diff --git a/cmd/tailscaled/depaware.txt b/cmd/tailscaled/depaware.txt
index 9d7b4566a..645453a86 100644
--- a/cmd/tailscaled/depaware.txt
+++ b/cmd/tailscaled/depaware.txt
@@ -88,8 +88,6 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
    L    github.com/mdlayher/sdnotify                                 from tailscale.com/util/systemd
    L 💣 github.com/mdlayher/socket                                   from github.com/mdlayher/netlink
      💣 github.com/mitchellh/go-ps                                   from tailscale.com/safesocket
-   W    github.com/pkg/errors                                        from github.com/tailscale/certstore
-   W 💣 github.com/tailscale/certstore                               from tailscale.com/control/controlclient
         github.com/tailscale/goupnp                                  from github.com/tailscale/goupnp/dcps/internetgateway2+
         github.com/tailscale/goupnp/dcps/internetgateway2            from tailscale.com/net/portmapper
         github.com/tailscale/goupnp/httpu                            from github.com/tailscale/goupnp+
diff --git a/control/controlclient/sign_supported.go b/control/controlclient/sign_supported.go
index 3c51126a2..2d628fd23 100644
--- a/control/controlclient/sign_supported.go
+++ b/control/controlclient/sign_supported.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build windows && cgo
-// +build windows,cgo
+//go:build windows && cgo && tailscale_go
+// +build windows,cgo,tailscale_go
 
 // darwin,cgo is also supported by certstore but machineCertificateSubject will
 // need to be loaded by a different mechanism, so this is not currently enabled
diff --git a/control/controlclient/sign_supported_test.go b/control/controlclient/sign_supported_test.go
index c196cbb44..2055cb3f9 100644
--- a/control/controlclient/sign_supported_test.go
+++ b/control/controlclient/sign_supported_test.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build windows && cgo
-// +build windows,cgo
+//go:build windows && cgo && tailscale_go
+// +build windows,cgo,tailscale_go
 
 package controlclient
 
diff --git a/control/controlclient/sign_unsupported.go b/control/controlclient/sign_unsupported.go
index 936806557..6f7c4b4b2 100644
--- a/control/controlclient/sign_unsupported.go
+++ b/control/controlclient/sign_unsupported.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build !windows || !cgo
-// +build !windows !cgo
+//go:build !windows || !cgo || !tailscale_go
+// +build !windows !cgo !tailscale_go
 
 package controlclient