diff --git a/control/controlclient/direct.go b/control/controlclient/direct.go
index 1fefc391f..83a666c84 100644
--- a/control/controlclient/direct.go
+++ b/control/controlclient/direct.go
@@ -34,6 +34,7 @@
 	"tailscale.com/hostinfo"
 	"tailscale.com/ipn/ipnstate"
 	"tailscale.com/log/logheap"
+	"tailscale.com/logtail"
 	"tailscale.com/net/dnscache"
 	"tailscale.com/net/dnsfallback"
 	"tailscale.com/net/interfaces"
@@ -895,6 +896,9 @@ func (c *Direct) sendMapRequest(ctx context.Context, maxPolls int, cb func(*netm
 				c.logf("exiting process with status %v per controlplane", *code)
 				os.Exit(*code)
 			}
+			if resp.Debug.DisableLogTail {
+				logtail.Disable()
+			}
 			if resp.Debug.LogHeapPprof {
 				go logheap.LogHeap(resp.Debug.LogHeapURL)
 			}
diff --git a/logtail/logtail.go b/logtail/logtail.go
index e1c8f8863..9e7a26805 100644
--- a/logtail/logtail.go
+++ b/logtail/logtail.go
@@ -20,6 +20,7 @@
 
 	"tailscale.com/logtail/backoff"
 	"tailscale.com/net/interfaces"
+	"tailscale.com/syncs"
 	tslogger "tailscale.com/types/logger"
 	"tailscale.com/wgengine/monitor"
 )
@@ -412,7 +413,18 @@ func (l *Logger) Flush() error {
 	return nil
 }
 
+// logtailDisabled is whether logtail uploads to logcatcher are disabled.
+var logtailDisabled syncs.AtomicBool
+
+// Disable disables logtail uploads for the lifetime of the process.
+func Disable() {
+	logtailDisabled.Set(true)
+}
+
 func (l *Logger) send(jsonBlob []byte) (int, error) {
+	if logtailDisabled.Get() {
+		return len(jsonBlob), nil
+	}
 	n, err := l.buffer.Write(jsonBlob)
 	if l.drainLogs == nil {
 		select {
diff --git a/tailcfg/tailcfg.go b/tailcfg/tailcfg.go
index 6c32afe43..13a9a6b38 100644
--- a/tailcfg/tailcfg.go
+++ b/tailcfg/tailcfg.go
@@ -1458,6 +1458,10 @@ type Debug struct {
 	// new attempts at UPnP connections.
 	DisableUPnP opt.Bool `json:",omitempty"`
 
+	// DisableLogTail disables the logtail package. Once disabled it can't be
+	// re-enabled for the lifetime of the process.
+	DisableLogTail bool `json:",omitempty"`
+
 	// Exit optionally specifies that the client should os.Exit
 	// with this code.
 	Exit *int `json:",omitempty"`