
+			// possible, so don't hold them to this rule.
+			continue
+		}
 		switch fn {
 		case "util/httpm/httpm.go", "util/httpm/httpm_test.go":
 			continue
diff --git a/util/linuxfw/fake_netfilter.go b/util/linuxfw/fake_netfilter.go
index eac5d904c..903714b70 100644
--- a/util/linuxfw/fake_netfilter.go
+++ b/util/linuxfw/fake_netfilter.go
@@ -19,6 +19,8 @@ type FakeNetfilterRunner struct {
 		TailscaleServiceIP netip.Addr
 		ClusterIP          netip.Addr
 	}
+	// clampedAddrs tracks addresses passed to ClampMSSToPMTU.
+	clampedAddrs []netip.Addr
 }
 
 // NewFakeNetfilterRunner creates a new FakeNetfilterRunner.
@@ -83,9 +85,17 @@ func (f *FakeNetfilterRunner) DNATWithLoadBalancer(origDst netip.Addr, dsts []ne
 }
 func (f *FakeNetfilterRunner) EnsureSNATForDst(src, dst netip.Addr) error               { return nil }
 func (f *FakeNetfilterRunner) DNATNonTailscaleTraffic(tun string, dst netip.Addr) error { return nil }
-func (f *FakeNetfilterRunner) ClampMSSToPMTU(tun string, addr netip.Addr) error         { return nil }
-func (f *FakeNetfilterRunner) AddMagicsockPortRule(port uint16, network string) error   { return nil }
-func (f *FakeNetfilterRunner) DelMagicsockPortRule(port uint16, network string) error   { return nil }
+func (f *FakeNetfilterRunner) ClampMSSToPMTU(tun string, addr netip.Addr) error {
+	f.clampedAddrs = append(f.clampedAddrs, addr)
+	return nil
+}
+
+// GetClampedAddrs returns the addresses passed to ClampMSSToPMTU.
+func (f *FakeNetfilterRunner) GetClampedAddrs() []netip.Addr {
+	return f.clampedAddrs
+}
+func (f *FakeNetfilterRunner) AddMagicsockPortRule(port uint16, network string) error { return nil }
+func (f *FakeNetfilterRunner) DelMagicsockPortRule(port uint16, network string) error { return nil }
 func (f *FakeNetfilterRunner) DeletePortMapRuleForSvc(svc, tun string, targetIP netip.Addr, pm PortMap) error {
 	return nil
 }
@@ -95,3 +105,5 @@ func (f *FakeNetfilterRunner) DeleteSvc(svc, tun string, targetIPs []netip.Addr,
 func (f *FakeNetfilterRunner) EnsurePortMapRuleForSvc(svc, tun string, targetIP netip.Addr, pm PortMap) error {
 	return nil
 }
+func (f *FakeNetfilterRunner) AddExternalCGNATRules(mode CGNATMode, tunname string) error { return nil }
+func (f *FakeNetfilterRunner) DelExternalCGNATRules(mode CGNATMode, tunname string) error { return nil }
diff --git a/util/linuxfw/iptables_runner.go b/util/linuxfw/iptables_runner.go
index 0d50bdd61..ad983fb75 100644
--- a/util/linuxfw/iptables_runner.go
+++ b/util/linuxfw/iptables_runner.go
@@ -95,9 +95,21 @@ func tsChain(chain string) string {
 }
 
 // DelLoopbackRule removes the iptables rule permitting loopback
-// traffic to a Tailscale IP.
+// traffic to a Tailscale IP. A missing rule is not an error: an address
+// left on the interface by a previous tailscaled instance never went
+// through AddLoopbackRule in this one, so removing it must not be
+// blocked by the absence of its loopback rule.
 func (i *iptablesRunner) DelLoopbackRule(addr netip.Addr) error {
-	if err := i.getIPTByAddr(addr).Delete("filter", "ts-input", "-i", "lo", "-s", addr.String(), "-j", "ACCEPT"); err != nil {
+	ipt := i.getIPTByAddr(addr)
+	args := []string{"-i", "lo", "-s", addr.String(), "-j", "ACCEPT"}
+	exists, err := ipt.Exists("filter", "ts-input", args...)
+	if err != nil {
+		return fmt.Errorf("checking loopback allow rule for %q: %w", addr, err)
+	}
+	if !exists {
+		return nil
+	}
+	if err := ipt.Delete("filter", "ts-input", args...); err != nil {
 		return fmt.Errorf("deleting loopback allow rule for %q: %w", addr, err)
 	}
 
@@ -214,23 +226,8 @@ func (i *iptablesRunner) AddBase(tunname string) error {
 // addBase4 adds some basic IPv4 processing rules to be
 // supplemented by later calls to other helpers.
 func (i *iptablesRunner) addBase4(tunname string) error {
-	// Only allow CGNAT range traffic to come from tailscale0. There
-	// is an exception carved out for ranges used by ChromeOS, for
-	// which we fall out of the Tailscale chain.
-	//
-	// Note, this will definitely break nodes that end up using the
-	// CGNAT range for other purposes :(.
-	args := []string{"!", "-i", tunname, "-s", tsaddr.ChromeOSVMRange().String(), "-j", "RETURN"}
-	if err := i.ipt4.Append("filter", "ts-input", args...); err != nil {
-		return fmt.Errorf("adding %v in v4/filter/ts-input: %w", args, err)
-	}
-	args = []string{"!", "-i", tunname, "-s", tsaddr.CGNATRange().String(), "-j", "DROP"}
-	if err := i.ipt4.Append("filter", "ts-input", args...); err != nil {
-		return fmt.Errorf("adding %v in v4/filter/ts-input: %w", args, err)
-	}
-
-	// Explicitly allow all other inbound traffic to the tun interface
-	args = []string{"-i", tunname, "-j", "ACCEPT"}
+	// Explicitly allow all inbound traffic to the tun interface
+	args := []string{"-i", tunname, "-j", "ACCEPT"}
 	if err := i.ipt4.Append("filter", "ts-input", args...); err != nil {
 		return fmt.Errorf("adding %v in v4/filter/ts-input: %w", args, err)
 	}
@@ -337,7 +334,16 @@ func (i *iptablesRunner) DNATWithLoadBalancer(origDst netip.Addr, dsts []netip.A
 
 func (i *iptablesRunner) ClampMSSToPMTU(tun string, addr netip.Addr) error {
 	table := i.getIPTByAddr(addr)
-	return table.Append("mangle", "FORWARD", "-o", tun, "-p", "tcp", "--tcp-flags", "SYN,RST", "SYN", "-j", "TCPMSS", "--clamp-mss-to-pmtu")
+	// Clamp MSS on forwarded TCP handshakes in both directions: the SYN
+	// leaving via tun towards the tailnet peer, and the SYN-ACK arriving on
+	// tun and being forwarded back out towards the originating endpoint. A
+	// single -o tun rule only clamps one side of the handshake, leaving the
+	// endpoint on the other side advertising an MSS that is too large for the
+	// tun MTU, which black-holes large segments when PMTU discovery is broken.
+	if err := table.Append("mangle", "FORWARD", "-o", tun, "-p", "tcp", "--tcp-flags", "SYN,RST", "SYN", "-j", "TCPMSS", "--clamp-mss-to-pmtu"); err != nil {
+		return err
+	}
+	return table.Append("mangle", "FORWARD", "-i", tun, "-p", "tcp", "--tcp-flags", "SYN,RST", "SYN", "-j", "TCPMSS", "--clamp-mss-to-pmtu")
 }
 
 // addBase6 adds some basic IPv6 processing rules to be
@@ -551,10 +557,14 @@ func (i *iptablesRunner) AddConnmarkSaveRule() error {
 
 	// mangle/PREROUTING: Restore mark from conntrack for ESTABLISHED/RELATED connections
 	// This runs BEFORE routing decision and rp_filter check
+	// The connmark check ensures we only restore when Tailscale has marked the connection,
+	// preventing us from wiping mark bits set by other systems when ct mark is zero.
 	for _, ipt := range i.getTables() {
 		args := []string{
 			"-m", "conntrack",
 			"--ctstate", "ESTABLISHED,RELATED",
+			"-m", "connmark",
+			"!", "--mark", "0x0/" + fwmarkMask, // Only restore if ct mark has Tailscale bits set
 			"-j", "CONNMARK",
 			"--restore-mark",
 			"--nfmask", fwmarkMask,
@@ -592,6 +602,8 @@ func (i *iptablesRunner) DelConnmarkSaveRule() error {
 		args := []string{
 			"-m", "conntrack",
 			"--ctstate", "ESTABLISHED,RELATED",
+			"-m", "connmark",
+			"!", "--mark", "0x0/" + fwmarkMask,
 			"-j", "CONNMARK",
 			"--restore-mark",
 			"--nfmask", fwmarkMask,
@@ -682,6 +694,67 @@ func (i *iptablesRunner) DelMagicsockPortRule(port uint16, network string) error
 	return nil
 }
 
+// buildExternalCGNATRules abstracts out logic for constructing firewall rules
+// for handling non-Tailscale CGNAT traffic, since these rules need to be
+// identical across [AddExternalCGNATRules] and [DelExternalCGNATRules].
+func buildExternalCGNATRules(mode CGNATMode, tunname string) ([][]string, error) {
+	switch mode {
+	case CGNATModeDrop:
+		// Only allow CGNAT range traffic to come from the Tailscale interface.
+		// There is an exception carved out for ranges used by ChromeOS, for
+		// which we fall out of the Tailscale chain.
+		return [][]string{
+			{"!", "-i", tunname, "-s", tsaddr.ChromeOSVMRange().String(), "-j", "RETURN"},
+			{"!", "-i", tunname, "-s", tsaddr.CGNATRange().String(), "-j", "DROP"},
+		}, nil
+	case CGNATModeReturn:
+		// Fall out of the Tailscale chain for CGNAT traffic that doesn't
+		// originate from the Tailscale interface.
+		return [][]string{
+			{"!", "-i", tunname, "-s", tsaddr.CGNATRange().String(), "-j", "RETURN"},
+		}, nil
+	default:
+		return nil, fmt.Errorf("unsupported mode %q", mode)
+	}
+}
+
+// AddExternalCGNATRules adds rules to the ts-input chain to deal with
+// traffic from the CGNAT range that arrives on non-Tailscale network
+// interfaces.
+func (i *iptablesRunner) AddExternalCGNATRules(mode CGNATMode, tunname string) error {
+	rules, err := buildExternalCGNATRules(mode, tunname)
+	if err != nil {
+		return fmt.Errorf("build cgnat mode rule: %v", err)
+	}
+	for _, rule := range rules {
+		if err := i.ipt4.Append("filter", "ts-input", rule...); err != nil {
+			return fmt.Errorf("adding %v in v4/filter/ts-input: %w", rule, err)
+		}
+	}
+	return nil
+}
+
+// DelExternalCGNATRules removes the rules created by AddExternalCGNATRules,
+// if they exist.
+func (i *iptablesRunner) DelExternalCGNATRules(mode CGNATMode, tunname string) error {
+	rules, err := buildExternalCGNATRules(mode, tunname)
+	if err != nil {
+		return fmt.Errorf("build cgnat mode rule: %v", err)
+	}
+	for _, rule := range rules {
+		if found, err := i.ipt4.Exists("filter", "ts-input", rule...); err != nil {
+			return fmt.Errorf("checking for %v in v4/filter/ts-input: %w", rule, err)
+		} else if !found {
+			// Don't need to delete a rule that isn't there.
+			continue
+		}
+		if err := i.ipt4.Delete("filter", "ts-input", rule...); err != nil {
+			return fmt.Errorf("deleting %v in v4/filter/ts-input: %w", rule, err)
+		}
+	}
+	return nil
+}
+
 // delTSHook deletes hook in a chain that jumps to a ts-chain. If the hook does not
 // exist, it's a no-op since the desired state is already achieved but we log the
 // error because error code from the iptables module resists unwrapping.
diff --git a/util/linuxfw/iptables_runner_test.go b/util/linuxfw/iptables_runner_test.go
index 77c753004..f31080044 100644
--- a/util/linuxfw/iptables_runner_test.go
+++ b/util/linuxfw/iptables_runner_test.go
@@ -126,8 +126,6 @@ func TestAddAndDeleteBase(t *testing.T) {
 
 	// Check that the rules were created.
 	tsRulesV4 := []fakeRule{ // table/chain/rule
-		{"filter", "ts-input", []string{"!", "-i", tunname, "-s", tsaddr.ChromeOSVMRange().String(), "-j", "RETURN"}},
-		{"filter", "ts-input", []string{"!", "-i", tunname, "-s", tsaddr.CGNATRange().String(), "-j", "DROP"}},
 		{"filter", "ts-forward", []string{"-o", tunname, "-s", tsaddr.CGNATRange().String(), "-j", "DROP"}},
 	}
 
@@ -369,6 +367,8 @@ func TestAddAndDelConnmarkSaveRule(t *testing.T) {
 	preroutingArgs := []string{
 		"-m", "conntrack",
 		"--ctstate", "ESTABLISHED,RELATED",
+		"-m", "connmark",
+		"!", "--mark", "0x0/0xff0000",
 		"-j", "CONNMARK",
 		"--restore-mark",
 		"--nfmask", "0xff0000",
@@ -504,3 +504,89 @@ func TestAddAndDelConnmarkSaveRule(t *testing.T) {
 		}
 	})
 }
+
+func TestAddAndDelCGNATRules(t *testing.T) {
+	iptr := newFakeIPTablesRunner()
+	tunname := "tun0"
+
+	// We need the chains to exist so we can add rules into them.
+	if err := iptr.AddChains(); err != nil {
+		t.Fatal(err)
+	}
+
+	tests := []struct {
+		mode      CGNATMode
+		wantRules []fakeRule
+	}{
+		{
+			CGNATModeDrop, []fakeRule{
+				{"filter", "ts-input", []string{"!", "-i", tunname, "-s", tsaddr.ChromeOSVMRange().String(), "-j", "RETURN"}},
+				{"filter", "ts-input", []string{"!", "-i", tunname, "-s", tsaddr.CGNATRange().String(), "-j", "DROP"}},
+			},
+		},
+		{
+			CGNATModeReturn, []fakeRule{
+				{"filter", "ts-input", []string{"!", "-i", tunname, "-s", tsaddr.CGNATRange().String(), "-j", "RETURN"}},
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		if err := iptr.AddExternalCGNATRules(tt.mode, tunname); err != nil {
+			t.Fatal(err)
+		}
+
+		for _, tr := range tt.wantRules {
+			if exists, err := iptr.ipt4.Exists(tr.table, tr.chain, tr.args...); err != nil {
+				t.Fatalf("mode %q: error checking for rule: %v", tt.mode, err)
+			} else if !exists {
+				t.Errorf("mode %q: rule %s/%s/%s doesn't exist", tt.mode, tr.table, tr.chain, strings.Join(tr.args, " "))
+			}
+		}
+
+		if err := iptr.DelExternalCGNATRules(tt.mode, tunname); err != nil {
+			t.Fatal(err)
+		}
+
+		for _, tr := range tt.wantRules {
+			if exists, err := iptr.ipt4.Exists(tr.table, tr.chain, tr.args...); err != nil {
+				t.Fatalf("mode %q: error checking for rule: %v", tt.mode, err)
+			} else if exists {
+				t.Errorf("mode %q: rule %s/%s/%s not deleted", tt.mode, tr.table, tr.chain, strings.Join(tr.args, " "))
+			}
+		}
+	}
+}
+
+// TestDelLoopbackRuleMissing verifies DelLoopbackRule is a no-op (not an error)
+// when the rule is absent, so removing an address whose loopback rule was never
+// added in this instance -- e.g. one left on the interface by a previous
+// tailscaled -- isn't blocked. See tailscale/tailscale#19974.
+func TestDelLoopbackRuleMissing(t *testing.T) {
+	iptr := newFakeIPTablesRunner()
+	if err := iptr.AddChains(); err != nil {
+		t.Fatal(err)
+	}
+	defer iptr.DelChains()
+
+	addr := netip.MustParseAddr("100.64.0.99")
+	rule := []string{"-i", "lo", "-s", addr.String(), "-j", "ACCEPT"}
+
+	// No AddLoopbackRule for addr, so its rule is absent. Delete must not error.
+	if err := iptr.DelLoopbackRule(addr); err != nil {
+		t.Fatalf("DelLoopbackRule with no rule present: %v", err)
+	}
+
+	// And it still deletes the rule when present.
+	if err := iptr.AddLoopbackRule(addr); err != nil {
+		t.Fatal(err)
+	}
+	if err := iptr.DelLoopbackRule(addr); err != nil {
+		t.Fatalf("DelLoopbackRule with rule present: %v", err)
+	}
+	if exists, err := iptr.ipt4.Exists("filter", "ts-input", rule...); err != nil {
+		t.Fatal(err)
+	} else if exists {
+		t.Error("loopback rule still present after DelLoopbackRule")
+	}
+}
diff --git a/util/linuxfw/linuxfw.go b/util/linuxfw/linuxfw.go
index 325a5809f..eb2da1896 100644
--- a/util/linuxfw/linuxfw.go
+++ b/util/linuxfw/linuxfw.go
@@ -7,6 +7,7 @@
 package linuxfw
 
 import (
+	"encoding/binary"
 	"errors"
 	"fmt"
 	"os"
@@ -53,6 +54,13 @@ const (
 	FirewallModeNfTables FirewallMode = "nftables"
 )
 
+type CGNATMode string
+
+const (
+	CGNATModeDrop   CGNATMode = "DROP"
+	CGNATModeReturn CGNATMode = "RETURN"
+)
+
 // The following bits are added to packet marks for Tailscale use.
 //
 // We tried to pick bits sufficiently out of the way that it's
@@ -79,19 +87,28 @@ const (
 	bypassMarkNum      = tsconst.LinuxBypassMarkNum
 )
 
-// getTailscaleFwmarkMaskNeg returns the negation of TailscaleFwmarkMask in bytes.
+// getTailscaleFwmarkMaskNeg returns the negation of TailscaleFwmarkMask
+// in native byte order.
 func getTailscaleFwmarkMaskNeg() []byte {
-	return []byte{0xff, 0x00, 0xff, 0xff}
+	return nativeEndianUint32(^uint32(fwmarkMaskNum))
 }
 
-// getTailscaleFwmarkMask returns the TailscaleFwmarkMask in bytes.
+// getTailscaleFwmarkMask returns the TailscaleFwmarkMask in native byte order.
 func getTailscaleFwmarkMask() []byte {
-	return []byte{0x00, 0xff, 0x00, 0x00}
+	return nativeEndianUint32(fwmarkMaskNum)
 }
 
-// getTailscaleSubnetRouteMark returns the TailscaleSubnetRouteMark in bytes.
+// getTailscaleSubnetRouteMark returns the TailscaleSubnetRouteMark
+// in native byte order.
 func getTailscaleSubnetRouteMark() []byte {
-	return []byte{0x00, 0x04, 0x00, 0x00}
+	return nativeEndianUint32(subnetRouteMarkNum)
+}
+
+// nativeEndianUint32 returns v as a 4-byte slice in the host's native byte order.
+func nativeEndianUint32(v uint32) []byte {
+	b := make([]byte, 4)
+	binary.NativeEndian.PutUint32(b, v)
+	return b
 }
 
 // checkIPv6ForTest can be set in tests.
diff --git a/util/linuxfw/linuxfwtest/linuxfwtest.go b/util/linuxfw/linuxfwtest/linuxfwtest.go
deleted file mode 100644
index bf1477ad9..000000000
--- a/util/linuxfw/linuxfwtest/linuxfwtest.go
+++ /dev/null
@@ -1,31 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-//go:build cgo && linux
-
-// Package linuxfwtest contains tests for the linuxfw package. Go does not
-// support cgo in tests, and we don't want the main package to have a cgo
-// dependency, so we put all the tests here and call them from the main package
-// in tests intead.
-package linuxfwtest
-
-import (
-	"testing"
-	"unsafe"
-)
-
-/*
-#include <sys/socket.h>  // socket()
-*/
-import "C"
-
-type SizeInfo struct {
-	SizeofSocklen uintptr
-}
-
-func TestSizes(t *testing.T, si *SizeInfo) {
-	want := unsafe.Sizeof(C.socklen_t(0))
-	if want != si.SizeofSocklen {
-		t.Errorf("sockLen has wrong size; want=%d got=%d", want, si.SizeofSocklen)
-	}
-}
diff --git a/util/linuxfw/linuxfwtest/linuxfwtest_unsupported.go b/util/linuxfw/linuxfwtest/linuxfwtest_unsupported.go
deleted file mode 100644
index ec2d24d35..000000000
--- a/util/linuxfw/linuxfwtest/linuxfwtest_unsupported.go
+++ /dev/null
@@ -1,18 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-//go:build !cgo || !linux
-
-package linuxfwtest
-
-import (
-	"testing"
-)
-
-type SizeInfo struct {
-	SizeofSocklen uintptr
-}
-
-func TestSizes(t *testing.T, si *SizeInfo) {
-	t.Skip("not supported without cgo")
-}
diff --git a/util/linuxfw/nftables_runner.go b/util/linuxfw/nftables_runner.go
index cdb1c5bfb..dd0961883 100644
--- a/util/linuxfw/nftables_runner.go
+++ b/util/linuxfw/nftables_runner.go
@@ -248,11 +248,16 @@ func (n *nftablesRunner) EnsureSNATForDst(src, dst netip.Addr) error {
 
 // ClampMSSToPMTU ensures that all packets with TCP flags (SYN, ACK, RST) set
 // being forwarded via the given interface (tun) have MSS set to <MTU of the
-// interface> - 40 (IP and TCP headers). This can be useful if this tailscale
-// instance is expected to run as a forwarding proxy, forwarding packets from an
-// endpoint with higher MTU in an environment where path MTU discovery is
-// expected to not work (such as the proxies created by the Tailscale Kubernetes
-// operator). ClamMSSToPMTU creates a new base-chain ts-clamp in the filter
+// interface> - 40 (IP and TCP headers). It clamps both directions of a
+// forwarded TCP handshake: the SYN leaving via tun and the SYN-ACK arriving on
+// tun. Clamping only the output direction would leave the endpoint on the other
+// side of the proxy advertising an MSS that is too large for the tun MTU,
+// black-holing large segments when path MTU discovery is broken. This can be
+// useful if this tailscale instance is expected to run as a forwarding proxy,
+// forwarding packets from an endpoint with higher MTU in an environment where
+// path MTU discovery is expected to not work (such as the proxies created by
+// the Tailscale Kubernetes operator). ClampMSSToPMTU creates a new base-chain
+// ts-clamp in the filter
 // table with accept policy and priority -150. In practice, this means that for
 // SYN packets the clamp rule in this chain will likely run first and accept the
 // packet. This is fine because 1) nftables run ALL chains with the same hook
@@ -289,61 +294,75 @@ func (n *nftablesRunner) ClampMSSToPMTU(tun string, addr netip.Addr) error {
 		return fmt.Errorf("error ensuring forward chain: %w", err)
 	}
 
-	clampRule := &nftables.Rule{
-		Table: filterTable,
-		Chain: fwChain,
-		Exprs: []expr.Any{
-			&expr.Meta{Key: expr.MetaKeyOIFNAME, Register: 1},
-			&expr.Cmp{
-				Op:       expr.CmpOpEq,
-				Register: 1,
-				Data:     []byte(tun),
+	// clampRuleForIface builds a rule that clamps the MSS of forwarded TCP
+	// handshake packets matching tun on the given interface-name meta key.
+	// ifaceKey is either expr.MetaKeyOIFNAME (packets leaving via tun) or
+	// expr.MetaKeyIIFNAME (packets arriving on tun).
+	clampRuleForIface := func(ifaceKey expr.MetaKey) *nftables.Rule {
+		return &nftables.Rule{
+			Table: filterTable,
+			Chain: fwChain,
+			Exprs: []expr.Any{
+				&expr.Meta{Key: ifaceKey, Register: 1},
+				&expr.Cmp{
+					Op:       expr.CmpOpEq,
+					Register: 1,
+					Data:     []byte(tun),
+				},
+				&expr.Meta{Key: expr.MetaKeyL4PROTO, Register: 1},
+				&expr.Cmp{
+					Op:       expr.CmpOpEq,
+					Register: 1,
+					Data:     []byte{unix.IPPROTO_TCP},
+				},
+				&expr.Payload{
+					DestRegister: 1,
+					Base:         expr.PayloadBaseTransportHeader,
+					Offset:       13,
+					Len:          1,
+				},
+				&expr.Bitwise{
+					DestRegister:   1,
+					SourceRegister: 1,
+					Len:            1,
+					Mask:           []byte{0x02},
+					Xor:            []byte{0x00},
+				},
+				&expr.Cmp{
+					Op:       expr.CmpOpNeq, // match any packet with a TCP flag set (SYN, ACK, RST)
+					Register: 1,
+					Data:     []byte{0x00},
+				},
+				&expr.Rt{
+					Register: 1,
+					Key:      expr.RtTCPMSS,
+				},
+				&expr.Byteorder{
+					DestRegister:   1,
+					SourceRegister: 1,
+					Op:             expr.ByteorderHton,
+					Len:            2,
+					Size:           2,
+				},
+				&expr.Exthdr{
+					SourceRegister: 1,
+					Type:           2,
+					Offset:         2,
+					Len:            2,
+					Op:             expr.ExthdrOpTcpopt,
+				},
 			},
-			&expr.Meta{Key: expr.MetaKeyL4PROTO, Register: 1},
-			&expr.Cmp{
-				Op:       expr.CmpOpEq,
-				Register: 1,
-				Data:     []byte{unix.IPPROTO_TCP},
-			},
-			&expr.Payload{
-				DestRegister: 1,
-				Base:         expr.PayloadBaseTransportHeader,
-				Offset:       13,
-				Len:          1,
-			},
-			&expr.Bitwise{
-				DestRegister:   1,
-				SourceRegister: 1,
-				Len:            1,
-				Mask:           []byte{0x02},
-				Xor:            []byte{0x00},
-			},
-			&expr.Cmp{
-				Op:       expr.CmpOpNeq, // match any packet with a TCP flag set (SYN, ACK, RST)
-				Register: 1,
-				Data:     []byte{0x00},
-			},
-			&expr.Rt{
-				Register: 1,
-				Key:      expr.RtTCPMSS,
-			},
-			&expr.Byteorder{
-				DestRegister:   1,
-				SourceRegister: 1,
-				Op:             expr.ByteorderHton,
-				Len:            2,
-				Size:           2,
-			},
-			&expr.Exthdr{
-				SourceRegister: 1,
-				Type:           2,
-				Offset:         2,
-				Len:            2,
-				Op:             expr.ExthdrOpTcpopt,
-			},
-		},
+		}
 	}
-	n.conn.AddRule(clampRule)
+
+	// Clamp both directions of the forwarded handshake: the SYN leaving via
+	// tun towards the tailnet peer, and the SYN-ACK arriving on tun and being
+	// forwarded back out towards the originating endpoint. Matching only the
+	// output interface leaves the endpoint on the other side advertising an MSS
+	// that is too large for the tun MTU, which black-holes large segments when
+	// PMTU discovery is broken.
+	n.conn.AddRule(clampRuleForIface(expr.MetaKeyOIFNAME))
+	n.conn.AddRule(clampRuleForIface(expr.MetaKeyIIFNAME))
 	return n.conn.Flush()
 }
 
@@ -416,6 +435,9 @@ func (e errorChainNotFound) Error() string {
 // getChainFromTable returns the chain with the given name from the given table.
 // Note that a chain name is unique within a table.
 func getChainFromTable(c *nftables.Conn, table *nftables.Table, name string) (*nftables.Chain, error) {
+	if table == nil {
+		return nil, fmt.Errorf("could not get chain %q: table not initialized", name)
+	}
 	chains, err := c.ListChainsOfTableFamily(table.Family)
 	if err != nil {
 		return nil, fmt.Errorf("list chains: %w", err)
@@ -453,8 +475,13 @@ func getOrCreateChain(c *nftables.Conn, cinfo chainInfo) (*nftables.Chain, error
 		// type/hook/priority, but for "conventional chains" assume they're what
 		// we expect (in case iptables-nft/ufw make minor behavior changes in
 		// the future).
-		if isTSChain(chain.Name) && (chain.Type != cinfo.chainType || *chain.Hooknum != *cinfo.chainHook || *chain.Priority != *cinfo.chainPriority) {
-			return nil, fmt.Errorf("chain %s already exists with different type/hook/priority", cinfo.name)
+		if isTSChain(chain.Name) {
+			if chain.Hooknum == nil || chain.Priority == nil {
+				return nil, errors.New("nftables chain has nil hooknum or priority; kernel may lack nftables support (CONFIG_NF_TABLES)")
+			}
+			if chain.Type != cinfo.chainType || *chain.Hooknum != *cinfo.chainHook || *chain.Priority != *cinfo.chainPriority {
+				return nil, fmt.Errorf("chain %s already exists with different type/hook/priority", cinfo.name)
+			}
 		}
 		return chain, nil
 	}
@@ -576,8 +603,9 @@ type NetfilterRunner interface {
 
 	DeleteSvc(svc, tun string, targetIPs []netip.Addr, pm []PortMap) error
 
-	// ClampMSSToPMTU adds a rule to the mangle/FORWARD chain to clamp MSS for
-	// traffic destined for the provided tun interface.
+	// ClampMSSToPMTU adds rules to clamp the MSS of forwarded TCP handshake
+	// packets in both directions (entering and leaving the provided tun
+	// interface), so both endpoints negotiate an MSS that fits the tun MTU.
 	ClampMSSToPMTU(tun string, addr netip.Addr) error
 
 	// AddMagicsockPortRule adds a rule to the ts-input chain to accept
@@ -588,6 +616,15 @@ type NetfilterRunner interface {
 	// DelMagicsockPortRule removes the rule created by AddMagicsockPortRule,
 	// if it exists.
 	DelMagicsockPortRule(port uint16, network string) error
+
+	// AddExternalCGNATRules adds rules to the ts-input chain to deal with
+	// traffic from the CGNAT range that arrives on non-Tailscale network
+	// interfaces.
+	AddExternalCGNATRules(mode CGNATMode, tunname string) error
+
+	// DelExternalCGNATRules removes the rules created by AddExternalCGNATRules,
+	// if they exist.
+	DelExternalCGNATRules(mode CGNATMode, tunname string) error
 }
 
 // New creates a NetfilterRunner, auto-detecting whether to use
@@ -1216,6 +1253,27 @@ func addReturnChromeOSVMRangeRule(c *nftables.Conn, table *nftables.Table, chain
 	return nil
 }
 
+// delReturnChromeOSVMRangeRule deletes the rule created by addReturnChromeOSVMRangeRule,
+// if it exists.
+func delReturnChromeOSVMRangeRule(c *nftables.Conn, table *nftables.Table, chain *nftables.Chain, tunname string) error {
+	rule, err := createRangeRule(table, chain, tunname, tsaddr.ChromeOSVMRange(), expr.VerdictReturn)
+	if err != nil {
+		return fmt.Errorf("create rule: %w", err)
+	}
+	rule, err = findRule(c, rule)
+	if err != nil {
+		return fmt.Errorf("find rule: %v", err)
+	}
+	if rule == nil {
+		return nil
+	}
+	_ = c.DelRule(rule)
+	if err := c.Flush(); err != nil {
+		return fmt.Errorf("flush del rule: %w", err)
+	}
+	return nil
+}
+
 // addDropCGNATRangeRule adds a rule to drop if the source IP is in the
 // CGNAT range.
 func addDropCGNATRangeRule(c *nftables.Conn, table *nftables.Table, chain *nftables.Chain, tunname string) error {
@@ -1230,6 +1288,62 @@ func addDropCGNATRangeRule(c *nftables.Conn, table *nftables.Table, chain *nftab
 	return nil
 }
 
+// delDropCGNATRangeRule deletes the rule created by addDropCGNATRangeRule,
+// if it exists.
+func delDropCGNATRangeRule(c *nftables.Conn, table *nftables.Table, chain *nftables.Chain, tunname string) error {
+	rule, err := createRangeRule(table, chain, tunname, tsaddr.CGNATRange(), expr.VerdictDrop)
+	if err != nil {
+		return fmt.Errorf("create rule: %w", err)
+	}
+	rule, err = findRule(c, rule)
+	if err != nil {
+		return fmt.Errorf("find rule: %v", err)
+	}
+	if rule == nil {
+		return nil
+	}
+	_ = c.DelRule(rule)
+	if err := c.Flush(); err != nil {
+		return fmt.Errorf("flush del rule: %w", err)
+	}
+	return nil
+}
+
+// addReturnCGNATRangeRule adds a rule to return if the source IP is in the
+// CGNAT range.
+func addReturnCGNATRangeRule(c *nftables.Conn, table *nftables.Table, chain *nftables.Chain, tunname string) error {
+	rule, err := createRangeRule(table, chain, tunname, tsaddr.CGNATRange(), expr.VerdictReturn)
+	if err != nil {
+		return fmt.Errorf("create rule: %w", err)
+	}
+	_ = c.AddRule(rule)
+	if err = c.Flush(); err != nil {
+		return fmt.Errorf("add rule: %w", err)
+	}
+	return nil
+}
+
+// delReturnCGNATRangeRule deletes the rule created by addReturnCGNATRangeRule,
+// if it exists.
+func delReturnCGNATRangeRule(c *nftables.Conn, table *nftables.Table, chain *nftables.Chain, tunname string) error {
+	rule, err := createRangeRule(table, chain, tunname, tsaddr.CGNATRange(), expr.VerdictReturn)
+	if err != nil {
+		return fmt.Errorf("create rule: %w", err)
+	}
+	rule, err = findRule(c, rule)
+	if err != nil {
+		return fmt.Errorf("find rule: %v", err)
+	}
+	if rule == nil {
+		return nil
+	}
+	_ = c.DelRule(rule)
+	if err := c.Flush(); err != nil {
+		return fmt.Errorf("flush del rule: %w", err)
+	}
+	return nil
+}
+
 // createSetSubnetRouteMarkRule creates a rule to set the subnet route
 // mark if the packet is from the given interface.
 func createSetSubnetRouteMarkRule(table *nftables.Table, chain *nftables.Chain, tunname string) (*nftables.Rule, error) {
@@ -1497,6 +1611,67 @@ func (n *nftablesRunner) DelMagicsockPortRule(port uint16, network string) error
 	return nil
 }
 
+// AddExternalCGNATRules adds rules to the ts-input chain to deal with
+// traffic from the CGNAT range that arrives on non-Tailscale network
+// interfaces.
+func (n *nftablesRunner) AddExternalCGNATRules(mode CGNATMode, tunname string) error {
+	conn := n.conn
+
+	inputChain, err := getChainFromTable(conn, n.nft4.Filter, chainNameInput)
+	if err != nil {
+		return fmt.Errorf("get input chain v4: %v", err)
+	}
+	switch mode {
+	case CGNATModeDrop:
+		if err = addReturnChromeOSVMRangeRule(conn, n.nft4.Filter, inputChain, tunname); err != nil {
+			return fmt.Errorf("add return chromeos vm range rule v4: %w", err)
+		}
+		if err = addDropCGNATRangeRule(conn, n.nft4.Filter, inputChain, tunname); err != nil {
+			return fmt.Errorf("add drop cgnat range rule v4: %w", err)
+		}
+	case CGNATModeReturn:
+		if err = addReturnCGNATRangeRule(conn, n.nft4.Filter, inputChain, tunname); err != nil {
+			return fmt.Errorf("add return cgnat range rule v4: %w", err)
+		}
+	default:
+		return fmt.Errorf("unsupported cgnat mode %q", mode)
+	}
+	if err = conn.Flush(); err != nil {
+		return fmt.Errorf("flush cgnat rules v4: %w", err)
+	}
+	return nil
+}
+
+// DelExternalCGNATRules removes the rules created by AddExternalCGNATRules,
+// if they exist.
+func (n *nftablesRunner) DelExternalCGNATRules(mode CGNATMode, tunname string) error {
+	conn := n.conn
+
+	inputChain, err := getChainFromTable(conn, n.nft4.Filter, chainNameInput)
+	if err != nil {
+		return fmt.Errorf("get input chain v4: %v", err)
+	}
+	switch mode {
+	case CGNATModeDrop:
+		if err = delReturnChromeOSVMRangeRule(conn, n.nft4.Filter, inputChain, tunname); err != nil {
+			return fmt.Errorf("del return chromeos vm range rule v4: %w", err)
+		}
+		if err = delDropCGNATRangeRule(conn, n.nft4.Filter, inputChain, tunname); err != nil {
+			return fmt.Errorf("del drop cgnat range rule v4: %w", err)
+		}
+	case CGNATModeReturn:
+		if err = delReturnCGNATRangeRule(conn, n.nft4.Filter, inputChain, tunname); err != nil {
+			return fmt.Errorf("del return cgnat range rule v4: %w", err)
+		}
+	default:
+		return fmt.Errorf("unsupported mode %q", mode)
+	}
+	if err = conn.Flush(); err != nil {
+		return fmt.Errorf("flush cgnat rules v4: %w", err)
+	}
+	return nil
+}
+
 // createAcceptIncomingPacketRule creates a rule to accept incoming packets to
 // the given interface.
 func createAcceptIncomingPacketRule(table *nftables.Table, chain *nftables.Chain, tunname string) *nftables.Rule {
@@ -1550,12 +1725,6 @@ func (n *nftablesRunner) addBase4(tunname string) error {
 	if err != nil {
 		return fmt.Errorf("get input chain v4: %v", err)
 	}
-	if err = addReturnChromeOSVMRangeRule(conn, n.nft4.Filter, inputChain, tunname); err != nil {
-		return fmt.Errorf("add return chromeos vm range rule v4: %w", err)
-	}
-	if err = addDropCGNATRangeRule(conn, n.nft4.Filter, inputChain, tunname); err != nil {
-		return fmt.Errorf("add drop cgnat range rule v4: %w", err)
-	}
 	if err = addAcceptIncomingPacketRule(conn, n.nft4.Filter, inputChain, tunname); err != nil {
 		return fmt.Errorf("add accept incoming packet rule v4: %w", err)
 	}
@@ -1771,9 +1940,7 @@ func (n *nftablesRunner) DelSNATRule() error {
 }
 
 func nativeUint32(v uint32) []byte {
-	b := make([]byte, 4)
-	binary.NativeEndian.PutUint32(b, v)
-	return b
+	return nativeEndianUint32(v)
 }
 
 func makeStatefulRuleExprs(tunname string) []expr.Any {
@@ -1960,6 +2127,24 @@ func (n *nftablesRunner) DelStatefulRule(tunname string) error {
 
 // makeConnmarkRestoreExprs creates nftables expressions to restore mark from conntrack.
 // Implements: ct state established,related ct mark & 0xff0000 != 0 meta mark set ct mark & 0xff0000
+//
+// LIMITATION: Unlike iptables CONNMARK --restore-mark with --nfmask, this implementation
+// overwrites non-Tailscale bits in the packet mark rather than merging them. This is a
+// fundamental limitation of the Linux kernel's nftables expression VM (not the Go library).
+//
+// The nftables Bitwise expression only supports: (register & CONSTANT_MASK) ^ CONSTANT_XOR.
+// It cannot perform register-to-register operations needed for perfect bit preservation:
+//
+//	meta mark = (meta mark & ~0xff0000) | (ct mark & 0xff0000)
+//	                 ^^^^^                   ^^^^^^^
+//	            needs meta mark         and ct mark combined
+//
+// In contrast, iptables CONNMARK is a specialized kernel module with custom C code that
+// can atomically merge marks from different sources.
+//
+// The conditional check (ct mark & 0xff0000 != 0) prevents the worst case of wiping all
+// mark bits to zero. Perfect bit preservation would require kernel
+// changes to add register-to-register bitwise operations to nftables.
 func makeConnmarkRestoreExprs() []expr.Any {
 	return []expr.Any{
 		// Load conntrack state into register 1
@@ -1995,7 +2180,13 @@ func makeConnmarkRestoreExprs() []expr.Any {
 			Mask:           getTailscaleFwmarkMask(),
 			Xor:            []byte{0x00, 0x00, 0x00, 0x00},
 		},
-		// Set packet mark from register 1
+		// Check if masked ct mark is non-zero (critical: prevents wiping marks with 0)
+		&expr.Cmp{
+			Op:       expr.CmpOpNeq,
+			Register: 1,
+			Data:     []byte{0, 0, 0, 0},
+		},
+		// Set packet mark from register 1 (contains ct mark & 0xff0000)
 		&expr.Meta{
 			Key:            expr.MetaKeyMARK,
 			SourceRegister: true,
diff --git a/util/linuxfw/nftables_runner_test.go b/util/linuxfw/nftables_runner_test.go
index 17945e245..5aa418378 100644
--- a/util/linuxfw/nftables_runner_test.go
+++ b/util/linuxfw/nftables_runner_test.go
@@ -10,7 +10,6 @@ import (
 	"errors"
 	"fmt"
 	"net/netip"
-	"os"
 	"runtime"
 	"slices"
 	"strings"
@@ -299,7 +298,7 @@ func TestAddSetSubnetRouteMarkRule(t *testing.T) {
 		// nft add chain ip ts-filter-test ts-forward-test { type filter hook forward priority 0\; }
 		[]byte("\x02\x00\x00\x00\x13\x00\x01\x00\x74\x73\x2d\x66\x69\x6c\x74\x65\x72\x2d\x74\x65\x73\x74\x00\x00\x14\x00\x03\x00\x74\x73\x2d\x66\x6f\x72\x77\x61\x72\x64\x2d\x74\x65\x73\x74\x00\x14\x00\x04\x80\x08\x00\x01\x00\x00\x00\x00\x02\x08\x00\x02\x00\x00\x00\x00\x00\x0b\x00\x07\x00\x66\x69\x6c\x74\x65\x72\x00\x00"),
 		// nft add rule ip ts-filter-test ts-forward-test iifname "testTunn" counter meta mark set mark and 0xff00ffff xor 0x40000
-		[]byte("\x02\x00\x00\x00\x13\x00\x01\x00\x74\x73\x2d\x66\x69\x6c\x74\x65\x72\x2d\x74\x65\x73\x74\x00\x00\x14\x00\x02\x00\x74\x73\x2d\x66\x6f\x72\x77\x61\x72\x64\x2d\x74\x65\x73\x74\x00\x10\x01\x04\x80\x24\x00\x01\x80\x09\x00\x01\x00\x6d\x65\x74\x61\x00\x00\x00\x00\x14\x00\x02\x80\x08\x00\x02\x00\x00\x00\x00\x06\x08\x00\x01\x00\x00\x00\x00\x01\x30\x00\x01\x80\x08\x00\x01\x00\x63\x6d\x70\x00\x24\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x01\x08\x00\x02\x00\x00\x00\x00\x00\x10\x00\x03\x80\x0c\x00\x01\x00\x74\x65\x73\x74\x54\x75\x6e\x6e\x2c\x00\x01\x80\x0c\x00\x01\x00\x63\x6f\x75\x6e\x74\x65\x72\x00\x1c\x00\x02\x80\x0c\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x24\x00\x01\x80\x09\x00\x01\x00\x6d\x65\x74\x61\x00\x00\x00\x00\x14\x00\x02\x80\x08\x00\x02\x00\x00\x00\x00\x03\x08\x00\x01\x00\x00\x00\x00\x01\x44\x00\x01\x80\x0c\x00\x01\x00\x62\x69\x74\x77\x69\x73\x65\x00\x34\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x01\x08\x00\x02\x00\x00\x00\x00\x01\x08\x00\x03\x00\x00\x00\x00\x04\x0c\x00\x04\x80\x08\x00\x01\x00\xff\x00\xff\xff\x0c\x00\x05\x80\x08\x00\x01\x00\x00\x04\x00\x00\x24\x00\x01\x80\x09\x00\x01\x00\x6d\x65\x74\x61\x00\x00\x00\x00\x14\x00\x02\x80\x08\x00\x02\x00\x00\x00\x00\x03\x08\x00\x03\x00\x00\x00\x00\x01"),
+		[]byte("\x02\x00\x00\x00\x13\x00\x01\x00\x74\x73\x2d\x66\x69\x6c\x74\x65\x72\x2d\x74\x65\x73\x74\x00\x00\x14\x00\x02\x00\x74\x73\x2d\x66\x6f\x72\x77\x61\x72\x64\x2d\x74\x65\x73\x74\x00\x10\x01\x04\x80\x24\x00\x01\x80\x09\x00\x01\x00\x6d\x65\x74\x61\x00\x00\x00\x00\x14\x00\x02\x80\x08\x00\x02\x00\x00\x00\x00\x06\x08\x00\x01\x00\x00\x00\x00\x01\x30\x00\x01\x80\x08\x00\x01\x00\x63\x6d\x70\x00\x24\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x01\x08\x00\x02\x00\x00\x00\x00\x00\x10\x00\x03\x80\x0c\x00\x01\x00\x74\x65\x73\x74\x54\x75\x6e\x6e\x2c\x00\x01\x80\x0c\x00\x01\x00\x63\x6f\x75\x6e\x74\x65\x72\x00\x1c\x00\x02\x80\x0c\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x24\x00\x01\x80\x09\x00\x01\x00\x6d\x65\x74\x61\x00\x00\x00\x00\x14\x00\x02\x80\x08\x00\x02\x00\x00\x00\x00\x03\x08\x00\x01\x00\x00\x00\x00\x01\x44\x00\x01\x80\x0c\x00\x01\x00\x62\x69\x74\x77\x69\x73\x65\x00\x34\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x01\x08\x00\x02\x00\x00\x00\x00\x01\x08\x00\x03\x00\x00\x00\x00\x04\x0c\x00\x04\x80\x08\x00\x01\x00\xff\xff\x00\xff\x0c\x00\x05\x80\x08\x00\x01\x00\x00\x00\x04\x00\x24\x00\x01\x80\x09\x00\x01\x00\x6d\x65\x74\x61\x00\x00\x00\x00\x14\x00\x02\x80\x08\x00\x02\x00\x00\x00\x00\x03\x08\x00\x03\x00\x00\x00\x00\x01"),
 		// batch end
 		[]byte("\x00\x00\x00\x0a"),
 	}
@@ -427,7 +426,7 @@ func TestAddMatchSubnetRouteMarkRuleMasq(t *testing.T) {
 		// nft add chain ip ts-nat-test ts-postrouting-test { type nat hook postrouting priority 100; }
 		[]byte("\x02\x00\x00\x00\x10\x00\x01\x00\x74\x73\x2d\x6e\x61\x74\x2d\x74\x65\x73\x74\x00\x18\x00\x03\x00\x74\x73\x2d\x70\x6f\x73\x74\x72\x6f\x75\x74\x69\x6e\x67\x2d\x74\x65\x73\x74\x00\x14\x00\x04\x80\x08\x00\x01\x00\x00\x00\x00\x04\x08\x00\x02\x00\x00\x00\x00\x64\x08\x00\x07\x00\x6e\x61\x74\x00"),
 		// nft add rule ip ts-nat-test ts-postrouting-test meta mark & 0x00ff0000 == 0x00040000 counter masquerade
-		[]byte("\x02\x00\x00\x00\x10\x00\x01\x00\x74\x73\x2d\x6e\x61\x74\x2d\x74\x65\x73\x74\x00\x18\x00\x02\x00\x74\x73\x2d\x70\x6f\x73\x74\x72\x6f\x75\x74\x69\x6e\x67\x2d\x74\x65\x73\x74\x00\xd8\x00\x04\x80\x24\x00\x01\x80\x09\x00\x01\x00\x6d\x65\x74\x61\x00\x00\x00\x00\x14\x00\x02\x80\x08\x00\x02\x00\x00\x00\x00\x03\x08\x00\x01\x00\x00\x00\x00\x01\x44\x00\x01\x80\x0c\x00\x01\x00\x62\x69\x74\x77\x69\x73\x65\x00\x34\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x01\x08\x00\x02\x00\x00\x00\x00\x01\x08\x00\x03\x00\x00\x00\x00\x04\x0c\x00\x04\x80\x08\x00\x01\x00\x00\xff\x00\x00\x0c\x00\x05\x80\x08\x00\x01\x00\x00\x00\x00\x00\x2c\x00\x01\x80\x08\x00\x01\x00\x63\x6d\x70\x00\x20\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x01\x08\x00\x02\x00\x00\x00\x00\x00\x0c\x00\x03\x80\x08\x00\x01\x00\x00\x04\x00\x00\x2c\x00\x01\x80\x0c\x00\x01\x00\x63\x6f\x75\x6e\x74\x65\x72\x00\x1c\x00\x02\x80\x0c\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x01\x80\x09\x00\x01\x00\x6d\x61\x73\x71\x00\x00\x00\x00\x04\x00\x02\x80"),
+		[]byte("\x02\x00\x00\x00\x10\x00\x01\x00\x74\x73\x2d\x6e\x61\x74\x2d\x74\x65\x73\x74\x00\x18\x00\x02\x00\x74\x73\x2d\x70\x6f\x73\x74\x72\x6f\x75\x74\x69\x6e\x67\x2d\x74\x65\x73\x74\x00\xd8\x00\x04\x80\x24\x00\x01\x80\x09\x00\x01\x00\x6d\x65\x74\x61\x00\x00\x00\x00\x14\x00\x02\x80\x08\x00\x02\x00\x00\x00\x00\x03\x08\x00\x01\x00\x00\x00\x00\x01\x44\x00\x01\x80\x0c\x00\x01\x00\x62\x69\x74\x77\x69\x73\x65\x00\x34\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x01\x08\x00\x02\x00\x00\x00\x00\x01\x08\x00\x03\x00\x00\x00\x00\x04\x0c\x00\x04\x80\x08\x00\x01\x00\x00\x00\xff\x00\x0c\x00\x05\x80\x08\x00\x01\x00\x00\x00\x00\x00\x2c\x00\x01\x80\x08\x00\x01\x00\x63\x6d\x70\x00\x20\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x01\x08\x00\x02\x00\x00\x00\x00\x00\x0c\x00\x03\x80\x08\x00\x01\x00\x00\x00\x04\x00\x2c\x00\x01\x80\x0c\x00\x01\x00\x63\x6f\x75\x6e\x74\x65\x72\x00\x1c\x00\x02\x80\x0c\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x01\x80\x09\x00\x01\x00\x6d\x61\x73\x71\x00\x00\x00\x00\x04\x00\x02\x80"),
 		// batch end
 		[]byte("\x00\x00\x00\x0a"),
 	}
@@ -498,7 +497,7 @@ func TestAddMatchSubnetRouteMarkRuleAccept(t *testing.T) {
 		// nft add chain ip ts-filter-test ts-forward-test { type filter hook forward priority 0\; }
 		[]byte("\x02\x00\x00\x00\x13\x00\x01\x00\x74\x73\x2d\x66\x69\x6c\x74\x65\x72\x2d\x74\x65\x73\x74\x00\x00\x14\x00\x03\x00\x74\x73\x2d\x66\x6f\x72\x77\x61\x72\x64\x2d\x74\x65\x73\x74\x00\x14\x00\x04\x80\x08\x00\x01\x00\x00\x00\x00\x02\x08\x00\x02\x00\x00\x00\x00\x00\x0b\x00\x07\x00\x66\x69\x6c\x74\x65\x72\x00\x00"),
 		// nft add rule ip ts-filter-test ts-forward-test meta mark and 0x00ff0000 eq 0x00040000 counter accept
-		[]byte("\x02\x00\x00\x00\x13\x00\x01\x00\x74\x73\x2d\x66\x69\x6c\x74\x65\x72\x2d\x74\x65\x73\x74\x00\x00\x14\x00\x02\x00\x74\x73\x2d\x66\x6f\x72\x77\x61\x72\x64\x2d\x74\x65\x73\x74\x00\xf4\x00\x04\x80\x24\x00\x01\x80\x09\x00\x01\x00\x6d\x65\x74\x61\x00\x00\x00\x00\x14\x00\x02\x80\x08\x00\x02\x00\x00\x00\x00\x03\x08\x00\x01\x00\x00\x00\x00\x01\x44\x00\x01\x80\x0c\x00\x01\x00\x62\x69\x74\x77\x69\x73\x65\x00\x34\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x01\x08\x00\x02\x00\x00\x00\x00\x01\x08\x00\x03\x00\x00\x00\x00\x04\x0c\x00\x04\x80\x08\x00\x01\x00\x00\xff\x00\x00\x0c\x00\x05\x80\x08\x00\x01\x00\x00\x00\x00\x00\x2c\x00\x01\x80\x08\x00\x01\x00\x63\x6d\x70\x00\x20\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x01\x08\x00\x02\x00\x00\x00\x00\x00\x0c\x00\x03\x80\x08\x00\x01\x00\x00\x04\x00\x00\x2c\x00\x01\x80\x0c\x00\x01\x00\x63\x6f\x75\x6e\x74\x65\x72\x00\x1c\x00\x02\x80\x0c\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x30\x00\x01\x80\x0e\x00\x01\x00\x69\x6d\x6d\x65\x64\x69\x61\x74\x65\x00\x00\x00\x1c\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x00\x10\x00\x02\x80\x0c\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x01"),
+		[]byte("\x02\x00\x00\x00\x13\x00\x01\x00\x74\x73\x2d\x66\x69\x6c\x74\x65\x72\x2d\x74\x65\x73\x74\x00\x00\x14\x00\x02\x00\x74\x73\x2d\x66\x6f\x72\x77\x61\x72\x64\x2d\x74\x65\x73\x74\x00\xf4\x00\x04\x80\x24\x00\x01\x80\x09\x00\x01\x00\x6d\x65\x74\x61\x00\x00\x00\x00\x14\x00\x02\x80\x08\x00\x02\x00\x00\x00\x00\x03\x08\x00\x01\x00\x00\x00\x00\x01\x44\x00\x01\x80\x0c\x00\x01\x00\x62\x69\x74\x77\x69\x73\x65\x00\x34\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x01\x08\x00\x02\x00\x00\x00\x00\x01\x08\x00\x03\x00\x00\x00\x00\x04\x0c\x00\x04\x80\x08\x00\x01\x00\x00\x00\xff\x00\x0c\x00\x05\x80\x08\x00\x01\x00\x00\x00\x00\x00\x2c\x00\x01\x80\x08\x00\x01\x00\x63\x6d\x70\x00\x20\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x01\x08\x00\x02\x00\x00\x00\x00\x00\x0c\x00\x03\x80\x08\x00\x01\x00\x00\x00\x04\x00\x2c\x00\x01\x80\x0c\x00\x01\x00\x63\x6f\x75\x6e\x74\x65\x72\x00\x1c\x00\x02\x80\x0c\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x30\x00\x01\x80\x0e\x00\x01\x00\x69\x6d\x6d\x65\x64\x69\x61\x74\x65\x00\x00\x00\x1c\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x00\x10\x00\x02\x80\x0c\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x01"),
 		// batch end
 		[]byte("\x00\x00\x00\x0a"),
 	}
@@ -522,10 +521,7 @@ func TestAddMatchSubnetRouteMarkRuleAccept(t *testing.T) {
 
 func newSysConn(t *testing.T) *nftables.Conn {
 	t.Helper()
-	if os.Geteuid() != 0 {
-		t.Skip(t.Name(), " requires privileges to create a namespace in order to run")
-		return nil
-	}
+	tstest.RequireRoot(t)
 
 	runtime.LockOSThread()
 
@@ -637,7 +633,7 @@ func TestAddAndDelNetfilterChains(t *testing.T) {
 func getTsChains(
 	conn *nftables.Conn,
 	proto nftables.TableFamily) (*nftables.Chain, *nftables.Chain, *nftables.Chain, error) {
-	chains, err := conn.ListChainsOfTableFamily(nftables.TableFamilyIPv4)
+	chains, err := conn.ListChainsOfTableFamily(proto)
 	if err != nil {
 		return nil, nil, nil, fmt.Errorf("list chains failed: %w", err)
 	}
@@ -662,17 +658,7 @@ func findV4BaseRules(
 	forwChain *nftables.Chain,
 	tunname string) ([]*nftables.Rule, error) {
 	want := []*nftables.Rule{}
-	rule, err := createRangeRule(inpChain.Table, inpChain, tunname, tsaddr.ChromeOSVMRange(), expr.VerdictReturn)
-	if err != nil {
-		return nil, fmt.Errorf("create rule: %w", err)
-	}
-	want = append(want, rule)
-	rule, err = createRangeRule(inpChain.Table, inpChain, tunname, tsaddr.CGNATRange(), expr.VerdictDrop)
-	if err != nil {
-		return nil, fmt.Errorf("create rule: %w", err)
-	}
-	want = append(want, rule)
-	rule, err = createDropOutgoingPacketFromCGNATRangeRuleWithTunname(forwChain.Table, forwChain, tunname)
+	rule, err := createDropOutgoingPacketFromCGNATRangeRuleWithTunname(forwChain.Table, forwChain, tunname)
 	if err != nil {
 		return nil, fmt.Errorf("create rule: %w", err)
 	}
@@ -749,7 +735,7 @@ func TestNFTAddAndDelNetfilterBase(t *testing.T) {
 	if err != nil {
 		t.Fatalf("getTsChains() failed: %v", err)
 	}
-	checkChainRules(t, conn, inputV4, 3)
+	checkChainRules(t, conn, inputV4, 1)
 	checkChainRules(t, conn, forwardV4, 4)
 	checkChainRules(t, conn, postroutingV4, 0)
 
@@ -767,8 +753,8 @@ func TestNFTAddAndDelNetfilterBase(t *testing.T) {
 	if err != nil {
 		t.Fatalf("getTsChains() failed: %v", err)
 	}
-	checkChainRules(t, conn, inputV6, 3)
-	checkChainRules(t, conn, forwardV6, 4)
+	checkChainRules(t, conn, inputV6, 1)
+	checkChainRules(t, conn, forwardV6, 3)
 	checkChainRules(t, conn, postroutingV6, 0)
 
 	_, err = findCommonBaseRules(conn, forwardV6, "testTunn")
@@ -787,6 +773,92 @@ func TestNFTAddAndDelNetfilterBase(t *testing.T) {
 	}
 }
 
+func findCGNATRules(
+	conn *nftables.Conn,
+	inpChain *nftables.Chain,
+	mode CGNATMode,
+	tunname string,
+) error {
+	want := []*nftables.Rule{}
+	switch mode {
+	case CGNATModeDrop:
+		rule, err := createRangeRule(inpChain.Table, inpChain, tunname, tsaddr.ChromeOSVMRange(), expr.VerdictReturn)
+		if err != nil {
+			return fmt.Errorf("create rule: %w", err)
+		}
+		want = append(want, rule)
+		rule, err = createRangeRule(inpChain.Table, inpChain, tunname, tsaddr.CGNATRange(), expr.VerdictDrop)
+		if err != nil {
+			return fmt.Errorf("create rule: %w", err)
+		}
+		want = append(want, rule)
+	case CGNATModeReturn:
+		rule, err := createRangeRule(inpChain.Table, inpChain, tunname, tsaddr.CGNATRange(), expr.VerdictReturn)
+		if err != nil {
+			return fmt.Errorf("create rule: %w", err)
+		}
+		want = append(want, rule)
+	default:
+		return fmt.Errorf("unknown mode %q", mode)
+	}
+	for _, rule := range want {
+		_, err := findRule(conn, rule)
+		if err != nil {
+			return fmt.Errorf("find rule: %w", err)
+		}
+	}
+	return nil
+}
+
+func TestNFTAddAndDelCGNATRules(t *testing.T) {
+	modes := []CGNATMode{CGNATModeDrop, CGNATModeReturn}
+	for _, mode := range modes {
+		t.Run(string(mode), func(t *testing.T) {
+			conn := newSysConn(t)
+
+			runner := newFakeNftablesRunnerWithConn(t, conn, false)
+
+			if err := runner.AddChains(); err != nil {
+				t.Fatalf("AddChains() failed: %v", err)
+			}
+			defer runner.DelChains()
+
+			inputV4, _, _, err := getTsChains(conn, nftables.TableFamilyIPv4)
+			if err != nil {
+				t.Fatalf("getTsChains() failed: %v", err)
+			}
+
+			checkChainRules(t, conn, inputV4, 0)
+
+			tunname := "tun0"
+
+			if err := runner.AddExternalCGNATRules(mode, tunname); err != nil {
+				t.Fatalf("add rules: %v", err)
+			}
+
+			switch mode {
+			case CGNATModeDrop:
+				checkChainRules(t, conn, inputV4, 2)
+			case CGNATModeReturn:
+				checkChainRules(t, conn, inputV4, 1)
+			default:
+				t.Fatalf("unknown mode %q", mode)
+			}
+
+			if err := findCGNATRules(conn, inputV4, mode, tunname); err != nil {
+				t.Fatalf("find rules: %v", err)
+			}
+
+			if err := runner.DelExternalCGNATRules(mode, tunname); err != nil {
+				t.Fatalf("delete rules: %v", err)
+			}
+
+			// Verify that all the rules have been deleted (0 remaining).
+			checkChainRules(t, conn, inputV4, 0)
+		})
+	}
+}
+
 func findLoopBackRule(conn *nftables.Conn, proto nftables.TableFamily, table *nftables.Table, chain *nftables.Chain, addr netip.Addr) (*nftables.Rule, error) {
 	matchingAddr := addr.AsSlice()
 	saddrExpr, err := newLoadSaddrExpr(proto, 1)
@@ -849,16 +921,16 @@ func TestNFTAddAndDelLoopbackRule(t *testing.T) {
 
 	runner.AddBase("testTunn")
 	defer runner.DelBase()
-	checkChainRules(t, conn, inputV4, 3)
-	checkChainRules(t, conn, inputV6, 3)
+	checkChainRules(t, conn, inputV4, 1)
+	checkChainRules(t, conn, inputV6, 1)
 
 	addr := netip.MustParseAddr("192.168.0.2")
 	addrV6 := netip.MustParseAddr("2001:db8::2")
 	runner.AddLoopbackRule(addr)
 	runner.AddLoopbackRule(addrV6)
 
-	checkChainRules(t, conn, inputV4, 4)
-	checkChainRules(t, conn, inputV6, 4)
+	checkChainRules(t, conn, inputV4, 2)
+	checkChainRules(t, conn, inputV6, 2)
 
 	existingLoopBackRule, err := findLoopBackRule(conn, nftables.TableFamilyIPv4, runner.nft4.Filter, inputV4, addr)
 	if err != nil {
@@ -881,8 +953,8 @@ func TestNFTAddAndDelLoopbackRule(t *testing.T) {
 	runner.DelLoopbackRule(addr)
 	runner.DelLoopbackRule(addrV6)
 
-	checkChainRules(t, conn, inputV4, 3)
-	checkChainRules(t, conn, inputV6, 3)
+	checkChainRules(t, conn, inputV4, 1)
+	checkChainRules(t, conn, inputV6, 1)
 }
 
 func TestNFTAddAndDelHookRule(t *testing.T) {
@@ -1246,7 +1318,7 @@ func TestMakeConnmarkRestoreExprs(t *testing.T) {
 		// nft add chain ip mangle PREROUTING { type filter hook prerouting priority mangle; }
 		[]byte("\x02\x00\x00\x00\x0b\x00\x01\x00\x6d\x61\x6e\x67\x6c\x65\x00\x00\x0f\x00\x03\x00\x50\x52\x45\x52\x4f\x55\x54\x49\x4e\x47\x00\x00\x14\x00\x04\x80\x08\x00\x01\x00\x00\x00\x00\x00\x08\x00\x02\x00\xff\xff\xff\x6a\x0b\x00\x07\x00\x66\x69\x6c\x74\x65\x72\x00\x00"),
 		// nft add rule ip mangle PREROUTING ct state established,related ct mark & 0xff0000 != 0 meta mark set ct mark & 0xff0000
-		[]byte("\x02\x00\x00\x00\x0b\x00\x01\x00\x6d\x61\x6e\x67\x6c\x65\x00\x00\x0f\x00\x02\x00\x50\x52\x45\x52\x4f\x55\x54\x49\x4e\x47\x00\x00\x1c\x01\x04\x80\x20\x00\x01\x80\x07\x00\x01\x00\x63\x74\x00\x00\x14\x00\x02\x80\x08\x00\x02\x00\x00\x00\x00\x00\x08\x00\x01\x00\x00\x00\x00\x01\x44\x00\x01\x80\x0c\x00\x01\x00\x62\x69\x74\x77\x69\x73\x65\x00\x34\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x01\x08\x00\x02\x00\x00\x00\x00\x01\x08\x00\x03\x00\x00\x00\x00\x04\x0c\x00\x04\x80\x08\x00\x01\x00\x06\x00\x00\x00\x0c\x00\x05\x80\x08\x00\x01\x00\x00\x00\x00\x00\x2c\x00\x01\x80\x08\x00\x01\x00\x63\x6d\x70\x00\x20\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x01\x08\x00\x02\x00\x00\x00\x00\x01\x0c\x00\x03\x80\x08\x00\x01\x00\x00\x00\x00\x00\x20\x00\x01\x80\x07\x00\x01\x00\x63\x74\x00\x00\x14\x00\x02\x80\x08\x00\x02\x00\x00\x00\x00\x03\x08\x00\x01\x00\x00\x00\x00\x01\x44\x00\x01\x80\x0c\x00\x01\x00\x62\x69\x74\x77\x69\x73\x65\x00\x34\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x01\x08\x00\x02\x00\x00\x00\x00\x01\x08\x00\x03\x00\x00\x00\x00\x04\x0c\x00\x04\x80\x08\x00\x01\x00\x00\xff\x00\x00\x0c\x00\x05\x80\x08\x00\x01\x00\x00\x00\x00\x00\x24\x00\x01\x80\x09\x00\x01\x00\x6d\x65\x74\x61\x00\x00\x00\x00\x14\x00\x02\x80\x08\x00\x02\x00\x00\x00\x00\x03\x08\x00\x03\x00\x00\x00\x00\x01"),
+		[]byte("\x02\x00\x00\x00\x0b\x00\x01\x00\x6d\x61\x6e\x67\x6c\x65\x00\x00\x0f\x00\x02\x00\x50\x52\x45\x52\x4f\x55\x54\x49\x4e\x47\x00\x00\x48\x01\x04\x80\x20\x00\x01\x80\x07\x00\x01\x00\x63\x74\x00\x00\x14\x00\x02\x80\x08\x00\x02\x00\x00\x00\x00\x00\x08\x00\x01\x00\x00\x00\x00\x01\x44\x00\x01\x80\x0c\x00\x01\x00\x62\x69\x74\x77\x69\x73\x65\x00\x34\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x01\x08\x00\x02\x00\x00\x00\x00\x01\x08\x00\x03\x00\x00\x00\x00\x04\x0c\x00\x04\x80\x08\x00\x01\x00\x06\x00\x00\x00\x0c\x00\x05\x80\x08\x00\x01\x00\x00\x00\x00\x00\x2c\x00\x01\x80\x08\x00\x01\x00\x63\x6d\x70\x00\x20\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x01\x08\x00\x02\x00\x00\x00\x00\x01\x0c\x00\x03\x80\x08\x00\x01\x00\x00\x00\x00\x00\x20\x00\x01\x80\x07\x00\x01\x00\x63\x74\x00\x00\x14\x00\x02\x80\x08\x00\x02\x00\x00\x00\x00\x03\x08\x00\x01\x00\x00\x00\x00\x01\x44\x00\x01\x80\x0c\x00\x01\x00\x62\x69\x74\x77\x69\x73\x65\x00\x34\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x01\x08\x00\x02\x00\x00\x00\x00\x01\x08\x00\x03\x00\x00\x00\x00\x04\x0c\x00\x04\x80\x08\x00\x01\x00\x00\x00\xff\x00\x0c\x00\x05\x80\x08\x00\x01\x00\x00\x00\x00\x00\x2c\x00\x01\x80\x08\x00\x01\x00\x63\x6d\x70\x00\x20\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x01\x08\x00\x02\x00\x00\x00\x00\x01\x0c\x00\x03\x80\x08\x00\x01\x00\x00\x00\x00\x00\x24\x00\x01\x80\x09\x00\x01\x00\x6d\x65\x74\x61\x00\x00\x00\x00\x14\x00\x02\x80\x08\x00\x02\x00\x00\x00\x00\x03\x08\x00\x03\x00\x00\x00\x00\x01"),
 		// batch end
 		[]byte("\x00\x00\x00\x0a"),
 	}
@@ -1287,7 +1359,7 @@ func TestMakeConnmarkSaveExprs(t *testing.T) {
 		// nft add chain ip mangle OUTPUT { type route hook output priority mangle; }
 		[]byte("\x02\x00\x00\x00\x0b\x00\x01\x00\x6d\x61\x6e\x67\x6c\x65\x00\x00\x0b\x00\x03\x00\x4f\x55\x54\x50\x55\x54\x00\x00\x14\x00\x04\x80\x08\x00\x01\x00\x00\x00\x00\x03\x08\x00\x02\x00\xff\xff\xff\x6a\x0a\x00\x07\x00\x72\x6f\x75\x74\x65\x00\x00\x00"),
 		// nft add rule ip mangle OUTPUT ct state new meta mark & 0xff0000 != 0 ct mark set meta mark & 0xff0000
-		[]byte("\x02\x00\x00\x00\x0b\x00\x01\x00\x6d\x61\x6e\x67\x6c\x65\x00\x00\x0b\x00\x02\x00\x4f\x55\x54\x50\x55\x54\x00\x00\xb0\x01\x04\x80\x20\x00\x01\x80\x07\x00\x01\x00\x63\x74\x00\x00\x14\x00\x02\x80\x08\x00\x02\x00\x00\x00\x00\x00\x08\x00\x01\x00\x00\x00\x00\x01\x44\x00\x01\x80\x0c\x00\x01\x00\x62\x69\x74\x77\x69\x73\x65\x00\x34\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x01\x08\x00\x02\x00\x00\x00\x00\x01\x08\x00\x03\x00\x00\x00\x00\x04\x0c\x00\x04\x80\x08\x00\x01\x00\x08\x00\x00\x00\x0c\x00\x05\x80\x08\x00\x01\x00\x00\x00\x00\x00\x2c\x00\x01\x80\x08\x00\x01\x00\x63\x6d\x70\x00\x20\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x01\x08\x00\x02\x00\x00\x00\x00\x01\x0c\x00\x03\x80\x08\x00\x01\x00\x00\x00\x00\x00\x24\x00\x01\x80\x09\x00\x01\x00\x6d\x65\x74\x61\x00\x00\x00\x00\x14\x00\x02\x80\x08\x00\x02\x00\x00\x00\x00\x03\x08\x00\x01\x00\x00\x00\x00\x01\x44\x00\x01\x80\x0c\x00\x01\x00\x62\x69\x74\x77\x69\x73\x65\x00\x34\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x01\x08\x00\x02\x00\x00\x00\x00\x01\x08\x00\x03\x00\x00\x00\x00\x04\x0c\x00\x04\x80\x08\x00\x01\x00\x00\xff\x00\x00\x0c\x00\x05\x80\x08\x00\x01\x00\x00\x00\x00\x00\x2c\x00\x01\x80\x08\x00\x01\x00\x63\x6d\x70\x00\x20\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x01\x08\x00\x02\x00\x00\x00\x00\x01\x0c\x00\x03\x80\x08\x00\x01\x00\x00\x00\x00\x00\x24\x00\x01\x80\x09\x00\x01\x00\x6d\x65\x74\x61\x00\x00\x00\x00\x14\x00\x02\x80\x08\x00\x02\x00\x00\x00\x00\x03\x08\x00\x01\x00\x00\x00\x00\x01\x44\x00\x01\x80\x0c\x00\x01\x00\x62\x69\x74\x77\x69\x73\x65\x00\x34\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x01\x08\x00\x02\x00\x00\x00\x00\x01\x08\x00\x03\x00\x00\x00\x00\x04\x0c\x00\x04\x80\x08\x00\x01\x00\x00\xff\x00\x00\x0c\x00\x05\x80\x08\x00\x01\x00\x00\x00\x00\x00\x20\x00\x01\x80\x07\x00\x01\x00\x63\x74\x00\x00\x14\x00\x02\x80\x08\x00\x02\x00\x00\x00\x00\x03\x08\x00\x04\x00\x00\x00\x00\x01"),
+		[]byte("\x02\x00\x00\x00\x0b\x00\x01\x00\x6d\x61\x6e\x67\x6c\x65\x00\x00\x0b\x00\x02\x00\x4f\x55\x54\x50\x55\x54\x00\x00\xb0\x01\x04\x80\x20\x00\x01\x80\x07\x00\x01\x00\x63\x74\x00\x00\x14\x00\x02\x80\x08\x00\x02\x00\x00\x00\x00\x00\x08\x00\x01\x00\x00\x00\x00\x01\x44\x00\x01\x80\x0c\x00\x01\x00\x62\x69\x74\x77\x69\x73\x65\x00\x34\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x01\x08\x00\x02\x00\x00\x00\x00\x01\x08\x00\x03\x00\x00\x00\x00\x04\x0c\x00\x04\x80\x08\x00\x01\x00\x08\x00\x00\x00\x0c\x00\x05\x80\x08\x00\x01\x00\x00\x00\x00\x00\x2c\x00\x01\x80\x08\x00\x01\x00\x63\x6d\x70\x00\x20\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x01\x08\x00\x02\x00\x00\x00\x00\x01\x0c\x00\x03\x80\x08\x00\x01\x00\x00\x00\x00\x00\x24\x00\x01\x80\x09\x00\x01\x00\x6d\x65\x74\x61\x00\x00\x00\x00\x14\x00\x02\x80\x08\x00\x02\x00\x00\x00\x00\x03\x08\x00\x01\x00\x00\x00\x00\x01\x44\x00\x01\x80\x0c\x00\x01\x00\x62\x69\x74\x77\x69\x73\x65\x00\x34\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x01\x08\x00\x02\x00\x00\x00\x00\x01\x08\x00\x03\x00\x00\x00\x00\x04\x0c\x00\x04\x80\x08\x00\x01\x00\x00\x00\xff\x00\x0c\x00\x05\x80\x08\x00\x01\x00\x00\x00\x00\x00\x2c\x00\x01\x80\x08\x00\x01\x00\x63\x6d\x70\x00\x20\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x01\x08\x00\x02\x00\x00\x00\x00\x01\x0c\x00\x03\x80\x08\x00\x01\x00\x00\x00\x00\x00\x24\x00\x01\x80\x09\x00\x01\x00\x6d\x65\x74\x61\x00\x00\x00\x00\x14\x00\x02\x80\x08\x00\x02\x00\x00\x00\x00\x03\x08\x00\x01\x00\x00\x00\x00\x01\x44\x00\x01\x80\x0c\x00\x01\x00\x62\x69\x74\x77\x69\x73\x65\x00\x34\x00\x02\x80\x08\x00\x01\x00\x00\x00\x00\x01\x08\x00\x02\x00\x00\x00\x00\x01\x08\x00\x03\x00\x00\x00\x00\x04\x0c\x00\x04\x80\x08\x00\x01\x00\x00\x00\xff\x00\x0c\x00\x05\x80\x08\x00\x01\x00\x00\x00\x00\x00\x20\x00\x01\x80\x07\x00\x01\x00\x63\x74\x00\x00\x14\x00\x02\x80\x08\x00\x02\x00\x00\x00\x00\x03\x08\x00\x04\x00\x00\x00\x00\x01"),
 		// batch end
 		[]byte("\x00\x00\x00\x0a"),
 	}
@@ -1313,3 +1385,39 @@ func TestMakeConnmarkSaveExprs(t *testing.T) {
 		t.Fatalf("Flush() failed: %v", err)
 	}
 }
+
+// TestGetOrCreateChainNilHooknum verifies that getOrCreateChain returns a clear
+// error when a ts- chain exists but has nil Hooknum/Priority, which happens when
+// the kernel lacks nftables support (CONFIG_NF_TABLES).
+func TestGetOrCreateChainNilHooknum(t *testing.T) {
+	conn := newSysConn(t)
+
+	table := conn.AddTable(&nftables.Table{
+		Family: nftables.TableFamilyIPv4,
+		Name:   "ts-filter-test",
+	})
+	// Add a ts- chain without hooknum/priority (regular chain), simulating
+	// the broken state returned by a kernel without nftables support.
+	conn.AddChain(&nftables.Chain{
+		Name:  "ts-input",
+		Table: table,
+	})
+	if err := conn.Flush(); err != nil {
+		t.Fatalf("Flush() failed: %v", err)
+	}
+
+	// Now try getOrCreateChain expecting a base chain with hooknum/priority.
+	_, err := getOrCreateChain(conn, chainInfo{
+		table:         table,
+		name:          "ts-input",
+		chainType:     nftables.ChainTypeFilter,
+		chainHook:     nftables.ChainHookInput,
+		chainPriority: nftables.ChainPriorityFilter,
+	})
+	if err == nil {
+		t.Fatal("expected error for chain with nil hooknum/priority, got nil")
+	}
+	if !strings.Contains(err.Error(), "nil hooknum") {
+		t.Fatalf("unexpected error: %v", err)
+	}
+}
diff --git a/util/osuser/user.go b/util/osuser/user.go
index 2de3da762..3fdbfbbd3 100644
--- a/util/osuser/user.go
+++ b/util/osuser/user.go
@@ -8,11 +8,14 @@ package osuser
 import (
 	"context"
 	"errors"
+	"fmt"
 	"log"
 	"os/exec"
 	"os/user"
+	"reflect"
 	"runtime"
 	"strings"
+	"sync"
 	"time"
 	"unicode/utf8"
 
@@ -50,6 +53,12 @@ func LookupByUsername(username string) (*user.User, error) {
 // lookupStd is either user.Lookup or user.LookupId.
 type lookupStd func(string) (*user.User, error)
 
+var execGetent = func(ctx context.Context, args ...string) ([]byte, error) {
+	return exec.CommandContext(ctx, "getent", args...).Output()
+}
+
+var getentDoubleDashSupported = sync.OnceValue(probeGetentDoubleDashSupport)
+
 func lookup(usernameOrUID string, std lookupStd, wantShell bool) (*user.User, string, error) {
 	// Skip getent entirely on Non-Unix platforms that won't ever have it.
 	// (Using HasPrefix for "wasip1", anticipating that WASI support will
@@ -118,6 +127,12 @@ func checkGetentInput(usernameOrUID string) bool {
 	if len(usernameOrUID) > maxUid || len(usernameOrUID) == 0 {
 		return false
 	}
+
+	// Leading dashes aren't valid for usernames.
+	if strings.HasPrefix(usernameOrUID, "-") {
+		return false
+	}
+
 	for _, r := range usernameOrUID {
 		if r < ' ' || r == 0x7f || r == utf8.RuneError { // TODO(bradfitz): more?
 			return false
@@ -139,23 +154,77 @@ func userLookupGetent(usernameOrUID string, std lookupStd) (*user.User, string,
 	}
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
-	out, err := exec.CommandContext(ctx, "getent", "passwd", usernameOrUID).Output()
+
+	args := []string{"passwd"}
+	// Append "--" only if the local getent accepts it, to prevent a username or
+	// UID from being interpreted as an option without breaking getent variants
+	// that do not support end-of-options parsing here.
+	if getentDoubleDashSupported() {
+		args = append(args, "--")
+	}
+	args = append(args, usernameOrUID)
+
+	out, err := execGetent(ctx, args...)
 	if err != nil {
 		log.Printf("error calling getent for user %q: %v", usernameOrUID, err)
 		u, err := std(usernameOrUID)
 		return u, "", err
 	}
+	u, shell, err := parseGetentUser(out)
+	if err != nil {
+		log.Printf("getent for user %q returned invalid output %q: %v", usernameOrUID, out, err)
+		u, err := std(usernameOrUID)
+		return u, "", err
+	}
+	return u, shell, nil
+}
+
+func probeGetentDoubleDashSupport() bool {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	out, err := execGetent(ctx, "passwd", "root")
+	if err != nil {
+		return false
+	}
+
+	outDoubleDash, err := execGetent(ctx, "passwd", "--", "root")
+	if err != nil {
+		return false
+	}
+
+	u, shell, err := parseGetentUser(out)
+	if err != nil {
+		return false
+	}
+
+	uDoubleDash, shellDoubleDash, err := parseGetentUser(outDoubleDash)
+	if err != nil {
+		return false
+	}
+
+	// Short-circuit if the user is obviously incorrect
+	if uDoubleDash.Name != "root" || uDoubleDash.Uid != "0" || uDoubleDash.Gid != "0" {
+		return false
+	}
+
+	if !reflect.DeepEqual(u, uDoubleDash) || shell != shellDoubleDash {
+		return false
+	}
+
+	return true
+}
+
+func parseGetentUser(out []byte) (*user.User, string, error) {
 	// output is "alice:x:1001:1001:Alice Smith,,,:/home/alice:/bin/bash"
 	f := strings.SplitN(strings.TrimSpace(string(out)), ":", 10)
 	for len(f) < 7 {
 		f = append(f, "")
 	}
-	var mandatoryFields = []int{0, 2, 3, 5}
-	for _, v := range mandatoryFields {
-		if f[v] == "" {
-			log.Printf("getent for user %q returned invalid output: %q", usernameOrUID, out)
-			u, err := std(usernameOrUID)
-			return u, "", err
+	var mandatoryFields = map[int]string{0: "Username", 2: "Uid", 3: "Gid", 5: "HomeDir"}
+	for k, v := range mandatoryFields {
+		if f[k] == "" {
+			return nil, "", fmt.Errorf("missing mandatory field %q", v)
 		}
 	}
 	return &user.User{
diff --git a/util/osuser/user_test.go b/util/osuser/user_test.go
new file mode 100644
index 000000000..cbea237af
--- /dev/null
+++ b/util/osuser/user_test.go
@@ -0,0 +1,103 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package osuser
+
+import (
+	"context"
+	"errors"
+	"os/user"
+	"reflect"
+	"sync"
+	"testing"
+)
+
+func TestProbeGetentDoubleDashSupport(t *testing.T) {
+	origExecGetent := execGetent
+	t.Cleanup(func() {
+		execGetent = origExecGetent
+	})
+
+	tests := []struct {
+		name string
+		out  []byte
+		err  error
+		want bool
+	}{
+		{
+			name: "supported",
+			out:  []byte("root:x:0:0:root:/root:/bin/sh\n"),
+			want: true,
+		},
+		{
+			name: "error",
+			err:  errors.New("unsupported"),
+			want: false,
+		},
+		{
+			name: "wrong-user",
+			out:  []byte("daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\n"),
+			want: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			execGetent = func(_ context.Context, args ...string) ([]byte, error) {
+				return tt.out, tt.err
+			}
+			if got := probeGetentDoubleDashSupport(); got != tt.want {
+				t.Fatalf("probeGetentDashDashSupport() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestUserLookupGetentUsesProbeResult(t *testing.T) {
+	origExecGetent := execGetent
+	origProbe := getentDoubleDashSupported
+	t.Cleanup(func() {
+		execGetent = origExecGetent
+		getentDoubleDashSupported = origProbe
+	})
+
+	tests := []struct {
+		name      string
+		supported bool
+		wantArgs  []string
+	}{
+		{
+			name:      "supported",
+			supported: true,
+			wantArgs:  []string{"passwd", "--", "alice"},
+		},
+		{
+			name:      "unsupported",
+			supported: false,
+			wantArgs:  []string{"passwd", "alice"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			getentDoubleDashSupported = sync.OnceValue(func() bool { return tt.supported })
+			execGetent = func(_ context.Context, args ...string) ([]byte, error) {
+				if !reflect.DeepEqual(args, tt.wantArgs) {
+					t.Fatalf("args = %q, want %q", args, tt.wantArgs)
+				}
+				return []byte("alice:x:1001:1001:Alice:/home/alice:/bin/sh\n"), nil
+			}
+			std := func(string) (*user.User, error) {
+				t.Fatal("std lookup should not be called")
+				return nil, nil
+			}
+			u, shell, err := userLookupGetent("alice", std)
+			if err != nil {
+				t.Fatalf("userLookupGetent error: %v", err)
+			}
+			if u.Username != "alice" || shell != "/bin/sh" {
+				t.Fatalf("got user=%+v shell=%q", u, shell)
+			}
+		})
+	}
+}
diff --git a/util/pidowner/pidowner.go b/util/pidowner/pidowner.go
deleted file mode 100644
index cec92ba36..000000000
--- a/util/pidowner/pidowner.go
+++ /dev/null
@@ -1,24 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-// Package pidowner handles lookups from process ID to its owning user.
-package pidowner
-
-import (
-	"errors"
-	"runtime"
-)
-
-var ErrNotImplemented = errors.New("not implemented for GOOS=" + runtime.GOOS)
-
-var ErrProcessNotFound = errors.New("process not found")
-
-// OwnerOfPID returns the user ID that owns the given process ID.
-//
-// The returned user ID is suitable to passing to os/user.LookupId.
-//
-// The returned error will be ErrNotImplemented for operating systems where
-// this isn't supported.
-func OwnerOfPID(pid int) (userID string, err error) {
-	return ownerOfPID(pid)
-}
diff --git a/util/pidowner/pidowner_linux.go b/util/pidowner/pidowner_linux.go
deleted file mode 100644
index f3f5cd97d..000000000
--- a/util/pidowner/pidowner_linux.go
+++ /dev/null
@@ -1,36 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-package pidowner
-
-import (
-	"fmt"
-	"os"
-	"strings"
-
-	"tailscale.com/util/lineiter"
-)
-
-func ownerOfPID(pid int) (userID string, err error) {
-	file := fmt.Sprintf("/proc/%d/status", pid)
-	for lr := range lineiter.File(file) {
-		line, err := lr.Value()
-		if err != nil {
-			if os.IsNotExist(err) {
-				return "", ErrProcessNotFound
-			}
-			return "", err
-		}
-		if len(line) < 4 || string(line[:4]) != "Uid:" {
-			continue
-		}
-		f := strings.Fields(string(line))
-		if len(f) >= 2 {
-			userID = f[1] // real userid
-		}
-	}
-	if userID == "" {
-		return "", fmt.Errorf("missing Uid line in %s", file)
-	}
-	return userID, nil
-}
diff --git a/util/pidowner/pidowner_noimpl.go b/util/pidowner/pidowner_noimpl.go
deleted file mode 100644
index 4bc665d61..000000000
--- a/util/pidowner/pidowner_noimpl.go
+++ /dev/null
@@ -1,8 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-//go:build !windows && !linux
-
-package pidowner
-
-func ownerOfPID(pid int) (userID string, err error) { return "", ErrNotImplemented }
diff --git a/util/pidowner/pidowner_test.go b/util/pidowner/pidowner_test.go
deleted file mode 100644
index 2774a8ab0..000000000
--- a/util/pidowner/pidowner_test.go
+++ /dev/null
@@ -1,50 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-package pidowner
-
-import (
-	"math/rand"
-	"os"
-	"os/user"
-	"testing"
-)
-
-func TestOwnerOfPID(t *testing.T) {
-	id, err := OwnerOfPID(os.Getpid())
-	if err == ErrNotImplemented {
-		t.Skip(err)
-	}
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Logf("id=%q", id)
-
-	u, err := user.LookupId(id)
-	if err != nil {
-		t.Fatalf("LookupId: %v", err)
-	}
-	t.Logf("Got: %+v", u)
-}
-
-// validate that OS implementation returns ErrProcessNotFound.
-func TestNotFoundError(t *testing.T) {
-	// Try a bunch of times to stumble upon a pid that doesn't exist...
-	const tries = 50
-	for range tries {
-		_, err := OwnerOfPID(rand.Intn(1e9))
-		if err == ErrNotImplemented {
-			t.Skip(err)
-		}
-		if err == nil {
-			// We got unlucky and this pid existed. Try again.
-			continue
-		}
-		if err == ErrProcessNotFound {
-			// Pass.
-			return
-		}
-		t.Fatalf("Error is not ErrProcessNotFound: %T %v", err, err)
-	}
-	t.Errorf("after %d tries, couldn't find a process that didn't exist", tries)
-}
diff --git a/util/pidowner/pidowner_windows.go b/util/pidowner/pidowner_windows.go
deleted file mode 100644
index 8edd7698d..000000000
--- a/util/pidowner/pidowner_windows.go
+++ /dev/null
@@ -1,35 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-package pidowner
-
-import (
-	"fmt"
-	"syscall"
-
-	"golang.org/x/sys/windows"
-)
-
-func ownerOfPID(pid int) (userID string, err error) {
-	procHnd, err := windows.OpenProcess(windows.PROCESS_QUERY_INFORMATION, false, uint32(pid))
-	if err == syscall.Errno(0x57) { // invalid parameter, for PIDs that don't exist
-		return "", ErrProcessNotFound
-	}
-	if err != nil {
-		return "", fmt.Errorf("OpenProcess: %T %#v", err, err)
-	}
-	defer windows.CloseHandle(procHnd)
-
-	var tok windows.Token
-	if err := windows.OpenProcessToken(procHnd, windows.TOKEN_QUERY, &tok); err != nil {
-		return "", fmt.Errorf("OpenProcessToken: %w", err)
-	}
-
-	tokUser, err := tok.GetTokenUser()
-	if err != nil {
-		return "", fmt.Errorf("GetTokenUser: %w", err)
-	}
-
-	sid := tokUser.User.Sid
-	return sid.String(), nil
-}
diff --git a/util/pool/pool.go b/util/pool/pool.go
deleted file mode 100644
index 2e223e577..000000000
--- a/util/pool/pool.go
+++ /dev/null
@@ -1,211 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-// Package pool contains a generic type for managing a pool of resources; for
-// example, connections to a database, or to a remote service.
-//
-// Unlike sync.Pool from the Go standard library, this pool does not remove
-// items from the pool when garbage collection happens, nor is it safe for
-// concurrent use like sync.Pool.
-package pool
-
-import (
-	"fmt"
-	"math/rand/v2"
-)
-
-// consistencyCheck enables additional runtime checks to ensure that the pool
-// is well-formed; it is disabled by default, and can be enabled during tests
-// to catch additional bugs.
-const consistencyCheck = false
-
-// Pool is a pool of resources. It is not safe for concurrent use.
-type Pool[V any] struct {
-	s []itemAndIndex[V]
-}
-
-type itemAndIndex[V any] struct {
-	// item is the element in the pool
-	item V
-
-	// index is the current location of this item in pool.s. It gets set to
-	// -1 when the item is removed from the pool.
-	index *int
-}
-
-// Handle is an opaque handle to a resource in a pool. It is used to delete an
-// item from the pool, without requiring the item to be comparable.
-type Handle[V any] struct {
-	idx *int // pointer to index; -1 if not in slice
-}
-
-// Len returns the current size of the pool.
-func (p *Pool[V]) Len() int {
-	return len(p.s)
-}
-
-// Clear removes all items from the pool.
-func (p *Pool[V]) Clear() {
-	p.s = nil
-}
-
-// AppendTakeAll removes all items from the pool, appending them to the
-// provided slice (which can be nil) and returning them. The returned slice can
-// be nil if the provided slice was nil and the pool was empty.
-//
-// This function does not free the backing storage for the pool; to do that,
-// use the Clear function.
-func (p *Pool[V]) AppendTakeAll(dst []V) []V {
-	ret := dst
-	for i := range p.s {
-		e := p.s[i]
-		if consistencyCheck && e.index == nil {
-			panic(fmt.Sprintf("pool: index is nil at %d", i))
-		}
-		if *e.index >= 0 {
-			ret = append(ret, p.s[i].item)
-		}
-	}
-	p.s = p.s[:0]
-	return ret
-}
-
-// Add adds an item to the pool and returns a handle to it. The handle can be
-// used to delete the item from the pool with the Delete method.
-func (p *Pool[V]) Add(item V) Handle[V] {
-	// Store the index in a pointer, so that we can pass it to both the
-	// handle and store it in the itemAndIndex.
-	idx := new(len(p.s))
-	p.s = append(p.s, itemAndIndex[V]{
-		item:  item,
-		index: idx,
-	})
-	return Handle[V]{idx}
-}
-
-// Peek will return the item with the given handle without removing it from the
-// pool.
-//
-// It will return ok=false if the item has been deleted or previously taken.
-func (p *Pool[V]) Peek(h Handle[V]) (v V, ok bool) {
-	p.checkHandle(h)
-	idx := *h.idx
-	if idx < 0 {
-		var zero V
-		return zero, false
-	}
-	p.checkIndex(idx)
-	return p.s[idx].item, true
-}
-
-// Delete removes the item from the pool.
-//
-// It reports whether the element was deleted; it will return false if the item
-// has been taken with the TakeRandom function, or if the item was already
-// deleted.
-func (p *Pool[V]) Delete(h Handle[V]) bool {
-	p.checkHandle(h)
-	idx := *h.idx
-	if idx < 0 {
-		return false
-	}
-	p.deleteIndex(idx)
-	return true
-}
-
-func (p *Pool[V]) deleteIndex(idx int) {
-	// Mark the item as deleted.
-	p.checkIndex(idx)
-	*(p.s[idx].index) = -1
-
-	// If this isn't the last element in the slice, overwrite the element
-	// at this item's index with the last element.
-	lastIdx := len(p.s) - 1
-
-	if idx < lastIdx {
-		last := p.s[lastIdx]
-		p.checkElem(lastIdx, last)
-		*last.index = idx
-		p.s[idx] = last
-	}
-
-	// Zero out last element (for GC) and truncate slice.
-	p.s[lastIdx] = itemAndIndex[V]{}
-	p.s = p.s[:lastIdx]
-}
-
-// Take will remove the item with the given handle from the pool and return it.
-//
-// It will return ok=false and the zero value if the item has been deleted or
-// previously taken.
-func (p *Pool[V]) Take(h Handle[V]) (v V, ok bool) {
-	p.checkHandle(h)
-	idx := *h.idx
-	if idx < 0 {
-		var zero V
-		return zero, false
-	}
-
-	e := p.s[idx]
-	p.deleteIndex(idx)
-	return e.item, true
-}
-
-// TakeRandom returns and removes a random element from p
-// and reports whether there was one to take.
-//
-// It will return ok=false and the zero value if the pool is empty.
-func (p *Pool[V]) TakeRandom() (v V, ok bool) {
-	if len(p.s) == 0 {
-		var zero V
-		return zero, false
-	}
-	pick := rand.IntN(len(p.s))
-	e := p.s[pick]
-	p.checkElem(pick, e)
-	p.deleteIndex(pick)
-	return e.item, true
-}
-
-// checkIndex verifies that the provided index is within the bounds of the
-// pool's slice, and that the corresponding element has a non-nil index
-// pointer, and panics if not.
-func (p *Pool[V]) checkIndex(idx int) {
-	if !consistencyCheck {
-		return
-	}
-
-	if idx >= len(p.s) {
-		panic(fmt.Sprintf("pool: index %d out of range (len %d)", idx, len(p.s)))
-	}
-	if p.s[idx].index == nil {
-		panic(fmt.Sprintf("pool: index is nil at %d", idx))
-	}
-}
-
-// checkHandle verifies that the provided handle is not nil, and panics if it
-// is.
-func (p *Pool[V]) checkHandle(h Handle[V]) {
-	if !consistencyCheck {
-		return
-	}
-
-	if h.idx == nil {
-		panic("pool: nil handle")
-	}
-}
-
-// checkElem verifies that the provided itemAndIndex has a non-nil index, and
-// that the stored index matches the expected position within the slice.
-func (p *Pool[V]) checkElem(idx int, e itemAndIndex[V]) {
-	if !consistencyCheck {
-		return
-	}
-
-	if e.index == nil {
-		panic("pool: index is nil")
-	}
-	if got := *e.index; got != idx {
-		panic(fmt.Sprintf("pool: index is incorrect: want %d, got %d", idx, got))
-	}
-}
diff --git a/util/pool/pool_test.go b/util/pool/pool_test.go
deleted file mode 100644
index ad509a563..000000000
--- a/util/pool/pool_test.go
+++ /dev/null
@@ -1,203 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-package pool
-
-import (
-	"slices"
-	"testing"
-)
-
-func TestPool(t *testing.T) {
-	p := Pool[int]{}
-
-	if got, want := p.Len(), 0; got != want {
-		t.Errorf("got initial length %v; want %v", got, want)
-	}
-
-	h1 := p.Add(101)
-	h2 := p.Add(102)
-	h3 := p.Add(103)
-	h4 := p.Add(104)
-
-	if got, want := p.Len(), 4; got != want {
-		t.Errorf("got length %v; want %v", got, want)
-	}
-
-	tests := []struct {
-		h    Handle[int]
-		want int
-	}{
-		{h1, 101},
-		{h2, 102},
-		{h3, 103},
-		{h4, 104},
-	}
-	for i, test := range tests {
-		got, ok := p.Peek(test.h)
-		if !ok {
-			t.Errorf("test[%d]: did not find item", i)
-			continue
-		}
-		if got != test.want {
-			t.Errorf("test[%d]: got %v; want %v", i, got, test.want)
-		}
-	}
-
-	if deleted := p.Delete(h2); !deleted {
-		t.Errorf("h2 not deleted")
-	}
-	if deleted := p.Delete(h2); deleted {
-		t.Errorf("h2 should not be deleted twice")
-	}
-	if got, want := p.Len(), 3; got != want {
-		t.Errorf("got length %v; want %v", got, want)
-	}
-	if _, ok := p.Peek(h2); ok {
-		t.Errorf("h2 still in pool")
-	}
-
-	// Remove an item by handle
-	got, ok := p.Take(h4)
-	if !ok {
-		t.Errorf("h4 not found")
-	}
-	if got != 104 {
-		t.Errorf("got %v; want 104", got)
-	}
-
-	// Take doesn't work on previously-taken or deleted items.
-	if _, ok := p.Take(h4); ok {
-		t.Errorf("h4 should not be taken twice")
-	}
-	if _, ok := p.Take(h2); ok {
-		t.Errorf("h2 should not be taken after delete")
-	}
-
-	// Remove all items and return them
-	items := p.AppendTakeAll(nil)
-	want := []int{101, 103}
-	if !slices.Equal(items, want) {
-		t.Errorf("got items %v; want %v", items, want)
-	}
-	if got := p.Len(); got != 0 {
-		t.Errorf("got length %v; want 0", got)
-	}
-
-	// Insert and then clear should result in no items.
-	p.Add(105)
-	p.Clear()
-	if got := p.Len(); got != 0 {
-		t.Errorf("got length %v; want 0", got)
-	}
-}
-
-func TestTakeRandom(t *testing.T) {
-	p := Pool[int]{}
-	for i := range 10 {
-		p.Add(i + 100)
-	}
-
-	seen := make(map[int]bool)
-	for range 10 {
-		item, ok := p.TakeRandom()
-		if !ok {
-			t.Errorf("unexpected empty pool")
-			break
-		}
-		if seen[item] {
-			t.Errorf("got duplicate item %v", item)
-		}
-		seen[item] = true
-	}
-
-	// Verify that the pool is empty
-	if _, ok := p.TakeRandom(); ok {
-		t.Errorf("expected empty pool")
-	}
-
-	for i := range 10 {
-		want := 100 + i
-		if !seen[want] {
-			t.Errorf("item %v not seen", want)
-		}
-	}
-
-	if t.Failed() {
-		t.Logf("seen: %+v", seen)
-	}
-}
-
-func BenchmarkPool_AddDelete(b *testing.B) {
-	b.Run("impl=Pool", func(b *testing.B) {
-		p := Pool[int]{}
-
-		// Warm up/force an initial allocation
-		h := p.Add(0)
-		p.Delete(h)
-
-		b.ResetTimer()
-
-		for i := 0; i < b.N; i++ {
-			h := p.Add(i)
-			p.Delete(h)
-		}
-	})
-	b.Run("impl=map", func(b *testing.B) {
-		p := make(map[int]bool)
-
-		// Force initial allocation
-		p[0] = true
-		delete(p, 0)
-
-		b.ResetTimer()
-
-		for i := 0; i < b.N; i++ {
-			p[i] = true
-			delete(p, i)
-		}
-	})
-}
-
-func BenchmarkPool_TakeRandom(b *testing.B) {
-	b.Run("impl=Pool", func(b *testing.B) {
-		p := Pool[int]{}
-
-		// Insert the number of items we'll be taking, then reset the timer.
-		for i := 0; i < b.N; i++ {
-			p.Add(i)
-		}
-		b.ResetTimer()
-
-		// Now benchmark taking all the items.
-		for i := 0; i < b.N; i++ {
-			p.TakeRandom()
-		}
-
-		if p.Len() != 0 {
-			b.Errorf("pool not empty")
-		}
-	})
-	b.Run("impl=map", func(b *testing.B) {
-		p := make(map[int]bool)
-
-		// Insert the number of items we'll be taking, then reset the timer.
-		for i := 0; i < b.N; i++ {
-			p[i] = true
-		}
-		b.ResetTimer()
-
-		// Now benchmark taking all the items.
-		for i := 0; i < b.N; i++ {
-			// Taking a random item is simulated by a single map iteration.
-			for k := range p {
-				delete(p, k) // "take" the item by removing it
-				break
-			}
-		}
-
-		if len(p) != 0 {
-			b.Errorf("map not empty")
-		}
-	})
-}
diff --git a/util/progresstracking/progresstracking.go b/util/progresstracking/progresstracking.go
index 21cbfa52b..5aad6d9f8 100644
--- a/util/progresstracking/progresstracking.go
+++ b/util/progresstracking/progresstracking.go
@@ -2,11 +2,14 @@
 // SPDX-License-Identifier: BSD-3-Clause
 
 // Package progresstracking provides wrappers around io.Reader and io.Writer
-// that track progress.
+// that track progress, and a Ticker for reporting progress from an atomic
+// counter on a regular interval.
 package progresstracking
 
 import (
 	"io"
+	"sync"
+	"sync/atomic"
 	"time"
 )
 
@@ -37,3 +40,82 @@ func (r *reader) Read(p []byte) (int, error) {
 	}
 	return n, err
 }
+
+// NewWriter wraps w with a writer that calls onProgress after every write
+// that brings the total past the next interval threshold. onProgress receives
+// the cumulative byte count. If expectedTotal > 0, a final onProgress call is
+// guaranteed when the cumulative count reaches or exceeds it, even if the
+// interval hasn't elapsed.
+func NewWriter(w io.Writer, expectedTotal int64, interval time.Duration, onProgress func(totalWritten int64)) io.Writer {
+	return &writer{w: w, expectedTotal: expectedTotal, interval: interval, onProgress: onProgress}
+}
+
+type writer struct {
+	w             io.Writer
+	expectedTotal int64 // non-zero if known
+	interval      time.Duration
+	onProgress    func(int64)
+	lastTracked   time.Time
+	total         int64
+	reachedTotal  bool
+}
+
+func (pw *writer) Write(p []byte) (int, error) {
+	n, err := pw.w.Write(p)
+	pw.total += int64(n)
+	if !pw.reachedTotal && pw.expectedTotal > 0 && pw.total >= pw.expectedTotal {
+		pw.onProgress(pw.total)
+		pw.reachedTotal = true
+	} else if time.Since(pw.lastTracked) > pw.interval {
+		pw.onProgress(pw.total)
+		pw.lastTracked = time.Now()
+	}
+	return n, err
+}
+
+// Ticker reports progress on a regular interval by polling a counter function.
+// It spawns a background goroutine that calls report approximately every
+// second. Call the returned stop function when the operation is complete;
+// stop calls report one final time and blocks until the goroutine exits.
+// The stop function is safe to call multiple times, but will only call
+// report the first time it is invoked.
+func Ticker(done func() int64, total int64, report func(done, total int64)) (stop func()) {
+	stopCh := make(chan struct{})
+	finished := make(chan struct{})
+	go func() {
+		defer close(finished)
+		t := time.NewTicker(time.Second)
+		defer t.Stop()
+		for {
+			select {
+			case <-stopCh:
+				report(done(), total)
+				return
+			case <-t.C:
+				report(done(), total)
+			}
+		}
+	}()
+	return sync.OnceFunc(func() {
+		close(stopCh)
+		<-finished
+	})
+}
+
+// CountingWriter wraps an io.Writer and atomically tracks total bytes
+// written, suitable for use with Ticker.
+type CountingWriter struct {
+	W     io.Writer
+	count atomic.Int64
+}
+
+// Count returns the total number of bytes written.
+func (c *CountingWriter) Count() int64 { return c.count.Load() }
+
+func (c *CountingWriter) Write(b []byte) (int, error) {
+	n, err := c.W.Write(b)
+	if n > 0 {
+		c.count.Add(int64(n))
+	}
+	return n, err
+}
diff --git a/util/set/set.go b/util/set/set.go
index c3d2350a7..c6db4f3f2 100644
--- a/util/set/set.go
+++ b/util/set/set.go
@@ -6,9 +6,12 @@ package set
 
 import (
 	"encoding/json"
+	"iter"
 	"maps"
 	"reflect"
 	"sort"
+
+	"tailscale.com/types/views"
 )
 
 // Set is a set of T.
@@ -26,14 +29,35 @@ func Of[T comparable](slice ...T) Set[T] {
 	return s
 }
 
+// OfSliceView returns a new set constructed from the elements in v.
+func OfSliceView[T comparable](v views.Slice[T]) Set[T] {
+	s := make(Set[T], v.Len())
+	s.AddSliceView(v)
+	return s
+}
+
 // Clone returns a new set cloned from the elements in s.
 func (s Set[T]) Clone() Set[T] {
 	return maps.Clone(s)
 }
 
+// All returns an iterator over all elements in s.
+// The iteration order is not specified
+// and is not guaranteed to be the same from one call to the next.
+func (s Set[T]) All() iter.Seq[T] {
+	return maps.Keys(s)
+}
+
 // Add adds e to s.
 func (s Set[T]) Add(e T) { s[e] = struct{}{} }
 
+// AddSeq adds each element of es to s.
+func (s Set[T]) AddSeq(es iter.Seq[T]) {
+	for e := range es {
+		s.Add(e)
+	}
+}
+
 // AddSlice adds each element of es to s.
 func (s Set[T]) AddSlice(es []T) {
 	for _, e := range es {
@@ -41,6 +65,13 @@ func (s Set[T]) AddSlice(es []T) {
 	}
 }
 
+// AddSliceView adds each element of v to s.
+func (s Set[T]) AddSliceView(v views.Slice[T]) {
+	for _, e := range v.All() {
+		s.Add(e)
+	}
+}
+
 // AddSet adds each element of es to s.
 func (s Set[T]) AddSet(es Set[T]) {
 	for e := range es {
@@ -105,6 +136,27 @@ func genOrderedSwapper(rt reflect.Type) func(reflect.Value) func(i, j int) bool
 // Delete removes e from the set.
 func (s Set[T]) Delete(e T) { delete(s, e) }
 
+// DeleteSeq removes all elements in es from the set.
+func (s Set[T]) DeleteSeq(es iter.Seq[T]) {
+	for e := range es {
+		s.Delete(e)
+	}
+}
+
+// DeleteSlice removes all elements in es from the set.
+func (s Set[T]) DeleteSlice(es []T) {
+	for _, e := range es {
+		s.Delete(e)
+	}
+}
+
+// DeleteSet removes all elements in es from the set.
+func (s Set[T]) DeleteSet(es Set[T]) {
+	for e := range es {
+		s.Delete(e)
+	}
+}
+
 // Contains reports whether s contains e.
 func (s Set[T]) Contains(e T) bool {
 	_, ok := s[e]
diff --git a/util/set/set_test.go b/util/set/set_test.go
index 2188cbb4d..1c7dee287 100644
--- a/util/set/set_test.go
+++ b/util/set/set_test.go
@@ -7,6 +7,8 @@ import (
 	"encoding/json"
 	"slices"
 	"testing"
+
+	"tailscale.com/types/views"
 )
 
 func TestSet(t *testing.T) {
@@ -50,6 +52,40 @@ func TestSet(t *testing.T) {
 			t.Errorf("slice missing %d (%#v)", e, es)
 		}
 	}
+
+	s.Delete(1)
+	if s.Contains(1) {
+		t.Error("shouldn't have 1")
+	}
+	if !s.Contains(2) {
+		t.Error("missing 2")
+	}
+	if !s.Contains(3) {
+		t.Error("missing 3")
+	}
+	if !s.Contains(4) {
+		t.Error("missing 4")
+	}
+	if s.Len() != 3 {
+		t.Errorf("wrong len %d; want 3", s.Len())
+	}
+
+	s.DeleteSeq(slices.Values([]int{2, 3}))
+	if s.Contains(1) {
+		t.Error("shouldn't have 1")
+	}
+	if s.Contains(2) {
+		t.Error("shouldn't have 2")
+	}
+	if s.Contains(3) {
+		t.Error("shouldn't have 3")
+	}
+	if !s.Contains(4) {
+		t.Error("missing 4")
+	}
+	if s.Len() != 1 {
+		t.Errorf("wrong len %d; want 1", s.Len())
+	}
 }
 
 func TestSetOf(t *testing.T) {
@@ -64,6 +100,18 @@ func TestSetOf(t *testing.T) {
 	}
 }
 
+func TestOfSliceView(t *testing.T) {
+	s := OfSliceView(views.SliceOf([]int{1, 2, 3, 4, 4, 1}))
+	if s.Len() != 4 {
+		t.Errorf("wrong len %d; want 4", s.Len())
+	}
+	for _, n := range []int{1, 2, 3, 4} {
+		if !s.Contains(n) {
+			t.Errorf("should contain %d", n)
+		}
+	}
+}
+
 func TestEqual(t *testing.T) {
 	type test struct {
 		name     string
diff --git a/util/syspolicy/load.go b/util/syspolicy/load.go
new file mode 100644
index 000000000..89acaaabe
--- /dev/null
+++ b/util/syspolicy/load.go
@@ -0,0 +1,42 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package syspolicy
+
+import (
+	"errors"
+	"fmt"
+	"io/fs"
+
+	"tailscale.com/util/syspolicy/rsop"
+	"tailscale.com/util/syspolicy/setting"
+	"tailscale.com/util/syspolicy/source"
+)
+
+// LoadJSONPolicyFile loads policy settings from the JSON file at path and
+// registers them as a [setting.DeviceScope] policy source under sourceName.
+//
+// If path does not exist, no source is registered and the function returns
+// nil. Malformed JSON, unknown setting keys, or values that cannot be
+// decoded as the registered type for their key all surface as errors here
+// rather than at first use, and nothing is registered.
+//
+// LoadJSONPolicyFile is intended to be called once, early in process
+// startup, after command-line flags are parsed but before any policy
+// setting is read.
+func LoadJSONPolicyFile(sourceName, path string) error {
+	store, err := source.NewJSONPolicyStoreFromFile(path)
+	if err != nil {
+		if errors.Is(err, fs.ErrNotExist) {
+			return nil
+		}
+		return fmt.Errorf("syspolicy: loading %s: %w", path, err)
+	}
+	if err := store.Validate(); err != nil {
+		return fmt.Errorf("syspolicy: invalid %s:\n%w", path, err)
+	}
+	if _, err := rsop.RegisterStore(sourceName, setting.DeviceScope, store); err != nil {
+		return fmt.Errorf("syspolicy: registering %s: %w", path, err)
+	}
+	return nil
+}
diff --git a/util/syspolicy/policyclient/policy_snapshot.go b/util/syspolicy/policyclient/policy_snapshot.go
new file mode 100644
index 000000000..eaa4953a2
--- /dev/null
+++ b/util/syspolicy/policyclient/policy_snapshot.go
@@ -0,0 +1,12 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !ts_omit_syspolicy
+
+package policyclient
+
+import "tailscale.com/util/syspolicy/setting"
+
+// PolicySnapshot is an alias for [settings.Snapshot] unless syspolicy is omitted
+// from the build.
+type policySnapshot = setting.Snapshot
diff --git a/util/syspolicy/policyclient/policy_snapshot_omit.go b/util/syspolicy/policyclient/policy_snapshot_omit.go
new file mode 100644
index 000000000..24b6b52f0
--- /dev/null
+++ b/util/syspolicy/policyclient/policy_snapshot_omit.go
@@ -0,0 +1,9 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build ts_omit_syspolicy
+
+package policyclient
+
+// PolicySnapshot is a stub when syspolicy is omitted from the build.
+type policySnapshot struct{}
diff --git a/util/syspolicy/policyclient/policyclient.go b/util/syspolicy/policyclient/policyclient.go
index e6ad208b0..ed5192ec2 100644
--- a/util/syspolicy/policyclient/policyclient.go
+++ b/util/syspolicy/policyclient/policyclient.go
@@ -62,11 +62,21 @@ type Client interface {
 	HasAnyOf(keys ...pkey.Key) (bool, error)
 
 	// RegisterChangeCallback registers a callback function that will be called
-	// whenever a policy change is detected. It returns a function to unregister
-	// the callback and an error if the registration fails.
-	RegisterChangeCallback(cb func(PolicyChange)) (unregister func(), err error)
+	// whenever a policy change is detected. If uid is empty, the callback fires
+	// for device-scope policy changes. If uid is non-empty, it fires for changes
+	// to that user's effective policy (device + user policies merged). It returns
+	// a function to unregister the callback and an error if the registration fails.
+	RegisterChangeCallback(uid string, cb func(PolicyChange)) (unregister func(), err error)
+
+	// GetPolicySnapshot returns the effective policy snapshot for the given user ID.
+	// If uid is empty, returns the default-scope policy. Returns nil, nil if policy
+	// snapshots are not supported.
+	GetPolicySnapshot(uid string) (*PolicySnapshot, error)
 }
 
+// PolicySnapshot is an alias for [setting.Snapshot] unless syspolicy is omitted from the build.
+type PolicySnapshot = policySnapshot
+
 // Get returns a non-nil [Client] implementation as a function of the
 // build tags. It returns a no-op implementation if the full syspolicy
 // package is omitted from the build, or in tests.
@@ -140,6 +150,10 @@ func (NoPolicyClient) HasAnyOf(keys ...pkey.Key) (bool, error) {
 
 func (NoPolicyClient) SetDebugLoggingEnabled(enabled bool) {}
 
-func (NoPolicyClient) RegisterChangeCallback(cb func(PolicyChange)) (unregister func(), err error) {
+func (NoPolicyClient) RegisterChangeCallback(uid string, cb func(PolicyChange)) (unregister func(), err error) {
 	return func() {}, nil
 }
+
+func (NoPolicyClient) GetPolicySnapshot(uid string) (*PolicySnapshot, error) {
+	return nil, nil
+}
diff --git a/util/syspolicy/policytest/policytest.go b/util/syspolicy/policytest/policytest.go
index 9879a0fd3..e2208ff2b 100644
--- a/util/syspolicy/policytest/policytest.go
+++ b/util/syspolicy/policytest/policytest.go
@@ -226,7 +226,7 @@ func (c Config) HasAnyOf(keys ...pkey.Key) (bool, error) {
 	return false, nil
 }
 
-func (c Config) RegisterChangeCallback(callback func(policyclient.PolicyChange)) (func(), error) {
+func (c Config) RegisterChangeCallback(uid string, callback func(policyclient.PolicyChange)) (func(), error) {
 	w, ok := c[watchersKey].(*watchers)
 	if !ok {
 		return func() {}, nil
@@ -242,3 +242,7 @@ func (c Config) RegisterChangeCallback(callback func(policyclient.PolicyChange))
 }
 
 func (sp Config) SetDebugLoggingEnabled(enabled bool) {}
+
+func (c Config) GetPolicySnapshot(uid string) (*policyclient.PolicySnapshot, error) {
+	return nil, nil
+}
diff --git a/util/syspolicy/source/json_policy_store.go b/util/syspolicy/source/json_policy_store.go
new file mode 100644
index 000000000..461e104f4
--- /dev/null
+++ b/util/syspolicy/source/json_policy_store.go
@@ -0,0 +1,226 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package source
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"math"
+	"os"
+	"sort"
+	"strconv"
+
+	"tailscale.com/feature/buildfeatures"
+	"tailscale.com/util/syspolicy/pkey"
+	"tailscale.com/util/syspolicy/setting"
+)
+
+// hujsonStandardize is set to hujson.Standardize by json_policy_store_hujson.go
+// on platforms that have HuJSON support compiled in. When non-nil, the JSON
+// policy file may use HuJSON (comments and trailing commas); when nil, the
+// file must be pure standard JSON.
+var hujsonStandardize func([]byte) ([]byte, error)
+
+var _ Store = (*JSONPolicyStore)(nil)
+
+// JSONPolicyStore is a [Store] backed by a JSON object that maps policy
+// setting keys to values. It is a read-only snapshot; the underlying map
+// is captured at construction time and never re-read.
+//
+// JSON values are mapped to policy setting types as follows:
+//   - strings map to [setting.StringValue], [setting.PreferenceOptionValue],
+//     [setting.VisibilityValue], and [setting.DurationValue]. For
+//     [setting.DurationValue], the string is parsed by [time.ParseDuration]
+//     elsewhere in the package (e.g. "24h", "5m").
+//   - booleans map to [setting.BooleanValue].
+//   - numbers map to [setting.IntegerValue]. Negative or non-integer values
+//     are rejected with [setting.ErrTypeMismatch].
+//   - arrays of strings map to [setting.StringListValue].
+type JSONPolicyStore struct {
+	m map[string]any
+}
+
+// NewJSONPolicyStore returns a new [JSONPolicyStore] backed by the given map.
+// A nil or empty map results in a store that reports every key as
+// [setting.ErrNotConfigured].
+func NewJSONPolicyStore(m map[string]any) *JSONPolicyStore {
+	return &JSONPolicyStore{m: m}
+}
+
+// NewJSONPolicyStoreFromFile reads the file at path and returns a new
+// [JSONPolicyStore] backed by its contents. The file must contain a JSON
+// object at its top level. JSON numbers are decoded as [json.Number] to
+// preserve precision for [setting.IntegerValue] settings.
+func NewJSONPolicyStoreFromFile(path string) (*JSONPolicyStore, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return nil, err
+	}
+	return NewJSONPolicyStoreFromBytes(data)
+}
+
+// NewJSONPolicyStoreFromBytes is like [NewJSONPolicyStoreFromFile] but reads
+// from data instead of a file. When HuJSON support is linked into the build,
+// data may be HuJSON (comments and trailing commas allowed); otherwise it
+// must be pure standard JSON.
+func NewJSONPolicyStoreFromBytes(data []byte) (*JSONPolicyStore, error) {
+	if buildfeatures.HasHuJSONConf && hujsonStandardize != nil {
+		std, err := hujsonStandardize(data)
+		if err != nil {
+			return nil, fmt.Errorf("syspolicy: parsing HuJSON/JSON: %w", err)
+		}
+		data = std
+	}
+	dec := json.NewDecoder(bytes.NewReader(data))
+	dec.UseNumber()
+	var m map[string]any
+	if err := dec.Decode(&m); err != nil {
+		return nil, fmt.Errorf("syspolicy: parsing JSON: %w", err)
+	}
+	return &JSONPolicyStore{m: m}, nil
+}
+
+// ReadString implements [Store].
+func (s *JSONPolicyStore) ReadString(key pkey.Key) (string, error) {
+	v, ok := s.m[string(key)]
+	if !ok {
+		return "", setting.ErrNotConfigured
+	}
+	str, ok := v.(string)
+	if !ok {
+		return "", fmt.Errorf("%w: %q is %T, want string", setting.ErrTypeMismatch, key, v)
+	}
+	return str, nil
+}
+
+// ReadBoolean implements [Store].
+func (s *JSONPolicyStore) ReadBoolean(key pkey.Key) (bool, error) {
+	v, ok := s.m[string(key)]
+	if !ok {
+		return false, setting.ErrNotConfigured
+	}
+	b, ok := v.(bool)
+	if !ok {
+		return false, fmt.Errorf("%w: %q is %T, want bool", setting.ErrTypeMismatch, key, v)
+	}
+	return b, nil
+}
+
+// ReadUInt64 implements [Store].
+func (s *JSONPolicyStore) ReadUInt64(key pkey.Key) (uint64, error) {
+	v, ok := s.m[string(key)]
+	if !ok {
+		return 0, setting.ErrNotConfigured
+	}
+	switch n := v.(type) {
+	case json.Number:
+		u, err := strconv.ParseUint(n.String(), 10, 64)
+		if err != nil {
+			return 0, fmt.Errorf("%w: %q is not a uint64: %v", setting.ErrTypeMismatch, key, err)
+		}
+		return u, nil
+	case float64:
+		if n < 0 || n > math.MaxUint64 || n != math.Trunc(n) {
+			return 0, fmt.Errorf("%w: %q (%v) is not a uint64", setting.ErrTypeMismatch, key, n)
+		}
+		return uint64(n), nil
+	default:
+		return 0, fmt.Errorf("%w: %q is %T, want number", setting.ErrTypeMismatch, key, v)
+	}
+}
+
+// ReadStringArray implements [Store].
+func (s *JSONPolicyStore) ReadStringArray(key pkey.Key) ([]string, error) {
+	v, ok := s.m[string(key)]
+	if !ok {
+		return nil, setting.ErrNotConfigured
+	}
+	arr, ok := v.([]any)
+	if !ok {
+		return nil, fmt.Errorf("%w: %q is %T, want array", setting.ErrTypeMismatch, key, v)
+	}
+	res := make([]string, len(arr))
+	for i, e := range arr {
+		str, ok := e.(string)
+		if !ok {
+			return nil, fmt.Errorf("%w: %q[%d] is %T, want string", setting.ErrTypeMismatch, key, i, e)
+		}
+		res[i] = str
+	}
+	return res, nil
+}
+
+// Validate checks that every key in the parsed JSON corresponds to a
+// registered policy setting (per [setting.Definitions]) and that its value
+// can be successfully decoded as the registered setting's type. It joins
+// all problems into a single error so callers see every issue at once
+// instead of one per startup-then-runtime cycle.
+//
+// Validate triggers registration of any deferred setting definitions, so
+// it should only be called after all init-time registrations have run.
+func (s *JSONPolicyStore) Validate() error {
+	defs, err := setting.Definitions()
+	if err != nil {
+		return err
+	}
+	byKey := make(map[pkey.Key]*setting.Definition, len(defs))
+	for _, d := range defs {
+		byKey[d.Key()] = d
+	}
+
+	keys := make([]string, 0, len(s.m))
+	for k := range s.m {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+
+	var errs []error
+	for _, k := range keys {
+		def, ok := byKey[pkey.Key(k)]
+		if !ok {
+			errs = append(errs, fmt.Errorf("unknown policy setting %q", k))
+			continue
+		}
+		if err := s.validateValue(def); err != nil {
+			errs = append(errs, fmt.Errorf("%q: %w", k, err))
+		}
+	}
+	return errors.Join(errs...)
+}
+
+// validateValue is like [readPolicySettingValue] but is stricter for the
+// enum-like [setting.PreferenceOptionValue] and [setting.VisibilityValue]
+// types: their runtime UnmarshalText silently coerces unknown strings to a
+// default, which is fine at read time but defeats the point of load-time
+// validation, so this checks the raw string against the known values.
+func (s *JSONPolicyStore) validateValue(def *setting.Definition) error {
+	key := def.Key()
+	switch def.Type() {
+	case setting.PreferenceOptionValue:
+		str, err := s.ReadString(key)
+		if err != nil {
+			return err
+		}
+		switch str {
+		case "always", "never", "user-decides":
+			return nil
+		}
+		return fmt.Errorf(`%w: %q is not a valid PreferenceOption ("always", "never", or "user-decides")`, setting.ErrTypeMismatch, str)
+	case setting.VisibilityValue:
+		str, err := s.ReadString(key)
+		if err != nil {
+			return err
+		}
+		switch str {
+		case "show", "hide":
+			return nil
+		}
+		return fmt.Errorf(`%w: %q is not a valid Visibility ("show" or "hide")`, setting.ErrTypeMismatch, str)
+	default:
+		_, err := readPolicySettingValue(s, def)
+		return err
+	}
+}
diff --git a/util/syspolicy/source/json_policy_store_hujson.go b/util/syspolicy/source/json_policy_store_hujson.go
new file mode 100644
index 000000000..8f1e981e8
--- /dev/null
+++ b/util/syspolicy/source/json_policy_store_hujson.go
@@ -0,0 +1,19 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !ios && !android && !ts_omit_hujsonconf
+
+package source
+
+import "github.com/tailscale/hujson"
+
+// Only link the hujson package on platforms that use it, to reduce binary
+// size & memory a bit. iOS and Android don't load syspolicy files from
+// disk so they don't need HuJSON either.
+//
+// While the linker's deadcode mostly handles this today, this keeps us
+// honest for the future.
+
+func init() {
+	hujsonStandardize = hujson.Standardize
+}
diff --git a/util/syspolicy/source/json_policy_store_test.go b/util/syspolicy/source/json_policy_store_test.go
new file mode 100644
index 000000000..0f4e34798
--- /dev/null
+++ b/util/syspolicy/source/json_policy_store_test.go
@@ -0,0 +1,366 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package source
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	"tailscale.com/util/syspolicy/pkey"
+	"tailscale.com/util/syspolicy/ptype"
+	"tailscale.com/util/syspolicy/setting"
+)
+
+func TestJSONPolicyStoreReadString(t *testing.T) {
+	s := NewJSONPolicyStore(map[string]any{
+		"ControlURL": "https://controlplane.example.com",
+		"AuthKey":    "tskey-auth-xxx",
+		"Bool":       true,
+	})
+
+	got, err := s.ReadString("ControlURL")
+	if err != nil {
+		t.Fatalf("ReadString(ControlURL) error: %v", err)
+	}
+	if want := "https://controlplane.example.com"; got != want {
+		t.Errorf("ReadString(ControlURL) = %q, want %q", got, want)
+	}
+
+	if _, err := s.ReadString("Missing"); !errors.Is(err, setting.ErrNotConfigured) {
+		t.Errorf("ReadString(Missing) err = %v, want ErrNotConfigured", err)
+	}
+
+	if _, err := s.ReadString("Bool"); !errors.Is(err, setting.ErrTypeMismatch) {
+		t.Errorf("ReadString(Bool) err = %v, want ErrTypeMismatch", err)
+	}
+}
+
+func TestJSONPolicyStoreReadBoolean(t *testing.T) {
+	s := NewJSONPolicyStore(map[string]any{
+		"AlwaysOn": true,
+		"Str":      "yes",
+	})
+
+	got, err := s.ReadBoolean("AlwaysOn")
+	if err != nil {
+		t.Fatalf("ReadBoolean(AlwaysOn) error: %v", err)
+	}
+	if !got {
+		t.Errorf("ReadBoolean(AlwaysOn) = false, want true")
+	}
+
+	if _, err := s.ReadBoolean("Missing"); !errors.Is(err, setting.ErrNotConfigured) {
+		t.Errorf("ReadBoolean(Missing) err = %v, want ErrNotConfigured", err)
+	}
+
+	if _, err := s.ReadBoolean("Str"); !errors.Is(err, setting.ErrTypeMismatch) {
+		t.Errorf("ReadBoolean(Str) err = %v, want ErrTypeMismatch", err)
+	}
+}
+
+func TestJSONPolicyStoreReadStringArray(t *testing.T) {
+	s := NewJSONPolicyStore(map[string]any{
+		"AllowedSuggestedExitNodes": []any{"node-a", "node-b"},
+		"Empty":                     []any{},
+		"NotArray":                  "abc",
+		"WrongElem":                 []any{"a", 1},
+	})
+
+	got, err := s.ReadStringArray("AllowedSuggestedExitNodes")
+	if err != nil {
+		t.Fatalf("ReadStringArray(AllowedSuggestedExitNodes) error: %v", err)
+	}
+	if want := []string{"node-a", "node-b"}; !reflect.DeepEqual(got, want) {
+		t.Errorf("ReadStringArray = %v, want %v", got, want)
+	}
+
+	got, err = s.ReadStringArray("Empty")
+	if err != nil {
+		t.Fatalf("ReadStringArray(Empty) error: %v", err)
+	}
+	if len(got) != 0 {
+		t.Errorf("ReadStringArray(Empty) = %v, want empty", got)
+	}
+
+	if _, err := s.ReadStringArray("Missing"); !errors.Is(err, setting.ErrNotConfigured) {
+		t.Errorf("ReadStringArray(Missing) err = %v, want ErrNotConfigured", err)
+	}
+	if _, err := s.ReadStringArray("NotArray"); !errors.Is(err, setting.ErrTypeMismatch) {
+		t.Errorf("ReadStringArray(NotArray) err = %v, want ErrTypeMismatch", err)
+	}
+	if _, err := s.ReadStringArray("WrongElem"); !errors.Is(err, setting.ErrTypeMismatch) {
+		t.Errorf("ReadStringArray(WrongElem) err = %v, want ErrTypeMismatch", err)
+	}
+}
+
+func TestJSONPolicyStoreReadUInt64FromMap(t *testing.T) {
+	s := NewJSONPolicyStore(map[string]any{
+		"Float":    float64(42),
+		"Negative": float64(-1),
+		"Frac":     float64(1.5),
+		"Str":      "nope",
+	})
+
+	got, err := s.ReadUInt64("Float")
+	if err != nil {
+		t.Fatalf("ReadUInt64(Float) error: %v", err)
+	}
+	if got != 42 {
+		t.Errorf("ReadUInt64(Float) = %d, want 42", got)
+	}
+
+	if _, err := s.ReadUInt64("Missing"); !errors.Is(err, setting.ErrNotConfigured) {
+		t.Errorf("ReadUInt64(Missing) err = %v, want ErrNotConfigured", err)
+	}
+	for _, k := range []pkey.Key{"Negative", "Frac", "Str"} {
+		if _, err := s.ReadUInt64(k); !errors.Is(err, setting.ErrTypeMismatch) {
+			t.Errorf("ReadUInt64(%s) err = %v, want ErrTypeMismatch", k, err)
+		}
+	}
+}
+
+func TestJSONPolicyStoreReadUInt64FromJSON(t *testing.T) {
+	// json.Number path: bigger than float64 mantissa precision.
+	s, err := NewJSONPolicyStoreFromBytes([]byte(`{"Big": 18446744073709551610}`))
+	if err != nil {
+		t.Fatalf("NewJSONPolicyStoreFromBytes: %v", err)
+	}
+	got, err := s.ReadUInt64("Big")
+	if err != nil {
+		t.Fatalf("ReadUInt64(Big) error: %v", err)
+	}
+	if want := uint64(18446744073709551610); got != want {
+		t.Errorf("ReadUInt64(Big) = %d, want %d", got, want)
+	}
+}
+
+// TestJSONPolicyStoreDuration verifies that duration-typed settings, which
+// the reader fetches via ReadString and parses with time.ParseDuration, work
+// end-to-end with values like "24h".
+func TestJSONPolicyStoreDuration(t *testing.T) {
+	s := NewJSONPolicyStore(map[string]any{
+		"ReconnectAfter": "24h",
+		"Bad":            "notaduration",
+	})
+	def := setting.NewDefinition("ReconnectAfter", setting.DeviceSetting, setting.DurationValue)
+	v, err := readPolicySettingValue(s, def)
+	if err != nil {
+		t.Fatalf("readPolicySettingValue(ReconnectAfter) error: %v", err)
+	}
+	if got, want := v.(time.Duration), 24*time.Hour; got != want {
+		t.Errorf("ReconnectAfter = %v, want %v", got, want)
+	}
+
+	badDef := setting.NewDefinition("Bad", setting.DeviceSetting, setting.DurationValue)
+	if _, err := readPolicySettingValue(s, badDef); err == nil {
+		t.Errorf("readPolicySettingValue(Bad) err = nil, want parse error")
+	}
+}
+
+func TestJSONPolicyStorePreferenceOptionAndVisibility(t *testing.T) {
+	s := NewJSONPolicyStore(map[string]any{
+		"CheckUpdates":           "always",
+		"AdminConsoleVisibility": "hide",
+	})
+	prefDef := setting.NewDefinition("CheckUpdates", setting.DeviceSetting, setting.PreferenceOptionValue)
+	v, err := readPolicySettingValue(s, prefDef)
+	if err != nil {
+		t.Fatalf("readPolicySettingValue(CheckUpdates) error: %v", err)
+	}
+	if got := v.(ptype.PreferenceOption); got != ptype.AlwaysByPolicy {
+		t.Errorf("CheckUpdates = %v, want AlwaysByPolicy", got)
+	}
+
+	visDef := setting.NewDefinition("AdminConsoleVisibility", setting.UserSetting, setting.VisibilityValue)
+	v, err = readPolicySettingValue(s, visDef)
+	if err != nil {
+		t.Fatalf("readPolicySettingValue(AdminConsoleVisibility) error: %v", err)
+	}
+	if got := v.(ptype.Visibility); got != ptype.HiddenByPolicy {
+		t.Errorf("AdminConsoleVisibility = %v, want HiddenByPolicy", got)
+	}
+}
+
+func TestJSONPolicyStoreValidate(t *testing.T) {
+	// Register a small set of definitions covering each type that the
+	// validator needs to exercise.
+	if err := setting.SetDefinitionsForTest(t,
+		setting.NewDefinition("ControlURL", setting.DeviceSetting, setting.StringValue),
+		setting.NewDefinition("AlwaysOn", setting.DeviceSetting, setting.BooleanValue),
+		setting.NewDefinition("AllowedSuggestedExitNodes", setting.DeviceSetting, setting.StringListValue),
+		setting.NewDefinition("ReconnectAfter", setting.DeviceSetting, setting.DurationValue),
+		setting.NewDefinition("CheckUpdates", setting.DeviceSetting, setting.PreferenceOptionValue),
+		setting.NewDefinition("AdminConsoleVisibility", setting.UserSetting, setting.VisibilityValue),
+	); err != nil {
+		t.Fatal(err)
+	}
+
+	tests := []struct {
+		name        string
+		json        map[string]any
+		wantOK      bool
+		wantErrSubs []string // substrings the error must contain (only when wantOK is false)
+	}{
+		{
+			name:   "empty",
+			json:   map[string]any{},
+			wantOK: true,
+		},
+		{
+			name: "all_valid",
+			json: map[string]any{
+				"ControlURL":                "https://controlplane.example.com",
+				"AlwaysOn":                  true,
+				"AllowedSuggestedExitNodes": []any{"node-a", "node-b"},
+				"ReconnectAfter":            "24h",
+				"CheckUpdates":              "always",
+				"AdminConsoleVisibility":    "hide",
+			},
+			wantOK: true,
+		},
+		{
+			name: "unknown_key",
+			json: map[string]any{
+				"ControlURL":  "https://controlplane.example.com",
+				"NoSuchThing": "whatever",
+			},
+			wantErrSubs: []string{`unknown policy setting "NoSuchThing"`},
+		},
+		{
+			name: "wrong_type_string",
+			json: map[string]any{
+				"ControlURL": true,
+			},
+			wantErrSubs: []string{`"ControlURL"`, "type mismatch"},
+		},
+		{
+			name: "wrong_type_bool",
+			json: map[string]any{
+				"AlwaysOn": "yes",
+			},
+			wantErrSubs: []string{`"AlwaysOn"`, "type mismatch"},
+		},
+		{
+			name: "wrong_type_array",
+			json: map[string]any{
+				"AllowedSuggestedExitNodes": "node-a",
+			},
+			wantErrSubs: []string{`"AllowedSuggestedExitNodes"`, "type mismatch"},
+		},
+		{
+			name: "bad_duration",
+			json: map[string]any{
+				"ReconnectAfter": "notaduration",
+			},
+			wantErrSubs: []string{`"ReconnectAfter"`, "notaduration"},
+		},
+		{
+			name: "bad_preference_option",
+			json: map[string]any{
+				"CheckUpdates": "sometimes",
+			},
+			wantErrSubs: []string{`"CheckUpdates"`, "sometimes", "always"},
+		},
+		{
+			name: "bad_visibility",
+			json: map[string]any{
+				"AdminConsoleVisibility": "maybe",
+			},
+			wantErrSubs: []string{`"AdminConsoleVisibility"`, "maybe", "show"},
+		},
+		{
+			name: "multiple_errors_reported",
+			json: map[string]any{
+				"AlwaysOn":    "yes",
+				"NoSuchThing": 1,
+			},
+			wantErrSubs: []string{`"AlwaysOn"`, `unknown policy setting "NoSuchThing"`},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := NewJSONPolicyStore(tt.json).Validate()
+			if tt.wantOK {
+				if err != nil {
+					t.Fatalf("Validate() = %v, want nil", err)
+				}
+				return
+			}
+			if err == nil {
+				t.Fatalf("Validate() = nil, want error containing %v", tt.wantErrSubs)
+			}
+			for _, sub := range tt.wantErrSubs {
+				if !strings.Contains(err.Error(), sub) {
+					t.Errorf("Validate() error = %q, want it to contain %q", err, sub)
+				}
+			}
+		})
+	}
+}
+
+func TestNewJSONPolicyStoreFromBytesHuJSON(t *testing.T) {
+	if hujsonStandardize == nil {
+		t.Skip("HuJSON support not linked into this build")
+	}
+	const hujsonInput = `{
+  // The control plane URL.
+  "ControlURL": "https://controlplane.example.com",
+  "AlwaysOn": true, // trailing comma is OK in HuJSON
+}`
+	s, err := NewJSONPolicyStoreFromBytes([]byte(hujsonInput))
+	if err != nil {
+		t.Fatalf("NewJSONPolicyStoreFromBytes(HuJSON) error: %v", err)
+	}
+	got, err := s.ReadString("ControlURL")
+	if err != nil {
+		t.Fatalf("ReadString: %v", err)
+	}
+	if want := "https://controlplane.example.com"; got != want {
+		t.Errorf("ReadString = %q, want %q", got, want)
+	}
+	gotBool, err := s.ReadBoolean("AlwaysOn")
+	if err != nil {
+		t.Fatalf("ReadBoolean: %v", err)
+	}
+	if !gotBool {
+		t.Errorf("ReadBoolean = false, want true")
+	}
+}
+
+func TestNewJSONPolicyStoreFromFile(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "syspolicy.json")
+	if err := os.WriteFile(path, []byte(`{"ControlURL": "https://example.com"}`), 0600); err != nil {
+		t.Fatal(err)
+	}
+	s, err := NewJSONPolicyStoreFromFile(path)
+	if err != nil {
+		t.Fatalf("NewJSONPolicyStoreFromFile: %v", err)
+	}
+	got, err := s.ReadString("ControlURL")
+	if err != nil {
+		t.Fatalf("ReadString: %v", err)
+	}
+	if want := "https://example.com"; got != want {
+		t.Errorf("ReadString = %q, want %q", got, want)
+	}
+
+	if _, err := NewJSONPolicyStoreFromFile(filepath.Join(dir, "missing.json")); err == nil {
+		t.Errorf("NewJSONPolicyStoreFromFile(missing) err = nil, want error")
+	}
+
+	bad := filepath.Join(dir, "bad.json")
+	if err := os.WriteFile(bad, []byte(`not json`), 0600); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := NewJSONPolicyStoreFromFile(bad); err == nil {
+		t.Errorf("NewJSONPolicyStoreFromFile(bad) err = nil, want parse error")
+	}
+}
diff --git a/util/syspolicy/source/policy_reader.go b/util/syspolicy/source/policy_reader.go
index 177985322..ece08e3cb 100644
--- a/util/syspolicy/source/policy_reader.go
+++ b/util/syspolicy/source/policy_reader.go
@@ -91,7 +91,7 @@ func newReader(store Store, origin *setting.Origin) (*Reader, error) {
 }
 
 // GetSettings returns the current [*setting.Snapshot],
-// re-reading it from from the underlying [Store] only if the policy
+// re-reading it from the underlying [Store] only if the policy
 // has changed since it was read last. It never fails and returns
 // the previous version of the policy settings if a read attempt fails.
 func (r *Reader) GetSettings() *setting.Snapshot {
@@ -125,6 +125,11 @@ func (r *Reader) ReadSettings() (*setting.Snapshot, error) {
 func (r *Reader) reload(force bool) (*setting.Snapshot, error) {
 	r.mu.Lock()
 	defer r.mu.Unlock()
+	if r.closing {
+		// The reader is closing (or already closed) and r.store may be nil.
+		// Return the last known policy instead of reading from the store.
+		return r.lastPolicy, nil
+	}
 	if r.upToDate && !force {
 		return r.lastPolicy, nil
 	}
@@ -267,12 +272,13 @@ func (r *Reader) Close() error {
 			return err
 		}
 	}
-	r.store = nil
-
 	close(r.doneCh)
 
 	r.mu.Lock()
 	defer r.mu.Unlock()
+	// Nil out the store only while holding r.mu; reload reads r.store
+	// under the same lock, so writing it unlocked would be a data race.
+	r.store = nil
 	for _, c := range r.sessions {
 		c.closeInternal()
 	}
diff --git a/util/syspolicy/source/policy_reader_test.go b/util/syspolicy/source/policy_reader_test.go
index e5a893f56..0a477b0c6 100644
--- a/util/syspolicy/source/policy_reader_test.go
+++ b/util/syspolicy/source/policy_reader_test.go
@@ -5,6 +5,7 @@ package source
 
 import (
 	"cmp"
+	"sync"
 	"testing"
 	"time"
 
@@ -244,6 +245,39 @@ func TestReaderLifecycle(t *testing.T) {
 	}
 }
 
+// TestReaderCloseReloadRace is a regression test for tailscale/corp#45548,
+// where [Reader.Close] set r.store to nil without holding r.mu while a
+// concurrent [Reader.reload] read r.store under r.mu, causing a data race
+// and a potential nil interface method call panic.
+func TestReaderCloseReloadRace(t *testing.T) {
+	setting.SetDefinitionsForTest(t, setting.NewDefinition("StringValue", setting.DeviceSetting, setting.StringValue))
+	origin := setting.NewNamedOrigin("Test", setting.DeviceScope)
+	for range 100 {
+		store := NewTestStoreOf(t, TestSettingOf("StringValue", "S1"))
+		reader, err := newReader(store, origin)
+		if err != nil {
+			t.Fatalf("newReader failed: %v", err)
+		}
+
+		var wg sync.WaitGroup
+		start := make(chan struct{})
+		for range 4 {
+			wg.Go(func() {
+				<-start
+				for range 10 {
+					reader.ReadSettings()
+				}
+			})
+		}
+		wg.Go(func() {
+			<-start
+			reader.Close()
+		})
+		close(start)
+		wg.Wait()
+	}
+}
+
 func TestReadingSession(t *testing.T) {
 	setting.SetDefinitionsForTest(t, setting.NewDefinition("StringValue", setting.DeviceSetting, setting.StringValue))
 	store := NewTestStore(t)
diff --git a/util/syspolicy/syspolicy.go b/util/syspolicy/syspolicy.go
index 7451bde75..ed37b9a02 100644
--- a/util/syspolicy/syspolicy.go
+++ b/util/syspolicy/syspolicy.go
@@ -129,8 +129,12 @@ func getDuration(name pkey.Key, defaultValue time.Duration) (time.Duration, erro
 
 // registerChangeCallback adds a function that will be called whenever the effective policy
 // for the default scope changes. The returned function can be used to unregister the callback.
-func registerChangeCallback(cb rsop.PolicyChangeCallback) (unregister func(), err error) {
-	effective, err := rsop.PolicyFor(setting.DefaultScope())
+func registerChangeCallback(uid string, cb rsop.PolicyChangeCallback) (unregister func(), err error) {
+	scope := setting.DefaultScope()
+	if uid != "" {
+		scope = setting.UserScopeOf(uid)
+	}
+	effective, err := rsop.PolicyFor(scope)
 	if err != nil {
 		return nil, err
 	}
@@ -259,6 +263,18 @@ func (globalSyspolicy) HasAnyOf(keys ...pkey.Key) (bool, error) {
 	return hasAnyOf(keys...)
 }
 
-func (globalSyspolicy) RegisterChangeCallback(cb func(policyclient.PolicyChange)) (unregister func(), err error) {
-	return registerChangeCallback(cb)
+func (globalSyspolicy) RegisterChangeCallback(uid string, cb func(policyclient.PolicyChange)) (unregister func(), err error) {
+	return registerChangeCallback(uid, cb)
+}
+
+func (globalSyspolicy) GetPolicySnapshot(uid string) (*policyclient.PolicySnapshot, error) {
+	scope := setting.DefaultScope()
+	if uid != "" {
+		scope = setting.UserScopeOf(uid)
+	}
+	p, err := rsop.PolicyFor(scope)
+	if err != nil {
+		return nil, err
+	}
+	return p.Get(), nil
 }
diff --git a/util/sysresources/memory.go b/util/sysresources/memory.go
deleted file mode 100644
index 3c6b9ae85..000000000
--- a/util/sysresources/memory.go
+++ /dev/null
@@ -1,10 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-package sysresources
-
-// TotalMemory returns the total accessible system memory, in bytes. If the
-// value cannot be determined, then 0 will be returned.
-func TotalMemory() uint64 {
-	return totalMemoryImpl()
-}
diff --git a/util/sysresources/memory_bsd.go b/util/sysresources/memory_bsd.go
deleted file mode 100644
index 945f86ea3..000000000
--- a/util/sysresources/memory_bsd.go
+++ /dev/null
@@ -1,16 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-//go:build freebsd || openbsd || dragonfly || netbsd
-
-package sysresources
-
-import "golang.org/x/sys/unix"
-
-func totalMemoryImpl() uint64 {
-	val, err := unix.SysctlUint64("hw.physmem")
-	if err != nil {
-		return 0
-	}
-	return val
-}
diff --git a/util/sysresources/memory_darwin.go b/util/sysresources/memory_darwin.go
deleted file mode 100644
index 165f12eb3..000000000
--- a/util/sysresources/memory_darwin.go
+++ /dev/null
@@ -1,16 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-//go:build darwin
-
-package sysresources
-
-import "golang.org/x/sys/unix"
-
-func totalMemoryImpl() uint64 {
-	val, err := unix.SysctlUint64("hw.memsize")
-	if err != nil {
-		return 0
-	}
-	return val
-}
diff --git a/util/sysresources/memory_linux.go b/util/sysresources/memory_linux.go
deleted file mode 100644
index 3885a8aa6..000000000
--- a/util/sysresources/memory_linux.go
+++ /dev/null
@@ -1,19 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-//go:build linux
-
-package sysresources
-
-import "golang.org/x/sys/unix"
-
-func totalMemoryImpl() uint64 {
-	var info unix.Sysinfo_t
-
-	if err := unix.Sysinfo(&info); err != nil {
-		return 0
-	}
-
-	// uint64 casts are required since these might be uint32s
-	return uint64(info.Totalram) * uint64(info.Unit)
-}
diff --git a/util/sysresources/memory_unsupported.go b/util/sysresources/memory_unsupported.go
deleted file mode 100644
index c88e9ed52..000000000
--- a/util/sysresources/memory_unsupported.go
+++ /dev/null
@@ -1,8 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-//go:build !(linux || darwin || freebsd || openbsd || dragonfly || netbsd)
-
-package sysresources
-
-func totalMemoryImpl() uint64 { return 0 }
diff --git a/util/sysresources/sysresources.go b/util/sysresources/sysresources.go
deleted file mode 100644
index 33d0d5d96..000000000
--- a/util/sysresources/sysresources.go
+++ /dev/null
@@ -1,6 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-// Package sysresources provides OS-independent methods of determining the
-// resources available to the current system.
-package sysresources
diff --git a/util/sysresources/sysresources_test.go b/util/sysresources/sysresources_test.go
deleted file mode 100644
index 7fea1bf0f..000000000
--- a/util/sysresources/sysresources_test.go
+++ /dev/null
@@ -1,25 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-package sysresources
-
-import (
-	"runtime"
-	"testing"
-)
-
-func TestTotalMemory(t *testing.T) {
-	switch runtime.GOOS {
-	case "linux":
-	case "freebsd", "openbsd", "dragonfly", "netbsd":
-	case "darwin":
-	default:
-		t.Skipf("not supported on runtime.GOOS=%q yet", runtime.GOOS)
-	}
-
-	mem := TotalMemory()
-	if mem == 0 {
-		t.Fatal("wanted TotalMemory > 0")
-	}
-	t.Logf("total memory: %v bytes", mem)
-}
diff --git a/util/testenv/testenv.go b/util/testenv/testenv.go
index 1ae1fe8a8..d234b7d62 100644
--- a/util/testenv/testenv.go
+++ b/util/testenv/testenv.go
@@ -8,6 +8,7 @@ package testenv
 import (
 	"context"
 	"flag"
+	"io"
 
 	"tailscale.com/types/lazy"
 )
@@ -21,8 +22,23 @@ func InTest() bool {
 	})
 }
 
+// Verbose reports whether the test binary is running with verbose
+// output (the -test.v flag), like testing.Verbose but without
+// importing the testing package.
+func Verbose() bool {
+	f := flag.Lookup("test.v")
+	if f == nil {
+		return false
+	}
+	// The flag's String value is "false" when off, and "true" or
+	// "test2json" when on.
+	return f.Value.String() != "false"
+}
+
 // TB is testing.TB, to avoid importing "testing" in non-test code.
 type TB interface {
+	ArtifactDir() string
+	Attr(key, value string)
 	Cleanup(func())
 	Error(args ...any)
 	Errorf(format string, args ...any)
@@ -35,6 +51,7 @@ type TB interface {
 	Log(args ...any)
 	Logf(format string, args ...any)
 	Name() string
+	Output() io.Writer
 	Setenv(key, value string)
 	Chdir(dir string)
 	Skip(args ...any)
diff --git a/util/testenv/testenv_test.go b/util/testenv/testenv_test.go
index 3001d19eb..181f017f7 100644
--- a/util/testenv/testenv_test.go
+++ b/util/testenv/testenv_test.go
@@ -4,6 +4,7 @@
 package testenv
 
 import (
+	"reflect"
 	"testing"
 
 	"tailscale.com/tstest/deptest"
@@ -29,3 +30,24 @@ func TestInParallelTestFalse(t *testing.T) {
 		t.Fatal("InParallelTest should return false before t.Parallel has been called")
 	}
 }
+
+// TestMatchesTestingTB verifies that TB has every exported method of
+// testing.TB, with matching signatures. It can't be a compile-time
+// assertion because testing.TB has an unexported method.
+func TestMatchesTestingTB(t *testing.T) {
+	want := reflect.TypeFor[testing.TB]()
+	got := reflect.TypeFor[TB]()
+	for m := range want.Methods() {
+		if m.PkgPath != "" {
+			continue // unexported
+		}
+		gm, ok := got.MethodByName(m.Name)
+		if !ok {
+			t.Errorf("TB lacks method %s%v", m.Name, m.Type)
+			continue
+		}
+		if gm.Type != m.Type {
+			t.Errorf("TB method %s has type %v; want %v", m.Name, gm.Type, m.Type)
+		}
+	}
+}
diff --git a/util/topk/topk.go b/util/topk/topk.go
deleted file mode 100644
index 95ebd895d..000000000
--- a/util/topk/topk.go
+++ /dev/null
@@ -1,261 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-// Package topk defines a count-min sketch and a cheap probabilistic top-K data
-// structure that uses the count-min sketch to track the top K items in
-// constant memory and O(log(k)) time.
-package topk
-
-import (
-	"container/heap"
-	"hash/maphash"
-	"math"
-	"slices"
-	"sync"
-)
-
-// TopK is a probabilistic counter of the top K items, using a count-min sketch
-// to keep track of item counts and a heap to track the top K of them.
-type TopK[T any] struct {
-	heap minHeap[T]
-	k    int
-	sf   SerializeFunc[T]
-	cms  CountMinSketch
-}
-
-// HashFunc is responsible for providing a []byte serialization of a value,
-// appended to the provided byte slice. This is used for hashing the value when
-// adding to a CountMinSketch.
-type SerializeFunc[T any] func([]byte, T) []byte
-
-// New creates a new TopK that stores k values. Parameters for the underlying
-// count-min sketch are chosen for a 0.1% error rate and a 0.1% probability of
-// error.
-func New[T any](k int, sf SerializeFunc[T]) *TopK[T] {
-	hashes, buckets := PickParams(0.001, 0.001)
-	return NewWithParams(k, sf, hashes, buckets)
-}
-
-// NewWithParams creates a new TopK that stores k values, and additionally
-// allows customizing the parameters for the underlying count-min sketch.
-func NewWithParams[T any](k int, sf SerializeFunc[T], numHashes, numCols int) *TopK[T] {
-	ret := &TopK[T]{
-		heap: make(minHeap[T], 0, k),
-		k:    k,
-		sf:   sf,
-	}
-	ret.cms.init(numHashes, numCols)
-	return ret
-}
-
-// Add calls AddN(val, 1).
-func (tk *TopK[T]) Add(val T) uint64 {
-	return tk.AddN(val, 1)
-}
-
-var hashPool = &sync.Pool{
-	New: func() any {
-		buf := make([]byte, 0, 128)
-		return &buf
-	},
-}
-
-// AddN adds the given item to the set with the provided count, returning the
-// new estimated count.
-func (tk *TopK[T]) AddN(val T, count uint64) uint64 {
-	buf := hashPool.Get().(*[]byte)
-	defer hashPool.Put(buf)
-	ser := tk.sf((*buf)[:0], val)
-
-	vcount := tk.cms.AddN(ser, count)
-
-	// If we don't have a full heap, just push it.
-	if len(tk.heap) < tk.k {
-		heap.Push(&tk.heap, mhValue[T]{
-			count: vcount,
-			val:   val,
-		})
-		return vcount
-	}
-
-	// If this item's count surpasses the heap's minimum, update the heap.
-	if vcount > tk.heap[0].count {
-		tk.heap[0] = mhValue[T]{
-			count: vcount,
-			val:   val,
-		}
-		heap.Fix(&tk.heap, 0)
-	}
-	return vcount
-}
-
-// Top returns the estimated top K items as stored by this TopK.
-func (tk *TopK[T]) Top() []T {
-	ret := make([]T, 0, tk.k)
-	for _, item := range tk.heap {
-		ret = append(ret, item.val)
-	}
-	return ret
-}
-
-// AppendTop appends the estimated top K items as stored by this TopK to the
-// provided slice, allocating only if the slice does not have enough capacity
-// to store all items. The provided slice can be nil.
-func (tk *TopK[T]) AppendTop(sl []T) []T {
-	sl = slices.Grow(sl, tk.k)
-	for _, item := range tk.heap {
-		sl = append(sl, item.val)
-	}
-	return sl
-}
-
-// CountMinSketch implements a count-min sketch, a probabilistic data structure
-// that tracks the frequency of events in a stream of data.
-//
-// See: https://en.wikipedia.org/wiki/Count%E2%80%93min_sketch
-type CountMinSketch struct {
-	hashes   []maphash.Seed
-	nbuckets int
-	matrix   []uint64
-}
-
-// NewCountMinSketch creates a new CountMinSketch with the provided number of
-// hashes and buckets. Hashes and buckets are often called "depth" and "width",
-// or "d" and "w", respectively.
-func NewCountMinSketch(hashes, buckets int) *CountMinSketch {
-	ret := &CountMinSketch{}
-	ret.init(hashes, buckets)
-	return ret
-}
-
-// PickParams provides good parameters for 'hashes' and 'buckets' when
-// constructing a CountMinSketch, given an estimated total number of counts
-// (i.e. the sum of all counts ever stored), the error factor ϵ as a float
-// (e.g. 1% is 0.001), and the probability factor δ.
-//
-// Parameters are chosen such that with a probability of 1−δ, the error is at
-// most ϵ∗totalCount. Or, in other words: if N is the true count of an event,
-// E is the estimate given by a sketch and T the total count of items in the
-// sketch, E ≤ N + T*ϵ with probability (1 - δ).
-func PickParams(err, probability float64) (hashes, buckets int) {
-	d := math.Ceil(math.Log(1 / probability))
-	w := math.Ceil(math.E / err)
-
-	return int(d), int(w)
-}
-
-func (cms *CountMinSketch) init(hashes, buckets int) {
-	for range hashes {
-		cms.hashes = append(cms.hashes, maphash.MakeSeed())
-	}
-
-	// Need a matrix of hashes * buckets to store counts
-	cms.nbuckets = buckets
-	cms.matrix = make([]uint64, hashes*buckets)
-}
-
-// Add calls AddN(val, 1).
-func (cms *CountMinSketch) Add(val []byte) uint64 {
-	return cms.AddN(val, 1)
-}
-
-// AddN increments the count for the given value by the provided count,
-// returning the new count.
-func (cms *CountMinSketch) AddN(val []byte, count uint64) uint64 {
-	var (
-		mh  maphash.Hash
-		ret uint64 = math.MaxUint64
-	)
-	for i, seed := range cms.hashes {
-		mh.SetSeed(seed)
-
-		// Generate a hash for this value using Lemire's alternative to modular reduction:
-		//    https://lemire.me/blog/2016/06/27/a-fast-alternative-to-the-modulo-reduction/
-		mh.Write(val)
-		hash := mh.Sum64()
-		hash = multiplyHigh64(hash, uint64(cms.nbuckets))
-
-		// The index in our matrix is (i * buckets) to move "down" i
-		// rows in our matrix to the row for this hash, plus 'hash' to
-		// move inside this row.
-		idx := (i * cms.nbuckets) + int(hash)
-
-		// Add to this row
-		cms.matrix[idx] += count
-		ret = min(ret, cms.matrix[idx])
-	}
-	return ret
-}
-
-// Get returns the count for the provided value.
-func (cms *CountMinSketch) Get(val []byte) uint64 {
-	var (
-		mh  maphash.Hash
-		ret uint64 = math.MaxUint64
-	)
-	for i, seed := range cms.hashes {
-		mh.SetSeed(seed)
-
-		// Generate a hash for this value using Lemire's alternative to modular reduction:
-		//    https://lemire.me/blog/2016/06/27/a-fast-alternative-to-the-modulo-reduction/
-		mh.Write(val)
-		hash := mh.Sum64()
-		hash = multiplyHigh64(hash, uint64(cms.nbuckets))
-
-		// The index in our matrix is (i * buckets) to move "down" i
-		// rows in our matrix to the row for this hash, plus 'hash' to
-		// move inside this row.
-		idx := (i * cms.nbuckets) + int(hash)
-
-		// Select the minimal value among all rows
-		ret = min(ret, cms.matrix[idx])
-	}
-	return ret
-}
-
-// multiplyHigh64 implements (x * y) >> 64 "the long way" without access to a
-// 128-bit type. This function is adapted from something similar in Tensorflow:
-//
-//	https://github.com/tensorflow/tensorflow/commit/a47a300185026fe7829990def9113bf3a5109fed
-//
-// TODO(andrew-d): this could be replaced with a single "MULX" instruction on
-// x86_64 platforms, which we can do if this ever turns out to be a performance
-// bottleneck.
-func multiplyHigh64(x, y uint64) uint64 {
-	x_lo := x & 0xffffffff
-	x_hi := x >> 32
-	buckets_lo := y & 0xffffffff
-	buckets_hi := y >> 32
-	prod_hi := x_hi * buckets_hi
-	prod_lo := x_lo * buckets_lo
-	prod_mid1 := x_hi * buckets_lo
-	prod_mid2 := x_lo * buckets_hi
-	carry := ((prod_mid1 & 0xffffffff) + (prod_mid2 & 0xffffffff) + (prod_lo >> 32)) >> 32
-	return prod_hi + (prod_mid1 >> 32) + (prod_mid2 >> 32) + carry
-}
-
-type mhValue[T any] struct {
-	count uint64
-	val   T
-}
-
-// An minHeap is a min-heap of ints and associated values.
-type minHeap[T any] []mhValue[T]
-
-func (h minHeap[T]) Len() int           { return len(h) }
-func (h minHeap[T]) Less(i, j int) bool { return h[i].count < h[j].count }
-func (h minHeap[T]) Swap(i, j int)      { h[i], h[j] = h[j], h[i] }
-
-func (h *minHeap[T]) Push(x any) {
-	// Push and Pop use pointer receivers because they modify the slice's length,
-	// not just its contents.
-	*h = append(*h, x.(mhValue[T]))
-}
-
-func (h *minHeap[T]) Pop() any {
-	old := *h
-	n := len(old)
-	x := old[n-1]
-	*h = old[0 : n-1]
-	return x
-}
diff --git a/util/topk/topk_test.go b/util/topk/topk_test.go
deleted file mode 100644
index 7679f59a3..000000000
--- a/util/topk/topk_test.go
+++ /dev/null
@@ -1,135 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-package topk
-
-import (
-	"encoding/binary"
-	"fmt"
-	"slices"
-	"testing"
-)
-
-func TestCountMinSketch(t *testing.T) {
-	cms := NewCountMinSketch(4, 10)
-	items := []string{"foo", "bar", "baz", "asdf", "quux"}
-	for _, item := range items {
-		cms.Add([]byte(item))
-	}
-	for _, item := range items {
-		count := cms.Get([]byte(item))
-		if count < 1 {
-			t.Errorf("item %q should have count >= 1", item)
-		} else if count > 1 {
-			t.Logf("item %q has count > 1: %d", item, count)
-		}
-	}
-
-	// Test that an item that's *not* in the set has a value lower than the
-	// total number of items we inserted (in the case that all items
-	// collided).
-	noItemCount := cms.Get([]byte("doesn't exist"))
-	if noItemCount > uint64(len(items)) {
-		t.Errorf("expected nonexistent item to have value < %d; got %d", len(items), noItemCount)
-	}
-}
-
-func TestTopK(t *testing.T) {
-	// This is probabilistic, so we're going to try 10 times to get the
-	// "right" value; the likelihood that we fail on all attempts is
-	// vanishingly small since the number of hash buckets is drastically
-	// larger than the number of items we're inserting.
-	var (
-		got  []int
-		want = []int{5, 6, 7, 8, 9}
-	)
-	for range 10 {
-		topk := NewWithParams[int](5, func(in []byte, val int) []byte {
-			return binary.LittleEndian.AppendUint64(in, uint64(val))
-		}, 4, 1000)
-
-		// Add the first 10 integers with counts equal to 2x their value
-		for i := range 10 {
-			topk.AddN(i, uint64(i*2))
-		}
-
-		got = topk.Top()
-		t.Logf("top K items: %+v", got)
-		slices.Sort(got)
-
-		if slices.Equal(got, want) {
-			// All good!
-			return
-		}
-
-		// continue and retry or fail
-	}
-
-	t.Errorf("top K mismatch\ngot: %v\nwant: %v", got, want)
-}
-
-func TestPickParams(t *testing.T) {
-	hashes, buckets := PickParams(
-		0.001, // 0.1% error rate
-		0.001, // 0.1% chance of having an error, or 99.9% chance of not having an error
-	)
-	t.Logf("hashes = %d, buckets = %d", hashes, buckets)
-}
-
-func BenchmarkCountMinSketch(b *testing.B) {
-	cms := NewCountMinSketch(PickParams(0.001, 0.001))
-	b.ResetTimer()
-	b.ReportAllocs()
-
-	var enc [8]byte
-	for i := range b.N {
-		binary.LittleEndian.PutUint64(enc[:], uint64(i))
-		cms.Add(enc[:])
-	}
-}
-
-func BenchmarkTopK(b *testing.B) {
-	for _, n := range []int{
-		10,
-		128,
-		256,
-		1024,
-		8192,
-	} {
-		b.Run(fmt.Sprintf("Top%d", n), func(b *testing.B) {
-			out := make([]int, 0, n)
-			topk := New[int](n, func(in []byte, val int) []byte {
-				return binary.LittleEndian.AppendUint64(in, uint64(val))
-			})
-			b.ResetTimer()
-			b.ReportAllocs()
-
-			for i := range b.N {
-				topk.Add(i)
-			}
-			out = topk.AppendTop(out[:0]) // should not allocate
-			_ = out                       // appease linter
-		})
-	}
-}
-
-func TestMultiplyHigh64(t *testing.T) {
-	testCases := []struct {
-		x, y uint64
-		want uint64
-	}{
-		{0, 0, 0},
-		{0xffffffff, 0xffffffff, 0},
-		{0x2, 0xf000000000000000, 1},
-		{0x3, 0xf000000000000000, 2},
-		{0x3, 0xf000000000000001, 2},
-		{0x3, 0xffffffffffffffff, 2},
-		{0xffffffffffffffff, 0xffffffffffffffff, 0xfffffffffffffffe},
-	}
-	for _, tc := range testCases {
-		got := multiplyHigh64(tc.x, tc.y)
-		if got != tc.want {
-			t.Errorf("got multiplyHigh64(%x, %x) = %x, want %x", tc.x, tc.y, got, tc.want)
-		}
-	}
-}
diff --git a/util/winutil/gp/gp_windows.go b/util/winutil/gp/gp_windows.go
index dd13a2701..df2052eff 100644
--- a/util/winutil/gp/gp_windows.go
+++ b/util/winutil/gp/gp_windows.go
@@ -9,6 +9,7 @@ package gp
 import (
 	"fmt"
 	"runtime"
+	"unsafe"
 
 	"golang.org/x/sys/windows"
 )
@@ -77,3 +78,14 @@ func toRefreshPolicyFlags(force bool) uint32 {
 	}
 	return 0
 }
+
+var mgmtProductTailscale = unsafe.SliceData([]uint16{'T', 'a', 'i', 'l', 's', 'c', 'a', 'l', 'e', 0})
+
+// NotifyMachinePolicyChange sends a machine-scoped group policy change
+// notification which Windows broadcasts to group policy change subscribers.
+// The caller must be running as LocalSystem.
+func NotifyMachinePolicyChange() error {
+	// GenerateGPNotification is quasi-documented. Note that its implementation
+	// contains an access check ensuring that the calling user is LocalSystem!
+	return generateGPNotification(true, mgmtProductTailscale, 0)
+}
diff --git a/util/winutil/gp/gp_windows_test.go b/util/winutil/gp/gp_windows_test.go
index dfad02930..1ce75871e 100644
--- a/util/winutil/gp/gp_windows_test.go
+++ b/util/winutil/gp/gp_windows_test.go
@@ -106,23 +106,13 @@ func TestGroupPolicyReadLockClose(t *testing.T) {
 
 	doWithCustomEnterLeaveFuncs(t, func(gpLock *PolicyLock) {
 		done := make(chan struct{})
+		var lockErr error
 		go func() {
 			defer close(done)
-
-			err := gpLock.Lock()
-			if err == nil {
+			lockErr = gpLock.Lock()
+			if lockErr == nil {
 				defer gpLock.Unlock()
 			}
-
-			// We closed gpLock before the enter function returned.
-			// (*PolicyLock).Lock is expected to fail.
-			if err == nil || !errors.Is(err, ErrInvalidLockState) {
-				t.Errorf("(*PolicyLock).Lock: got %v; want %v", err, ErrInvalidLockState)
-			}
-			// gpLock must not be held as Lock() failed.
-			if lockCnt := gpLock.lockCnt.Load(); lockCnt != 0 {
-				t.Errorf("lockCnt: got %v; want 0", lockCnt)
-			}
 		}()
 
 		<-init
@@ -130,7 +120,22 @@ func TestGroupPolicyReadLockClose(t *testing.T) {
 		if err := gpLock.Close(); err != nil {
 			t.Fatalf("(*PolicyLock).Close failed: %v", err)
 		}
+		// Wait for Lock to fully unwind before reading lockCnt.
+		// Otherwise we race with Close clearing the LSB:
+		// close(lk.closing) wakes lockSlow's select, whose defer
+		// runs Add(-2) on lockCnt before Close completes its CAS,
+		// briefly leaving lockCnt at 1 instead of 0.
 		<-done
+
+		// We closed gpLock before the enter function returned.
+		// (*PolicyLock).Lock is expected to fail.
+		if lockErr == nil || !errors.Is(lockErr, ErrInvalidLockState) {
+			t.Errorf("(*PolicyLock).Lock: got %v; want %v", lockErr, ErrInvalidLockState)
+		}
+		// gpLock must not be held as Lock() failed.
+		if lockCnt := gpLock.lockCnt.Load(); lockCnt != 0 {
+			t.Errorf("lockCnt: got %v; want 0", lockCnt)
+		}
 	}, enter, leave)
 }
 
diff --git a/util/winutil/gp/mksyscall.go b/util/winutil/gp/mksyscall.go
index 22fd0c137..1ddbebb37 100644
--- a/util/winutil/gp/mksyscall.go
+++ b/util/winutil/gp/mksyscall.go
@@ -6,6 +6,7 @@ package gp
 //go:generate go run golang.org/x/sys/windows/mkwinsyscall -output zsyscall_windows.go mksyscall.go
 
 //sys enterCriticalPolicySection(machine bool) (handle policyLockHandle, err error) [int32(failretval)==0] = userenv.EnterCriticalPolicySection
+//sys generateGPNotification(machine bool, mgmtProduct *uint16, mgmtProductOptions uint32) (ret error) = userenv.GenerateGPNotification?
 //sys impersonateLoggedOnUser(token windows.Token) (err error) [int32(failretval)==0] = advapi32.ImpersonateLoggedOnUser
 //sys leaveCriticalPolicySection(handle policyLockHandle) (err error) [int32(failretval)==0] = userenv.LeaveCriticalPolicySection
 //sys registerGPNotification(event windows.Handle, machine bool) (err error) [int32(failretval)==0] = userenv.RegisterGPNotification
diff --git a/util/winutil/gp/zsyscall_windows.go b/util/winutil/gp/zsyscall_windows.go
index 41c240c26..f0ba9a1c4 100644
--- a/util/winutil/gp/zsyscall_windows.go
+++ b/util/winutil/gp/zsyscall_windows.go
@@ -43,6 +43,7 @@ var (
 
 	procImpersonateLoggedOnUser    = modadvapi32.NewProc("ImpersonateLoggedOnUser")
 	procEnterCriticalPolicySection = moduserenv.NewProc("EnterCriticalPolicySection")
+	procGenerateGPNotification     = moduserenv.NewProc("GenerateGPNotification")
 	procLeaveCriticalPolicySection = moduserenv.NewProc("LeaveCriticalPolicySection")
 	procRefreshPolicyEx            = moduserenv.NewProc("RefreshPolicyEx")
 	procRegisterGPNotification     = moduserenv.NewProc("RegisterGPNotification")
@@ -70,6 +71,22 @@ func enterCriticalPolicySection(machine bool) (handle policyLockHandle, err erro
 	return
 }
 
+func generateGPNotification(machine bool, mgmtProduct *uint16, mgmtProductOptions uint32) (ret error) {
+	ret = procGenerateGPNotification.Find()
+	if ret != nil {
+		return
+	}
+	var _p0 uint32
+	if machine {
+		_p0 = 1
+	}
+	r0, _, _ := syscall.SyscallN(procGenerateGPNotification.Addr(), uintptr(_p0), uintptr(unsafe.Pointer(mgmtProduct)), uintptr(mgmtProductOptions))
+	if r0 != 0 {
+		ret = syscall.Errno(r0)
+	}
+	return
+}
+
 func leaveCriticalPolicySection(handle policyLockHandle) (err error) {
 	r1, _, e1 := syscall.SyscallN(procLeaveCriticalPolicySection.Addr(), uintptr(handle))
 	if int32(r1) == 0 {
diff --git a/util/winutil/startupinfo_windows.go b/util/winutil/startupinfo_windows.go
index 5ded67c7c..e96209764 100644
--- a/util/winutil/startupinfo_windows.go
+++ b/util/winutil/startupinfo_windows.go
@@ -156,7 +156,7 @@ func canBeInherited(h windows.Handle) bool {
 
 // SetStdHandles sets the StdInput, StdOutput, and StdErr handles and configures
 // their inheritability as needed. When the handles are valid, non-console
-// kernel objects, sib takes ownership of of them. All three handles may be set
+// kernel objects, sib takes ownership of them. All three handles may be set
 // to zero to indicate that the parent's std handles should not be implicitly
 // inherited.
 //
diff --git a/util/winutil/svcdiag_windows.go b/util/winutil/svcdiag_windows.go
index e28f9b6af..b9356d2f2 100644
--- a/util/winutil/svcdiag_windows.go
+++ b/util/winutil/svcdiag_windows.go
@@ -212,7 +212,7 @@ func getSvcTriggerInfo(svc *mgr.Service) (*_SERVICE_TRIGGER_INFO, error) {
 
 // makeLogEntry consolidates relevant service information into a svcStateLogEntry.
 // We record the values of various service configuration constants as strings
-// so the the log entries are easy to interpret at a glance by humans.
+// so the log entries are easy to interpret at a glance by humans.
 func makeLogEntry(svc *mgr.Service, status svc.Status, cfg mgr.Config) (entry svcStateLogEntry) {
 	entry.ServiceName = svc.Name
 
diff --git a/util/winutil/winutil_windows.go b/util/winutil/winutil_windows.go
index cab0dabdf..1e2488f15 100644
--- a/util/winutil/winutil_windows.go
+++ b/util/winutil/winutil_windows.go
@@ -163,7 +163,7 @@ func getRegStringsInternal(subKey, name string) ([]string, error) {
 	return val, nil
 }
 
-// SetRegStrings sets a MULTI_SZ value in the in the local machine path
+// SetRegStrings sets a MULTI_SZ value in the local machine path
 // to the strings specified by values.
 func SetRegStrings(name string, values []string) error {
 	return setRegStringsInternal(regBase, name, values)
@@ -577,7 +577,7 @@ func lookupPseudoUser(uid string) (*user.User, error) {
 	}
 
 	// We're looking for SIDs "S-1-5-x" where 17 <= x <= 20.
-	// This is checking for the the "5"
+	// This is checking for the "5"
 	if sid.IdentifierAuthority() != windows.SECURITY_NT_AUTHORITY {
 		return nil, fmt.Errorf(`SID %q does not use "NT AUTHORITY"`, uid)
 	}
@@ -972,3 +972,25 @@ func GUIPathFromReg() (string, error) {
 
 	return regPath, nil
 }
+
+// IsCurrentProcessLocalSystem checks whether the current process is running
+// as LocalSystem.
+func IsCurrentProcessLocalSystem() bool {
+	localSystem, err := windows.CreateWellKnownSid(windows.WinLocalSystemSid)
+	if err != nil {
+		return false
+	}
+
+	token := windows.GetCurrentProcessToken()
+	// The current process token is a pseudo-handle so we don't need to close it.
+	if ok, err := token.IsMember(localSystem); err != nil || !ok {
+		return false
+	}
+
+	u, err := token.GetTokenUser()
+	if err != nil {
+		return false
+	}
+
+	return u.User.Sid.Equals(localSystem)
+}
diff --git a/version/cmdname.go b/version/cmdname.go
index 5a0b84875..8e6adb047 100644
--- a/version/cmdname.go
+++ b/version/cmdname.go
@@ -13,6 +13,7 @@ import (
 	"os"
 	"path"
 	"runtime"
+	"runtime/debug"
 	"strings"
 )
 
@@ -20,6 +21,15 @@ import (
 // using os.Executable. If os.Executable fails (it shouldn't), then
 // "cmd" is returned.
 func CmdName() string {
+	// On non-Windows, the modinfo embedded in the running binary is
+	// authoritative and avoids re-reading the executable from disk.
+	// Windows needs the executable-name-based GUI override in cmdName,
+	// so it still takes the slower path.
+	if runtime.GOOS != "windows" {
+		if info, ok := debug.ReadBuildInfo(); ok && info.Path != "" {
+			return path.Base(info.Path)
+		}
+	}
 	e, err := os.Executable()
 	if err != nil {
 		return "cmd"
diff --git a/version/distro/distro.go b/version/distro/distro.go
index 03c02ccab..5407f8dae 100644
--- a/version/distro/distro.go
+++ b/version/distro/distro.go
@@ -19,6 +19,7 @@ type Distro string
 
 const (
 	Debian    = Distro("debian")
+	Crostini  = Distro("crostini") // ChromeOS Crostini Linux container; Debian-based
 	Arch      = Distro("arch")
 	Synology  = Distro("synology")
 	OpenWrt   = Distro("openwrt")
@@ -84,6 +85,11 @@ func linuxDistro() Distro {
 		// Currently supported product families:
 		// - UDM (UniFi Dream Machine, UDM-Pro)
 		return UBNT
+	case have("/opt/google/cros-containers/bin/garcon"):
+		// ChromeOS Crostini ships /opt/google/cros-containers/bin/garcon
+		// in every penguin container. MUST be checked before Debian since
+		// Crostini is Debian-based.
+		return Crostini
 	case have("/etc/debian_version"):
 		return Debian
 	case have("/etc/arch-release"):
diff --git a/version/mkversion/mkversion.go b/version/mkversion/mkversion.go
index 45576e4c1..23fee416f 100644
--- a/version/mkversion/mkversion.go
+++ b/version/mkversion/mkversion.go
@@ -289,7 +289,7 @@ func mkOutput(v verInfo) (VersionInfo, error) {
 		// We started to need to do this in 2023, and the last Apple-generated
 		// incrementing build number was 273. To avoid using up the space, we
 		// use <year - 1750> as the major version (thus 273.*, 274.* in 2024, etc.),
-		// so that we we're still in the same range. This way if Apple goes back to
+		// so that we're still in the same range. This way if Apple goes back to
 		// auto-incrementing the number for us, we can go back to it with
 		// reasonable-looking numbers.
 		// In May 2024, a build with version number 275 was uploaded to the App Store
diff --git a/version/print.go b/version/print.go
index ca62226ee..3b4a256cf 100644
--- a/version/print.go
+++ b/version/print.go
@@ -24,7 +24,14 @@ var stringLazy = sync.OnceValue(func() string {
 	if extraGitCommitStamp != "" {
 		fmt.Fprintf(&ret, "  other commit: %s\n", extraGitCommitStamp)
 	}
-	fmt.Fprintf(&ret, "  go version: %s\n", runtime.Version())
+	if tsGoRev := tailscaleToolchainRev(); tsGoRev != "" {
+		if len(tsGoRev) > 10 {
+			tsGoRev = tsGoRev[:10]
+		}
+		fmt.Fprintf(&ret, "  go version: %s (tailscale/go %s)\n", runtime.Version(), tsGoRev)
+	} else {
+		fmt.Fprintf(&ret, "  go version: %s\n", runtime.Version())
+	}
 	return strings.TrimSpace(ret.String())
 })
 
diff --git a/version/prop.go b/version/prop.go
index 36d769917..59ca74086 100644
--- a/version/prop.go
+++ b/version/prop.go
@@ -312,6 +312,11 @@ type Meta struct {
 	// GitCommitTime is the commit time of the git commit in GitCommit.
 	GitCommitTime string `json:"gitCommitTime,omitempty"`
 
+	// TailscaleGoGitHash is the git commit hash from
+	// https://github.com/tailscale/go used to build this binary, if built
+	// with the Tailscale Go toolchain. Otherwise it is empty.
+	TailscaleGoGitHash string `json:"tailscaleGoGitHash,omitempty"`
+
 	// Cap is the current Tailscale capability version. It's a monotonically
 	// incrementing integer that's incremented whenever a new capability is
 	// added.
@@ -324,17 +329,18 @@ var getMeta lazy.SyncValue[Meta]
 func GetMeta() Meta {
 	return getMeta.Get(func() Meta {
 		return Meta{
-			MajorMinorPatch: majorMinorPatch(),
-			Short:           Short(),
-			Long:            Long(),
-			GitCommitTime:   getEmbeddedInfo().commitTime,
-			GitCommit:       gitCommit(),
-			GitDirty:        gitDirty(),
-			OSVariant:       osVariant(),
-			ExtraGitCommit:  extraGitCommitStamp,
-			IsDev:           isDev(),
-			UnstableBranch:  IsUnstableBuild(),
-			Cap:             int(tailcfg.CurrentCapabilityVersion),
+			MajorMinorPatch:    majorMinorPatch(),
+			Short:              Short(),
+			Long:               Long(),
+			GitCommitTime:      getEmbeddedInfo().commitTime,
+			GitCommit:          gitCommit(),
+			GitDirty:           gitDirty(),
+			OSVariant:          osVariant(),
+			ExtraGitCommit:     extraGitCommitStamp,
+			IsDev:              isDev(),
+			UnstableBranch:     IsUnstableBuild(),
+			TailscaleGoGitHash: tailscaleToolchainRev(),
+			Cap:                int(tailcfg.CurrentCapabilityVersion),
 		}
 	})
 }
diff --git a/version/version.go b/version/version.go
index 7d8efc375..8ffc21832 100644
--- a/version/version.go
+++ b/version/version.go
@@ -146,6 +146,23 @@ var getEmbeddedInfo = sync.OnceValue(func() embeddedInfo {
 	return ret
 })
 
+// tailscaleToolchainRev returns the git hash of the Tailscale Go toolchain
+// used to build this binary, if any. It is read separately from getEmbeddedInfo
+// because that function discards build info when VCS fields are missing (e.g.
+// in test binaries), but the toolchain rev is still present.
+var tailscaleToolchainRev = sync.OnceValue(func() string {
+	bi, ok := debug.ReadBuildInfo()
+	if !ok {
+		return ""
+	}
+	for _, s := range bi.Settings {
+		if s.Key == "tailscale.toolchain.rev" {
+			return s.Value
+		}
+	}
+	return ""
+})
+
 func gitCommit() string {
 	if gitCommitStamp != "" {
 		return gitCommitStamp
diff --git a/version/version_internal_test.go b/version/version_internal_test.go
index c78df4ff8..72b2dcd5f 100644
--- a/version/version_internal_test.go
+++ b/version/version_internal_test.go
@@ -3,7 +3,13 @@
 
 package version
 
-import "testing"
+import (
+	"os/exec"
+	"strings"
+	"testing"
+
+	"tailscale.com/util/cibuild"
+)
 
 func TestIsValidLongWithTwoRepos(t *testing.T) {
 	tests := []struct {
@@ -26,6 +32,26 @@ func TestIsValidLongWithTwoRepos(t *testing.T) {
 	}
 }
 
+func TestTailscaleToolchainRev(t *testing.T) {
+	out, err := exec.Command("go", "env", "GOROOT").Output()
+	if err != nil {
+		t.Fatalf("go env GOROOT: %v", err)
+	}
+	goRoot := strings.TrimSpace(string(out))
+	isTsgo := strings.Contains(goRoot, "/.cache/tsgo/")
+	if !cibuild.On() && !isTsgo {
+		t.Skip("skipping; not in CI and not using the Tailscale Go toolchain")
+	}
+	if !isTailscaleGo {
+		t.Skip("skipping; not built with tailscale_go build tag")
+	}
+	rev := tailscaleToolchainRev()
+	if rev == "" {
+		t.Fatal("tailscale.toolchain.rev is empty in build info; expected non-empty when using tsgo")
+	}
+	t.Logf("tailscale.toolchain.rev = %s", rev)
+}
+
 func TestPrepExeNameForCmp(t *testing.T) {
 	cases := []struct {
 		exe  string
diff --git a/version/version_test.go b/version/version_test.go
index 42bcf2163..01fcd47ec 100644
--- a/version/version_test.go
+++ b/version/version_test.go
@@ -6,6 +6,8 @@ package version_test
 import (
 	"bytes"
 	"os"
+	"path"
+	"runtime/debug"
 	"testing"
 
 	ts "tailscale.com"
@@ -49,3 +51,21 @@ func TestShortAllocs(t *testing.T) {
 		t.Errorf("allocs = %v; want 0", allocs)
 	}
 }
+
+func BenchmarkCmdName(b *testing.B) {
+	b.ReportAllocs()
+	for b.Loop() {
+		_ = version.CmdName()
+	}
+}
+
+func BenchmarkReadBuildInfo(b *testing.B) {
+	b.ReportAllocs()
+	for b.Loop() {
+		info, ok := debug.ReadBuildInfo()
+		if !ok {
+			b.Fatal("ReadBuildInfo failed")
+		}
+		_ = path.Base(info.Path)
+	}
+}
diff --git a/wgengine/bench/wg.go b/wgengine/bench/wg.go
index 7b35a089a..0e96a7b61 100644
--- a/wgengine/bench/wg.go
+++ b/wgengine/bench/wg.go
@@ -19,20 +19,12 @@ import (
 	"tailscale.com/tsd"
 	"tailscale.com/types/key"
 	"tailscale.com/types/logger"
-	"tailscale.com/types/netmap"
 	"tailscale.com/wgengine"
 	"tailscale.com/wgengine/filter"
 	"tailscale.com/wgengine/router"
 	"tailscale.com/wgengine/wgcfg"
 )
 
-func epFromTyped(eps []tailcfg.Endpoint) (ret []netip.AddrPort) {
-	for _, ep := range eps {
-		ret = append(ret, ep.Addr)
-	}
-	return
-}
-
 func setupWGTest(b *testing.B, logf logger.Logf, traf *TrafficGen, a1, a2 netip.Prefix) {
 	l1 := logger.WithPrefix(logf, "e1: ")
 	k1 := key.NewNode()
@@ -90,6 +82,29 @@ func setupWGTest(b *testing.B, logf logger.Logf, traf *TrafficGen, a1, a2 netip.
 	e1.SetFilter(filter.NewAllowAllForTest(l1))
 	e2.SetFilter(filter.NewAllowAllForTest(l2))
 
+	// There is no LocalBackend in this benchmark, so install trivial
+	// outbound peer lookups and per-peer config sources; without them,
+	// outbound packets can't lazily create their WireGuard peer.
+	k1pub, k2pub := k1.Public(), k2.Public()
+	e1.SetPeerByIPPacketFunc(func(dst netip.Addr) (_ key.NodePublic, ok bool) {
+		return k2pub, a2.Contains(dst)
+	})
+	e2.SetPeerByIPPacketFunc(func(dst netip.Addr) (_ key.NodePublic, ok bool) {
+		return k1pub, a1.Contains(dst)
+	})
+	e1.SetPeerConfigFunc(func(pubk key.NodePublic) (_ []netip.Prefix, ok bool) {
+		if pubk == k2pub {
+			return []netip.Prefix{a2}, true
+		}
+		return nil, false
+	})
+	e2.SetPeerConfigFunc(func(pubk key.NodePublic) (_ []netip.Prefix, ok bool) {
+		if pubk == k1pub {
+			return []netip.Prefix{a1}, true
+		}
+		return nil, false
+	})
+
 	var wait sync.WaitGroup
 	wait.Add(2)
 
@@ -103,23 +118,7 @@ func setupWGTest(b *testing.B, logf logger.Logf, traf *TrafficGen, a1, a2 netip.
 		}
 		logf("e1 status: %v", *st)
 
-		n := &tailcfg.Node{
-			ID:         tailcfg.NodeID(0),
-			Name:       "n1",
-			Addresses:  []netip.Prefix{a1},
-			AllowedIPs: []netip.Prefix{a1},
-			Endpoints:  epFromTyped(st.LocalAddrs),
-		}
-		e2.SetNetworkMap(&netmap.NetworkMap{
-			NodeKey: k2.Public(),
-			Peers:   []tailcfg.NodeView{n.View()},
-		})
-
-		p := wgcfg.Peer{
-			PublicKey:  c1.PrivateKey.Public(),
-			AllowedIPs: []netip.Prefix{a1},
-		}
-		c2.Peers = []wgcfg.Peer{p}
+		e2.SetSelfNode(tailcfg.NodeView{})
 		e2.Reconfig(&c2, &router.Config{}, new(dns.Config))
 		e1waitDoneOnce.Do(wait.Done)
 	})
@@ -134,23 +133,7 @@ func setupWGTest(b *testing.B, logf logger.Logf, traf *TrafficGen, a1, a2 netip.
 		}
 		logf("e2 status: %v", *st)
 
-		n := &tailcfg.Node{
-			ID:         tailcfg.NodeID(0),
-			Name:       "n2",
-			Addresses:  []netip.Prefix{a2},
-			AllowedIPs: []netip.Prefix{a2},
-			Endpoints:  epFromTyped(st.LocalAddrs),
-		}
-		e1.SetNetworkMap(&netmap.NetworkMap{
-			NodeKey: k1.Public(),
-			Peers:   []tailcfg.NodeView{n.View()},
-		})
-
-		p := wgcfg.Peer{
-			PublicKey:  c2.PrivateKey.Public(),
-			AllowedIPs: []netip.Prefix{a2},
-		}
-		c1.Peers = []wgcfg.Peer{p}
+		e1.SetSelfNode(tailcfg.NodeView{})
 		e1.Reconfig(&c1, &router.Config{}, new(dns.Config))
 		e2waitDoneOnce.Do(wait.Done)
 	})
diff --git a/wgengine/bird_hooks.go b/wgengine/bird_hooks.go
new file mode 100644
index 000000000..f388ee792
--- /dev/null
+++ b/wgengine/bird_hooks.go
@@ -0,0 +1,41 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package wgengine
+
+import (
+	"tailscale.com/feature"
+	"tailscale.com/tailcfg"
+	"tailscale.com/types/logger"
+)
+
+// Bird is the engine's handle on the BIRD Internet Routing Daemon
+// integration, implemented by the feature/bird package. It enables the
+// "tailscale" protocol in BIRD while this node is a primary subnet
+// router and disables it otherwise.
+//
+// Reconfig and ReconfigDone are only called from [Engine.Reconfig],
+// serialized by the engine's internal lock. Close is called from
+// [Engine.Close].
+type Bird interface {
+	// Reconfig recomputes from the given self node whether this node is
+	// a primary subnet router. It is called near the top of every
+	// [Engine.Reconfig], before its ErrNoChanges early return. It
+	// reports whether the primary subnet router state changed, which
+	// suppresses the engine's ErrNoChanges early return.
+	Reconfig(self tailcfg.NodeView) (changed bool)
+
+	// ReconfigDone is called at the end of [Engine.Reconfig], after the
+	// router is configured, and applies any protocol state change
+	// computed by the preceding Reconfig call.
+	ReconfigDone()
+
+	// Close disables the protocol and closes the connection to BIRD.
+	Close()
+}
+
+// HookNewBird is set by the feature/bird package to construct each
+// engine's [Bird], connecting to the BIRD unix socket at socketPath.
+// If unset, BIRD integration is not linked into the binary and
+// [Config.BIRDSocket] must not be set.
+var HookNewBird feature.Hook[func(logf logger.Logf, socketPath string) (Bird, error)]
diff --git a/wgengine/filter/filter.go b/wgengine/filter/filter.go
index b2be836c7..7fdf4d024 100644
--- a/wgengine/filter/filter.go
+++ b/wgengine/filter/filter.go
@@ -621,8 +621,25 @@ func (f *Filter) runIn6(q *packet.Parsed) (r Response, why string) {
 	return noVerdict, "no rules matched"
 }
 
-// runIn runs the output-specific part of the filter logic.
+// runOut runs the output-specific part of the filter logic.
 func (f *Filter) runOut(q *packet.Parsed) (r Response, why string) {
+	f.UpdateOutboundFlowState(q)
+	return Accept, "ok out"
+}
+
+// UpdateOutboundFlowState records reverse-flow connection-tracking state for
+// the given outbound packet so that subsequent inbound replies on the same
+// flow are admitted by [Filter.RunIn] without an explicit allow rule.
+//
+// Only UDP and SCTP packets are tracked; for other protocols this is a no-op.
+//
+// It is intended for callers that synthesize outbound packets and bypass
+// [Filter.RunOut] (for example netstack's [InjectOutbound] path used by
+// userspace networking, tsnet and the SOCKS5/HTTP proxies), so that reply
+// packets matching an outbound UDP flow are not silently dropped as "no
+// matching rule" by [Filter.RunIn]. See tailscale/tailscale#14229 and
+// tailscale/tailscale#20064.
+func (f *Filter) UpdateOutboundFlowState(q *packet.Parsed) {
 	switch q.IPProto {
 	case ipproto.UDP, ipproto.SCTP:
 		tuple := flowtrack.MakeTuple(q.IPProto, q.Dst, q.Src) // src/dst reversed
@@ -630,7 +647,6 @@ func (f *Filter) runOut(q *packet.Parsed) (r Response, why string) {
 		f.state.lru.Add(tuple, struct{}{})
 		f.state.mu.Unlock()
 	}
-	return Accept, "ok out"
 }
 
 // direction is whether a packet was flowing into this machine, or
diff --git a/wgengine/filter/filter_test.go b/wgengine/filter/filter_test.go
index a3b9a8e00..56e35b88c 100644
--- a/wgengine/filter/filter_test.go
+++ b/wgengine/filter/filter_test.go
@@ -254,6 +254,8 @@ func TestNoAllocs(t *testing.T) {
 		{"udp6_in", in, udp6Packet},
 		{"udp4_out", out, udp4Packet},
 		{"udp6_out", out, udp6Packet},
+		{"frag6_first_in", in, udp6FirstFragment},
+		{"frag6_nonfirst_in", in, udp6NonFirstFragment},
 	}
 
 	for _, test := range tests {
@@ -377,6 +379,41 @@ func BenchmarkFilter(b *testing.B) {
 	}
 }
 
+// udp6FirstFragment is the first fragment (offset 0) of a source-fragmented
+// IPv6 UDP datagram from 2001::5 to [2001::1]:443. decode6 reads its ports past
+// the 8-byte Fragment extension header so the filter can match it like an
+// unfragmented packet.
+var udp6FirstFragment = []byte{
+	// IPv6 header. Next header = 44 (Fragment), payload len = 24.
+	0x60, 0x00, 0x00, 0x00, 0x00, 0x18, 0x2c, 0x40,
+	// Src: 2001::5
+	0x20, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05,
+	// Dst: 2001::1
+	0x20, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
+	// Fragment header: NextHeader=UDP, Reserved, Offset=0 + M=1, Identification.
+	0x11, 0x00, 0x00, 0x01, 0xde, 0xad, 0xbe, 0xef,
+	// UDP header: sport 1234, dport 443.
+	0x04, 0xd2, 0x01, 0xbb, 0x00, 0x10, 0x00, 0x00,
+	// Payload.
+	0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61,
+}
+
+// udp6NonFirstFragment is a later fragment (nonzero offset, no transport
+// header) of an IPv6 datagram. decode6 classifies it as ipproto.Fragment,
+// which pre() passes through regardless of ACL, exactly as for IPv4.
+var udp6NonFirstFragment = []byte{
+	// IPv6 header. Next header = 44 (Fragment), payload len = 16.
+	0x60, 0x00, 0x00, 0x00, 0x00, 0x10, 0x2c, 0x40,
+	// Src: 2001::5
+	0x20, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05,
+	// Dst: 2001::1
+	0x20, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
+	// Fragment header: NextHeader=UDP, Reserved, Offset=185 blocks + M=0, Identification.
+	0x11, 0x00, 0x05, 0xc8, 0xde, 0xad, 0xbe, 0xef,
+	// Payload continuation (no transport header).
+	0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61,
+}
+
 func TestPreFilter(t *testing.T) {
 	packets := []struct {
 		desc       string
@@ -389,6 +426,7 @@ func TestPreFilter(t *testing.T) {
 		{"short-junk", Drop, usermetric.ReasonTooShort, raw4default(ipproto.Unknown, 10)},
 		{"long-junk", Drop, usermetric.ReasonUnknownProtocol, raw4default(ipproto.Unknown, 21)},
 		{"fragment", Accept, "", raw4default(ipproto.Fragment, 40)},
+		{"fragment6", Accept, "", udp6NonFirstFragment},
 		{"tcp", noVerdict, "", raw4default(ipproto.TCP, 0)},
 		{"udp", noVerdict, "", raw4default(ipproto.UDP, 0)},
 		{"icmp", noVerdict, "", raw4default(ipproto.ICMPv4, 0)},
@@ -404,6 +442,26 @@ func TestPreFilter(t *testing.T) {
 	}
 }
 
+// TestRunInIPv6FirstFragment checks that the first fragment of a
+// source-fragmented IPv6 datagram is matched on its ports and accepted like an
+// unfragmented packet, rather than being dropped as an unknown protocol (the
+// bug where v6 fragments were silently counted as "acl" drops).
+func TestRunInIPv6FirstFragment(t *testing.T) {
+	f := newFilter(t.Logf)
+
+	var p packet.Parsed
+	p.Decode(udp6FirstFragment)
+	// The fragment header must be parsed through to the real sub-protocol;
+	// otherwise no ACL rule can match it.
+	if p.IPProto != ipproto.UDP {
+		t.Fatalf("decoded IPProto = %v, want UDP (fragment header not parsed)", p.IPProto)
+	}
+	// 2001::5 => [2001::1]:443 is permitted by the "::/0 => ::/0:443" rule.
+	if got := f.RunIn(&p, 0); got != Accept {
+		t.Errorf("RunIn(first fragment) = %v, want Accept", got)
+	}
+}
+
 func TestOmitDropLogging(t *testing.T) {
 	tests := []struct {
 		name string
diff --git a/wgengine/filter/match.go b/wgengine/filter/match.go
index eee6ddf25..6c157d124 100644
--- a/wgengine/filter/match.go
+++ b/wgengine/filter/match.go
@@ -56,7 +56,7 @@ func srcMatches(m *filtertype.Match, srcAddr netip.Addr, hasCap CapTestFunc) boo
 // CapTestFunc is the function signature of a function that tests whether srcIP
 // has a given capability.
 //
-// It it used in the fast path of evaluating filter rules so should be fast.
+// It is used in the fast path of evaluating filter rules so should be fast.
 type CapTestFunc = func(srcIP netip.Addr, cap tailcfg.NodeCapability) bool
 
 func (ms matches) matchIPsOnly(q *packet.Parsed, hasCap CapTestFunc) bool {
diff --git a/wgengine/filter/tailcfg.go b/wgengine/filter/tailcfg.go
index e7e71526a..3360b169d 100644
--- a/wgengine/filter/tailcfg.go
+++ b/wgengine/filter/tailcfg.go
@@ -131,7 +131,7 @@ var (
 //
 // TODO(bradfitz): make this return an IPSet and plumb that all
 // around, and ultimately use a new version of IPSet.ContainsFunc like
-// Contains16Func that works in [16]byte address, so we we can match
+// Contains16Func that works in [16]byte address, so we can match
 // at runtime without allocating?
 func parseIPSet(arg string) (prefixes []netip.Prefix, peerCap tailcfg.NodeCapability, err error) {
 	if arg == "*" {
diff --git a/wgengine/magicsock/debughttp.go b/wgengine/magicsock/debughttp.go
index 68019d0a7..a9f4734f9 100644
--- a/wgengine/magicsock/debughttp.go
+++ b/wgengine/magicsock/debughttp.go
@@ -108,8 +108,8 @@ func (c *Conn) ServeHTTPDebug(w http.ResponseWriter, r *http.Request) {
 		}
 		sort.Slice(ent, func(i, j int) bool { return ent[i].pub.Less(ent[j].pub) })
 
-		peers := map[key.NodePublic]tailcfg.NodeView{}
-		for _, p := range c.peers.All() {
+		peers := make(map[key.NodePublic]tailcfg.NodeView, len(c.peersByID))
+		for _, p := range c.peersByID {
 			peers[p.Key()] = p
 		}
 
diff --git a/wgengine/magicsock/derp.go b/wgengine/magicsock/derp.go
index 1cab52b93..214c61f0d 100644
--- a/wgengine/magicsock/derp.go
+++ b/wgengine/magicsock/derp.go
@@ -102,6 +102,7 @@ type activeDerp struct {
 
 var (
 	pickDERPFallbackForTests func() int
+	reSTUNHookForTests       func(why string)
 )
 
 // pickDERPFallback returns a non-zero but deterministic DERP node to
@@ -155,7 +156,7 @@ var checkControlHealthDuringNearestDERPInTests = false
 // region that it selected and set (via setNearestDERP).
 //
 // c.mu must NOT be held.
-func (c *Conn) maybeSetNearestDERP(report *netcheck.Report) (preferredDERP int) {
+func (c *Conn) maybeSetNearestDERP(report *netcheck.Report, force bool) (preferredDERP int) {
 	// Don't change our PreferredDERP if we don't have a connection to
 	// control; if we don't, then we can't inform peers about a DERP home
 	// change, which breaks all connectivity. Even if this DERP region is
@@ -169,7 +170,10 @@ func (c *Conn) maybeSetNearestDERP(report *netcheck.Report) (preferredDERP int)
 	//
 	// Despite the above behaviour, ensure that we set the nearest DERP if
 	// we don't currently have one set; any DERP server is better than
-	// none, even if not connected to control.
+	// none, even if not connected to control. The exception here is if we have
+	// a cached netmap with a previous DERP server. Retaining the previous DERP
+	// makes it easier for other nodes to find each other when control is not
+	// available.
 	var connectedToControl bool
 	if testenv.InTest() && !checkControlHealthDuringNearestDERPInTests {
 		connectedToControl = true
@@ -179,7 +183,7 @@ func (c *Conn) maybeSetNearestDERP(report *netcheck.Report) (preferredDERP int)
 	c.mu.Lock()
 	myDerp := c.myDerp
 	c.mu.Unlock()
-	if !connectedToControl {
+	if !connectedToControl && !force {
 		if myDerp != 0 {
 			metricDERPHomeNoChangeNoControl.Add(1)
 			return myDerp
@@ -198,15 +202,32 @@ func (c *Conn) maybeSetNearestDERP(report *netcheck.Report) (preferredDERP int)
 	}
 	if preferredDERP != myDerp {
 		c.logf(
-			"magicsock: home DERP changing from derp-%d [%dms] to derp-%d [%dms]",
-			c.myDerp, report.RegionLatency[myDerp].Milliseconds(), preferredDERP, report.RegionLatency[preferredDERP].Milliseconds())
+			"magicsock: home DERP changing from derp-%d [%dms] to derp-%d [%dms] (forced=%t)",
+			c.myDerp, report.RegionLatency[myDerp].Milliseconds(), preferredDERP, report.RegionLatency[preferredDERP].Milliseconds(), force)
 	}
 	if !c.setNearestDERP(preferredDERP) {
 		preferredDERP = 0
+	} else if preferredDERP != myDerp {
+		c.homeDERPChangedPub.Publish(HomeDERPChanged{Old: myDerp, New: preferredDERP})
 	}
 	return
 }
 
+// HomeDERPChanged is an event sent on the [eventbus.Bus] when a new home DERP
+// server has been selected. Its publisher is [magicsock.Coon]; its main
+// subscriber is [ipnlocal.LocalBackend] that updates the homeDERP used by the
+// netmap cache.
+// TODO(cmol): Move the subscriber to not inject into localBackend, but rather
+// into the netmap at the controlClient mapSession level once there is a stable
+// abstraction to use.
+type HomeDERPChanged struct {
+	Old, New int
+}
+
+func (c *Conn) ForceSetNearestDERP(regionID int) int {
+	return c.maybeSetNearestDERP(&netcheck.Report{PreferredDERP: regionID}, true)
+}
+
 func (c *Conn) derpRegionCodeLocked(regionID int) string {
 	if c.derpMap == nil {
 		return ""
@@ -393,6 +414,7 @@ func (c *Conn) derpWriteChanForRegion(regionID int, peer key.NodePublic) chan de
 		return derpMap.Regions[regionID]
 	})
 	dc.HealthTracker = c.health
+	dc.AppName = c.derpAppName
 	if c.extraRootCAs != nil {
 		dc.TLSConfig = &tls.Config{RootCAs: c.extraRootCAs}
 	}
@@ -771,7 +793,24 @@ func (c *Conn) SetOnlyTCP443(v bool) {
 
 // SetDERPMap controls which (if any) DERP servers are used.
 // A nil value means to disable DERP; it's disabled by default.
+//
+// SetDERPMap triggers a ReSTUN after updating the map. Callers that want to
+// set the map without triggering a ReSTUN should use [Conn.SetDERPMapWithoutReSTUN]
+// instead.
 func (c *Conn) SetDERPMap(dm *tailcfg.DERPMap) {
+	c.setDERPMap(dm, true)
+}
+
+// SetDERPMapWithoutReSTUN is like [Conn.SetDERPMap] but does not trigger a
+// ReSTUN after updating the map.
+//
+// It is used for setting the map from a cache, so the homeDERP can be set
+// from cache before any STUN happens.
+func (c *Conn) SetDERPMapWithoutReSTUN(dm *tailcfg.DERPMap) {
+	c.setDERPMap(dm, false)
+}
+
+func (c *Conn) setDERPMap(dm *tailcfg.DERPMap, doReStun bool) {
 	c.mu.Lock()
 	defer c.mu.Unlock()
 
@@ -828,8 +867,14 @@ func (c *Conn) SetDERPMap(dm *tailcfg.DERPMap) {
 		}
 	}
 
-	go c.ReSTUN("derp-map-update")
+	if doReStun {
+		if reSTUNHookForTests != nil {
+			reSTUNHookForTests("derp-map-update")
+		}
+		go c.ReSTUN("derp-map-update")
+	}
 }
+
 func (c *Conn) wantDerpLocked() bool { return c.derpMap != nil }
 
 // c.mu must be held.
diff --git a/wgengine/magicsock/derp_test.go b/wgengine/magicsock/derp_test.go
index 084f710d8..2d1f95571 100644
--- a/wgengine/magicsock/derp_test.go
+++ b/wgengine/magicsock/derp_test.go
@@ -4,9 +4,15 @@
 package magicsock
 
 import (
+	"fmt"
 	"testing"
 
+	"tailscale.com/health"
 	"tailscale.com/net/netcheck"
+	"tailscale.com/tailcfg"
+	"tailscale.com/tstest"
+	"tailscale.com/util/eventbus"
+	"tailscale.com/util/eventbus/eventbustest"
 )
 
 func CheckDERPHeuristicTimes(t *testing.T) {
@@ -14,3 +20,113 @@ func CheckDERPHeuristicTimes(t *testing.T) {
 		t.Errorf("PreferredDERPFrameTime too low; should be at least frameReceiveRecordRate")
 	}
 }
+
+func TestForceSetNearestDERP(t *testing.T) {
+	derpMap := &tailcfg.DERPMap{
+		Regions: map[int]*tailcfg.DERPRegion{
+			7: {
+				RegionID:   7,
+				RegionCode: "test",
+				Nodes: []*tailcfg.DERPNode{
+					{
+						Name:     "7a",
+						RegionID: 7,
+						HostName: "derp7.test.unused",
+						IPv4:     "127.0.0.1",
+						IPv6:     "none",
+					},
+				},
+			},
+		},
+	}
+
+	// Force the real control health check so we can verify force=true bypasses it.
+	tstest.Replace(t, &checkControlHealthDuringNearestDERPInTests, true)
+
+	bus := eventbustest.NewBus(t)
+	ht := health.NewTracker(bus)
+	c := newConn(t.Logf)
+	ec := bus.Client("magicsock.Conn.Test")
+	c.eventClient = ec
+	c.homeDERPChangedPub = eventbus.Publish[HomeDERPChanged](ec)
+	c.eventBus = bus
+	c.derpMap = derpMap
+	c.health = ht
+
+	ht.SetOutOfPollNetMap()
+
+	tw := eventbustest.NewWatcher(t, bus)
+
+	got := c.ForceSetNearestDERP(7)
+	if got != 7 {
+		t.Fatalf("ForceSetNearestDERP(7) = %d, want 7", got)
+	}
+	if c.myDerp != 7 {
+		t.Errorf("c.myDerp = %d after ForceSetNearestDERP, want 7", c.myDerp)
+	}
+
+	if err := eventbustest.Expect(tw, func(e HomeDERPChanged) error {
+		if e.Old != 0 || e.New != 7 {
+			return fmt.Errorf("got HomeDERPChanged{Old:%d, New:%d}, want {Old:0, New:7}", e.Old, e.New)
+		}
+		return nil
+	}); err != nil {
+		t.Errorf("expected HomeDERPChanged event: %v", err)
+	}
+}
+
+func TestSetDERPMapDoReStun(t *testing.T) {
+	derpMap1 := &tailcfg.DERPMap{
+		Regions: map[int]*tailcfg.DERPRegion{
+			1: {
+				RegionID:   1,
+				RegionCode: "cph",
+				Nodes: []*tailcfg.DERPNode{
+					{Name: "1a", RegionID: 1, HostName: "cph.test.unused", IPv4: "127.0.0.1", IPv6: "none"},
+				},
+			},
+		},
+	}
+	derpMap2 := &tailcfg.DERPMap{
+		Regions: map[int]*tailcfg.DERPRegion{
+			2: {
+				RegionID:   2,
+				RegionCode: "inc",
+				Nodes: []*tailcfg.DERPNode{
+					{Name: "2a", RegionID: 2, HostName: "inc.test.unused", IPv4: "127.0.0.1", IPv6: "none"},
+				},
+			},
+		},
+	}
+
+	var reSTUNCalls int
+	tstest.Replace(t, &reSTUNHookForTests, func(_ string) {
+		reSTUNCalls++
+	})
+
+	bus := eventbustest.NewBus(t)
+	ht := health.NewTracker(bus)
+	// Use WhileTestRunningLogger so the goroutine spawned by setDERPMap
+	// (which calls ReSTUN, which logs) doesn't race with test cleanup.
+	c := newConn(tstest.WhileTestRunningLogger(t))
+	ec := bus.Client("magicsock.Conn.Test")
+	c.eventClient = ec
+	c.homeDERPChangedPub = eventbus.Publish[HomeDERPChanged](ec)
+	c.eventBus = bus
+	c.health = ht
+	// With a zero private key and everHadKey=true, ReSTUN returns early without
+	// spawning updateEndpoints.
+	c.everHadKey = true
+
+	// SetDERPMapWithoutReSTUN should not trigger a ReSTUN.
+	c.SetDERPMapWithoutReSTUN(derpMap1)
+	if reSTUNCalls != 0 {
+		t.Errorf("SetDERPMapWithoutReSTUN: got %d ReSTUN calls, want 0", reSTUNCalls)
+	}
+
+	// SetDERPMap should trigger a ReSTUN.
+	c.SetDERPMap(derpMap2)
+	if reSTUNCalls != 1 {
+		t.Errorf("SetDERPMap: got %d ReSTUN calls, want 1", reSTUNCalls)
+	}
+}
diff --git a/wgengine/magicsock/endpoint.go b/wgengine/magicsock/endpoint.go
index b8d3b96be..2f144d0ea 100644
--- a/wgengine/magicsock/endpoint.go
+++ b/wgengine/magicsock/endpoint.go
@@ -43,7 +43,7 @@ var mtuProbePingSizesV6 []int
 // discoKeyAdvertisementInterval tells how often a disco update via TSMP can
 // happen. The update is triggered via enqueueCallMeMaybe, and thus it will
 // only be sent if the magicsock is in a state to send out CallMeMaybe.
-const discoKeyAdvertisementInterval = time.Second * 60
+const discoKeyAdvertisementInterval = time.Minute * 2
 
 func init() {
 	for _, m := range tstun.WireMTUsToProbe {
@@ -138,6 +138,20 @@ func (de *endpoint) udpRelayEndpointReady(maybeBest addrQuality) {
 func (de *endpoint) setBestAddrLocked(v addrQuality) {
 	if v.epAddr != de.bestAddr.epAddr {
 		de.probeUDPLifetime.resetCycleEndpointLocked()
+
+		// Reaching here, if we are upgrading from an invalid (missing) address
+		// to a valid one, record metrics:
+		if !de.bestAddr.ap.IsValid() && v.ap.IsValid() {
+			// If we are using data from a cached netmap, increment the counter for peers established.
+			isCached := de.c.usingCachedNetmap.Load()
+			if isCached {
+				metricCachedPeerContactDirect.Add(1)
+			}
+			// Regardless whether the netmap is cached, record how long it has
+			// been since the endpoint was initialized.
+			de.c.logf("magicsock: new contact: peer=%s usec=%d cached=%v via=direct",
+				de.publicKey.ShortString(), int64(mono.Since(de.c.initializedAt)/time.Microsecond), isCached)
+		}
 	}
 	de.bestAddr = v
 }
@@ -530,11 +544,6 @@ func (de *endpoint) noteRecvActivity(src epAddr, now mono.Time) bool {
 	elapsed := now.Sub(de.lastRecvWG.LoadAtomic())
 	if elapsed > 10*time.Second {
 		de.lastRecvWG.StoreAtomic(now)
-
-		if de.c.noteRecvActivity == nil {
-			return false
-		}
-		de.c.noteRecvActivity(de.publicKey)
 		return true
 	}
 	return false
@@ -897,7 +906,7 @@ func (de *endpoint) wantUDPRelayPathDiscoveryLocked(now mono.Time) bool {
 	if runtime.GOOS == "js" {
 		return false
 	}
-	if !de.c.hasPeerRelayServers.Load() {
+	if !de.c.relayManager.hasPeerRelayServers.Load() {
 		// Changes in this value between its access and a call to
 		// [endpoint.discoverUDPRelayPathsLocked] are fine, we will eventually
 		// do the "right" thing during future path discovery. The worst case is
@@ -1183,8 +1192,7 @@ func (de *endpoint) discoPingTimeout(txid stun.TxID) {
 		return
 	}
 	bestUntrusted := mono.Now().After(de.trustBestAddrUntil)
-	if sp.to == de.bestAddr.epAddr && sp.to.vni.IsSet() && bestUntrusted {
-		// TODO(jwhited): consider applying this to direct UDP paths as well
+	if sp.to == de.bestAddr.epAddr && bestUntrusted {
 		de.clearBestAddrLocked()
 	}
 	if debugDisco() || !de.bestAddr.ap.IsValid() || bestUntrusted {
@@ -1354,8 +1362,12 @@ func (de *endpoint) startDiscoPingLocked(ep epAddr, now mono.Time, purpose disco
 
 }
 
-// sendDiscoPingsLocked starts pinging all of ep's endpoints.
+// sendDiscoPingsLocked starts pinging all of ep's direct endpoints.
+// Sibling of discoverUDPRelayPathsLocked for udprelay.
 func (de *endpoint) sendDiscoPingsLocked(now mono.Time, sendCallMeMaybe bool) {
+	if debugNeverDirectUDP() {
+		return // skip when direct UDP is disabled
+	}
 	de.lastFullPing = now
 	var sentAny bool
 	for ep, st := range de.endpointState {
@@ -1778,12 +1790,8 @@ func (de *endpoint) handlePongConnLocked(m *disco.Pong, di *discoInfo, src epAdd
 			latency: latency,
 			wireMTU: pingSizeToPktLen(sp.size, sp.to),
 		}
-		// TODO(jwhited): consider checking de.trustBestAddrUntil as well. If
-		//  de.bestAddr is untrusted we may want to clear it, otherwise we could
-		//  get stuck with a forever untrusted bestAddr that blackholes, since
-		//  we don't clear direct UDP paths on disco ping timeout (see
-		//  discoPingTimeout).
-		if betterAddr(thisPong, de.bestAddr) {
+		bestUntrusted := now.After(de.trustBestAddrUntil)
+		if betterAddr(thisPong, de.bestAddr) || bestUntrusted {
 			de.c.logf("magicsock: disco: node %v %v now using %v mtu=%v tx=%x", de.publicKey.ShortString(), de.discoShort(), sp.to, thisPong.wireMTU, m.TxID[:6])
 			de.debugUpdates.Add(EndpointChange{
 				When: time.Now(),
@@ -1837,6 +1845,8 @@ type addrQuality struct {
 	wireMTU          tstun.WireMTU
 }
 
+func (a addrQuality) isZero() bool { return a == addrQuality{} }
+
 func (a addrQuality) String() string {
 	// TODO(jwhited): consider including relayServerDisco
 	return fmt.Sprintf("%v@%v+%v", a.epAddr, a.latency, a.wireMTU)
@@ -2098,7 +2108,7 @@ func (de *endpoint) setDERPHome(regionID uint16) {
 	de.mu.Lock()
 	defer de.mu.Unlock()
 	de.derpAddr = netip.AddrPortFrom(tailcfg.DerpMagicIPAddr, uint16(regionID))
-	if de.c.hasPeerRelayServers.Load() {
+	if de.c.relayManager.hasPeerRelayServers.Load() {
 		de.c.relayManager.handleDERPHomeChange(de.publicKey, regionID)
 	}
 }
diff --git a/wgengine/magicsock/endpoint_test.go b/wgengine/magicsock/endpoint_test.go
index eba742b00..0df59bbc4 100644
--- a/wgengine/magicsock/endpoint_test.go
+++ b/wgengine/magicsock/endpoint_test.go
@@ -4,14 +4,20 @@
 package magicsock
 
 import (
+	"fmt"
 	"net/netip"
 	"testing"
+	"testing/synctest"
 	"time"
 
+	"tailscale.com/disco"
+	"tailscale.com/envknob"
 	"tailscale.com/net/packet"
+	"tailscale.com/net/stun"
 	"tailscale.com/tailcfg"
 	"tailscale.com/tstime/mono"
 	"tailscale.com/types/key"
+	"tailscale.com/util/ringlog"
 )
 
 func TestProbeUDPLifetimeConfig_Equals(t *testing.T) {
@@ -453,3 +459,269 @@ func Test_endpoint_udpRelayEndpointReady(t *testing.T) {
 		})
 	}
 }
+
+func Test_endpoint_discoPingTimeout(t *testing.T) {
+	expired := -1 * time.Hour
+	valid := 1 * time.Hour
+	directAddrA := epAddr{ap: netip.MustParseAddrPort("192.0.2.1:7")}
+	relayAddrA := epAddr{ap: netip.MustParseAddrPort("192.0.2.2:77")}
+	relayAddrA.vni.Set(1)
+	directAddrB := epAddr{ap: netip.MustParseAddrPort("192.0.2.3:7")}
+	relayAddrB := epAddr{ap: netip.MustParseAddrPort("192.0.2.4:77")}
+	relayAddrB.vni.Set(1)
+
+	for _, tc := range []struct {
+		name                string
+		bestAddr            addrQuality
+		trustBestAddrUntil  time.Duration
+		pingTo              epAddr
+		wantBestAddrCleared bool
+	}{
+		{
+			name:                "relay-path-trust-expired",
+			bestAddr:            addrQuality{epAddr: relayAddrA},
+			trustBestAddrUntil:  expired,
+			pingTo:              relayAddrA,
+			wantBestAddrCleared: true,
+		},
+		{
+			name:                "direct-udp-path-trust-expired",
+			bestAddr:            addrQuality{epAddr: directAddrA},
+			trustBestAddrUntil:  expired,
+			pingTo:              directAddrA,
+			wantBestAddrCleared: true,
+		},
+		{
+			name:                "direct-udp-path-trust-valid",
+			bestAddr:            addrQuality{epAddr: directAddrA},
+			trustBestAddrUntil:  valid,
+			pingTo:              directAddrA,
+			wantBestAddrCleared: false,
+		},
+		{
+			name:                "relay-path-trust-valid",
+			bestAddr:            addrQuality{epAddr: relayAddrA},
+			trustBestAddrUntil:  valid,
+			pingTo:              relayAddrA,
+			wantBestAddrCleared: false,
+		},
+		{
+			name:                "ping-to-different-direct-addr-trust-expired",
+			bestAddr:            addrQuality{epAddr: directAddrA},
+			trustBestAddrUntil:  expired,
+			pingTo:              directAddrB,
+			wantBestAddrCleared: false,
+		},
+		{
+			name:                "ping-to-different-relay-addr-trust-expired",
+			bestAddr:            addrQuality{epAddr: relayAddrA},
+			trustBestAddrUntil:  expired,
+			pingTo:              relayAddrB,
+			wantBestAddrCleared: false,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			synctest.Test(t, func(t *testing.T) {
+				now := mono.Now() // synctest to match this to the internal 'now'
+				c := &Conn{
+					logf: func(msg string, args ...any) {},
+				}
+				c.discoAtomic.Set(key.NewDisco())
+				de := &endpoint{
+					c:                  c,
+					bestAddr:           tc.bestAddr,
+					trustBestAddrUntil: now.Add(tc.trustBestAddrUntil),
+					sentPing:           make(map[stun.TxID]sentPing),
+				}
+				txid := stun.NewTxID()
+				timer := time.NewTimer(time.Hour)
+				timer.Stop()
+				de.sentPing[txid] = sentPing{
+					to:      tc.pingTo,
+					at:      now.Add(-100 * time.Millisecond),
+					timer:   timer,
+					purpose: pingDiscovery,
+				}
+
+				de.discoPingTimeout(txid)
+				if tc.wantBestAddrCleared {
+					if de.bestAddr.ap.IsValid() {
+						t.Errorf("expected bestAddr to be cleared, but bestAddr.ap is valid: %v", de.bestAddr.ap)
+					}
+					if de.trustBestAddrUntil != 0 {
+						t.Errorf("expected trustBestAddrUntil to be cleared, but got: %v", de.trustBestAddrUntil)
+					}
+				} else {
+					if de.bestAddr != tc.bestAddr {
+						t.Errorf("expected bestAddr to be unchanged, got: %v, want: %v", de.bestAddr, tc.bestAddr)
+					}
+				}
+				if _, ok := de.sentPing[txid]; ok {
+					t.Errorf("expected sentPing[txid] to be removed, but it still exists")
+				}
+			})
+		})
+	}
+}
+
+func Test_endpoint_sendDiscoPingsLocked_neverDirectUDP(t *testing.T) {
+	directAddr := netip.MustParseAddrPort("192.0.2.1:7")
+	for _, neverDirectUDP := range []bool{false, true} {
+		t.Run(fmt.Sprintf("neverDirectUDP=%v", neverDirectUDP), func(t *testing.T) {
+			prev := envknob.String("TS_DEBUG_NEVER_DIRECT_UDP")
+			if neverDirectUDP {
+				envknob.Setenv("TS_DEBUG_NEVER_DIRECT_UDP", "true")
+			} else {
+				envknob.Setenv("TS_DEBUG_NEVER_DIRECT_UDP", "")
+			}
+			t.Cleanup(func() { envknob.Setenv("TS_DEBUG_NEVER_DIRECT_UDP", prev) })
+			now := mono.Now()
+			c := &Conn{
+				logf: func(msg string, args ...any) {},
+			}
+			c.discoAtomic.Set(key.NewDisco())
+			de := &endpoint{
+				c:             c,
+				sentPing:      make(map[stun.TxID]sentPing),
+				endpointState: make(map[netip.AddrPort]*endpointState),
+			}
+			de.disco.Store(&endpointDisco{key: key.NewDisco().Public()})
+			de.endpointState[directAddr] = &endpointState{}
+			de.sendDiscoPingsLocked(now, true)
+
+			wantPing := !neverDirectUDP
+			if gotPing := de.lastFullPing == now; gotPing != wantPing {
+				t.Errorf("lastFullPing set = %v, want %v", gotPing, wantPing)
+			}
+			if gotPing := de.endpointState[directAddr].lastPing == now; gotPing != wantPing {
+				t.Errorf("direct endpoint lastPing set = %v, want %v", gotPing, wantPing)
+			}
+		})
+	}
+}
+
+func Test_endpoint_handlePongConnLocked(t *testing.T) {
+	goodLatency := 50 * time.Millisecond
+	badLatency := 100 * time.Millisecond
+	expired := -1 * time.Hour
+	valid := 1 * time.Hour
+	directAddrA := epAddr{ap: netip.MustParseAddrPort("192.0.2.1:7")}
+	directAddrB := epAddr{ap: netip.MustParseAddrPort("192.0.2.2:8")}
+	derpAddr := epAddr{ap: netip.AddrPortFrom(tailcfg.DerpMagicIPAddr, 0)}
+
+	for _, tc := range []struct {
+		name               string
+		bestAddr           addrQuality
+		trustBestAddrUntil time.Duration
+		pongFrom           epAddr
+		pongLatency        time.Duration
+		wantBestAddr       epAddr
+	}{
+		{
+			name:               "better-latency-trust-valid",
+			bestAddr:           addrQuality{epAddr: directAddrA, latency: badLatency},
+			trustBestAddrUntil: valid,
+			pongFrom:           directAddrB,
+			pongLatency:        goodLatency,
+			wantBestAddr:       directAddrB,
+		},
+		{
+			name:               "worse-latency-trust-valid",
+			bestAddr:           addrQuality{epAddr: directAddrA, latency: goodLatency},
+			trustBestAddrUntil: valid,
+			pongFrom:           directAddrB,
+			pongLatency:        badLatency,
+			wantBestAddr:       directAddrA,
+		},
+		{
+			name:               "worse-latency-trust-expired",
+			bestAddr:           addrQuality{epAddr: directAddrA, latency: goodLatency},
+			trustBestAddrUntil: expired,
+			pongFrom:           directAddrB,
+			pongLatency:        badLatency,
+			wantBestAddr:       directAddrB,
+		},
+		{
+			name:               "same-path-trust-expired",
+			bestAddr:           addrQuality{epAddr: directAddrA, latency: badLatency},
+			trustBestAddrUntil: expired,
+			pongFrom:           directAddrA,
+			pongLatency:        goodLatency, // updated latency
+			wantBestAddr:       directAddrA,
+		},
+		{
+			name:               "derp-pong-trust-expired",
+			bestAddr:           addrQuality{epAddr: directAddrA, latency: badLatency},
+			trustBestAddrUntil: expired,
+			pongFrom:           derpAddr,
+			pongLatency:        goodLatency,
+			wantBestAddr:       directAddrA,
+		},
+		{
+			name:               "better-latency-trust-expired",
+			bestAddr:           addrQuality{epAddr: directAddrA, latency: badLatency},
+			trustBestAddrUntil: expired,
+			pongFrom:           directAddrB,
+			pongLatency:        goodLatency,
+			wantBestAddr:       directAddrB,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			synctest.Test(t, func(t *testing.T) {
+				now := mono.Now() // synctest to match this to the internal 'now'
+				pm := newPeerMap()
+				c := &Conn{
+					logf:    func(msg string, args ...any) {},
+					peerMap: pm,
+				}
+				c.discoAtomic.Set(key.NewDisco())
+				de := &endpoint{
+					c:                  c,
+					bestAddr:           tc.bestAddr,
+					bestAddrAt:         now.Add(-5 * time.Minute),
+					trustBestAddrUntil: now.Add(tc.trustBestAddrUntil),
+					sentPing:           make(map[stun.TxID]sentPing),
+					endpointState:      make(map[netip.AddrPort]*endpointState),
+					debugUpdates:       ringlog.New[EndpointChange](10),
+				}
+				txid := stun.NewTxID()
+				pong := &disco.Pong{
+					TxID: txid,
+					Src:  tc.pongFrom.ap,
+				}
+				timer := time.NewTimer(time.Hour)
+				timer.Stop()
+				de.sentPing[txid] = sentPing{
+					to:      tc.pongFrom,
+					at:      now.Add(-tc.pongLatency),
+					timer:   timer,
+					purpose: pingDiscovery,
+				}
+				if tc.pongFrom.ap.Addr() != tailcfg.DerpMagicIPAddr && !tc.pongFrom.vni.IsSet() {
+					de.endpointState[tc.pongFrom.ap] = &endpointState{}
+				}
+				di := &discoInfo{
+					discoKey:   key.NewDisco().Public(),
+					discoShort: "test",
+				}
+
+				knownTxID := de.handlePongConnLocked(pong, di, tc.pongFrom)
+				if !knownTxID {
+					t.Errorf("expected knownTxID to be true, got false")
+				}
+				if de.bestAddr.epAddr != tc.wantBestAddr {
+					t.Errorf("expected bestAddr.epAddr to be %v, got: %v", tc.wantBestAddr, de.bestAddr.epAddr)
+				}
+				if tc.pongFrom == tc.bestAddr.epAddr && de.bestAddr.latency-tc.pongLatency > 0 {
+					t.Errorf("expected latency to be  %v, got: %v", tc.pongLatency, de.bestAddr.latency)
+				}
+				if tc.pongFrom != derpAddr && de.trustBestAddrUntil.Before(now) {
+					t.Errorf("expected trustBestAddrUntil to be refreshed, but it's in the past: %v", de.trustBestAddrUntil)
+				}
+				if _, ok := de.sentPing[txid]; ok {
+					t.Errorf("expected sentPing[txid] to be removed, but it still exists")
+				}
+			})
+		})
+	}
+}
diff --git a/wgengine/magicsock/magicsock.go b/wgengine/magicsock/magicsock.go
index f13e31554..16e988cb3 100644
--- a/wgengine/magicsock/magicsock.go
+++ b/wgengine/magicsock/magicsock.go
@@ -51,6 +51,7 @@ import (
 	"tailscale.com/net/tstun"
 	"tailscale.com/syncs"
 	"tailscale.com/tailcfg"
+	"tailscale.com/tsconst"
 	"tailscale.com/tstime"
 	"tailscale.com/tstime/mono"
 	"tailscale.com/types/key"
@@ -164,12 +165,12 @@ type Conn struct {
 	derpActiveFunc         func()
 	idleFunc               func() time.Duration // nil means unknown
 	testOnlyPacketListener nettype.PacketListener
-	noteRecvActivity       func(key.NodePublic)                   // or nil, see Options.NoteRecvActivity
 	onDERPRecv             func(int, key.NodePublic, []byte) bool // or nil, see Options.OnDERPRecv
 	netMon                 *netmon.Monitor                        // must be non-nil
 	health                 *health.Tracker                        // or nil
 	extraRootCAs           *x509.CertPool                         // additional trusted root CAs; or nil
 	controlKnobs           *controlknobs.Knobs                    // or nil
+	derpAppName            string                                 // or empty, see Options.DERPAppName
 
 	// ================================================================
 	// No locking required to access these fields, either because
@@ -183,6 +184,7 @@ type Conn struct {
 	allocRelayEndpointPub    *eventbus.Publisher[UDPRelayAllocReq]
 	portUpdatePub            *eventbus.Publisher[router.PortUpdate]
 	tsmpDiscoKeyAvailablePub *eventbus.Publisher[NewDiscoKeyAvailable]
+	homeDERPChangedPub       *eventbus.Publisher[HomeDERPChanged]
 
 	// pconn4 and pconn6 are the underlying UDP sockets used to
 	// send/receive packets for wireguard and other magicsock
@@ -269,15 +271,12 @@ type Conn struct {
 	// captureHook, if non-nil, is the pcap logging callback when capturing.
 	captureHook syncs.AtomicValue[packet.CaptureCallback]
 
-	// hasPeerRelayServers is whether [relayManager] is configured with at least
-	// one peer relay server via [relayManager.handleRelayServersSet]. It exists
-	// to suppress calls into [relayManager] leading to wasted work involving
-	// channel operations and goroutine creation.
-	hasPeerRelayServers atomic.Bool
-
 	// discoAtomic is the current disco private and public keypair for this conn.
 	discoAtomic discoAtomic
 
+	// usingCacheNetmap is whether the latest update to self and peersByID are from a cached network map.
+	usingCachedNetmap atomic.Bool
+
 	// ============================================================
 	// mu guards all following fields; see userspaceEngine lock
 	// ordering rules against the engine. For derphttp, mu must
@@ -329,12 +328,6 @@ type Conn struct {
 	// for a period of time before withdrawing them.
 	endpointTracker endpointTracker
 
-	// peerSet is the set of peers that are currently configured in
-	// WireGuard. These are not used to filter inbound or outbound
-	// traffic at all, but only to track what state can be cleaned up
-	// in other maps below that are keyed by peer public key.
-	peerSet set.Set[key.NodePublic]
-
 	// peerMap tracks the networkmap Node entity for each peer
 	// by node key, node ID, and discovery key.
 	peerMap peerMap
@@ -361,18 +354,19 @@ type Conn struct {
 	// magicsock could do with any complexity reduction it can get.
 	netInfoLast *tailcfg.NetInfo
 
-	derpMap            *tailcfg.DERPMap              // nil (or zero regions/nodes) means DERP is disabled
-	self               tailcfg.NodeView              // from last SetNetworkMap
-	peers              views.Slice[tailcfg.NodeView] // from last SetNetworkMap, sorted by Node.ID; Note: [netmap.NodeMutation]'s rx'd in UpdateNetmapDelta are never applied
-	filt               *filter.Filter                // from last SetFilter
-	relayClientEnabled bool                          // whether we can allocate UDP relay endpoints on UDP relay servers or receive CallMeMaybeVia messages from peers
-	lastFlags          debugFlags                    // at time of last SetNetworkMap
-	privateKey         key.NodePrivate               // WireGuard private key for this node
-	everHadKey         bool                          // whether we ever had a non-zero private key
-	myDerp             int                           // nearest DERP region ID; 0 means none/unknown
-	homeless           bool                          // if true, don't try to find & stay conneted to a DERP home (myDerp will stay 0)
-	derpStarted        chan struct{}                 // closed on first connection to DERP; for tests & cleaner Close
-	activeDerp         map[int]activeDerp            // DERP regionID -> connection to a node in that region
+	derpMap   *tailcfg.DERPMap                    // nil (or zero regions/nodes) means DERP is disabled
+	self      tailcfg.NodeView                    // from last SetNetworkMap
+	peersByID map[tailcfg.NodeID]tailcfg.NodeView // current peer set, keyed by NodeID. Maintained by SetNetworkMap/UpsertPeer/RemovePeer. Note: per-field NodeMutation patches received in UpdateNetmapDelta are never applied to these snapshots.
+
+	filt               *filter.Filter     // from last SetFilter
+	relayClientEnabled bool               // whether we can allocate UDP relay endpoints on UDP relay servers or receive CallMeMaybeVia messages from peers
+	lastFlags          debugFlags         // at time of last SetNetworkMap
+	privateKey         key.NodePrivate    // WireGuard private key for this node
+	everHadKey         bool               // whether we ever had a non-zero private key
+	myDerp             int                // nearest DERP region ID; 0 means none/unknown
+	homeless           bool               // if true, don't try to find & stay conneted to a DERP home (myDerp will stay 0)
+	derpStarted        chan struct{}      // closed on first connection to DERP; for tests & cleaner Close
+	activeDerp         map[int]activeDerp // DERP regionID -> connection to a node in that region
 	prevDerp           map[int]*syncs.WaitGroupChan
 
 	// derpRoute contains optional alternate routes to use as an
@@ -399,6 +393,16 @@ type Conn struct {
 	// experiencing a write error, and is used to throttle the rate of rebinds.
 	lastErrRebind syncs.AtomicValue[time.Time]
 
+	// appliedDisableUDPGRO and appliedDisableUDPGSO cache the last UDP offload
+	// controlknobs values we reacted to. They are compared against the live
+	// knob values during netmap updates so we can detect a control-plane
+	// transition and trigger a [Conn.Rebind] to re-evaluate the
+	// UDP_GRO/UDP_SEGMENT socket options. Guarded by c.mu. Only consulted on
+	// Linux; on other platforms tryEnableUDPOffload is a no-op so any
+	// transition is meaningless and no rebind is fired.
+	appliedDisableUDPGRO bool
+	appliedDisableUDPGSO bool
+
 	// staticEndpoints are user set endpoints that this node should
 	// advertise amongst its wireguard endpoints. It is user's
 	// responsibility to ensure that traffic from these endpoints is routed
@@ -408,9 +412,21 @@ type Conn struct {
 	// metrics contains the metrics for the magicsock instance.
 	metrics *metrics
 
+	// initializedAt records the latest time at which the conn was
+	// (re)initialized for latency metrics. This is set at construction, and
+	// updated by netmap resets.
+	initializedAt mono.Time
+
 	// homeDERPGauge is the usermetric gauge for the home DERP region ID.
 	// This can be nil when [Options.Metrics] are not enabled.
 	homeDERPGauge *usermetric.Gauge
+
+	// checkNetworkUpDuringTests controls whether [Conn.networkDown]
+	// will report the value of [Conn.networkUp] while running tests.
+	//
+	// This allows tests to pass when the user's machine is offline,
+	// but allows us to still test network-down behaviour when desired.
+	checkNetworkUpDuringTests bool
 }
 
 // SetDebugLoggingEnabled controls whether spammy debug logging is enabled.
@@ -462,19 +478,6 @@ type Options struct {
 	// Only used by tests.
 	TestOnlyPacketListener nettype.PacketListener
 
-	// NoteRecvActivity, if provided, is a func for magicsock to call
-	// whenever it receives a packet from a a peer if it's been more
-	// than ~10 seconds since the last one. (10 seconds is somewhat
-	// arbitrary; the sole user, lazy WireGuard configuration,
-	// just doesn't need or want it called on
-	// every packet, just every minute or two for WireGuard timeouts,
-	// and 10 seconds seems like a good trade-off between often enough
-	// and not too often.)
-	// The provided func is likely to call back into
-	// Conn.ParseEndpoint, which acquires Conn.mu. As such, you should
-	// not hold Conn.mu while calling it.
-	NoteRecvActivity func(key.NodePublic)
-
 	// NetMon is the network monitor to use.
 	// It must be non-nil.
 	NetMon *netmon.Monitor
@@ -487,6 +490,10 @@ type Options struct {
 	// for TLS connections to DERP servers.
 	ExtraRootCAs *x509.CertPool
 
+	// DERPAppName, if non-empty, is an opaque app name string to
+	// advertise to DERP servers for stats purposes.
+	DERPAppName string
+
 	// Metrics specifies the metrics registry to record metrics to.
 	Metrics *usermetric.Registry
 
@@ -574,13 +581,14 @@ type UDPRelayAllocResp struct {
 func newConn(logf logger.Logf) *Conn {
 	discoPrivate := key.NewDisco()
 	c := &Conn{
-		logf:         logf,
-		derpRecvCh:   make(chan derpReadResult, 1), // must be buffered, see issue 3736
-		derpStarted:  make(chan struct{}),
-		peerLastDerp: make(map[key.NodePublic]int),
-		peerMap:      newPeerMap(),
-		discoInfo:    make(map[key.DiscoPublic]*discoInfo),
-		cloudInfo:    cloudinfo.New(logf),
+		logf:          logf,
+		derpRecvCh:    make(chan derpReadResult, 1), // must be buffered, see issue 3736
+		derpStarted:   make(chan struct{}),
+		peerLastDerp:  make(map[key.NodePublic]int),
+		peerMap:       newPeerMap(),
+		discoInfo:     make(map[key.DiscoPublic]*discoInfo),
+		cloudInfo:     cloudinfo.New(logf),
+		initializedAt: mono.Now(),
 	}
 	c.discoAtomic.Set(discoPrivate)
 	c.bind = &connBind{Conn: c, closed: true}
@@ -649,11 +657,19 @@ func NewConn(opts Options) (*Conn, error) {
 	c.eventBus = opts.EventBus
 	c.port.Store(uint32(opts.Port))
 	c.controlKnobs = opts.ControlKnobs
+	if runtime.GOOS == "linux" && c.controlKnobs != nil {
+		// Seed the cached "last applied" UDP offload knob values so the first
+		// netmap update doesn't spuriously trigger a rebind: bindSocket (called
+		// shortly after NewConn) will read these same knob values when
+		// configuring UDP_GRO/UDP_SEGMENT, so they're already in sync. We only
+		// do this on Linux because tryEnableUDPOffload is a no-op elsewhere.
+		c.appliedDisableUDPGRO = c.controlKnobs.DisableUDPGRO.Load()
+		c.appliedDisableUDPGSO = c.controlKnobs.DisableUDPGSO.Load()
+	}
 	c.epFunc = opts.endpointsFunc()
 	c.derpActiveFunc = opts.derpActiveFunc()
 	c.idleFunc = opts.IdleFunc
 	c.testOnlyPacketListener = opts.TestOnlyPacketListener
-	c.noteRecvActivity = opts.NoteRecvActivity
 	c.onDERPRecv = opts.OnDERPRecv
 
 	// Set up publishers and subscribers. Subscribe calls must return before
@@ -663,6 +679,7 @@ func NewConn(opts Options) (*Conn, error) {
 	c.allocRelayEndpointPub = eventbus.Publish[UDPRelayAllocReq](ec)
 	c.portUpdatePub = eventbus.Publish[router.PortUpdate](ec)
 	c.tsmpDiscoKeyAvailablePub = eventbus.Publish[NewDiscoKeyAvailable](ec)
+	c.homeDERPChangedPub = eventbus.Publish[HomeDERPChanged](ec)
 	eventbus.SubscribeFunc(ec, c.onPortMapChanged)
 	eventbus.SubscribeFunc(ec, c.onUDPRelayAllocResp)
 
@@ -693,6 +710,7 @@ func NewConn(opts Options) (*Conn, error) {
 	c.netMon = opts.NetMon
 	c.health = opts.HealthTracker
 	c.extraRootCAs = opts.ExtraRootCAs
+	c.derpAppName = opts.DERPAppName
 	c.getPeerByKey = opts.PeerByKeyFunc
 
 	if err := c.rebind(keepCurrentPort); err != nil {
@@ -1062,7 +1080,7 @@ func (c *Conn) updateNetInfo(ctx context.Context) (*netcheck.Report, error) {
 	ni.OSHasIPv6.Set(report.OSHasIPv6)
 	ni.WorkingUDP.Set(report.UDP)
 	ni.WorkingICMPv4.Set(report.ICMPv4)
-	ni.PreferredDERP = c.maybeSetNearestDERP(report)
+	ni.PreferredDERP = c.maybeSetNearestDERP(report, false)
 	ni.FirewallMode = hostinfo.FirewallMode()
 
 	c.callNetInfoCallback(ni)
@@ -1093,6 +1111,26 @@ func (c *Conn) callNetInfoCallbackLocked(ni *tailcfg.NetInfo) {
 	}
 }
 
+// ResetNetInfoLast clears the cached NetInfo used to de-duplicate NetInfo
+// callbacks, so that the next NetInfo is delivered to the registered callback
+// (see [Conn.SetNetInfoCallback]) even if it's structurally identical to the
+// previously delivered one.
+//
+// It must be called whenever the downstream consumer of NetInfo updates is
+// replaced, notably when [ipnlocal.LocalBackend] installs a new control client
+// after an interactive login or a profile switch.
+//
+// TODO(tailscale/tailscale#17887): remove once NetInfo updates move to the
+// eventbus, where a newly-installed consumer can fetch current state on
+// subscribe instead of magicsock exposing this de-dup-cache reset hook.
+//
+// c.mu must NOT be held.
+func (c *Conn) ResetNetInfoLast() {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.netInfoLast = nil
+}
+
 // addValidDiscoPathForTest makes addr a validated disco address for
 // discoKey. It's used in tests to enable receiving of packets from
 // addr without having to spin up the entire active discovery
@@ -1140,6 +1178,12 @@ func (c *Conn) LastRecvActivityOfNodeKey(nk key.NodePublic) string {
 	return mono.Since(saw).Round(time.Second).String()
 }
 
+// ProbeLocks acquires and releases Conn's internal mutex.
+func (c *Conn) ProbeLocks() {
+	c.mu.Lock()
+	c.mu.Unlock()
+}
+
 // Ping handles a "tailscale ping" CLI query.
 func (c *Conn) Ping(peer tailcfg.NodeView, res *ipnstate.PingResult, size int, cb func(*ipnstate.PingResult)) {
 	c.mu.Lock()
@@ -1445,14 +1489,10 @@ func (c *Conn) LocalPort() uint16 {
 
 var errNetworkDown = errors.New("magicsock: network down")
 
-// This allows tests to pass when the user's machine is offline, but allows us
-// to still test network-down behaviour when desired.
-var checkNetworkDownDuringTests = false
-
 func (c *Conn) networkDown() bool {
 	// For tests, always assume the network is up unless we're explicitly
 	// testing this behaviour.
-	if envknob.AssumeNetworkUp() || (testenv.InTest() && !checkNetworkDownDuringTests) {
+	if envknob.AssumeNetworkUp() || (testenv.InTest() && !c.checkNetworkUpDuringTests) {
 		return false
 	}
 	return !c.networkUp.Load()
@@ -2353,6 +2393,20 @@ func (c *Conn) handleDiscoMessage(msg []byte, src epAddr, shouldBeRelayHandshake
 			c.logf("[unexpected] %s from peer via DERP whose netmap discokey != disco source", msgType)
 			return
 		}
+
+		// Reaching here, if we are using data from a cached network map the
+		// receipt of a CallMeMaybe from a peer indicates we have a sufficiently
+		// viable connection to that peer to count it as active while cached.
+		isCached := c.usingCachedNetmap.Load()
+		if isCached {
+			metricCachedPeerContactDERP.Add(1)
+		}
+		// If we did not already have an endpoint for this peer, even a stale
+		// one, record how long it has been since the endpoint was initialized.
+		if !lastBest.ap.IsValid() {
+			c.logf("magicsock: new contact: peer=%s usec=%d cached=%v via=derp",
+				nodeKey.ShortString(), int64(mono.Since(c.initializedAt)/time.Microsecond), isCached)
+		}
 		if isVia {
 			c.dlogf("[v1] magicsock: disco: %v<-%v via %v (%v, %v)  got call-me-maybe-via, %d endpoints",
 				c.discoAtomic.Short(), epDisco.short, via.ServerDisco.ShortString(),
@@ -2430,24 +2484,12 @@ func (c *Conn) handleDiscoMessage(msg []byte, src epAddr, shouldBeRelayHandshake
 		if c.filt == nil {
 			return
 		}
-		// Binary search of peers is O(log n) while c.mu is held.
-		// TODO: We might be able to use ep.nodeAddr instead of all addresses,
-		//  or we might be able to release c.mu before doing this work. Keep it
-		//  simple and slow for now. c.peers.AsSlice is a copy. We may need to
-		//  write our own binary search for a [views.Slice].
-		peerI, ok := slices.BinarySearchFunc(c.peers.AsSlice(), ep.nodeID, func(peer tailcfg.NodeView, target tailcfg.NodeID) int {
-			if peer.ID() < target {
-				return -1
-			} else if peer.ID() > target {
-				return 1
-			}
-			return 0
-		})
+		peer, ok := c.peersByID[ep.nodeID]
 		if !ok {
 			// unexpected
 			return
 		}
-		if !nodeHasCap(c.filt, c.peers.At(peerI), c.self, tailcfg.PeerCapabilityRelay) {
+		if !nodeHasCap(c.filt, peer, c.self, tailcfg.PeerCapabilityRelay) {
 			return
 		}
 		// [Conn.mu] must not be held while publishing, or [Conn.onUDPRelayAllocResp]
@@ -2759,43 +2801,6 @@ func (c *Conn) SetPrivateKey(privateKey key.NodePrivate) error {
 	return nil
 }
 
-// UpdatePeers is called when the set of WireGuard peers changes. It
-// then removes any state for old peers.
-//
-// The caller passes ownership of newPeers map to UpdatePeers.
-func (c *Conn) UpdatePeers(newPeers set.Set[key.NodePublic]) {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-
-	oldPeers := c.peerSet
-	c.peerSet = newPeers
-
-	// Clean up any key.NodePublic-keyed maps for peers that no longer
-	// exist.
-	for peer := range oldPeers {
-		if !newPeers.Contains(peer) {
-			delete(c.derpRoute, peer)
-			delete(c.peerLastDerp, peer)
-		}
-	}
-
-	if len(oldPeers) == 0 && len(newPeers) > 0 {
-		go c.ReSTUN("non-zero-peers")
-	}
-}
-
-func nodesEqual(x, y views.Slice[tailcfg.NodeView]) bool {
-	if x.Len() != y.Len() {
-		return false
-	}
-	for i := range x.Len() {
-		if !x.At(i).Equal(y.At(i)) {
-			return false
-		}
-	}
-	return true
-}
-
 // debugRingBufferSize returns a maximum size for our set of endpoint ring
 // buffers by assuming that a single large update is ~500 bytes, and that we
 // want to not use more than 1MiB of memory on phones / 4MiB on other devices.
@@ -2883,7 +2888,7 @@ func (c *Conn) SetFilter(f *filter.Filter) {
 	c.mu.Lock()
 	c.filt = f
 	self := c.self
-	peers := c.peers
+	peers := c.peerSnapshotLocked()
 	relayClientEnabled := c.relayClientEnabled
 	c.mu.Unlock() // release c.mu before potentially calling c.updateRelayServersSet which is O(m * n)
 
@@ -2897,11 +2902,26 @@ func (c *Conn) SetFilter(f *filter.Filter) {
 	c.updateRelayServersSet(f, self, peers)
 }
 
+// peerSnapshotLocked returns a freshly-allocated slice of the current peers.
+// It's used by callers that need to pass peer state to an O(m * n) callee
+// (like [Conn.updateRelayServersSet]) after releasing c.mu. c.mu must be held.
+func (c *Conn) peerSnapshotLocked() []tailcfg.NodeView {
+	if len(c.peersByID) == 0 {
+		return nil
+	}
+	out := make([]tailcfg.NodeView, 0, len(c.peersByID))
+	for _, p := range c.peersByID {
+		out = append(out, p)
+	}
+	return out
+}
+
 // updateRelayServersSet iterates all peers and self, evaluating filt for each
 // one in order to determine which are relay server candidates. filt, self, and
 // peers are passed as args (vs c.mu-guarded fields) to enable callers to
 // release c.mu before calling as this is O(m * n) (we iterate all cap rules 'm'
-// in filt for every peer 'n').
+// in filt for every peer 'n'). peers must be a snapshot owned by the caller;
+// this function does not retain it after return.
 //
 // Calls to updateRelayServersSet must never run concurrent to
 // [endpoint.setDERPHome], otherwise [candidatePeerRelay] DERP home changes may
@@ -2913,9 +2933,9 @@ func (c *Conn) SetFilter(f *filter.Filter) {
 //     them.
 //  2. Moving this work upstream into [nodeBackend] or similar, and publishing
 //     the computed result over the eventbus instead.
-func (c *Conn) updateRelayServersSet(filt *filter.Filter, self tailcfg.NodeView, peers views.Slice[tailcfg.NodeView]) {
+func (c *Conn) updateRelayServersSet(filt *filter.Filter, self tailcfg.NodeView, peers []tailcfg.NodeView) {
 	relayServers := make(set.Set[candidatePeerRelay])
-	nodes := append(peers.AsSlice(), self)
+	nodes := append(peers, self)
 	for _, maybeCandidate := range nodes {
 		if maybeCandidate.ID() != self.ID() && !capVerIsRelayCapable(maybeCandidate.Cap()) {
 			// If maybeCandidate's [tailcfg.CapabilityVersion] is not relay-capable,
@@ -2933,12 +2953,9 @@ func (c *Conn) updateRelayServersSet(filt *filter.Filter, self tailcfg.NodeView,
 			derpHomeRegionID: uint16(maybeCandidate.HomeDERP()),
 		})
 	}
+	// [relayManager]'s run loop updates [relayManager.hasPeerRelayServers]
+	// to reflect the new server count.
 	c.relayManager.handleRelayServersSet(relayServers)
-	if len(relayServers) > 0 {
-		c.hasPeerRelayServers.Store(true)
-	} else {
-		c.hasPeerRelayServers.Store(false)
-	}
 }
 
 // nodeHasCap returns true if src has cap on dst, otherwise it returns false.
@@ -2948,6 +2965,11 @@ func nodeHasCap(filt *filter.Filter, src, dst tailcfg.NodeView, cap tailcfg.Peer
 		!dst.Valid() {
 		return false
 	}
+	if src.UnsignedPeerAPIOnly() {
+		// Unsigned peers aren't covered by tailnet lock and must never hold
+		// peer capabilities such as relay allocation/target.
+		return false
+	}
 	for _, srcPrefix := range src.Addresses().All() {
 		if !srcPrefix.IsSingleIP() {
 			continue
@@ -2985,58 +3007,105 @@ func (c *candidatePeerRelay) isValid() bool {
 	return !c.nodeKey.IsZero() && !c.discoKey.IsZero()
 }
 
-// SetNetworkMap updates the network map with the given self node and peers.
-// It must be called synchronously from the caller's goroutine to ensure
-// magicsock has the current state before subsequent operations proceed.
+// SetNetworkMap updates the network map with the given self node and peers
+// reported by the control plane (rather than cached).  It must be called
+// synchronously from the caller's goroutine to ensure magicsock has the
+// current state before subsequent operations proceed.
 //
 // self may be invalid if there's no network map.
+//
+// SetNetworkMap takes the full peer list and walks all of it. For incremental
+// updates where only a single peer changes, prefer the O(1) [Conn.UpsertPeer]
+// and [Conn.RemovePeer] methods. SetNetworkMap remains the right call for the
+// initial netmap and for changes to self or to global state (filter, DERP,
+// etc.) that aren't covered by the per-peer methods.
 func (c *Conn) SetNetworkMap(self tailcfg.NodeView, peers []tailcfg.NodeView) {
-	peersChanged := c.updateNodes(self, peers)
+	c.setNetworkMapInternal(self, peers, false)
+}
+
+// SetNetworkMapCached behaves as SetNetworkMap, but indicates to c that the
+// data provided are from a cache rather than the control plane. The same
+// constraints otherwise apply.
+func (c *Conn) SetNetworkMapCached(self tailcfg.NodeView, peers []tailcfg.NodeView) {
+	c.setNetworkMapInternal(self, peers, true)
+}
+
+// setNetworkMapInternal is the shared implementation of SetNetworkMap and SetNetworkMapCached.
+func (c *Conn) setNetworkMapInternal(self tailcfg.NodeView, peers []tailcfg.NodeView, isCached bool) {
+	peersChanged, selfWasValid := c.updateNodes(self, peers)
 
 	relayClientEnabled := self.Valid() &&
 		!self.HasCap(tailcfg.NodeAttrDisableRelayClient) &&
 		!self.HasCap(tailcfg.NodeAttrOnlyTCP443)
 
+	udpOffloadKnobsChanged := false
+	var curGRO, curGSO bool
 	c.mu.Lock()
 	relayClientChanged := c.relayClientEnabled != relayClientEnabled
 	c.relayClientEnabled = relayClientEnabled
 	filt := c.filt
 	selfView := c.self
-	peersView := c.peers
+	peersSnap := c.peerSnapshotLocked()
 	isClosed := c.closed
+	c.usingCachedNetmap.Store(isCached)
+	if !self.Valid() {
+		c.initializedAt = mono.Now() // the netmap is being reset
+	}
+	initializedAt := c.initializedAt
+	if runtime.GOOS == "linux" && c.controlKnobs != nil {
+		curGRO = c.controlKnobs.DisableUDPGRO.Load()
+		curGSO = c.controlKnobs.DisableUDPGSO.Load()
+		if curGRO != c.appliedDisableUDPGRO || curGSO != c.appliedDisableUDPGSO {
+			c.appliedDisableUDPGRO = curGRO
+			c.appliedDisableUDPGSO = curGSO
+			udpOffloadKnobsChanged = true
+		}
+	}
 	c.mu.Unlock() // release c.mu before potentially calling c.updateRelayServersSet which is O(m * n)
 
 	if isClosed {
 		return // nothing to do here, the conn is closed and the update is no longer relevant
 	}
+	if self.Valid() && !selfWasValid {
+		// Reaching here, we have our first "real" netmap (self is valid, and
+		// the previous netmap was unset or reset), so record the latency from reset.
+		c.logf("magicsock: new contact: control-netmap usec=%d cached=%v",
+			int64(mono.Since(initializedAt)/time.Microsecond), isCached)
+	}
+
+	if udpOffloadKnobsChanged {
+		// A control-plane node attribute toggled UDP GRO or UDP GSO. Rebind
+		// the UDP sockets so tryEnableUDPOffload re-runs and applies the new
+		// values, then ReSTUN to refresh endpoints.
+		c.logf("magicsock: UDP offload knobs changed (DisableUDPGRO=%v DisableUDPGSO=%v); rebinding",
+			curGRO, curGSO)
+		c.Rebind()
+		go c.ReSTUN("udp-offload-knobs-changed")
+	}
 
 	if peersChanged || relayClientChanged {
 		if !relayClientEnabled {
+			// [relayManager]'s run loop updates [relayManager.hasPeerRelayServers].
 			c.relayManager.handleRelayServersSet(nil)
-			c.hasPeerRelayServers.Store(false)
 		} else {
-			c.updateRelayServersSet(filt, selfView, peersView)
+			c.updateRelayServersSet(filt, selfView, peersSnap)
 		}
 	}
 }
 
 // updateNodes updates [Conn] to reflect the given self node and peers.
-// It reports whether the peers were changed from before.
-func (c *Conn) updateNodes(self tailcfg.NodeView, peers []tailcfg.NodeView) (peersChanged bool) {
+// It reports whether the peer set (membership or any field) changed,
+// and whether the previous self node was valid.
+func (c *Conn) updateNodes(self tailcfg.NodeView, peers []tailcfg.NodeView) (peersChanged, wasValid bool) {
 	c.mu.Lock()
 	defer c.mu.Unlock()
-
 	if c.closed {
-		return false
+		return false, false
 	}
 
-	priorPeers := c.peers
 	metricNumPeers.Set(int64(len(peers)))
-
-	// Update c.self & c.peers regardless, before the following early return.
+	selfWasValid := c.self.Valid()
 	c.self = self
-	curPeers := views.SliceOf(peers)
-	c.peers = curPeers
 
 	// [debugFlags] are mutable in [Conn.SetSilentDisco] &
 	// [Conn.SetProbeUDPLifetime]. These setters are passed [controlknobs.Knobs]
@@ -3049,137 +3118,57 @@ func (c *Conn) updateNodes(self tailcfg.NodeView, peers []tailcfg.NodeView) (pee
 	// TODO: mutate [debugFlags] here instead of in various [Conn] setters.
 	flags := c.debugFlagsLocked()
 
-	peersChanged = !nodesEqual(priorPeers, curPeers)
-	if !peersChanged && c.lastFlags == flags {
-		// The rest of this function is all adjusting state for peers that have
-		// changed. But if the set of peers is equal and the debug flags (for
-		// silent disco and probe UDP lifetime) haven't changed, there is no
-		// need to do anything else.
-		return
+	// Fast path: if the peer set and every peer's NodeView are unchanged,
+	// and flags are unchanged, skip all further work.
+	if c.lastFlags == flags && len(peers) == len(c.peersByID) {
+		allSame := true
+		for _, n := range peers {
+			if prev, ok := c.peersByID[n.ID()]; !ok || !prev.Equal(n) {
+				allSame = false
+				break
+			}
+		}
+		if allSame {
+			return false, selfWasValid
+		}
 	}
 
 	c.lastFlags = flags
-
 	c.logf("[v1] magicsock: got updated network map; %d peers", len(peers))
 
 	entriesPerBuffer := debugRingBufferSize(len(peers))
 
-	// Try a pass of just upserting nodes and creating missing
-	// endpoints. If the set of nodes is the same, this is an
-	// efficient alloc-free update. If the set of nodes is different,
-	// we'll fall through to the next pass, which allocates but can
-	// handle full set updates.
+	// Build the new peer map while upserting each peer.
+	newPeers := make(map[tailcfg.NodeID]tailcfg.NodeView, len(peers))
 	for _, n := range peers {
-		if n.ID() == 0 {
-			devPanicf("node with zero ID")
-			continue
+		newPeers[n.ID()] = n
+		c.upsertPeerLocked(n, flags, entriesPerBuffer)
+	}
+	if len(newPeers) != len(peers) {
+		// Duplicate NodeIDs in the input shouldn't happen, but log if so.
+		c.logf("[unexpected] magicsock.updateNodes: %d peers input but %d unique IDs", len(peers), len(newPeers))
+	}
+	// Clean up node-key-keyed state for peers that are gone or have
+	// rotated their node key.
+	for id, prev := range c.peersByID {
+		if n, ok := newPeers[id]; !ok || n.Key() != prev.Key() {
+			delete(c.derpRoute, prev.Key())
+			delete(c.peerLastDerp, prev.Key())
 		}
-		if n.Key().IsZero() {
-			devPanicf("node with zero key")
-			continue
-		}
-		ep, ok := c.peerMap.endpointForNodeID(n.ID())
-		if ok && ep.publicKey != n.Key() {
-			// The node rotated public keys. Delete the old endpoint and create
-			// it anew.
-			c.peerMap.deleteEndpoint(ep)
-			ok = false
-		}
-		if ok {
-			// At this point we're modifying an existing endpoint (ep) whose
-			// public key and nodeID match n. Its other fields (such as disco
-			// key or endpoints) might've changed.
-
-			if n.DiscoKey().IsZero() && !n.IsWireGuardOnly() {
-				// Discokey transitioned from non-zero to zero? This should not
-				// happen in the wild, however it could mean:
-				// 1. A node was downgraded from post 0.100 to pre 0.100.
-				// 2. A Tailscale node key was extracted and used on a
-				//    non-Tailscale node (should not enter here due to the
-				//    IsWireGuardOnly check)
-				// 3. The server is misbehaving.
-				c.peerMap.deleteEndpoint(ep)
-				continue
-			}
-			var oldDiscoKey key.DiscoPublic
-			if epDisco := ep.disco.Load(); epDisco != nil {
-				oldDiscoKey = epDisco.key
-			}
-			ep.updateFromNode(n, flags.heartbeatDisabled, flags.probeUDPLifetimeOn)
-			c.peerMap.upsertEndpoint(ep, oldDiscoKey) // maybe update discokey mappings in peerMap
-			continue
-		}
-
-		if ep, ok := c.peerMap.endpointForNodeKey(n.Key()); ok {
-			// At this point n.Key() should be for a key we've never seen before. If
-			// ok was true above, it was an update to an existing matching key and
-			// we don't get this far. If ok was false above, that means it's a key
-			// that differs from the one the NodeID had. But double check.
-			if ep.nodeID != n.ID() {
-				// Server error. This is known to be a particular issue for Mullvad
-				// nodes (http://go/corp/27300), so log a distinct error for the
-				// Mullvad and non-Mullvad cases. The error will be logged either way,
-				// so an approximate heuristic is fine.
-				//
-				// When #27300 is fixed, we can delete this branch and log the same
-				// panic for any public key moving.
-				if strings.HasSuffix(n.Name(), ".mullvad.ts.net.") {
-					devPanicf("public key moved between Mullvad nodeIDs (old=%v new=%v, key=%s); see http://go/corp/27300", ep.nodeID, n.ID(), n.Key().String())
-				} else {
-					devPanicf("public key moved between nodeIDs (old=%v new=%v, key=%s)", ep.nodeID, n.ID(), n.Key().String())
-				}
-			} else {
-				// Internal data structures out of sync.
-				devPanicf("public key found in peerMap but not by nodeID")
-			}
-			continue
-		}
-		if n.DiscoKey().IsZero() && !n.IsWireGuardOnly() {
-			// Ancient pre-0.100 node, which does not have a disco key.
-			// No longer supported.
-			continue
-		}
-
-		ep = &endpoint{
-			c:                 c,
-			nodeID:            n.ID(),
-			publicKey:         n.Key(),
-			publicKeyHex:      n.Key().UntypedHexString(),
-			sentPing:          map[stun.TxID]sentPing{},
-			endpointState:     map[netip.AddrPort]*endpointState{},
-			heartbeatDisabled: flags.heartbeatDisabled,
-			isWireguardOnly:   n.IsWireGuardOnly(),
-		}
-		switch runtime.GOOS {
-		case "ios", "android":
-			// Omit, to save memory. Prior to 2024-03-20 we used to limit it to
-			// ~1MB on mobile but we never used the data so the memory was just
-			// wasted.
-		default:
-			ep.debugUpdates = ringlog.New[EndpointChange](entriesPerBuffer)
-		}
-		if n.Addresses().Len() > 0 {
-			ep.nodeAddr = n.Addresses().At(0).Addr()
-		}
-		ep.initFakeUDPAddr()
-		ep.updateDiscoKey(n.DiscoKey())
-
-		if debugPeerMap() {
-			c.logEndpointCreated(n)
-		}
-
-		ep.updateFromNode(n, flags.heartbeatDisabled, flags.probeUDPLifetimeOn)
-		c.peerMap.upsertEndpoint(ep, key.DiscoPublic{})
+	}
+	hadPeers := len(c.peersByID) > 0
+	c.peersByID = newPeers
+	// A key-less conn can't STUN; the ReSTUN("set-private-key") on
+	// first key covers peers that arrived before the key.
+	if !hadPeers && len(newPeers) > 0 && !c.privateKey.IsZero() {
+		go c.ReSTUN("non-zero-peers")
 	}
 
-	// If the set of nodes changed since the last SetNetworkMap, the
-	// upsert loop just above made c.peerMap contain the union of the
-	// old and new peers - which will be larger than the set from the
-	// current netmap. If that happens, go through the allocful
-	// deletion path to clean up moribund nodes.
-	if c.peerMap.nodeCount() != len(peers) {
+	// If the upsert pass left stale endpoints in peerMap (peers removed
+	// relative to before), clean them up.
+	if c.peerMap.nodeCount() != len(newPeers) {
 		keep := set.Set[key.NodePublic]{}
-		for _, n := range peers {
+		for _, n := range newPeers {
 			keep.Add(n.Key())
 		}
 		c.peerMap.forEachEndpoint(func(ep *endpoint) {
@@ -3189,14 +3178,237 @@ func (c *Conn) updateNodes(self tailcfg.NodeView, peers []tailcfg.NodeView) (pee
 		})
 	}
 
-	// discokeys might have changed in the above. Discard unused info.
+	// discokeys might have changed above. Discard unused info.
 	for dk := range c.discoInfo {
 		if !c.peerMap.knownPeerDiscoKey(dk) {
 			delete(c.discoInfo, dk)
 		}
 	}
 
-	return peersChanged
+	return true, selfWasValid
+}
+
+// upsertPeerLocked upserts a single peer's endpoint in c.peerMap. It is the
+// per-peer body shared by [Conn.SetNetworkMap]'s upsert pass and by the
+// efficient per-peer [Conn.UpsertPeer] path.
+//
+// c.mu must be held.
+func (c *Conn) upsertPeerLocked(n tailcfg.NodeView, flags debugFlags, entriesPerBuffer int) {
+	if n.ID() == 0 {
+		devPanicf("node with zero ID")
+		return
+	}
+	if n.Key().IsZero() {
+		devPanicf("node with zero key")
+		return
+	}
+	ep, ok := c.peerMap.endpointForNodeID(n.ID())
+	if ok && ep.publicKey != n.Key() {
+		// The node rotated public keys. Delete the old endpoint and create
+		// it anew.
+		c.peerMap.deleteEndpoint(ep)
+		ok = false
+	}
+	if ok {
+		// At this point we're modifying an existing endpoint (ep) whose
+		// public key and nodeID match n. Its other fields (such as disco
+		// key or endpoints) might've changed.
+
+		if n.DiscoKey().IsZero() && !n.IsWireGuardOnly() {
+			// Discokey transitioned from non-zero to zero? This should not
+			// happen in the wild, however it could mean:
+			// 1. A node was downgraded from post 0.100 to pre 0.100.
+			// 2. A Tailscale node key was extracted and used on a
+			//    non-Tailscale node (should not enter here due to the
+			//    IsWireGuardOnly check)
+			// 3. The server is misbehaving.
+			c.peerMap.deleteEndpoint(ep)
+			return
+		}
+		var oldDiscoKey key.DiscoPublic
+		if epDisco := ep.disco.Load(); epDisco != nil {
+			oldDiscoKey = epDisco.key
+		}
+		ep.updateFromNode(n, flags.heartbeatDisabled, flags.probeUDPLifetimeOn)
+		c.peerMap.upsertEndpoint(ep, oldDiscoKey) // maybe update discokey mappings in peerMap
+		return
+	}
+
+	if ep, ok := c.peerMap.endpointForNodeKey(n.Key()); ok {
+		// At this point n.Key() should be for a key we've never seen before. If
+		// ok was true above, it was an update to an existing matching key and
+		// we don't get this far. If ok was false above, that means it's a key
+		// that differs from the one the NodeID had. But double check.
+		if ep.nodeID != n.ID() {
+			// Server error. This is known to be a particular issue for Mullvad
+			// nodes (http://go/corp/27300), so log a distinct error for the
+			// Mullvad and non-Mullvad cases. The error will be logged either way,
+			// so an approximate heuristic is fine.
+			//
+			// When #27300 is fixed, we can delete this branch and log the same
+			// panic for any public key moving.
+			if strings.HasSuffix(n.Name(), ".mullvad.ts.net.") {
+				devPanicf("public key moved between Mullvad nodeIDs (old=%v new=%v, key=%s); see http://go/corp/27300", ep.nodeID, n.ID(), n.Key().String())
+			} else {
+				devPanicf("public key moved between nodeIDs (old=%v new=%v, key=%s)", ep.nodeID, n.ID(), n.Key().String())
+			}
+		} else {
+			// Internal data structures out of sync.
+			devPanicf("public key found in peerMap but not by nodeID")
+		}
+		return
+	}
+	if n.DiscoKey().IsZero() && !n.IsWireGuardOnly() {
+		// Ancient pre-0.100 node, which does not have a disco key.
+		// No longer supported.
+		return
+	}
+
+	ep = &endpoint{
+		c:                 c,
+		nodeID:            n.ID(),
+		publicKey:         n.Key(),
+		publicKeyHex:      n.Key().UntypedHexString(),
+		sentPing:          map[stun.TxID]sentPing{},
+		endpointState:     map[netip.AddrPort]*endpointState{},
+		heartbeatDisabled: flags.heartbeatDisabled,
+		isWireguardOnly:   n.IsWireGuardOnly(),
+	}
+	switch runtime.GOOS {
+	case "ios", "android":
+		// Omit, to save memory. Prior to 2024-03-20 we used to limit it to
+		// ~1MB on mobile but we never used the data so the memory was just
+		// wasted.
+	default:
+		ep.debugUpdates = ringlog.New[EndpointChange](entriesPerBuffer)
+	}
+	if n.Addresses().Len() > 0 {
+		ep.nodeAddr = n.Addresses().At(0).Addr()
+	}
+	ep.initFakeUDPAddr()
+	ep.updateDiscoKey(n.DiscoKey())
+
+	if debugPeerMap() {
+		c.logEndpointCreated(n)
+	}
+
+	ep.updateFromNode(n, flags.heartbeatDisabled, flags.probeUDPLifetimeOn)
+	c.peerMap.upsertEndpoint(ep, key.DiscoPublic{})
+}
+
+// UpsertPeer adds or updates a single peer in c. It is the efficient
+// O(1)-per-peer alternative to [Conn.SetNetworkMap] when a single peer was
+// added or its fields changed. The caller is responsible for serializing
+// UpsertPeer/RemovePeer/SetNetworkMap calls relative to one another.
+//
+// UpsertPeer updates the relay-server set incrementally (O(1)) when the
+// upserted peer's relay candidacy changed, rather than rebuilding the
+// whole set with [Conn.updateRelayServersSet].
+func (c *Conn) UpsertPeer(n tailcfg.NodeView) {
+	c.mu.Lock()
+	if c.closed {
+		c.mu.Unlock()
+		return
+	}
+	if n.ID() == 0 {
+		c.mu.Unlock()
+		devPanicf("UpsertPeer: node with zero ID")
+		return
+	}
+	flags := c.debugFlagsLocked()
+	if prev, ok := c.peersByID[n.ID()]; ok && prev.Key() != n.Key() {
+		delete(c.derpRoute, prev.Key())
+		delete(c.peerLastDerp, prev.Key())
+	}
+	hadPeers := len(c.peersByID) > 0
+	mak.Set(&c.peersByID, n.ID(), n)
+	// See the matching trigger in updateNodes for why the key check.
+	if !hadPeers && !c.privateKey.IsZero() {
+		go c.ReSTUN("non-zero-peers")
+	}
+	c.upsertPeerLocked(n, flags, debugRingBufferSize(len(c.peersByID)))
+
+	var relayUpsert candidatePeerRelay
+	relayQualifies := false
+	if c.relayClientEnabled {
+		relayQualifies, relayUpsert = c.relayCandidateLocked(n)
+	}
+	relayClientEnabled := c.relayClientEnabled
+	c.mu.Unlock()
+
+	if relayClientEnabled {
+		if relayQualifies {
+			c.relayManager.handleRelayServerUpsert(relayUpsert)
+		} else {
+			// The peer may have previously qualified; remove covers that
+			// case and is a no-op otherwise.
+			c.relayManager.handleRelayServerRemove(n.Key())
+		}
+	}
+}
+
+// RemovePeer removes a single peer from c. It is the efficient
+// O(1)-per-peer alternative to [Conn.SetNetworkMap] when a single peer was
+// removed. The caller is responsible for serializing UpsertPeer/RemovePeer/
+// SetNetworkMap calls relative to one another.
+func (c *Conn) RemovePeer(nid tailcfg.NodeID) {
+	c.mu.Lock()
+	if c.closed {
+		c.mu.Unlock()
+		return
+	}
+	prev, ok := c.peersByID[nid]
+	if !ok {
+		c.mu.Unlock()
+		return
+	}
+	delete(c.peersByID, nid)
+	delete(c.derpRoute, prev.Key())
+	delete(c.peerLastDerp, prev.Key())
+	if ep, ok := c.peerMap.endpointForNodeID(nid); ok {
+		c.peerMap.deleteEndpoint(ep)
+	}
+
+	// If the peer we just removed held the only reference to its disco
+	// key, drop the now-orphaned c.discoInfo entry. No need to scan the
+	// whole map — only this peer's disco key can have become unreferenced
+	// by this single removal.
+	if dk := prev.DiscoKey(); !dk.IsZero() && !c.peerMap.knownPeerDiscoKey(dk) {
+		delete(c.discoInfo, dk)
+	}
+
+	relayClientEnabled := c.relayClientEnabled
+	c.mu.Unlock()
+
+	if relayClientEnabled {
+		// Tell the relay manager to drop the peer. The run loop no-ops
+		// this if the peer wasn't a relay server.
+		c.relayManager.handleRelayServerRemove(prev.Key())
+	}
+}
+
+// relayCandidateLocked reports whether peer p is eligible to be a relay
+// server candidate for self, and if so returns the [candidatePeerRelay]
+// that would be added to the relay-server set. c.mu must be held.
+//
+// It mirrors the per-peer predicate in [Conn.updateRelayServersSet].
+func (c *Conn) relayCandidateLocked(p tailcfg.NodeView) (ok bool, cp candidatePeerRelay) {
+	if !p.Valid() {
+		return false, candidatePeerRelay{}
+	}
+	// The cap-version gate in updateRelayServersSet only applies to peers
+	// (not self). This helper is only called for peers, so always check.
+	if !capVerIsRelayCapable(p.Cap()) {
+		return false, candidatePeerRelay{}
+	}
+	if !nodeHasCap(c.filt, p, c.self, tailcfg.PeerCapabilityRelayTarget) {
+		return false, candidatePeerRelay{}
+	}
+	return true, candidatePeerRelay{
+		nodeKey:          p.Key(),
+		discoKey:         p.DiscoKey(),
+		derpHomeRegionID: uint16(p.HomeDERP()),
+	}
 }
 
 func devPanicf(format string, a ...any) {
@@ -3422,7 +3634,7 @@ func (c *Conn) shouldDoPeriodicReSTUNLocked() bool {
 	if c.networkDown() || c.homeless {
 		return false
 	}
-	if len(c.peerSet) == 0 || c.privateKey.IsZero() {
+	if len(c.peersByID) == 0 || c.privateKey.IsZero() {
 		// If no peers, not worth doing.
 		// Also don't if there's no key (not running).
 		return false
@@ -3517,13 +3729,13 @@ func (c *Conn) bindSocket(ruc *RebindingUDPConn, network string, curPortFate cur
 	defer ruc.mu.Unlock()
 
 	if runtime.GOOS == "js" {
-		ruc.setConnLocked(newBlockForeverConn(), "", c.bind.BatchSize())
+		ruc.setConnLocked(newBlockForeverConn(), "", c.bind.BatchSize(), c.controlKnobs)
 		return nil
 	}
 
 	if debugAlwaysDERP() {
 		c.logf("disabled %v per TS_DEBUG_ALWAYS_USE_DERP", network)
-		ruc.setConnLocked(newBlockForeverConn(), "", c.bind.BatchSize())
+		ruc.setConnLocked(newBlockForeverConn(), "", c.bind.BatchSize(), c.controlKnobs)
 		return nil
 	}
 
@@ -3582,7 +3794,7 @@ func (c *Conn) bindSocket(ruc *RebindingUDPConn, network string, curPortFate cur
 		if debugBindSocket() {
 			c.logf("magicsock: bindSocket: successfully listened %v port %d", network, port)
 		}
-		ruc.setConnLocked(pconn, network, c.bind.BatchSize())
+		ruc.setConnLocked(pconn, network, c.bind.BatchSize(), c.controlKnobs)
 		if network == "udp4" {
 			c.health.SetUDP4Unbound(false)
 		}
@@ -3593,7 +3805,7 @@ func (c *Conn) bindSocket(ruc *RebindingUDPConn, network string, curPortFate cur
 	// Set pconn to a dummy conn whose reads block until closed.
 	// This keeps the receive funcs alive for a future in which
 	// we get a link change and we can try binding again.
-	ruc.setConnLocked(newBlockForeverConn(), "", c.bind.BatchSize())
+	ruc.setConnLocked(newBlockForeverConn(), "", c.bind.BatchSize(), c.controlKnobs)
 	if network == "udp4" {
 		c.health.SetUDP4Unbound(true)
 	}
@@ -3737,6 +3949,10 @@ func (c *Conn) UpdateNetmapDelta(muts []netmap.NodeMutation) {
 			ep.mu.Unlock()
 		}
 	}
+
+	// As of 2026-06-11 we will only get deltas from the control plane, so upon
+	// receiving one we should infer we have switched out of the cached state.
+	c.usingCachedNetmap.Store(false)
 }
 
 // UpdateStatus implements the interface needed by ipnstate.StatusBuilder.
@@ -3841,18 +4057,18 @@ const (
 var (
 	// pingTimeoutDuration is how long we wait for a pong reply before
 	// assuming it's never coming.
-	pingTimeoutDuration = 5 * time.Second
+	pingTimeoutDuration = tsconst.DefaultPingTimeout
 
 	// discoPingInterval is the minimum time between pings
 	// to an endpoint. (Except in the case of CallMeMaybe frames
 	// resetting the counter, as the first pings likely didn't through
 	// the firewall)
-	discoPingInterval = 5 * time.Second
+	discoPingInterval = tsconst.DefaultPingInterval
 
 	// wireguardPingInterval is the minimum time between pings to an endpoint.
 	// Pings are only sent if we have not observed bidirectional traffic with an
 	// endpoint in at least this duration.
-	wireguardPingInterval = 5 * time.Second
+	wireguardPingInterval = tsconst.DefaultPingInterval
 )
 
 // indexSentinelDeleted is the temporary value that endpointState.index takes while
@@ -4109,6 +4325,10 @@ var (
 	metricTSMPDiscoKeyAdvertisementReceived  = clientmetric.NewCounter("magicsock_tsmp_disco_key_advertisement_received")
 	metricTSMPDiscoKeyAdvertisementApplied   = clientmetric.NewCounter("magicsock_tsmp_disco_key_advertisement_applied")
 	metricTSMPDiscoKeyAdvertisementUnchanged = clientmetric.NewCounter("magicsock_tsmp_disco_key_advertisement_unchanged")
+
+	// Counters for peer contacts established using cached network map data.
+	metricCachedPeerContactDERP   = clientmetric.NewCounter("magicsock_cached_peer_contact_derp")
+	metricCachedPeerContactDirect = clientmetric.NewCounter("magicsock_cached_peer_contact_direct")
 )
 
 // newUDPLifetimeCounter returns a new *clientmetric.Metric with the provided
@@ -4133,10 +4353,35 @@ func (c *Conn) GetLastNetcheckReport(ctx context.Context) *netcheck.Report {
 	return c.lastNetCheckReport.Load()
 }
 
-// SetLastNetcheckReportForTest sets the magicsock conn's last netcheck report.
-// Used for testing purposes.
-func (c *Conn) SetLastNetcheckReportForTest(ctx context.Context, report *netcheck.Report) {
-	c.lastNetCheckReport.Store(report)
+// AddNetcheckReportForTest records report in the conn's netcheck client's
+// recent-report history as if it had been produced at time now, seeding the
+// netcheck client's per-region latency history. If report is newer than the
+// currently stored last netcheck report, it also becomes the last netcheck
+// report.
+func (c *Conn) AddNetcheckReportForTest(dm *tailcfg.DERPMap, report *netcheck.Report, now time.Time) {
+	testenv.AssertInTest()
+	rep := report.Clone() // netchecker mutates the report, so create a copy
+	c.netChecker.AddReportHistoryForTest(dm, rep, now)
+	for {
+		if cur := c.lastNetCheckReport.Load(); cur == nil || rep.Now.After(cur.Now) {
+			if c.lastNetCheckReport.CompareAndSwap(cur, rep) {
+				break
+			}
+		}
+	}
+}
+
+// GetDERPRegionLatency returns the lowest latency seen per DERP region over
+// netcheck's recent history, keyed by region ID. Unlike the most recent report
+// from GetLastNetcheckReport (which for an incremental netcheck covers only a
+// few regions), netcheck's history retains every region measured by the most
+// recent full netcheck, so this can rank regions the latest report did not
+// re-probe. It returns nil if the netcheck client is not yet initialized.
+func (c *Conn) GetDERPRegionLatency() map[int]time.Duration {
+	if c.netChecker == nil {
+		return nil
+	}
+	return c.netChecker.RecentRegionLatency()
 }
 
 // lazyEndpoint is a wireguard [conn.Endpoint] for when magicsock received a
@@ -4166,16 +4411,10 @@ var _ conn.Endpoint = (*lazyEndpoint)(nil)
 
 // InitiationMessagePublicKey implements [conn.InitiationAwareEndpoint].
 // wireguard-go calls us here if we passed it a [*lazyEndpoint] for an
-// initiation message, for which it might not have the relevant peer configured,
-// enabling us to just-in-time configure it and note its activity via
-// [*endpoint.noteRecvActivity], before it performs peer lookup and attempts
-// decryption.
+// initiation message, for which it might not have the relevant peer configured.
+// Wireguard-go's PeerLookupFunc handles on-demand peer creation.
 //
-// Reception of all other WireGuard message types implies pre-existing knowledge
-// of the peer by wireguard-go for it to do useful work. See
-// [userspaceEngine.maybeReconfigWireguardLocked] &
-// [userspaceEngine.noteRecvActivity] for more details around just-in-time
-// wireguard-go peer (de)configuration.
+// We still update endpoint activity tracking for bestAddr management.
 func (le *lazyEndpoint) InitiationMessagePublicKey(peerPublicKey [32]byte) {
 	pubKey := key.NodePublicFromRaw32(mem.B(peerPublicKey[:]))
 	if le.maybeEP != nil && pubKey.Compare(le.maybeEP.publicKey) == 0 {
@@ -4183,9 +4422,6 @@ func (le *lazyEndpoint) InitiationMessagePublicKey(peerPublicKey [32]byte) {
 	}
 	le.c.mu.Lock()
 	ep, ok := le.c.peerMap.endpointForNodeKey(pubKey)
-	// [Conn.mu] must not be held while [Conn.noteRecvActivity] is called, which
-	// [endpoint.noteRecvActivity] can end up calling. See
-	// [Options.NoteRecvActivity] docs.
 	le.c.mu.Unlock()
 	if !ok {
 		return
@@ -4193,11 +4429,6 @@ func (le *lazyEndpoint) InitiationMessagePublicKey(peerPublicKey [32]byte) {
 	now := mono.Now()
 	ep.lastRecvUDPAny.StoreAtomic(now)
 	ep.noteRecvActivity(le.src, now)
-	// [ep.noteRecvActivity] may end up JIT configuring the peer, but we don't
-	// update [peerMap] as wireguard-go hasn't decrypted the initiation
-	// message yet. wireguard-go will call us below in [lazyEndpoint.FromPeer]
-	// if it successfully decrypts the message, at which point it's safe to
-	// insert le.src into the [peerMap] for ep.
 }
 
 func (le *lazyEndpoint) ClearSrc()         {}
@@ -4275,6 +4506,11 @@ func (c *Conn) PeerRelays() set.Set[netip.Addr] {
 // node is the Tailscale tailcfg.NodeView of the peer that sent the update.
 func (c *Conn) HandleDiscoKeyAdvertisement(node tailcfg.NodeView, update packet.TSMPDiscoKeyAdvertisement) {
 	discoKey := update.Key
+	if discoKey.IsZero() {
+		c.logf("[v1] magicsock: received zero disco key update from %v", node.StableID())
+		return
+	}
+
 	c.logf("magicsock: received disco key update %v from %v", discoKey.ShortString(), node.StableID())
 	metricTSMPDiscoKeyAdvertisementReceived.Add(1)
 
@@ -4301,6 +4537,9 @@ func (c *Conn) HandleDiscoKeyAdvertisement(node tailcfg.NodeView, update packet.
 	c.discoInfoForKnownPeerLocked(discoKey)
 	ep.updateDiscoKey(discoKey)
 	c.peerMap.upsertEndpoint(ep, oldDiscoKey)
+	if !oldDiscoKey.IsZero() && !c.peerMap.knownPeerDiscoKey(oldDiscoKey) {
+		delete(c.discoInfo, oldDiscoKey)
+	}
 	c.logf("magicsock: updated disco key for peer %v to %v", nodeKey.ShortString(), discoKey.ShortString())
 	metricTSMPDiscoKeyAdvertisementApplied.Add(1)
 }
@@ -4328,11 +4567,10 @@ type NewDiscoKeyAvailable struct {
 
 // maybeSendTSMPDiscoAdvert conditionally emits an event indicating that we
 // should send our DiscoKey to the first node address of the magicksock endpoint.
-// The event is only emitted if we have not yet contacted that endpoint since
-// the DiscoKey changed.
 //
-// This condition is most likely met only once per endpoint, after the start of
-// tailscaled, but not until we contact the endpoint for the first time.
+// The event is suppressed if we are communicating over a non-DERP path, or
+// less than [discoKeyAdvertisementInterval] has passed since the last DiscoKey
+// was sent, or netmap caching is disabled on this node.
 //
 // We do not need the Conn to be locked, but the endpoint should be.
 func (c *Conn) maybeSendTSMPDiscoAdvert(de *endpoint) {
@@ -4340,13 +4578,33 @@ func (c *Conn) maybeSendTSMPDiscoAdvert(de *endpoint) {
 		return
 	}
 
+	// Disable TSMP disco advert by default, unless network map caching is
+	// enabled for the local node. Caching network maps on the remote node is
+	// what really matters in terms of handling a TSMP disco advert and applying
+	// it in a useful way, but the TSMP disco advert implementation as it exists
+	// here has pathological behaviors. Therefore, it should be disabled for
+	// almost all tailnets, and we lean on the network map caching control knob
+	// for this purpose. See #20081.
+	if c.controlKnobs == nil || !c.controlKnobs.CacheNetworkMaps.Load() {
+		return
+	}
+
 	de.mu.Lock()
 	defer de.mu.Unlock()
-	if mono.Now().Sub(de.lastDiscoKeyAdvertisement) > discoKeyAdvertisementInterval {
-		de.lastDiscoKeyAdvertisement = mono.Now()
-		c.tsmpDiscoKeyAvailablePub.Publish(NewDiscoKeyAvailable{
-			NodeFirstAddr: de.nodeAddr,
-			NodeID:        de.nodeID,
-		})
+
+	if !de.nodeAddr.IsValid() {
+		return
 	}
+
+	now := mono.Now()
+	if now.Sub(de.lastDiscoKeyAdvertisement) <= discoKeyAdvertisementInterval ||
+		(!de.lastDiscoKeyAdvertisement.IsZero() && !de.bestAddr.isZero()) {
+		return
+	}
+
+	de.lastDiscoKeyAdvertisement = now
+	c.tsmpDiscoKeyAvailablePub.Publish(NewDiscoKeyAvailable{
+		NodeFirstAddr: de.nodeAddr,
+		NodeID:        de.nodeID,
+	})
 }
diff --git a/wgengine/magicsock/magicsock_test.go b/wgengine/magicsock/magicsock_test.go
index b7492b867..488c2e5f7 100644
--- a/wgengine/magicsock/magicsock_test.go
+++ b/wgengine/magicsock/magicsock_test.go
@@ -21,6 +21,7 @@ import (
 	"os"
 	"reflect"
 	"runtime"
+	"slices"
 	"strconv"
 	"strings"
 	"sync"
@@ -39,7 +40,9 @@ import (
 	"go4.org/mem"
 	"golang.org/x/net/icmp"
 	"golang.org/x/net/ipv4"
-	"tailscale.com/cmd/testwrapper/flakytest"
+	extwgconn "golang.zx2c4.com/wireguard/conn"
+	extwgdevice "golang.zx2c4.com/wireguard/device"
+	extwgtest "golang.zx2c4.com/wireguard/tun/tuntest"
 	"tailscale.com/control/controlknobs"
 	"tailscale.com/derp/derpserver"
 	"tailscale.com/disco"
@@ -51,8 +54,10 @@ import (
 	"tailscale.com/net/netmon"
 	"tailscale.com/net/packet"
 	"tailscale.com/net/ping"
+	"tailscale.com/net/routemanager"
 	"tailscale.com/net/stun"
 	"tailscale.com/net/stun/stuntest"
+	"tailscale.com/net/tsaddr"
 	"tailscale.com/net/tstun"
 	"tailscale.com/tailcfg"
 	"tailscale.com/tstest"
@@ -63,11 +68,11 @@ import (
 	"tailscale.com/types/netlogtype"
 	"tailscale.com/types/netmap"
 	"tailscale.com/types/nettype"
-	"tailscale.com/types/views"
 	"tailscale.com/util/cibuild"
 	"tailscale.com/util/clientmetric"
 	"tailscale.com/util/eventbus"
 	"tailscale.com/util/eventbus/eventbustest"
+	"tailscale.com/util/mak"
 	"tailscale.com/util/must"
 	"tailscale.com/util/racebuild"
 	"tailscale.com/util/set"
@@ -76,7 +81,6 @@ import (
 	"tailscale.com/wgengine/filter"
 	"tailscale.com/wgengine/filter/filtertype"
 	"tailscale.com/wgengine/wgcfg"
-	"tailscale.com/wgengine/wgcfg/nmcfg"
 	"tailscale.com/wgengine/wglog"
 )
 
@@ -215,7 +219,7 @@ func newMagicStackWithKey(t testing.TB, logf logger.Logf, ln nettype.PacketListe
 	tsTun.SetFilter(filter.NewAllowAllForTest(logf))
 	tsTun.Start()
 
-	wgLogger := wglog.NewLogger(logf)
+	wgLogger := wglog.NewLogger(logf, nil)
 	dev := wgcfg.NewDevice(tsTun, conn.Bind(), wgLogger.DeviceLogger)
 	dev.Up()
 
@@ -241,10 +245,82 @@ func newMagicStackWithKey(t testing.TB, logf logger.Logf, ln nettype.PacketListe
 	}
 }
 
-func (s *magicStack) Reconfig(cfg *wgcfg.Config) error {
+// wgCfgOf builds a test node's wgcfg.Config from its netmap the same
+// way ipnlocal.authReconfigLocked does in production: just the private
+// key and self addresses. Peers ride the per-peer config source
+// instead; see [magicStack.Reconfig].
+func wgCfgOf(pk key.NodePrivate, nm *netmap.NetworkMap) *wgcfg.Config {
+	return &wgcfg.Config{
+		PrivateKey: pk,
+		Addresses:  nm.GetAddresses().AsSlice(),
+	}
+}
+
+// Reconfig applies cfg and peers to the stack's WireGuard device and
+// tun-layer data plane. In production these flow from LocalBackend
+// (via [tailscale.com/wgengine.Engine.Reconfig] and the live per-peer
+// config source installed with Engine.SetPeerConfigFunc); tests that
+// bypass LocalBackend replicate that wiring here, deriving everything
+// from a real [routemanager.RouteManager] fed the given peers,
+// exactly as LocalBackend does in production, so this helper cannot
+// drift from the production derivation.
+func (s *magicStack) Reconfig(cfg *wgcfg.Config, peers []tailcfg.NodeView) error {
 	s.tsTun.SetWGConfig(cfg)
-	s.wgLogger.SetPeers(cfg.Peers)
-	return wgcfg.ReconfigDevice(s.dev, cfg, s.conn.logf)
+
+	rm := routemanager.New(nil)
+	mut := rm.Begin()
+	// Tests want subnet routes accepted, matching what production
+	// gets from Prefs.RouteAll.
+	mut.SetPrefs(routemanager.Prefs{RouteAll: true})
+	// idByKey stands in for nodeBackend's public-key-to-node-ID
+	// index, which LocalBackend uses to serve the engine's per-peer
+	// config source.
+	idByKey := make(map[key.NodePublic]tailcfg.NodeID, len(peers))
+	for _, n := range peers {
+		idByKey[n.Key()] = n.ID()
+		mut.UpsertPeer(n)
+	}
+	mut.Commit()
+	peerAllowedIPs := func(k key.NodePublic) ([]netip.Prefix, bool) {
+		id, ok := idByKey[k]
+		if !ok {
+			return nil, false
+		}
+		return rm.PeerAllowedIPs(id)
+	}
+
+	// The tun-layer per-peer route attributes (masquerade, jailed).
+	native4, native6 := tsaddr.FirstTailscaleAddrs(slices.All(cfg.Addresses))
+	s.tsTun.SetPeerRoutes(native4, native6, rm.Outbound())
+
+	// Outbound packet routing, as LocalBackend's lookupPeerByIP does
+	// via the outbound table.
+	s.dev.SetPeerByIPPacketFunc(func(_, dst netip.Addr, _ []byte) (device.NoisePublicKey, bool) {
+		if pr, ok := rm.Outbound().Lookup(dst); ok {
+			return pr.Key.Raw32(), true
+		}
+		return device.NoisePublicKey{}, false
+	})
+
+	// The live per-peer config source backing lazy peer creation, as
+	// LocalBackend's peerAllowedIPs does via PeerAllowedIPs, and the
+	// per-peer device convergence that Engine.SyncDevicePeer does.
+	s.dev.SetPeerLookupFunc(wgcfg.NewPeerLookupFunc(s.conn.Bind(), s.conn.logf, func(pubk device.NoisePublicKey) ([]netip.Prefix, bool) {
+		return peerAllowedIPs(key.NodePublicFromRaw32(mem.B(pubk[:])))
+	}))
+	s.dev.SetPrivateKey(key.NodePrivateAs[device.NoisePrivateKey](cfg.PrivateKey))
+	s.dev.RemoveMatchingPeers(func(pk device.NoisePublicKey) bool {
+		_, ok := peerAllowedIPs(key.NodePublicFromRaw32(mem.B(pk[:])))
+		return !ok
+	})
+	for _, n := range peers {
+		if peer, ok := s.dev.LookupActivePeer(n.Key().Raw32()); ok {
+			if ips, ok := peerAllowedIPs(n.Key()); ok {
+				peer.SetAllowedIPs(ips)
+			}
+		}
+	}
+	return nil
 }
 
 func (s *magicStack) String() string {
@@ -346,18 +422,8 @@ func meshStacks(logf logger.Logf, mutateNetmap func(idx int, nm *netmap.NetworkM
 		for i, m := range ms {
 			nm := buildNetmapLocked(i)
 			m.conn.SetNetworkMap(nm.SelfNode, nm.Peers)
-			peerSet := make(set.Set[key.NodePublic], len(nm.Peers))
-			for _, peer := range nm.Peers {
-				peerSet.Add(peer.Key())
-			}
-			m.conn.UpdatePeers(peerSet)
-			wg, err := nmcfg.WGCfg(ms[i].privateKey, nm, logf, 0, "")
-			if err != nil {
-				// We're too far from the *testing.T to be graceful,
-				// blow up. Shouldn't happen anyway.
-				panic(fmt.Sprintf("failed to construct wgcfg from netmap: %v", err))
-			}
-			if err := m.Reconfig(wg); err != nil {
+			wg := wgCfgOf(ms[i].privateKey, nm)
+			if err := m.Reconfig(wg, nm.Peers); err != nil {
 				if ctx.Err() != nil || errors.Is(err, errConnClosed) {
 					// shutdown race, don't care.
 					return
@@ -414,20 +480,30 @@ func TestNewConn(t *testing.T) {
 	stunAddr, stunCleanupFn := stuntest.Serve(t)
 	defer stunCleanupFn()
 
-	port := pickPort(t)
+	// Use port 0 to let the system assign a port, avoiding TOCTOU races
+	// from the previous pickPort approach which would close a socket and
+	// hope to rebind to the same port.
 	conn, err := NewConn(Options{
-		Port:              port,
+		Port:              0,
 		DisablePortMapper: true,
 		EndpointsFunc:     epFunc,
 		Logf:              t.Logf,
 		NetMon:            netMon,
 		EventBus:          bus,
+		HealthTracker:     health.NewTracker(bus),
 		Metrics:           new(usermetric.Registry),
 	})
 	if err != nil {
 		t.Fatal(err)
 	}
 	defer conn.Close()
+
+	// Get the actual port that was assigned
+	port := conn.LocalPort()
+	if port == 0 {
+		t.Fatal("LocalPort returned 0")
+	}
+
 	conn.SetDERPMap(stuntest.DERPMapOf(stunAddr.String()))
 	conn.SetPrivateKey(key.NewNode())
 
@@ -463,14 +539,60 @@ collectEndpoints:
 	}
 }
 
-func pickPort(t testing.TB) uint16 {
-	t.Helper()
-	conn, err := net.ListenPacket("udp4", "127.0.0.1:0")
-	if err != nil {
-		t.Fatal(err)
+// TestResetNetInfoLast verifies that ResetNetInfoLast clears the NetInfo
+// de-duplication cache, so the next NetInfo is delivered to the callback even
+// when it's structurally unchanged (which callNetInfoCallback would normally
+// suppress). This is what lets a node re-advertise its home DERP
+// (NetInfo.PreferredDERP) to a freshly-installed control client after an
+// interactive login or profile switch; without it, peers can't reach the node
+// over DERP until some unrelated NetInfo field changes.
+func TestResetNetInfoLast(t *testing.T) {
+	tstest.PanicOnLog()
+
+	c := newConn(t.Logf)
+
+	got := make(chan *tailcfg.NetInfo, 8)
+	c.SetNetInfoCallback(func(ni *tailcfg.NetInfo) {
+		got <- ni
+	})
+
+	wantCall := func(why string, wantDERP int) {
+		t.Helper()
+		select {
+		case ni := <-got:
+			if ni.PreferredDERP != wantDERP {
+				t.Fatalf("%s: got PreferredDERP=%d, want %d", why, ni.PreferredDERP, wantDERP)
+			}
+		case <-time.After(5 * time.Second):
+			t.Fatalf("%s: timed out waiting for NetInfo callback", why)
+		}
 	}
-	defer conn.Close()
-	return uint16(conn.LocalAddr().(*net.UDPAddr).Port)
+	wantNoCall := func(why string) {
+		t.Helper()
+		select {
+		case ni := <-got:
+			t.Fatalf("%s: unexpected NetInfo callback: %+v", why, ni)
+		case <-time.After(200 * time.Millisecond):
+		}
+	}
+
+	ni := &tailcfg.NetInfo{PreferredDERP: 7, WorkingUDP: "true", LinkType: "wired"}
+
+	// First delivery fires the callback.
+	c.callNetInfoCallback(ni.Clone())
+	wantCall("initial", 7)
+
+	// An identical NetInfo is de-duplicated: no callback. This is exactly the
+	// behavior that, on a control-client swap, drops the home DERP.
+	c.callNetInfoCallback(ni.Clone())
+	wantNoCall("duplicate suppressed")
+
+	// Simulate a new control client being installed: clearing the de-dup cache
+	// must let the next (otherwise-identical) NetInfo through, modeling the
+	// post-login netcheck that re-reports derp-7 to the new session.
+	c.ResetNetInfoLast()
+	c.callNetInfoCallback(ni.Clone())
+	wantCall("after ResetNetInfoLast", 7)
 }
 
 func TestPickDERPFallback(t *testing.T) {
@@ -504,7 +626,7 @@ func TestPickDERPFallback(t *testing.T) {
 		}
 	}
 
-	// Test that that the pointer value of c is blended in and
+	// Test that the pointer value of c is blended in and
 	// distribution over nodes works.
 	got := map[int]int{}
 	for range 50 {
@@ -604,6 +726,7 @@ func TestDeviceStartStop(t *testing.T) {
 		Logf:          t.Logf,
 		NetMon:        netMon,
 		EventBus:      bus,
+		HealthTracker: health.NewTracker(bus),
 		Metrics:       new(usermetric.Registry),
 	})
 	if err != nil {
@@ -612,7 +735,7 @@ func TestDeviceStartStop(t *testing.T) {
 	defer conn.Close()
 
 	tun := tuntest.NewChannelTUN()
-	wgLogger := wglog.NewLogger(t.Logf)
+	wgLogger := wglog.NewLogger(t.Logf, nil)
 	dev := wgcfg.NewDevice(tun.TUN(), conn.Bind(), wgLogger.DeviceLogger)
 	dev.Up()
 	dev.Close()
@@ -733,7 +856,6 @@ func (localhostListener) ListenPacket(ctx context.Context, network, address stri
 }
 
 func TestTwoDevicePing(t *testing.T) {
-	flakytest.Mark(t, "https://github.com/tailscale/tailscale/issues/11762")
 	ln, ip := localhostListener{}, netaddr.IPv4(127, 0, 0, 1)
 	n := &devices{
 		m1:     ln,
@@ -1107,30 +1229,32 @@ func testTwoDevicePing(t *testing.T, d *devices) {
 	m1cfg := &wgcfg.Config{
 		PrivateKey: m1.privateKey,
 		Addresses:  []netip.Prefix{netip.MustParsePrefix("1.0.0.1/32")},
-		Peers: []wgcfg.Peer{
-			{
-				PublicKey:  m2.privateKey.Public(),
-				DiscoKey:   m2.conn.DiscoPublicKey(),
-				AllowedIPs: []netip.Prefix{netip.MustParsePrefix("1.0.0.2/32")},
-			},
-		},
 	}
+	m1peers := nodeViews([]*tailcfg.Node{{
+		ID:         2,
+		Key:        m2.privateKey.Public(),
+		DiscoKey:   m2.conn.DiscoPublicKey(),
+		HomeDERP:   1,
+		Addresses:  []netip.Prefix{netip.MustParsePrefix("1.0.0.2/32")},
+		AllowedIPs: []netip.Prefix{netip.MustParsePrefix("1.0.0.2/32")},
+	}})
 	m2cfg := &wgcfg.Config{
 		PrivateKey: m2.privateKey,
 		Addresses:  []netip.Prefix{netip.MustParsePrefix("1.0.0.2/32")},
-		Peers: []wgcfg.Peer{
-			{
-				PublicKey:  m1.privateKey.Public(),
-				DiscoKey:   m1.conn.DiscoPublicKey(),
-				AllowedIPs: []netip.Prefix{netip.MustParsePrefix("1.0.0.1/32")},
-			},
-		},
 	}
+	m2peers := nodeViews([]*tailcfg.Node{{
+		ID:         1,
+		Key:        m1.privateKey.Public(),
+		DiscoKey:   m1.conn.DiscoPublicKey(),
+		HomeDERP:   1,
+		Addresses:  []netip.Prefix{netip.MustParsePrefix("1.0.0.1/32")},
+		AllowedIPs: []netip.Prefix{netip.MustParsePrefix("1.0.0.1/32")},
+	}})
 
-	if err := m1.Reconfig(m1cfg); err != nil {
+	if err := m1.Reconfig(m1cfg, m1peers); err != nil {
 		t.Fatal(err)
 	}
-	if err := m2.Reconfig(m2cfg); err != nil {
+	if err := m2.Reconfig(m2cfg, m2peers); err != nil {
 		t.Fatal(err)
 	}
 
@@ -1254,7 +1378,7 @@ func testTwoDevicePing(t *testing.T, d *devices) {
 	t.Run("no-op-dev1-reconfig", func(t *testing.T) {
 		setT(t)
 		defer setT(outerT)
-		if err := m1.Reconfig(m1cfg); err != nil {
+		if err := m1.Reconfig(m1cfg, m1peers); err != nil {
 			t.Fatal(err)
 		}
 		ping1(t)
@@ -1265,96 +1389,133 @@ func testTwoDevicePing(t *testing.T, d *devices) {
 	t.Run("compare-metrics-stats", func(t *testing.T) {
 		setT(t)
 		defer setT(outerT)
-		m1.counts.Reset()
-		m2.counts.Reset()
-		m1.conn.resetMetricsForTest()
-		m2.conn.resetMetricsForTest()
-		t.Logf("Metrics before: %s\n", m1.metrics.String())
+
+		// Snapshot both counting systems before pings rather than
+		// resetting them. Resetting two independent systems
+		// non-atomically left a window where background WireGuard
+		// keepalives could increment one system but not the other,
+		// causing flaky off-by-one mismatches.
+		physBefore1, metricBefore1 := snapshotCounts(m1)
+		physBefore2, metricBefore2 := snapshotCounts(m2)
+
 		ping1(t)
 		ping2(t)
-		assertConnStatsAndUserMetricsEqual(t, m1)
-		assertConnStatsAndUserMetricsEqual(t, m2)
+
+		assertConnStatDeltasMatchMetricDeltas(t, m1, physBefore1, metricBefore1)
+		assertConnStatDeltasMatchMetricDeltas(t, m2, physBefore2, metricBefore2)
 		assertGlobalMetricsMatchPerConn(t, m1, m2)
-		t.Logf("Metrics after: %s\n", m1.metrics.String())
 	})
 }
 
-func (c *Conn) resetMetricsForTest() {
-	c.metrics.inboundBytesIPv4Total.Set(0)
-	c.metrics.inboundPacketsIPv4Total.Set(0)
-	c.metrics.outboundBytesIPv4Total.Set(0)
-	c.metrics.outboundPacketsIPv4Total.Set(0)
-	c.metrics.inboundBytesIPv6Total.Set(0)
-	c.metrics.inboundPacketsIPv6Total.Set(0)
-	c.metrics.outboundBytesIPv6Total.Set(0)
-	c.metrics.outboundPacketsIPv6Total.Set(0)
-	c.metrics.inboundBytesDERPTotal.Set(0)
-	c.metrics.inboundPacketsDERPTotal.Set(0)
-	c.metrics.outboundBytesDERPTotal.Set(0)
-	c.metrics.outboundPacketsDERPTotal.Set(0)
+// countSnapshot holds a point-in-time snapshot of packet/byte statistics,
+// categorized by transport type (IPv4 vs DERP).
+type countSnapshot struct {
+	ipv4RxBytes, ipv4TxBytes     int64
+	ipv4RxPackets, ipv4TxPackets int64
+	derpRxBytes, derpTxBytes     int64
+	derpRxPackets, derpTxPackets int64
 }
 
-func assertConnStatsAndUserMetricsEqual(t *testing.T, ms *magicStack) {
-	t.Helper()
-	physIPv4RxBytes := int64(0)
-	physIPv4TxBytes := int64(0)
-	physDERPRxBytes := int64(0)
-	physDERPTxBytes := int64(0)
-	physIPv4RxPackets := int64(0)
-	physIPv4TxPackets := int64(0)
-	physDERPRxPackets := int64(0)
-	physDERPTxPackets := int64(0)
+// snapshotCounts captures the current physical connection counter values and
+// user metrics for ms, returning them as separate snapshots. Reading both
+// systems back-to-back (rather than resetting them non-atomically) avoids a
+// race where background WireGuard keepalives could increment one system but
+// not the other during a reset window.
+func snapshotCounts(ms *magicStack) (phys, metric countSnapshot) {
 	for conn, count := range ms.counts.Clone() {
-		t.Logf("physconn src: %s, dst: %s", conn.Src.String(), conn.Dst.String())
 		if conn.Dst.String() == "127.3.3.40:1" {
-			physDERPRxBytes += int64(count.RxBytes)
-			physDERPTxBytes += int64(count.TxBytes)
-			physDERPRxPackets += int64(count.RxPackets)
-			physDERPTxPackets += int64(count.TxPackets)
+			phys.derpRxBytes += int64(count.RxBytes)
+			phys.derpTxBytes += int64(count.TxBytes)
+			phys.derpRxPackets += int64(count.RxPackets)
+			phys.derpTxPackets += int64(count.TxPackets)
 		} else {
-			physIPv4RxBytes += int64(count.RxBytes)
-			physIPv4TxBytes += int64(count.TxBytes)
-			physIPv4RxPackets += int64(count.RxPackets)
-			physIPv4TxPackets += int64(count.TxPackets)
+			phys.ipv4RxBytes += int64(count.RxBytes)
+			phys.ipv4TxBytes += int64(count.TxBytes)
+			phys.ipv4RxPackets += int64(count.RxPackets)
+			phys.ipv4TxPackets += int64(count.TxPackets)
 		}
 	}
+	metric = countSnapshot{
+		ipv4RxBytes:   ms.conn.metrics.inboundBytesIPv4Total.Value(),
+		ipv4TxBytes:   ms.conn.metrics.outboundBytesIPv4Total.Value(),
+		ipv4RxPackets: ms.conn.metrics.inboundPacketsIPv4Total.Value(),
+		ipv4TxPackets: ms.conn.metrics.outboundPacketsIPv4Total.Value(),
+		derpRxBytes:   ms.conn.metrics.inboundBytesDERPTotal.Value(),
+		derpTxBytes:   ms.conn.metrics.outboundBytesDERPTotal.Value(),
+		derpRxPackets: ms.conn.metrics.inboundPacketsDERPTotal.Value(),
+		derpTxPackets: ms.conn.metrics.outboundPacketsDERPTotal.Value(),
+	}
+	return phys, metric
+}
 
-	metricIPv4RxBytes := ms.conn.metrics.inboundBytesIPv4Total.Value()
-	metricIPv4RxPackets := ms.conn.metrics.inboundPacketsIPv4Total.Value()
-	metricIPv4TxBytes := ms.conn.metrics.outboundBytesIPv4Total.Value()
-	metricIPv4TxPackets := ms.conn.metrics.outboundPacketsIPv4Total.Value()
+// assertConnStatDeltasMatchMetricDeltas checks that the changes in physical
+// connection counters since physBefore match the changes in user metrics since
+// metricBefore. Using deltas avoids a race from non-atomically resetting the
+// two independent counting systems.
+//
+// As a safety net, a difference of exactly one packet (and the corresponding
+// bytes) is tolerated, since a background WireGuard keepalive could still
+// arrive in the narrow window between snapshotting the two systems.
+func assertConnStatDeltasMatchMetricDeltas(t *testing.T, ms *magicStack, physBefore, metricBefore countSnapshot) {
+	t.Helper()
+	physAfter, metricAfter := snapshotCounts(ms)
 
-	metricDERPRxBytes := ms.conn.metrics.inboundBytesDERPTotal.Value()
-	metricDERPRxPackets := ms.conn.metrics.inboundPacketsDERPTotal.Value()
-	metricDERPTxBytes := ms.conn.metrics.outboundBytesDERPTotal.Value()
-	metricDERPTxPackets := ms.conn.metrics.outboundPacketsDERPTotal.Value()
+	type stat struct {
+		name                 string
+		physDelta, metDelta  int64
+		isPackets            bool // true for packet counts, false for byte counts
+		packetDeltaTolerated bool // set by packet check, used by byte check
+	}
 
-	// Reset counts after reading all values to minimize the window where a
-	// background packet could increment metrics but miss the cloned counts.
-	ms.counts.Reset()
+	stats := []stat{
+		{name: "IPv4RxPackets", physDelta: physAfter.ipv4RxPackets - physBefore.ipv4RxPackets, metDelta: metricAfter.ipv4RxPackets - metricBefore.ipv4RxPackets, isPackets: true},
+		{name: "IPv4RxBytes", physDelta: physAfter.ipv4RxBytes - physBefore.ipv4RxBytes, metDelta: metricAfter.ipv4RxBytes - metricBefore.ipv4RxBytes},
+		{name: "IPv4TxPackets", physDelta: physAfter.ipv4TxPackets - physBefore.ipv4TxPackets, metDelta: metricAfter.ipv4TxPackets - metricBefore.ipv4TxPackets, isPackets: true},
+		{name: "IPv4TxBytes", physDelta: physAfter.ipv4TxBytes - physBefore.ipv4TxBytes, metDelta: metricAfter.ipv4TxBytes - metricBefore.ipv4TxBytes},
+		{name: "DERPRxPackets", physDelta: physAfter.derpRxPackets - physBefore.derpRxPackets, metDelta: metricAfter.derpRxPackets - metricBefore.derpRxPackets, isPackets: true},
+		{name: "DERPRxBytes", physDelta: physAfter.derpRxBytes - physBefore.derpRxBytes, metDelta: metricAfter.derpRxBytes - metricBefore.derpRxBytes},
+		{name: "DERPTxPackets", physDelta: physAfter.derpTxPackets - physBefore.derpTxPackets, metDelta: metricAfter.derpTxPackets - metricBefore.derpTxPackets, isPackets: true},
+		{name: "DERPTxBytes", physDelta: physAfter.derpTxBytes - physBefore.derpTxBytes, metDelta: metricAfter.derpTxBytes - metricBefore.derpTxBytes},
+	}
 
-	// Compare physical connection stats with per-conn user metrics.
-	// A rebind during the measurement window can reset the physical connection
-	// counter, causing physical stats to show 0 while user metrics recorded
-	// packets normally. Tolerate this by logging instead of failing.
-	checkPhysVsMetric := func(phys, metric int64, name string) {
-		if phys == metric {
-			return
+	// First pass: check packet counts, tolerating ±1 from stray keepalives.
+	for i := range stats {
+		s := &stats[i]
+		if !s.isPackets {
+			continue
 		}
-		if phys == 0 && metric > 0 {
-			t.Logf("%s: physical counter is 0 but metric is %d (possible rebind during measurement)", name, metric)
-			return
+		if s.physDelta == s.metDelta {
+			continue
 		}
-		t.Errorf("%s: physical=%d, metric=%d", name, phys, metric)
+		diff := s.physDelta - s.metDelta
+		if diff < 0 {
+			diff = -diff
+		}
+		if diff <= 1 {
+			s.packetDeltaTolerated = true
+			t.Logf("%s: physical delta=%d, metric delta=%d (off by 1, likely background WireGuard keepalive)", s.name, s.physDelta, s.metDelta)
+			continue
+		}
+		t.Errorf("%s: physical delta=%d, metric delta=%d", s.name, s.physDelta, s.metDelta)
+	}
+
+	// Second pass: check byte counts; tolerate mismatches when the
+	// corresponding packet count was already tolerated.
+	for i := range stats {
+		s := &stats[i]
+		if s.isPackets {
+			continue
+		}
+		if s.physDelta == s.metDelta {
+			continue
+		}
+		// The preceding entry in the slice is always the corresponding packet stat.
+		if stats[i-1].packetDeltaTolerated {
+			t.Logf("%s: physical delta=%d, metric delta=%d (within single-packet tolerance)", s.name, s.physDelta, s.metDelta)
+			continue
+		}
+		t.Errorf("%s: physical delta=%d, metric delta=%d", s.name, s.physDelta, s.metDelta)
 	}
-	checkPhysVsMetric(physDERPRxBytes, metricDERPRxBytes, "DERPRxBytes")
-	checkPhysVsMetric(physDERPTxBytes, metricDERPTxBytes, "DERPTxBytes")
-	checkPhysVsMetric(physIPv4RxBytes, metricIPv4RxBytes, "IPv4RxBytes")
-	checkPhysVsMetric(physIPv4TxBytes, metricIPv4TxBytes, "IPv4TxBytes")
-	checkPhysVsMetric(physDERPRxPackets, metricDERPRxPackets, "DERPRxPackets")
-	checkPhysVsMetric(physDERPTxPackets, metricDERPTxPackets, "DERPTxPackets")
-	checkPhysVsMetric(physIPv4RxPackets, metricIPv4RxPackets, "IPv4RxPackets")
-	checkPhysVsMetric(physIPv4TxPackets, metricIPv4TxPackets, "IPv4TxPackets")
 }
 
 // assertGlobalMetricsMatchPerConn validates that the global clientmetric
@@ -1408,36 +1569,42 @@ func TestDiscoStringLogRace(t *testing.T) {
 	wg.Wait()
 }
 
+// Test32bitAlignment verifies that the 64-bit atomic mono.Time fields are
+// 64-bit aligned, so that StoreAtomic and LoadAtomic won't panic on 32-bit
+// platforms.
+//
+// For normal Go atomic types (sync/atomic.Int64, etc), the Go compiler
+// guarantees 64-bit alignment on 32-bit platforms with an unexported magic
+// embedded struct field. We can't make mono.Time use that easily. We could change
+// mono.Time to be type Time struct { atomic.Int64 }, but that's pretty invasive.
+// Instead, we just have this test to keep us safe on 32-bit platforms.
 func Test32bitAlignment(t *testing.T) {
-	// Need an associated conn with non-nil noteRecvActivity to
-	// trigger interesting work on the atomics in endpoint.
-	called := 0
+	if rt := reflect.TypeFor[mono.Time](); rt.Kind() != reflect.Int64 {
+		t.Fatalf("mono.Time is not a 64-bit integer type anymore; this test may be irrelevant now or out of date")
+	}
+
 	de := endpoint{
-		c: &Conn{
-			noteRecvActivity: func(key.NodePublic) { called++ },
-		},
+		c: &Conn{},
 	}
 
 	if off := unsafe.Offsetof(de.lastRecvWG); off%8 != 0 {
 		t.Fatalf("endpoint.lastRecvWG is not 8-byte aligned")
 	}
+	if off := unsafe.Offsetof(de.lastRecvUDPAny); off%8 != 0 {
+		t.Fatalf("endpoint.lastRecvUDPAny is not 8-byte aligned")
+	}
 
-	de.noteRecvActivity(epAddr{}, mono.Now()) // verify this doesn't panic on 32-bit
-	if called != 1 {
-		t.Fatal("expected call to noteRecvActivity")
-	}
-	de.noteRecvActivity(epAddr{}, mono.Now())
-	if called != 1 {
-		t.Error("expected no second call to noteRecvActivity")
-	}
+	// Verify these don't panic.
+	de.lastRecvWG.StoreAtomic(mono.Now())
+	de.lastRecvUDPAny.StoreAtomic(mono.Now())
 }
 
 // newTestConn returns a new Conn.
 func newTestConn(t testing.TB) *Conn {
 	t.Helper()
-	port := pickPort(t)
 
 	bus := eventbustest.NewBus(t)
+	t.Cleanup(bus.Close)
 
 	netMon, err := netmon.New(bus, logger.WithPrefix(t.Logf, "... netmon: "))
 	if err != nil {
@@ -1452,7 +1619,7 @@ func newTestConn(t testing.TB) *Conn {
 		Metrics:                new(usermetric.Registry),
 		DisablePortMapper:      true,
 		Logf:                   t.Logf,
-		Port:                   port,
+		Port:                   0,
 		TestOnlyPacketListener: localhostListener{},
 		EndpointsFunc: func(eps []tailcfg.Endpoint) {
 			t.Logf("endpoints: %q", eps)
@@ -1461,6 +1628,7 @@ func newTestConn(t testing.TB) *Conn {
 	if err != nil {
 		t.Fatal(err)
 	}
+	t.Cleanup(func() { conn.Close() })
 	return conn
 }
 
@@ -2185,8 +2353,8 @@ func TestRebindingUDPConn(t *testing.T) {
 		t.Fatal(err)
 	}
 	defer realConn.Close()
-	c.setConnLocked(realConn.(nettype.PacketConn), "udp4", 1)
-	c.setConnLocked(newBlockForeverConn(), "", 1)
+	c.setConnLocked(realConn.(nettype.PacketConn), "udp4", 1, nil)
+	c.setConnLocked(newBlockForeverConn(), "", 1, nil)
 }
 
 // https://github.com/tailscale/tailscale/issues/6680: don't ignore
@@ -2209,18 +2377,131 @@ func TestSetNetworkMapWithNoPeers(t *testing.T) {
 	}
 }
 
+// Tests that the full-set peer update path (SetNetworkMap) and the
+// incremental per-peer paths (UpsertPeer, RemovePeer) maintain the
+// node-key-keyed DERP state (derpRoute and peerLastDerp) identically
+// when peers are removed or rotate their node keys. LocalBackend uses
+// either path depending on whether it received a full netmap or a
+// delta, so a change to the cleanup in one path must be made to both.
+func TestPeerDERPStateCleanup(t *testing.T) {
+	peerA := &tailcfg.Node{ID: 1, Key: randNodeKey(), DiscoKey: randDiscoKey(), Endpoints: eps("192.168.1.2:1")}
+	peerB := &tailcfg.Node{ID: 2, Key: randNodeKey(), DiscoKey: randDiscoKey(), Endpoints: eps("192.168.1.2:2")}
+	peerARotated := peerA.Clone()
+	peerARotated.Key = randNodeKey()
+
+	steps := []struct {
+		name  string
+		peers []*tailcfg.Node // the desired peer set after the step
+	}{
+		{"initial", []*tailcfg.Node{peerA, peerB}},
+		{"rotate-A-key", []*tailcfg.Node{peerARotated, peerB}},
+		{"remove-B", []*tailcfg.Node{peerARotated}},
+		{"remove-all", nil},
+	}
+
+	// seedDERPState populates the node-key-keyed DERP maps for each
+	// current peer, as receiving DERP traffic from them would.
+	seedDERPState := func(c *Conn) {
+		c.mu.Lock()
+		defer c.mu.Unlock()
+		for _, n := range c.peersByID {
+			mak.Set(&c.derpRoute, n.Key(), derpRoute{regionID: 1})
+			mak.Set(&c.peerLastDerp, n.Key(), 1)
+		}
+	}
+
+	// derpKeys returns a canonical dump of the node-key-keyed DERP
+	// state that peer removals and key rotations must clean up.
+	derpKeys := func(c *Conn) []string {
+		c.mu.Lock()
+		defer c.mu.Unlock()
+		var got []string
+		for k := range c.derpRoute {
+			got = append(got, "derpRoute "+k.String())
+		}
+		for k := range c.peerLastDerp {
+			got = append(got, "peerLastDerp "+k.String())
+		}
+		slices.Sort(got)
+		return got
+	}
+
+	// stateString returns a canonical dump of all the per-peer state
+	// that the two update paths must maintain identically.
+	stateString := func(c *Conn) string {
+		c.mu.Lock()
+		lines := []string{fmt.Sprintf("peerMap %d", c.peerMap.nodeCount())}
+		for id, n := range c.peersByID {
+			lines = append(lines, fmt.Sprintf("peer %d %s", id, n.Key()))
+		}
+		c.mu.Unlock()
+		lines = append(lines, derpKeys(c)...)
+		slices.Sort(lines)
+		return strings.Join(lines, "\n")
+	}
+
+	connFull := newTestConn(t) // updated via SetNetworkMap
+	defer connFull.Close()
+	connInc := newTestConn(t) // updated via UpsertPeer/RemovePeer
+	defer connInc.Close()
+
+	prevKeyByID := map[tailcfg.NodeID]key.NodePublic{}
+	for _, step := range steps {
+		connFull.SetNetworkMap(tailcfg.NodeView{}, nodeViews(step.peers))
+
+		curIDs := set.Set[tailcfg.NodeID]{}
+		for _, n := range step.peers {
+			curIDs.Add(n.ID)
+			connInc.UpsertPeer(n.View())
+		}
+		for id := range prevKeyByID {
+			if !curIDs.Contains(id) {
+				connInc.RemovePeer(id)
+			}
+		}
+
+		// The DERP state seeded before this step must survive only for
+		// peers still present with an unchanged node key.
+		var want []string
+		for _, n := range step.peers {
+			if k, ok := prevKeyByID[n.ID]; ok && k == n.Key {
+				want = append(want, "derpRoute "+n.Key.String(), "peerLastDerp "+n.Key.String())
+			}
+		}
+		slices.Sort(want)
+		if got := derpKeys(connFull); !slices.Equal(got, want) {
+			t.Errorf("step %q: SetNetworkMap path DERP state = %q; want %q", step.name, got, want)
+		}
+
+		// Both update paths must have produced identical state.
+		if full, inc := stateString(connFull), stateString(connInc); full != inc {
+			t.Errorf("step %q: state mismatch between update paths\nSetNetworkMap path:\n%s\nUpsertPeer/RemovePeer path:\n%s", step.name, full, inc)
+		}
+
+		clear(prevKeyByID)
+		for _, n := range step.peers {
+			prevKeyByID[n.ID] = n.Key
+		}
+		seedDERPState(connFull)
+		seedDERPState(connInc)
+	}
+}
+
 // newWireguard starts up a new wireguard-go device attached to a test tun, and
-// returns the device, tun and endpoint port. To add peers call device.IpcSet with UAPI instructions.
-func newWireguard(t *testing.T, uapi string, aips []netip.Prefix) (*device.Device, *tuntest.ChannelTUN, uint16) {
-	wgtun := tuntest.NewChannelTUN()
+// returns the device, tun and endpoint port. To add peers call device.IpcSet
+// with UAPI instructions.
+//
+// This uses stock wireguard-go to simulate a non-Tailscale peer.
+func newWireguard(t *testing.T, uapi string, aips []netip.Prefix) (*extwgdevice.Device, *extwgtest.ChannelTUN, uint16) {
+	wgtun := extwgtest.NewChannelTUN()
 	wglogf := func(f string, args ...any) {
 		t.Logf("wg-go: "+f, args...)
 	}
-	wglog := device.Logger{
+	wglog := extwgdevice.Logger{
 		Verbosef: func(string, ...any) {},
 		Errorf:   wglogf,
 	}
-	wgdev := wgcfg.NewDevice(wgtun.TUN(), wgconn.NewDefaultBind(), &wglog)
+	wgdev := extwgdevice.NewDevice(wgtun.TUN(), extwgconn.NewDefaultBind(), &wglog)
 
 	if err := wgdev.IpcSet(uapi); err != nil {
 		t.Fatal(err)
@@ -2292,11 +2573,8 @@ func TestIsWireGuardOnlyPeer(t *testing.T) {
 	}
 	m.conn.SetNetworkMap(nm.SelfNode, nm.Peers)
 
-	cfg, err := nmcfg.WGCfg(m.privateKey, nm, t.Logf, netmap.AllowSubnetRoutes, "")
-	if err != nil {
-		t.Fatal(err)
-	}
-	m.Reconfig(cfg)
+	cfg := wgCfgOf(m.privateKey, nm)
+	m.Reconfig(cfg, nm.Peers)
 
 	pbuf := tuntest.Ping(wgaip.Addr(), tsaip.Addr())
 	m.tun.Outbound <- pbuf
@@ -2353,11 +2631,8 @@ func TestIsWireGuardOnlyPeerWithMasquerade(t *testing.T) {
 	}
 	m.conn.SetNetworkMap(nm.SelfNode, nm.Peers)
 
-	cfg, err := nmcfg.WGCfg(m.privateKey, nm, t.Logf, netmap.AllowSubnetRoutes, "")
-	if err != nil {
-		t.Fatal(err)
-	}
-	m.Reconfig(cfg)
+	cfg := wgCfgOf(m.privateKey, nm)
+	m.Reconfig(cfg, nm.Peers)
 
 	pbuf := tuntest.Ping(wgaip.Addr(), tsaip.Addr())
 	m.tun.Outbound <- pbuf
@@ -2393,12 +2668,9 @@ func applyNetworkMap(t *testing.T, m *magicStack, nm *netmap.NetworkMap) {
 	m.conn.noV6.Store(true)
 
 	// Turn the network map into a wireguard config (for the tailscale internal wireguard device).
-	cfg, err := nmcfg.WGCfg(m.privateKey, nm, t.Logf, netmap.AllowSubnetRoutes, "")
-	if err != nil {
-		t.Fatal(err)
-	}
+	cfg := wgCfgOf(m.privateKey, nm)
 	// Apply the wireguard config to the tailscale internal wireguard device.
-	if err := m.Reconfig(cfg); err != nil {
+	if err := m.Reconfig(cfg, nm.Peers); err != nil {
 		t.Fatal(err)
 	}
 }
@@ -3048,6 +3320,7 @@ func TestMaybeSetNearestDERP(t *testing.T) {
 		old                int
 		reportDERP         int
 		connectedToControl bool
+		force              bool
 		want               int
 	}{
 		{
@@ -3071,6 +3344,22 @@ func TestMaybeSetNearestDERP(t *testing.T) {
 			connectedToControl: false, // not connected...
 			want:               21,    // ... but want to change to new DERP
 		},
+		{
+			name:               "force_not_connected_with_report_derp",
+			old:                1,
+			reportDERP:         21,
+			connectedToControl: false,
+			force:              true,
+			want:               21, // force bypasses the no-change-without-control guard
+		},
+		{
+			name:               "force_not_connected_no_derp_no_current",
+			old:                0,
+			reportDERP:         0,
+			connectedToControl: false,
+			force:              true,
+			want:               31, // force + no report DERP → deterministic fallback
+		},
 		{
 			name:               "not_connected_with_fallback_and_no_current",
 			old:                0,     // no current DERP
@@ -3095,8 +3384,13 @@ func TestMaybeSetNearestDERP(t *testing.T) {
 	}
 	for _, tt := range testCases {
 		t.Run(tt.name, func(t *testing.T) {
-			ht := health.NewTracker(eventbustest.NewBus(t))
+			bus := eventbustest.NewBus(t)
+			ht := health.NewTracker(bus)
 			c := newConn(t.Logf)
+			ec := bus.Client("magicsock.Conn.Test")
+			c.eventClient = ec
+			c.homeDERPChangedPub = eventbus.Publish[HomeDERPChanged](ec)
+			c.eventBus = bus
 			c.myDerp = tt.old
 			c.derpMap = derpMap
 			c.health = ht
@@ -3114,7 +3408,7 @@ func TestMaybeSetNearestDERP(t *testing.T) {
 				}
 			}
 
-			got := c.maybeSetNearestDERP(report)
+			got := c.maybeSetNearestDERP(report, tt.force)
 			if got != tt.want {
 				t.Errorf("got new DERP region %d, want %d", got, tt.want)
 			}
@@ -3204,10 +3498,13 @@ func TestMaybeRebindOnError(t *testing.T) {
 	})
 }
 
-func newTestConnAndRegistry(t *testing.T) (*Conn, *usermetric.Registry, func()) {
+func newTestConnAndRegistry(t *testing.T) (*Conn, *usermetric.Registry) {
 	t.Helper()
 	bus := eventbus.New()
+	t.Cleanup(bus.Close)
+
 	netMon := must.Get(netmon.New(bus, t.Logf))
+	t.Cleanup(func() { netMon.Close() })
 
 	reg := new(usermetric.Registry)
 
@@ -3216,14 +3513,12 @@ func newTestConnAndRegistry(t *testing.T) (*Conn, *usermetric.Registry, func())
 		Logf:              t.Logf,
 		NetMon:            netMon,
 		EventBus:          bus,
+		HealthTracker:     health.NewTracker(bus),
 		Metrics:           reg,
 	}))
+	t.Cleanup(func() { conn.Close() })
 
-	return conn, reg, func() {
-		bus.Close()
-		netMon.Close()
-		conn.Close()
-	}
+	return conn, reg
 }
 
 func TestNetworkSendErrors(t *testing.T) {
@@ -3241,10 +3536,8 @@ func TestNetworkSendErrors(t *testing.T) {
 			t.Skipf("skipping on %s", runtime.GOOS)
 		}
 
-		tstest.Replace(t, &checkNetworkDownDuringTests, true)
-
-		conn, reg, close := newTestConnAndRegistry(t)
-		defer close()
+		conn, reg := newTestConnAndRegistry(t)
+		conn.checkNetworkUpDuringTests = true
 
 		buffs := [][]byte{{00, 00, 00, 00, 00, 00, 00, 00}}
 		ep := &lazyEndpoint{
@@ -3273,8 +3566,7 @@ func TestNetworkSendErrors(t *testing.T) {
 	})
 
 	t.Run("invalid-payload", func(t *testing.T) {
-		conn, reg, close := newTestConnAndRegistry(t)
-		defer close()
+		conn, reg := newTestConnAndRegistry(t)
 
 		conn.SetNetworkUp(false)
 		err := conn.Send([][]byte{{00}}, &lazyEndpoint{}, 0)
@@ -3529,6 +3821,9 @@ func Test_nodeHasCap(t *testing.T) {
 	nodeDOnlyIPv6 := nodeCOnlyIPv4.Clone()
 	nodeDOnlyIPv6.Addresses[0] = netip.MustParsePrefix("::2/128")
 
+	nodeCUnsigned := nodeCOnlyIPv4.Clone()
+	nodeCUnsigned.UnsignedPeerAPIOnly = true
+
 	tests := []struct {
 		name string
 		filt *filter.Filter
@@ -3645,6 +3940,24 @@ func Test_nodeHasCap(t *testing.T) {
 			cap:  tailcfg.PeerCapabilityRelayTarget,
 			want: false,
 		},
+		{
+			name: "unsigned-src",
+			filt: filter.New([]filtertype.Match{
+				{
+					Srcs: []netip.Prefix{netip.MustParsePrefix("2.2.2.2/32")},
+					Caps: []filtertype.CapMatch{
+						{
+							Dst: netip.MustParsePrefix("1.1.1.1/32"),
+							Cap: tailcfg.PeerCapabilityRelayTarget,
+						},
+					},
+				},
+			}, nil, nil, nil, nil, nil),
+			src:  nodeCUnsigned.View(),
+			dst:  nodeAOnlyIPv4.View(),
+			cap:  tailcfg.PeerCapabilityRelayTarget,
+			want: false,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -3814,7 +4127,7 @@ func TestConn_SetNetworkMap_updateRelayServersSet(t *testing.T) {
 			c.filt = tt.filt
 			if len(tt.wantRelayServers) == 0 {
 				// So we can verify it gets flipped back.
-				c.hasPeerRelayServers.Store(true)
+				c.relayManager.hasPeerRelayServers.Store(true)
 			}
 
 			c.SetNetworkMap(tt.self, tt.peers)
@@ -3822,8 +4135,8 @@ func TestConn_SetNetworkMap_updateRelayServersSet(t *testing.T) {
 			if !got.Equal(tt.wantRelayServers) {
 				t.Fatalf("got: %v != want: %v", got, tt.wantRelayServers)
 			}
-			if len(tt.wantRelayServers) > 0 != c.hasPeerRelayServers.Load() {
-				t.Fatalf("c.hasPeerRelayServers: %v != len(tt.wantRelayServers) > 0: %v", c.hasPeerRelayServers.Load(), len(tt.wantRelayServers) > 0)
+			if got, want := c.relayManager.hasPeerRelayServers.Load(), len(tt.wantRelayServers) > 0; got != want {
+				t.Fatalf("c.relayManager.hasPeerRelayServers: %v != len(tt.wantRelayServers) > 0: %v", got, want)
 			}
 			if c.relayClientEnabled != tt.wantRelayClientEnabled {
 				t.Fatalf("c.relayClientEnabled: %v != wantRelayClientEnabled: %v", c.relayClientEnabled, tt.wantRelayClientEnabled)
@@ -3903,60 +4216,55 @@ func TestConn_receiveIP(t *testing.T) {
 		// If [*endpoint] then we expect 'got' to be the same [*endpoint]. If
 		// [*lazyEndpoint] and [*lazyEndpoint.maybeEP] is non-nil, we expect
 		// got.maybeEP to also be non-nil. Must not be reused across tests.
-		wantEndpointType           wgconn.Endpoint
-		wantSize                   int
-		wantIsGeneveEncap          bool
-		wantOk                     bool
-		wantMetricInc              *clientmetric.Metric
-		wantNoteRecvActivityCalled bool
+		wantEndpointType  wgconn.Endpoint
+		wantSize          int
+		wantIsGeneveEncap bool
+		wantOk            bool
+		wantMetricInc     *clientmetric.Metric
 	}{
 		{
-			name:                       "naked-disco",
-			b:                          looksLikeNakedDisco,
-			ipp:                        netip.MustParseAddrPort("127.0.0.1:7777"),
-			cache:                      &epAddrEndpointCache{},
-			wantEndpointType:           nil,
-			wantSize:                   0,
-			wantIsGeneveEncap:          false,
-			wantOk:                     false,
-			wantMetricInc:              metricRecvDiscoBadPeer,
-			wantNoteRecvActivityCalled: false,
+			name:              "naked-disco",
+			b:                 looksLikeNakedDisco,
+			ipp:               netip.MustParseAddrPort("127.0.0.1:7777"),
+			cache:             &epAddrEndpointCache{},
+			wantEndpointType:  nil,
+			wantSize:          0,
+			wantIsGeneveEncap: false,
+			wantOk:            false,
+			wantMetricInc:     metricRecvDiscoBadPeer,
 		},
 		{
-			name:                       "geneve-encap-disco",
-			b:                          looksLikeGeneveDisco,
-			ipp:                        netip.MustParseAddrPort("127.0.0.1:7777"),
-			cache:                      &epAddrEndpointCache{},
-			wantEndpointType:           nil,
-			wantSize:                   0,
-			wantIsGeneveEncap:          false,
-			wantOk:                     false,
-			wantMetricInc:              metricRecvDiscoBadPeer,
-			wantNoteRecvActivityCalled: false,
+			name:              "geneve-encap-disco",
+			b:                 looksLikeGeneveDisco,
+			ipp:               netip.MustParseAddrPort("127.0.0.1:7777"),
+			cache:             &epAddrEndpointCache{},
+			wantEndpointType:  nil,
+			wantSize:          0,
+			wantIsGeneveEncap: false,
+			wantOk:            false,
+			wantMetricInc:     metricRecvDiscoBadPeer,
 		},
 		{
-			name:                       "STUN-binding",
-			b:                          looksLikeSTUNBinding,
-			ipp:                        netip.MustParseAddrPort("127.0.0.1:7777"),
-			cache:                      &epAddrEndpointCache{},
-			wantEndpointType:           nil,
-			wantSize:                   0,
-			wantIsGeneveEncap:          false,
-			wantOk:                     false,
-			wantMetricInc:              findMetricByName("netcheck_stun_recv_ipv4"),
-			wantNoteRecvActivityCalled: false,
+			name:              "STUN-binding",
+			b:                 looksLikeSTUNBinding,
+			ipp:               netip.MustParseAddrPort("127.0.0.1:7777"),
+			cache:             &epAddrEndpointCache{},
+			wantEndpointType:  nil,
+			wantSize:          0,
+			wantIsGeneveEncap: false,
+			wantOk:            false,
+			wantMetricInc:     findMetricByName("netcheck_stun_recv_ipv4"),
 		},
 		{
-			name:                       "naked-WireGuard-init-lazyEndpoint-empty-peerMap",
-			b:                          looksLikeNakedWireGuardInit,
-			ipp:                        netip.MustParseAddrPort("127.0.0.1:7777"),
-			cache:                      &epAddrEndpointCache{},
-			wantEndpointType:           &lazyEndpoint{},
-			wantSize:                   len(looksLikeNakedWireGuardInit),
-			wantIsGeneveEncap:          false,
-			wantOk:                     true,
-			wantMetricInc:              nil,
-			wantNoteRecvActivityCalled: false,
+			name:              "naked-WireGuard-init-lazyEndpoint-empty-peerMap",
+			b:                 looksLikeNakedWireGuardInit,
+			ipp:               netip.MustParseAddrPort("127.0.0.1:7777"),
+			cache:             &epAddrEndpointCache{},
+			wantEndpointType:  &lazyEndpoint{},
+			wantSize:          len(looksLikeNakedWireGuardInit),
+			wantIsGeneveEncap: false,
+			wantOk:            true,
+			wantMetricInc:     nil,
 		},
 		{
 			name:                            "naked-WireGuard-init-endpoint-matching-peerMap-entry",
@@ -3970,19 +4278,17 @@ func TestConn_receiveIP(t *testing.T) {
 			wantIsGeneveEncap:               false,
 			wantOk:                          true,
 			wantMetricInc:                   nil,
-			wantNoteRecvActivityCalled:      true,
 		},
 		{
-			name:                       "geneve-WireGuard-init-lazyEndpoint-empty-peerMap",
-			b:                          looksLikeGeneveWireGuardInit,
-			ipp:                        netip.MustParseAddrPort("127.0.0.1:7777"),
-			cache:                      &epAddrEndpointCache{},
-			wantEndpointType:           &lazyEndpoint{},
-			wantSize:                   len(looksLikeGeneveWireGuardInit) - packet.GeneveFixedHeaderLength,
-			wantIsGeneveEncap:          true,
-			wantOk:                     true,
-			wantMetricInc:              nil,
-			wantNoteRecvActivityCalled: false,
+			name:              "geneve-WireGuard-init-lazyEndpoint-empty-peerMap",
+			b:                 looksLikeGeneveWireGuardInit,
+			ipp:               netip.MustParseAddrPort("127.0.0.1:7777"),
+			cache:             &epAddrEndpointCache{},
+			wantEndpointType:  &lazyEndpoint{},
+			wantSize:          len(looksLikeGeneveWireGuardInit) - packet.GeneveFixedHeaderLength,
+			wantIsGeneveEncap: true,
+			wantOk:            true,
+			wantMetricInc:     nil,
 		},
 		{
 			name:                            "geneve-WireGuard-init-lazyEndpoint-matching-peerMap-activity-noted",
@@ -3994,11 +4300,10 @@ func TestConn_receiveIP(t *testing.T) {
 			wantEndpointType: &lazyEndpoint{
 				maybeEP: newPeerMapInsertableEndpoint(0),
 			},
-			wantSize:                   len(looksLikeGeneveWireGuardInit) - packet.GeneveFixedHeaderLength,
-			wantIsGeneveEncap:          true,
-			wantOk:                     true,
-			wantMetricInc:              nil,
-			wantNoteRecvActivityCalled: true,
+			wantSize:          len(looksLikeGeneveWireGuardInit) - packet.GeneveFixedHeaderLength,
+			wantIsGeneveEncap: true,
+			wantOk:            true,
+			wantMetricInc:     nil,
 		},
 		{
 			name:                            "geneve-WireGuard-init-lazyEndpoint-matching-peerMap-no-activity-noted",
@@ -4010,17 +4315,15 @@ func TestConn_receiveIP(t *testing.T) {
 			wantEndpointType: &lazyEndpoint{
 				maybeEP: newPeerMapInsertableEndpoint(mono.Now().Add(time.Hour * 24)),
 			},
-			wantSize:                   len(looksLikeGeneveWireGuardInit) - packet.GeneveFixedHeaderLength,
-			wantIsGeneveEncap:          true,
-			wantOk:                     true,
-			wantMetricInc:              nil,
-			wantNoteRecvActivityCalled: false,
+			wantSize:          len(looksLikeGeneveWireGuardInit) - packet.GeneveFixedHeaderLength,
+			wantIsGeneveEncap: true,
+			wantOk:            true,
+			wantMetricInc:     nil,
 		},
 		// TODO(jwhited): verify cache.de is used when conditions permit
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			noteRecvActivityCalled := false
 			metricBefore := int64(0)
 			if tt.wantMetricInc != nil {
 				metricBefore = tt.wantMetricInc.Value()
@@ -4033,9 +4336,6 @@ func TestConn_receiveIP(t *testing.T) {
 				peerMap:    newPeerMap(),
 			}
 			c.havePrivateKey.Store(true)
-			c.noteRecvActivity = func(public key.NodePublic) {
-				noteRecvActivityCalled = true
-			}
 			var counts netlogtype.CountsByConnection
 			c.SetConnectionCounter(counts.Add)
 
@@ -4090,10 +4390,6 @@ func TestConn_receiveIP(t *testing.T) {
 			if tt.wantMetricInc != nil && tt.wantMetricInc.Value() != metricBefore+1 {
 				t.Errorf("receiveIP() metric %v not incremented", tt.wantMetricInc.Name())
 			}
-			if tt.wantNoteRecvActivityCalled != noteRecvActivityCalled {
-				t.Errorf("receiveIP() noteRecvActivityCalled = %v, want %v", noteRecvActivityCalled, tt.wantNoteRecvActivityCalled)
-			}
-
 			if tt.cache.de != nil {
 				switch ep := got.(type) {
 				case *endpoint:
@@ -4145,34 +4441,29 @@ func TestConn_receiveIP(t *testing.T) {
 
 func Test_lazyEndpoint_InitiationMessagePublicKey(t *testing.T) {
 	tests := []struct {
-		name                       string
-		callWithPeerMapKey         bool
-		maybeEPMatchingKey         bool
-		wantNoteRecvActivityCalled bool
+		name               string
+		callWithPeerMapKey bool
+		maybeEPMatchingKey bool
 	}{
 		{
-			name:                       "noteRecvActivity-called",
-			callWithPeerMapKey:         true,
-			maybeEPMatchingKey:         false,
-			wantNoteRecvActivityCalled: true,
+			name:               "noteRecvActivity-called",
+			callWithPeerMapKey: true,
+			maybeEPMatchingKey: false,
 		},
 		{
-			name:                       "maybeEP-early-return",
-			callWithPeerMapKey:         true,
-			maybeEPMatchingKey:         true,
-			wantNoteRecvActivityCalled: false,
+			name:               "maybeEP-early-return",
+			callWithPeerMapKey: true,
+			maybeEPMatchingKey: true,
 		},
 		{
-			name:                       "not-in-peerMap-early-return",
-			callWithPeerMapKey:         false,
-			maybeEPMatchingKey:         false,
-			wantNoteRecvActivityCalled: false,
+			name:               "not-in-peerMap-early-return",
+			callWithPeerMapKey: false,
+			maybeEPMatchingKey: false,
 		},
 		{
-			name:                       "not-in-peerMap-maybeEP-early-return",
-			callWithPeerMapKey:         false,
-			maybeEPMatchingKey:         true,
-			wantNoteRecvActivityCalled: false,
+			name:               "not-in-peerMap-maybeEP-early-return",
+			callWithPeerMapKey: false,
+			maybeEPMatchingKey: true,
 		},
 	}
 	for _, tt := range tests {
@@ -4185,19 +4476,7 @@ func Test_lazyEndpoint_InitiationMessagePublicKey(t *testing.T) {
 				key: key.NewDisco().Public(),
 			})
 
-			var noteRecvActivityCalledFor key.NodePublic
 			conn := newConn(t.Logf)
-			conn.noteRecvActivity = func(public key.NodePublic) {
-				// wireguard-go will call into ParseEndpoint if the "real"
-				// noteRecvActivity ends up JIT configuring the peer. Mimic that
-				// to ensure there are no deadlocks around conn.mu.
-				// See tailscale/tailscale#16651 & http://go/corp#30836
-				_, err := conn.ParseEndpoint(ep.publicKey.UntypedHexString())
-				if err != nil {
-					t.Fatalf("ParseEndpoint() err: %v", err)
-				}
-				noteRecvActivityCalledFor = public
-			}
 			ep.c = conn
 
 			var pubKey [32]byte
@@ -4213,13 +4492,6 @@ func Test_lazyEndpoint_InitiationMessagePublicKey(t *testing.T) {
 				le.maybeEP = ep
 			}
 			le.InitiationMessagePublicKey(pubKey)
-			want := key.NodePublic{}
-			if tt.wantNoteRecvActivityCalled {
-				want = ep.publicKey
-			}
-			if noteRecvActivityCalledFor.Compare(want) != 0 {
-				t.Fatalf("noteRecvActivityCalledFor = %v, want %v", noteRecvActivityCalledFor, want)
-			}
 		})
 	}
 }
@@ -4367,55 +4639,85 @@ func TestRotateDiscoKeyMultipleTimes(t *testing.T) {
 }
 
 func TestReceiveTSMPDiscoKeyAdvertisement(t *testing.T) {
-	conn := newTestConn(t)
-	t.Cleanup(func() { conn.Close() })
-
-	peerKey := key.NewNode().Public()
-	ep := &endpoint{
-		nodeID:    1,
-		publicKey: peerKey,
-		nodeAddr:  netip.MustParseAddr("100.64.0.1"),
-	}
-	discoKey := key.NewDisco().Public()
-	ep.disco.Store(&endpointDisco{
-		key:   discoKey,
-		short: discoKey.ShortString(),
-	})
-	ep.c = conn
-	conn.mu.Lock()
-	nodeView := (&tailcfg.Node{
-		Key: ep.publicKey,
-		Addresses: []netip.Prefix{
-			netip.MustParsePrefix("100.64.0.1/32"),
+	tests := []struct {
+		name       string
+		newKeyFunc func() key.DiscoPublic
+		wantUpdate bool
+	}{
+		{
+			name:       "normal_key_change",
+			newKeyFunc: key.NewDisco().Public,
+			wantUpdate: true,
+		},
+		{
+			name: "zero_key_change",
+			newKeyFunc: func() key.DiscoPublic {
+				return key.DiscoPublic{}
+			},
+			wantUpdate: false,
 		},
-	}).View()
-	conn.peers = views.SliceOf([]tailcfg.NodeView{nodeView})
-	conn.mu.Unlock()
-
-	conn.peerMap.upsertEndpoint(ep, key.DiscoPublic{})
-
-	if ep.discoShort() != discoKey.ShortString() {
-		t.Errorf("Original disco key %s, does not match %s", discoKey.ShortString(), ep.discoShort())
 	}
 
-	newDiscoKey := key.NewDisco().Public()
-	tka := packet.TSMPDiscoKeyAdvertisement{
-		Src: netip.MustParseAddr("100.64.0.1"),
-		Key: newDiscoKey,
-	}
-	conn.HandleDiscoKeyAdvertisement(nodeView, tka)
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			conn := newTestConn(t)
+			t.Cleanup(func() { conn.Close() })
 
-	if ep.disco.Load().short != newDiscoKey.ShortString() {
-		t.Errorf("New disco key %s, does not match %s", newDiscoKey.ShortString(), ep.disco.Load().short)
+			peerKey := key.NewNode().Public()
+			ep := &endpoint{
+				nodeID:    1,
+				publicKey: peerKey,
+				nodeAddr:  netip.MustParseAddr("100.64.0.1"),
+			}
+			discoKey := key.NewDisco().Public()
+			ep.disco.Store(&endpointDisco{
+				key:   discoKey,
+				short: discoKey.ShortString(),
+			})
+			ep.c = conn
+			conn.mu.Lock()
+			nodeView := (&tailcfg.Node{
+				Key: ep.publicKey,
+				Addresses: []netip.Prefix{
+					netip.MustParsePrefix("100.64.0.1/32"),
+				},
+			}).View()
+			conn.peersByID = map[tailcfg.NodeID]tailcfg.NodeView{nodeView.ID(): nodeView}
+			conn.mu.Unlock()
+
+			conn.peerMap.upsertEndpoint(ep, key.DiscoPublic{})
+
+			if ep.discoShort() != discoKey.ShortString() {
+				t.Errorf("Original disco key %s, does not match %s", discoKey.ShortString(), ep.discoShort())
+			}
+
+			newDiscoKey := tt.newKeyFunc()
+			tka := packet.TSMPDiscoKeyAdvertisement{
+				Src: netip.MustParseAddr("100.64.0.1"),
+				Key: newDiscoKey,
+			}
+			conn.HandleDiscoKeyAdvertisement(nodeView, tka)
+			wantDiscoKey := discoKey
+			if tt.wantUpdate {
+				wantDiscoKey = newDiscoKey
+			}
+
+			if ep.disco.Load().short != wantDiscoKey.ShortString() {
+				t.Errorf("New disco key %s, does not match %s", newDiscoKey.ShortString(), ep.disco.Load().short)
+			}
+		})
 	}
 }
 
 func TestSendingTSMPDiscoTimer(t *testing.T) {
-	t.Setenv("TS_USE_CACHED_NETMAP", "1")
 	conn := newTestConn(t)
 	tw := eventbustest.NewWatcher(t, conn.eventBus)
 	t.Cleanup(func() { conn.Close() })
 
+	// maybeSendTSMPDiscoAdvert only advertises when netmap caching is enabled.
+	conn.controlKnobs = new(controlknobs.Knobs)
+	conn.controlKnobs.CacheNetworkMaps.Store(true)
+
 	peerKey := key.NewNode().Public()
 	ep := &endpoint{
 		nodeID:    1,
@@ -4435,7 +4737,7 @@ func TestSendingTSMPDiscoTimer(t *testing.T) {
 			netip.MustParsePrefix("100.64.0.1/32"),
 		},
 	}).View()
-	conn.peers = views.SliceOf([]tailcfg.NodeView{nodeView})
+	conn.peersByID = map[tailcfg.NodeID]tailcfg.NodeView{nodeView.ID(): nodeView}
 	conn.mu.Unlock()
 
 	conn.peerMap.upsertEndpoint(ep, key.DiscoPublic{})
@@ -4444,12 +4746,135 @@ func TestSendingTSMPDiscoTimer(t *testing.T) {
 		t.Errorf("Original disco key %s, does not match %s", discoKey.ShortString(), ep.discoShort())
 	}
 
+	// Only one gets through, second is rate limited.
 	conn.maybeSendTSMPDiscoAdvert(ep)
 	conn.maybeSendTSMPDiscoAdvert(ep)
-	eventbustest.ExpectExactly(tw, eventbustest.Type[NewDiscoKeyAvailable]())
+	if err := eventbustest.ExpectExactly(tw, eventbustest.Type[NewDiscoKeyAvailable]()); err != nil {
+		t.Errorf("expected only one event, got: %s", err)
+	}
+
+	// Reset to get the event firing again.
 	ep.mu.Lock()
 	ep.lastDiscoKeyAdvertisement = 0
 	ep.mu.Unlock()
 	conn.maybeSendTSMPDiscoAdvert(ep)
-	eventbustest.Expect(tw, eventbustest.Type[NewDiscoKeyAvailable]())
+	if err := eventbustest.Expect(tw, eventbustest.Type[NewDiscoKeyAvailable]()); err != nil {
+		t.Errorf("expected only one event, got: %s", err)
+	}
+
+	// With a direct bestAddr and a non-zero lastDiscoKeyAdvertisement past the
+	// rate-limit interval. No advert should be sent due to the active bestAddr.
+	ep.mu.Lock()
+	ep.lastDiscoKeyAdvertisement = mono.Now().Add(-discoKeyAdvertisementInterval - time.Second)
+	ep.bestAddr = addrQuality{epAddr: epAddr{ap: netip.MustParseAddrPort("1.2.3.4:567")}}
+	ep.mu.Unlock()
+	conn.maybeSendTSMPDiscoAdvert(ep)
+
+	// Simulating restart should send an advert.
+	ep.mu.Lock()
+	ep.lastDiscoKeyAdvertisement = 0
+	ep.mu.Unlock()
+	conn.maybeSendTSMPDiscoAdvert(ep)
+	if err := eventbustest.ExpectExactly(tw, eventbustest.Type[NewDiscoKeyAvailable]()); err != nil {
+		t.Errorf("expected only one event, got: %s", err)
+	}
+}
+
+// TestSendingTSMPDiscoCachingDisabled verifies that maybeSendTSMPDiscoAdvert
+// early-returns (sends no advert) when netmap caching is not enabled via the
+// CacheNetworkMaps control knob, including when no knobs are present at all.
+func TestSendingTSMPDiscoCachingDisabled(t *testing.T) {
+	tests := []struct {
+		name  string
+		knobs *controlknobs.Knobs
+	}{
+		{name: "no-knobs", knobs: nil},
+		// Knobs present but CacheNetworkMaps left at its false default.
+		{name: "caching-disabled", knobs: new(controlknobs.Knobs)},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			conn := newTestConn(t)
+			t.Cleanup(func() { conn.Close() })
+			conn.controlKnobs = tt.knobs
+
+			ep := &endpoint{
+				nodeID:    1,
+				publicKey: key.NewNode().Public(),
+				nodeAddr:  netip.MustParseAddr("100.64.0.1"),
+			}
+			ep.c = conn
+
+			// A fresh endpoint with a zero lastDiscoKeyAdvertisement and no
+			// direct bestAddr would otherwise advertise; the only thing
+			// suppressing it here is the disabled caching knob. On early
+			// return the timestamp is left untouched (zero).
+			conn.maybeSendTSMPDiscoAdvert(ep)
+
+			ep.mu.Lock()
+			defer ep.mu.Unlock()
+			if !ep.lastDiscoKeyAdvertisement.IsZero() {
+				t.Errorf("lastDiscoKeyAdvertisement = %v; want zero (advert should have been suppressed)", ep.lastDiscoKeyAdvertisement)
+			}
+		})
+	}
+}
+
+// TestSendingTSMPDiscoPeerRelaySuppressed verifies that maybeSendTSMPDiscoAdvert
+// suppresses the advert when the bestAddr is a peer relay path (a non-zero
+// addrQuality whose epAddr has a VNI set), even though such a path is not
+// direct. Suppression is observed via lastDiscoKeyAdvertisement remaining
+// unchanged, since a fired advert would overwrite it with the current time.
+func TestSendingTSMPDiscoPeerRelaySuppressed(t *testing.T) {
+	conn := newTestConn(t)
+	t.Cleanup(func() { conn.Close() })
+
+	// maybeSendTSMPDiscoAdvert only advertises when netmap caching is enabled.
+	conn.controlKnobs = new(controlknobs.Knobs)
+	conn.controlKnobs.CacheNetworkMaps.Store(true)
+
+	peerKey := key.NewNode().Public()
+	ep := &endpoint{
+		nodeID:    1,
+		publicKey: peerKey,
+		nodeAddr:  netip.MustParseAddr("100.64.0.1"),
+	}
+	discoKey := key.NewDisco().Public()
+	ep.disco.Store(&endpointDisco{
+		key:   discoKey,
+		short: discoKey.ShortString(),
+	})
+	ep.c = conn
+	conn.mu.Lock()
+	nodeView := (&tailcfg.Node{
+		Key: ep.publicKey,
+		Addresses: []netip.Prefix{
+			netip.MustParsePrefix("100.64.0.1/32"),
+		},
+	}).View()
+	conn.peersByID = map[tailcfg.NodeID]tailcfg.NodeView{nodeView.ID(): nodeView}
+	conn.mu.Unlock()
+
+	conn.peerMap.upsertEndpoint(ep, key.DiscoPublic{})
+
+	// A peer relay bestAddr: an epAddr with a VNI set. It is past the
+	// rate-limit interval with a non-zero lastDiscoKeyAdvertisement, so the
+	// only thing suppressing the advert is the active (non-zero) bestAddr.
+	var vni packet.VirtualNetworkID
+	vni.Set(7)
+	lastAdvert := mono.Now().Add(-discoKeyAdvertisementInterval - time.Second)
+	ep.mu.Lock()
+	ep.lastDiscoKeyAdvertisement = lastAdvert
+	ep.bestAddr = addrQuality{epAddr: epAddr{ap: netip.MustParseAddrPort("1.2.3.4:567"), vni: vni}}
+	ep.mu.Unlock()
+
+	conn.maybeSendTSMPDiscoAdvert(ep)
+
+	// A fired advert would have overwritten lastDiscoKeyAdvertisement with the
+	// current time; confirm it was left untouched, indicating suppression.
+	ep.mu.Lock()
+	defer ep.mu.Unlock()
+	if ep.lastDiscoKeyAdvertisement != lastAdvert {
+		t.Errorf("lastDiscoKeyAdvertisement = %v; want unchanged %v (advert should have been suppressed)", ep.lastDiscoKeyAdvertisement, lastAdvert)
+	}
 }
diff --git a/wgengine/magicsock/peermap.go b/wgengine/magicsock/peermap.go
index b6e9b08a3..37f7b07eb 100644
--- a/wgengine/magicsock/peermap.go
+++ b/wgengine/magicsock/peermap.go
@@ -151,7 +151,11 @@ func (m *peerMap) upsertEndpoint(ep *endpoint, oldDiscoKey key.DiscoPublic) {
 
 	epDisco := ep.disco.Load()
 	if epDisco == nil || oldDiscoKey != epDisco.key {
-		delete(m.nodesOfDisco[oldDiscoKey], ep.publicKey)
+		s := m.nodesOfDisco[oldDiscoKey]
+		delete(s, ep.publicKey)
+		if len(s) == 0 {
+			delete(m.nodesOfDisco, oldDiscoKey)
+		}
 	}
 	if ep.isWireguardOnly {
 		// If the peer is a WireGuard only peer, add all of its endpoints.
@@ -214,7 +218,11 @@ func (m *peerMap) deleteEndpoint(ep *endpoint) {
 
 	pi := m.byNodeKey[ep.publicKey]
 	if epDisco != nil {
-		delete(m.nodesOfDisco[epDisco.key], ep.publicKey)
+		s := m.nodesOfDisco[epDisco.key]
+		delete(s, ep.publicKey)
+		if len(s) == 0 {
+			delete(m.nodesOfDisco, epDisco.key)
+		}
 	}
 	delete(m.byNodeKey, ep.publicKey)
 	if was, ok := m.byNodeID[ep.nodeID]; ok && was.ep == ep {
diff --git a/wgengine/magicsock/peermap_test.go b/wgengine/magicsock/peermap_test.go
index 7fcd09384..aaaa7e991 100644
--- a/wgengine/magicsock/peermap_test.go
+++ b/wgengine/magicsock/peermap_test.go
@@ -35,3 +35,100 @@ func Test_peerMap_oneRelayEpAddrPerNK(t *testing.T) {
 		t.Fatalf("expected relay epAddr %v, got: %v", relayEpAddrB, got)
 	}
 }
+
+func Test_peerMap_nodesOfDisco_upsertCleansOldKey(t *testing.T) {
+	pm := newPeerMap()
+	nk := key.NewNode().Public()
+	discoK1 := key.NewDisco().Public()
+	discoK2 := key.NewDisco().Public()
+
+	ep := &endpoint{nodeID: 1, publicKey: nk}
+	ep.disco.Store(&endpointDisco{key: discoK1})
+	pm.upsertEndpoint(ep, key.DiscoPublic{}) // insert with K1
+
+	if !pm.knownPeerDiscoKey(discoK1) {
+		t.Fatal("expected K1 to be known after initial upsert")
+	}
+
+	// Rotate disco
+	ep.disco.Store(&endpointDisco{key: discoK2})
+	pm.upsertEndpoint(ep, discoK1)
+
+	if pm.knownPeerDiscoKey(discoK1) {
+		t.Error("old disco key K1 is still known after rotation")
+	}
+	if old, ok := pm.nodesOfDisco[discoK1]; ok {
+		t.Errorf("old disco key K1 should be absent from nodesOfDisco, but entry %v remains", old)
+	}
+	if !pm.knownPeerDiscoKey(discoK2) {
+		t.Error("new disco key K2 should be known after rotation")
+	}
+}
+
+func Test_peerMap_nodesOfDisco_deleteCleansKey(t *testing.T) {
+	pm := newPeerMap()
+	nk := key.NewNode().Public()
+	dk := key.NewDisco().Public()
+
+	conn := newTestConn(t)
+	ep := &endpoint{
+		nodeID:        1,
+		publicKey:     nk,
+		c:             conn,
+		endpointState: map[netip.AddrPort]*endpointState{},
+	}
+	ep.disco.Store(&endpointDisco{key: dk})
+	pm.upsertEndpoint(ep, key.DiscoPublic{})
+
+	if !pm.knownPeerDiscoKey(dk) {
+		t.Fatal("expected disco key to be known after upsert")
+	}
+
+	pm.deleteEndpoint(ep)
+
+	if pm.knownPeerDiscoKey(dk) {
+		t.Error("disco key is still known after deletion")
+	}
+	if s, ok := pm.nodesOfDisco[dk]; ok {
+		t.Errorf("nodesOfDisco for deleted key: found %v, want absent", s)
+	}
+}
+
+func Test_peerMap_nodesOfDisco_sharedDiscoKey(t *testing.T) {
+	pm := newPeerMap()
+	nk1 := key.NewNode().Public()
+	nk2 := key.NewNode().Public()
+	dk := key.NewDisco().Public()
+
+	conn := newTestConn(t)
+
+	ep1 := &endpoint{
+		nodeID:        1,
+		publicKey:     nk1,
+		c:             conn,
+		endpointState: map[netip.AddrPort]*endpointState{},
+	}
+	ep1.disco.Store(&endpointDisco{key: dk})
+	pm.upsertEndpoint(ep1, key.DiscoPublic{})
+
+	ep2 := &endpoint{
+		nodeID:        2,
+		publicKey:     nk2,
+		c:             conn,
+		endpointState: map[netip.AddrPort]*endpointState{},
+	}
+	ep2.disco.Store(&endpointDisco{key: dk})
+	pm.upsertEndpoint(ep2, key.DiscoPublic{})
+
+	pm.deleteEndpoint(ep1)
+
+	if !pm.knownPeerDiscoKey(dk) {
+		t.Error("shared disco key should still be known after one of two peers is removed")
+	}
+
+	pm.deleteEndpoint(ep2)
+
+	if pm.knownPeerDiscoKey(dk) {
+		t.Error("disco key should be unknown after both peers removed")
+	}
+}
diff --git a/wgengine/magicsock/rebinding_conn.go b/wgengine/magicsock/rebinding_conn.go
index 11398c592..c361a6b09 100644
--- a/wgengine/magicsock/rebinding_conn.go
+++ b/wgengine/magicsock/rebinding_conn.go
@@ -12,6 +12,7 @@ import (
 	"syscall"
 
 	"golang.org/x/net/ipv6"
+	"tailscale.com/control/controlknobs"
 	"tailscale.com/net/batching"
 	"tailscale.com/net/netaddr"
 	"tailscale.com/net/packet"
@@ -41,9 +42,9 @@ type RebindingUDPConn struct {
 // nettype.PacketConn to a batchingConn when appropriate. This upgrade is
 // intentionally pushed closest to where read/write ops occur in order to avoid
 // disrupting surrounding code that assumes nettype.PacketConn is a
-// *net.UDPConn.
-func (c *RebindingUDPConn) setConnLocked(p nettype.PacketConn, network string, batchSize int) {
-	upc := batching.TryUpgradeToConn(p, network, batchSize, "magicsock_udp_rxq_overflows")
+// *net.UDPConn. knobs may be nil.
+func (c *RebindingUDPConn) setConnLocked(p nettype.PacketConn, network string, batchSize int, knobs *controlknobs.Knobs) {
+	upc := batching.TryUpgradeToConn(p, network, batchSize, "magicsock_udp_rxq_overflows", knobs)
 	c.pconn = upc
 	c.pconnAtomic.Store(&upc)
 	c.port = uint16(c.localAddrLocked().Port)
diff --git a/wgengine/magicsock/relaymanager.go b/wgengine/magicsock/relaymanager.go
index e4cd5eb9f..3be23b6ed 100644
--- a/wgengine/magicsock/relaymanager.go
+++ b/wgengine/magicsock/relaymanager.go
@@ -9,6 +9,7 @@ import (
 	"fmt"
 	"net/netip"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	"tailscale.com/disco"
@@ -34,6 +35,14 @@ import (
 type relayManager struct {
 	initOnce sync.Once
 
+	// hasPeerRelayServers is whether relayManager is configured with at
+	// least one peer relay server via [relayManager.handleRelayServersSet]
+	// (or per-peer variants). Exposed as an atomic so [endpoint] hot paths
+	// can short-circuit when there are no relay servers without taking any
+	// lock or entering the run loop. Written only from runLoop() via
+	// [relayManager.publishHasServersRunLoop].
+	hasPeerRelayServers atomic.Bool
+
 	// ===================================================================
 	// The following fields are owned by a single goroutine, runLoop().
 	serversByNodeKey                        map[key.NodePublic]candidatePeerRelay
@@ -56,6 +65,8 @@ type relayManager struct {
 	newServerEndpointCh chan newRelayServerEndpointEvent
 	rxDiscoMsgCh        chan relayDiscoMsgEvent
 	serversCh           chan set.Set[candidatePeerRelay]
+	serverUpsertCh      chan candidatePeerRelay
+	serverRemoveCh      chan key.NodePublic
 	getServersCh        chan chan set.Set[candidatePeerRelay]
 	derpHomeChangeCh    chan derpHomeChangeEvent
 
@@ -228,6 +239,16 @@ func (r *relayManager) runLoop() {
 			if !r.hasActiveWorkRunLoop() {
 				return
 			}
+		case upsert := <-r.serverUpsertCh:
+			r.handleServerUpsertRunLoop(upsert)
+			if !r.hasActiveWorkRunLoop() {
+				return
+			}
+		case nk := <-r.serverRemoveCh:
+			r.handleServerRemoveRunLoop(nk)
+			if !r.hasActiveWorkRunLoop() {
+				return
+			}
 		case getServersCh := <-r.getServersCh:
 			r.handleGetServersRunLoop(getServersCh)
 			if !r.hasActiveWorkRunLoop() {
@@ -265,6 +286,34 @@ func (r *relayManager) handleServersUpdateRunLoop(update set.Set[candidatePeerRe
 	for _, v := range update.Slice() {
 		r.serversByNodeKey[v.nodeKey] = v
 	}
+	r.publishHasServersRunLoop()
+}
+
+// handleServerUpsertRunLoop inserts or updates cp in serversByNodeKey. It is
+// the per-peer analog of [relayManager.handleServersUpdateRunLoop] used by
+// [Conn.UpsertPeer].
+func (r *relayManager) handleServerUpsertRunLoop(cp candidatePeerRelay) {
+	r.serversByNodeKey[cp.nodeKey] = cp
+	r.publishHasServersRunLoop()
+}
+
+// handleServerRemoveRunLoop deletes nk from serversByNodeKey. It is a no-op
+// if nk isn't currently a known server. It is the per-peer analog of
+// [relayManager.handleServersUpdateRunLoop] used by [Conn.RemovePeer] and by
+// [Conn.UpsertPeer] when a peer is upserted with fields that make it no
+// longer a relay candidate.
+func (r *relayManager) handleServerRemoveRunLoop(nk key.NodePublic) {
+	if _, ok := r.serversByNodeKey[nk]; !ok {
+		return
+	}
+	delete(r.serversByNodeKey, nk)
+	r.publishHasServersRunLoop()
+}
+
+// publishHasServersRunLoop updates [relayManager.hasPeerRelayServers] to
+// reflect whether any relay servers are currently known.
+func (r *relayManager) publishHasServersRunLoop() {
+	r.hasPeerRelayServers.Store(len(r.serversByNodeKey) > 0)
 }
 
 type relayDiscoMsgEvent struct {
@@ -330,6 +379,8 @@ func (r *relayManager) init() {
 		r.newServerEndpointCh = make(chan newRelayServerEndpointEvent)
 		r.rxDiscoMsgCh = make(chan relayDiscoMsgEvent)
 		r.serversCh = make(chan set.Set[candidatePeerRelay])
+		r.serverUpsertCh = make(chan candidatePeerRelay)
+		r.serverRemoveCh = make(chan key.NodePublic)
 		r.getServersCh = make(chan chan set.Set[candidatePeerRelay])
 		r.derpHomeChangeCh = make(chan derpHomeChangeEvent)
 		r.runLoopStoppedCh = make(chan struct{}, 1)
@@ -436,6 +487,21 @@ func (r *relayManager) handleRelayServersSet(servers set.Set[candidatePeerRelay]
 	relayManagerInputEvent(r, nil, &r.serversCh, servers)
 }
 
+// handleRelayServerUpsert is the O(1) per-peer variant of
+// [relayManager.handleRelayServersSet]: it inserts or updates a single
+// relay server entry.
+func (r *relayManager) handleRelayServerUpsert(cp candidatePeerRelay) {
+	relayManagerInputEvent(r, nil, &r.serverUpsertCh, cp)
+}
+
+// handleRelayServerRemove is the O(1) per-peer variant of
+// [relayManager.handleRelayServersSet]: it removes a single relay server
+// entry by node key. It is a no-op if nk is not currently a known relay
+// server.
+func (r *relayManager) handleRelayServerRemove(nk key.NodePublic) {
+	relayManagerInputEvent(r, nil, &r.serverRemoveCh, nk)
+}
+
 // relayManagerInputEvent initializes [relayManager] if necessary, starts
 // relayManager.runLoop() if it is not running, and writes 'event' on 'eventCh'.
 //
@@ -724,8 +790,10 @@ func (r *relayManager) handleNewServerEndpointRunLoop(newServerEndpoint newRelay
 		go r.sendCallMeMaybeVia(newServerEndpoint.wlb.ep, newServerEndpoint.se)
 	}
 
-	lastBestMatchingServer := newServerEndpoint.se.ServerDisco.Compare(newServerEndpoint.wlb.lastBest.relayServerDisco) == 0
-	if lastBestMatchingServer && newServerEndpoint.wlb.lastBestIsTrusted {
+	lastBestMatchingServerVNI := newServerEndpoint.wlb.lastBest.vni.IsSet() &&
+		newServerEndpoint.se.ServerDisco.Compare(newServerEndpoint.wlb.lastBest.relayServerDisco) == 0 &&
+		newServerEndpoint.se.VNI == newServerEndpoint.wlb.lastBest.vni.Get()
+	if lastBestMatchingServerVNI && newServerEndpoint.wlb.lastBestIsTrusted {
 		// This relay server endpoint is the same as [endpoint]'s bestAddr at
 		// the time UDP relay path discovery was started, and it was also a
 		// trusted path (see endpoint.trustBestAddrUntil), so return early.
diff --git a/wgengine/magicsock/relaymanager_test.go b/wgengine/magicsock/relaymanager_test.go
index 47d935404..cf07e4210 100644
--- a/wgengine/magicsock/relaymanager_test.go
+++ b/wgengine/magicsock/relaymanager_test.go
@@ -109,12 +109,36 @@ func TestRelayManager_handleNewServerEndpointRunLoop(t *testing.T) {
 	serverDiscoA := key.NewDisco().Public()
 	serverDiscoB := key.NewDisco().Public()
 
+	// getAddrQuality returns an addrQuality with serverDisco with the provided
+	// VNI set. A negative vni leaves the VNI unset.
+	getAddrQuality := func(serverDisco key.DiscoPublic, vni int) addrQuality {
+		aq := addrQuality{relayServerDisco: serverDisco}
+		if vni >= 0 {
+			aq.epAddr.vni.Set(uint32(vni))
+		}
+		return aq
+	}
+
 	serverAendpointALamport1VNI1 := newRelayServerEndpointEvent{
 		wlb: endpointWithLastBest{ep: epA},
 		se:  udprelay.ServerEndpoint{ServerDisco: serverDiscoA, LamportID: 1, VNI: 1},
 	}
+	// lastBest matches the new server endpoint on both server disco and VNI, and
+	// is trusted: suppression should fire.
 	serverAendpointALamport1VNI1LastBestMatching := newRelayServerEndpointEvent{
-		wlb: endpointWithLastBest{ep: epA, lastBestIsTrusted: true, lastBest: addrQuality{relayServerDisco: serverDiscoA}},
+		wlb: endpointWithLastBest{ep: epA, lastBestIsTrusted: true, lastBest: getAddrQuality(serverDiscoA, 1)},
+		se:  udprelay.ServerEndpoint{ServerDisco: serverDiscoA, LamportID: 1, VNI: 1},
+	}
+	// lastBest matches the new server endpoint on server disco but NOT VNI (1 vs
+	// 2), and is trusted: suppression should NOT fire.
+	serverAendpointALamport1VNI1LastBestMatchingServerNeqVNI := newRelayServerEndpointEvent{
+		wlb: endpointWithLastBest{ep: epA, lastBestIsTrusted: true, lastBest: getAddrQuality(serverDiscoA, 2)},
+		se:  udprelay.ServerEndpoint{ServerDisco: serverDiscoA, LamportID: 1, VNI: 1},
+	}
+	// lastBest matches the new server endpoint on server disco, is trusted, but
+	// has no VNI set: suppression should NOT fire.
+	serverAendpointALamport1VNI1LastBestMatchingServerUnsetVNI := newRelayServerEndpointEvent{
+		wlb: endpointWithLastBest{ep: epA, lastBestIsTrusted: true, lastBest: getAddrQuality(serverDiscoA, -1)},
 		se:  udprelay.ServerEndpoint{ServerDisco: serverDiscoA, LamportID: 1, VNI: 1},
 	}
 	serverAendpointALamport2VNI1 := newRelayServerEndpointEvent{
@@ -212,12 +236,38 @@ func TestRelayManager_handleNewServerEndpointRunLoop(t *testing.T) {
 			},
 		},
 		{
-			name: "trusted-last-best-with-matching-server",
+			// Trusted lastBest matching on both server disco and VNI suppresses
+			// the new handshake.
+			name: "trusted-last-best-matching-server-and-vni",
 			events: []newRelayServerEndpointEvent{
 				serverAendpointALamport1VNI1LastBestMatching,
 			},
 			want: []newRelayServerEndpointEvent{},
 		},
+		{
+			// Trusted lastBest matching on server disco but NOT VNI must not
+			// suppress the new handshake, otherwise we may never handshake a new
+			// peer relay server endpoint around remote client restarts and/or
+			// disco key rotation (#20215).
+			name: "trusted-last-best-matching-server-neq-vni",
+			events: []newRelayServerEndpointEvent{
+				serverAendpointALamport1VNI1LastBestMatchingServerNeqVNI,
+			},
+			want: []newRelayServerEndpointEvent{
+				serverAendpointALamport1VNI1LastBestMatchingServerNeqVNI,
+			},
+		},
+		{
+			// Trusted lastBest matching on server disco with an unset VNI must
+			// not suppress the new handshake.
+			name: "trusted-last-best-matching-server-unset-vni",
+			events: []newRelayServerEndpointEvent{
+				serverAendpointALamport1VNI1LastBestMatchingServerUnsetVNI,
+			},
+			want: []newRelayServerEndpointEvent{
+				serverAendpointALamport1VNI1LastBestMatchingServerUnsetVNI,
+			},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
diff --git a/wgengine/netlog/netlog.go b/wgengine/netlog/netlog.go
index e03a520f2..2da0c5d31 100644
--- a/wgengine/netlog/netlog.go
+++ b/wgengine/netlog/netlog.go
@@ -24,12 +24,12 @@ import (
 	"tailscale.com/net/sockstats"
 	"tailscale.com/net/tsaddr"
 	"tailscale.com/syncs"
+	"tailscale.com/tailcfg"
 	"tailscale.com/types/ipproto"
 	"tailscale.com/types/logger"
 	"tailscale.com/types/logid"
 	"tailscale.com/types/netlogfunc"
 	"tailscale.com/types/netlogtype"
-	"tailscale.com/types/netmap"
 	"tailscale.com/util/eventbus"
 	"tailscale.com/util/set"
 	"tailscale.com/wgengine/router"
@@ -51,6 +51,19 @@ type noopDevice struct{}
 
 func (noopDevice) SetConnectionCounter(netlogfunc.ConnectionCounter) {}
 
+// NodeSource provides node lookups for the network logger.
+// Methods may be called concurrently.
+type NodeSource interface {
+	// SelfNode returns the local node and its owning user profile.
+	// Both views may be invalid if no self node is known yet.
+	SelfNode() (node tailcfg.NodeView, user tailcfg.UserProfileView)
+
+	// NodeByAddr returns the node assigned the given address along with
+	// its owning user profile.
+	// ok is false if no node is known to own addr.
+	NodeByAddr(addr netip.Addr) (node tailcfg.NodeView, user tailcfg.UserProfileView, ok bool)
+}
+
 // Logger logs statistics about every connection.
 // At present, it only logs connections within a tailscale network.
 // By default, exit node traffic is not logged for privacy reasons
@@ -69,10 +82,8 @@ type Logger struct {
 	recordsChan chan record // set to nil when shutdown
 	flushTimer  *time.Timer // fires when record should flush to recordsChan
 
-	// Information about Tailscale nodes.
-	// These are read-only once updated by ReconfigNetworkMap.
-	selfNode nodeUser
-	allNodes map[netip.Addr]nodeUser // includes selfNode; nodeUser values are always valid
+	// source provides node lookups. Set by Startup, cleared by shutdownLocked.
+	source NodeSource
 
 	// Information about routes.
 	// These are read-only once updated by ReconfigRoutes.
@@ -115,14 +126,20 @@ var testClient *http.Client
 // The sock is used to populated the PhysicalTraffic field in [netlogtype.Message].
 //
 // The netMon parameter is optional; if non-nil it's used to do faster interface lookups.
-func (nl *Logger) Startup(logf logger.Logf, nm *netmap.NetworkMap, nodeLogID, domainLogID logid.PrivateID, tun, sock Device, netMon *netmon.Monitor, health *health.Tracker, bus *eventbus.Bus, logExitFlowEnabledEnabled bool) error {
+//
+// source provides on-demand node lookups for connections seen by the logger.
+// It must be non-nil.
+func (nl *Logger) Startup(logf logger.Logf, source NodeSource, nodeLogID, domainLogID logid.PrivateID, tun, sock Device, netMon *netmon.Monitor, health *health.Tracker, bus *eventbus.Bus, logExitFlowEnabledEnabled bool) error {
 	nl.mu.Lock()
 	defer nl.mu.Unlock()
 
 	if nl.shutdownLocked != nil {
 		return fmt.Errorf("network logger already running")
 	}
-	nl.selfNode, nl.allNodes = makeNodeMaps(nm)
+	if source == nil {
+		return fmt.Errorf("network logger requires a non-nil NodeSource")
+	}
+	nl.source = source
 
 	// Startup a log stream to Tailscale's logging service.
 	if logf == nil {
@@ -194,8 +211,7 @@ func (nl *Logger) Startup(logf logger.Logf, nm *netmap.NetworkMap, nodeLogID, do
 
 		// Purge state.
 		nl.shutdownLocked = nil
-		nl.selfNode = nodeUser{}
-		nl.allNodes = nil
+		nl.source = nil
 		nl.routeAddrs = nil
 		nl.routePrefixes = nil
 
@@ -249,15 +265,15 @@ func (nl *Logger) addNewVirtConnLocked(c netlogtype.Connection) connType {
 	var srcNodeLen, dstNodeLen int
 	srcNode, srcSeen := nl.record.seenNodes[c.Src.Addr()]
 	if !srcSeen {
-		srcNode = nl.allNodes[c.Src.Addr()]
-		if srcNode.Valid() {
+		if node, user, ok := nl.source.NodeByAddr(c.Src.Addr()); ok {
+			srcNode = nodeUser{node, user}
 			srcNodeLen = srcNode.jsonLen()
 		}
 	}
 	dstNode, dstSeen := nl.record.seenNodes[c.Dst.Addr()]
 	if !dstSeen {
-		dstNode = nl.allNodes[c.Dst.Addr()]
-		if dstNode.Valid() {
+		if node, user, ok := nl.source.NodeByAddr(c.Dst.Addr()); ok {
+			dstNode = nodeUser{node, user}
 			dstNodeLen = dstNode.jsonLen()
 		}
 	}
@@ -279,12 +295,10 @@ func (nl *Logger) addNewVirtConnLocked(c netlogtype.Connection) connType {
 	nl.recordLen += netlogtype.MaxConnectionCountsJSONSize + srcNodeLen + dstNodeLen
 
 	// Classify the traffic type.
-	var srcIsSelfNode bool
-	if nl.selfNode.Valid() {
-		srcIsSelfNode = nl.selfNode.Addresses().ContainsFunc(func(p netip.Prefix) bool {
-			return c.Src.Addr() == p.Addr() && p.IsSingleIP()
-		})
-	}
+	// srcNode == self iff NodeByAddr resolved the source to the same node as
+	// the current record's self.
+	srcIsSelfNode := srcNode.Valid() && nl.record.selfNode.Valid() &&
+		srcNode.ID() == nl.record.selfNode.ID()
 	switch {
 	case srcIsSelfNode && dstNode.Valid():
 		return virtualTraffic
@@ -335,8 +349,8 @@ func (nl *Logger) addNewPhysConnLocked(c netlogtype.Connection) {
 	var srcNodeLen int
 	srcNode, srcSeen := nl.record.seenNodes[c.Src.Addr()]
 	if !srcSeen {
-		srcNode = nl.allNodes[c.Src.Addr()]
-		if srcNode.Valid() {
+		if node, user, ok := nl.source.NodeByAddr(c.Src.Addr()); ok {
+			srcNode = nodeUser{node, user}
 			srcNodeLen = srcNode.jsonLen()
 		}
 	}
@@ -361,14 +375,16 @@ func (nl *Logger) initRecordLocked() {
 	if nl.recordLen != 0 {
 		return
 	}
+	node, user := nl.source.SelfNode()
+	self := nodeUser{node, user}
 	nl.record = record{
-		selfNode:  nl.selfNode,
+		selfNode:  self,
 		start:     time.Now().UTC(),
 		seenNodes: make(map[netip.Addr]nodeUser),
 		virtConns: make(map[netlogtype.Connection]countsType),
 		physConns: make(map[netlogtype.Connection]netlogtype.Counts),
 	}
-	nl.recordLen = netlogtype.MinMessageJSONSize + nl.selfNode.jsonLen()
+	nl.recordLen = netlogtype.MinMessageJSONSize + self.jsonLen()
 
 	// Start a time to auto-flush the record.
 	// Avoid tickers since continually waking up a goroutine
@@ -406,39 +422,6 @@ func (nl *Logger) flushRecordLocked() {
 	nl.recordLen = 0
 }
 
-func makeNodeMaps(nm *netmap.NetworkMap) (selfNode nodeUser, allNodes map[netip.Addr]nodeUser) {
-	if nm == nil {
-		return
-	}
-	allNodes = make(map[netip.Addr]nodeUser)
-	if nm.SelfNode.Valid() {
-		selfNode = nodeUser{nm.SelfNode, nm.UserProfiles[nm.SelfNode.User()]}
-		for _, addr := range nm.SelfNode.Addresses().All() {
-			if addr.IsSingleIP() {
-				allNodes[addr.Addr()] = selfNode
-			}
-		}
-	}
-	for _, peer := range nm.Peers {
-		if peer.Valid() {
-			for _, addr := range peer.Addresses().All() {
-				if addr.IsSingleIP() {
-					allNodes[addr.Addr()] = nodeUser{peer, nm.UserProfiles[peer.User()]}
-				}
-			}
-		}
-	}
-	return selfNode, allNodes
-}
-
-// ReconfigNetworkMap configures the network logger with an updated netmap.
-func (nl *Logger) ReconfigNetworkMap(nm *netmap.NetworkMap) {
-	selfNode, allNodes := makeNodeMaps(nm) // avoid holding lock while making maps
-	nl.mu.Lock()
-	nl.selfNode, nl.allNodes = selfNode, allNodes
-	nl.mu.Unlock()
-}
-
 func makeRouteMaps(cfg *router.Config) (addrs set.Set[netip.Addr], prefixes []netip.Prefix) {
 	addrs = make(set.Set[netip.Addr])
 	insertPrefixes := func(rs []netip.Prefix) {
diff --git a/wgengine/netlog/netlog_omit.go b/wgengine/netlog/netlog_omit.go
index 041a18376..827904bb7 100644
--- a/wgengine/netlog/netlog_omit.go
+++ b/wgengine/netlog/netlog_omit.go
@@ -7,8 +7,11 @@ package netlog
 
 type Logger struct{}
 
-func (*Logger) Startup(...any) error   { return nil }
-func (*Logger) Running() bool          { return false }
-func (*Logger) Shutdown(any) error     { return nil }
-func (*Logger) ReconfigNetworkMap(any) {}
-func (*Logger) ReconfigRoutes(any)     {}
+// NodeSource is a stub kept so the omit build does not break consumers that
+// reference the type. It has no methods.
+type NodeSource any
+
+func (*Logger) Startup(...any) error { return nil }
+func (*Logger) Running() bool        { return false }
+func (*Logger) Shutdown(any) error   { return nil }
+func (*Logger) ReconfigRoutes(any)   {}
diff --git a/wgengine/netlog/netlog_test.go b/wgengine/netlog/netlog_test.go
index cc6968547..57bb16344 100644
--- a/wgengine/netlog/netlog_test.go
+++ b/wgengine/netlog/netlog_test.go
@@ -21,22 +21,74 @@ import (
 	"tailscale.com/types/bools"
 	"tailscale.com/types/ipproto"
 	"tailscale.com/types/netlogtype"
-	"tailscale.com/types/netmap"
 	"tailscale.com/wgengine/router"
 )
 
+// nodeAndUser pairs a [tailcfg.NodeView] with its owning user profile.
+type nodeAndUser struct {
+	node tailcfg.NodeView
+	user tailcfg.UserProfileView
+}
+
+// fakeNodeSource is a [NodeSource] implementation backed by static maps,
+// for tests.
+type fakeNodeSource struct {
+	self     tailcfg.NodeView
+	selfUser tailcfg.UserProfileView
+	byAddr   map[netip.Addr]nodeAndUser
+}
+
+func (s *fakeNodeSource) SelfNode() (tailcfg.NodeView, tailcfg.UserProfileView) {
+	return s.self, s.selfUser
+}
+
+func (s *fakeNodeSource) NodeByAddr(a netip.Addr) (_ tailcfg.NodeView, _ tailcfg.UserProfileView, ok bool) {
+	nu, ok := s.byAddr[a]
+	return nu.node, nu.user, ok
+}
+
+// newFakeNodeSource builds a [fakeNodeSource] from a self [tailcfg.NodeView],
+// a list of peer [tailcfg.NodeView] values, and a UserProfile map.
+// All single-IP addresses on self and the peers are indexed for NodeByAddr.
+func newFakeNodeSource(self tailcfg.NodeView, peers []tailcfg.NodeView, users map[tailcfg.UserID]tailcfg.UserProfileView) *fakeNodeSource {
+	s := &fakeNodeSource{
+		byAddr: map[netip.Addr]nodeAndUser{},
+	}
+	if self.Valid() {
+		s.self = self
+		s.selfUser = users[self.User()]
+		for _, p := range self.Addresses().All() {
+			if p.IsSingleIP() {
+				s.byAddr[p.Addr()] = nodeAndUser{self, s.selfUser}
+			}
+		}
+	}
+	for _, peer := range peers {
+		if !peer.Valid() {
+			continue
+		}
+		pu := users[peer.User()]
+		for _, p := range peer.Addresses().All() {
+			if p.IsSingleIP() {
+				s.byAddr[p.Addr()] = nodeAndUser{peer, pu}
+			}
+		}
+	}
+	return s
+}
+
 func TestEmbedNodeInfo(t *testing.T) {
-	// Initialize the logger with a particular view of the netmap.
+	// Initialize the logger with a particular view of the node state.
 	var logger Logger
-	logger.ReconfigNetworkMap(&netmap.NetworkMap{
-		SelfNode: (&tailcfg.Node{
+	logger.source = newFakeNodeSource(
+		(&tailcfg.Node{
 			StableID:  "n123456CNTL",
 			ID:        123456,
 			Name:      "test.tail123456.ts.net",
 			Addresses: []netip.Prefix{prefix("100.1.2.3")},
 			Tags:      []string{"tag:foo", "tag:bar"},
 		}).View(),
-		Peers: []tailcfg.NodeView{
+		[]tailcfg.NodeView{
 			(&tailcfg.Node{
 				StableID:  "n123457CNTL",
 				ID:        123457,
@@ -52,10 +104,10 @@ func TestEmbedNodeInfo(t *testing.T) {
 				User:      54321,
 			}).View(),
 		},
-		UserProfiles: map[tailcfg.UserID]tailcfg.UserProfileView{
+		map[tailcfg.UserID]tailcfg.UserProfileView{
 			54321: (&tailcfg.UserProfile{ID: 54321, LoginName: "peer@example.com"}).View(),
 		},
-	})
+	)
 	logger.ReconfigRoutes(&router.Config{
 		SubnetRoutes: []netip.Prefix{
 			prefix("172.16.1.1/16"),
@@ -148,6 +200,9 @@ func TestEmbedNodeInfo(t *testing.T) {
 
 func TestUpdateRace(t *testing.T) {
 	var logger Logger
+	// Install an empty fake source so NodeByAddr / SelfNode are exercised on
+	// the lookup path without returning any matches.
+	logger.source = &fakeNodeSource{}
 	logger.recordsChan = make(chan record, 1)
 	go func(recordsChan chan record) {
 		for range recordsChan {
@@ -167,11 +222,6 @@ func TestUpdateRace(t *testing.T) {
 				}
 			}
 		})
-		group.Go(func() {
-			for range 1000 {
-				logger.ReconfigNetworkMap(new(netmap.NetworkMap))
-			}
-		})
 		group.Go(func() {
 			for range 1000 {
 				logger.ReconfigRoutes(new(router.Config))
@@ -194,6 +244,7 @@ func randAddrPort() netip.AddrPort {
 
 func TestAutoFlushMaxConns(t *testing.T) {
 	var logger Logger
+	logger.source = &fakeNodeSource{}
 	logger.recordsChan = make(chan record, 1)
 	for i := 0; len(logger.recordsChan) == 0; i++ {
 		logger.updateVirtConn(0, netip.AddrPortFrom(netip.Addr{}, uint16(i)), netip.AddrPort{}, 1, 1, false)
@@ -206,6 +257,7 @@ func TestAutoFlushMaxConns(t *testing.T) {
 
 func TestAutoFlushTimeout(t *testing.T) {
 	var logger Logger
+	logger.source = &fakeNodeSource{}
 	logger.recordsChan = make(chan record, 1)
 	synctest.Test(t, func(t *testing.T) {
 		logger.updateVirtConn(0, netip.AddrPort{}, netip.AddrPort{}, 1, 1, false)
@@ -222,6 +274,7 @@ func TestAutoFlushTimeout(t *testing.T) {
 
 func BenchmarkUpdateSameConn(b *testing.B) {
 	var logger Logger
+	logger.source = &fakeNodeSource{}
 	b.ReportAllocs()
 	for range b.N {
 		logger.updateVirtConn(0, netip.AddrPort{}, netip.AddrPort{}, 1, 1, false)
@@ -230,6 +283,7 @@ func BenchmarkUpdateSameConn(b *testing.B) {
 
 func BenchmarkUpdateNewConns(b *testing.B) {
 	var logger Logger
+	logger.source = &fakeNodeSource{}
 	b.ReportAllocs()
 	for i := range b.N {
 		logger.updateVirtConn(0, netip.AddrPortFrom(netip.Addr{}, uint16(i)), netip.AddrPort{}, 1, 1, false)
diff --git a/wgengine/netlog_hooks.go b/wgengine/netlog_hooks.go
new file mode 100644
index 000000000..129f2f96b
--- /dev/null
+++ b/wgengine/netlog_hooks.go
@@ -0,0 +1,86 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+package wgengine
+
+import (
+	"net/netip"
+
+	"tailscale.com/feature"
+	"tailscale.com/health"
+	"tailscale.com/net/netmon"
+	"tailscale.com/net/tstun"
+	"tailscale.com/tailcfg"
+	"tailscale.com/types/logger"
+	"tailscale.com/types/logid"
+	"tailscale.com/util/eventbus"
+	"tailscale.com/wgengine/magicsock"
+	"tailscale.com/wgengine/router"
+)
+
+// NetLogSource provides the network flow logging feature what it needs
+// from the rest of the system (in practice, ipnlocal.LocalBackend):
+// on-demand node lookups and the current audit logging identity.
+type NetLogSource interface {
+	// SelfNode returns the current self node and its owning user profile.
+	// The views are invalid if there is no current node.
+	SelfNode() (tailcfg.NodeView, tailcfg.UserProfileView)
+
+	// NodeByAddr returns the node assigned the given address along with
+	// its owning user profile.
+	// ok is false if no node is known to own addr.
+	NodeByAddr(addr netip.Addr) (node tailcfg.NodeView, user tailcfg.UserProfileView, ok bool)
+
+	// NetLogIDs returns the audit logging IDs from the current netmap,
+	// along with whether exit node flows should be logged.
+	// ok is false if network flow logging should not run.
+	NetLogIDs() (nodeID, domainID logid.PrivateID, logExitFlows bool, ok bool)
+}
+
+// NetLogger is the engine's handle on the network flow logger
+// lifecycle, implemented by the feature/netlog package.
+//
+// Reconfig and ReconfigDone are only called from [Engine.Reconfig],
+// serialized by the engine's internal lock. Shutdown may be called
+// concurrently with them from [Engine.Close].
+type NetLogger interface {
+	// Reconfig is called near the top of every [Engine.Reconfig],
+	// before its ErrNoChanges early return (so identity-only changes
+	// still take effect) and before the router is configured (so a
+	// starting logger captures initial packets). It reports whether
+	// network logging state changed, which suppresses the engine's
+	// ErrNoChanges early return.
+	Reconfig(routerCfg *router.Config, routerChanged bool) (changed bool)
+
+	// ReconfigDone is called at the end of [Engine.Reconfig], after
+	// the router is configured, so that a logger stopping as a result
+	// of the preceding Reconfig call captures final packets. It may
+	// block to flush pending messages.
+	ReconfigDone()
+
+	// Shutdown stops the logger. It may block to flush pending
+	// messages, bounded by an internal upload timeout.
+	Shutdown()
+}
+
+// NetLoggerDeps are the engine-owned dependencies passed to
+// [HookNewNetLogger] to construct a [NetLogger].
+type NetLoggerDeps struct {
+	Logf   logger.Logf
+	Tun    *tstun.Wrapper
+	Sock   *magicsock.Conn
+	NetMon *netmon.Monitor
+	Health *health.Tracker
+	Bus    *eventbus.Bus
+
+	// Source returns the [NetLogSource] installed via
+	// [Engine.SetNetLogSource], or nil if none has been installed yet.
+	// It is a func because the source is installed after the engine
+	// (and thus the NetLogger) is constructed.
+	Source func() NetLogSource
+}
+
+// HookNewNetLogger is set by the feature/netlog package to construct
+// each engine's [NetLogger]. If unset, network flow logging is not
+// linked into the binary and the engine skips all NetLogger calls.
+var HookNewNetLogger feature.Hook[func(NetLoggerDeps) NetLogger]
diff --git a/wgengine/netstack/gro/gro.go b/wgengine/netstack/gro/gro.go
index 152b25295..40ec9f325 100644
--- a/wgengine/netstack/gro/gro.go
+++ b/wgengine/netstack/gro/gro.go
@@ -25,11 +25,14 @@ import (
 // !stack.PacketBuffer.RXChecksumValidated, i.e. it satisfies
 // stack.CapabilityRXChecksumOffload. Other protocols with checksum fields,
 // e.g. ICMP{v6}, are still validated by gVisor regardless of rx checksum
-// offloading capabilities.
+// offloading capabilities. IPv4 fragments cannot have their L4 checksums
+// validated before reassembly, so only their IPv4 header checksum is validated
+// here.
 func RXChecksumOffload(p *packet.Parsed) *stack.PacketBuffer {
 	var (
 		pn        tcpip.NetworkProtocolNumber
 		csumStart int
+		fragment  bool
 	)
 	buf := p.Buffer()
 
@@ -45,6 +48,11 @@ func RXChecksumOffload(p *packet.Parsed) *stack.PacketBuffer {
 		if ^tun.Checksum(buf[:csumStart], 0) != 0 {
 			return nil
 		}
+		// Non-first fragments (FragmentOffset != 0) arrive here with
+		// p.IPProto == ipproto.Fragment (set by packet.Parsed.Decode), so
+		// they already skip the L4 checksum check below. We only need to
+		// catch the first fragment, which still has its real IPProto.
+		fragment = header.IPv4(buf).More()
 		pn = header.IPv4ProtocolNumber
 	case 6:
 		if len(buf) < header.IPv6FixedHeaderSize {
@@ -80,7 +88,7 @@ func RXChecksumOffload(p *packet.Parsed) *stack.PacketBuffer {
 		}
 	}
 
-	if p.IPProto == ipproto.TCP || p.IPProto == ipproto.UDP {
+	if !fragment && (p.IPProto == ipproto.TCP || p.IPProto == ipproto.UDP) {
 		lenForPseudo := len(buf) - csumStart
 		csum := tun.PseudoHeaderChecksum(
 			uint8(p.IPProto),
diff --git a/wgengine/netstack/gro/gro_test.go b/wgengine/netstack/gro/gro_test.go
index 49171b78c..687518365 100644
--- a/wgengine/netstack/gro/gro_test.go
+++ b/wgengine/netstack/gro/gro_test.go
@@ -62,6 +62,23 @@ func Test_RXChecksumOffload(t *testing.T) {
 	at := 20 + 16
 	tcp4InvalidCsum[at] = ^tcp4InvalidCsum[at]
 
+	tcp4FirstFragment := make([]byte, 20+20+60)
+	copy(tcp4FirstFragment, tcp4[:len(tcp4FirstFragment)])
+	ipv4H = header.IPv4(tcp4FirstFragment)
+	ipv4H.SetTotalLength(uint16(len(tcp4FirstFragment)))
+	ipv4H.SetFlagsFragmentOffset(header.IPv4FlagMoreFragments, 0)
+	ipv4H.SetChecksum(0)
+	ipv4H.SetChecksum(^ipv4H.CalculateChecksum())
+
+	tcp4SecondFragment := make([]byte, 20+40)
+	copy(tcp4SecondFragment, tcp4[:20])
+	copy(tcp4SecondFragment[20:], tcp4[20+80:])
+	ipv4H = header.IPv4(tcp4SecondFragment)
+	ipv4H.SetTotalLength(uint16(len(tcp4SecondFragment)))
+	ipv4H.SetFlagsFragmentOffset(0, 80)
+	ipv4H.SetChecksum(0)
+	ipv4H.SetChecksum(^ipv4H.CalculateChecksum())
+
 	tcp6ExtHeaderInvalidCsum := make([]byte, len(tcp6ExtHeader))
 	copy(tcp6ExtHeaderInvalidCsum, tcp6ExtHeader)
 	at = 40 + 8 + 16
@@ -87,6 +104,16 @@ func Test_RXChecksumOffload(t *testing.T) {
 			tcp4InvalidCsum,
 			false,
 		},
+		{
+			"tcp4 first fragment skips L4 csum",
+			tcp4FirstFragment,
+			true,
+		},
+		{
+			"tcp4 second fragment skips L4 csum",
+			tcp4SecondFragment,
+			true,
+		},
 		{
 			"tcp6 with ext header invalid csum",
 			tcp6ExtHeaderInvalidCsum,
diff --git a/wgengine/netstack/netstack.go b/wgengine/netstack/netstack.go
index 4da89e364..ea0537503 100644
--- a/wgengine/netstack/netstack.go
+++ b/wgengine/netstack/netstack.go
@@ -64,10 +64,12 @@ import (
 const debugPackets = false
 
 // If non-zero, these override the values returned from the corresponding
-// functions, below.
+// functions, below. They are accessed atomically because background
+// goroutines in the gVisor TCP stack read them while test cleanup
+// goroutines may be restoring them concurrently.
 var (
-	maxInFlightConnectionAttemptsForTest          int
-	maxInFlightConnectionAttemptsPerClientForTest int
+	maxInFlightConnectionAttemptsForTest          atomic.Int32
+	maxInFlightConnectionAttemptsPerClientForTest atomic.Int32
 )
 
 // maxInFlightConnectionAttempts returns the global number of in-flight
@@ -80,8 +82,8 @@ var (
 // connection, so we want to ensure that we don't allow an unbounded number of
 // connections.
 func maxInFlightConnectionAttempts() int {
-	if n := maxInFlightConnectionAttemptsForTest; n > 0 {
-		return n
+	if n := maxInFlightConnectionAttemptsForTest.Load(); n > 0 {
+		return int(n)
 	}
 
 	if version.IsMobile() {
@@ -106,8 +108,8 @@ func maxInFlightConnectionAttempts() int {
 // maxInFlightConnectionAttempts, but applies on a per-client basis
 // (i.e. keyed by the remote Tailscale IP).
 func maxInFlightConnectionAttemptsPerClient() int {
-	if n := maxInFlightConnectionAttemptsPerClientForTest; n > 0 {
-		return n
+	if n := maxInFlightConnectionAttemptsPerClientForTest.Load(); n > 0 {
+		return int(n)
 	}
 
 	// For now, allow each individual client at most 2/3rds of the global
@@ -214,6 +216,7 @@ type Impl struct {
 	dialer    *tsdial.Dialer
 	ctx       context.Context        // alive until Close
 	ctxCancel context.CancelFunc     // called on Close
+	injectWG  sync.WaitGroup         // wait for the inject goroutine
 	lb        *ipnlocal.LocalBackend // or nil
 	dns       *dns.Manager
 
@@ -280,6 +283,11 @@ type Impl struct {
 	packetsInFlight map[stack.TransportEndpointID]struct{}
 }
 
+// Stack returns the underlying gVisor network stack.
+func (ns *Impl) Stack() *stack.Stack {
+	return ns.ipstack
+}
+
 const nicID = 1
 
 // maxUDPPacketSize is the maximum size of a UDP packet we copy in
@@ -448,6 +456,7 @@ func (ns *Impl) Close() error {
 	ns.ctxCancel()
 	ns.ipstack.Close()
 	ns.ipstack.Wait()
+	ns.injectWG.Wait()
 	return nil
 }
 
@@ -642,7 +651,9 @@ func (ns *Impl) Start(b LocalBackend) error {
 	udpFwd := udp.NewForwarder(ns.ipstack, ns.acceptUDPNoICMP)
 	ns.ipstack.SetTransportProtocolHandler(tcp.ProtocolNumber, ns.wrapTCPProtocolHandler(tcpFwd.HandlePacket))
 	ns.ipstack.SetTransportProtocolHandler(udp.ProtocolNumber, ns.wrapUDPProtocolHandler(udpFwd.HandlePacket))
-	go ns.inject()
+	ns.injectWG.Go(func() {
+		ns.inject()
+	})
 	if ns.ready.Swap(true) {
 		panic("already started")
 	}
@@ -843,20 +854,27 @@ func (ns *Impl) handleLocalPackets(p *packet.Parsed, t *tstun.Wrapper, gro *gro.
 	serviceName, isVIPServiceIP := ns.atomicIPVIPServiceMap.Load()[dst]
 	switch {
 	case dst == serviceIP || dst == serviceIPv6:
-		// We want to intercept some traffic to the "service IP" (e.g.
-		// 100.100.100.100 for IPv4). However, of traffic to the
-		// service IP, we only care about UDP 53, and TCP on port 53,
-		// 80, and 8080.
-		switch p.IPProto {
-		case ipproto.TCP:
-			if port := p.Dst.Port(); port != 53 && port != 80 && port != 8080 && !ns.isLoopbackPort(port) {
-				return filter.Accept, gro
-			}
-		case ipproto.UDP:
-			if port := p.Dst.Port(); port != 53 && !ns.isLoopbackPort(port) {
-				return filter.Accept, gro
-			}
-		}
+		// Traffic to the Tailscale service IP (100.100.100.100 /
+		// fd7a:115c:a1e0::53) is always terminated locally on this
+		// node; it must never be forwarded out over WireGuard to a
+		// peer. Netstack's TCP/UDP acceptors handle the ports we
+		// actually serve (UDP 53 MagicDNS, TCP 53/80/8080 for DNS,
+		// the web client, and Taildrive, plus any debug loopback
+		// port). Other ports are rejected cleanly by netstack: UDP
+		// closes the endpoint in acceptUDP, and TCP is RST'd by
+		// acceptTCP's hittingServiceIP guard.
+		//
+		// Previously we returned filter.Accept for TCP/UDP on any
+		// other port, which let the packet fall through to the ACL
+		// filter and ultimately wireguard-go, where no peer owns the
+		// quad-100 AllowedIP. That produced noisy "open-conn-track:
+		// timeout opening ...; no associated peer node" log lines
+		// (e.g. for stray traffic to 100.100.100.100:853 / DoT) and
+		// leaked quad-100 packets onto the tailnet.
+		//
+		// We now unconditionally absorb quad-100 into netstack here,
+		// regardless of IP protocol or port, so such traffic never
+		// reaches the conntrack / peer-routing layers.
 	case isVIPServiceIP:
 		// returns all active VIP services in a set, since the IPVIPServiceMap
 		// contains inactive service IPs when node hosts the service, we need to
@@ -1652,6 +1670,35 @@ func (ns *Impl) acceptTCP(r *tcp.ForwarderRequest) {
 		} else {
 			dialIP = ipv4Loopback
 		}
+	case hittingServiceIP:
+		// TCP to the Tailscale service IP on a port we don't serve
+		// (anything other than DNS/53, web client/80, Taildrive/8080,
+		// or the debug loopback port handled above). handleLocalPackets
+		// absorbs all quad-100 traffic into netstack to prevent it
+		// from leaking to WireGuard peers as noisy "open-conn-track:
+		// timeout opening ...; no associated peer node" log lines
+		// (see the comment there).
+		//
+		// Without this explicit guard, execution would fall through
+		// to the isTailscaleIP case below (quad-100 is in the
+		// tailscale IP range), rewriting the dial target to
+		// 127.0.0.1:<port> and forwardTCP'ing the connection onto
+		// whatever random service happens to be listening on the
+		// host's loopback at that port. Reject cleanly with a RST
+		// here instead.
+		r.Complete(true) // sends a RST
+		return
+	case ns.isVIPServiceIP(dialIP):
+		// TCP to a VIP service IP on a port the service does not serve. A served
+		// port returns early above (TCPHandlerForDst is non-nil), so reaching here
+		// means this node has no serve handler for this port. Don't fall through
+		// to the isTailscaleIP case below (a VIP is in the Tailscale IP range),
+		// which would rewrite the dial target to 127.0.0.1:<port> and forwardTCP
+		// the connection onto whatever unrelated service happens to be listening
+		// on the host's loopback at that port — reachable via the service IP by
+		// any peer, even one granted access only to the service. Reject with a RST.
+		r.Complete(true) // sends a RST
+		return
 	case isTailscaleIP:
 		dialIP = ipv4Loopback
 	}
diff --git a/wgengine/netstack/netstack_test.go b/wgengine/netstack/netstack_test.go
index e588fa47c..f0e1b04b1 100644
--- a/wgengine/netstack/netstack_test.go
+++ b/wgengine/netstack/netstack_test.go
@@ -17,7 +17,9 @@ import (
 	"gvisor.dev/gvisor/pkg/tcpip"
 	"gvisor.dev/gvisor/pkg/tcpip/adapters/gonet"
 	"gvisor.dev/gvisor/pkg/tcpip/header"
+	"gvisor.dev/gvisor/pkg/tcpip/network/ipv4"
 	"gvisor.dev/gvisor/pkg/tcpip/stack"
+	"gvisor.dev/gvisor/pkg/tcpip/transport/udp"
 	"tailscale.com/envknob"
 	"tailscale.com/ipn"
 	"tailscale.com/ipn/ipnlocal"
@@ -33,6 +35,7 @@ import (
 	"tailscale.com/types/ipproto"
 	"tailscale.com/types/logid"
 	"tailscale.com/types/netmap"
+	"tailscale.com/util/clientmetric"
 	"tailscale.com/wgengine"
 	"tailscale.com/wgengine/filter"
 )
@@ -469,7 +472,7 @@ func TestShouldProcessInbound(t *testing.T) {
 				IPServiceMap := netmap.IPServiceMappings{
 					serviceIP: "svc:test-service",
 				}
-				i.lb.SetIPServiceMappingsForTest(IPServiceMap)
+				i.lb.ForTest().SetIPServiceMappings(IPServiceMap)
 
 				i.atomicIsVIPServiceIPFunc.Store(func(addr netip.Addr) bool {
 					return addr == serviceIP
@@ -516,7 +519,7 @@ func TestShouldProcessInbound(t *testing.T) {
 				IPServiceMap := netmap.IPServiceMappings{
 					serviceIP: "svc:test-service",
 				}
-				i.lb.SetIPServiceMappingsForTest(IPServiceMap)
+				i.lb.ForTest().SetIPServiceMappings(IPServiceMap)
 
 				i.atomicIsVIPServiceIPFunc.Store(func(addr netip.Addr) bool {
 					return addr == serviceIP
@@ -542,7 +545,7 @@ func TestShouldProcessInbound(t *testing.T) {
 				IPServiceMap := netmap.IPServiceMappings{
 					serviceIPv6: "svc:test-service",
 				}
-				i.lb.SetIPServiceMappingsForTest(IPServiceMap)
+				i.lb.ForTest().SetIPServiceMappings(IPServiceMap)
 
 				i.atomicIsVIPServiceIPFunc.Store(func(addr netip.Addr) bool {
 					return addr == serviceIPv6
@@ -586,7 +589,7 @@ func TestShouldProcessInbound(t *testing.T) {
 				IPServiceMap := netmap.IPServiceMappings{
 					serviceIPv6: "svc:test-service",
 				}
-				i.lb.SetIPServiceMappingsForTest(IPServiceMap)
+				i.lb.ForTest().SetIPServiceMappings(IPServiceMap)
 
 				i.atomicIsVIPServiceIPFunc.Store(func(addr netip.Addr) bool {
 					return addr == serviceIPv6
@@ -613,7 +616,7 @@ func TestShouldProcessInbound(t *testing.T) {
 				IPServiceMap := netmap.IPServiceMappings{
 					serviceIP: "svc:test-service",
 				}
-				i.lb.SetIPServiceMappingsForTest(IPServiceMap)
+				i.lb.ForTest().SetIPServiceMappings(IPServiceMap)
 
 				i.atomicIsVIPServiceIPFunc.Store(func(addr netip.Addr) bool {
 					return addr == serviceIP
@@ -736,7 +739,10 @@ func makeHangDialer(tb testing.TB) (netx.DialFunc, chan struct{}) {
 // TestTCPForwardLimits verifies that the limits on the TCP forwarder work in a
 // success case (i.e. when we don't hit the limit).
 func TestTCPForwardLimits(t *testing.T) {
+	tstest.AssertNotParallel(t) // calls envknob.Setenv
 	envknob.Setenv("TS_DEBUG_NETSTACK", "true")
+	t.Cleanup(func() { envknob.Setenv("TS_DEBUG_NETSTACK", "") })
+
 	impl := makeNetstack(t, func(impl *Impl) {
 		impl.ProcessSubnets = true
 	})
@@ -811,11 +817,16 @@ func TestTCPForwardLimits(t *testing.T) {
 // TestTCPForwardLimits_PerClient verifies that the per-client limit for TCP
 // forwarding works.
 func TestTCPForwardLimits_PerClient(t *testing.T) {
+	clientmetric.ResetForTest(t)
+	tstest.AssertNotParallel(t) // calls envknob.Setenv
 	envknob.Setenv("TS_DEBUG_NETSTACK", "true")
+	t.Cleanup(func() { envknob.Setenv("TS_DEBUG_NETSTACK", "") })
 
 	// Set our test override limits during this test.
-	tstest.Replace(t, &maxInFlightConnectionAttemptsForTest, 2)
-	tstest.Replace(t, &maxInFlightConnectionAttemptsPerClientForTest, 1)
+	maxInFlightConnectionAttemptsForTest.Store(2)
+	t.Cleanup(func() { maxInFlightConnectionAttemptsForTest.Store(0) })
+	maxInFlightConnectionAttemptsPerClientForTest.Store(1)
+	t.Cleanup(func() { maxInFlightConnectionAttemptsPerClientForTest.Store(0) })
 
 	impl := makeNetstack(t, func(impl *Impl) {
 		impl.ProcessSubnets = true
@@ -945,9 +956,10 @@ func TestHandleLocalPackets(t *testing.T) {
 		netip.MustParseAddr("100.99.55.111"):        "svc:test-service",
 		netip.MustParseAddr("fd7a:115c:a1e0::abcd"): "svc:test-service",
 	}
-	impl.lb.SetIPServiceMappingsForTest(IPServiceMap)
+	impl.lb.ForTest().SetIPServiceMappings(IPServiceMap)
 
 	t.Run("ShouldHandleServiceIP", func(t *testing.T) {
+		t.Parallel()
 		pkt := &packet.Parsed{
 			IPVersion: 4,
 			IPProto:   ipproto.TCP,
@@ -960,7 +972,94 @@ func TestHandleLocalPackets(t *testing.T) {
 			t.Errorf("got filter outcome %v, want filter.DropSilently", resp)
 		}
 	})
+	// Any port on the quad-100 service IP must be absorbed locally by
+	// netstack and never leak out to the WireGuard / peer-routing
+	// layers. Historically we only intercepted specific ports (UDP 53
+	// and TCP 53/80/8080), causing stray traffic to other ports such
+	// as 100.100.100.100:853 (DoT) to time out in wireguard-go and
+	// produce "open-conn-track: timeout opening ...; no associated
+	// peer node" log spam. See the handleLocalPackets comment.
+	quad100LeakCases := []struct {
+		name  string
+		proto ipproto.Proto
+		dst   string
+	}{
+		{"TCP-853-DoT-v4", ipproto.TCP, "100.100.100.100:853"},
+		{"TCP-443-DoH-v4", ipproto.TCP, "100.100.100.100:443"},
+		{"TCP-9000-stray-v4", ipproto.TCP, "100.100.100.100:9000"},
+		{"UDP-853-DoQ-v4", ipproto.UDP, "100.100.100.100:853"},
+		{"UDP-443-v4", ipproto.UDP, "100.100.100.100:443"},
+		{"TCP-853-DoT-v6", ipproto.TCP, "[fd7a:115c:a1e0::53]:853"},
+		{"UDP-443-v6", ipproto.UDP, "[fd7a:115c:a1e0::53]:443"},
+	}
+	for _, tc := range quad100LeakCases {
+		t.Run("ShouldNotLeakQuad100_"+tc.name, func(t *testing.T) {
+			t.Parallel()
+			dst := netip.MustParseAddrPort(tc.dst)
+			ipVersion := uint8(4)
+			if dst.Addr().Is6() {
+				ipVersion = 6
+			}
+			src := "127.0.0.1:9999"
+			if ipVersion == 6 {
+				src = "[::1]:9999"
+			}
+			pkt := &packet.Parsed{
+				IPVersion: ipVersion,
+				IPProto:   tc.proto,
+				Src:       netip.MustParseAddrPort(src),
+				Dst:       dst,
+			}
+			if tc.proto == ipproto.TCP {
+				pkt.TCPFlags = packet.TCPSyn
+			}
+			resp, _ := impl.handleLocalPackets(pkt, impl.tundev, nil)
+			if resp != filter.DropSilently {
+				t.Errorf("quad-100 %s packet leaked: got filter outcome %v, want filter.DropSilently", tc.name, resp)
+			}
+		})
+	}
+	// Exhaustive sweep of all ports for both transport protocols and
+	// both IP versions, confirming no port leaks. The quad-100 branch
+	// of handleLocalPackets is port-independent by construction; this
+	// test serves as a regression guard against accidental port-based
+	// exemptions slipping back in.
+	t.Run("ShouldNotLeakQuad100_AllPorts", func(t *testing.T) {
+		t.Parallel()
+		protos := []ipproto.Proto{ipproto.TCP, ipproto.UDP}
+		dsts := []netip.Addr{
+			netip.MustParseAddr("100.100.100.100"),
+			netip.MustParseAddr("fd7a:115c:a1e0::53"),
+		}
+		for _, proto := range protos {
+			for _, dstAddr := range dsts {
+				ipVersion := uint8(4)
+				srcStr := "127.0.0.1:9999"
+				if dstAddr.Is6() {
+					ipVersion = 6
+					srcStr = "[::1]:9999"
+				}
+				src := netip.MustParseAddrPort(srcStr)
+				for port := 1; port <= 65535; port++ {
+					pkt := &packet.Parsed{
+						IPVersion: ipVersion,
+						IPProto:   proto,
+						Src:       src,
+						Dst:       netip.AddrPortFrom(dstAddr, uint16(port)),
+					}
+					if proto == ipproto.TCP {
+						pkt.TCPFlags = packet.TCPSyn
+					}
+					resp, _ := impl.handleLocalPackets(pkt, impl.tundev, nil)
+					if resp != filter.DropSilently {
+						t.Fatalf("port=%d proto=%v dst=%v: got %v, want filter.DropSilently", port, proto, dstAddr, resp)
+					}
+				}
+			}
+		}
+	})
 	t.Run("ShouldHandle4via6", func(t *testing.T) {
+		t.Parallel()
 		pkt := &packet.Parsed{
 			IPVersion: 6,
 			IPProto:   ipproto.TCP,
@@ -983,6 +1082,7 @@ func TestHandleLocalPackets(t *testing.T) {
 		}
 	})
 	t.Run("ShouldHandleLocalTailscaleServices", func(t *testing.T) {
+		t.Parallel()
 		pkt := &packet.Parsed{
 			IPVersion: 4,
 			IPProto:   ipproto.TCP,
@@ -995,7 +1095,32 @@ func TestHandleLocalPackets(t *testing.T) {
 			t.Errorf("got filter outcome %v, want filter.DropSilently", resp)
 		}
 	})
+	t.Run("ShouldNotHandleInactiveVIPService", func(t *testing.T) {
+		// Tests that packets to Tailscale Services we don't host are accepted.
+		inactiveVIP := netip.MustParseAddr("100.99.55.222")
+		impl.lb.ForTest().SetIPServiceMappings(netmap.IPServiceMappings{
+			netip.MustParseAddr("100.99.55.111"):        "svc:test-service", // active (shared fixture)
+			netip.MustParseAddr("fd7a:115c:a1e0::abcd"): "svc:test-service",
+			inactiveVIP: "svc:inactive-elsewhere",
+		})
+		t.Cleanup(func() {
+			// Restore the shared fixture for any later/parallel subtests.
+			impl.lb.ForTest().SetIPServiceMappings(IPServiceMap)
+		})
+		pkt := &packet.Parsed{
+			IPVersion: 4,
+			IPProto:   ipproto.TCP,
+			Src:       netip.MustParseAddrPort("127.0.0.1:9999"),
+			Dst:       netip.AddrPortFrom(inactiveVIP, 80),
+			TCPFlags:  packet.TCPSyn,
+		}
+		resp, _ := impl.handleLocalPackets(pkt, impl.tundev, nil)
+		if resp != filter.Accept {
+			t.Errorf("inactive VIP service: got filter outcome %v, want filter.Accept (pass through to host)", resp)
+		}
+	})
 	t.Run("OtherNonHandled", func(t *testing.T) {
+		t.Parallel()
 		pkt := &packet.Parsed{
 			IPVersion: 6,
 			IPProto:   ipproto.TCP,
@@ -1018,6 +1143,191 @@ func TestHandleLocalPackets(t *testing.T) {
 	})
 }
 
+// TestAcceptTCPRoutingTailscaleIPRange tests how acceptTCP behaves for TCP SYN
+// packets destined to IPs in the Tailscale range (100.64.0.0/10).
+//
+//   - Packets to the Tailscale IP should be forwarded to loopback if there is
+//     no configured handler for the port.
+//   - Packets to the service IP (100.100.100.100) on non-served ports should
+//     never make it to the local host.
+//   - Packets to a Tailscale Service VIP on non-served ports should never make
+//     it to the local host.
+func TestAcceptTCPLoopbackForwardVsRST(t *testing.T) {
+	serviceVIP := netip.MustParseAddr("100.90.1.2")
+	selfIP := netip.MustParseAddr("100.64.1.2")
+	const serviceName = "svc:test"
+
+	cases := []struct {
+		name string
+		// configure runs inside makeNetstack, before Start.
+		configure func(*Impl)
+		// afterStart runs after Start, for state that requires the backend to be
+		// running (prefs, service IP maps, NIC address registration). Optional.
+		afterStart func(t *testing.T, impl *Impl)
+		// dst is the SYN's destination. Its port has no registered handler.
+		dst netip.AddrPort
+		// inbound selects the injection path: true => injectInbound (a packet
+		// from a peer), false => handleLocalPackets (host-originated, or the
+		// kernel-hairpin re-entry).
+		inbound bool
+		// wantForward is whether acceptTCP should forward the connection to the
+		// host's loopback (true) or reject it with a RST (false).
+		wantForward bool
+	}{
+		{
+			name: "Quad-100UnservedPortIsRST",
+			configure: func(impl *Impl) {
+				impl.ProcessSubnets = false
+				impl.ProcessLocalIPs = false
+				impl.atomicIsLocalIPFunc.Store(looksLikeATailscaleSelfAddress)
+			},
+			// 853 is DoT, the specific case called out in the original bug
+			// report ("conntrack error no peer found for 100.100.100.100:853").
+			// Before the fix, port 853 (and any non-{53,80,8080} port) leaked
+			// out to WireGuard; after the fix it is absorbed and must NOT
+			// trigger forwardTCP. handleLocalPackets absorbs all quad-100
+			// traffic regardless of port to prevent it leaking to WireGuard
+			// peers (which produced noisy "open-conn-track: timeout opening ...;
+			// no associated peer node" log lines), leaving acceptTCP to reject
+			// the unserved port with a RST rather than falling through to the
+			// isTailscaleIP loopback rewrite.
+			dst:         netip.AddrPortFrom(tsaddr.TailscaleServiceIP(), 853),
+			wantForward: false,
+		},
+		{
+			name: "VIPServiceUnservedPortIsRST",
+			configure: func(impl *Impl) {
+				impl.ProcessSubnets = false
+				impl.ProcessLocalIPs = false
+				impl.atomicIsLocalIPFunc.Store(looksLikeATailscaleSelfAddress)
+				impl.atomicIsVIPServiceIPFunc.Store(func(addr netip.Addr) bool {
+					return addr == serviceVIP
+				})
+			},
+			afterStart: func(t *testing.T, impl *Impl) {
+				// Mark the service as one this node hosts and is actively
+				// serving, so handleLocalPackets absorbs its traffic into
+				// netstack (rather than letting a non-hosted VIP route through).
+				// The service serves no TCP ports here, so every port is
+				// "non-served". AdvertiseServices flows through to
+				// UpdateActiveVIPServices, marking the service active.
+				prefs := ipn.NewPrefs()
+				prefs.AdvertiseServices = []string{serviceName}
+				if _, err := impl.lb.EditPrefs(&ipn.MaskedPrefs{
+					Prefs:                *prefs,
+					AdvertiseServicesSet: true,
+				}); err != nil {
+					t.Fatalf("EditPrefs: %v", err)
+				}
+				impl.lb.ForTest().SetIPServiceMappings(netmap.IPServiceMappings{serviceVIP: serviceName})
+			},
+			dst:         netip.AddrPortFrom(serviceVIP, 8001), // 8001: a port the service doesn't serve
+			wantForward: false,
+		},
+		{
+			name: "LocalTailscaleIPUnhandledPortForwardsToLoopback",
+			configure: func(impl *Impl) {
+				impl.ProcessSubnets = false
+				// ProcessLocalIPs=true so an inbound packet to a local Tailscale
+				// IP is absorbed into netstack and dispatched to acceptTCP.
+				impl.ProcessLocalIPs = true
+				impl.atomicIsLocalIPFunc.Store(func(addr netip.Addr) bool {
+					return addr == selfIP
+				})
+			},
+			// 9999 has no SSH/webclient/peerapi/serve handler, so
+			// TCPHandlerForDst returns nil and acceptTCP falls to the
+			// isTailscaleIP case, which rewrites the dial to 127.0.0.1:9999 and
+			// calls forwardTCP. This is how local handlers reach the host, and
+			// the RST guards above must not swallow it.
+			dst:         netip.AddrPortFrom(selfIP, 9999),
+			inbound:     true,
+			wantForward: true,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			impl := makeNetstack(t, tc.configure)
+			if tc.afterStart != nil {
+				tc.afterStart(t, impl)
+			}
+
+			dialFn, gotConn := makeHangDialer(t)
+			impl.forwardDialFunc = dialFn
+
+			// Use a client IP in the CGNAT range so shouldProcessInbound-adjacent
+			// code paths treat this as plausibly-peer-sourced traffic, matching
+			// what a real stray probe from a peer or the host OS would look like.
+			client := netip.MustParseAddr("100.101.102.103")
+			pkt := tcp4syn(t, client, tc.dst.Addr(), 1234, tc.dst.Port())
+			var parsed packet.Parsed
+			parsed.Decode(pkt)
+
+			// Both injection paths absorb the packet into netstack, returning
+			// filter.DropSilently (i.e. not handing it to the host); acceptTCP
+			// is then dispatched with the packet.
+			inject := impl.handleLocalPackets
+			if tc.inbound {
+				inject = impl.injectInbound
+			}
+			if resp, _ := inject(&parsed, impl.tundev, nil); resp != filter.DropSilently {
+				t.Fatalf("inject for %v: got filter outcome %v, want filter.DropSilently", tc.dst, resp)
+			}
+
+			// acceptTCP runs asynchronously in the gVisor TCP dispatcher after
+			// handleLocalPackets injects the packet into netstack. Use the
+			// in-flight connection counter as a deterministic synchronization
+			// point: wrapTCPProtocolHandler increments connsInFlightByClient
+			// when the dispatcher hands the connection off to acceptTCP, and
+			// acceptTCP's deferred decrementInFlightTCPForward decrements it
+			// on return.
+			//
+			// On the green path (RST guard fires), acceptTCP returns promptly
+			// and the counter reaches 0. On the red path (fall-through to
+			// forwardTCP), acceptTCP blocks inside the forwardDialFunc call —
+			// makeHangDialer signals gotConn on entry (buffered, non-blocking)
+			// and then blocks forever — so the counter never reaches 0 but
+			// gotConn fires synchronously from the dispatcher goroutine. A
+			// select on both races those outcomes without real-time padding.
+			//
+			// testing/synctest is not usable here: gVisor's sleep package calls
+			// the runtime's gopark directly rather than via the standard
+			// library, so synctest.Wait() cannot observe those goroutines
+			// becoming durably blocked and hangs indefinitely.
+			inFlightZero := make(chan struct{})
+			go func() {
+				for {
+					impl.mu.Lock()
+					n := impl.connsInFlightByClient[client]
+					impl.mu.Unlock()
+					if n == 0 {
+						close(inFlightZero)
+						return
+					}
+					time.Sleep(time.Millisecond)
+				}
+			}()
+
+			select {
+			case <-gotConn:
+				if !tc.wantForward {
+					t.Fatalf("forwardDialFunc was called for %v; acceptTCP forwarded to the host's loopback instead of sending a RST", tc.dst)
+				}
+			case <-inFlightZero:
+				if tc.wantForward {
+					t.Fatalf("forwardDialFunc was NOT called for %v; acceptTCP rejected the connection instead of forwarding it to loopback", tc.dst)
+				}
+			case <-time.After(5 * time.Second):
+				// Safety net so a regression in the in-flight counter plumbing
+				// doesn't hang the whole test run; both outcomes above should
+				// fire within milliseconds in practice.
+				t.Fatalf("timed out waiting for acceptTCP to dispatch %v SYN", tc.dst)
+			}
+		})
+	}
+}
+
 func TestShouldSendToHost(t *testing.T) {
 	var (
 		selfIP4             = netip.MustParseAddr("100.64.1.2")
@@ -1487,6 +1797,114 @@ func udp4raw(t testing.TB, src, dst netip.Addr, sport, dport uint16, payload []b
 	return buf
 }
 
+func fragmentIPv4ForTest(t testing.TB, pkt []byte, firstPayloadLen uint16) (first, second []byte) {
+	t.Helper()
+	if firstPayloadLen%8 != 0 {
+		t.Fatalf("firstPayloadLen %d is not 8-byte aligned", firstPayloadLen)
+	}
+	if len(pkt) < header.IPv4MinimumSize+int(firstPayloadLen) {
+		t.Fatalf("packet length %d too short for firstPayloadLen %d", len(pkt), firstPayloadLen)
+	}
+	ip := header.IPv4(pkt)
+	if ip.HeaderLength() != header.IPv4MinimumSize {
+		t.Fatalf("test helper only supports 20-byte IPv4 headers; got %d", ip.HeaderLength())
+	}
+	ipPayloadLen := len(pkt) - header.IPv4MinimumSize
+	if int(firstPayloadLen) >= ipPayloadLen {
+		t.Fatalf("firstPayloadLen %d must be smaller than IP payload length %d", firstPayloadLen, ipPayloadLen)
+	}
+
+	first = make([]byte, header.IPv4MinimumSize+int(firstPayloadLen))
+	copy(first, pkt[:len(first)])
+	firstIP := header.IPv4(first)
+	firstIP.SetTotalLength(uint16(len(first)))
+	firstIP.SetFlagsFragmentOffset(header.IPv4FlagMoreFragments, 0)
+	firstIP.SetChecksum(0)
+	firstIP.SetChecksum(^firstIP.CalculateChecksum())
+
+	secondPayloadLen := ipPayloadLen - int(firstPayloadLen)
+	second = make([]byte, header.IPv4MinimumSize+secondPayloadLen)
+	copy(second[:header.IPv4MinimumSize], pkt[:header.IPv4MinimumSize])
+	copy(second[header.IPv4MinimumSize:], pkt[header.IPv4MinimumSize+int(firstPayloadLen):])
+	secondIP := header.IPv4(second)
+	secondIP.SetTotalLength(uint16(len(second)))
+	secondIP.SetFlagsFragmentOffset(0, firstPayloadLen)
+	secondIP.SetChecksum(0)
+	secondIP.SetChecksum(^secondIP.CalculateChecksum())
+
+	return first, second
+}
+
+// TestLinkEndpointInjectInboundIPv4Fragments verifies that Tailscale's inbound
+// link endpoint path lets IPv4 fragments reach gVisor for reassembly.
+// Previously (see https://github.com/tailscale/tailscale/issues/20320),
+// gro.RXChecksumOffload validated L4 checksums before reassembly, so the first
+// fragment was dropped and the UDP datagram never reached the socket.
+func TestLinkEndpointInjectInboundIPv4Fragments(t *testing.T) {
+	const nicID tcpip.NICID = 1
+	localIP := netip.MustParseAddr("100.64.1.2")
+	remoteIP := netip.MustParseAddr("100.64.1.3")
+	payload := []byte("0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz")
+	raw := udp4raw(t, remoteIP, localIP, 12345, 8081, payload)
+	first, second := fragmentIPv4ForTest(t, raw, 80)
+
+	s := stack.New(stack.Options{
+		NetworkProtocols: []stack.NetworkProtocolFactory{
+			ipv4.NewProtocol,
+		},
+		TransportProtocols: []stack.TransportProtocolFactory{
+			udp.NewProtocol,
+		},
+	})
+	defer s.Close()
+
+	ep := newLinkEndpoint(64, 1280, "", groNotSupported)
+	if err := s.CreateNIC(nicID, ep); err != nil {
+		t.Fatalf("CreateNIC: %v", err)
+	}
+	if err := s.AddProtocolAddress(nicID, tcpip.ProtocolAddress{
+		Protocol:          header.IPv4ProtocolNumber,
+		AddressWithPrefix: tcpip.AddrFrom4(localIP.As4()).WithPrefix(),
+	}, stack.AddressProperties{}); err != nil {
+		t.Fatalf("AddProtocolAddress: %v", err)
+	}
+
+	pc, err := gonet.DialUDP(s, &tcpip.FullAddress{
+		NIC:  nicID,
+		Addr: tcpip.AddrFrom4(localIP.As4()),
+		Port: 8081,
+	}, nil, header.IPv4ProtocolNumber)
+	if err != nil {
+		t.Fatalf("DialUDP: %v", err)
+	}
+	defer pc.Close()
+
+	var parsed packet.Parsed
+	parsed.Decode(first)
+	ep.injectInbound(&parsed)
+	parsed.Decode(second)
+	ep.injectInbound(&parsed)
+
+	if err := pc.SetReadDeadline(time.Now().Add(5 * time.Second)); err != nil {
+		t.Fatalf("SetReadDeadline: %v", err)
+	}
+	buf := make([]byte, 512)
+	n, addr, err := pc.ReadFrom(buf)
+	if err != nil {
+		t.Fatalf("ReadFrom: %v (fragmented packet was not reassembled and delivered)", err)
+	}
+	if got := string(buf[:n]); got != string(payload) {
+		t.Fatalf("payload = %q, want %q", got, payload)
+	}
+	udpAddr, ok := addr.(*net.UDPAddr)
+	if !ok {
+		t.Fatalf("remote addr = %T(%v), want *net.UDPAddr", addr, addr)
+	}
+	if got := udpAddr.AddrPort(); got != netip.MustParseAddrPort("100.64.1.3:12345") {
+		t.Fatalf("remote addr = %v, want 100.64.1.3:12345", got)
+	}
+}
+
 // TestInjectLoopback verifies that the inject goroutine delivers self-addressed
 // packets back into gVisor (via DeliverLoopback) instead of sending them to
 // WireGuard outbound. This is a regression test for a bug where self-dial
diff --git a/wgengine/netstack/netstack_userping_apple.go b/wgengine/netstack/netstack_userping_apple.go
index a82b81e99..cb6926f0a 100644
--- a/wgengine/netstack/netstack_userping_apple.go
+++ b/wgengine/netstack/netstack_userping_apple.go
@@ -6,33 +6,30 @@
 package netstack
 
 import (
+	"context"
+	"net"
 	"net/netip"
 	"time"
 
-	probing "github.com/prometheus-community/pro-bing"
+	"tailscale.com/net/ping"
 )
 
 // sendOutboundUserPing sends a non-privileged ICMP (or ICMPv6) ping to dstIP with the given timeout.
 func (ns *Impl) sendOutboundUserPing(dstIP netip.Addr, timeout time.Duration) error {
-	p, err := probing.NewPinger(dstIP.String())
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+
+	p := ping.New(ctx, ns.logf, nil)
+	p.Unprivileged = true
+	defer p.Close()
+
+	dst := &net.IPAddr{IP: dstIP.AsSlice(), Zone: dstIP.Zone()}
+	ns.logf("sendOutboundUserPing: forwarding ping to %s", dstIP)
+	d, err := p.Send(ctx, dst, []byte("tailscale-userping"))
 	if err != nil {
-		ns.logf("sendICMPPingToIP failed to create pinger: %v", err)
+		ns.logf("sendOutboundUserPing: ping to %s failed: %v", dstIP, err)
 		return err
 	}
-
-	p.Timeout = timeout
-	p.Count = 1
-	p.SetPrivileged(false)
-
-	p.OnSend = func(pkt *probing.Packet) {
-		ns.logf("sendICMPPingToIP: forwarding ping to %s:", p.Addr())
-	}
-	p.OnRecv = func(pkt *probing.Packet) {
-		ns.logf("sendICMPPingToIP: %d bytes pong from %s: icmp_seq=%d time=%v", pkt.Nbytes, pkt.IPAddr, pkt.Seq, pkt.Rtt)
-	}
-	p.OnFinish = func(stats *probing.Statistics) {
-		ns.logf("sendICMPPingToIP: done, %d replies received", stats.PacketsRecv)
-	}
-
-	return p.Run()
+	ns.logf("sendOutboundUserPing: pong from %s in %v", dstIP, d)
+	return nil
 }
diff --git a/wgengine/pendopen.go b/wgengine/pendopen.go
index e816506de..52055b174 100644
--- a/wgengine/pendopen.go
+++ b/wgengine/pendopen.go
@@ -68,7 +68,6 @@ func (e *userspaceEngine) trackOpenPreFilterIn(pp *packet.Parsed, t *tstun.Wrapp
 	res = filter.Accept // always
 
 	if pp.IPProto == ipproto.TSMP {
-		res = filter.DropSilently
 		rh, ok := pp.AsTailscaleRejectedHeader()
 		if !ok {
 			return
@@ -78,6 +77,14 @@ func (e *userspaceEngine) trackOpenPreFilterIn(pp *packet.Parsed, t *tstun.Wrapp
 		} else if f := tsRejectFlow(rh); e.removeFlow(f) {
 			e.logf("open-conn-track: flow %v %v > %v rejected due to %v", rh.Proto, rh.Src, rh.Dst, rh.Reason)
 		}
+		switch rh.Reason {
+		case packet.RejectedDueToUnknownAppConnectorTransitIP:
+			// Keep res = filter.Accept, don't drop this packet because it will
+			// be used later for further communication between app connector
+			// and client.
+		default:
+			res = filter.DropSilently
+		}
 		return
 	}
 
@@ -131,14 +138,14 @@ func (e *userspaceEngine) isOSNetworkProbe(dst netip.AddrPort) bool {
 	// iOS had log spam like:
 	// open-conn-track: timeout opening (100.115.73.60:52501 => 17.125.252.5:443); no associated peer node
 	if runtime.GOOS == "ios" && dst.Port() == 443 && appleIPRange.Contains(dst.Addr()) {
-		if _, ok := e.PeerForIP(dst.Addr()); !ok {
+		if _, ok := e.peerForIP(dst.Addr()); !ok {
 			return true
 		}
 	}
 	// NetworkManager; https://github.com/tailscale/tailscale/issues/13687
 	// open-conn-track: timeout opening (TCP 100.96.229.119:42798 => 185.125.190.49:80); no associated peer node
 	if runtime.GOOS == "linux" && dst.Port() == 80 && canonicalIPs()(dst.Addr()) {
-		if _, ok := e.PeerForIP(dst.Addr()); !ok {
+		if _, ok := e.peerForIP(dst.Addr()); !ok {
 			return true
 		}
 	}
@@ -192,7 +199,7 @@ func (e *userspaceEngine) onOpenTimeout(flow flowtrack.Tuple) {
 	}
 
 	// Diagnose why it might've timed out.
-	pip, ok := e.PeerForIP(flow.DstAddr())
+	pip, ok := e.peerForIP(flow.DstAddr())
 	if !ok {
 		e.logf("open-conn-track: timeout opening %v; no associated peer node", flow)
 		return
diff --git a/wgengine/router/osrouter/router_linux.go b/wgengine/router/osrouter/router_linux.go
index 3c261c912..c8b31d00e 100644
--- a/wgengine/router/osrouter/router_linux.go
+++ b/wgengine/router/osrouter/router_linux.go
@@ -6,12 +6,17 @@
 package osrouter
 
 import (
+	"bytes"
 	"errors"
 	"fmt"
+	"io"
+	"iter"
 	"net"
 	"net/netip"
 	"os"
 	"os/exec"
+	"path/filepath"
+	"slices"
 	"strconv"
 	"strings"
 	"sync"
@@ -27,12 +32,14 @@ import (
 	"tailscale.com/envknob"
 	"tailscale.com/health"
 	"tailscale.com/net/netmon"
+	"tailscale.com/net/tsaddr"
 	"tailscale.com/tsconst"
 	"tailscale.com/types/logger"
 	"tailscale.com/types/opt"
 	"tailscale.com/types/preftype"
 	"tailscale.com/util/eventbus"
 	"tailscale.com/util/linuxfw"
+	"tailscale.com/util/set"
 	"tailscale.com/version/distro"
 	"tailscale.com/wgengine/router"
 )
@@ -71,9 +78,21 @@ type linuxRouter struct {
 
 	// Various feature checks for the network stack.
 	ipRuleAvailable bool     // whether kernel was built with IP_MULTIPLE_TABLES
-	v6Available     bool     // whether the kernel supports IPv6
 	fwmaskWorksLazy opt.Bool // whether we can use 'ip rule...fwmark <mark>/<mask>'; set lazily
 
+	// interfaceV6Usable reports whether the kernel has IPv6 enabled on the
+	// tunnel interface specifically (distinct from global IPv6 support,
+	// which the netfilter runner tracks). Always set: the constructor wires
+	// it to interfaceV6UsableForTun; tests override it. See #20447.
+	interfaceV6Usable func() bool
+
+	// interfaceV6UsableMemo memoizes interfaceV6Usable for the duration of a
+	// single Set, so its many getV6Available calls don't each hit /proc. It's
+	// an atomic tri-state (see the memoV6 constants) because getV6Available is
+	// also reached, without holding mu, from the onIPRuleDeleted timer's
+	// justAddIPRules; the unset value there means "read live". See #20447.
+	interfaceV6UsableMemo atomic.Int32
+
 	// ipPolicyPrefBase is the base priority at which ip rules are installed.
 	ipPolicyPrefBase int
 
@@ -82,6 +101,7 @@ type linuxRouter struct {
 
 	mu                sync.Mutex
 	addrs             map[netip.Prefix]bool
+	lastScanAddrs     set.Set[netip.Prefix] // desired addrs at the last successful orphan scan; nil until the first scan
 	routes            map[netip.Prefix]bool
 	localRoutes       map[netip.Prefix]bool
 	snatSubnetRoutes  bool
@@ -89,6 +109,7 @@ type linuxRouter struct {
 	connmarkEnabled   bool // whether connmark rules are currently enabled
 	netfilterMode     preftype.NetfilterMode
 	netfilterKind     string
+	cgnatMode         linuxfw.CGNATMode
 	magicsockPortV4   uint16
 	magicsockPortV6   uint16
 }
@@ -119,6 +140,7 @@ func newUserspaceRouterAdvanced(logf logger.Logf, tunname string, netMon *netmon
 		ipRuleFixLimiter: rate.NewLimiter(rate.Every(5*time.Second), 10),
 		ipPolicyPrefBase: 5200,
 	}
+	r.interfaceV6Usable = func() bool { return interfaceV6UsableForTun(r.tunname) }
 	ec := bus.Client("router-linux")
 	r.rulesAddedPub = eventbus.Publish[AddIPRules](ec)
 	eventbus.SubscribeFunc(ec, func(rs netmon.RuleDeleted) {
@@ -167,8 +189,6 @@ func newUserspaceRouterAdvanced(logf logger.Logf, tunname string, netMon *netmon
 		r.logf("mwan3 on openWRT detected, switching policy base priority to 1300")
 	}
 
-	r.v6Available = linuxfw.CheckIPv6(r.logf) == nil
-
 	r.fixupWSLMTU()
 
 	return r, nil
@@ -416,6 +436,11 @@ func (r *linuxRouter) setupNetfilterLocked(kind string) error {
 func (r *linuxRouter) Set(cfg *router.Config) error {
 	r.mu.Lock()
 	defer r.mu.Unlock()
+	// Memoize the tun's IPv6 usability for the duration of this Set so the
+	// per-address/route getV6Available calls don't each re-read /proc.
+	// snapshotV6Usable runs now; the closure it returns (trailing ()) is
+	// deferred to clear the memo on return.
+	defer r.snapshotV6Usable()()
 	var errs []error
 	if cfg == nil {
 		cfg = &shutdownConfig
@@ -449,12 +474,48 @@ func (r *linuxRouter) Set(cfg *router.Config) error {
 	}
 	r.routes = newRoutes
 
+	prevAddrs := r.addrs
 	newAddrs, err := cidrDiff("addr", r.addrs, cfg.LocalAddrs, r.addAddress, r.delAddress, r.logf)
 	if err != nil {
 		errs = append(errs, err)
 	}
 	r.addrs = newAddrs
 
+	// r.addrs only tracks what this instance configured, so it misses
+	// Tailscale addresses a previous instance left on a persistent tailscale0.
+	// After the reconcile above (so our own addresses and their loopback rules
+	// are installed first), sweep any Tailscale-range interface address that
+	// isn't desired and that we don't already track (prevAddrs). Like cidrDiff,
+	// this trusts cfg.LocalAddrs to be authoritative. See #19974.
+	//
+	// TODO(bcreane): a late orphan with no config change -- IPv6 becoming
+	// available, or an external re-add -- isn't caught here; re-run this sweep on
+	// netmon.ChangeDelta to handle it. See tailscale/corp#43882.
+	wantAddrs := set.SetOf(cfg.LocalAddrs)
+	if r.lastScanAddrs == nil || !r.lastScanAddrs.Equal(wantAddrs) {
+		if ifaceAddrs, err := r.tailscaleInterfaceAddrs(); err != nil {
+			r.logf("router: enumerating interface addresses failed, skipping orphan cleanup: %v", err)
+		} else {
+			r.lastScanAddrs = wantAddrs
+			kernelAddrs := r.deletableAddrs(ifaceAddrs)
+			var removed []netip.Prefix
+			for p := range orphanedAddrs(kernelAddrs, cfg.LocalAddrs) {
+				if prevAddrs[p] {
+					continue // an address we were tracking; cidrDiff already handled it
+				}
+				if err := r.delAddress(p); err != nil {
+					r.logf("router: removing stale address %v from %s failed: %v", p, r.tunname, err)
+					errs = append(errs, err)
+					continue
+				}
+				removed = append(removed, p)
+			}
+			if len(removed) > 0 {
+				r.logf("router: removed %d stale Tailscale address(es) from %s left by a previous instance: %v", len(removed), r.tunname, removed)
+			}
+		}
+	}
+
 	// Ensure that the SNAT rule is added or removed as needed.
 	switch {
 	case cfg.SNATSubnetRoutes == r.snatSubnetRoutes:
@@ -489,7 +550,9 @@ func (r *linuxRouter) Set(cfg *router.Config) error {
 	// Connmark rules for rp_filter compatibility.
 	// Always enabled when netfilter is ON to handle all rp_filter=1 scenarios
 	// (normal operation, exit nodes, subnet routers, and clients using exit nodes).
-	netfilterOn := cfg.NetfilterMode == netfilterOn
+	// Gate on r.netfilterMode (actual state) rather than cfg.NetfilterMode
+	// (desired state) so we don't call into the runner when chain setup failed.
+	netfilterOn := r.netfilterMode == netfilterOn
 	switch {
 	case netfilterOn == r.connmarkEnabled:
 		// state already correct, nothing to do.
@@ -502,6 +565,14 @@ func (r *linuxRouter) Set(cfg *router.Config) error {
 			// Only update state on success to keep it in sync with actual rules
 			r.connmarkEnabled = true
 		}
+		// Enable src_valid_mark so the kernel uses the packet's fwmark
+		// during the rp_filter reverse-path check. Without this, the
+		// connmark restore in mangle/PREROUTING is ineffective — rp_filter
+		// does its routing lookup with fwmark=0, ignoring the restored
+		// bypass mark, and drops reply packets as martians.
+		if err := writeSysctl("net.ipv4.conf.all.src_valid_mark", "1"); err != nil {
+			r.logf("warning: failed to enable src_valid_mark: %v", err)
+		}
 	default:
 		r.logf("disabling connmark-based rp_filter workaround")
 		if err := r.nfr.DelConnmarkSaveRule(); err != nil {
@@ -521,9 +592,50 @@ func (r *linuxRouter) Set(cfg *router.Config) error {
 		r.enableIPForwarding()
 	}
 
+	// Remove the rule to drop off-tailnet CGNAT traffic, if needed.
+	if netfilterOn || r.netfilterMode == netfilterNoDivert {
+		var cgnatMode linuxfw.CGNATMode
+		if cfg.RemoveCGNATDropRule {
+			cgnatMode = linuxfw.CGNATModeReturn
+		} else {
+			cgnatMode = linuxfw.CGNATModeDrop
+		}
+		err := r.setCGNATDropModeLocked(cgnatMode)
+		if err != nil {
+			errs = append(errs, fmt.Errorf("set cgnat mode: %w", err))
+		}
+	}
+
 	return errors.Join(errs...)
 }
 
+// setCGNATDropModeLocked clears old rules and add new rules for the desired
+// behavior for incoming non-Tailscale CGNAT packets.
+// [linuxRouter.mu] must be held.
+func (r *linuxRouter) setCGNATDropModeLocked(want linuxfw.CGNATMode) error {
+	if want == r.cgnatMode {
+		return nil
+	}
+	// r.cgnatMode is empty at initial startup, before this function has been
+	// called for the first time. In that case, we can skip deleting old
+	// rules, because there aren't any.
+	if r.cgnatMode != "" {
+		err := r.nfr.DelExternalCGNATRules(r.cgnatMode, r.tunname)
+		if err != nil {
+			return fmt.Errorf("clear old cgnat rules: %w", err)
+		}
+	}
+	err := r.nfr.AddExternalCGNATRules(want, r.tunname)
+	if err != nil {
+		// We currently have no rules set, so change the state to reflect that
+		// so we might try again on a future Router update.
+		r.cgnatMode = ""
+		return fmt.Errorf("add new cgnat rules: %w", err)
+	}
+	r.cgnatMode = want
+	return nil
+}
+
 var dockerStatefulFilteringWarnable = health.Register(&health.Warnable{
 	Code:     "docker-stateful-filtering",
 	Title:    "Docker with stateful filtering",
@@ -772,18 +884,108 @@ func (r *linuxRouter) setNetfilterModeLocked(mode preftype.NetfilterMode) error
 		}
 	}
 
+	// Re-add the CGNAT rules if we had any set.
+	// This does not call [linuxRouter.setCGNATDropModeLocked] because that
+	// function assumes that [linuxRouter.cgnatMode] accurately represents the
+	// current state in the firewall. This would not be true when we hit this
+	// code path, and is what we're fixing up here.
+	if r.cgnatMode != "" {
+		if err := r.nfr.AddExternalCGNATRules(r.cgnatMode, r.tunname); err != nil {
+			// We currently have no rules set, so change the state to reflect that
+			// so we might try again on a future Router update.
+			r.cgnatMode = ""
+			return fmt.Errorf("add cgnat rules: %w", err)
+		}
+	}
+
 	return nil
 }
 
 // getV6FilteringAvailable returns true if the router is able to setup the
 // required tailscale filter rules for IPv6.
 func (r *linuxRouter) getV6FilteringAvailable() bool {
+	if r.nfr == nil {
+		return false
+	}
 	return r.nfr.HasIPV6() && r.nfr.HasIPV6Filter()
 }
 
-// getV6Available returns true if the host supports IPv6.
+// getV6Available reports whether the router can manage IPv6. r.nfr can be nil if
+// setupNetfilterLocked failed earlier in Set (which continues on error), so
+// treat a nil runner as no IPv6 rather than dereferencing it.
+//
+// It requires both global IPv6 support (the netfilter runner) and IPv6 on the
+// tun interface itself, which can differ: the kernel may refuse IPv6 on the tun
+// while global IPv6 is fine. The per-interface check consults /proc, so within
+// a single Set (which calls this once per address and route) the result is
+// snapshotted by snapshotV6Usable rather than re-read each time. See #20447.
 func (r *linuxRouter) getV6Available() bool {
-	return r.nfr.HasIPV6()
+	if r.nfr == nil {
+		return false
+	}
+	switch memoV6(r.interfaceV6UsableMemo.Load()) {
+	case memoV6Usable:
+		return r.nfr.HasIPV6()
+	case memoV6Unusable:
+		return false
+	default: // memoV6Unset: no snapshot active, read live.
+		return r.nfr.HasIPV6() && r.interfaceV6Usable()
+	}
+}
+
+// memoV6 is the state of a linuxRouter.interfaceV6UsableMemo snapshot.
+type memoV6 int32
+
+const (
+	memoV6Unset    memoV6 = iota // no snapshot active; read live
+	memoV6Usable                 // snapshot: IPv6 usable on the tun interface
+	memoV6Unusable               // snapshot: IPv6 not usable on the tun interface
+)
+
+// snapshotV6Usable memoizes interfaceV6Usable for the duration of a Set, so
+// its many getV6Available calls don't each hit /proc. It returns a function
+// that clears the snapshot, intended to be deferred. The snapshot is taken
+// once: an IPv6-enabled flip concurrent with a single Set is rare and, since a
+// stray v6 operation is no longer fatal, harmless until the next Set. See
+// #20447.
+func (r *linuxRouter) snapshotV6Usable() func() {
+	m := memoV6Unusable
+	if r.interfaceV6Usable() {
+		m = memoV6Usable
+	}
+	r.interfaceV6UsableMemo.Store(int32(m))
+	return func() { r.interfaceV6UsableMemo.Store(int32(memoV6Unset)) }
+}
+
+// interfaceV6UsableForTun reports whether the kernel has IPv6 enabled on the
+// named interface. The kernel creates /proc/sys/net/ipv6/conf/<iface>/ only
+// once IPv6 is up on the interface (e.g. an MTU below the 1280-byte IPv6
+// minimum removes it entirely), and disable_ipv6 within it reflects whether
+// IPv6 has since been turned off explicitly.
+func interfaceV6UsableForTun(tunname string) bool {
+	if tunname == "" {
+		return false
+	}
+	// Open under conf/ with os.OpenInRoot so a "../" or symlink in tunname can't
+	// escape the directory.
+	f, err := os.OpenInRoot("/proc/sys/net/ipv6/conf", filepath.Join(tunname, "disable_ipv6"))
+	if err != nil {
+		// A missing directory/knob means IPv6 isn't up on the interface, so it's
+		// unavailable. Any other error (e.g. EACCES, or tunname escaping the
+		// root) means we couldn't read the knob; assume IPv6 is usable rather
+		// than skipping it on a transient or defensive error.
+		return !os.IsNotExist(err)
+	}
+	defer f.Close()
+	bs, err := io.ReadAll(f)
+	if err != nil {
+		return true // couldn't read; assume usable
+	}
+	disabled, err := strconv.ParseBool(strings.TrimSpace(string(bs)))
+	if err != nil {
+		return true // unparseable; assume usable
+	}
+	return !disabled
 }
 
 // addAddress adds an IP/mask to the tunnel interface. Fails if the
@@ -812,32 +1014,144 @@ func (r *linuxRouter) addAddress(addr netip.Prefix) error {
 	return nil
 }
 
-// delAddress removes an IP/mask from the tunnel interface. Fails if
-// the address is not assigned to the interface, or if the removal
-// fails.
+// delAddress removes an IP/mask from the tunnel interface. It attempts both the
+// loopback-rule teardown and the address deletion even if the former fails, so a
+// missing firewall rule can't leak the address; errors from both are joined.
 func (r *linuxRouter) delAddress(addr netip.Prefix) error {
-	if !r.getV6Available() && addr.Addr().Is6() {
-		return nil
-	}
+	var errs []error
 	if err := r.delLoopbackRule(addr.Addr()); err != nil {
-		return err
+		errs = append(errs, err)
 	}
+	if err := r.delAddrRaw(addr); err != nil {
+		errs = append(errs, err)
+	}
+	return errors.Join(errs...)
+}
+
+// delAddrRaw deletes addr from the tunnel interface without the loopback-rule
+// teardown that [linuxRouter.delAddress] does.
+func (r *linuxRouter) delAddrRaw(addr netip.Prefix) error {
 	if r.useIPCommand() {
 		if err := r.cmd.run("ip", "addr", "del", addr.String(), "dev", r.tunname); err != nil {
 			return fmt.Errorf("deleting address %q from tunnel interface: %w", addr, err)
 		}
-	} else {
-		link, err := r.link()
-		if err != nil {
-			return fmt.Errorf("deleting address %v, %w", addr, err)
-		}
-		if err := netlink.AddrDel(link, nlAddrOfPrefix(addr)); err != nil {
-			return fmt.Errorf("deleting address %v from tunnel interface: %w", addr, err)
-		}
+		return nil
+	}
+	link, err := r.link()
+	if err != nil {
+		return fmt.Errorf("deleting address %v, %w", addr, err)
+	}
+	if err := netlink.AddrDel(link, nlAddrOfPrefix(addr)); err != nil {
+		return fmt.Errorf("deleting address %v from tunnel interface: %w", addr, err)
 	}
 	return nil
 }
 
+// isDeletableAddr reports whether ip, found on the tunnel interface, is a
+// Tailscale-range address the live router should delete. It excludes IPv6 when
+// IPv6 is unavailable so the Set-time sweep doesn't churn on addresses this
+// instance couldn't have installed; the teardown path uses [tailscaleAddrs]
+// instead and removes every Tailscale-range address.
+func (r *linuxRouter) isDeletableAddr(ip netip.Addr) bool {
+	ip = ip.Unmap()
+	if !tsaddr.IsTailscaleIP(ip) {
+		return false
+	}
+	return !ip.Is6() || r.getV6Available()
+}
+
+// tailscaleAddrs yields only the Tailscale-range addresses from addrs, per
+// [tsaddr.IsTailscaleIP].
+func tailscaleAddrs(addrs iter.Seq[netip.Prefix]) iter.Seq[netip.Prefix] {
+	return func(yield func(netip.Prefix) bool) {
+		for p := range addrs {
+			if tsaddr.IsTailscaleIP(p.Addr()) && !yield(p) {
+				return
+			}
+		}
+	}
+}
+
+// deletableAddrs yields the addresses from addrs the live router should delete,
+// per [linuxRouter.isDeletableAddr].
+func (r *linuxRouter) deletableAddrs(addrs iter.Seq[netip.Prefix]) iter.Seq[netip.Prefix] {
+	return func(yield func(netip.Prefix) bool) {
+		for p := range addrs {
+			if r.isDeletableAddr(p.Addr()) && !yield(p) {
+				return
+			}
+		}
+	}
+}
+
+// tailscaleInterfaceAddrs yields the addresses on the tunnel interface,
+// preserving each kernel prefix length so a later delete matches. It errors if
+// the interface can't be read.
+func (r *linuxRouter) tailscaleInterfaceAddrs() (iter.Seq[netip.Prefix], error) {
+	if r.useIPCommand() {
+		return r.tailscaleInterfaceAddrsIPCommand()
+	}
+	link, err := r.link()
+	if err != nil {
+		return nil, err
+	}
+	addrs, err := netlink.AddrList(link, netlink.FAMILY_ALL)
+	if err != nil {
+		return nil, err
+	}
+	var ret []netip.Prefix
+	for _, a := range addrs {
+		if a.IPNet == nil {
+			continue
+		}
+		if pfx, ok := netipx.FromStdIPNet(a.IPNet); ok {
+			ret = append(ret, pfx)
+		}
+	}
+	return slices.Values(ret), nil
+}
+
+// tailscaleInterfaceAddrsIPCommand is the "ip" command implementation of
+// [linuxRouter.tailscaleInterfaceAddrs], used in tests and when
+// TS_DEBUG_USE_IP_COMMAND is set.
+func (r *linuxRouter) tailscaleInterfaceAddrsIPCommand() (iter.Seq[netip.Prefix], error) {
+	out, err := r.cmd.output("ip", "-oneline", "addr", "show", "dev", r.tunname)
+	if err != nil {
+		return nil, err
+	}
+	var ret []netip.Prefix
+	for line := range bytes.Lines(out) {
+		// `ip -oneline addr show` puts each address on one line as
+		// "inet <cidr>" or "inet6 <cidr>".
+		fields := strings.Fields(string(line))
+		for i := 0; i+1 < len(fields); i++ {
+			if fields[i] != "inet" && fields[i] != "inet6" {
+				continue
+			}
+			p, err := netip.ParsePrefix(fields[i+1])
+			if err != nil {
+				break
+			}
+			ret = append(ret, p)
+			break
+		}
+	}
+	return slices.Values(ret), nil
+}
+
+// orphanedAddrs yields the addresses in kernelAddrs that are not in desired,
+// i.e. the stale addresses left on the interface that the sweep should remove.
+func orphanedAddrs(kernelAddrs iter.Seq[netip.Prefix], desired []netip.Prefix) iter.Seq[netip.Prefix] {
+	want := set.SetOf(desired)
+	return func(yield func(netip.Prefix) bool) {
+		for p := range kernelAddrs {
+			if !want.Contains(p) && !yield(p) {
+				return
+			}
+		}
+	}
+}
+
 // addLoopbackRule adds a firewall rule to permit loopback traffic to
 // a local Tailscale IP.
 func (r *linuxRouter) addLoopbackRule(addr netip.Addr) error {
@@ -1624,10 +1938,49 @@ func platformCanNetfilter() bool {
 // The function calls cleanUp for both iptables and nftables since which ever
 // netfilter runner is used, the cleanUp function for the other one doesn't do anything.
 func cleanUp(logf logger.Logf, interfaceName string) {
-	if interfaceName != "userspace-networking" && platformCanNetfilter() {
+	if interfaceName == "userspace-networking" {
+		return
+	}
+	if platformCanNetfilter() {
 		linuxfw.IPTablesCleanUp(logf)
 		linuxfw.NfTablesCleanUp(logf)
 	}
+	removeOrphanedAddrsForCleanup(logf, osCommandRunner{ambientCapNetAdmin: useAmbientCaps()}, interfaceName)
+}
+
+// removeOrphanedAddrsForCleanup removes every Tailscale-range address from
+// interfaceName. On the teardown path (tailscaled --cleanup, and the cleanup at
+// daemon start) there is no desired config or running router, so every such
+// address is an orphan. Best-effort: failures are logged, not returned.
+func removeOrphanedAddrsForCleanup(logf logger.Logf, cmd commandRunner, interfaceName string) {
+	// A minimal router suffices: delAddress reaches delLoopbackRule, which
+	// returns early because netfilterMode is netfilterOff (the zero value), so
+	// the nil nfr/netMon/health are never dereferenced. logf is wrapped to match
+	// the live router's "router: " prefix.
+	r := &linuxRouter{
+		logf:    logger.WithPrefix(logf, "router: "),
+		tunname: interfaceName,
+		cmd:     cmd,
+	}
+	ifaceAddrs, err := r.tailscaleInterfaceAddrs()
+	if err != nil {
+		r.logf("enumerating %s addresses for cleanup failed: %v", interfaceName, err)
+		return
+	}
+	// Unlike the live sweep's deletableAddrs, tailscaleAddrs keeps IPv6 too: a
+	// previous instance may have left a ULA orphan even though this process never
+	// brought IPv6 up. delAddress is idempotent, so a no-op v6 delete is harmless.
+	var removed []netip.Prefix
+	for p := range tailscaleAddrs(ifaceAddrs) {
+		if err := r.delAddress(p); err != nil {
+			r.logf("removing stale address %v from %s during cleanup failed: %v", p, interfaceName, err)
+			continue
+		}
+		removed = append(removed, p)
+	}
+	if len(removed) > 0 {
+		r.logf("removed %d stale Tailscale address(es) from %s during cleanup: %v", len(removed), interfaceName, removed)
+	}
 }
 
 // Checks if the running openWRT system is using mwan3, based on the heuristic
diff --git a/wgengine/router/osrouter/router_linux_test.go b/wgengine/router/osrouter/router_linux_test.go
index 07aa8ced8..efa2bd358 100644
--- a/wgengine/router/osrouter/router_linux_test.go
+++ b/wgengine/router/osrouter/router_linux_test.go
@@ -31,6 +31,7 @@ import (
 	"tailscale.com/util/eventbus"
 	"tailscale.com/util/eventbus/eventbustest"
 	"tailscale.com/util/linuxfw"
+	"tailscale.com/util/set"
 	"tailscale.com/version/distro"
 	"tailscale.com/wgengine/router"
 )
@@ -524,6 +525,10 @@ v6/nat/ts-postrouting -m mark --mark 0x40000/0xff0000 -j MASQUERADE
 	ht := health.NewTracker(bus)
 	router, err := newUserspaceRouterAdvanced(t.Logf, "tailscale0", mon, fake, ht, bus)
 	router.(*linuxRouter).nfr = fake.nfr
+	// Don't consult the live /proc for the tun's IPv6 state in tests; the
+	// fake netfilter runner's HasIPV6 (noV6) is the authoritative v6 signal
+	// here. See #20447.
+	router.(*linuxRouter).interfaceV6Usable = func() bool { return true }
 	if err != nil {
 		t.Fatalf("failed to create router: %v", err)
 	}
@@ -561,7 +566,13 @@ type fakeIPTablesRunner struct {
 	t    *testing.T
 	ipt4 map[string][]string
 	ipt6 map[string][]string
-	// we always assume ipv6 and ipv6 nat are enabled when testing
+	// we always assume ipv6 and ipv6 nat are enabled when testing, unless
+	// noV6 is set.
+	noV6 bool
+
+	addChainsErr          error // if non-nil, AddChains returns it instead of setting up chains
+	addConnmarkSaveCalls  int
+	addExternalCGNATCalls int
 }
 
 func newIPTablesRunner(t *testing.T) linuxfw.NetfilterRunner {
@@ -717,11 +728,11 @@ func (n *fakeIPTablesRunner) DeleteDNATRuleForSvc(svcName string, origDst, dst n
 	return errors.New("not implemented")
 }
 
+type iptRule struct{ chain, rule string }
+
 func (n *fakeIPTablesRunner) addBase4(tunname string) error {
 	curIPT := n.ipt4
-	newRules := []struct{ chain, rule string }{
-		{"filter/ts-input", fmt.Sprintf("! -i %s -s %s -j RETURN", tunname, tsaddr.ChromeOSVMRange().String())},
-		{"filter/ts-input", fmt.Sprintf("! -i %s -s %s -j DROP", tunname, tsaddr.CGNATRange().String())},
+	newRules := []iptRule{
 		{"filter/ts-forward", fmt.Sprintf("-i %s -j MARK --set-mark %s/%s", tunname, tsconst.LinuxSubnetRouteMark, tsconst.LinuxFwmarkMask)},
 		{"filter/ts-forward", fmt.Sprintf("-m mark --mark %s/%s -j ACCEPT", tsconst.LinuxSubnetRouteMark, tsconst.LinuxFwmarkMask)},
 		{"filter/ts-forward", fmt.Sprintf("-o %s -s %s -j DROP", tunname, tsaddr.CGNATRange().String())},
@@ -737,7 +748,7 @@ func (n *fakeIPTablesRunner) addBase4(tunname string) error {
 
 func (n *fakeIPTablesRunner) addBase6(tunname string) error {
 	curIPT := n.ipt6
-	newRules := []struct{ chain, rule string }{
+	newRules := []iptRule{
 		{"filter/ts-forward", fmt.Sprintf("-i %s -j MARK --set-mark %s/%s", tunname, tsconst.LinuxSubnetRouteMark, tsconst.LinuxFwmarkMask)},
 		{"filter/ts-forward", fmt.Sprintf("-m mark --mark %s/%s -j ACCEPT", tsconst.LinuxSubnetRouteMark, tsconst.LinuxFwmarkMask)},
 		{"filter/ts-forward", fmt.Sprintf("-o %s -j ACCEPT", tunname)},
@@ -762,7 +773,7 @@ func (n *fakeIPTablesRunner) DelLoopbackRule(addr netip.Addr) error {
 }
 
 func (n *fakeIPTablesRunner) AddHooks() error {
-	newRules := []struct{ chain, rule string }{
+	newRules := []iptRule{
 		{"filter/INPUT", "-j ts-input"},
 		{"filter/FORWARD", "-j ts-forward"},
 		{"nat/POSTROUTING", "-j ts-postrouting"},
@@ -778,7 +789,7 @@ func (n *fakeIPTablesRunner) AddHooks() error {
 }
 
 func (n *fakeIPTablesRunner) DelHooks(logf logger.Logf) error {
-	delRules := []struct{ chain, rule string }{
+	delRules := []iptRule{
 		{"filter/INPUT", "-j ts-input"},
 		{"filter/FORWARD", "-j ts-forward"},
 		{"nat/POSTROUTING", "-j ts-postrouting"},
@@ -794,6 +805,9 @@ func (n *fakeIPTablesRunner) DelHooks(logf logger.Logf) error {
 }
 
 func (n *fakeIPTablesRunner) AddChains() error {
+	if n.addChainsErr != nil {
+		return n.addChainsErr
+	}
 	for _, ipt := range []map[string][]string{n.ipt4, n.ipt6} {
 		for _, chain := range []string{"filter/ts-input", "filter/ts-forward", "nat/ts-postrouting"} {
 			ipt[chain] = nil
@@ -922,6 +936,7 @@ func (n *fakeIPTablesRunner) DelMagicsockPortRule(port uint16, network string) e
 }
 
 func (n *fakeIPTablesRunner) AddConnmarkSaveRule() error {
+	n.addConnmarkSaveCalls++
 	// PREROUTING rule: restore mark from conntrack
 	prerouteRule := "-m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark --nfmask 0xff0000 --ctmask 0xff0000"
 	for _, ipt := range []map[string][]string{n.ipt4, n.ipt6} {
@@ -953,7 +968,50 @@ func (n *fakeIPTablesRunner) DelConnmarkSaveRule() error {
 	return nil
 }
 
-func (n *fakeIPTablesRunner) HasIPV6() bool       { return true }
+func buildExternalCGNATRules(mode linuxfw.CGNATMode, tunname string) ([]iptRule, error) {
+	switch mode {
+	case linuxfw.CGNATModeDrop:
+		return []iptRule{
+			{"filter/ts-input", fmt.Sprintf("! -i %s -s %s -j RETURN", tunname, tsaddr.ChromeOSVMRange().String())},
+			{"filter/ts-input", fmt.Sprintf("! -i %s -s %s -j DROP", tunname, tsaddr.CGNATRange().String())},
+		}, nil
+	case linuxfw.CGNATModeReturn:
+		return []iptRule{
+			{"filter/ts-input", fmt.Sprintf("! -i %s -s %s -j RETURN", tunname, tsaddr.CGNATRange().String())},
+		}, nil
+	default:
+		return nil, fmt.Errorf("unsupported mode %q", mode)
+	}
+}
+
+func (n *fakeIPTablesRunner) AddExternalCGNATRules(mode linuxfw.CGNATMode, tunname string) error {
+	n.addExternalCGNATCalls++
+	rules, err := buildExternalCGNATRules(mode, tunname)
+	if err != nil {
+		return err
+	}
+	for _, rule := range rules {
+		if err := appendRule(n, n.ipt4, rule.chain, rule.rule); err != nil {
+			return fmt.Errorf("add rule %q to chain %q: %w", rule.rule, rule.chain, err)
+		}
+	}
+	return nil
+}
+
+func (n *fakeIPTablesRunner) DelExternalCGNATRules(mode linuxfw.CGNATMode, tunname string) error {
+	rules, err := buildExternalCGNATRules(mode, tunname)
+	if err != nil {
+		return err
+	}
+	for _, rule := range rules {
+		if err := deleteRule(n, n.ipt4, rule.chain, rule.rule); err != nil {
+			return fmt.Errorf("del rule %q to chain %q: %w", rule.rule, rule.chain, err)
+		}
+	}
+	return nil
+}
+
+func (n *fakeIPTablesRunner) HasIPV6() bool       { return !n.noV6 }
 func (n *fakeIPTablesRunner) HasIPV6NAT() bool    { return true }
 func (n *fakeIPTablesRunner) HasIPV6Filter() bool { return true }
 
@@ -1074,6 +1132,12 @@ func (o *fakeOS) run(args ...string) error {
 	switch args[2] {
 	case "add":
 		if slices.Contains(*ls, rest) {
+			// addAddress uses netlink AddrReplace in production, which is
+			// idempotent; model that for addresses rather than erroring.
+			// Routes/rules keep strict add semantics.
+			if args[1] == "addr" {
+				return nil
+			}
 			o.t.Errorf("can't add %q, already present", rest)
 			return errors.New("already exists")
 		}
@@ -1111,8 +1175,34 @@ func (o *fakeOS) run(args ...string) error {
 }
 
 func (o *fakeOS) output(args ...string) ([]byte, error) {
-	want := "ip rule list priority 10000"
 	got := strings.Join(args, " ")
+
+	if dev, ok := strings.CutPrefix(got, "ip -oneline addr show dev "); ok {
+		// Render o.ips (entries look like "<cidr> dev <ifname>") in a simplified
+		// `ip -oneline addr show` format that exposes the family token the parser
+		// keys off of. Only addresses on the requested device are returned, so the
+		// fake models a real multi-interface host: `show dev tailscale0` never
+		// reports an address that lives on eth0.
+		var ret []string
+		for _, e := range o.ips {
+			cidr, rest, _ := strings.Cut(e, " ")
+			if rest != "dev "+dev {
+				continue // address is on a different interface
+			}
+			p, err := netip.ParsePrefix(cidr)
+			if err != nil {
+				continue
+			}
+			fam := "inet"
+			if p.Addr().Is6() {
+				fam = "inet6"
+			}
+			ret = append(ret, fmt.Sprintf("3: %s    %s %s scope global %s", dev, fam, cidr, dev))
+		}
+		return []byte(strings.Join(ret, "\n")), nil
+	}
+
+	want := "ip rule list priority 10000"
 	if got != want {
 		o.t.Errorf("unexpected command that wants output: %v", got)
 		return nil, errExec
@@ -1157,9 +1247,7 @@ func (lt *linuxTest) Close() error {
 }
 
 func newLinuxRootTest(t *testing.T) (*linuxTest, *eventbus.Bus) {
-	if os.Getuid() != 0 {
-		t.Skip("test requires root")
-	}
+	tstest.RequireRoot(t)
 
 	lt := new(linuxTest)
 	lt.tun = createTestTUN(t)
@@ -1211,7 +1299,9 @@ func TestRuleDeletedEvent(t *testing.T) {
 }
 
 func TestDelRouteIdempotent(t *testing.T) {
+	fake := NewFakeOS(t)
 	lt, _ := newLinuxRootTest(t)
+	lt.r.nfr = fake.nfr
 	defer lt.Close()
 
 	for _, s := range []string{
@@ -1237,7 +1327,9 @@ func TestDelRouteIdempotent(t *testing.T) {
 }
 
 func TestAddRemoveRules(t *testing.T) {
+	fake := NewFakeOS(t)
 	lt, _ := newLinuxRootTest(t)
+	lt.r.nfr = fake.nfr
 	defer lt.Close()
 	r := lt.r
 
@@ -1506,3 +1598,517 @@ func TestUpdateMagicsockPortChange(t *testing.T) {
 			oldPortRule, nfr.ipt4["filter/ts-input"])
 	}
 }
+
+// TestSetSkipsNetfilterAddonsWhenSetupFails verifies that Set does not invoke
+// rule-management methods that depend on the ts-* chains existing when chain
+// setup failed.
+func TestSetSkipsNetfilterAddonsWhenSetupFails(t *testing.T) {
+	nfr := newIPTablesRunner(t).(*fakeIPTablesRunner)
+	nfr.addChainsErr = errors.New("kernel lacks netfilter support")
+
+	bus := eventbus.New()
+	defer bus.Close()
+	mon, err := netmon.New(bus, logger.Discard)
+	if err != nil {
+		t.Fatal(err)
+	}
+	mon.Start()
+	defer mon.Close()
+
+	fake := NewFakeOS(t)
+	ht := health.NewTracker(bus)
+	r, err := newUserspaceRouterAdvanced(logger.Discard, "tailscale0", mon, fake, ht, bus)
+	if err != nil {
+		t.Fatalf("newUserspaceRouterAdvanced: %v", err)
+	}
+	lr := r.(*linuxRouter)
+	lr.nfr = nfr
+	// Keep the fake netfilter runner's HasIPV6 the sole v6 signal; don't
+	// consult the live /proc for the tun's IPv6 state. See #20447.
+	lr.interfaceV6Usable = func() bool { return true }
+	if err := lr.Up(); err != nil {
+		t.Fatalf("Up: %v", err)
+	}
+	defer lr.Close()
+
+	cfg := &Config{
+		LocalAddrs:    mustCIDRs("100.101.102.103/10"),
+		NetfilterMode: netfilterOn,
+	}
+	// Set must return an error (chain setup failed) but must not panic.
+	if err := lr.Set(cfg); err == nil {
+		t.Fatal("Set returned nil; want error because AddChains failed")
+	}
+	if lr.netfilterMode != netfilterOff {
+		t.Errorf("netfilterMode = %v; want netfilterOff after failed AddChains", lr.netfilterMode)
+	}
+	if nfr.addConnmarkSaveCalls != 0 {
+		t.Errorf("AddConnmarkSaveRule called %d times; want 0 when chain setup failed",
+			nfr.addConnmarkSaveCalls)
+	}
+	if nfr.addExternalCGNATCalls != 0 {
+		t.Errorf("AddExternalCGNATRules called %d times; want 0 when chain setup failed",
+			nfr.addExternalCGNATCalls)
+	}
+}
+
+// newTestLinuxRouter builds a linuxRouter backed by a fakeOS, brought up and
+// ready for Set, mirroring TestSetSkipsNetfilterAddonsWhenSetupFails.
+func newTestLinuxRouter(t *testing.T) (*linuxRouter, *fakeOS) {
+	t.Helper()
+	bus := eventbus.New()
+	t.Cleanup(bus.Close)
+	mon, err := netmon.New(bus, logger.Discard)
+	if err != nil {
+		t.Fatal(err)
+	}
+	mon.Start()
+	t.Cleanup(func() { mon.Close() })
+
+	fake := NewFakeOS(t)
+	ht := health.NewTracker(bus)
+	r, err := newUserspaceRouterAdvanced(logger.Discard, "tailscale0", mon, fake, ht, bus)
+	if err != nil {
+		t.Fatalf("newUserspaceRouterAdvanced: %v", err)
+	}
+	lr := r.(*linuxRouter)
+	lr.nfr = fake.nfr
+	// Keep the fake netfilter runner's HasIPV6 (noV6) the sole v6 signal;
+	// don't consult the live /proc for the tun's IPv6 state. See #20447.
+	lr.interfaceV6Usable = func() bool { return true }
+	if err := lr.Up(); err != nil {
+		t.Fatalf("Up: %v", err)
+	}
+	t.Cleanup(func() { lr.Close() })
+	return lr, fake
+}
+
+// TestSetRemovesOrphanedTailscaleAddrs verifies that Set removes Tailscale-range
+// addresses left on the interface by a previous instance (issue 19974), even
+// though they're absent from the in-memory r.addrs map.
+func TestSetRemovesOrphanedTailscaleAddrs(t *testing.T) {
+	lr, fake := newTestLinuxRouter(t)
+
+	// Simulate a tailscale0 that survived a restart still carrying a prior
+	// profile's CGNAT v4 and Tailscale ULA v6 addresses, plus a non-Tailscale
+	// address that must be left alone.
+	fake.ips = []string{
+		"100.64.0.99/32 dev tailscale0",         // CGNAT v4 orphan
+		"fd7a:115c:a1e0::99/128 dev tailscale0", // ULA v6 orphan
+		"192.168.1.5/24 dev tailscale0",         // non-Tailscale, leave alone
+	}
+	slices.Sort(fake.ips)
+
+	cfg := &Config{
+		LocalAddrs:    mustCIDRs("100.64.0.1/32"),
+		NetfilterMode: netfilterOff,
+	}
+	if err := lr.Set(cfg); err != nil {
+		t.Fatalf("Set: %v", err)
+	}
+
+	if !slices.Contains(fake.ips, "100.64.0.1/32 dev tailscale0") {
+		t.Errorf("desired addr 100.64.0.1/32 not present; ips=%q", fake.ips)
+	}
+	for _, gone := range []string{
+		"100.64.0.99/32 dev tailscale0",
+		"fd7a:115c:a1e0::99/128 dev tailscale0",
+	} {
+		if slices.Contains(fake.ips, gone) {
+			t.Errorf("orphaned Tailscale addr %q was not removed; ips=%q", gone, fake.ips)
+		}
+	}
+	// Non-Tailscale address must be untouched.
+	if !slices.Contains(fake.ips, "192.168.1.5/24 dev tailscale0") {
+		t.Errorf("non-Tailscale addr 192.168.1.5/24 was wrongly removed; ips=%q", fake.ips)
+	}
+}
+
+// TestSetRemovesOrphanWithNetfilter verifies orphan removal also works with
+// netfilter enabled, where delAddress additionally tears down the address's
+// loopback rule. An orphan from a previous instance has no such rule, so this
+// guards that removing it isn't blocked by the loopback-rule deletion (see the
+// iptables DelLoopbackRule DeleteIfExists handling).
+func TestSetRemovesOrphanWithNetfilter(t *testing.T) {
+	lr, fake := newTestLinuxRouter(t)
+
+	fake.ips = []string{
+		"100.64.0.99/32 dev tailscale0", // CGNAT v4 orphan, no loopback rule
+	}
+
+	cfg := &Config{
+		LocalAddrs:    mustCIDRs("100.64.0.1/32"),
+		NetfilterMode: netfilterOn,
+	}
+	if err := lr.Set(cfg); err != nil {
+		t.Fatalf("Set: %v", err)
+	}
+
+	if slices.Contains(fake.ips, "100.64.0.99/32 dev tailscale0") {
+		t.Errorf("orphan was not removed with netfilter on; ips=%q", fake.ips)
+	}
+	if !slices.Contains(fake.ips, "100.64.0.1/32 dev tailscale0") {
+		t.Errorf("desired addr 100.64.0.1/32 not present; ips=%q", fake.ips)
+	}
+}
+
+// TestSetInstallsLoopbackRuleForExistingAddr covers the persisted-interface
+// restart case: the node's own address is already on tailscale0 (so the kernel
+// reports it), but its per-address loopback rule was flushed when the netfilter
+// chains were rebuilt. Set must still install the loopback rule, i.e. it must
+// not skip addAddress just because the address is already present -- which it
+// would if a desired address were folded into the orphan set. See #19974.
+func TestSetInstallsLoopbackRuleForExistingAddr(t *testing.T) {
+	lr, fake := newTestLinuxRouter(t)
+
+	// The node's own address persisted on the interface across the restart.
+	fake.ips = []string{
+		"100.64.0.1/32 dev tailscale0",
+	}
+
+	cfg := &Config{
+		LocalAddrs:    mustCIDRs("100.64.0.1/32"),
+		NetfilterMode: netfilterOn,
+	}
+	if err := lr.Set(cfg); err != nil {
+		t.Fatalf("Set: %v", err)
+	}
+
+	nfr := fake.nfr.(*fakeIPTablesRunner)
+	wantRule := "-i lo -s 100.64.0.1 -j ACCEPT"
+	if !slices.Contains(nfr.ipt4["filter/ts-input"], wantRule) {
+		t.Errorf("loopback rule %q not installed for already-present addr; ts-input=%q",
+			wantRule, nfr.ipt4["filter/ts-input"])
+	}
+}
+
+// TestSetOrphanScanGatedByAddrChange verifies the interface is scanned for
+// orphans on the first Set and when LocalAddrs changes, but not for route-only
+// updates -- so a subnet router churning routes doesn't pay for a scan on every
+// Set.
+func TestSetOrphanScanGatedByAddrChange(t *testing.T) {
+	lr, fake := newTestLinuxRouter(t)
+
+	// First Set establishes steady state (scans, finds nothing to remove).
+	if err := lr.Set(&Config{
+		LocalAddrs:    mustCIDRs("100.64.0.1/32"),
+		NetfilterMode: netfilterOff,
+	}); err != nil {
+		t.Fatalf("Set 1: %v", err)
+	}
+
+	// An orphan appears afterward. A route-only update leaves LocalAddrs
+	// unchanged, so the scan is skipped and the orphan stays in place.
+	fake.ips = append(fake.ips, "100.64.0.99/32 dev tailscale0")
+	slices.Sort(fake.ips)
+	if err := lr.Set(&Config{
+		LocalAddrs:    mustCIDRs("100.64.0.1/32"),
+		Routes:        mustCIDRs("10.0.0.0/24"),
+		NetfilterMode: netfilterOff,
+	}); err != nil {
+		t.Fatalf("Set 2 (route-only): %v", err)
+	}
+	if !slices.Contains(fake.ips, "100.64.0.99/32 dev tailscale0") {
+		t.Errorf("orphan removed on a route-only update; scan should have been skipped; ips=%q", fake.ips)
+	}
+
+	// When LocalAddrs changes, the scan runs again and the orphan is removed.
+	if err := lr.Set(&Config{
+		LocalAddrs:    mustCIDRs("100.64.0.2/32"),
+		Routes:        mustCIDRs("10.0.0.0/24"),
+		NetfilterMode: netfilterOff,
+	}); err != nil {
+		t.Fatalf("Set 3 (addr change): %v", err)
+	}
+	if slices.Contains(fake.ips, "100.64.0.99/32 dev tailscale0") {
+		t.Errorf("orphan not removed after LocalAddrs change; ips=%q", fake.ips)
+	}
+}
+
+// TestSetOrphanScanNotRetriedOnDuplicateLocalAddrs verifies the scan gate
+// compares the desired address set rather than its length against r.addrs. A
+// duplicate in LocalAddrs (or, equivalently, an address that fails to install)
+// leaves r.addrs smaller than len(LocalAddrs); a length-based gate would then
+// rescan on every Set. The set comparison treats the desired set as unchanged.
+func TestSetOrphanScanNotRetriedOnDuplicateLocalAddrs(t *testing.T) {
+	lr, fake := newTestLinuxRouter(t)
+
+	// LocalAddrs with a duplicate: cidrDiff dedups, so r.addrs ends up smaller
+	// than len(LocalAddrs).
+	dupCfg := &Config{
+		LocalAddrs:    mustCIDRs("100.64.0.1/32", "100.64.0.1/32"),
+		NetfilterMode: netfilterOff,
+	}
+	if err := lr.Set(dupCfg); err != nil {
+		t.Fatalf("Set 1: %v", err)
+	}
+
+	// An orphan appears; re-applying the same (duplicated) LocalAddrs must not
+	// trigger a rescan, so the orphan stays.
+	fake.ips = append(fake.ips, "100.64.0.99/32 dev tailscale0")
+	slices.Sort(fake.ips)
+	if err := lr.Set(dupCfg); err != nil {
+		t.Fatalf("Set 2: %v", err)
+	}
+	if !slices.Contains(fake.ips, "100.64.0.99/32 dev tailscale0") {
+		t.Errorf("rescan ran for an unchanged (duplicated) LocalAddrs; ips=%q", fake.ips)
+	}
+}
+
+// TestSetKeepsNonTailscaleAddrs is the safety check: Set must never remove
+// addresses outside Tailscale's ranges, even when they're not in the config.
+func TestSetKeepsNonTailscaleAddrs(t *testing.T) {
+	lr, fake := newTestLinuxRouter(t)
+
+	keep := []string{
+		"192.168.1.5/24 dev tailscale0",        // non-Tailscale v4
+		"fe80::1/64 dev tailscale0",            // link-local v6
+		"100.115.92.5/32 dev tailscale0",       // ChromeOS VM range: in CGNAT, not a Tailscale IP
+		"100.63.0.1/32 dev tailscale0",         // just below CGNAT 100.64.0.0/10
+		"100.128.0.1/32 dev tailscale0",        // just above CGNAT
+		"fd7a:115c:a1e1::1/128 dev tailscale0", // adjacent to the Tailscale ULA /48, not in it
+	}
+	fake.ips = append([]string(nil), keep...)
+	slices.Sort(fake.ips)
+
+	cfg := &Config{
+		LocalAddrs:    mustCIDRs("100.64.0.1/32"),
+		NetfilterMode: netfilterOff,
+	}
+	if err := lr.Set(cfg); err != nil {
+		t.Fatalf("Set: %v", err)
+	}
+
+	for _, k := range keep {
+		if !slices.Contains(fake.ips, k) {
+			t.Errorf("non-Tailscale addr %q was wrongly removed; ips=%q", k, fake.ips)
+		}
+	}
+}
+
+func TestOrphanedAddrs(t *testing.T) {
+	p := netip.MustParsePrefix
+	// orphanedAddrs yields in kernelAddrs order, but compare as sets to be safe.
+	got := set.SetOf(slices.Collect(orphanedAddrs(
+		slices.Values([]netip.Prefix{p("100.64.0.1/32"), p("100.64.0.99/32"), p("fd7a:115c:a1e0::99/128")}),
+		[]netip.Prefix{p("100.64.0.1/32")},
+	)))
+	want := set.SetOf([]netip.Prefix{p("100.64.0.99/32"), p("fd7a:115c:a1e0::99/128")})
+	if !got.Equal(want) {
+		t.Errorf("orphanedAddrs = %v; want %v", got.Slice(), want.Slice())
+	}
+	if got := slices.Collect(orphanedAddrs(slices.Values([]netip.Prefix(nil)), []netip.Prefix{p("100.64.0.1/32")})); got != nil {
+		t.Errorf("orphanedAddrs(nil, ...) = %v; want nil", got)
+	}
+}
+
+// TestGetV6AvailableNilNFR verifies the v6-availability checks don't panic when
+// r.nfr is nil, which happens if setupNetfilterLocked failed earlier in Set.
+// The orphan sweep reaches getV6Available via isDeletableAddr, so this
+// must not deref a nil runner.
+func TestGetV6AvailableNilNFR(t *testing.T) {
+	r := &linuxRouter{} // nfr left nil
+	if r.getV6Available() {
+		t.Error("getV6Available() = true with nil nfr; want false")
+	}
+	if r.getV6FilteringAvailable() {
+		t.Error("getV6FilteringAvailable() = true with nil nfr; want false")
+	}
+	if r.isDeletableAddr(netip.MustParseAddr("fd7a:115c:a1e0::99")) {
+		t.Error("isDeletableAddr(v6) = true with nil nfr; want false")
+	}
+}
+
+// TestSetSkipsV6OrphansWhenV6Unavailable verifies that when IPv6 is
+// unavailable, Set does not enumerate v6 orphans for removal. delAddress
+// no-ops on v6 in that state, so enumerating them would let cidrDiff record a
+// delete that never happened; instead we leave them out of the reconcile.
+func TestSetSkipsV6OrphansWhenV6Unavailable(t *testing.T) {
+	lr, fake := newTestLinuxRouter(t)
+	fake.nfr.(*fakeIPTablesRunner).noV6 = true
+
+	fake.ips = []string{
+		"100.64.0.99/32 dev tailscale0",         // CGNAT v4 orphan, removable
+		"fd7a:115c:a1e0::99/128 dev tailscale0", // ULA v6 orphan, not removable without v6
+	}
+	slices.Sort(fake.ips)
+
+	cfg := &Config{
+		LocalAddrs:    mustCIDRs("100.64.0.1/32"),
+		NetfilterMode: netfilterOff,
+	}
+	if err := lr.Set(cfg); err != nil {
+		t.Fatalf("Set: %v", err)
+	}
+
+	// The v4 orphan is removed; the v6 orphan is left in place rather than
+	// being treated as removed via a no-op delete.
+	if slices.Contains(fake.ips, "100.64.0.99/32 dev tailscale0") {
+		t.Errorf("v4 orphan was not removed; ips=%q", fake.ips)
+	}
+	if !slices.Contains(fake.ips, "fd7a:115c:a1e0::99/128 dev tailscale0") {
+		t.Errorf("v6 orphan should be left alone when v6 is unavailable; ips=%q", fake.ips)
+	}
+}
+
+// TestSetSkipsV6WhenInterfaceV6Unusable verifies that when global IPv6 is
+// available (the netfilter runner reports HasIPV6) but the kernel has not
+// enabled IPv6 on the tunnel interface itself -- e.g. the tun MTU is below the
+// 1280-byte IPv6 minimum -- Set skips the v6 address rather than failing. This
+// is the #20447 scenario: historically the v6 addAddress errored, aborting the
+// whole router pass, which in turn suppressed DNS configuration.
+func TestSetSkipsV6WhenInterfaceV6Unusable(t *testing.T) {
+	lr, fake := newTestLinuxRouter(t)
+	// Global v6 is fine (fake nfr HasIPV6 defaults true), but the tun
+	// interface has no usable v6.
+	lr.interfaceV6Usable = func() bool { return false }
+
+	cfg := &Config{
+		LocalAddrs:    mustCIDRs("100.64.0.1/32", "fd7a:115c:a1e0::1/128"),
+		NetfilterMode: netfilterOff,
+	}
+	if err := lr.Set(cfg); err != nil {
+		t.Fatalf("Set: %v", err)
+	}
+
+	// The v4 address is programmed; the v6 address is skipped rather than
+	// attempted (which would have errored on a v6-less interface).
+	if !slices.Contains(fake.ips, "100.64.0.1/32 dev tailscale0") {
+		t.Errorf("v4 address was not programmed; ips=%q", fake.ips)
+	}
+	if slices.Contains(fake.ips, "fd7a:115c:a1e0::1/128 dev tailscale0") {
+		t.Errorf("v6 address should be skipped when the interface has no usable v6; ips=%q", fake.ips)
+	}
+}
+
+// TestSetSnapshotsV6Usable verifies that a single Set consults the
+// per-interface IPv6 check (which reads /proc) once, rather than once per
+// address and route, even though many getV6Available calls happen within it.
+func TestSetSnapshotsV6Usable(t *testing.T) {
+	lr, _ := newTestLinuxRouter(t)
+	var calls int
+	lr.interfaceV6Usable = func() bool {
+		calls++
+		return true
+	}
+
+	cfg := &Config{
+		LocalAddrs:    mustCIDRs("100.64.0.1/32", "fd7a:115c:a1e0::1/128"),
+		Routes:        mustCIDRs("10.0.0.0/8", "fd00::/8"),
+		NetfilterMode: netfilterOff,
+	}
+	if err := lr.Set(cfg); err != nil {
+		t.Fatalf("Set: %v", err)
+	}
+	if calls != 1 {
+		t.Errorf("interfaceV6Usable called %d times during one Set; want 1 (snapshotted)", calls)
+	}
+}
+
+// TestCleanUpRemovesAllTailscaleAddrs verifies the teardown path removes every
+// Tailscale-range address (IPv4 CGNAT and IPv6 ULA) while leaving non-Tailscale
+// addresses alone.
+func TestCleanUpRemovesAllTailscaleAddrs(t *testing.T) {
+	fake := NewFakeOS(t)
+	fake.ips = []string{
+		"100.64.0.1/32 dev tailscale0",         // CGNAT v4
+		"fd7a:115c:a1e0::1/128 dev tailscale0", // ULA v6
+		"192.168.1.5/24 dev tailscale0",        // non-Tailscale, leave alone
+		"fe80::1/64 dev tailscale0",            // link-local v6, leave alone
+	}
+	slices.Sort(fake.ips)
+
+	removeOrphanedAddrsForCleanup(t.Logf, fake, "tailscale0")
+
+	for _, gone := range []string{
+		"100.64.0.1/32 dev tailscale0",
+		"fd7a:115c:a1e0::1/128 dev tailscale0",
+	} {
+		if slices.Contains(fake.ips, gone) {
+			t.Errorf("Tailscale addr %q was not removed during cleanup; ips=%q", gone, fake.ips)
+		}
+	}
+	for _, keep := range []string{
+		"192.168.1.5/24 dev tailscale0",
+		"fe80::1/64 dev tailscale0",
+	} {
+		if !slices.Contains(fake.ips, keep) {
+			t.Errorf("non-Tailscale addr %q was wrongly removed during cleanup; ips=%q", keep, fake.ips)
+		}
+	}
+}
+
+// TestCleanUpRemovesV6OrphanWithoutNetfilter is the teardown counterpart to
+// TestSetSkipsV6OrphansWhenV6Unavailable: with a nil netfilter runner (so
+// getV6Available is false), cleanup must still remove an IPv6 ULA orphan.
+func TestCleanUpRemovesV6OrphanWithoutNetfilter(t *testing.T) {
+	fake := NewFakeOS(t)
+	fake.ips = []string{
+		"fd7a:115c:a1e0::99/128 dev tailscale0", // ULA v6 orphan
+	}
+
+	removeOrphanedAddrsForCleanup(t.Logf, fake, "tailscale0")
+
+	if slices.Contains(fake.ips, "fd7a:115c:a1e0::99/128 dev tailscale0") {
+		t.Errorf("v6 orphan was not removed during cleanup; ips=%q", fake.ips)
+	}
+}
+
+// TestCleanUpKeepsNearRangeAddrs verifies the teardown sweep removes real
+// Tailscale orphans while leaving addresses at the edges of Tailscale's ranges
+// untouched. In particular the ChromeOS VM range is inside CGNAT 100.64.0.0/10
+// but excluded by tsaddr.IsTailscaleIP, so a naive CGNAT-prefix check would
+// wrongly delete it.
+func TestCleanUpKeepsNearRangeAddrs(t *testing.T) {
+	fake := NewFakeOS(t)
+	remove := []string{
+		"100.64.0.99/32 dev tailscale0",         // CGNAT v4 orphan
+		"fd7a:115c:a1e0::99/128 dev tailscale0", // Tailscale ULA v6 orphan
+	}
+	keep := []string{
+		"100.115.92.5/32 dev tailscale0",       // ChromeOS VM range: in CGNAT, not a Tailscale IP
+		"100.63.0.1/32 dev tailscale0",         // just below CGNAT
+		"100.128.0.1/32 dev tailscale0",        // just above CGNAT
+		"fd7a:115c:a1e1::1/128 dev tailscale0", // adjacent to the Tailscale ULA /48
+		"192.168.1.5/24 dev tailscale0",        // non-Tailscale v4
+		"fe80::1/64 dev tailscale0",            // link-local v6
+	}
+	fake.ips = append(append([]string(nil), remove...), keep...)
+	slices.Sort(fake.ips)
+
+	removeOrphanedAddrsForCleanup(t.Logf, fake, "tailscale0")
+
+	for _, r := range remove {
+		if slices.Contains(fake.ips, r) {
+			t.Errorf("orphan %q was not removed during cleanup; ips=%q", r, fake.ips)
+		}
+	}
+	for _, k := range keep {
+		if !slices.Contains(fake.ips, k) {
+			t.Errorf("near-range non-Tailscale addr %q was wrongly removed during cleanup; ips=%q", k, fake.ips)
+		}
+	}
+}
+
+// TestCleanUpOnlyTouchesTunInterface guards that the sweep is scoped to the
+// tunnel interface. 100.64.0.0/10 is shared ISP CGNAT space, so a host may carry
+// a non-Tailscale CGNAT address on its WAN/other interface; the sweep enumerates
+// and deletes only on tailscale0, so such an address on eth0 must never be
+// touched even though it's in the CGNAT range.
+func TestCleanUpOnlyTouchesTunInterface(t *testing.T) {
+	fake := NewFakeOS(t)
+	fake.ips = []string{
+		"100.64.0.99/32 dev tailscale0", // our orphan on the tun -> removed
+		"100.64.0.5/32 dev eth0",        // someone else's CGNAT on WAN -> must survive
+	}
+	slices.Sort(fake.ips)
+
+	removeOrphanedAddrsForCleanup(t.Logf, fake, "tailscale0")
+
+	if slices.Contains(fake.ips, "100.64.0.99/32 dev tailscale0") {
+		t.Errorf("tailscale0 orphan was not removed; ips=%q", fake.ips)
+	}
+	if !slices.Contains(fake.ips, "100.64.0.5/32 dev eth0") {
+		t.Errorf("non-Tailscale CGNAT addr on eth0 was wrongly removed; ips=%q", fake.ips)
+	}
+}
diff --git a/wgengine/router/router.go b/wgengine/router/router.go
index 6868acb43..f8d702d47 100644
--- a/wgengine/router/router.go
+++ b/wgengine/router/router.go
@@ -132,10 +132,11 @@ type Config struct {
 	SubnetRoutes []netip.Prefix
 
 	// Linux-only things below, ignored on other platforms.
-	SNATSubnetRoutes  bool                   // SNAT traffic to local subnets
-	StatefulFiltering bool                   // Apply stateful filtering to inbound connections
-	NetfilterMode     preftype.NetfilterMode // how much to manage netfilter rules
-	NetfilterKind     string                 // what kind of netfilter to use ("nftables", "iptables", or "" to auto-detect)
+	SNATSubnetRoutes    bool                   // SNAT traffic to local subnets
+	StatefulFiltering   bool                   // Apply stateful filtering to inbound connections
+	NetfilterMode       preftype.NetfilterMode // how much to manage netfilter rules
+	NetfilterKind       string                 // what kind of netfilter to use ("nftables", "iptables", or "" to auto-detect)
+	RemoveCGNATDropRule bool                   // whether to remove the firewall rule to drop non-Tailscale inbound traffic from CGNAT IPs
 }
 
 func (a *Config) Equal(b *Config) bool {
diff --git a/wgengine/router/router_test.go b/wgengine/router/router_test.go
index f6176f1d0..e6b415586 100644
--- a/wgengine/router/router_test.go
+++ b/wgengine/router/router_test.go
@@ -15,7 +15,7 @@ func TestConfigEqual(t *testing.T) {
 	testedFields := []string{
 		"LocalAddrs", "Routes", "LocalRoutes", "NewMTU",
 		"SubnetRoutes", "SNATSubnetRoutes", "StatefulFiltering",
-		"NetfilterMode", "NetfilterKind",
+		"NetfilterMode", "NetfilterKind", "RemoveCGNATDropRule",
 	}
 	configType := reflect.TypeFor[Config]()
 	configFields := []string{}
diff --git a/wgengine/userspace.go b/wgengine/userspace.go
index 1b77d4b97..c9bae72ee 100644
--- a/wgengine/userspace.go
+++ b/wgengine/userspace.go
@@ -4,25 +4,24 @@
 package wgengine
 
 import (
-	"bufio"
 	"context"
 	crand "crypto/rand"
 	"crypto/x509"
 	"errors"
 	"fmt"
 	"io"
-	"maps"
 	"math"
 	"net/netip"
-	"reflect"
 	"runtime"
 	"slices"
-	"strings"
 	"sync"
+	"sync/atomic"
 	"time"
 
+	"github.com/gaissmai/bart"
 	"github.com/tailscale/wireguard-go/device"
 	"github.com/tailscale/wireguard-go/tun"
+	"go4.org/mem"
 	"tailscale.com/control/controlknobs"
 	"tailscale.com/drive"
 	"tailscale.com/envknob"
@@ -35,8 +34,8 @@ import (
 	"tailscale.com/net/ipset"
 	"tailscale.com/net/netmon"
 	"tailscale.com/net/packet"
+	"tailscale.com/net/routemanager"
 	"tailscale.com/net/sockstats"
-	"tailscale.com/net/tsaddr"
 	"tailscale.com/net/tsdial"
 	"tailscale.com/net/tstun"
 	"tailscale.com/syncs"
@@ -47,22 +46,18 @@ import (
 	"tailscale.com/types/ipproto"
 	"tailscale.com/types/key"
 	"tailscale.com/types/logger"
-	"tailscale.com/types/netmap"
 	"tailscale.com/types/views"
-	"tailscale.com/util/backoff"
 	"tailscale.com/util/checkchange"
 	"tailscale.com/util/clientmetric"
 	"tailscale.com/util/eventbus"
 	"tailscale.com/util/execqueue"
 	"tailscale.com/util/mak"
-	"tailscale.com/util/set"
 	"tailscale.com/util/singleflight"
 	"tailscale.com/util/testenv"
 	"tailscale.com/util/usermetric"
 	"tailscale.com/version"
 	"tailscale.com/wgengine/filter"
 	"tailscale.com/wgengine/magicsock"
-	"tailscale.com/wgengine/netlog"
 	"tailscale.com/wgengine/netstack/gro"
 	"tailscale.com/wgengine/router"
 	"tailscale.com/wgengine/wgcfg"
@@ -70,33 +65,6 @@ import (
 	"tailscale.com/wgengine/wglog"
 )
 
-// Lazy wireguard-go configuration parameters.
-const (
-	// lazyPeerIdleThreshold is the idle duration after
-	// which we remove a peer from the wireguard configuration.
-	// (This includes peers that have never been idle, which
-	// effectively have infinite idleness)
-	lazyPeerIdleThreshold = 5 * time.Minute
-
-	// packetSendTimeUpdateFrequency controls how often we record
-	// the time that we wrote a packet to an IP address.
-	packetSendTimeUpdateFrequency = 10 * time.Second
-
-	// packetSendRecheckWireguardThreshold controls how long we can go
-	// between packet sends to an IP before checking to see
-	// whether this IP address needs to be added back to the
-	// WireGuard peer oconfig.
-	packetSendRecheckWireguardThreshold = 1 * time.Minute
-)
-
-// statusPollInterval is how often we ask wireguard-go for its engine
-// status (as long as there's activity). See docs on its use below.
-const statusPollInterval = 1 * time.Minute
-
-// networkLoggerUploadTimeout is the maximum timeout to wait when
-// shutting down the network logger as it uploads the last network log messages.
-const networkLoggerUploadTimeout = 5 * time.Second
-
 type userspaceEngine struct {
 	// eventBus will eventually become required, but for now may be nil.
 	eventBus    *eventbus.Bus
@@ -119,11 +87,12 @@ type userspaceEngine struct {
 	netMon         *netmon.Monitor
 	health         *health.Tracker
 	netMonOwned    bool                // whether we created netMon (and thus need to close it)
-	birdClient     BIRDClient          // or nil
 	controlKnobs   *controlknobs.Knobs // or nil
 
-	testMaybeReconfigHook func()                        // for tests; if non-nil, fires if maybeReconfigWireguardLocked called
-	testDiscoChangedHook  func(map[key.NodePublic]bool) // for tests; if non-nil, fires after assembling discoChanged map
+	// bird is the BIRD integration handle constructed via
+	// [HookNewBird], or nil if [Config.BIRDSocket] was empty or the
+	// feature/bird package is not linked into the binary.
+	bird Bird
 
 	// isLocalAddr reports the whether an IP is assigned to the local
 	// tunnel interface. It's used to reflect local packets
@@ -134,27 +103,36 @@ type userspaceEngine struct {
 	// is being routed over Tailscale.
 	isDNSIPOverTailscale syncs.AtomicValue[func(netip.Addr) bool]
 
-	wgLock              sync.Mutex // serializes all wgdev operations; see lock order comment below
-	lastCfgFull         wgcfg.Config
-	lastNMinPeers       int
-	lastRouter          *router.Config
-	lastEngineFull      *wgcfg.Config // of full wireguard config, not trimmed
-	lastEngineInputs    *maybeReconfigInputs
-	lastDNSConfig       dns.ConfigView // or invalid if none
-	lastIsSubnetRouter  bool           // was the node a primary subnet router in the last run.
-	recvActivityAt      map[key.NodePublic]mono.Time
-	trimmedNodes        map[key.NodePublic]bool   // set of node keys of peers currently excluded from wireguard config
-	sentActivityAt      map[netip.Addr]*mono.Time // value is accessed atomically
-	destIPActivityFuncs map[netip.Addr]func()
-	lastStatusPollTime  mono.Time         // last time we polled the engine status
-	reconfigureVPN      func() error      // or nil
-	conn25PacketHooks   Conn25PacketHooks // or nil
+	wgLock sync.Mutex // serializes all wgdev operations; see lock order comment below
 
-	mu             sync.Mutex         // guards following; see lock order comment below
-	netMap         *netmap.NetworkMap // or nil
-	closing        bool               // Close was called (even if we're still closing)
+	// peerForIPFn, if non-nil, is the callback installed via
+	// [userspaceEngine.SetPeerForIPFunc]. peerForIP delegates to it
+	// for the cold-path control lookups (Ping, TSMP, pendopen, etc).
+	peerForIPFn atomic.Pointer[func(netip.Addr) (_ PeerForIP, ok bool)]
+
+	// peerConfigFn, if non-nil, is the live per-peer allowed-IPs
+	// source installed via [userspaceEngine.SetPeerConfigFunc]. When
+	// set, wgdev's PeerLookupFunc queries it directly, so reconfigs
+	// no longer install per-config lookup closures.
+	peerConfigFn atomic.Pointer[func(key.NodePublic) (allowedIPs []netip.Prefix, ok bool)]
+
+	lastCfg        wgcfg.Config
+	lastRouter     *router.Config
+	lastDNSConfig  dns.ConfigView // or invalid if none
+	reconfigureVPN func() error   // or nil
+
+	// lastAppliedDisableTUNUDPGRO and lastAppliedDisableTUNTCPGRO cache the
+	// controlknobs values that were last applied to the TUN device. They are
+	// read and updated under e.mu and only consulted when buildfeatures.HasGRO
+	// is true. Note: wireguard-go's GRO disablement is one-way (sticky), so
+	// transitions from disabled back to enabled require a client restart.
+	lastAppliedDisableTUNUDPGRO bool
+	lastAppliedDisableTUNTCPGRO bool
+
+	mu             sync.Mutex       // guards following; see lock order comment below
+	selfNode       tailcfg.NodeView // or invalid if none
+	closing        bool             // Close was called (even if we're still closing)
 	statusCallback StatusCallback
-	peerSequence   views.Slice[key.NodePublic]
 	endpoints      []tailcfg.Endpoint
 	pendOpen       map[flowtrackTuple]*pendingOpenFlow // see pendopen.go
 
@@ -166,36 +144,27 @@ type userspaceEngine struct {
 	// value of the ICMP identifier and sequence number concatenated.
 	icmpEchoResponseCallback map[uint32]func()
 
-	// networkLogger logs statistics about network connections.
-	networkLogger netlog.Logger
+	// netlogger is the network flow logger handle constructed via
+	// [HookNewNetLogger], or nil if the feature/netlog package is not
+	// linked into the binary.
+	netlogger NetLogger
 
-	// tsmpLearnedDisco tracks per node key if a peer disco key was learned via TSMP.
-	// wgLock must be held when using this map.
-	tsmpLearnedDisco map[key.NodePublic]key.DiscoPublic
+	// netLogSource is the [NetLogSource] installed via
+	// [Engine.SetNetLogSource]; the netlogger reads it on each
+	// Reconfig via [NetLoggerDeps.Source]. It may be nil if no source
+	// was installed.
+	netLogSource syncs.AtomicValue[NetLogSource]
+
+	// wgPeerLookup is the lookup function installed via
+	// [Engine.SetWGPeerLookup]; it is consulted by [wgLogger] to translate
+	// wireguard-go peer references in log lines. It may be nil if no
+	// lookup was installed, in which case peer references are not
+	// rewritten.
+	wgPeerLookup syncs.AtomicValue[func(wgString string) (tsString string, ok bool)]
 
 	// Lock ordering: magicsock.Conn.mu, wgLock, then mu.
 }
 
-// BIRDClient handles communication with the BIRD Internet Routing Daemon.
-type BIRDClient interface {
-	EnableProtocol(proto string) error
-	DisableProtocol(proto string) error
-	Close() error
-}
-
-// Conn25PacketHooks are hooks for Connectors 2025 app connectors.
-// They are meant to be wired into to corresponding hooks in the
-// [tstun.Wrapper]. They may modify the packet (e.g., NAT), or drop
-// invalid app connector traffic.
-type Conn25PacketHooks interface {
-	// HandlePacketsFromTunDevice sends packets originating from the tun device
-	// for further Connectors 2025 app connectors processing.
-	HandlePacketsFromTunDevice(*packet.Parsed) filter.Response
-	// HandlePacketsFromWireguard sends packets originating from WireGuard
-	// for further Connectors 2025 app connectors processing.
-	HandlePacketsFromWireGuard(*packet.Parsed) filter.Response
-}
-
 // Config is the engine configuration.
 type Config struct {
 	// Tun is the device used by the Engine to exchange packets with
@@ -241,6 +210,11 @@ type Config struct {
 	// connections (e.g. DERP). Passed through to magicsock.
 	ExtraRootCAs *x509.CertPool
 
+	// DERPAppName, if non-empty, is an opaque app name string to
+	// advertise to DERP servers for stats purposes. It is passed
+	// through to magicsock.
+	DERPAppName string
+
 	// ControlKnobs is the set of control plane-provied knobs
 	// to use.
 	// If nil, defaults are used.
@@ -255,9 +229,10 @@ type Config struct {
 	// Used in "fake" mode for development.
 	RespondToPing bool
 
-	// BIRDClient, if non-nil, will be used to configure BIRD whenever
-	// this node is a primary subnet router.
-	BIRDClient BIRDClient
+	// BIRDSocket, if non-empty, is the path of the BIRD unix socket to
+	// configure whenever this node is a primary subnet router. It
+	// requires the feature/bird package to be linked in.
+	BIRDSocket string
 
 	// SetSubsystem, if non-nil, is called for each new subsystem created, just before a successful return.
 	SetSubsystem func(any)
@@ -273,10 +248,6 @@ type Config struct {
 	// become required non-nil.
 	EventBus *eventbus.Bus
 
-	// Conn25PacketHooks, if non-nil, is used to hook packets for Connectors 2025
-	// app connector handling logic.
-	Conn25PacketHooks Conn25PacketHooks
-
 	// ForceDiscoKey, if non-zero, forces the use of a specific disco
 	// private key. This should only be used for special cases and
 	// experiments, not for production. The recommended normal path is to
@@ -391,27 +362,30 @@ func NewUserspaceEngine(logf logger.Logf, conf Config) (_ Engine, reterr error)
 	}
 
 	e := &userspaceEngine{
-		eventBus:          conf.EventBus,
-		timeNow:           mono.Now,
-		logf:              logf,
-		reqCh:             make(chan struct{}, 1),
-		waitCh:            make(chan struct{}),
-		tundev:            tsTUNDev,
-		router:            rtr,
-		dialer:            conf.Dialer,
-		confListenPort:    conf.ListenPort,
-		birdClient:        conf.BIRDClient,
-		controlKnobs:      conf.ControlKnobs,
-		reconfigureVPN:    conf.ReconfigureVPN,
-		health:            conf.HealthTracker,
-		conn25PacketHooks: conf.Conn25PacketHooks,
+		eventBus:       conf.EventBus,
+		timeNow:        mono.Now,
+		logf:           logf,
+		reqCh:          make(chan struct{}, 1),
+		waitCh:         make(chan struct{}),
+		tundev:         tsTUNDev,
+		router:         rtr,
+		dialer:         conf.Dialer,
+		confListenPort: conf.ListenPort,
+		controlKnobs:   conf.ControlKnobs,
+		reconfigureVPN: conf.ReconfigureVPN,
+		health:         conf.HealthTracker,
 	}
 
-	if e.birdClient != nil {
-		// Disable the protocol at start time.
-		if err := e.birdClient.DisableProtocol("tailscale"); err != nil {
+	if buildfeatures.HasBird && conf.BIRDSocket != "" {
+		newBird, ok := HookNewBird.GetOk()
+		if !ok {
+			return nil, errors.New("wgengine: Config.BIRDSocket set but the feature/bird package is not linked in")
+		}
+		bird, err := newBird(logf, conf.BIRDSocket)
+		if err != nil {
 			return nil, err
 		}
+		e.bird = bird
 	}
 	e.isLocalAddr.Store(ipset.FalseContainsIPFunc())
 	e.isDNSIPOverTailscale.Store(ipset.FalseContainsIPFunc())
@@ -456,16 +430,13 @@ func NewUserspaceEngine(logf logger.Logf, conf Config) (_ Engine, reterr error)
 		NetMon:         e.netMon,
 		HealthTracker:  e.health,
 		ExtraRootCAs:   conf.ExtraRootCAs,
+		DERPAppName:    conf.DERPAppName,
 		Metrics:        conf.Metrics,
 		ControlKnobs:   conf.ControlKnobs,
 		PeerByKeyFunc:  e.PeerByKey,
 		ForceDiscoKey:  conf.ForceDiscoKey,
 		OnDERPRecv:     conf.OnDERPRecv,
 	}
-	if buildfeatures.HasLazyWG {
-		magicsockOpts.NoteRecvActivity = e.noteRecvActivity
-	}
-
 	var err error
 	e.magicConn, err = magicsock.NewConn(magicsockOpts)
 	if err != nil {
@@ -474,6 +445,18 @@ func NewUserspaceEngine(logf logger.Logf, conf Config) (_ Engine, reterr error)
 	closePool.add(e.magicConn)
 	e.magicConn.SetNetworkUp(e.netMon.InterfaceState().AnyInterfaceUp())
 
+	if newNetLogger, ok := HookNewNetLogger.GetOk(); ok {
+		e.netlogger = newNetLogger(NetLoggerDeps{
+			Logf:   logf,
+			Tun:    e.tundev,
+			Sock:   e.magicConn,
+			NetMon: e.netMon,
+			Health: e.health,
+			Bus:    e.eventBus,
+			Source: e.netLogSource.Load,
+		})
+	}
+
 	tsTUNDev.SetDiscoKey(e.magicConn.DiscoPublicKey())
 
 	if conf.RespondToPing {
@@ -481,16 +464,6 @@ func NewUserspaceEngine(logf logger.Logf, conf Config) (_ Engine, reterr error)
 	}
 	e.tundev.PreFilterPacketOutboundToWireGuardEngineIntercept = e.handleLocalPackets
 
-	if e.conn25PacketHooks != nil {
-		e.tundev.PreFilterPacketOutboundToWireGuardAppConnectorIntercept = func(p *packet.Parsed, _ *tstun.Wrapper) filter.Response {
-			return e.conn25PacketHooks.HandlePacketsFromTunDevice(p)
-		}
-
-		e.tundev.PostFilterPacketInboundFromWireGuardAppConnector = func(p *packet.Parsed, _ *tstun.Wrapper) filter.Response {
-			return e.conn25PacketHooks.HandlePacketsFromWireGuard(p)
-		}
-	}
-
 	if buildfeatures.HasDebug && envknob.BoolDefaultTrue("TS_DEBUG_CONNECT_FAILURES") {
 		if e.tundev.PreFilterPacketInboundFromWireGuard != nil {
 			return nil, errors.New("unexpected PreFilterIn already set")
@@ -502,7 +475,13 @@ func NewUserspaceEngine(logf logger.Logf, conf Config) (_ Engine, reterr error)
 		e.tundev.PostFilterPacketOutboundToWireGuard = e.trackOpenPostFilterOut
 	}
 
-	e.wgLogger = wglog.NewLogger(logf)
+	e.wgLogger = wglog.NewLogger(logf, func(wgString string) (tsString string, ok bool) {
+		fn := e.wgPeerLookup.Load()
+		if fn == nil {
+			return "", false
+		}
+		return fn(wgString)
+	})
 	e.tundev.OnTSMPPongReceived = func(pong packet.TSMPPongReply) {
 		e.mu.Lock()
 		defer e.mu.Unlock()
@@ -578,7 +557,15 @@ func NewUserspaceEngine(logf logger.Logf, conf Config) (_ Engine, reterr error)
 	if err := e.router.Up(); err != nil {
 		return nil, fmt.Errorf("router.Up: %w", err)
 	}
-	tsTUNDev.SetLinkFeaturesPostUp()
+	tsTUNDev.SetLinkFeaturesPostUp(e.controlKnobs)
+	if buildfeatures.HasGRO && runtime.GOOS == "linux" && e.controlKnobs != nil {
+		// Seed the cached "last applied" TUN GRO knob values so the first
+		// netmap update doesn't spuriously call ApplyGROKnobs:
+		// SetLinkFeaturesPostUp above already applied these same values. We
+		// only do this on Linux because ApplyGROKnobs is a no-op elsewhere.
+		e.lastAppliedDisableTUNUDPGRO = e.controlKnobs.DisableTUNUDPGRO.Load()
+		e.lastAppliedDisableTUNTCPGRO = e.controlKnobs.DisableTUNTCPGRO.Load()
+	}
 
 	// It's a little pointless to apply no-op settings here (they
 	// should already be empty?), but it at least exercises the
@@ -619,7 +606,7 @@ func NewUserspaceEngine(logf logger.Logf, conf Config) (_ Engine, reterr error)
 		pkt := packet.TSMPDiscoKeyAdvertisement{
 			Key: update.Key,
 		}
-		peer, ok := e.PeerForIP(update.Src)
+		peer, ok := e.peerForIP(update.Src)
 		if !ok {
 			e.logf("wgengine: no peer found for %v", update.Src)
 			return
@@ -628,6 +615,9 @@ func NewUserspaceEngine(logf logger.Logf, conf Config) (_ Engine, reterr error)
 	})
 	var tsmpRequestGroup singleflight.Group[netip.Addr, struct{}]
 	eventbus.SubscribeFunc(ec, func(req magicsock.NewDiscoKeyAvailable) {
+		if !req.NodeFirstAddr.IsValid() {
+			return
+		}
 		go tsmpRequestGroup.Do(req.NodeFirstAddr, func() (struct{}, error) {
 			e.sendTSMPDiscoAdvertisement(req.NodeFirstAddr)
 			e.logf("wgengine: sending TSMP disco key advertisement to %v", req.NodeFirstAddr)
@@ -692,357 +682,121 @@ func (e *userspaceEngine) handleLocalPackets(p *packet.Parsed, t *tstun.Wrapper)
 	return filter.Accept
 }
 
-var debugTrimWireguard = envknob.RegisterOptBool("TS_DEBUG_TRIM_WIREGUARD")
-
-// forceFullWireguardConfig reports whether we should give wireguard our full
-// network map, even for inactive peers.
-//
-// TODO(bradfitz): remove this at some point. We had a TODO to do it before 1.0
-// but it's still there as of 1.30. Really we should not do this wireguard lazy
-// peer config at all and just fix wireguard-go to not have so much extra memory
-// usage per peer. That would simplify a lot of Tailscale code. OTOH, we have 50
-// MB of memory on iOS now instead of 15 MB, so the other option is to just give
-// up on lazy wireguard config and blow the memory and hope for the best on iOS.
-// That's sad too. Or we get rid of these knobs (lazy wireguard config has been
-// stable!) but I'm worried that a future regression would be easier to debug
-// with these knobs in place.
-func (e *userspaceEngine) forceFullWireguardConfig(numPeers int) bool {
-	// Did the user explicitly enable trimming via the environment variable knob?
-	if b, ok := debugTrimWireguard().Get(); ok {
-		return !b
+// SetPeerConfigFunc implements [Engine.SetPeerConfigFunc]. It stores
+// fn and installs a single wgdev PeerLookupFunc wrapping it, so
+// lazily-created peers always get current allowed IPs and the lookup
+// func never needs to be reinstalled as the peer set changes.
+func (e *userspaceEngine) SetPeerConfigFunc(fn func(key.NodePublic) (allowedIPs []netip.Prefix, ok bool)) {
+	if fn == nil {
+		panic("SetPeerConfigFunc: nil fn")
 	}
-	return e.controlKnobs != nil && e.controlKnobs.KeepFullWGConfig.Load()
+	e.peerConfigFn.Store(&fn)
+	e.wgdev.SetPeerLookupFunc(wgcfg.NewPeerLookupFunc(e.wgdev.Bind(), e.logf, func(pubk device.NoisePublicKey) ([]netip.Prefix, bool) {
+		return fn(key.NodePublicFromRaw32(mem.B(pubk[:])))
+	}))
 }
 
-// isTrimmablePeer reports whether p is a peer that we can trim out of the
-// network map.
-//
-// For implementation simplicity, we can only trim peers that have
-// only non-subnet AllowedIPs (an IPv4 /32 or IPv6 /128), which is the
-// common case for most peers. Subnet router nodes will just always be
-// created in the wireguard-go config.
-func (e *userspaceEngine) isTrimmablePeer(p *wgcfg.Peer, numPeers int) bool {
-	if e.forceFullWireguardConfig(numPeers) {
-		return false
+// SyncDevicePeer implements [Engine.SyncDevicePeer].
+func (e *userspaceEngine) SyncDevicePeer(k key.NodePublic) {
+	fn := e.peerConfigFn.Load()
+	if fn == nil {
+		return
 	}
-
-	// AllowedIPs must all be single IPs, not subnets.
-	for _, aip := range p.AllowedIPs {
-		if !aip.IsSingleIP() {
-			return false
-		}
-	}
-	return true
-}
-
-// noteRecvActivity is called by magicsock when a packet has been
-// received for the peer with node key nk. Magicsock calls this no
-// more than every 10 seconds for a given peer.
-func (e *userspaceEngine) noteRecvActivity(nk key.NodePublic) {
 	e.wgLock.Lock()
 	defer e.wgLock.Unlock()
-
-	if _, ok := e.recvActivityAt[nk]; !ok {
-		// Not a trimmable peer we care about tracking. (See isTrimmablePeer)
-		if e.trimmedNodes[nk] {
-			e.logf("wgengine: [unexpected] noteReceiveActivity called on idle node %v that's not in recvActivityAt", nk.ShortString())
-		}
-		return
-	}
-	now := e.timeNow()
-	e.recvActivityAt[nk] = now
-
-	// As long as there's activity, periodically poll the engine to get
-	// stats for the far away side effect of
-	// ipn/ipnlocal.LocalBackend.parseWgStatusLocked to log activity, for
-	// use in various admin dashboards.
-	// This particularly matters on platforms without a connected GUI, as
-	// the GUIs generally poll this enough to cause that logging. But
-	// tailscaled alone did not, hence this.
-	if e.lastStatusPollTime.IsZero() || now.Sub(e.lastStatusPollTime) >= statusPollInterval {
-		e.lastStatusPollTime = now
-		go e.RequestStatus()
-	}
-
-	// If the last activity time jumped a bunch (say, at least
-	// half the idle timeout) then see if we need to reprogram
-	// WireGuard. This could probably be just
-	// lazyPeerIdleThreshold without the divide by 2, but
-	// maybeReconfigWireguardLocked is cheap enough to call every
-	// couple minutes (just not on every packet).
-	if e.trimmedNodes[nk] {
-		e.logf("wgengine: idle peer %v now active, reconfiguring WireGuard", nk.ShortString())
-		e.maybeReconfigWireguardLocked(nil)
-	}
-}
-
-// isActiveSinceLocked reports whether the peer identified by (nk, ip)
-// has had a packet sent to or received from it since t.
-//
-// e.wgLock must be held.
-func (e *userspaceEngine) isActiveSinceLocked(nk key.NodePublic, ip netip.Addr, t mono.Time) bool {
-	if e.recvActivityAt[nk].After(t) {
-		return true
-	}
-	timePtr, ok := e.sentActivityAt[ip]
+	// The peer set may be about to change; drop the wgLogger's cached
+	// peer-string rewrites so the next log line re-resolves them.
+	e.wgLogger.Invalidate()
+	allowedIPs, ok := (*fn)(k)
 	if !ok {
-		return false
-	}
-	return timePtr.LoadAtomic().After(t)
-}
-
-// maybeReconfigInputs holds the inputs to the maybeReconfigWireguardLocked
-// function. If these things don't change between calls, there's nothing to do.
-type maybeReconfigInputs struct {
-	WGConfig     *wgcfg.Config
-	TrimmedNodes map[key.NodePublic]bool
-	TrackNodes   views.Slice[key.NodePublic]
-	TrackIPs     views.Slice[netip.Addr]
-}
-
-func (i *maybeReconfigInputs) Equal(o *maybeReconfigInputs) bool {
-	return reflect.DeepEqual(i, o)
-}
-
-func (i *maybeReconfigInputs) Clone() *maybeReconfigInputs {
-	if i == nil {
-		return nil
-	}
-	v := *i
-	v.WGConfig = i.WGConfig.Clone()
-	v.TrimmedNodes = maps.Clone(i.TrimmedNodes)
-	return &v
-}
-
-// discoChanged are the set of peers whose disco keys have changed, implying they've restarted.
-// If a peer is in this set and was previously in the live wireguard config,
-// it needs to be first removed and then re-added to flush out its wireguard session key.
-// If discoChanged is nil or empty, this extra removal step isn't done.
-//
-// e.wgLock must be held.
-func (e *userspaceEngine) maybeReconfigWireguardLocked(discoChanged map[key.NodePublic]bool) error {
-	if hook := e.testMaybeReconfigHook; hook != nil {
-		hook()
-		return nil
-	}
-
-	full := e.lastCfgFull
-	e.wgLogger.SetPeers(full.Peers)
-
-	// Compute a minimal config to pass to wireguard-go
-	// based on the full config. Prune off all the peers
-	// and only add the active ones back.
-	min := full
-	min.Peers = make([]wgcfg.Peer, 0, e.lastNMinPeers)
-
-	// We'll only keep a peer around if it's been active in
-	// the past 5 minutes. That's more than WireGuard's key
-	// rotation time anyway so it's no harm if we remove it
-	// later if it's been inactive.
-	var activeCutoff mono.Time
-	if buildfeatures.HasLazyWG {
-		activeCutoff = e.timeNow().Add(-lazyPeerIdleThreshold)
-	}
-
-	// Not all peers can be trimmed from the network map (see
-	// isTrimmablePeer). For those that are trimmable, keep track of
-	// their NodeKey and Tailscale IPs. These are the ones we'll need
-	// to install tracking hooks for to watch their send/receive
-	// activity.
-	var trackNodes []key.NodePublic
-	var trackIPs []netip.Addr
-	if buildfeatures.HasLazyWG {
-		trackNodes = make([]key.NodePublic, 0, len(full.Peers))
-		trackIPs = make([]netip.Addr, 0, len(full.Peers))
-	}
-
-	// Don't re-alloc the map; the Go compiler optimizes map clears as of
-	// Go 1.11, so we can re-use the existing + allocated map.
-	if e.trimmedNodes != nil {
-		clear(e.trimmedNodes)
-	} else {
-		e.trimmedNodes = make(map[key.NodePublic]bool)
-	}
-
-	needRemoveStep := false
-	for i := range full.Peers {
-		p := &full.Peers[i]
-		nk := p.PublicKey
-		if !buildfeatures.HasLazyWG || !e.isTrimmablePeer(p, len(full.Peers)) {
-			min.Peers = append(min.Peers, *p)
-			if discoChanged[nk] {
-				needRemoveStep = true
-			}
-			continue
-		}
-		trackNodes = append(trackNodes, nk)
-		recentlyActive := false
-		for _, cidr := range p.AllowedIPs {
-			trackIPs = append(trackIPs, cidr.Addr())
-			recentlyActive = recentlyActive || e.isActiveSinceLocked(nk, cidr.Addr(), activeCutoff)
-		}
-		if recentlyActive {
-			min.Peers = append(min.Peers, *p)
-			if discoChanged[nk] {
-				needRemoveStep = true
-			}
-		} else {
-			e.trimmedNodes[nk] = true
-		}
-	}
-	e.lastNMinPeers = len(min.Peers)
-
-	if changed := checkchange.Update(&e.lastEngineInputs, &maybeReconfigInputs{
-		WGConfig:     &min,
-		TrimmedNodes: e.trimmedNodes,
-		TrackNodes:   views.SliceOf(trackNodes),
-		TrackIPs:     views.SliceOf(trackIPs),
-	}); !changed {
-		return nil
-	}
-
-	if buildfeatures.HasLazyWG {
-		e.updateActivityMapsLocked(trackNodes, trackIPs)
-	}
-
-	if needRemoveStep {
-		minner := min
-		minner.Peers = nil
-		numRemove := 0
-		for _, p := range min.Peers {
-			if discoChanged[p.PublicKey] {
-				numRemove++
-				continue
-			}
-			minner.Peers = append(minner.Peers, p)
-		}
-		if numRemove > 0 {
-			e.logf("wgengine: Reconfig: removing session keys for %d peers", numRemove)
-			if err := wgcfg.ReconfigDevice(e.wgdev, &minner, e.logf); err != nil {
-				e.logf("wgdev.Reconfig: %v", err)
-				return err
-			}
-		}
-	}
-
-	e.logf("wgengine: Reconfig: configuring userspace WireGuard config (with %d/%d peers)", len(min.Peers), len(full.Peers))
-	if err := wgcfg.ReconfigDevice(e.wgdev, &min, e.logf); err != nil {
-		e.logf("wgdev.Reconfig: %v", err)
-		return err
-	}
-	return nil
-}
-
-// updateActivityMapsLocked updates the data structures used for tracking the activity
-// of wireguard peers that we might add/remove dynamically from the real config
-// as given to wireguard-go.
-//
-// e.wgLock must be held.
-func (e *userspaceEngine) updateActivityMapsLocked(trackNodes []key.NodePublic, trackIPs []netip.Addr) {
-	if !buildfeatures.HasLazyWG {
+		e.wgdev.RemovePeer(k.Raw32())
 		return
 	}
-	// Generate the new map of which nodekeys we want to track
-	// receive times for.
-	mr := map[key.NodePublic]mono.Time{} // TODO: only recreate this if set of keys changed
-	for _, nk := range trackNodes {
-		// Preserve old times in the new map, but also
-		// populate map entries for new trackNodes values with
-		// time.Time{} zero values. (Only entries in this map
-		// are tracked, so the Time zero values allow it to be
-		// tracked later)
-		mr[nk] = e.recvActivityAt[nk]
+	if peer, ok := e.wgdev.LookupActivePeer(k.Raw32()); ok {
+		peer.SetAllowedIPs(allowedIPs)
 	}
-	e.recvActivityAt = mr
-
-	oldTime := e.sentActivityAt
-	e.sentActivityAt = make(map[netip.Addr]*mono.Time, len(oldTime))
-	oldFunc := e.destIPActivityFuncs
-	e.destIPActivityFuncs = make(map[netip.Addr]func(), len(oldFunc))
-
-	updateFn := func(timePtr *mono.Time) func() {
-		return func() {
-			now := e.timeNow()
-			old := timePtr.LoadAtomic()
-
-			// How long's it been since we last sent a packet?
-			elapsed := now.Sub(old)
-			if old == 0 {
-				// For our first packet, old is 0, which has indeterminate meaning.
-				// Set elapsed to a big number (four score and seven years).
-				elapsed = 762642 * time.Hour
-			}
-
-			if elapsed >= packetSendTimeUpdateFrequency {
-				timePtr.StoreAtomic(now)
-			}
-			// On a big jump, assume we might no longer be in the wireguard
-			// config and go check.
-			if elapsed >= packetSendRecheckWireguardThreshold {
-				e.wgLock.Lock()
-				defer e.wgLock.Unlock()
-				e.maybeReconfigWireguardLocked(nil)
-			}
-		}
-	}
-
-	for _, ip := range trackIPs {
-		timePtr := oldTime[ip]
-		if timePtr == nil {
-			timePtr = new(mono.Time)
-		}
-		e.sentActivityAt[ip] = timePtr
-
-		fn := oldFunc[ip]
-		if fn == nil {
-			fn = updateFn(timePtr)
-		}
-		e.destIPActivityFuncs[ip] = fn
-	}
-	e.tundev.SetDestIPActivityFuncs(e.destIPActivityFuncs)
 }
 
-// hasOverlap checks if there is a IPPrefix which is common amongst the two
-// provided slices.
-func hasOverlap(aips, rips views.Slice[netip.Prefix]) bool {
-	for _, aip := range aips.All() {
-		if views.SliceContains(rips, aip) {
-			return true
+// ResetDevicePeer implements [Engine.ResetDevicePeer].
+func (e *userspaceEngine) ResetDevicePeer(k key.NodePublic) {
+	e.wgLock.Lock()
+	defer e.wgLock.Unlock()
+	e.wgLogger.Invalidate()
+	e.wgdev.RemovePeer(k.Raw32())
+}
+
+// SetPeerByIPPacketFunc installs a callback used by wireguard-go to look up
+// which peer should handle an outbound packet by destination IP.
+//
+// LocalBackend's implementation consults both the exact node-address fast
+// path and the RouteManager's outbound table (covering subnet routes and
+// exit-node default routes), and stays correct under incremental netmap
+// deltas.
+//
+// A nil fn uninstalls the callback, reverting the device to its standard
+// WireGuard AllowedIPs trie, which only contains peers that already exist
+// in the device. Callers without a LocalBackend that need outbound packets
+// to lazily create peers must install their own callback.
+func (e *userspaceEngine) SetPeerByIPPacketFunc(fn func(netip.Addr) (_ key.NodePublic, ok bool)) {
+	if fn == nil {
+		e.wgdev.SetPeerByIPPacketFunc(nil)
+		return
+	}
+	e.wgdev.SetPeerByIPPacketFunc(func(_, dst netip.Addr, _ []byte) (device.NoisePublicKey, bool) {
+		if pk, ok := fn(dst); ok {
+			return pk.Raw32(), true
 		}
+		return device.NoisePublicKey{}, false
+	})
+}
+
+func (e *userspaceEngine) SetPeerSessionStateFunc(fn func(key.NodePublic, PeerWireGuardState)) {
+	e.wgdev.SetSessionStateFunc(func(pk device.NoisePublicKey, state device.PeerSessionState) {
+		if fn != nil {
+			fn(key.NodePublicFromRaw32(mem.B(pk[:])), peerWireGuardStateFromDevice(state))
+		}
+	})
+}
+
+// SetNetLogSource installs the [NetLogSource] consulted by the engine's
+// network flow logger.
+func (e *userspaceEngine) SetNetLogSource(src NetLogSource) {
+	e.netLogSource.Store(src)
+}
+
+// SetWGPeerLookup installs the lookup function used by the engine's
+// wireguard-go log wrapper to rewrite peer references in log lines.
+func (e *userspaceEngine) SetWGPeerLookup(fn func(wgString string) (tsString string, ok bool)) {
+	e.wgPeerLookup.Store(fn)
+}
+
+func peerWireGuardStateFromDevice(state device.PeerSessionState) PeerWireGuardState {
+	switch state {
+	case device.PeerSessionNone:
+		return PeerWireGuardStateNone
+	case device.PeerSessionHandshake:
+		return PeerWireGuardStateHandshake
+	case device.PeerSessionEstablished:
+		return PeerWireGuardStateEstablished
+	case device.PeerSessionExpired:
+		return PeerWireGuardStateExpired
+	default:
+		panic(fmt.Sprintf("unexpected wireguard-go PeerSessionState %d", state))
 	}
-	return false
 }
 
 // ResetAndStop resets the engine to a clean state (like calling Reconfig
-// with all pointers to zero values) and waits for it to be fully stopped,
-// with no live peers or DERPs.
+// with all pointers to zero values) and returns the resulting status.
 //
 // Unlike Reconfig, it does not return ErrNoChanges.
 //
-// If the engine stops, returns the status. NB that this status will not be sent
-// to the registered status callback, it is on the caller to ensure this status
-// is handled appropriately.
+// The returned status will not be sent to the registered status callback;
+// it is on the caller to ensure this status is handled appropriately.
 func (e *userspaceEngine) ResetAndStop() (*Status, error) {
 	if err := e.Reconfig(&wgcfg.Config{}, &router.Config{}, &dns.Config{}); err != nil && !errors.Is(err, ErrNoChanges) {
 		return nil, err
 	}
-	bo := backoff.NewBackoff("UserspaceEngineResetAndStop", e.logf, 1*time.Second)
-	for {
-		st, err := e.getStatus()
-		if err != nil {
-			return nil, err
-		}
-		if len(st.Peers) == 0 && st.DERPs == 0 {
-			return st, nil
-		}
-		bo.BackOff(context.Background(), fmt.Errorf("waiting for engine to stop: peers=%d derps=%d", len(st.Peers), st.DERPs))
-	}
-}
-
-func (e *userspaceEngine) PatchDiscoKey(pub key.NodePublic, disco key.DiscoPublic) {
-	e.wgLock.Lock()
-	defer e.wgLock.Unlock()
-	mak.Set(&e.tsmpLearnedDisco, pub, disco)
+	return e.getStatus()
 }
 
 func (e *userspaceEngine) Reconfig(cfg *wgcfg.Config, routerCfg *router.Config, dnsCfg *dns.Config) error {
@@ -1059,17 +813,8 @@ func (e *userspaceEngine) Reconfig(cfg *wgcfg.Config, routerCfg *router.Config,
 	defer e.wgLock.Unlock()
 	e.tundev.SetWGConfig(cfg)
 
-	peerSet := make(set.Set[key.NodePublic], len(cfg.Peers))
-
 	e.mu.Lock()
-	seq := make([]key.NodePublic, 0, len(cfg.Peers))
-	for _, p := range cfg.Peers {
-		seq = append(seq, p.PublicKey)
-		peerSet.Add(p.PublicKey)
-	}
-	e.peerSequence = views.SliceOf(seq)
-
-	nm := e.netMap
+	self := e.selfNode
 	e.mu.Unlock()
 
 	listenPort := e.confListenPort
@@ -1079,16 +824,16 @@ func (e *userspaceEngine) Reconfig(cfg *wgcfg.Config, routerCfg *router.Config,
 
 	peerMTUEnable := e.magicConn.ShouldPMTUD()
 
-	isSubnetRouter := false
-	if buildfeatures.HasBird && e.birdClient != nil && nm != nil && nm.SelfNode.Valid() {
-		isSubnetRouter = hasOverlap(nm.SelfNode.PrimaryRoutes(), nm.SelfNode.Hostinfo().RoutableIPs())
-		e.logf("[v1] Reconfig: hasOverlap(%v, %v) = %v; isSubnetRouter=%v lastIsSubnetRouter=%v",
-			nm.SelfNode.PrimaryRoutes(), nm.SelfNode.Hostinfo().RoutableIPs(),
-			isSubnetRouter, isSubnetRouter, e.lastIsSubnetRouter)
+	// Let the BIRD integration recompute whether this node is a
+	// primary subnet router, before the early return below so that a
+	// change in that state alone still reaches the protocol toggle in
+	// ReconfigDone at the end.
+	birdChanged := false
+	if e.bird != nil {
+		birdChanged = e.bird.Reconfig(self)
 	}
-	isSubnetRouterChanged := buildfeatures.HasAdvertiseRoutes && isSubnetRouter != e.lastIsSubnetRouter
 
-	engineChanged := checkchange.Update(&e.lastEngineFull, cfg)
+	engineChanged := !e.lastCfg.Equal(cfg)
 	routerChanged := checkchange.Update(&e.lastRouter, routerCfg)
 	dnsChanged := buildfeatures.HasDNS && !e.lastDNSConfig.Equal(dnsCfg.View())
 	if dnsChanged {
@@ -1097,17 +842,18 @@ func (e *userspaceEngine) Reconfig(cfg *wgcfg.Config, routerCfg *router.Config,
 
 	listenPortChanged := listenPort != e.magicConn.LocalPort()
 	peerMTUChanged := peerMTUEnable != e.magicConn.PeerMTUEnabled()
-	if !engineChanged && !routerChanged && !dnsChanged && !listenPortChanged && !isSubnetRouterChanged && !peerMTUChanged {
-		return ErrNoChanges
+
+	// Let the network flow logger react before the early return below,
+	// so that logging identity changes take effect even when nothing
+	// else changed, and before the router is configured, so that a
+	// starting logger captures initial packets.
+	netlogChanged := false
+	if e.netlogger != nil {
+		netlogChanged = e.netlogger.Reconfig(routerCfg, routerChanged)
 	}
-	newLogIDs := cfg.NetworkLogging
-	oldLogIDs := e.lastCfgFull.NetworkLogging
-	netLogIDsNowValid := !newLogIDs.NodeID.IsZero() && !newLogIDs.DomainID.IsZero()
-	netLogIDsWasValid := !oldLogIDs.NodeID.IsZero() && !oldLogIDs.DomainID.IsZero()
-	netLogIDsChanged := netLogIDsNowValid && netLogIDsWasValid && newLogIDs != oldLogIDs
-	netLogRunning := netLogIDsNowValid && !routerCfg.Equal(&router.Config{})
-	if !buildfeatures.HasNetLog || envknob.NoLogsNoSupport() {
-		netLogRunning = false
+
+	if !engineChanged && !routerChanged && !dnsChanged && !listenPortChanged && !birdChanged && !peerMTUChanged && !netlogChanged {
+		return ErrNoChanges
 	}
 
 	// TODO(bradfitz,danderson): maybe delete this isDNSIPOverTailscale
@@ -1119,130 +865,45 @@ func (e *userspaceEngine) Reconfig(cfg *wgcfg.Config, routerCfg *router.Config,
 		e.isDNSIPOverTailscale.Store(ipset.NewContainsIPFunc(views.SliceOf(dnsIPsOverTailscale(dnsCfg, routerCfg))))
 	}
 
-	// See if any peers have changed disco keys, which means they've restarted.
-	// If so, we need to update the wireguard-go/device.Device in two phases:
-	// once without the node which has restarted, to clear its wireguard session key,
-	// and a second time with it.
-	discoChanged := make(map[key.NodePublic]bool)
-	{
-		prevEP := make(map[key.NodePublic]key.DiscoPublic)
-		for i := range e.lastCfgFull.Peers {
-			if p := &e.lastCfgFull.Peers[i]; !p.DiscoKey.IsZero() {
-				prevEP[p.PublicKey] = p.DiscoKey
-			}
+	if !e.lastCfg.PrivateKey.Equal(cfg.PrivateKey) {
+		// Tell magicsock about the new (or initial) private key
+		// (which is needed by DERP) before wgdev gets it, as wgdev
+		// will start trying to handshake, which we want to be able to
+		// go over DERP.
+		if err := e.magicConn.SetPrivateKey(cfg.PrivateKey); err != nil {
+			e.logf("wgengine: Reconfig: SetPrivateKey: %v", err)
 		}
-		for i := range cfg.Peers {
-			p := &cfg.Peers[i]
-			if p.DiscoKey.IsZero() {
-				continue
-			}
 
-			// If the key changed, mark the connection for reconfiguration.
-			pub := p.PublicKey
-
-			if old, ok := prevEP[pub]; ok && old != p.DiscoKey {
-				// If the disco key was learned via TSMP, we do not need to reset the
-				// wireguard config as the new key was received over an existing wireguard
-				// connection.
-				if discoTSMP, okTSMP := e.tsmpLearnedDisco[p.PublicKey]; okTSMP {
-					if discoTSMP == p.DiscoKey {
-						// Key matches, remove entry from map.
-						e.logf("wgengine: Skipping reconfig (TSMP key): %s changed from %q to %q",
-							pub.ShortString(), old, p.DiscoKey)
-						delete(e.tsmpLearnedDisco, p.PublicKey)
-					} else {
-						// The new disco key does not match what we received via
-						// TSMP for this peer. This is unexpected, so log it.
-						// If it does happen, overwrite the previously-saved
-						// disco key with the new one for now:  We expect another
-						// update must be pending in that case, so keep the map
-						// entry.
-						// The reason why this should never happen is that only a single
-						// request is coming through the netmap pipeline at a time, and there
-						// should realistically ever only be a single entry in the map. This
-						// is really a belt and suspenders solution to find usage that is
-						// inconsistent with our expectations.
-						e.logf("wgengine: [unexpected] Reconfig: using TSMP key for %s (control stale): tsmp=%q control=%q old=%q",
-							pub.ShortString(), discoTSMP, p.DiscoKey, old)
-						metricTSMPLearnedKeyMismatch.Add(1)
-						p.DiscoKey = discoTSMP
-					}
-
-					// Skip session clear no matter what.
-					continue
-				}
-
-				discoChanged[pub] = true
-				e.logf("wgengine: Reconfig: %s changed from %q to %q", pub.ShortString(), old, p.DiscoKey)
-			}
+		if err := e.wgdev.SetPrivateKey(key.NodePrivateAs[device.NoisePrivateKey](cfg.PrivateKey)); err != nil {
+			e.logf("wgengine: Reconfig: wgdev.SetPrivateKey: %v", err)
 		}
 	}
 
-	// For tests, what disco connections needs to be changed.
-	if e.testDiscoChangedHook != nil {
-		e.testDiscoChangedHook(discoChanged)
-	}
+	e.lastCfg = *cfg.Clone()
 
-	e.lastCfgFull = *cfg.Clone()
-
-	// Tell magicsock about the new (or initial) private key
-	// (which is needed by DERP) before wgdev gets it, as wgdev
-	// will start trying to handshake, which we want to be able to
-	// go over DERP.
-	if err := e.magicConn.SetPrivateKey(cfg.PrivateKey); err != nil {
-		e.logf("wgengine: Reconfig: SetPrivateKey: %v", err)
-	}
-	e.magicConn.UpdatePeers(peerSet)
 	e.magicConn.SetPreferredPort(listenPort)
 	e.magicConn.UpdatePMTUD()
 
-	if err := e.maybeReconfigWireguardLocked(discoChanged); err != nil {
-		return err
-	}
-
-	// Cleanup map of tsmp marks for peers that no longer exists in config.
-	for nodeKey := range e.tsmpLearnedDisco {
-		if !peerSet.Contains(nodeKey) {
-			delete(e.tsmpLearnedDisco, nodeKey)
-		}
-	}
-
-	// Shutdown the network logger because the IDs changed.
-	// Let it be started back up by subsequent logic.
-	if buildfeatures.HasNetLog && netLogIDsChanged && e.networkLogger.Running() {
-		e.logf("wgengine: Reconfig: shutting down network logger")
-		ctx, cancel := context.WithTimeout(context.Background(), networkLoggerUploadTimeout)
-		defer cancel()
-		if err := e.networkLogger.Shutdown(ctx); err != nil {
-			e.logf("wgengine: Reconfig: error shutting down network logger: %v", err)
-		}
-	}
-
-	// Startup the network logger.
-	// Do this before configuring the router so that we capture initial packets.
-	if buildfeatures.HasNetLog && netLogRunning && !e.networkLogger.Running() {
-		nid := cfg.NetworkLogging.NodeID
-		tid := cfg.NetworkLogging.DomainID
-		logExitFlowEnabled := cfg.NetworkLogging.LogExitFlowEnabled
-		e.logf("wgengine: Reconfig: starting up network logger (node:%s tailnet:%s)", nid.Public(), tid.Public())
-		if err := e.networkLogger.Startup(e.logf, nm, nid, tid, e.tundev, e.magicConn, e.netMon, e.health, e.eventBus, logExitFlowEnabled); err != nil {
-			e.logf("wgengine: Reconfig: error starting up network logger: %v", err)
-		}
-		e.networkLogger.ReconfigRoutes(routerCfg)
-	}
+	// Note: no wireguard-go device reconfig happens here. The device
+	// learns its peer set from the live config source installed via
+	// [Engine.SetPeerConfigFunc] (peers are lazily created and synced
+	// per peer by [Engine.SyncDevicePeer]), and its private key is set
+	// above when it changes.
 
+	// A router.Set error is recorded but must not abort the reconfig: DNS
+	// configuration below must be attempted independently. See #20447.
+	var routerErr error
 	if routerChanged {
 		e.logf("wgengine: Reconfig: configuring router")
-		e.networkLogger.ReconfigRoutes(routerCfg)
-		err := e.router.Set(routerCfg)
-		e.health.SetRouterHealth(err)
-		if err != nil {
-			return err
+		routerErr = e.router.Set(routerCfg)
+		e.health.SetRouterHealth(routerErr)
+		if routerErr != nil {
+			e.logf("wgengine: Reconfig: router config failed (%v); continuing to DNS config so name resolution still works", routerErr)
 		}
 	}
 
 	// We've historically re-set DNS even after just a router change. While
-	// refactoring in tailscale/tailscale#17448 and and
+	// refactoring in tailscale/tailscale#17448 and
 	// tailscale/tailscale#17499, I'm erring on the side of keeping that
 	// historical quirk for now (2025-10-08), lest it's load bearing in
 	// unexpected ways
@@ -1250,6 +911,7 @@ func (e *userspaceEngine) Reconfig(cfg *wgcfg.Config, routerCfg *router.Config,
 	// TODO(bradfitz): try to do the "configuring DNS" part below only if
 	// dnsChanged, not routerChanged. The "resolver.ShouldUseRoutes" part
 	// probably needs to keep happening for both.
+	var dnsErr, vpnErr error
 	if buildfeatures.HasDNS && (routerChanged || dnsChanged) {
 		if resolver.ShouldUseRoutes(e.controlKnobs) {
 			e.logf("wgengine: Reconfig: user dialer")
@@ -1262,46 +924,32 @@ func (e *userspaceEngine) Reconfig(cfg *wgcfg.Config, routerCfg *router.Config,
 		// DNS managers refuse to apply settings if the device has no
 		// assigned address.
 		e.logf("wgengine: Reconfig: configuring DNS")
-		err := e.dns.Set(*dnsCfg)
-		e.health.SetDNSHealth(err)
-		if err != nil {
-			return err
-		}
-		if err := e.reconfigureVPNIfNecessary(); err != nil {
-			return err
+		dnsErr = e.dns.Set(*dnsCfg)
+		e.health.SetDNSHealth(dnsErr)
+		if dnsErr == nil {
+			vpnErr = e.reconfigureVPNIfNecessary()
 		}
 	}
 
-	// Shutdown the network logger.
-	// Do this after configuring the router so that we capture final packets.
-	// This attempts to flush out any log messages and may block.
-	if !netLogRunning && e.networkLogger.Running() {
-		e.logf("wgengine: Reconfig: shutting down network logger")
-		ctx, cancel := context.WithTimeout(context.Background(), networkLoggerUploadTimeout)
-		defer cancel()
-		if err := e.networkLogger.Shutdown(ctx); err != nil {
-			e.logf("wgengine: Reconfig: error shutting down network logger: %v", err)
-		}
+	// Let the network flow logger finish reacting, pairing the Reconfig
+	// call near the top of this function. This runs regardless of router
+	// or DNS errors above: skipping it would leave a stopping logger
+	// running until the next successful reconfig.
+	// This may block to flush pending log messages.
+	if e.netlogger != nil {
+		e.netlogger.ReconfigDone()
 	}
 
-	if buildfeatures.HasBird && isSubnetRouterChanged && e.birdClient != nil {
-		e.logf("wgengine: Reconfig: configuring BIRD")
-		var err error
-		if isSubnetRouter {
-			err = e.birdClient.EnableProtocol("tailscale")
-		} else {
-			err = e.birdClient.DisableProtocol("tailscale")
-		}
-		if err != nil {
-			// Log but don't fail here.
-			e.logf("wgengine: error configuring BIRD: %v", err)
-		} else {
-			e.lastIsSubnetRouter = isSubnetRouter
-		}
+	// Let the BIRD integration apply any protocol state change computed by
+	// its Reconfig call above. As with the netlogger, this runs even if
+	// router/DNS config failed, so BIRD's protocol state still tracks the
+	// primary-subnet-router transition.
+	if e.bird != nil {
+		e.bird.ReconfigDone()
 	}
 
 	e.logf("[v1] wgengine: Reconfig done")
-	return nil
+	return errors.Join(routerErr, dnsErr, vpnErr)
 }
 
 func (e *userspaceEngine) GetFilter() *filter.Filter {
@@ -1320,6 +968,10 @@ func (e *userspaceEngine) SetJailedFilter(filt *filter.Filter) {
 	e.tundev.SetJailedFilter(filt)
 }
 
+func (e *userspaceEngine) SetPeerRoutes(native4, native6 netip.Addr, routes *bart.Table[*routemanager.PeerRoute]) {
+	e.tundev.SetPeerRoutes(native4, native6, routes)
+}
+
 func (e *userspaceEngine) SetStatusCallback(cb StatusCallback) {
 	e.mu.Lock()
 	defer e.mu.Unlock()
@@ -1342,8 +994,14 @@ func (e *userspaceEngine) PeerByKey(pubKey key.NodePublic) (_ wgint.Peer, ok boo
 	if dev == nil {
 		return wgint.Peer{}, false
 	}
-	peer := dev.LookupPeer(pubKey.Raw32())
-	if peer == nil {
+	// Use LookupActivePeer (not LookupPeer) to avoid triggering on-demand
+	// peer creation via PeerLookupFunc. PeerByKey is called from status
+	// polling paths (getStatus, getPeerStatusLite) which iterate every peer
+	// in the netmap; using LookupPeer would lazily create a wireguard-go
+	// peer for every single netmap peer on each status poll, leaking
+	// memory via per-peer queues and goroutines.
+	peer, ok := dev.LookupActivePeer(pubKey.Raw32())
+	if !ok {
 		return wgint.Peer{}, false
 	}
 	return wgint.PeerOf(peer), true
@@ -1369,7 +1027,6 @@ func (e *userspaceEngine) getStatus() (*Status, error) {
 
 	e.mu.Lock()
 	closing := e.closing
-	peerKeys := e.peerSequence
 	localAddrs := slices.Clone(e.endpoints)
 	e.mu.Unlock()
 
@@ -1377,9 +1034,20 @@ func (e *userspaceEngine) getStatus() (*Status, error) {
 		return nil, ErrEngineClosing
 	}
 
-	peers := make([]ipnstate.PeerStatusLite, 0, peerKeys.Len())
-	for _, key := range peerKeys.All() {
-		if status, ok := e.getPeerStatusLite(key); ok {
+	// Snapshot the set of active wgdev peers. wireguard-go has no
+	// read-only iterator over its peer map; RemoveMatchingPeers with
+	// a callback that always returns false is the cheap equivalent
+	// (the callback can't itself call LookupActivePeer, though, as
+	// RemoveMatchingPeers holds the wireguard device's mutex).
+	var peerKeys []key.NodePublic
+	e.wgdev.RemoveMatchingPeers(func(pk device.NoisePublicKey) bool {
+		peerKeys = append(peerKeys, key.NodePublicFromRaw32(mem.B(pk[:])))
+		return false
+	})
+
+	peers := make([]ipnstate.PeerStatusLite, 0, len(peerKeys))
+	for _, k := range peerKeys {
+		if status, ok := e.getPeerStatusLite(k); ok {
 			peers = append(peers, status)
 		}
 	}
@@ -1428,9 +1096,14 @@ func (e *userspaceEngine) RequestStatus() {
 
 func (e *userspaceEngine) Close() {
 	e.eventClient.Close()
-	// TODO(cmol): Should we wait for it too?
-	// Same question raised in appconnector.go.
-	e.linkChangeQueue.Shutdown()
+	// eventClient.Close waited for the ChangeDelta subscriber, the sole
+	// producer for linkChangeQueue, to return, so no new work can be
+	// queued. Discard queued linkChanges and wait for an in-flight one
+	// to finish before closing the subsystems it uses.
+	// See tailscale/tailscale#17641.
+	drainCtx, drainCancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer drainCancel()
+	e.linkChangeQueue.ShutdownAndWait(drainCtx)
 	e.mu.Lock()
 	if e.closing {
 		e.mu.Unlock()
@@ -1439,8 +1112,6 @@ func (e *userspaceEngine) Close() {
 	e.closing = true
 	e.mu.Unlock()
 
-	r := bufio.NewReader(strings.NewReader(""))
-	e.wgdev.IpcSetOperation(r)
 	e.magicConn.Close()
 	if e.netMonOwned {
 		e.netMon.Close()
@@ -1449,16 +1120,13 @@ func (e *userspaceEngine) Close() {
 	e.router.Close()
 	e.wgdev.Close()
 	e.tundev.Close()
-	if e.birdClient != nil {
-		e.birdClient.DisableProtocol("tailscale")
-		e.birdClient.Close()
+	if e.bird != nil {
+		e.bird.Close()
 	}
 	close(e.waitCh)
 
-	ctx, cancel := context.WithTimeout(context.Background(), networkLoggerUploadTimeout)
-	defer cancel()
-	if err := e.networkLogger.Shutdown(ctx); err != nil {
-		e.logf("wgengine: Close: error shutting down network logger: %v", err)
+	if e.netlogger != nil {
+		e.netlogger.Shutdown()
 	}
 }
 
@@ -1538,12 +1206,28 @@ func (e *userspaceEngine) linkChange(delta *netmon.ChangeDelta) {
 	}
 }
 
-func (e *userspaceEngine) SetNetworkMap(nm *netmap.NetworkMap) {
+func (e *userspaceEngine) SetSelfNode(self tailcfg.NodeView) {
 	e.mu.Lock()
-	e.netMap = nm
+	e.selfNode = self
+	tunGROKnobsChanged := false
+	var curUDP, curTCP bool
+	if buildfeatures.HasGRO && runtime.GOOS == "linux" && e.controlKnobs != nil {
+		curUDP = e.controlKnobs.DisableTUNUDPGRO.Load()
+		curTCP = e.controlKnobs.DisableTUNTCPGRO.Load()
+		// Only act on transitions toward "disabled"; wireguard-go's GRO
+		// disablement is sticky and cannot be reversed without restart.
+		if (curUDP && !e.lastAppliedDisableTUNUDPGRO) ||
+			(curTCP && !e.lastAppliedDisableTUNTCPGRO) {
+			tunGROKnobsChanged = true
+		}
+		e.lastAppliedDisableTUNUDPGRO = curUDP
+		e.lastAppliedDisableTUNTCPGRO = curTCP
+	}
 	e.mu.Unlock()
-	if e.networkLogger.Running() {
-		e.networkLogger.ReconfigNetworkMap(nm)
+	if buildfeatures.HasGRO && tunGROKnobsChanged {
+		e.logf("wgengine: TUN GRO knobs changed (DisableTUNUDPGRO=%v DisableTUNTCPGRO=%v); applying",
+			curUDP, curTCP)
+		e.tundev.ApplyGROKnobs(e.controlKnobs)
 	}
 }
 
@@ -1569,7 +1253,7 @@ func (e *userspaceEngine) UpdateStatus(sb *ipnstate.StatusBuilder) {
 
 func (e *userspaceEngine) Ping(ip netip.Addr, pingType tailcfg.PingType, size int, cb func(*ipnstate.PingResult)) {
 	res := &ipnstate.PingResult{IP: ip.String()}
-	pip, ok := e.PeerForIP(ip)
+	pip, ok := e.peerForIP(ip)
 	if !ok {
 		e.logf("ping(%v): no matching peer", ip)
 		res.Err = "no matching peer"
@@ -1600,19 +1284,19 @@ func (e *userspaceEngine) mySelfIPMatchingFamily(dst netip.Addr) (src netip.Addr
 	var zero netip.Addr
 	e.mu.Lock()
 	defer e.mu.Unlock()
-	if e.netMap == nil {
-		return zero, errors.New("no netmap")
+	if !e.selfNode.Valid() {
+		return zero, errors.New("no self node")
 	}
-	addrs := e.netMap.GetAddresses()
+	addrs := e.selfNode.Addresses()
 	if addrs.Len() == 0 {
-		return zero, errors.New("no self address in netmap")
+		return zero, errors.New("no self address")
 	}
 	for _, p := range addrs.All() {
 		if p.IsSingleIP() && p.Addr().BitLen() == dst.BitLen() {
 			return p.Addr(), nil
 		}
 	}
-	return zero, errors.New("no self address in netmap matching address family")
+	return zero, errors.New("no self address matching address family")
 }
 
 func (e *userspaceEngine) sendICMPEchoRequest(destIP netip.Addr, peer tailcfg.NodeView, res *ipnstate.PingResult, cb func(*ipnstate.PingResult)) {
@@ -1757,64 +1441,34 @@ func (e *userspaceEngine) setICMPEchoResponseCallback(idSeq uint32, cb func()) {
 	}
 }
 
-// PeerForIP returns the Node in the wireguard config
-// that's responsible for handling the given IP address.
-//
-// If none is found in the wireguard config but one is found in
-// the netmap, it's described in an error.
-//
-// peerForIP acquires both e.mu and e.wgLock, but neither at the same
-// time.
-func (e *userspaceEngine) PeerForIP(ip netip.Addr) (ret PeerForIP, ok bool) {
+// ProbeLocks implements [Engine.ProbeLocks].
+func (e *userspaceEngine) ProbeLocks() {
 	e.mu.Lock()
-	nm := e.netMap
 	e.mu.Unlock()
-	if nm == nil {
-		return ret, false
-	}
-
-	// Check for exact matches before looking for subnet matches.
-	// TODO(bradfitz): add maps for these. on NetworkMap?
-	for _, p := range nm.Peers {
-		for i := range p.Addresses().Len() {
-			a := p.Addresses().At(i)
-			if a.Addr() == ip && a.IsSingleIP() && tsaddr.IsTailscaleIP(ip) {
-				return PeerForIP{Node: p, Route: a}, true
-			}
-		}
-	}
-	addrs := nm.GetAddresses()
-	for i := range addrs.Len() {
-		if a := addrs.At(i); a.Addr() == ip && a.IsSingleIP() && tsaddr.IsTailscaleIP(ip) {
-			return PeerForIP{Node: nm.SelfNode, IsSelf: true, Route: a}, true
-		}
-	}
 
 	e.wgLock.Lock()
-	defer e.wgLock.Unlock()
+	e.wgLock.Unlock()
+}
 
-	// TODO(bradfitz): this is O(n peers). Add ART to netaddr?
-	var best netip.Prefix
-	var bestKey key.NodePublic
-	for _, p := range e.lastCfgFull.Peers {
-		for _, cidr := range p.AllowedIPs {
-			if !cidr.Contains(ip) {
-				continue
-			}
-			if !best.IsValid() || cidr.Bits() > best.Bits() {
-				best = cidr
-				bestKey = p.PublicKey
-			}
-		}
+// SetPeerForIPFunc installs the callback used by [userspaceEngine.peerForIP].
+// See [Engine.SetPeerForIPFunc].
+func (e *userspaceEngine) SetPeerForIPFunc(fn func(netip.Addr) (PeerForIP, bool)) {
+	if fn == nil {
+		e.peerForIPFn.Store(nil)
+		return
 	}
-	// And another pass. Probably better than allocating a map per peerForIP
-	// call. But TODO(bradfitz): add a lookup map to netmap.NetworkMap.
-	if !bestKey.IsZero() {
-		for _, p := range nm.Peers {
-			if p.Key() == bestKey {
-				return PeerForIP{Node: p, Route: best}, true
-			}
-		}
+	e.peerForIPFn.Store(&fn)
+}
+
+// peerForIP returns the node responsible for handling the given IP.
+// It delegates to the callback installed via [Engine.SetPeerForIPFunc];
+// engines without an installed callback return (zero, false).
+func (e *userspaceEngine) peerForIP(ip netip.Addr) (ret PeerForIP, ok bool) {
+	if !ip.IsValid() {
+		return ret, false
+	}
+	if fn := e.peerForIPFn.Load(); fn != nil {
+		return (*fn)(ip)
 	}
 	return ret, false
 }
@@ -1903,8 +1557,6 @@ var (
 
 	metricTSMPDiscoKeyAdvertisementSent  = clientmetric.NewCounter("magicsock_tsmp_disco_key_advertisement_sent")
 	metricTSMPDiscoKeyAdvertisementError = clientmetric.NewCounter("magicsock_tsmp_disco_key_advertisement_error")
-
-	metricTSMPLearnedKeyMismatch = clientmetric.NewCounter("magicsock_tsmp_learned_key_mismatch")
 )
 
 func (e *userspaceEngine) InstallCaptureHook(cb packet.CaptureCallback) {
diff --git a/wgengine/userspace_test.go b/wgengine/userspace_test.go
index 558df4ced..efe2e04bb 100644
--- a/wgengine/userspace_test.go
+++ b/wgengine/userspace_test.go
@@ -4,93 +4,77 @@
 package wgengine
 
 import (
+	"crypto/tls"
+	"errors"
 	"fmt"
 	"math/rand"
+	"net"
+	"net/http"
+	"net/http/httptest"
 	"net/netip"
 	"os"
-	"reflect"
 	"runtime"
+	"slices"
+	"sync"
 	"testing"
+	"time"
 
+	"github.com/tailscale/wireguard-go/device"
 	"go4.org/mem"
 	"tailscale.com/cmd/testwrapper/flakytest"
 	"tailscale.com/control/controlknobs"
+	"tailscale.com/derp"
+	"tailscale.com/derp/derpserver"
 	"tailscale.com/envknob"
 	"tailscale.com/health"
 	"tailscale.com/net/dns"
+	"tailscale.com/net/dns/resolver"
 	"tailscale.com/net/netaddr"
-	"tailscale.com/net/tstun"
+	"tailscale.com/net/netmon"
+	"tailscale.com/net/stun/stuntest"
 	"tailscale.com/tailcfg"
-	"tailscale.com/tstest"
-	"tailscale.com/tstime/mono"
+	"tailscale.com/types/dnstype"
 	"tailscale.com/types/key"
+	"tailscale.com/types/logger"
 	"tailscale.com/types/netmap"
 	"tailscale.com/types/opt"
+	"tailscale.com/util/dnsname"
 	"tailscale.com/util/eventbus/eventbustest"
 	"tailscale.com/util/usermetric"
 	"tailscale.com/wgengine/router"
 	"tailscale.com/wgengine/wgcfg"
 )
 
-func TestNoteReceiveActivity(t *testing.T) {
-	now := mono.Time(123456)
-	var logBuf tstest.MemLogger
+func TestPeerWireGuardStateValuesMatchWireguardGo(t *testing.T) {
+	const unknownPeerSessionState device.PeerSessionState = 255
 
-	confc := make(chan bool, 1)
-	gotConf := func() bool {
-		select {
-		case <-confc:
-			return true
-		default:
-			return false
+	tests := []struct {
+		name string
+		wg   device.PeerSessionState
+		want PeerWireGuardState
+	}{
+		{"none", device.PeerSessionNone, PeerWireGuardStateNone},
+		{"handshake", device.PeerSessionHandshake, PeerWireGuardStateHandshake},
+		{"established", device.PeerSessionEstablished, PeerWireGuardStateEstablished},
+		{"expired", device.PeerSessionExpired, PeerWireGuardStateExpired},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := peerWireGuardStateFromDevice(tt.wg); got != tt.want {
+				t.Fatalf("converted state = %v; want %v", got, tt.want)
+			}
+			if got, want := uint8(tt.wg), uint8(tt.want); got != want {
+				t.Fatalf("wireguard-go const = %v; want %v", got, want)
+			}
+		})
+	}
+
+	defer func() {
+		if recover() == nil {
+			t.Fatal("expected panic for unknown wireguard-go state")
 		}
-	}
-	e := &userspaceEngine{
-		timeNow:               func() mono.Time { return now },
-		recvActivityAt:        map[key.NodePublic]mono.Time{},
-		logf:                  logBuf.Logf,
-		tundev:                new(tstun.Wrapper),
-		testMaybeReconfigHook: func() { confc <- true },
-		trimmedNodes:          map[key.NodePublic]bool{},
-	}
-	ra := e.recvActivityAt
-
-	nk := key.NewNode().Public()
-
-	// Activity on an untracked key should do nothing.
-	e.noteRecvActivity(nk)
-	if len(ra) != 0 {
-		t.Fatalf("unexpected growth in map: now has %d keys; want 0", len(ra))
-	}
-	if logBuf.Len() != 0 {
-		t.Fatalf("unexpected log write (and thus activity): %s", logBuf.Bytes())
-	}
-
-	// Now track it, but don't mark it trimmed, so shouldn't update.
-	ra[nk] = 0
-	e.noteRecvActivity(nk)
-	if len(ra) != 1 {
-		t.Fatalf("unexpected growth in map: now has %d keys; want 1", len(ra))
-	}
-	if got := ra[nk]; got != now {
-		t.Fatalf("time in map = %v; want %v", got, now)
-	}
-	if gotConf() {
-		t.Fatalf("unexpected reconfig")
-	}
-
-	// Now mark it trimmed and expect an update.
-	e.trimmedNodes[nk] = true
-	e.noteRecvActivity(nk)
-	if len(ra) != 1 {
-		t.Fatalf("unexpected growth in map: now has %d keys; want 1", len(ra))
-	}
-	if got := ra[nk]; got != now {
-		t.Fatalf("time in map = %v; want %v", got, now)
-	}
-	if !gotConf() {
-		t.Fatalf("didn't get expected reconfig")
-	}
+	}()
+	_ = peerWireGuardStateFromDevice(unknownPeerSessionState)
 }
 
 func nodeViews(v []*tailcfg.Node) []tailcfg.NodeView {
@@ -111,11 +95,10 @@ func TestUserspaceEngineReconfig(t *testing.T) {
 		t.Fatal(err)
 	}
 	t.Cleanup(e.Close)
-	ue := e.(*userspaceEngine)
 
 	routerCfg := &router.Config{}
 
-	for _, nodeHex := range []string{
+	for i, nodeHex := range []string{
 		"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
 		"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
 	} {
@@ -127,44 +110,49 @@ func TestUserspaceEngineReconfig(t *testing.T) {
 				},
 			}),
 		}
-		nk, err := key.ParseNodePublicUntyped(mem.S(nodeHex))
-		if err != nil {
-			t.Fatal(err)
-		}
 		cfg := &wgcfg.Config{
-			Peers: []wgcfg.Peer{
-				{
-					PublicKey: nk,
-					AllowedIPs: []netip.Prefix{
-						netip.PrefixFrom(netaddr.IPv4(100, 100, 99, 1), 32),
-					},
-				},
+			Addresses: []netip.Prefix{
+				netip.PrefixFrom(netaddr.IPv4(100, 100, 99, byte(1+i)), 32),
 			},
 		}
 
-		e.SetNetworkMap(nm)
+		e.SetSelfNode(nm.SelfNode)
 		err = e.Reconfig(cfg, routerCfg, &dns.Config{})
 		if err != nil {
 			t.Fatal(err)
 		}
-
-		wantRecvAt := map[key.NodePublic]mono.Time{
-			nkFromHex(nodeHex): 0,
-		}
-		if got := ue.recvActivityAt; !reflect.DeepEqual(got, wantRecvAt) {
-			t.Errorf("wrong recvActivityAt\n got: %v\nwant: %v\n", got, wantRecvAt)
-		}
-
-		wantTrimmedNodes := map[key.NodePublic]bool{
-			nkFromHex(nodeHex): true,
-		}
-		if got := ue.trimmedNodes; !reflect.DeepEqual(got, wantTrimmedNodes) {
-			t.Errorf("wrong wantTrimmedNodes\n got: %v\nwant: %v\n", got, wantTrimmedNodes)
-		}
 	}
 }
 
-func TestUserspaceEngineTSMPLearned(t *testing.T) {
+// failingRouter is a router.Router whose Set always fails, used to verify that
+// DNS configuration is still attempted when router configuration fails.
+type failingRouter struct {
+	err error
+}
+
+func (failingRouter) Up() error                  { return nil }
+func (r failingRouter) Set(*router.Config) error { return r.err }
+func (failingRouter) Close() error               { return nil }
+
+// recordingOSConfigurator is a dns.OSConfigurator that records whether SetDNS
+// was called.
+type recordingOSConfigurator struct {
+	setDNSCalled bool
+}
+
+func (c *recordingOSConfigurator) SetDNS(dns.OSConfig) error { c.setDNSCalled = true; return nil }
+func (c *recordingOSConfigurator) SupportsSplitDNS() bool    { return false }
+func (c *recordingOSConfigurator) Close() error              { return nil }
+func (c *recordingOSConfigurator) GetBaseConfig() (dns.OSConfig, error) {
+	return dns.OSConfig{}, dns.ErrGetBaseConfigNotSupported
+}
+
+// TestUserspaceEngineReconfigDNSAfterRouterError verifies that a router.Set
+// failure does not prevent DNS from being configured. Historically Reconfig
+// returned on router error before dns.Set ran, so MagicDNS was never
+// configured on hosts where router config failed on every reconfig. See
+// tailscale/tailscale#20447.
+func TestUserspaceEngineReconfigDNSAfterRouterError(t *testing.T) {
 	bus := eventbustest.NewBus(t)
 
 	ht := health.NewTracker(bus)
@@ -176,151 +164,29 @@ func TestUserspaceEngineTSMPLearned(t *testing.T) {
 	t.Cleanup(e.Close)
 	ue := e.(*userspaceEngine)
 
-	discoChangedChan := make(chan map[key.NodePublic]bool, 1)
-	ue.testDiscoChangedHook = func(m map[key.NodePublic]bool) {
-		discoChangedChan <- m
+	routerErr := fmt.Errorf("router boom")
+	ue.router = failingRouter{err: routerErr}
+
+	osCfg := &recordingOSConfigurator{}
+	ue.dns = dns.NewManager(t.Logf, osCfg, ht, ue.dialer, nil, nil, runtime.GOOS, bus)
+
+	nm := &netmap.NetworkMap{
+		Peers: nodeViews([]*tailcfg.Node{{ID: 1, Key: nkFromHex("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa")}}),
 	}
-
-	routerCfg := &router.Config{}
-
-	keyChanges := []struct {
-		tsmp  bool
-		inMap bool
-	}{
-		{tsmp: false, inMap: false},
-		{tsmp: true, inMap: false},
-		{tsmp: false, inMap: true},
+	cfg := &wgcfg.Config{
+		Addresses: []netip.Prefix{netip.PrefixFrom(netaddr.IPv4(100, 100, 99, 1), 32)},
 	}
+	e.SetSelfNode(nm.SelfNode)
 
-	nkHex := "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-	for _, change := range keyChanges {
-		oldDisco := key.NewDisco()
-		nm := &netmap.NetworkMap{
-			Peers: nodeViews([]*tailcfg.Node{
-				{
-					ID:       1,
-					Key:      nkFromHex(nkHex),
-					DiscoKey: oldDisco.Public(),
-				},
-			}),
-		}
-		nk, err := key.ParseNodePublicUntyped(mem.S(nkHex))
-		if err != nil {
-			t.Fatal(err)
-		}
-		e.SetNetworkMap(nm)
+	err = e.Reconfig(cfg, &router.Config{}, &dns.Config{})
 
-		newDisco := key.NewDisco()
-		cfg := &wgcfg.Config{
-			Peers: []wgcfg.Peer{
-				{
-					PublicKey: nk,
-					DiscoKey:  newDisco.Public(),
-				},
-			},
-		}
-
-		if change.tsmp {
-			ue.PatchDiscoKey(nk, newDisco.Public())
-		}
-		err = e.Reconfig(cfg, routerCfg, &dns.Config{})
-		if err != nil {
-			t.Fatal(err)
-		}
-
-		changeMap := <-discoChangedChan
-
-		if _, ok := changeMap[nk]; ok != change.inMap {
-			t.Fatalf("expect key %v in map %v to be %t, got %t", nk, changeMap,
-				change.inMap, ok)
-		}
+	if !osCfg.setDNSCalled {
+		t.Error("SetDNS was not called after router.Set failed; DNS config must be independent of router success")
 	}
-}
-
-func TestUserspaceEngineTSMPLearnedMismatch(t *testing.T) {
-	bus := eventbustest.NewBus(t)
-
-	ht := health.NewTracker(bus)
-	reg := new(usermetric.Registry)
-	e, err := NewFakeUserspaceEngine(t.Logf, 0, ht, reg, bus)
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(e.Close)
-	ue := e.(*userspaceEngine)
-
-	discoChangedChan := make(chan map[key.NodePublic]bool, 1)
-	ue.testDiscoChangedHook = func(m map[key.NodePublic]bool) {
-		discoChangedChan <- m
-	}
-
-	routerCfg := &router.Config{}
-	var metricValue int64 = 0
-
-	keyChanges := []struct {
-		tsmp     bool
-		inMap    bool
-		wrongKey bool
-	}{
-		{tsmp: false, inMap: false, wrongKey: false},
-		{tsmp: true, inMap: false, wrongKey: true},
-		{tsmp: false, inMap: false, wrongKey: false},
-	}
-
-	nkHex := "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-	for _, change := range keyChanges {
-		oldDisco := key.NewDisco()
-		nm := &netmap.NetworkMap{
-			Peers: nodeViews([]*tailcfg.Node{
-				{
-					ID:       1,
-					Key:      nkFromHex(nkHex),
-					DiscoKey: oldDisco.Public(),
-				},
-			}),
-		}
-		nk, err := key.ParseNodePublicUntyped(mem.S(nkHex))
-		if err != nil {
-			t.Fatal(err)
-		}
-		e.SetNetworkMap(nm)
-
-		newDisco := key.NewDisco()
-		cfg := &wgcfg.Config{
-			Peers: []wgcfg.Peer{
-				{
-					PublicKey: nk,
-					DiscoKey:  newDisco.Public(),
-				},
-			},
-		}
-
-		tsmpKey := newDisco.Public()
-		if change.tsmp {
-			if change.wrongKey {
-				tsmpKey = key.NewDisco().Public()
-			}
-			ue.PatchDiscoKey(nk, tsmpKey)
-		}
-		err = e.Reconfig(cfg, routerCfg, &dns.Config{})
-		if err != nil {
-			t.Fatal(err)
-		}
-
-		changeMap := <-discoChangedChan
-
-		if _, ok := changeMap[nk]; ok != change.inMap {
-			t.Fatalf("expect key %v in map %v to be %t, got %t", nk, changeMap,
-				change.inMap, ok)
-		}
-
-		metric := metricTSMPLearnedKeyMismatch.Value()
-		delta := metric - metricValue
-		metricValue = metric
-
-		if change.wrongKey && delta != 1 {
-			t.Fatalf("expected a delta of 1, got %d", delta)
-		}
+	if err == nil {
+		t.Error("Reconfig returned nil; want the router error to be surfaced")
+	} else if !errors.Is(err, routerErr) {
+		t.Errorf("Reconfig error = %v; want it to wrap the router error %v", err, routerErr)
 	}
 }
 
@@ -355,18 +221,9 @@ func TestUserspaceEnginePortReconfig(t *testing.T) {
 	t.Cleanup(ue.Close)
 
 	startingPort := ue.magicConn.LocalPort()
-	nodeKey, err := key.ParseNodePublicUntyped(mem.S("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"))
-	if err != nil {
-		t.Fatal(err)
-	}
 	cfg := &wgcfg.Config{
-		Peers: []wgcfg.Peer{
-			{
-				PublicKey: nodeKey,
-				AllowedIPs: []netip.Prefix{
-					netip.PrefixFrom(netaddr.IPv4(100, 100, 99, 1), 32),
-				},
-			},
+		Addresses: []netip.Prefix{
+			netip.PrefixFrom(netaddr.IPv4(100, 100, 99, 1), 32),
 		},
 	}
 	routerCfg := &router.Config{}
@@ -437,18 +294,9 @@ func TestUserspaceEnginePeerMTUReconfig(t *testing.T) {
 	t.Logf("Info: OS default don't fragment bit(s) setting: %v", osDefaultDF)
 
 	// Build a set of configs to use as we change the peer MTU settings.
-	nodeKey, err := key.ParseNodePublicUntyped(mem.S("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"))
-	if err != nil {
-		t.Fatal(err)
-	}
 	cfg := &wgcfg.Config{
-		Peers: []wgcfg.Peer{
-			{
-				PublicKey: nodeKey,
-				AllowedIPs: []netip.Prefix{
-					netip.PrefixFrom(netaddr.IPv4(100, 100, 99, 1), 32),
-				},
-			},
+		Addresses: []netip.Prefix{
+			netip.PrefixFrom(netaddr.IPv4(100, 100, 99, 1), 32),
 		},
 	}
 	routerCfg := &router.Config{}
@@ -514,17 +362,10 @@ func TestTSMPKeyAdvertisement(t *testing.T) {
 		}).View(),
 	}
 	cfg := &wgcfg.Config{
-		Peers: []wgcfg.Peer{
-			{
-				PublicKey: nodeKey,
-				AllowedIPs: []netip.Prefix{
-					netip.PrefixFrom(netaddr.IPv4(100, 100, 99, 1), 32),
-				},
-			},
-		},
+		Addresses: nm.SelfNode.Addresses().AsSlice(),
 	}
 
-	ue.SetNetworkMap(nm)
+	ue.SetSelfNode(nm.SelfNode)
 	err = ue.Reconfig(cfg, routerCfg, &dns.Config{})
 	if err != nil {
 		t.Fatal(err)
@@ -609,3 +450,196 @@ func BenchmarkGenLocalAddrFunc(b *testing.B) {
 	})
 	b.Logf("x = %v", x)
 }
+
+// Regression test for #19730: on major link change, MatchDomains Routes must
+// be preserved.
+func TestLinkChangeReapplyPreservesMagicDNSRoutes(t *testing.T) {
+	switch runtime.GOOS {
+	case "linux", "android", "darwin", "ios", "openbsd":
+	default:
+		t.Skipf("linkChange DNS reapply path not exercised on %s", runtime.GOOS)
+	}
+
+	bus := eventbustest.NewBus(t)
+	noop, err := dns.NewNoopManager()
+	if err != nil {
+		t.Fatal(err)
+	}
+	e, err := NewUserspaceEngine(t.Logf, Config{
+		HealthTracker: health.NewTracker(bus),
+		Metrics:       new(usermetric.Registry),
+		EventBus:      bus,
+		DNS:           noop,
+		RespondToPing: true,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(e.Close)
+
+	var (
+		mu   sync.Mutex
+		last resolver.Config
+	)
+	e.(*userspaceEngine).dns.Resolver().TestOnlySetHook(func(cfg resolver.Config) {
+		mu.Lock()
+		defer mu.Unlock()
+		last = cfg
+	})
+	snapshot := func() []dnsname.FQDN {
+		mu.Lock()
+		defer mu.Unlock()
+		return slices.Clone(last.LocalDomains)
+	}
+
+	dnsCfg := &dns.Config{
+		Routes: map[dnsname.FQDN][]*dnstype.Resolver{
+			"ts.net.":              {{Addr: "199.247.155.53"}},
+			"foo.ts.net.":          nil,
+			"64.100.in-addr.arpa.": nil,
+		},
+		Hosts: map[dnsname.FQDN][]netip.Addr{
+			"node.foo.ts.net.": {netip.MustParseAddr("100.64.0.5")},
+		},
+		SearchDomains: []dnsname.FQDN{"foo.ts.net."},
+	}
+	if err := e.Reconfig(&wgcfg.Config{}, &router.Config{}, dnsCfg); err != nil {
+		t.Fatalf("Reconfig: %v", err)
+	}
+	initial := snapshot()
+
+	cd, err := netmon.NewChangeDelta(nil, &netmon.State{HaveV4: true}, 0, true)
+	if err != nil {
+		t.Fatal(err)
+	}
+	cd.RebindLikelyRequired = true
+	e.(*userspaceEngine).linkChange(cd)
+
+	after := snapshot()
+	slices.Sort(initial)
+	slices.Sort(after)
+	if !slices.Equal(initial, after) {
+		t.Errorf("resolver LocalDomains changed after linkChange:\n  initial: %s\n  after:   %s",
+			logger.AsJSON(initial), logger.AsJSON(after))
+	}
+}
+
+// TestCloseWaitsForLinkChange tests that Close waits for in-flight
+// linkChangeQueue work to finish before tearing down the subsystems
+// that linkChange uses.
+//
+// See https://github.com/tailscale/tailscale/issues/17641.
+func TestCloseWaitsForLinkChange(t *testing.T) {
+	bus := eventbustest.NewBus(t)
+
+	ht := health.NewTracker(bus)
+	reg := new(usermetric.Registry)
+	e, err := NewFakeUserspaceEngine(t.Logf, 0, ht, reg, bus)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	started := make(chan struct{})
+	release := make(chan struct{})
+	done := make(chan struct{})
+	e.(*userspaceEngine).linkChangeQueue.Add(func() {
+		close(started)
+		<-release
+		close(done)
+	})
+	<-started
+
+	go func() {
+		time.Sleep(50 * time.Millisecond)
+		close(release)
+	}()
+	e.Close()
+	select {
+	case <-done:
+	default:
+		t.Fatal("Close returned with link change work still in flight")
+	}
+}
+
+// TestDERPAppNamePlumbing tests that Config.DERPAppName makes it all
+// the way from the engine config to the ClientInfo received by an
+// in-process DERP server.
+func TestDERPAppNamePlumbing(t *testing.T) {
+	const appName = "app-name-plumbing-test"
+
+	priv := key.NewNode()
+	infoCh := make(chan derp.ClientInfo, 1)
+
+	derpSrv := derpserver.New(key.NewNode(), t.Logf)
+	derpSrv.ForTest().SetOnClientInfo(func(k key.NodePublic, info derp.ClientInfo) {
+		if k != priv.Public() {
+			return
+		}
+		select {
+		case infoCh <- info:
+		default:
+		}
+	})
+	httpsrv := httptest.NewUnstartedServer(derpserver.Handler(derpSrv))
+	httpsrv.Config.ErrorLog = logger.StdLogger(t.Logf)
+	httpsrv.Config.TLSNextProto = make(map[string]func(*http.Server, *tls.Conn, http.Handler))
+	httpsrv.StartTLS()
+	t.Cleanup(func() {
+		httpsrv.CloseClientConnections()
+		httpsrv.Close()
+		derpSrv.Close()
+	})
+
+	stunAddr, stunCleanup := stuntest.Serve(t)
+	t.Cleanup(stunCleanup)
+
+	derpMap := &tailcfg.DERPMap{
+		Regions: map[int]*tailcfg.DERPRegion{
+			1: {
+				RegionID:   1,
+				RegionCode: "test",
+				Nodes: []*tailcfg.DERPNode{{
+					Name:             "t1",
+					RegionID:         1,
+					HostName:         "test-node.unused",
+					IPv4:             "127.0.0.1",
+					IPv6:             "none",
+					STUNPort:         stunAddr.Port,
+					DERPPort:         httpsrv.Listener.Addr().(*net.TCPAddr).Port,
+					InsecureForTests: true,
+				}},
+			},
+		},
+	}
+
+	bus := eventbustest.NewBus(t)
+	noopDNS, err := dns.NewNoopManager()
+	if err != nil {
+		t.Fatal(err)
+	}
+	e, err := NewUserspaceEngine(t.Logf, Config{
+		HealthTracker: health.NewTracker(bus),
+		Metrics:       new(usermetric.Registry),
+		EventBus:      bus,
+		DNS:           noopDNS,
+		DERPAppName:   appName,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(e.Close)
+
+	if err := e.Reconfig(&wgcfg.Config{PrivateKey: priv}, &router.Config{}, &dns.Config{}); err != nil {
+		t.Fatalf("Reconfig: %v", err)
+	}
+	e.(*userspaceEngine).magicConn.SetDERPMap(derpMap)
+
+	select {
+	case info := <-infoCh:
+		if info.AppName != appName {
+			t.Fatalf("ClientInfo.AppName = %q; want %q", info.AppName, appName)
+		}
+	case <-time.After(10 * time.Second):
+		t.Fatal("timeout waiting for engine to connect to the test DERP server")
+	}
+}
diff --git a/wgengine/watchdog.go b/wgengine/watchdog.go
deleted file mode 100644
index 4bb320b4b..000000000
--- a/wgengine/watchdog.go
+++ /dev/null
@@ -1,256 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-//go:build !js && !ts_omit_debug
-
-package wgengine
-
-import (
-	"fmt"
-	"log"
-	"net/netip"
-	"runtime/pprof"
-	"strings"
-	"sync"
-	"time"
-
-	"tailscale.com/envknob"
-	"tailscale.com/feature/buildfeatures"
-	"tailscale.com/ipn/ipnstate"
-	"tailscale.com/net/dns"
-	"tailscale.com/net/packet"
-	"tailscale.com/tailcfg"
-	"tailscale.com/types/key"
-	"tailscale.com/types/netmap"
-	"tailscale.com/util/clientmetric"
-	"tailscale.com/wgengine/filter"
-	"tailscale.com/wgengine/router"
-	"tailscale.com/wgengine/wgcfg"
-	"tailscale.com/wgengine/wgint"
-)
-
-type watchdogEvent string
-
-const (
-	Any               watchdogEvent = "Any"
-	Reconfig          watchdogEvent = "Reconfig"
-	ResetAndStop      watchdogEvent = "ResetAndStop"
-	SetFilter         watchdogEvent = "SetFilter"
-	SetJailedFilter   watchdogEvent = "SetJailedFilter"
-	SetStatusCallback watchdogEvent = "SetStatusCallback"
-	UpdateStatus      watchdogEvent = "UpdateStatus"
-	RequestStatus     watchdogEvent = "RequestStatus"
-	SetNetworkMap     watchdogEvent = "SetNetworkMap"
-	Ping              watchdogEvent = "Ping"
-	Close             watchdogEvent = "Close"
-	PeerForIPEvent    watchdogEvent = "PeerForIP"
-)
-
-var (
-	watchdogMetrics = map[watchdogEvent]*clientmetric.Metric{
-		Any:               clientmetric.NewCounter("watchdog_timeout_any_total"),
-		Reconfig:          clientmetric.NewCounter("watchdog_timeout_reconfig"),
-		ResetAndStop:      clientmetric.NewCounter("watchdog_timeout_resetandstop"),
-		SetFilter:         clientmetric.NewCounter("watchdog_timeout_setfilter"),
-		SetJailedFilter:   clientmetric.NewCounter("watchdog_timeout_setjailedfilter"),
-		SetStatusCallback: clientmetric.NewCounter("watchdog_timeout_setstatuscallback"),
-		UpdateStatus:      clientmetric.NewCounter("watchdog_timeout_updatestatus"),
-		RequestStatus:     clientmetric.NewCounter("watchdog_timeout_requeststatus"),
-		SetNetworkMap:     clientmetric.NewCounter("watchdog_timeout_setnetworkmap"),
-		Ping:              clientmetric.NewCounter("watchdog_timeout_ping"),
-		Close:             clientmetric.NewCounter("watchdog_timeout_close"),
-		PeerForIPEvent:    clientmetric.NewCounter("watchdog_timeout_peerforipevent"),
-	}
-)
-
-// NewWatchdog wraps an Engine and makes sure that all methods complete
-// within a reasonable amount of time.
-//
-// If they do not, the watchdog crashes the process.
-func NewWatchdog(e Engine) Engine {
-	if envknob.Bool("TS_DEBUG_DISABLE_WATCHDOG") {
-		return e
-	}
-	return &watchdogEngine{
-		wrap:     e,
-		logf:     log.Printf,
-		fatalf:   log.Fatalf,
-		maxWait:  45 * time.Second,
-		inFlight: make(map[inFlightKey]time.Time),
-	}
-}
-
-type inFlightKey struct {
-	op  watchdogEvent
-	ctr uint64
-}
-
-type watchdogEngine struct {
-	wrap    Engine
-	logf    func(format string, args ...any)
-	fatalf  func(format string, args ...any)
-	maxWait time.Duration
-
-	// Track the start time(s) of in-flight operations
-	inFlightMu  sync.Mutex
-	inFlight    map[inFlightKey]time.Time
-	inFlightCtr uint64
-}
-
-func (e *watchdogEngine) watchdogErr(event watchdogEvent, fn func() error) error {
-	// Track all in-flight operations so we can print more useful error
-	// messages on watchdog failure
-	e.inFlightMu.Lock()
-
-	key := inFlightKey{
-		op:  event,
-		ctr: e.inFlightCtr,
-	}
-	e.inFlightCtr++
-	e.inFlight[key] = time.Now()
-	e.inFlightMu.Unlock()
-
-	defer func() {
-		e.inFlightMu.Lock()
-		defer e.inFlightMu.Unlock()
-		delete(e.inFlight, key)
-	}()
-
-	errCh := make(chan error)
-	go func() {
-		errCh <- fn()
-	}()
-	t := time.NewTimer(e.maxWait)
-	select {
-	case err := <-errCh:
-		t.Stop()
-		return err
-	case <-t.C:
-		buf := new(strings.Builder)
-		pprof.Lookup("goroutine").WriteTo(buf, 1)
-		e.logf("wgengine watchdog stacks:\n%s", buf.String())
-		// Collect the list of in-flight operations for debugging.
-		var (
-			b   []byte
-			now = time.Now()
-		)
-		e.inFlightMu.Lock()
-		for k, t := range e.inFlight {
-			dur := now.Sub(t).Round(time.Millisecond)
-			b = fmt.Appendf(b, "in-flight[%d]: name=%s duration=%v start=%s\n", k.ctr, k.op, dur, t.Format(time.RFC3339Nano))
-		}
-		e.recordEvent(event)
-		e.inFlightMu.Unlock()
-
-		// Print everything as a single string to avoid log
-		// rate limits.
-		e.logf("wgengine watchdog in-flight:\n%s", b)
-		e.fatalf("wgengine: watchdog timeout on %s", event)
-		return nil
-	}
-}
-
-func (e *watchdogEngine) recordEvent(event watchdogEvent) {
-	if watchdogMetrics == nil {
-		return
-	}
-
-	mEvent, ok := watchdogMetrics[event]
-	if ok {
-		mEvent.Add(1)
-	}
-	mAny, ok := watchdogMetrics[Any]
-	if ok {
-		mAny.Add(1)
-	}
-}
-
-func (e *watchdogEngine) watchdog(event watchdogEvent, fn func()) {
-	e.watchdogErr(event, func() error {
-		fn()
-		return nil
-	})
-}
-
-func (e *watchdogEngine) Reconfig(cfg *wgcfg.Config, routerCfg *router.Config, dnsCfg *dns.Config) error {
-	return e.watchdogErr(Reconfig, func() error { return e.wrap.Reconfig(cfg, routerCfg, dnsCfg) })
-}
-
-func (e *watchdogEngine) ResetAndStop() (st *Status, err error) {
-	e.watchdog(ResetAndStop, func() {
-		st, err = e.wrap.ResetAndStop()
-	})
-	return st, err
-}
-
-func (e *watchdogEngine) GetFilter() *filter.Filter {
-	return e.wrap.GetFilter()
-}
-
-func (e *watchdogEngine) SetFilter(filt *filter.Filter) {
-	e.watchdog(SetFilter, func() { e.wrap.SetFilter(filt) })
-}
-
-func (e *watchdogEngine) GetJailedFilter() *filter.Filter {
-	return e.wrap.GetJailedFilter()
-}
-
-func (e *watchdogEngine) SetJailedFilter(filt *filter.Filter) {
-	e.watchdog(SetJailedFilter, func() { e.wrap.SetJailedFilter(filt) })
-}
-
-func (e *watchdogEngine) SetStatusCallback(cb StatusCallback) {
-	e.watchdog(SetStatusCallback, func() { e.wrap.SetStatusCallback(cb) })
-}
-
-func (e *watchdogEngine) UpdateStatus(sb *ipnstate.StatusBuilder) {
-	e.watchdog(UpdateStatus, func() { e.wrap.UpdateStatus(sb) })
-}
-
-func (e *watchdogEngine) RequestStatus() {
-	e.watchdog(RequestStatus, func() { e.wrap.RequestStatus() })
-}
-
-func (e *watchdogEngine) SetNetworkMap(nm *netmap.NetworkMap) {
-	e.watchdog(SetNetworkMap, func() { e.wrap.SetNetworkMap(nm) })
-}
-
-func (e *watchdogEngine) Ping(ip netip.Addr, pingType tailcfg.PingType, size int, cb func(*ipnstate.PingResult)) {
-	e.watchdog(Ping, func() { e.wrap.Ping(ip, pingType, size, cb) })
-}
-
-func (e *watchdogEngine) Close() {
-	e.watchdog(Close, e.wrap.Close)
-}
-
-func (e *watchdogEngine) PeerForIP(ip netip.Addr) (ret PeerForIP, ok bool) {
-	e.watchdog(PeerForIPEvent, func() { ret, ok = e.wrap.PeerForIP(ip) })
-	return ret, ok
-}
-
-func (e *watchdogEngine) Done() <-chan struct{} {
-	return e.wrap.Done()
-}
-
-func (e *watchdogEngine) InstallCaptureHook(cb packet.CaptureCallback) {
-	if !buildfeatures.HasCapture {
-		return
-	}
-	e.wrap.InstallCaptureHook(cb)
-}
-
-func (e *watchdogEngine) PeerByKey(pubKey key.NodePublic) (_ wgint.Peer, ok bool) {
-	return e.wrap.PeerByKey(pubKey)
-}
-
-func (e *watchdogEngine) PatchDiscoKey(pub key.NodePublic, disco key.DiscoPublic) {
-	// PatchDiscoKey mirrors the implementation of [controlclient.patchDiscoKeyer ].
-	// It is implemented here to avoid the dependency edge to controlclient, but must be kept
-	// in sync with the original implementation.
-	type patchDiscoKeyer interface {
-		PatchDiscoKey(key.NodePublic, key.DiscoPublic)
-	}
-	if n, ok := e.wrap.(patchDiscoKeyer); ok {
-		n.PatchDiscoKey(pub, disco)
-	}
-}
diff --git a/wgengine/watchdog_omit.go b/wgengine/watchdog_omit.go
deleted file mode 100644
index b4ed43442..000000000
--- a/wgengine/watchdog_omit.go
+++ /dev/null
@@ -1,8 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-//go:build js || ts_omit_debug
-
-package wgengine
-
-func NewWatchdog(e Engine) Engine { return e }
diff --git a/wgengine/watchdog_test.go b/wgengine/watchdog_test.go
deleted file mode 100644
index a0ce9cf07..000000000
--- a/wgengine/watchdog_test.go
+++ /dev/null
@@ -1,141 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-//go:build !js
-
-package wgengine
-
-import (
-	"runtime"
-	"sync"
-	"testing"
-	"time"
-
-	"tailscale.com/health"
-	"tailscale.com/util/eventbus/eventbustest"
-	"tailscale.com/util/usermetric"
-)
-
-func TestWatchdog(t *testing.T) {
-	t.Parallel()
-
-	var maxWaitMultiple time.Duration = 1
-	if runtime.GOOS == "darwin" {
-		// Work around slow close syscalls on Big Sur with content filter Network Extensions installed.
-		// See https://github.com/tailscale/tailscale/issues/1598.
-		maxWaitMultiple = 15
-	}
-
-	t.Run("default-watchdog-does-not-fire", func(t *testing.T) {
-		t.Parallel()
-		bus := eventbustest.NewBus(t)
-		ht := health.NewTracker(bus)
-		reg := new(usermetric.Registry)
-		e, err := NewFakeUserspaceEngine(t.Logf, 0, ht, reg, bus)
-		if err != nil {
-			t.Fatal(err)
-		}
-
-		e = NewWatchdog(e)
-		e.(*watchdogEngine).maxWait = maxWaitMultiple * 150 * time.Millisecond
-		e.(*watchdogEngine).logf = t.Logf
-		e.(*watchdogEngine).fatalf = t.Fatalf
-
-		e.RequestStatus()
-		e.RequestStatus()
-		e.RequestStatus()
-		e.Close()
-	})
-}
-
-func TestWatchdogMetrics(t *testing.T) {
-	tests := []struct {
-		name       string
-		events     []watchdogEvent
-		wantCounts map[watchdogEvent]int64
-	}{
-		{
-			name:   "single-event-types",
-			events: []watchdogEvent{RequestStatus, PeerForIPEvent, Ping},
-			wantCounts: map[watchdogEvent]int64{
-				RequestStatus:  1,
-				PeerForIPEvent: 1,
-				Ping:           1,
-			},
-		},
-		{
-			name:   "repeated-events",
-			events: []watchdogEvent{RequestStatus, RequestStatus, Ping, RequestStatus},
-			wantCounts: map[watchdogEvent]int64{
-				RequestStatus: 3,
-				Ping:          1,
-			},
-		},
-	}
-
-	// For swallowing fatalf calls and stack traces
-	logf := func(format string, args ...any) {}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			clearMetrics(t)
-			bus := eventbustest.NewBus(t)
-			ht := health.NewTracker(bus)
-			reg := new(usermetric.Registry)
-			e, err := NewFakeUserspaceEngine(logf, 0, ht, reg, bus)
-			if err != nil {
-				t.Fatal(err)
-			}
-			e = NewWatchdog(e)
-			w := e.(*watchdogEngine)
-			w.maxWait = 1 * time.Microsecond
-			w.logf = logf
-			w.fatalf = logf
-
-			var wg sync.WaitGroup
-			wg.Add(len(tt.events))
-
-			for _, ev := range tt.events {
-				blocked := make(chan struct{})
-				w.watchdog(ev, func() {
-					defer wg.Done()
-					<-blocked
-				})
-				close(blocked)
-			}
-			wg.Wait()
-
-			// Check individual event counts
-			for ev, want := range tt.wantCounts {
-				m, ok := watchdogMetrics[ev]
-				if !ok {
-					t.Fatalf("no metric found for event %q", ev)
-				}
-				got := m.Value()
-				if got != want {
-					t.Errorf("got %d metric events for %q, want %d", got, ev, want)
-				}
-			}
-
-			// Check total count for Any
-			m, ok := watchdogMetrics[Any]
-			if !ok {
-				t.Fatalf("no Any metric found")
-			}
-			got := m.Value()
-			if got != int64(len(tt.events)) {
-				t.Errorf("got %d metric events for Any, want %d", got, len(tt.events))
-			}
-		})
-	}
-}
-
-func clearMetrics(t *testing.T) {
-	t.Helper()
-	if watchdogMetrics == nil {
-		return
-	}
-	for _, m := range watchdogMetrics {
-		m.Set(0)
-	}
-}
diff --git a/wgengine/wgcfg/config.go b/wgengine/wgcfg/config.go
index 782812139..d613f0fc5 100644
--- a/wgengine/wgcfg/config.go
+++ b/wgengine/wgcfg/config.go
@@ -9,28 +9,19 @@ import (
 	"slices"
 
 	"tailscale.com/types/key"
-	"tailscale.com/types/logid"
 )
 
-//go:generate go run tailscale.com/cmd/cloner -type=Config,Peer
+//go:generate go run tailscale.com/cmd/cloner -type=Config
 
 // Config is a WireGuard configuration.
 // It only supports the set of things Tailscale uses.
+//
+// Peers are not part of the config: wireguard-go learns the peer set
+// and each peer's allowed IPs from the live per-peer config source
+// installed via [tailscale.com/wgengine.Engine.SetPeerConfigFunc].
 type Config struct {
 	PrivateKey key.NodePrivate
 	Addresses  []netip.Prefix
-	MTU        uint16
-	DNS        []netip.Addr
-	Peers      []Peer
-
-	// NetworkLogging enables network logging.
-	// It is disabled if either ID is the zero value.
-	// LogExitFlowEnabled indicates whether or not exit flows should be logged.
-	NetworkLogging struct {
-		NodeID             logid.PrivateID
-		DomainID           logid.PrivateID
-		LogExitFlowEnabled bool
-	}
 }
 
 func (c *Config) Equal(o *Config) bool {
@@ -38,52 +29,5 @@ func (c *Config) Equal(o *Config) bool {
 		return c == o
 	}
 	return c.PrivateKey.Equal(o.PrivateKey) &&
-		c.MTU == o.MTU &&
-		c.NetworkLogging == o.NetworkLogging &&
-		slices.Equal(c.Addresses, o.Addresses) &&
-		slices.Equal(c.DNS, o.DNS) &&
-		slices.EqualFunc(c.Peers, o.Peers, Peer.Equal)
-}
-
-type Peer struct {
-	PublicKey           key.NodePublic
-	DiscoKey            key.DiscoPublic // present only so we can handle restarts within wgengine, not passed to WireGuard
-	AllowedIPs          []netip.Prefix
-	V4MasqAddr          *netip.Addr // if non-nil, masquerade IPv4 traffic to this peer using this address
-	V6MasqAddr          *netip.Addr // if non-nil, masquerade IPv6 traffic to this peer using this address
-	IsJailed            bool        // if true, this peer is jailed and cannot initiate connections
-	PersistentKeepalive uint16      // in seconds between keep-alives; 0 to disable
-	// wireguard-go's endpoint for this peer. It should always equal Peer.PublicKey.
-	// We represent it explicitly so that we can detect if they diverge and recover.
-	// There is no need to set WGEndpoint explicitly when constructing a Peer by hand.
-	// It is only populated when reading Peers from wireguard-go.
-	WGEndpoint key.NodePublic
-}
-
-func addrPtrEq(a, b *netip.Addr) bool {
-	if a == nil || b == nil {
-		return a == b
-	}
-	return *a == *b
-}
-
-func (p Peer) Equal(o Peer) bool {
-	return p.PublicKey == o.PublicKey &&
-		p.DiscoKey == o.DiscoKey &&
-		slices.Equal(p.AllowedIPs, o.AllowedIPs) &&
-		p.IsJailed == o.IsJailed &&
-		p.PersistentKeepalive == o.PersistentKeepalive &&
-		addrPtrEq(p.V4MasqAddr, o.V4MasqAddr) &&
-		addrPtrEq(p.V6MasqAddr, o.V6MasqAddr) &&
-		p.WGEndpoint == o.WGEndpoint
-}
-
-// PeerWithKey returns the Peer with key k and reports whether it was found.
-func (config Config) PeerWithKey(k key.NodePublic) (Peer, bool) {
-	for _, p := range config.Peers {
-		if p.PublicKey == k {
-			return p, true
-		}
-	}
-	return Peer{}, false
+		slices.Equal(c.Addresses, o.Addresses)
 }
diff --git a/wgengine/wgcfg/config_test.go b/wgengine/wgcfg/config_test.go
index 7059b17b2..64ffc8041 100644
--- a/wgengine/wgcfg/config_test.go
+++ b/wgengine/wgcfg/config_test.go
@@ -14,26 +14,10 @@ func TestConfigEqual(t *testing.T) {
 	rt := reflect.TypeFor[Config]()
 	for sf := range rt.Fields() {
 		switch sf.Name {
-		case "Name", "NodeID", "PrivateKey", "MTU", "Addresses", "DNS", "Peers",
-			"NetworkLogging":
+		case "Name", "NodeID", "PrivateKey", "Addresses":
 			// These are compared in [Config.Equal].
 		default:
 			t.Errorf("Have you added field %q to Config.Equal? Do so if not, and then update TestConfigEqual", sf.Name)
 		}
 	}
 }
-
-// Tests that [Peer.Equal] tests all fields of [Peer], even ones
-// that might get added in the future.
-func TestPeerEqual(t *testing.T) {
-	rt := reflect.TypeFor[Peer]()
-	for sf := range rt.Fields() {
-		switch sf.Name {
-		case "PublicKey", "DiscoKey", "AllowedIPs", "IsJailed",
-			"PersistentKeepalive", "V4MasqAddr", "V6MasqAddr", "WGEndpoint":
-			// These are compared in [Peer.Equal].
-		default:
-			t.Errorf("Have you added field %q to Peer.Equal? Do so if not, and then update TestPeerEqual", sf.Name)
-		}
-	}
-}
diff --git a/wgengine/wgcfg/device.go b/wgengine/wgcfg/device.go
index ba29cfbdc..c5d39ea3d 100644
--- a/wgengine/wgcfg/device.go
+++ b/wgengine/wgcfg/device.go
@@ -4,9 +4,8 @@
 package wgcfg
 
 import (
-	"errors"
-	"io"
-	"sort"
+	"fmt"
+	"net/netip"
 
 	"github.com/tailscale/wireguard-go/conn"
 	"github.com/tailscale/wireguard-go/device"
@@ -16,53 +15,26 @@ import (
 
 // NewDevice returns a wireguard-go Device configured for Tailscale use.
 func NewDevice(tunDev tun.Device, bind conn.Bind, logger *device.Logger) *device.Device {
-	ret := device.NewDevice(tunDev, bind, logger)
-	ret.DisableSomeRoamingForBrokenMobileSemantics()
-	return ret
+	return device.NewDevice(tunDev, bind, logger)
 }
 
-func DeviceConfig(d *device.Device) (*Config, error) {
-	r, w := io.Pipe()
-	errc := make(chan error, 1)
-	go func() {
-		errc <- d.IpcGetOperation(w)
-		w.Close()
-	}()
-	cfg, fromErr := FromUAPI(r)
-	r.Close()
-	getErr := <-errc
-	err := errors.Join(getErr, fromErr)
-	if err != nil {
-		return nil, err
-	}
-	sort.Slice(cfg.Peers, func(i, j int) bool {
-		return cfg.Peers[i].PublicKey.Less(cfg.Peers[j].PublicKey)
-	})
-	return cfg, nil
-}
-
-// ReconfigDevice replaces the existing device configuration with cfg.
-func ReconfigDevice(d *device.Device, cfg *Config, logf logger.Logf) (err error) {
-	defer func() {
-		if err != nil {
-			logf("wgcfg.Reconfig failed: %v", err)
+// NewPeerLookupFunc returns a [device.PeerLookupFunc] that lazily
+// creates peers using allowedIPs as the source of each peer's allowed
+// IPs. The peer's endpoint is derived from its public key via bind.
+func NewPeerLookupFunc(bind conn.Bind, logf logger.Logf, allowedIPs func(device.NoisePublicKey) ([]netip.Prefix, bool)) device.PeerLookupFunc {
+	return func(pubk device.NoisePublicKey) (_ *device.NewPeerConfig, ok bool) {
+		ips, ok := allowedIPs(pubk)
+		if !ok {
+			return nil, false
 		}
-	}()
-
-	prev, err := DeviceConfig(d)
-	if err != nil {
-		return err
+		ep, err := bind.ParseEndpoint(fmt.Sprintf("%x", pubk[:]))
+		if err != nil {
+			logf("wgcfg: failed to parse endpoint for peer %x: %v", pubk[:8], err)
+			return nil, false
+		}
+		return &device.NewPeerConfig{
+			AllowedIPs: ips,
+			Endpoint:   ep,
+		}, true
 	}
-
-	r, w := io.Pipe()
-	errc := make(chan error, 1)
-	go func() {
-		errc <- d.IpcSetOperation(r)
-		r.Close()
-	}()
-
-	toErr := cfg.ToUAPI(logf, w, prev)
-	w.Close()
-	setErr := <-errc
-	return errors.Join(setErr, toErr)
 }
diff --git a/wgengine/wgcfg/device_test.go b/wgengine/wgcfg/device_test.go
index 507f22311..c07e14702 100644
--- a/wgengine/wgcfg/device_test.go
+++ b/wgengine/wgcfg/device_test.go
@@ -4,201 +4,74 @@
 package wgcfg
 
 import (
-	"bufio"
-	"bytes"
 	"io"
 	"net/netip"
 	"os"
-	"sort"
-	"strings"
-	"sync"
 	"testing"
 
 	"github.com/tailscale/wireguard-go/conn"
 	"github.com/tailscale/wireguard-go/device"
 	"github.com/tailscale/wireguard-go/tun"
-	"go4.org/mem"
 	"tailscale.com/types/key"
 )
 
-func TestDeviceConfig(t *testing.T) {
-	newK := func() (key.NodePublic, key.NodePrivate) {
-		t.Helper()
-		k := key.NewNode()
-		return k.Public(), k
-	}
-	k1, pk1 := newK()
-	ip1 := netip.MustParsePrefix("10.0.0.1/32")
+func TestNewPeerLookupFunc(t *testing.T) {
+	k1, _ := newK()
 
-	k2, pk2 := newK()
+	k2, _ := newK()
 	ip2 := netip.MustParsePrefix("10.0.0.2/32")
 
 	k3, _ := newK()
-	ip3 := netip.MustParsePrefix("10.0.0.3/32")
 
-	cfg1 := &Config{
-		PrivateKey: pk1,
-		Peers: []Peer{{
-			PublicKey:  k2,
-			AllowedIPs: []netip.Prefix{ip2},
-		}},
+	dev := NewDevice(newNilTun(), new(noopBind), device.NewLogger(device.LogLevelError, "test"))
+	defer dev.Close()
+
+	// peers is the live per-peer config source, standing in for what
+	// LocalBackend provides via wgengine.Engine.SetPeerConfigFunc.
+	peers := map[device.NoisePublicKey][]netip.Prefix{
+		k2.Raw32(): {ip2},
 	}
+	dev.SetPeerLookupFunc(NewPeerLookupFunc(dev.Bind(), t.Logf, func(pubk device.NoisePublicKey) ([]netip.Prefix, bool) {
+		ips, ok := peers[pubk]
+		return ips, ok
+	}))
 
-	cfg2 := &Config{
-		PrivateKey: pk2,
-		Peers: []Peer{{
-			PublicKey:           k1,
-			AllowedIPs:          []netip.Prefix{ip1},
-			PersistentKeepalive: 5,
-		}},
-	}
-
-	device1 := NewDevice(newNilTun(), new(noopBind), device.NewLogger(device.LogLevelError, "device1"))
-	device2 := NewDevice(newNilTun(), new(noopBind), device.NewLogger(device.LogLevelError, "device2"))
-	defer device1.Close()
-	defer device2.Close()
-
-	cmp := func(t *testing.T, d *device.Device, want *Config) {
-		t.Helper()
-		got, err := DeviceConfig(d)
-		if err != nil {
-			t.Fatal(err)
+	t.Run("lazy-creation", func(t *testing.T) {
+		// A peer known to the config source should be creatable on
+		// demand via LookupPeer.
+		if p := dev.LookupPeer(k2.Raw32()); p == nil {
+			t.Fatal("expected peer k2 to exist via LookupPeer")
 		}
-		prev := new(Config)
-		gotbuf := new(strings.Builder)
-		err = got.ToUAPI(t.Logf, gotbuf, prev)
-		gotStr := gotbuf.String()
-		if err != nil {
-			t.Errorf("got.ToUAPI(): error: %v", err)
-			return
+		// An unknown peer should not be found.
+		if p := dev.LookupPeer(k3.Raw32()); p != nil {
+			t.Fatal("expected unknown peer k3 to not exist")
 		}
-		wantbuf := new(strings.Builder)
-		err = want.ToUAPI(t.Logf, wantbuf, prev)
-		wantStr := wantbuf.String()
-		if err != nil {
-			t.Errorf("want.ToUAPI(): error: %v", err)
-			return
-		}
-		if gotStr != wantStr {
-			buf := new(bytes.Buffer)
-			w := bufio.NewWriter(buf)
-			if err := d.IpcGetOperation(w); err != nil {
-				t.Errorf("on error, could not IpcGetOperation: %v", err)
-			}
-			w.Flush()
-			t.Errorf("config mismatch:\n---- got:\n%s\n---- want:\n%s\n---- uapi:\n%s", gotStr, wantStr, buf.String())
-		}
-	}
-
-	t.Run("device1-config", func(t *testing.T) {
-		if err := ReconfigDevice(device1, cfg1, t.Logf); err != nil {
-			t.Fatal(err)
-		}
-		cmp(t, device1, cfg1)
 	})
 
-	t.Run("device2-config", func(t *testing.T) {
-		if err := ReconfigDevice(device2, cfg2, t.Logf); err != nil {
-			t.Fatal(err)
-		}
-		cmp(t, device2, cfg2)
-	})
-
-	// This is only to test that Config and Reconfig are properly synchronized.
-	t.Run("device2-config-reconfig", func(t *testing.T) {
-		var wg sync.WaitGroup
-		wg.Add(2)
-
-		go func() {
-			ReconfigDevice(device2, cfg2, t.Logf)
-			wg.Done()
-		}()
-
-		go func() {
-			DeviceConfig(device2)
-			wg.Done()
-		}()
-
-		wg.Wait()
-	})
-
-	t.Run("device1-modify-peer", func(t *testing.T) {
-		cfg1.Peers[0].DiscoKey = key.DiscoPublicFromRaw32(mem.B([]byte{0: 1, 31: 0}))
-		if err := ReconfigDevice(device1, cfg1, t.Logf); err != nil {
-			t.Fatal(err)
-		}
-		cmp(t, device1, cfg1)
-	})
-
-	t.Run("device1-replace-endpoint", func(t *testing.T) {
-		cfg1.Peers[0].DiscoKey = key.DiscoPublicFromRaw32(mem.B([]byte{0: 2, 31: 0}))
-		if err := ReconfigDevice(device1, cfg1, t.Logf); err != nil {
-			t.Fatal(err)
-		}
-		cmp(t, device1, cfg1)
-	})
-
-	t.Run("device1-add-new-peer", func(t *testing.T) {
-		cfg1.Peers = append(cfg1.Peers, Peer{
-			PublicKey:  k3,
-			AllowedIPs: []netip.Prefix{ip3},
+	t.Run("remove-peer", func(t *testing.T) {
+		delete(peers, k2.Raw32())
+		dev.RemoveMatchingPeers(func(pk device.NoisePublicKey) bool {
+			_, ok := peers[pk]
+			return !ok
 		})
-		sort.Slice(cfg1.Peers, func(i, j int) bool {
-			return cfg1.Peers[i].PublicKey.Less(cfg1.Peers[j].PublicKey)
-		})
-
-		origCfg, err := DeviceConfig(device1)
-		if err != nil {
-			t.Fatal(err)
-		}
-
-		if err := ReconfigDevice(device1, cfg1, t.Logf); err != nil {
-			t.Fatal(err)
-		}
-		cmp(t, device1, cfg1)
-
-		newCfg, err := DeviceConfig(device1)
-		if err != nil {
-			t.Fatal(err)
-		}
-
-		peer0 := func(cfg *Config) Peer {
-			p, ok := cfg.PeerWithKey(k2)
-			if !ok {
-				t.Helper()
-				t.Fatal("failed to look up peer 2")
-			}
-			return p
-		}
-		peersEqual := func(p, q Peer) bool {
-			return p.PublicKey == q.PublicKey && p.DiscoKey == q.DiscoKey && p.PersistentKeepalive == q.PersistentKeepalive && cidrsEqual(p.AllowedIPs, q.AllowedIPs)
-		}
-		if !peersEqual(peer0(origCfg), peer0(newCfg)) {
-			t.Error("reconfig modified old peer")
+		if p := dev.LookupPeer(k2.Raw32()); p != nil {
+			t.Fatal("expected peer k2 to not exist after removal")
 		}
 	})
 
-	t.Run("device1-remove-peer", func(t *testing.T) {
-		removeKey := cfg1.Peers[len(cfg1.Peers)-1].PublicKey
-		cfg1.Peers = cfg1.Peers[:len(cfg1.Peers)-1]
-
-		if err := ReconfigDevice(device1, cfg1, t.Logf); err != nil {
-			t.Fatal(err)
-		}
-		cmp(t, device1, cfg1)
-
-		newCfg, err := DeviceConfig(device1)
-		if err != nil {
-			t.Fatal(err)
-		}
-
-		_, ok := newCfg.PeerWithKey(removeKey)
-		if ok {
-			t.Error("reconfig failed to remove peer")
+	t.Run("self-key-not-peer", func(t *testing.T) {
+		// The device's own key should not be a peer.
+		if p := dev.LookupPeer(k1.Raw32()); p != nil {
+			t.Fatal("expected own key to not be a peer")
 		}
 	})
 }
 
+func newK() (key.NodePublic, key.NodePrivate) {
+	k := key.NewNode()
+	return k.Public(), k
+}
+
 // TODO: replace with a loopback tunnel
 type nilTun struct {
 	events chan tun.Event
diff --git a/wgengine/wgcfg/nmcfg/nmcfg.go b/wgengine/wgcfg/nmcfg/nmcfg.go
deleted file mode 100644
index f99b7b007..000000000
--- a/wgengine/wgcfg/nmcfg/nmcfg.go
+++ /dev/null
@@ -1,146 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-// Package nmcfg converts a controlclient.NetMap into a wgcfg config.
-package nmcfg
-
-import (
-	"bufio"
-	"cmp"
-	"fmt"
-	"net/netip"
-	"strings"
-
-	"tailscale.com/net/tsaddr"
-	"tailscale.com/tailcfg"
-	"tailscale.com/types/key"
-	"tailscale.com/types/logger"
-	"tailscale.com/types/logid"
-	"tailscale.com/types/netmap"
-	"tailscale.com/wgengine/wgcfg"
-)
-
-func nodeDebugName(n tailcfg.NodeView) string {
-	name, _, _ := strings.Cut(cmp.Or(n.Name(), n.Hostinfo().Hostname()), ".")
-	return name
-}
-
-// cidrIsSubnet reports whether cidr is a non-default-route subnet
-// exported by node that is not one of its own self addresses.
-func cidrIsSubnet(node tailcfg.NodeView, cidr netip.Prefix) bool {
-	if cidr.Bits() == 0 {
-		return false
-	}
-	if !cidr.IsSingleIP() {
-		return true
-	}
-	if tsaddr.IsTailscaleIP(cidr.Addr()) {
-		return false
-	}
-	for _, selfCIDR := range node.Addresses().All() {
-		if cidr == selfCIDR {
-			return false
-		}
-	}
-	return true
-}
-
-// WGCfg returns the NetworkMaps's WireGuard configuration.
-func WGCfg(pk key.NodePrivate, nm *netmap.NetworkMap, logf logger.Logf, flags netmap.WGConfigFlags, exitNode tailcfg.StableNodeID) (*wgcfg.Config, error) {
-	cfg := &wgcfg.Config{
-		PrivateKey: pk,
-		Addresses:  nm.GetAddresses().AsSlice(),
-		Peers:      make([]wgcfg.Peer, 0, len(nm.Peers)),
-	}
-
-	// Setup log IDs for data plane audit logging.
-	if nm.SelfNode.Valid() {
-		canNetworkLog := nm.SelfNode.HasCap(tailcfg.CapabilityDataPlaneAuditLogs)
-		logExitFlowEnabled := nm.SelfNode.HasCap(tailcfg.NodeAttrLogExitFlows)
-		if canNetworkLog && nm.SelfNode.DataPlaneAuditLogID() != "" && nm.DomainAuditLogID != "" {
-			nodeID, errNode := logid.ParsePrivateID(nm.SelfNode.DataPlaneAuditLogID())
-			if errNode != nil {
-				logf("[v1] wgcfg: unable to parse node audit log ID: %v", errNode)
-			}
-			domainID, errDomain := logid.ParsePrivateID(nm.DomainAuditLogID)
-			if errDomain != nil {
-				logf("[v1] wgcfg: unable to parse domain audit log ID: %v", errDomain)
-			}
-			if errNode == nil && errDomain == nil {
-				cfg.NetworkLogging.NodeID = nodeID
-				cfg.NetworkLogging.DomainID = domainID
-				cfg.NetworkLogging.LogExitFlowEnabled = logExitFlowEnabled
-			}
-		}
-	}
-
-	var skippedExitNode, skippedSubnetRouter, skippedExpired []tailcfg.NodeView
-
-	for _, peer := range nm.Peers {
-		if peer.DiscoKey().IsZero() && peer.HomeDERP() == 0 && !peer.IsWireGuardOnly() {
-			// Peer predates both DERP and active discovery, we cannot
-			// communicate with it.
-			logf("[v1] wgcfg: skipped peer %s, doesn't offer DERP or disco", peer.Key().ShortString())
-			continue
-		}
-		// Skip expired peers; we'll end up failing to connect to them
-		// anyway, since control intentionally breaks node keys for
-		// expired peers so that we can't discover endpoints via DERP.
-		if peer.Expired() {
-			skippedExpired = append(skippedExpired, peer)
-			continue
-		}
-
-		cfg.Peers = append(cfg.Peers, wgcfg.Peer{
-			PublicKey: peer.Key(),
-			DiscoKey:  peer.DiscoKey(),
-		})
-		cpeer := &cfg.Peers[len(cfg.Peers)-1]
-
-		didExitNodeLog := false
-		cpeer.V4MasqAddr = peer.SelfNodeV4MasqAddrForThisPeer().Clone()
-		cpeer.V6MasqAddr = peer.SelfNodeV6MasqAddrForThisPeer().Clone()
-		cpeer.IsJailed = peer.IsJailed()
-		for _, allowedIP := range peer.AllowedIPs().All() {
-			if allowedIP.Bits() == 0 && peer.StableID() != exitNode {
-				if didExitNodeLog {
-					// Don't log about both the IPv4 /0 and IPv6 /0.
-					continue
-				}
-				didExitNodeLog = true
-				skippedExitNode = append(skippedExitNode, peer)
-				continue
-			} else if cidrIsSubnet(peer, allowedIP) {
-				if (flags & netmap.AllowSubnetRoutes) == 0 {
-					skippedSubnetRouter = append(skippedSubnetRouter, peer)
-					continue
-				}
-			}
-			cpeer.AllowedIPs = append(cpeer.AllowedIPs, allowedIP)
-		}
-	}
-
-	logList := func(title string, nodes []tailcfg.NodeView) {
-		if len(nodes) == 0 {
-			return
-		}
-		logf("[v1] wgcfg: %s from %d nodes: %s", title, len(nodes), logger.ArgWriter(func(bw *bufio.Writer) {
-			const max = 5
-			for i, n := range nodes {
-				if i == max {
-					fmt.Fprintf(bw, "... +%d", len(nodes)-max)
-					return
-				}
-				if i > 0 {
-					bw.WriteString(", ")
-				}
-				fmt.Fprintf(bw, "%s (%s)", nodeDebugName(n), n.StableID())
-			}
-		}))
-	}
-	logList("skipped unselected exit nodes", skippedExitNode)
-	logList("did not accept subnet routes", skippedSubnetRouter)
-	logList("skipped expired peers", skippedExpired)
-
-	return cfg, nil
-}
diff --git a/wgengine/wgcfg/parser.go b/wgengine/wgcfg/parser.go
deleted file mode 100644
index 8fb921409..000000000
--- a/wgengine/wgcfg/parser.go
+++ /dev/null
@@ -1,186 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-package wgcfg
-
-import (
-	"bufio"
-	"fmt"
-	"io"
-	"net"
-	"net/netip"
-	"strconv"
-	"strings"
-
-	"go4.org/mem"
-	"tailscale.com/types/key"
-)
-
-type ParseError struct {
-	why      string
-	offender string
-}
-
-func (e *ParseError) Error() string {
-	return fmt.Sprintf("%s: %q", e.why, e.offender)
-}
-
-func parseEndpoint(s string) (host string, port uint16, err error) {
-	i := strings.LastIndexByte(s, ':')
-	if i < 0 {
-		return "", 0, &ParseError{"Missing port from endpoint", s}
-	}
-	host, portStr := s[:i], s[i+1:]
-	if len(host) < 1 {
-		return "", 0, &ParseError{"Invalid endpoint host", host}
-	}
-	uport, err := strconv.ParseUint(portStr, 10, 16)
-	if err != nil {
-		return "", 0, err
-	}
-	hostColon := strings.IndexByte(host, ':')
-	if host[0] == '[' || host[len(host)-1] == ']' || hostColon > 0 {
-		err := &ParseError{"Brackets must contain an IPv6 address", host}
-		if len(host) > 3 && host[0] == '[' && host[len(host)-1] == ']' && hostColon > 0 {
-			maybeV6 := net.ParseIP(host[1 : len(host)-1])
-			if maybeV6 == nil || len(maybeV6) != net.IPv6len {
-				return "", 0, err
-			}
-		} else {
-			return "", 0, err
-		}
-		host = host[1 : len(host)-1]
-	}
-	return host, uint16(uport), nil
-}
-
-// memROCut separates a mem.RO at the separator if it exists, otherwise
-// it returns two empty ROs and reports that it was not found.
-func memROCut(s mem.RO, sep byte) (before, after mem.RO, found bool) {
-	if i := mem.IndexByte(s, sep); i >= 0 {
-		return s.SliceTo(i), s.SliceFrom(i + 1), true
-	}
-	found = false
-	return
-}
-
-// FromUAPI generates a Config from r.
-// r should be generated by calling device.IpcGetOperation;
-// it is not compatible with other uapi streams.
-func FromUAPI(r io.Reader) (*Config, error) {
-	cfg := new(Config)
-	var peer *Peer // current peer being operated on
-	deviceConfig := true
-
-	scanner := bufio.NewScanner(r)
-	for scanner.Scan() {
-		line := mem.B(scanner.Bytes())
-		if line.Len() == 0 {
-			continue
-		}
-		key, value, ok := memROCut(line, '=')
-		if !ok {
-			return nil, fmt.Errorf("failed to cut line %q on =", line.StringCopy())
-		}
-		valueBytes := scanner.Bytes()[key.Len()+1:]
-
-		if key.EqualString("public_key") {
-			if deviceConfig {
-				deviceConfig = false
-			}
-			// Load/create the peer we are now configuring.
-			var err error
-			peer, err = cfg.handlePublicKeyLine(valueBytes)
-			if err != nil {
-				return nil, err
-			}
-			continue
-		}
-
-		var err error
-		if deviceConfig {
-			err = cfg.handleDeviceLine(key, value, valueBytes)
-		} else {
-			err = cfg.handlePeerLine(peer, key, value, valueBytes)
-		}
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	if err := scanner.Err(); err != nil {
-		return nil, err
-	}
-
-	return cfg, nil
-}
-
-func (cfg *Config) handleDeviceLine(k, value mem.RO, valueBytes []byte) error {
-	switch {
-	case k.EqualString("private_key"):
-		// wireguard-go guarantees not to send zero value; private keys are already clamped.
-		var err error
-		cfg.PrivateKey, err = key.ParseNodePrivateUntyped(value)
-		if err != nil {
-			return err
-		}
-	case k.EqualString("listen_port") || k.EqualString("fwmark"):
-	// ignore
-	default:
-		return fmt.Errorf("unexpected IpcGetOperation key: %q", k.StringCopy())
-	}
-	return nil
-}
-
-func (cfg *Config) handlePublicKeyLine(valueBytes []byte) (*Peer, error) {
-	p := Peer{}
-	var err error
-	p.PublicKey, err = key.ParseNodePublicUntyped(mem.B(valueBytes))
-	if err != nil {
-		return nil, err
-	}
-	cfg.Peers = append(cfg.Peers, p)
-	return &cfg.Peers[len(cfg.Peers)-1], nil
-}
-
-func (cfg *Config) handlePeerLine(peer *Peer, k, value mem.RO, valueBytes []byte) error {
-	switch {
-	case k.EqualString("endpoint"):
-		nk, err := key.ParseNodePublicUntyped(value)
-		if err != nil {
-			return fmt.Errorf("invalid endpoint %q for peer %q, expected a hex public key", value.StringCopy(), peer.PublicKey.ShortString())
-		}
-		// nk ought to equal peer.PublicKey.
-		// Under some rare circumstances, it might not. See corp issue #3016.
-		// Even if that happens, don't stop early, so that we can recover from it.
-		// Instead, note the value of nk so we can fix as needed.
-		peer.WGEndpoint = nk
-	case k.EqualString("persistent_keepalive_interval"):
-		n, err := mem.ParseUint(value, 10, 16)
-		if err != nil {
-			return err
-		}
-		peer.PersistentKeepalive = uint16(n)
-	case k.EqualString("allowed_ip"):
-		ipp := netip.Prefix{}
-		err := ipp.UnmarshalText(valueBytes)
-		if err != nil {
-			return err
-		}
-		peer.AllowedIPs = append(peer.AllowedIPs, ipp)
-	case k.EqualString("protocol_version"):
-		if !value.EqualString("1") {
-			return fmt.Errorf("invalid protocol version: %q", value.StringCopy())
-		}
-	case k.EqualString("replace_allowed_ips") ||
-		k.EqualString("preshared_key") ||
-		k.EqualString("last_handshake_time_sec") ||
-		k.EqualString("last_handshake_time_nsec") ||
-		k.EqualString("tx_bytes") ||
-		k.EqualString("rx_bytes"):
-	// ignore
-	default:
-		return fmt.Errorf("unexpected IpcGetOperation key: %q", k.StringCopy())
-	}
-	return nil
-}
diff --git a/wgengine/wgcfg/parser_test.go b/wgengine/wgcfg/parser_test.go
deleted file mode 100644
index 8c38ec025..000000000
--- a/wgengine/wgcfg/parser_test.go
+++ /dev/null
@@ -1,95 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-package wgcfg
-
-import (
-	"bufio"
-	"bytes"
-	"io"
-	"net/netip"
-	"reflect"
-	"runtime"
-	"testing"
-
-	"tailscale.com/types/key"
-)
-
-func noError(t *testing.T, err error) bool {
-	if err == nil {
-		return true
-	}
-	_, fn, line, _ := runtime.Caller(1)
-	t.Errorf("Error at %s:%d: %#v", fn, line, err)
-	return false
-}
-
-func equal(t *testing.T, expected, actual any) bool {
-	if reflect.DeepEqual(expected, actual) {
-		return true
-	}
-	_, fn, line, _ := runtime.Caller(1)
-	t.Errorf("Failed equals at %s:%d\nactual   %#v\nexpected %#v", fn, line, actual, expected)
-	return false
-}
-
-func TestParseEndpoint(t *testing.T) {
-	_, _, err := parseEndpoint("[192.168.42.0:]:51880")
-	if err == nil {
-		t.Error("Error was expected")
-	}
-	host, port, err := parseEndpoint("192.168.42.0:51880")
-	if noError(t, err) {
-		equal(t, "192.168.42.0", host)
-		equal(t, uint16(51880), port)
-	}
-	host, port, err = parseEndpoint("test.wireguard.com:18981")
-	if noError(t, err) {
-		equal(t, "test.wireguard.com", host)
-		equal(t, uint16(18981), port)
-	}
-	host, port, err = parseEndpoint("[2607:5300:60:6b0::c05f:543]:2468")
-	if noError(t, err) {
-		equal(t, "2607:5300:60:6b0::c05f:543", host)
-		equal(t, uint16(2468), port)
-	}
-	_, _, err = parseEndpoint("[::::::invalid:18981")
-	if err == nil {
-		t.Error("Error was expected")
-	}
-}
-
-func BenchmarkFromUAPI(b *testing.B) {
-	newK := func() (key.NodePublic, key.NodePrivate) {
-		b.Helper()
-		k := key.NewNode()
-		return k.Public(), k
-	}
-	k1, pk1 := newK()
-	ip1 := netip.MustParsePrefix("10.0.0.1/32")
-
-	peer := Peer{
-		PublicKey:  k1,
-		AllowedIPs: []netip.Prefix{ip1},
-	}
-	cfg1 := &Config{
-		PrivateKey: pk1,
-		Peers:      []Peer{peer, peer, peer, peer},
-	}
-
-	buf := new(bytes.Buffer)
-	w := bufio.NewWriter(buf)
-	if err := cfg1.ToUAPI(b.Logf, w, &Config{}); err != nil {
-		b.Fatal(err)
-	}
-	w.Flush()
-	r := bytes.NewReader(buf.Bytes())
-	b.ReportAllocs()
-	for range b.N {
-		r.Seek(0, io.SeekStart)
-		_, err := FromUAPI(r)
-		if err != nil {
-			b.Errorf("failed from UAPI: %v", err)
-		}
-	}
-}
diff --git a/wgengine/wgcfg/wgcfg_clone.go b/wgengine/wgcfg/wgcfg_clone.go
index 9e8de7b6f..7b56729c4 100644
--- a/wgengine/wgcfg/wgcfg_clone.go
+++ b/wgengine/wgcfg/wgcfg_clone.go
@@ -9,7 +9,6 @@ import (
 	"net/netip"
 
 	"tailscale.com/types/key"
-	"tailscale.com/types/logid"
 )
 
 // Clone makes a deep copy of Config.
@@ -21,56 +20,11 @@ func (src *Config) Clone() *Config {
 	dst := new(Config)
 	*dst = *src
 	dst.Addresses = append(src.Addresses[:0:0], src.Addresses...)
-	dst.DNS = append(src.DNS[:0:0], src.DNS...)
-	if src.Peers != nil {
-		dst.Peers = make([]Peer, len(src.Peers))
-		for i := range dst.Peers {
-			dst.Peers[i] = *src.Peers[i].Clone()
-		}
-	}
 	return dst
 }
 
 // A compilation failure here means this code must be regenerated, with the command at the top of this file.
 var _ConfigCloneNeedsRegeneration = Config(struct {
-	PrivateKey     key.NodePrivate
-	Addresses      []netip.Prefix
-	MTU            uint16
-	DNS            []netip.Addr
-	Peers          []Peer
-	NetworkLogging struct {
-		NodeID             logid.PrivateID
-		DomainID           logid.PrivateID
-		LogExitFlowEnabled bool
-	}
-}{})
-
-// Clone makes a deep copy of Peer.
-// The result aliases no memory with the original.
-func (src *Peer) Clone() *Peer {
-	if src == nil {
-		return nil
-	}
-	dst := new(Peer)
-	*dst = *src
-	dst.AllowedIPs = append(src.AllowedIPs[:0:0], src.AllowedIPs...)
-	if dst.V4MasqAddr != nil {
-		dst.V4MasqAddr = new(*src.V4MasqAddr)
-	}
-	if dst.V6MasqAddr != nil {
-		dst.V6MasqAddr = new(*src.V6MasqAddr)
-	}
-	return dst
-}
-
-// A compilation failure here means this code must be regenerated, with the command at the top of this file.
-var _PeerCloneNeedsRegeneration = Peer(struct {
-	PublicKey           key.NodePublic
-	DiscoKey            key.DiscoPublic
-	AllowedIPs          []netip.Prefix
-	V4MasqAddr          *netip.Addr
-	V6MasqAddr          *netip.Addr
-	IsJailed            bool
-	PersistentKeepalive uint16
-	WGEndpoint          key.NodePublic
+	PrivateKey key.NodePrivate
+	Addresses  []netip.Prefix
 }{})
diff --git a/wgengine/wgcfg/writer.go b/wgengine/wgcfg/writer.go
deleted file mode 100644
index f4981e3e9..000000000
--- a/wgengine/wgcfg/writer.go
+++ /dev/null
@@ -1,154 +0,0 @@
-// Copyright (c) Tailscale Inc & contributors
-// SPDX-License-Identifier: BSD-3-Clause
-
-package wgcfg
-
-import (
-	"fmt"
-	"io"
-	"net/netip"
-	"strconv"
-
-	"tailscale.com/types/key"
-	"tailscale.com/types/logger"
-)
-
-// ToUAPI writes cfg in UAPI format to w.
-// Prev is the previous device Config.
-//
-// Prev is required so that we can remove now-defunct peers without having to
-// remove and re-add all peers, and so that we can avoid writing information
-// about peers that have not changed since the previous time we wrote our
-// Config.
-func (cfg *Config) ToUAPI(logf logger.Logf, w io.Writer, prev *Config) error {
-	var stickyErr error
-	set := func(key, value string) {
-		if stickyErr != nil {
-			return
-		}
-		_, err := fmt.Fprintf(w, "%s=%s\n", key, value)
-		if err != nil {
-			stickyErr = err
-		}
-	}
-	setUint16 := func(key string, value uint16) {
-		set(key, strconv.FormatUint(uint64(value), 10))
-	}
-	setPeer := func(peer Peer) {
-		set("public_key", peer.PublicKey.UntypedHexString())
-	}
-
-	// Device config.
-	if !prev.PrivateKey.Equal(cfg.PrivateKey) {
-		set("private_key", cfg.PrivateKey.UntypedHexString())
-	}
-
-	old := make(map[key.NodePublic]Peer)
-	for _, p := range prev.Peers {
-		old[p.PublicKey] = p
-	}
-
-	// Add/configure all new peers.
-	for _, p := range cfg.Peers {
-		oldPeer, wasPresent := old[p.PublicKey]
-
-		// We only want to write the peer header/version if we're about
-		// to change something about that peer, or if it's a new peer.
-		// Figure out up-front whether we'll need to do anything for
-		// this peer, and skip doing anything if not.
-		//
-		// If the peer was not present in the previous config, this
-		// implies that this is a new peer; set all of these to 'true'
-		// to ensure that we're writing the full peer configuration.
-		willSetEndpoint := oldPeer.WGEndpoint != p.PublicKey || !wasPresent
-		willChangeIPs := !cidrsEqual(oldPeer.AllowedIPs, p.AllowedIPs) || !wasPresent
-		willChangeKeepalive := oldPeer.PersistentKeepalive != p.PersistentKeepalive // if not wasPresent, no need to redundantly set zero (default)
-
-		if !willSetEndpoint && !willChangeIPs && !willChangeKeepalive {
-			// It's safe to skip doing anything here; wireguard-go
-			// will not remove a peer if it's unspecified unless we
-			// tell it to (which we do below if necessary).
-			continue
-		}
-
-		setPeer(p)
-		set("protocol_version", "1")
-
-		// Avoid setting endpoints if the correct one is already known
-		// to WireGuard, because doing so generates a bit more work in
-		// calling magicsock's ParseEndpoint for effectively a no-op.
-		if willSetEndpoint {
-			if wasPresent {
-				// We had an endpoint, and it was wrong.
-				// By construction, this should not happen.
-				// If it does, keep going so that we can recover from it,
-				// but log so that we know about it,
-				// because it is an indicator of other failed invariants.
-				// See corp issue 3016.
-				logf("[unexpected] endpoint changed from %s to %s", oldPeer.WGEndpoint, p.PublicKey)
-			}
-			set("endpoint", p.PublicKey.UntypedHexString())
-		}
-
-		// TODO: replace_allowed_ips is expensive.
-		// If p.AllowedIPs is a strict superset of oldPeer.AllowedIPs,
-		// then skip replace_allowed_ips and instead add only
-		// the new ipps with allowed_ip.
-		if willChangeIPs {
-			set("replace_allowed_ips", "true")
-			for _, ipp := range p.AllowedIPs {
-				set("allowed_ip", ipp.String())
-			}
-		}
-
-		// Set PersistentKeepalive after the peer is otherwise configured,
-		// because it can trigger handshake packets.
-		if willChangeKeepalive {
-			setUint16("persistent_keepalive_interval", p.PersistentKeepalive)
-		}
-	}
-
-	// Remove peers that were present but should no longer be.
-	for _, p := range cfg.Peers {
-		delete(old, p.PublicKey)
-	}
-	for _, p := range old {
-		setPeer(p)
-		set("remove", "true")
-	}
-
-	if stickyErr != nil {
-		stickyErr = fmt.Errorf("ToUAPI: %w", stickyErr)
-	}
-	return stickyErr
-}
-
-func cidrsEqual(x, y []netip.Prefix) bool {
-	// TODO: re-implement using netaddr.IPSet.Equal.
-	if len(x) != len(y) {
-		return false
-	}
-	// First see if they're equal in order, without allocating.
-	exact := true
-	for i := range x {
-		if x[i] != y[i] {
-			exact = false
-			break
-		}
-	}
-	if exact {
-		return true
-	}
-
-	// Otherwise, see if they're the same, but out of order.
-	m := make(map[netip.Prefix]bool)
-	for _, v := range x {
-		m[v] = true
-	}
-	for _, v := range y {
-		if !m[v] {
-			return false
-		}
-	}
-	return true
-}
diff --git a/wgengine/wgengine.go b/wgengine/wgengine.go
index 9dd782e4a..652774756 100644
--- a/wgengine/wgengine.go
+++ b/wgengine/wgengine.go
@@ -9,9 +9,11 @@ import (
 	"net/netip"
 	"time"
 
+	"github.com/gaissmai/bart"
 	"tailscale.com/ipn/ipnstate"
 	"tailscale.com/net/dns"
 	"tailscale.com/net/packet"
+	"tailscale.com/net/routemanager"
 	"tailscale.com/tailcfg"
 	"tailscale.com/types/key"
 	"tailscale.com/types/netmap"
@@ -41,6 +43,28 @@ type StatusCallback func(*Status, error)
 // into network map updates.
 type NetworkMapCallback func(*netmap.NetworkMap)
 
+// PeerWireGuardState is the current WireGuard session state for a peer.
+type PeerWireGuardState uint8
+
+const (
+	// PeerWireGuardStateNone means there is no handshake in progress and no
+	// session key material retained for this peer.
+	PeerWireGuardStateNone PeerWireGuardState = 0
+
+	// PeerWireGuardStateHandshake means a handshake is in progress for this
+	// peer, but there is not currently a usable WireGuard session.
+	PeerWireGuardStateHandshake PeerWireGuardState = 1
+
+	// PeerWireGuardStateEstablished means the peer has a completed WireGuard
+	// session with usable session key material.
+	PeerWireGuardStateEstablished PeerWireGuardState = 2
+
+	// PeerWireGuardStateExpired means the peer's session key material is no
+	// longer considered usable, but final key cleanup or lazy peer removal may
+	// not have happened yet.
+	PeerWireGuardStateExpired PeerWireGuardState = 3
+)
+
 // ErrNoChanges is returned by Engine.Reconfig if no changes were made.
 var ErrNoChanges = errors.New("no changes made to Engine config")
 
@@ -76,9 +100,19 @@ type Engine interface {
 	// Unlike Reconfig, it does not return ErrNoChanges.
 	ResetAndStop() (*Status, error)
 
-	// PeerForIP returns the node to which the provided IP routes,
-	// if any. If none is found, (nil, false) is returned.
-	PeerForIP(netip.Addr) (_ PeerForIP, ok bool)
+	// SetPeerForIPFunc installs the IP-to-node lookup used by the
+	// engine's internal cold paths (Ping, TSMP, pendopen diagnostics).
+	// It parallels [Engine.SetPeerByIPPacketFunc] but returns richer
+	// data (a full NodeView, the matched route prefix, and the IsSelf
+	// flag).
+	//
+	// If fn is nil, those lookups fail for every IP.
+	//
+	// LocalBackend installs a func backed by the live nodeBackend for
+	// exact-match and self addresses, with the RouteManager's outbound
+	// table supplying the subnet-route / exit-node fallback; the engine
+	// itself holds no peer-lookup state on this path.
+	SetPeerForIPFunc(fn func(netip.Addr) (_ PeerForIP, ok bool))
 
 	// GetFilter returns the current packet filter, if any.
 	GetFilter() *filter.Filter
@@ -93,6 +127,17 @@ type Engine interface {
 	// SetJailedFilter updates the packet filter for jailed nodes.
 	SetJailedFilter(*filter.Filter)
 
+	// SetPeerRoutes updates the per-peer route attributes used by the
+	// tun-layer data plane for per-packet NAT rewrites and
+	// jailed-filter selection. native4 and native6 are this node's own
+	// Tailscale addresses, and routes maps each peer's addresses and
+	// routed prefixes to its attributes; it is a shared immutable
+	// snapshot from [routemanager.RouteManager.Outbound].
+	//
+	// A nil routes table disables all per-packet peer processing;
+	// callers pass nil when no current peer has any such attributes.
+	SetPeerRoutes(native4, native6 netip.Addr, routes *bart.Table[*routemanager.PeerRoute])
+
 	// SetStatusCallback sets the function to call when the
 	// WireGuard status changes.
 	SetStatusCallback(StatusCallback)
@@ -116,12 +161,9 @@ type Engine interface {
 	// You don't have to call this.
 	Done() <-chan struct{}
 
-	// SetNetworkMap informs the engine of the latest network map
-	// from the server. The network map's DERPMap field should be
-	// ignored as as it might be disabled; get it from SetDERPMap
-	// instead.
-	// The network map should only be read from.
-	SetNetworkMap(*netmap.NetworkMap)
+	// SetSelfNode informs the engine of the current self node.
+	// The zero (invalid) NodeView indicates no self node.
+	SetSelfNode(tailcfg.NodeView)
 
 	// UpdateStatus populates the network state using the provided
 	// status builder.
@@ -137,4 +179,84 @@ type Engine interface {
 	// packets traversing the data path. The hook can be uninstalled by
 	// calling this function with a nil value.
 	InstallCaptureHook(packet.CaptureCallback)
+
+	// SetPeerByIPPacketFunc installs a callback used by wireguard-go to
+	// look up which peer should handle an outbound packet by destination IP.
+	SetPeerByIPPacketFunc(func(netip.Addr) (_ key.NodePublic, ok bool))
+
+	// SetPeerConfigFunc installs the live source of per-peer WireGuard
+	// configuration: given a peer's public key, fn returns the prefixes
+	// the peer is currently allowed to originate traffic from, or
+	// ok=false if the peer is unknown (in which case it must not exist
+	// in the WireGuard device). The engine installs a single
+	// [device.PeerLookupFunc] wrapping fn, so lazily-created peers
+	// always see current state and the lookup func never needs to be
+	// reinstalled as peers come and go.
+	//
+	// It is expected to be called once during LocalBackend construction,
+	// before the first [Engine.Reconfig]. fn is called rarely (when
+	// wireguard-go first hears from a peer it doesn't have) and may
+	// acquire locks.
+	SetPeerConfigFunc(fn func(key.NodePublic) (allowedIPs []netip.Prefix, ok bool))
+
+	// SyncDevicePeer synchronizes the WireGuard device's state for a
+	// single peer with the config source installed via
+	// [Engine.SetPeerConfigFunc]: if the source no longer knows the
+	// peer, it is removed from the device; if the peer is active in the
+	// device, its allowed IPs are updated. It does O(1) work (plus the
+	// config source lookup) and is intended to be called for each peer
+	// added, updated, or removed by an incremental netmap delta,
+	// avoiding a full [Engine.Reconfig].
+	//
+	// It is a no-op if no config source is installed.
+	SyncDevicePeer(key.NodePublic)
+
+	// ResetDevicePeer removes the peer from the WireGuard device,
+	// discarding any session key material and in-flight handshake
+	// state. If the peer is still known to the config source installed
+	// via [Engine.SetPeerConfigFunc], it is lazily re-created on demand
+	// with fresh state.
+	//
+	// LocalBackend calls it when a peer's disco key changes, which
+	// means the peer restarted and its old sessions are dead.
+	ResetDevicePeer(key.NodePublic)
+
+	// SetNetLogSource installs the [NetLogSource] consulted by the
+	// engine's network flow logger for node lookups and the current
+	// audit logging identity.
+	//
+	// It is expected to be called once during LocalBackend construction,
+	// before any [Engine.Reconfig] call that starts up the network logger.
+	SetNetLogSource(NetLogSource)
+
+	// SetWGPeerLookup installs the function used by the engine's
+	// wireguard-go log wrapper to rewrite peer references in log lines
+	// (mapping wireguard-go's "peer(XXXX…YYYY)" form to the
+	// Tailscale-conventional short string form).
+	//
+	// It is expected to be called once during LocalBackend construction.
+	// The function is called concurrently and must be safe to call with
+	// no Engine locks held.
+	SetWGPeerLookup(func(wgString string) (tsString string, ok bool))
+
+	// SetPeerSessionStateFunc installs a callback used to observe WireGuard
+	// peer session state transitions.
+	//
+	// Calls are serialized per Engine and delivered in transition order from
+	// wireguard-go, while wireguard-go is holding locks. The callback must be
+	// cheap and must not call back into wireguard-go.
+	//
+	// It does not replay current state. Callers that need a complete view should
+	// set it before peers are started or lazily created, and maintain any
+	// snapshots, sequence numbers, and pubsub state outside wireguard-go.
+	//
+	// In Tailscale, the usual implementation is
+	// ipnlocal.LocalBackend.onPeerWireGuardState, installed early in
+	// LocalBackend construction.
+	SetPeerSessionStateFunc(func(key.NodePublic, PeerWireGuardState))
+
+	// ProbeLocks acquires and releases the engine's internal locks so
+	// that [ipnlocal.LocalBackend]'s watchdog can detect deadlocks in
+	// the engine. It is otherwise a no-op.
+	ProbeLocks()
 }
diff --git a/wgengine/wglog/wglog.go b/wgengine/wglog/wglog.go
index 174babb91..72a880dca 100644
--- a/wgengine/wglog/wglog.go
+++ b/wgengine/wglog/wglog.go
@@ -11,33 +11,42 @@ import (
 
 	"github.com/tailscale/wireguard-go/device"
 	"tailscale.com/envknob"
-	"tailscale.com/syncs"
-	"tailscale.com/types/key"
 	"tailscale.com/types/logger"
-	"tailscale.com/wgengine/wgcfg"
+	"tailscale.com/util/mak"
 )
 
 // A Logger is a wireguard-go log wrapper that cleans up and rewrites log lines.
-// It can be modified at run time to adjust to new wireguard-go configurations.
+// It rewrites wireguard-go peer references like "peer(XXXX…YYYY)" into the
+// Tailscale-conventional short string form like "[XXXXX]".
 type Logger struct {
 	DeviceLogger *device.Logger
-	replace      syncs.AtomicValue[map[string]string]
-	mu           sync.Mutex                   // protects strs
-	strs         map[key.NodePublic]*strCache // cached strs used to populate replace
-}
 
-// strCache holds a wireguard-go and a Tailscale style peer string.
-type strCache struct {
-	wg, ts string
-	used   bool // track whether this strCache was used in a particular round
+	// lookup, when non-nil, returns the Tailscale-conventional short
+	// string for a wireguard-go-formatted peer string (e.g. it maps
+	// "peer(IMTB…r7lM)" to "[IMTBr]"), or "", false if no peer matches.
+	// It is set once at construction and not changed afterwards.
+	lookup func(wgString string) (tsString string, ok bool)
+
+	mu sync.Mutex // protects cache
+
+	// cache memoizes lookup results. The key is the wireguard-go
+	// peer-string form ("peer(XXXX…YYYY)") and the value is the
+	// Tailscale-conventional short-string form ("[XXXXX]").
+	// It is cleared in bulk by Invalidate when the underlying peer set
+	// may have changed.
+	cache map[string]string
 }
 
 // NewLogger creates a new logger for use with wireguard-go.
 // This logger silences repetitive/unhelpful noisy log lines
 // and rewrites peer keys from wireguard-go into Tailscale format.
-func NewLogger(logf logger.Logf) *Logger {
+//
+// lookup, if non-nil, is consulted on cache misses to translate
+// wireguard-go peer references in log lines. If lookup is nil,
+// peer references are passed through unchanged.
+func NewLogger(logf logger.Logf, lookup func(wgString string) (tsString string, ok bool)) *Logger {
 	const prefix = "wg: "
-	ret := new(Logger)
+	ret := &Logger{lookup: lookup}
 	wrapper := func(format string, args ...any) {
 		if strings.Contains(format, "Routine:") && !strings.Contains(format, "receive incoming") {
 			// wireguard-go logs as it starts and stops routines.
@@ -60,32 +69,37 @@ func NewLogger(logf logger.Logf) *Logger {
 			// useful.
 			return
 		}
-		replace := ret.replace.Load()
-		if replace == nil {
-			// No replacements specified; log as originally planned.
+		if ret.lookup == nil {
+			// No lookup; log as originally planned.
 			logf(format, args...)
 			return
 		}
-		// Duplicate the args slice so that we can modify it.
-		// This is not always required, but the code required to avoid it is not worth the complexity.
-		newargs := make([]any, len(args))
-		copy(newargs, args)
-		for i, arg := range newargs {
-			// We want to replace *device.Peer args with the Tailscale-formatted version of themselves.
-			// Using *device.Peer directly makes this hard to test, so we string any fmt.Stringers,
-			// and if the string ends up looking exactly like a known Peer, we replace it.
-			// This is slightly imprecise, in that we don't check the formatting verb. Oh well.
+		// Replace any *device.Peer-shaped fmt.Stringer args with the
+		// Tailscale-formatted version of themselves. Using *device.Peer
+		// directly makes this hard to test, so we string any fmt.Stringers,
+		// and if the string ends up matching a known peer, we substitute.
+		// This is slightly imprecise, in that we don't check the formatting
+		// verb. Oh well.
+		var newargs []any
+		for i, arg := range args {
 			s, ok := arg.(fmt.Stringer)
 			if !ok {
 				continue
 			}
-			wgStr := s.String()
-			tsStr, ok := replace[wgStr]
+			tsStr, ok := ret.peerStringFor(s.String())
 			if !ok {
 				continue
 			}
+			if newargs == nil {
+				newargs = make([]any, len(args))
+				copy(newargs, args)
+			}
 			newargs[i] = tsStr
 		}
+		if newargs == nil {
+			logf(format, args...)
+			return
+		}
 		logf(format, newargs...)
 	}
 	if envknob.Bool("TS_DEBUG_RAW_WGLOG") {
@@ -95,36 +109,51 @@ func NewLogger(logf logger.Logf) *Logger {
 		Verbosef: logger.WithPrefix(wrapper, prefix+"[v2] "),
 		Errorf:   logger.WithPrefix(wrapper, prefix),
 	}
-	ret.strs = make(map[key.NodePublic]*strCache)
 	return ret
 }
 
-// SetPeers adjusts x to rewrite the peer public keys found in peers.
-// SetPeers is safe for concurrent use.
-func (x *Logger) SetPeers(peers []wgcfg.Peer) {
+// peerStringFor returns the Tailscale-conventional short string for
+// wgString, if wgString is a wireguard-go-formatted peer string for a
+// peer known to x.lookup. Results are memoized in x.cache for
+// subsequent log lines.
+func (x *Logger) peerStringFor(wgString string) (tsString string, ok bool) {
+	// Fast path: only strings shaped like wireguard-go's
+	// "peer(XXXX…YYYY)" output can be peer references; skip the cache
+	// and lookup call for anything else (e.g. arbitrary stringers used
+	// in unrelated log args).
+	if !strings.HasPrefix(wgString, "peer(") || !strings.HasSuffix(wgString, ")") {
+		return "", false
+	}
 	x.mu.Lock()
-	defer x.mu.Unlock()
-	// Construct a new peer public key log rewriter.
-	replace := make(map[string]string)
-	for _, peer := range peers {
-		c, ok := x.strs[peer.PublicKey] // look up cached strs
-		if !ok {
-			wg := peer.PublicKey.WireGuardGoString()
-			ts := peer.PublicKey.ShortString()
-			c = &strCache{wg: wg, ts: ts}
-			x.strs[peer.PublicKey] = c
-		}
-		c.used = true
-		replace[c.wg] = c.ts
+	if v, ok := x.cache[wgString]; ok {
+		x.mu.Unlock()
+		return v, true
 	}
-	// Remove any unused cached strs.
-	for k, c := range x.strs {
-		if !c.used {
-			delete(x.strs, k)
-			continue
-		}
-		// Mark c as unused for next round.
-		c.used = false
+	x.mu.Unlock()
+
+	// Call lookup without x.mu held so we don't have to reason about
+	// deadlocks between x.mu and any locks lookup acquires.
+	// In the worst case, two goroutines concurrently miss the cache
+	// for the same wgString and both call lookup; the redundant call
+	// is wasted but harmless.
+	tsString, ok = x.lookup(wgString)
+	if !ok {
+		return "", false
 	}
-	x.replace.Store(replace)
+	x.mu.Lock()
+	mak.Set(&x.cache, wgString, tsString)
+	x.mu.Unlock()
+	return tsString, true
+}
+
+// Invalidate clears the peer-string rewrite cache.
+//
+// Callers should invoke Invalidate when the set of wireguard-go peers
+// has changed so that the next log line re-resolves peer references
+// against the current lookup. It is safe to call concurrently with
+// logging.
+func (x *Logger) Invalidate() {
+	x.mu.Lock()
+	clear(x.cache)
+	x.mu.Unlock()
 }
diff --git a/wgengine/wglog/wglog_test.go b/wgengine/wglog/wglog_test.go
index 2e82f9312..0eb8e4b6e 100644
--- a/wgengine/wglog/wglog_test.go
+++ b/wgengine/wglog/wglog_test.go
@@ -7,10 +7,11 @@ import (
 	"fmt"
 	"testing"
 
+	extwgconn "github.com/tailscale/wireguard-go/conn"
+	extwgdevice "github.com/tailscale/wireguard-go/device"
+	"github.com/tailscale/wireguard-go/tun/tuntest"
 	"go4.org/mem"
 	"tailscale.com/types/key"
-	"tailscale.com/types/logger"
-	"tailscale.com/wgengine/wgcfg"
 	"tailscale.com/wgengine/wglog"
 )
 
@@ -40,12 +41,19 @@ func TestLogger(t *testing.T) {
 		}
 	}
 
-	x := wglog.NewLogger(logf)
-	key, err := key.ParseNodePublicUntyped(mem.S("20c4c1ae54e1fd37cab6e9a532ca20646aff496796cc41d4519560e5e82bee53"))
+	k, err := key.ParseNodePublicUntyped(mem.S("20c4c1ae54e1fd37cab6e9a532ca20646aff496796cc41d4519560e5e82bee53"))
 	if err != nil {
 		t.Fatal(err)
 	}
-	x.SetPeers([]wgcfg.Peer{{PublicKey: key}})
+	wantWG := k.WireGuardGoString()
+	wantTS := k.ShortString()
+	lookup := func(s string) (string, bool) {
+		if s == wantWG {
+			return wantTS, true
+		}
+		return "", false
+	}
+	x := wglog.NewLogger(logf, lookup)
 
 	for _, tt := range tests {
 		if tt.omit {
@@ -69,7 +77,7 @@ func TestSuppressLogs(t *testing.T) {
 	logf := func(format string, args ...any) {
 		logs = append(logs, fmt.Sprintf(format, args...))
 	}
-	x := wglog.NewLogger(logf)
+	x := wglog.NewLogger(logf, nil)
 	x.DeviceLogger.Verbosef("pass")
 	x.DeviceLogger.Verbosef("UAPI: Adding allowedip")
 
@@ -81,6 +89,35 @@ func TestSuppressLogs(t *testing.T) {
 	}
 }
 
+// TestWireGuardGoStringMatchesWireGuardGo guards against a wireguard-go bump
+// silently changing the wireguard-go peer-string format from under us. The
+// LocalBackend's nodeByWGString index is built using
+// [key.NodePublic.WireGuardGoString]; if wireguard-go's *device.Peer.String
+// were to drift, the index would quietly stop matching and wglog would no
+// longer translate peer references in log lines.
+func TestWireGuardGoStringMatchesWireGuardGo(t *testing.T) {
+	var raw [32]byte
+	for i := range raw {
+		raw[i] = byte(i + 1)
+	}
+	nodeKey := key.NodePublicFromRaw32(mem.B(raw[:]))
+
+	dev := extwgdevice.NewDevice(
+		tuntest.NewChannelTUN().TUN(),
+		extwgconn.NewDefaultBind(),
+		extwgdevice.NewLogger(extwgdevice.LogLevelError, ""),
+	)
+	t.Cleanup(dev.Close)
+	peer, err := dev.NewPeer(extwgdevice.NoisePublicKey(raw))
+	if err != nil {
+		t.Fatalf("NewPeer: %v", err)
+	}
+
+	if got, want := nodeKey.WireGuardGoString(), peer.String(); got != want {
+		t.Errorf("NodePublic.WireGuardGoString() = %q, want wireguard-go *device.Peer.String() = %q", got, want)
+	}
+}
+
 func stringer(s string) stringerString {
 	return stringerString(s)
 }
@@ -88,30 +125,3 @@ func stringer(s string) stringerString {
 type stringerString string
 
 func (s stringerString) String() string { return string(s) }
-
-func BenchmarkSetPeers(b *testing.B) {
-	b.ReportAllocs()
-	x := wglog.NewLogger(logger.Discard)
-	peers := [][]wgcfg.Peer{genPeers(0), genPeers(15), genPeers(16), genPeers(15)}
-	for range b.N {
-		for _, p := range peers {
-			x.SetPeers(p)
-		}
-	}
-}
-
-func genPeers(n int) []wgcfg.Peer {
-	if n > 32 {
-		panic("too many peers")
-	}
-	if n == 0 {
-		return nil
-	}
-	peers := make([]wgcfg.Peer, n)
-	for i := range peers {
-		var k [32]byte
-		k[n] = byte(n)
-		peers[i].PublicKey = key.NodePublicFromRaw32(mem.B(k[:]))
-	}
-	return peers
-}
diff --git a/words/scales.txt b/words/scales.txt
index 831011dee..64563c17f 100644
--- a/words/scales.txt
+++ b/words/scales.txt
@@ -57,7 +57,6 @@ moth
 eagle
 woodpecker
 morpho
-tautara
 anoles
 theropod
 owl
@@ -239,7 +238,6 @@ silverside
 banjo
 barb
 barbel
-bangus
 banfish
 ray
 danio
@@ -474,3 +472,41 @@ smelt
 rattlesnake
 armadillo
 bonytongue
+flops
+skink
+gharial
+viper
+adder
+taipan
+slowworm
+sturgeon
+krait
+copperhead
+bushmaster
+sidewinder
+kingsnake
+draco
+terrapin
+loggerhead
+hawksbill
+grouper
+wrasse
+parrotfish
+triggerfish
+tench
+shiner
+pantone
+rainbow
+munsell
+werner
+hue
+saturation
+gamut
+chroma
+tint
+shade
+luma
+spectrum
+roygbiv
+pride
+cat
diff --git a/words/tails.txt b/words/tails.txt
index 9b5ae2ca9..684afb651 100644
--- a/words/tails.txt
+++ b/words/tails.txt
@@ -453,7 +453,6 @@ silverside
 banjo
 barb
 barbel
-bangus
 batfish
 danio
 betta
@@ -799,3 +798,38 @@ komodo
 rattlesnake
 softshell
 bonytongue
+thresher
+numbat
+marten
+wolverine
+mongoose
+sugarglider
+ringtail
+bongo
+klipspringer
+chinchilla
+nutria
+muskrat
+fennec
+tarsier
+sifaka
+baboon
+mandrill
+langur
+boar
+peccary
+duiker
+dikdik
+impala
+chamois
+markhor
+roadrunner
+wagtail
+pintail
+fantail
+sawfish
+swordtail
+oarfish
+newt
+olm
+rainbow
diff --git a/words/words_test.go b/words/words_test.go
index 3547411a1..f04ae9008 100644
--- a/words/words_test.go
+++ b/words/words_test.go
@@ -4,10 +4,15 @@
 package words
 
 import (
+	"slices"
 	"strings"
 	"testing"
 )
 
+var nopes = []string{
+	"chub", "bangus", "hellbender",
+}
+
 func TestWords(t *testing.T) {
 	test := func(t *testing.T, words []string) {
 		t.Helper()
@@ -23,6 +28,9 @@ func TestWords(t *testing.T) {
 			if w == "" || strings.IndexFunc(w, nonASCIILower) != -1 {
 				t.Errorf("malformed word %q", w)
 			}
+			if slices.Contains(nopes, w) {
+				t.Errorf("word %q has been previously rejected/removed and should not be added", w)
+			}
 		}
 	}
 	t.Run("tails", func(t *testing.T) { test(t, Tails()) })