diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 2d1795668..313ce609f 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -161,7 +161,6 @@ jobs:
       if: matrix.buildflags == '' # skip on race builder
       working-directory: src
       run: |
-        export TS_USE_TOOLCHAIN=1
         ./build_dist.sh --extra-small ./cmd/tailscaled
         ./build_dist.sh --box ./cmd/tailscaled
         ./build_dist.sh --extra-small --box ./cmd/tailscaled
diff --git a/tool/gocross/gocross-wrapper.sh b/tool/gocross/gocross-wrapper.sh
index 366011fef..90f308eb5 100755
--- a/tool/gocross/gocross-wrapper.sh
+++ b/tool/gocross/gocross-wrapper.sh
@@ -3,8 +3,11 @@
 # SPDX-License-Identifier: BSD-3-Clause
 #
 # gocross-wrapper.sh is a wrapper that can be aliased to 'go', which
-# transparently builds gocross using a "bootstrap" Go toolchain, and
-# then invokes gocross.
+# transparently runs the version of github.com/tailscale/go as specified repo's
+# go.toolchain.rev file.
+#
+# It also conditionally (if TS_USE_GOCROSS=1) builds gocross and uses it as a go
+# wrapper to inject certain go flags.
 
 set -euo pipefail
 
@@ -76,6 +79,14 @@ case "$REV" in
     ;;
 esac
 
+# gocross is opt-in as of 2025-06-16. See tailscale/corp#26717.
+# It's primarily used for xcode builds, and a bit still for Windows.
+# In the past we needed it for git version stamping on Linux etc, but
+# Go does that itself nowadays.
+if [ "${TS_USE_GOCROSS:-}" != "1" ]; then
+    exit 0 # out of subshell
+fi
+
 if [[ -d "$toolchain" ]]; then
     # A toolchain exists, but is it recent enough to compile gocross? If not,
     # wipe it out so that the next if block fetches a usable one.
@@ -119,4 +130,23 @@ if [[ "$gocross_ok" == "0" ]]; then
 fi
 ) # End of the subshell execution.
 
-exec "${BASH_SOURCE%/*}/../../gocross" "$@"
+repo_root="${BASH_SOURCE%/*}/../.."
+
+# gocross is opt-in as of 2025-06-16. See tailscale/corp#26717
+# and comment above in this file.
+if [ "${TS_USE_GOCROSS:-}" != "1" ]; then
+    read -r REV <"${repo_root}/go.toolchain.rev"
+    case "$REV" in
+    /*)
+        toolchain="$REV"
+        ;;
+    *)
+        # If the prior subshell completed successfully, this toolchain location
+        # should be valid at this point.
+        toolchain="$HOME/.cache/tsgo/$REV"
+        ;;
+    esac
+    exec "$toolchain/bin/go" "$@"
+fi
+
+exec "${repo_root}/gocross" "$@"
diff --git a/tool/gocross/gocross_wrapper_test.go b/tool/gocross/gocross_wrapper_test.go
index 2b0f016a2..f4dcec429 100644
--- a/tool/gocross/gocross_wrapper_test.go
+++ b/tool/gocross/gocross_wrapper_test.go
@@ -15,7 +15,7 @@ import (
 func TestGocrossWrapper(t *testing.T) {
 	for i := range 2 { // once to build gocross; second to test it's cached
 		cmd := exec.Command("./gocross-wrapper.sh", "version")
-		cmd.Env = append(os.Environ(), "CI=true", "NOBASHDEBUG=false") // for "set -x" verbosity
+		cmd.Env = append(os.Environ(), "CI=true", "NOBASHDEBUG=false", "TS_USE_GOCROSS=1") // for "set -x" verbosity
 		out, err := cmd.CombinedOutput()
 		if err != nil {
 			t.Fatalf("gocross-wrapper.sh failed: %v\n%s", err, out)
diff --git a/version/print.go b/version/print.go
index be90432cc..43ee2b559 100644
--- a/version/print.go
+++ b/version/print.go
@@ -20,6 +20,7 @@ var stringLazy = sync.OnceValue(func() string {
 	if gitCommit() != "" {
 		fmt.Fprintf(&ret, "  tailscale commit: %s%s\n", gitCommit(), dirtyString())
 	}
+	fmt.Fprintf(&ret, "  long version: %s\n", Long())
 	if extraGitCommitStamp != "" {
 		fmt.Fprintf(&ret, "  other commit: %s\n", extraGitCommitStamp)
 	}