diff --git a/build_dist.sh b/build_dist.sh
index 9dc879b1e..45d471be0 100755
--- a/build_dist.sh
+++ b/build_dist.sh
@@ -18,7 +18,7 @@ fi
 
 eval `CGO_ENABLED=0 GOOS=$($go env GOHOSTOS) GOARCH=$($go env GOHOSTARCH) $go run ./cmd/mkversion`
 
-if [ "$1" = "shellvars" ]; then
+if [ "$#" -ge 1 ] && [ "$1" = "shellvars" ]; then
 	cat <<EOF
 VERSION_MINOR="$VERSION_MINOR"
 VERSION_SHORT="$VERSION_SHORT"
@@ -41,7 +41,7 @@ while [ "$#" -gt 1 ]; do
 		fi
 		shift
 		ldflags="$ldflags -w -s"
-		tags="${tags:+$tags,}ts_omit_aws,ts_omit_bird,ts_omit_tap,ts_omit_kube,ts_omit_completion,ts_omit_ssh,ts_omit_wakeonlan,ts_omit_capture,ts_omit_relayserver,ts_omit_systray,ts_omit_taildrop,ts_omit_tpm,ts_omit_syspolicy,ts_omit_debugeventbus,ts_omit_webclient,ts_omit_drive"
+		tags="${tags:+$tags,},$($go run ./cmd/featuretags --min)"
 		;;
 	--box)
 		if [ ! -z "${TAGS:-}" ]; then
diff --git a/cmd/featuretags/featuretags.go b/cmd/featuretags/featuretags.go
new file mode 100644
index 000000000..c97d66c47
--- /dev/null
+++ b/cmd/featuretags/featuretags.go
@@ -0,0 +1,73 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// The featuretags command helps other build tools select Tailscale's Go build
+// tags to use.
+package main
+
+import (
+	"flag"
+	"fmt"
+	"log"
+	"maps"
+	"slices"
+	"strings"
+
+	"tailscale.com/feature/featuretags"
+)
+
+var (
+	min    = flag.Bool("min", false, "remove all features not mentioned in --add")
+	remove = flag.String("remove", "", "a comma-separated list of features to remove from the build. (without the 'ts_omit_' prefix)")
+	add    = flag.String("add", "", "a comma-separated list of features or tags to add, if --min is used.")
+	list   = flag.Bool("list", false, "if true, list all known features and what they do")
+)
+
+func main() {
+	flag.Parse()
+
+	features := featuretags.Features
+
+	if *list {
+		for _, f := range slices.Sorted(maps.Keys(features)) {
+			fmt.Printf("%20s: %s\n", f, features[f])
+		}
+		return
+	}
+
+	var keep = map[string]bool{}
+	for t := range strings.SplitSeq(*add, ",") {
+		if t != "" {
+			keep[t] = true
+		}
+	}
+	var tags []string
+	if keep["cli"] {
+		// The "cli" --add value is special in that it's a build tag
+		// that adds something, rather than removes something.
+		tags = append(tags, "ts_include_cli")
+	}
+	if *min {
+		for _, f := range slices.Sorted(maps.Keys(features)) {
+			if f == "" {
+				continue
+			}
+			if !keep[f] {
+				tags = append(tags, "ts_omit_"+f)
+			}
+		}
+	}
+	for f := range strings.SplitSeq(*remove, ",") {
+		if f == "" {
+			continue
+		}
+		if _, ok := features[f]; !ok {
+			log.Fatalf("unknown feature %q in --remove", f)
+		}
+		tags = append(tags, "ts_omit_"+f)
+	}
+	if len(tags) != 0 {
+		fmt.Println(strings.Join(tags, ","))
+	}
+
+}
diff --git a/cmd/omitsize/omitsize.go b/cmd/omitsize/omitsize.go
index d8e1a6540..bce072973 100644
--- a/cmd/omitsize/omitsize.go
+++ b/cmd/omitsize/omitsize.go
@@ -13,17 +13,16 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
-	"regexp"
 	"slices"
 	"strconv"
 	"strings"
 
-	"tailscale.com/util/must"
+	"tailscale.com/feature/featuretags"
 )
 
 var (
 	cacheDir = flag.String("cachedir", "", "if non-empty, use this directory to store cached size results to speed up subsequent runs. The tool does not consider the git status when deciding whether to use the cache. It's on you to nuke it between runs if the tree changed.")
-	features = flag.String("features", "", "comma-separated list of features to consider, with or without the ts_omit_ prefix (default: all detected in build_dist.sh)")
+	features = flag.String("features", "", "comma-separated list of features to consider, with or without the ts_omit_ prefix")
 )
 
 func main() {
@@ -31,9 +30,9 @@ func main() {
 
 	var all []string
 	if *features == "" {
-		sh := must.Get(os.ReadFile("build_dist.sh"))
-		omitRx := regexp.MustCompile(`\b(ts_omit_\w+)\b`)
-		all = omitRx.FindAllString(string(sh), -1)
+		for k := range featuretags.Features {
+			all = append(all, "ts_omit_"+k)
+		}
 	} else {
 		for v := range strings.SplitSeq(*features, ",") {
 			if !strings.HasPrefix(v, "ts_omit_") {
diff --git a/feature/featuretags/featuretags.go b/feature/featuretags/featuretags.go
new file mode 100644
index 000000000..6f87dab76
--- /dev/null
+++ b/feature/featuretags/featuretags.go
@@ -0,0 +1,27 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// The featuretags package is a registry of all the ts_omit-able build tags.
+package featuretags
+
+var Features = map[string]string{
+	"aws":              "AWS integration",
+	"bird":             "Bird BGP integration",
+	"capture":          "Packet capture",
+	"cli":              "embed the CLI into the tailscaled binary",
+	"completion":       "CLI shell completion",
+	"debugeventbus":    "eventbus debug support",
+	"desktop_sessions": "Desktop sessions support",
+	"drive":            "Tailscale Drive (file server) support",
+	"kube":             "Kubernetes integration",
+	"relayserver":      "Relay server",
+	"ssh":              "Tailscale SSH support",
+	"syspolicy":        "System policy configuration (MDM) support",
+	"systray":          "Linux system tray",
+	"taildrop":         "Taildrop (file sending) support",
+	"tap":              "Experimental Layer 2 (ethernet) support",
+	"tka":              "Tailnet Lock (TKA) support",
+	"tpm":              "TPM support",
+	"wakeonlan":        "Wake-on-LAN support",
+	"webclient":        "Web client support",
+}