diff --git a/go.toolchain.branch b/go.toolchain.branch
new file mode 100644
index 000000000..a575de0f2
--- /dev/null
+++ b/go.toolchain.branch
@@ -0,0 +1 @@
+tailscale.go1.17
diff --git a/pull-toolchain.sh b/pull-toolchain.sh
new file mode 100755
index 000000000..f5a19e7d7
--- /dev/null
+++ b/pull-toolchain.sh
@@ -0,0 +1,16 @@
+#!/bin/sh
+# Retrieve the latest Go toolchain.
+#
+set -eu
+cd "$(dirname "$0")"
+
+read -r go_branch <go.toolchain.branch
+upstream=$(git ls-remote https://github.com/tailscale/go "$go_branch" | awk '{print $1}')
+current=$(cat go.toolchain.rev)
+if [ "$upstream" != "$current" ]; then
+	echo "$upstream" >go.toolchain.rev
+fi
+
+if [ -n "$(git diff-index --name-only HEAD -- go.toolchain.rev)" ]; then
+    echo "pull-toolchain.sh: changes imported. Use git commit to make them permanent." >&2
+fi