diff --git a/cmd/tailscale/ipn.go b/cmd/tailscale/ipn.go
index f79f56834..de8209ee5 100644
--- a/cmd/tailscale/ipn.go
+++ b/cmd/tailscale/ipn.go
@@ -20,7 +20,6 @@
 	"github.com/apenwarr/fixconsole"
 	"github.com/pborman/getopt/v2"
 	"tailscale.com/atomicfile"
-	"tailscale.com/control/controlclient"
 	"tailscale.com/ipn"
 	"tailscale.com/logpolicy"
 	"tailscale.com/safesocket"
@@ -46,7 +45,6 @@ func main() {
 	}
 	config := getopt.StringLong("config", 'f', "", "path to config file")
 	server := getopt.StringLong("server", 's', "https://login.tailscale.com", "URL to tailcontrol server")
-	alwaysrefresh := getopt.BoolLong("always-refresh", 0, "force key refresh at startup")
 	nuroutes := getopt.BoolLong("no-single-routes", 'N', "disallow (non-subnet) routes to single nodes")
 	rroutes := getopt.BoolLong("remote-routes", 'R', "allow routing subnets to remote nodes")
 	droutes := getopt.BoolLong("default-routes", 'D', "allow default route on remote node")
@@ -82,10 +80,6 @@ func main() {
 	}
 
 	ctx, cancel := context.WithCancel(context.Background())
-	lf := controlclient.LoginDefault
-	if *alwaysrefresh {
-		lf |= controlclient.LoginInteractive
-	}
 
 	go func() {
 		interrupt := make(chan os.Signal, 1)
@@ -96,9 +90,8 @@ func main() {
 
 	bc := ipn.NewBackendClient(log.Printf, clientToServer)
 	opts := ipn.Options{
-		Prefs:      prefs,
-		ServerURL:  *server,
-		LoginFlags: lf,
+		Prefs:     prefs,
+		ServerURL: *server,
 		Notify: func(n ipn.Notify) {
 			log.Printf("Notify: %v\n", n)
 			if n.ErrMessage != nil {
diff --git a/ipn/backend.go b/ipn/backend.go
index 7b0a35e12..245b70a6b 100644
--- a/ipn/backend.go
+++ b/ipn/backend.go
@@ -5,10 +5,11 @@
 package ipn
 
 import (
+	"time"
+
 	"tailscale.com/control/controlclient"
 	"tailscale.com/tailcfg"
 	"tailscale.com/wgengine"
-	"time"
 )
 
 type State int
@@ -53,7 +54,6 @@ type Options struct {
 	FrontendLogID string // public logtail id used by frontend
 	ServerURL     string
 	Prefs         Prefs
-	LoginFlags    controlclient.LoginFlags
 	Notify        func(n Notify) `json:"-"`
 }
 
diff --git a/ipn/e2e_test.go b/ipn/e2e_test.go
index 1bd54915a..dedc0c051 100644
--- a/ipn/e2e_test.go
+++ b/ipn/e2e_test.go
@@ -177,7 +177,6 @@ func newNode(t *testing.T, prefix string, https *httptest.Server) testNode {
 			WantRunning:      true,
 			Persist:          &c,
 		},
-		LoginFlags: controlclient.LoginDefault,
 		Notify: func(n Notify) {
 			// Automatically visit auth URLs
 			if n.BrowseToURL != nil {
diff --git a/ipn/local.go b/ipn/local.go
index 8b73d155d..92dcf5e85 100644
--- a/ipn/local.go
+++ b/ipn/local.go
@@ -253,7 +253,7 @@ func (b *LocalBackend) Start(opts Options) error {
 	b.logf("Backend: logs: be:%v fe:%v\n", blid, opts.FrontendLogID)
 	b.send(Notify{BackendLogID: &blid})
 
-	cli.Login(nil, opts.LoginFlags)
+	cli.Login(nil, controlclient.LoginDefault)
 	return nil
 }