diff --git a/Makefile b/Makefile
index 9373535..d6d3a41 100644
--- a/Makefile
+++ b/Makefile
@@ -156,6 +156,7 @@ $(GOBIN)/gobind: go.mod go.sum
 
 $(LIBTAILSCALE): Makefile android/libs $(shell find libtailscale -name *.go) go.mod go.sum $(GOBIN)/gomobile
 	$(GOBIN)/gomobile bind -target android -androidapi 26 \
+		-tags "$$(./build-tags.sh)" \
 		-ldflags "$(FULL_LDFLAGS)" \
 		-o $@ ./libtailscale
 
diff --git a/build-tags.sh b/build-tags.sh
new file mode 100755
index 0000000..de81fc9
--- /dev/null
+++ b/build-tags.sh
@@ -0,0 +1,16 @@
+#!/bin/bash
+
+if [[ -z "$TOOLCHAIN_DIR" ]]; then
+    # By default, if TOOLCHAIN_DIR is unset, we assume we're
+    # using the Tailscale Go toolchain (github.com/tailscale/go)
+    # at the revision specified by go.toolchain.rev. If so,
+    # we tell our caller to use the "tailscale_go" build tag.
+    echo "tailscale_go"
+else
+    # Otherwise, if TOOLCHAIN_DIR is specified, we assume
+    # we're F-Droid or something using a stock Go toolchain.
+    # That's fine. But we don't set the tailscale_go build tag.
+    # Return some no-op build tag that's non-empty for clarity
+    # when debugging.
+    echo "not_tailscale_go"
+fi