diff --git a/cmd/netlogfmt/main.go b/cmd/netlogfmt/main.go
index 7728c94a0..0d1b1667e 100644
--- a/cmd/netlogfmt/main.go
+++ b/cmd/netlogfmt/main.go
@@ -43,7 +43,7 @@ import (
 	jsonv2 "github.com/go-json-experiment/json"
 	"golang.org/x/exp/maps"
 	"golang.org/x/exp/slices"
-	"tailscale.com/logtail"
+	"tailscale.com/types/logid"
 	"tailscale.com/types/netlogtype"
 	"tailscale.com/util/must"
 )
@@ -136,8 +136,8 @@ func processObject(dec *jsonv2.Decoder) {
 
 type message struct {
 	Logtail struct {
-		ID     logtail.PublicID `json:"id"`
-		Logged time.Time        `json:"server_time"`
+		ID     logid.PublicID `json:"id"`
+		Logged time.Time      `json:"server_time"`
 	} `json:"logtail"`
 	Logged time.Time `json:"logged"`
 	netlogtype.Message
diff --git a/cmd/tailscaled/depaware.txt b/cmd/tailscaled/depaware.txt
index df5526364..b4235f86a 100644
--- a/cmd/tailscaled/depaware.txt
+++ b/cmd/tailscaled/depaware.txt
@@ -298,6 +298,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com/util/lineread                                  from tailscale.com/hostinfo+
         tailscale.com/util/mak                                       from tailscale.com/control/controlclient+
         tailscale.com/util/multierr                                  from tailscale.com/control/controlclient+
+        tailscale.com/util/must                                      from tailscale.com/logpolicy
         tailscale.com/util/osshare                                   from tailscale.com/ipn/ipnlocal+
    W    tailscale.com/util/pidowner                                  from tailscale.com/ipn/ipnauth
         tailscale.com/util/racebuild                                 from tailscale.com/logpolicy
diff --git a/ipn/ipnlocal/loglines_test.go b/ipn/ipnlocal/loglines_test.go
index 8e4bfdec6..55c403cc1 100644
--- a/ipn/ipnlocal/loglines_test.go
+++ b/ipn/ipnlocal/loglines_test.go
@@ -11,11 +11,11 @@ import (
 	"tailscale.com/ipn"
 	"tailscale.com/ipn/ipnstate"
 	"tailscale.com/ipn/store/mem"
-	"tailscale.com/logtail"
 	"tailscale.com/tailcfg"
 	"tailscale.com/tstest"
 	"tailscale.com/types/key"
 	"tailscale.com/types/logger"
+	"tailscale.com/types/logid"
 	"tailscale.com/types/persist"
 	"tailscale.com/wgengine"
 )
@@ -37,8 +37,8 @@ func TestLocalLogLines(t *testing.T) {
 	// This lets the logListen tracker verify that the rate-limiter allows these key lines.
 	logf := logger.RateLimitedFnWithClock(logListen.Logf, 5*time.Second, 0, 10, time.Now)
 
-	logid := func(hex byte) logtail.PublicID {
-		var ret logtail.PublicID
+	logid := func(hex byte) logid.PublicID {
+		var ret logid.PublicID
 		for i := 0; i < len(ret); i++ {
 			ret[i] = hex
 		}
diff --git a/logpolicy/logpolicy.go b/logpolicy/logpolicy.go
index 7d349c669..bbc857337 100644
--- a/logpolicy/logpolicy.go
+++ b/logpolicy/logpolicy.go
@@ -43,7 +43,9 @@ import (
 	"tailscale.com/safesocket"
 	"tailscale.com/smallzstd"
 	"tailscale.com/types/logger"
+	"tailscale.com/types/logid"
 	"tailscale.com/util/clientmetric"
+	"tailscale.com/util/must"
 	"tailscale.com/util/racebuild"
 	"tailscale.com/util/winutil"
 	"tailscale.com/version"
@@ -94,8 +96,8 @@ func LogHost() string {
 // Config represents an instance of logs in a collection.
 type Config struct {
 	Collection string
-	PrivateID  logtail.PrivateID
-	PublicID   logtail.PublicID
+	PrivateID  logid.PrivateID
+	PublicID   logid.PublicID
 }
 
 // Policy is a logger and its public ID.
@@ -103,15 +105,12 @@ type Policy struct {
 	// Logtail is the logger.
 	Logtail *logtail.Logger
 	// PublicID is the logger's instance identifier.
-	PublicID logtail.PublicID
+	PublicID logid.PublicID
 }
 
 // NewConfig creates a Config with collection and a newly generated PrivateID.
 func NewConfig(collection string) *Config {
-	id, err := logtail.NewPrivateID()
-	if err != nil {
-		panic("logtail.NewPrivateID should never fail")
-	}
+	id := must.Get(logid.NewPrivateID())
 	return &Config{
 		Collection: collection,
 		PrivateID:  id,
diff --git a/logtail/api.md b/logtail/api.md
index b2aae98ec..8ec0b69c0 100644
--- a/logtail/api.md
+++ b/logtail/api.md
@@ -125,11 +125,11 @@ The caller can query-encode the following fields:
       "collections": {
         "collection1.yourcompany.com": {
           "instances": {
-            "<logtail.PublicID>" :{
+            "<logid.PublicID>" :{
               "first-seen": "timestamp",
               "size": 4096
             },
-            "<logtail.PublicID>" :{
+            "<logid.PublicID>" :{
               "first-seen": "timestamp",
               "size": 512000,
               "orphan": true,
diff --git a/logtail/example/logreprocess/logreprocess.go b/logtail/example/logreprocess/logreprocess.go
index f2497fb41..5dbf76578 100644
--- a/logtail/example/logreprocess/logreprocess.go
+++ b/logtail/example/logreprocess/logreprocess.go
@@ -15,7 +15,7 @@ import (
 	"strings"
 	"time"
 
-	"tailscale.com/logtail"
+	"tailscale.com/types/logid"
 )
 
 func main() {
@@ -56,7 +56,7 @@ func main() {
 		log.Fatalf("logreprocess: read error %d: %s", resp.StatusCode, string(b))
 	}
 
-	tracebackCache := make(map[logtail.PublicID]*ProcessedMsg)
+	tracebackCache := make(map[logid.PublicID]*ProcessedMsg)
 
 	scanner := bufio.NewScanner(resp.Body)
 	for scanner.Scan() {
@@ -98,8 +98,8 @@ func main() {
 
 type Msg struct {
 	Logtail struct {
-		Instance   logtail.PublicID `json:"instance"`
-		ClientTime time.Time        `json:"client_time"`
+		Instance   logid.PublicID `json:"instance"`
+		ClientTime time.Time      `json:"client_time"`
 	} `json:"logtail"`
 
 	Text string `json:"text"`
@@ -110,6 +110,6 @@ type ProcessedMsg struct {
 		ClientTime time.Time `json:"client_time"`
 	} `json:"logtail"`
 
-	OrigInstance logtail.PublicID `json:"orig_instance"`
-	Text         string           `json:"text"`
+	OrigInstance logid.PublicID `json:"orig_instance"`
+	Text         string         `json:"text"`
 }
diff --git a/logtail/example/logtail/logtail.go b/logtail/example/logtail/logtail.go
index 3f2600de5..0c9e44258 100644
--- a/logtail/example/logtail/logtail.go
+++ b/logtail/example/logtail/logtail.go
@@ -12,6 +12,7 @@ import (
 	"os"
 
 	"tailscale.com/logtail"
+	"tailscale.com/types/logid"
 )
 
 func main() {
@@ -25,7 +26,7 @@ func main() {
 
 	log.SetFlags(0)
 
-	var id logtail.PrivateID
+	var id logid.PrivateID
 	if err := id.UnmarshalText([]byte(*privateID)); err != nil {
 		log.Fatalf("logtail: bad -privateid: %v", err)
 	}
diff --git a/tstest/integration/integration.go b/tstest/integration/integration.go
index 32ee4ddb8..16c31ec28 100644
--- a/tstest/integration/integration.go
+++ b/tstest/integration/integration.go
@@ -31,12 +31,12 @@ import (
 	"go4.org/mem"
 	"tailscale.com/derp"
 	"tailscale.com/derp/derphttp"
-	"tailscale.com/logtail"
 	"tailscale.com/net/stun/stuntest"
 	"tailscale.com/smallzstd"
 	"tailscale.com/tailcfg"
 	"tailscale.com/types/key"
 	"tailscale.com/types/logger"
+	"tailscale.com/types/logid"
 	"tailscale.com/types/nettype"
 	"tailscale.com/version"
 )
@@ -283,7 +283,7 @@ func (lc *LogCatcher) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	// collectionName := pathPaths[0]
-	privID, err := logtail.ParsePrivateID(pathParts[1])
+	privID, err := logid.ParsePrivateID(pathParts[1])
 	if err != nil {
 		log.Printf("bad log ID: %q: %v", r.URL.Path, err)
 	}
diff --git a/types/logid/id.go b/types/logid/id.go
index c46289d4c..b72eb0fd5 100644
--- a/types/logid/id.go
+++ b/types/logid/id.go
@@ -33,7 +33,7 @@ func NewPrivateID() (id PrivateID, err error) {
 func (id PrivateID) MarshalText() ([]byte, error) {
 	b := make([]byte, hex.EncodedLen(len(id)))
 	if i := hex.Encode(b, id[:]); i != len(b) {
-		return nil, fmt.Errorf("logtail.PrivateID.MarshalText: i=%d", i)
+		return nil, fmt.Errorf("logid.PrivateID.MarshalText: i=%d", i)
 	}
 	return b, nil
 }
@@ -61,10 +61,10 @@ func (id PrivateID) IsZero() bool { return id == PrivateID{} }
 func (id *PrivateID) UnmarshalText(s []byte) error {
 	b, err := hex.DecodeString(string(s))
 	if err != nil {
-		return fmt.Errorf("logtail.PrivateID.UnmarshalText: %v", err)
+		return fmt.Errorf("logid.PrivateID.UnmarshalText: %v", err)
 	}
 	if len(b) != len(id) {
-		return fmt.Errorf("logtail.PrivateID.UnmarshalText: invalid hex length: %d", len(b))
+		return fmt.Errorf("logid.PrivateID.UnmarshalText: invalid hex length: %d", len(b))
 	}
 	copy(id[:], b)
 	return nil
@@ -121,14 +121,14 @@ func MustParsePublicID(s string) PublicID {
 func (id PublicID) MarshalText() ([]byte, error) {
 	b := make([]byte, hex.EncodedLen(len(id)))
 	if i := hex.Encode(b, id[:]); i != len(b) {
-		return nil, fmt.Errorf("logtail.PublicID.MarshalText: i=%d", i)
+		return nil, fmt.Errorf("logid.PublicID.MarshalText: i=%d", i)
 	}
 	return b, nil
 }
 
 func (id *PublicID) UnmarshalText(s []byte) error {
 	if len(s) != len(id)*2 {
-		return fmt.Errorf("logtail.PublicID.UnmarshalText: invalid hex length: %d", len(s))
+		return fmt.Errorf("logid.PublicID.UnmarshalText: invalid hex length: %d", len(s))
 	}
 	for i := range id {
 		a, ok1 := fromHexChar(s[i*2+0])
diff --git a/wgengine/netlog/logger.go b/wgengine/netlog/logger.go
index cd7937a9d..192d46810 100644
--- a/wgengine/netlog/logger.go
+++ b/wgengine/netlog/logger.go
@@ -22,6 +22,7 @@ import (
 	"tailscale.com/net/tsaddr"
 	"tailscale.com/smallzstd"
 	"tailscale.com/tailcfg"
+	"tailscale.com/types/logid"
 	"tailscale.com/types/netlogtype"
 	"tailscale.com/util/multierr"
 	"tailscale.com/wgengine/router"
@@ -89,7 +90,7 @@ var testClient *http.Client
 // is a non-tailscale IP address to contact for that particular tailscale node.
 // The IP protocol and source port are always zero.
 // The sock is used to populated the PhysicalTraffic field in Message.
-func (nl *Logger) Startup(nodeID tailcfg.StableNodeID, nodeLogID, domainLogID logtail.PrivateID, tun, sock Device) error {
+func (nl *Logger) Startup(nodeID tailcfg.StableNodeID, nodeLogID, domainLogID logid.PrivateID, tun, sock Device) error {
 	nl.mu.Lock()
 	defer nl.mu.Unlock()
 	if nl.logger != nil {
diff --git a/wgengine/wgcfg/config.go b/wgengine/wgcfg/config.go
index 3281c166a..16b75969f 100644
--- a/wgengine/wgcfg/config.go
+++ b/wgengine/wgcfg/config.go
@@ -7,9 +7,9 @@ package wgcfg
 import (
 	"net/netip"
 
-	"tailscale.com/logtail"
 	"tailscale.com/tailcfg"
 	"tailscale.com/types/key"
+	"tailscale.com/types/logid"
 )
 
 //go:generate go run tailscale.com/cmd/cloner -type=Config,Peer
@@ -28,8 +28,8 @@ type Config struct {
 	// NetworkLogging enables network logging.
 	// It is disabled if either ID is the zero value.
 	NetworkLogging struct {
-		NodeID   logtail.PrivateID
-		DomainID logtail.PrivateID
+		NodeID   logid.PrivateID
+		DomainID logid.PrivateID
 	}
 }
 
diff --git a/wgengine/wgcfg/nmcfg/nmcfg.go b/wgengine/wgcfg/nmcfg/nmcfg.go
index be5a4be44..83640ebef 100644
--- a/wgengine/wgcfg/nmcfg/nmcfg.go
+++ b/wgengine/wgcfg/nmcfg/nmcfg.go
@@ -11,10 +11,10 @@ import (
 	"strings"
 
 	"golang.org/x/exp/slices"
-	"tailscale.com/logtail"
 	"tailscale.com/net/tsaddr"
 	"tailscale.com/tailcfg"
 	"tailscale.com/types/logger"
+	"tailscale.com/types/logid"
 	"tailscale.com/types/netmap"
 	"tailscale.com/wgengine/wgcfg"
 )
@@ -64,11 +64,11 @@ func WGCfg(nm *netmap.NetworkMap, logf logger.Logf, flags netmap.WGConfigFlags,
 		cfg.NodeID = nm.SelfNode.StableID
 		canNetworkLog := slices.Contains(nm.SelfNode.Capabilities, tailcfg.CapabilityDataPlaneAuditLogs)
 		if canNetworkLog && nm.SelfNode.DataPlaneAuditLogID != "" && nm.DomainAuditLogID != "" {
-			nodeID, errNode := logtail.ParsePrivateID(nm.SelfNode.DataPlaneAuditLogID)
+			nodeID, errNode := logid.ParsePrivateID(nm.SelfNode.DataPlaneAuditLogID)
 			if errNode != nil {
 				logf("[v1] wgcfg: unable to parse node audit log ID: %v", errNode)
 			}
-			domainID, errDomain := logtail.ParsePrivateID(nm.DomainAuditLogID)
+			domainID, errDomain := logid.ParsePrivateID(nm.DomainAuditLogID)
 			if errDomain != nil {
 				logf("[v1] wgcfg: unable to parse domain audit log ID: %v", errDomain)
 			}