diff --git a/ipn/ipnlocal/peerapi_h2c.go b/ipn/ipnlocal/peerapi_h2c.go
index 3888db8d9..39c9199ec 100644
--- a/ipn/ipnlocal/peerapi_h2c.go
+++ b/ipn/ipnlocal/peerapi_h2c.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build !ios && !android
-// +build !ios,!android
+//go:build !ios && !android && !js
+// +build !ios,!android,!js
 
 package ipnlocal
 
diff --git a/ipn/localapi/cert.go b/ipn/localapi/cert.go
index a2506f173..26eb3650f 100644
--- a/ipn/localapi/cert.go
+++ b/ipn/localapi/cert.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build !ios && !android
-// +build !ios,!android
+//go:build !ios && !android && !js
+// +build !ios,!android,!js
 
 package localapi
 
diff --git a/ipn/localapi/disabled_stubs.go b/ipn/localapi/disabled_stubs.go
index 3538b22e5..6aa19b316 100644
--- a/ipn/localapi/disabled_stubs.go
+++ b/ipn/localapi/disabled_stubs.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build ios || android
-// +build ios android
+//go:build ios || android || js
+// +build ios android js
 
 package localapi
 
diff --git a/ipn/localapi/profile.go b/ipn/localapi/profile.go
index 7780f7126..0dd61d1c9 100644
--- a/ipn/localapi/profile.go
+++ b/ipn/localapi/profile.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build !ios && !android
-// +build !ios,!android
+//go:build !ios && !android && !js
+// +build !ios,!android,!js
 
 // We don't include it on mobile where we're more memory constrained and
 // there's no CLI to get at the results anyway.
diff --git a/net/netns/socks.go b/net/netns/socks.go
index e2f7f19fd..c64253d28 100644
--- a/net/netns/socks.go
+++ b/net/netns/socks.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build !ios
-// +build !ios
+//go:build !ios && !js
+// +build !ios,!js
 
 package netns
 
diff --git a/net/portmapper/disabled_stubs.go b/net/portmapper/disabled_stubs.go
index 097424b3e..d940f3de0 100644
--- a/net/portmapper/disabled_stubs.go
+++ b/net/portmapper/disabled_stubs.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build ios
-// +build ios
+//go:build ios || js
+// +build ios js
 
 // (https://github.com/tailscale/tailscale/issues/2495)
 
diff --git a/net/portmapper/upnp.go b/net/portmapper/upnp.go
index 54cb8a211..c886ee344 100644
--- a/net/portmapper/upnp.go
+++ b/net/portmapper/upnp.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build !ios
-// +build !ios
+//go:build !ios && !js
+// +build !ios,!js
 
 // (https://github.com/tailscale/tailscale/issues/2495)
 
diff --git a/portlist/netstat.go b/portlist/netstat.go
index c88641746..9951f0252 100644
--- a/portlist/netstat.go
+++ b/portlist/netstat.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build !ios
-// +build !ios
+//go:build !ios && !js
+// +build !ios,!js
 
 package portlist
 
diff --git a/portlist/netstat_exec.go b/portlist/netstat_exec.go
index 77972d980..0a9911a01 100644
--- a/portlist/netstat_exec.go
+++ b/portlist/netstat_exec.go
@@ -2,9 +2,10 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build (windows || freebsd || openbsd || darwin) && !ios
+//go:build (windows || freebsd || openbsd || darwin) && !ios && !js
 // +build windows freebsd openbsd darwin
 // +build !ios
+// +build !js
 
 package portlist
 
diff --git a/wgengine/magicsock/debugknobs.go b/wgengine/magicsock/debugknobs.go
index dcd57a0e9..9ae40fe13 100644
--- a/wgengine/magicsock/debugknobs.go
+++ b/wgengine/magicsock/debugknobs.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build !ios
-// +build !ios
+//go:build !ios && !js
+// +build !ios,!js
 
 package magicsock
 
diff --git a/wgengine/magicsock/debugknobs_ios.go b/wgengine/magicsock/debugknobs_stubs.go
similarity index 88%
rename from wgengine/magicsock/debugknobs_ios.go
rename to wgengine/magicsock/debugknobs_stubs.go
index b20206092..47357fa3a 100644
--- a/wgengine/magicsock/debugknobs_ios.go
+++ b/wgengine/magicsock/debugknobs_stubs.go
@@ -2,11 +2,14 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build ios || js
+// +build ios js
+
 package magicsock
 
 import "tailscale.com/types/opt"
 
-// All knobs are disabled on iOS.
+// All knobs are disabled on iOS and Wasm.
 // Further, they're const, so the toolchain can produce smaller binaries.
 const (
 	debugDisco                       = false