diff --git a/clientupdate/clientupdate.go b/clientupdate/clientupdate.go
index c01378d0f..465187507 100644
--- a/clientupdate/clientupdate.go
+++ b/clientupdate/clientupdate.go
@@ -693,7 +693,6 @@ const (
 var (
 	verifyAuthenticode          func(string) error // or nil on non-Windows
 	markTempFileFunc            func(string) error // or nil on non-Windows
-	launchTailscaleAsWinGUIUser func(string) error // or nil on non-Windows
 )
 
 func (up *Updater) updateWindows() error {
@@ -713,16 +712,6 @@ func (up *Updater) updateWindows() error {
 			up.Logf("MSI install failed: %v", err)
 			return err
 		}
-		up.Logf("relaunching tailscale-ipn.exe...")
-		exePath := os.Getenv(winExePathEnv)
-		if exePath == "" {
-			up.Logf("env var %q not passed to installer binary copy", winExePathEnv)
-			return fmt.Errorf("env var %q not passed to installer binary copy", winExePathEnv)
-		}
-		if err := launchTailscaleAsWinGUIUser(exePath); err != nil {
-			up.Logf("Failed to re-launch tailscale after update: %v", err)
-			return err
-		}
 
 		up.Logf("success.")
 		return nil
@@ -820,9 +809,7 @@ func (up *Updater) switchOutputToFile() (io.Closer, error) {
 func (up *Updater) installMSI(msi string) error {
 	var err error
 	for tries := 0; tries < 2; tries++ {
-		// TS_NOLAUNCH: don't automatically launch the app after install.
-		// We will launch it explicitly as the current GUI user afterwards.
-		cmd := exec.Command("msiexec.exe", "/i", filepath.Base(msi), "/quiet", "/promptrestart", "/qn", "TS_NOLAUNCH=true")
+		cmd := exec.Command("msiexec.exe", "/i", filepath.Base(msi), "/quiet", "/promptrestart", "/qn")
 		cmd.Dir = filepath.Dir(msi)
 		cmd.Stdout = up.Stdout
 		cmd.Stderr = up.Stderr
diff --git a/clientupdate/clientupdate_windows.go b/clientupdate/clientupdate_windows.go
index ef21cf05d..2f6899a60 100644
--- a/clientupdate/clientupdate_windows.go
+++ b/clientupdate/clientupdate_windows.go
@@ -7,14 +7,6 @@
 package clientupdate
 
 import (
-	"errors"
-	"fmt"
-	"os/exec"
-	"os/user"
-	"path/filepath"
-	"syscall"
-	"unsafe"
-
 	"golang.org/x/sys/windows"
 	"tailscale.com/util/winutil/authenticode"
 )
@@ -22,7 +14,6 @@ import (
 func init() {
 	markTempFileFunc = markTempFileWindows
 	verifyAuthenticode = verifyTailscale
-	launchTailscaleAsWinGUIUser = launchTailscaleAsGUIUser
 }
 
 func markTempFileWindows(name string) error {
@@ -35,50 +26,3 @@ const certSubjectTailscale = "Tailscale Inc."
 func verifyTailscale(path string) error {
 	return authenticode.Verify(path, certSubjectTailscale)
 }
-
-func launchTailscaleAsGUIUser(exePath string) error {
-	exePath = filepath.Join(filepath.Dir(exePath), "tailscale-ipn.exe")
-
-	var token windows.Token
-	if u, err := user.Current(); err == nil && u.Name == "SYSTEM" {
-		sessionID, err := wtsGetActiveSessionID()
-		if err != nil {
-			return fmt.Errorf("wtsGetActiveSessionID(): %w", err)
-		}
-		if err := windows.WTSQueryUserToken(sessionID, &token); err != nil {
-			return fmt.Errorf("WTSQueryUserToken (0x%x): %w", sessionID, err)
-		}
-		defer token.Close()
-	}
-
-	cmd := exec.Command(exePath)
-	cmd.SysProcAttr = &syscall.SysProcAttr{
-		Token:      syscall.Token(token),
-		HideWindow: true,
-	}
-	return cmd.Start()
-}
-
-func wtsGetActiveSessionID() (uint32, error) {
-	var (
-		sessionInfo *windows.WTS_SESSION_INFO
-		count       uint32 = 0
-	)
-
-	const WTS_CURRENT_SERVER_HANDLE = 0
-	if err := windows.WTSEnumerateSessions(WTS_CURRENT_SERVER_HANDLE, 0, 1, &sessionInfo, &count); err != nil {
-		return 0, fmt.Errorf("WTSEnumerateSessions: %w", err)
-	}
-	defer windows.WTSFreeMemory(uintptr(unsafe.Pointer(sessionInfo)))
-
-	current := unsafe.Pointer(sessionInfo)
-	for i := uint32(0); i < count; i++ {
-		session := (*windows.WTS_SESSION_INFO)(current)
-		if session.State == windows.WTSActive {
-			return session.SessionID, nil
-		}
-		current = unsafe.Add(current, unsafe.Sizeof(windows.WTS_SESSION_INFO{}))
-	}
-
-	return 0, errors.New("no active desktop sessions found")
-}
diff --git a/cmd/tailscale/depaware.txt b/cmd/tailscale/depaware.txt
index b5e4e2865..53bd2005c 100644
--- a/cmd/tailscale/depaware.txt
+++ b/cmd/tailscale/depaware.txt
@@ -76,7 +76,7 @@ tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/dep
         tailscale.com/client/tailscale                               from tailscale.com/cmd/tailscale/cli+
         tailscale.com/client/tailscale/apitype                       from tailscale.com/cmd/tailscale/cli+
         tailscale.com/client/web                                     from tailscale.com/cmd/tailscale/cli
-     💣 tailscale.com/clientupdate                                   from tailscale.com/cmd/tailscale/cli+
+        tailscale.com/clientupdate                                   from tailscale.com/cmd/tailscale/cli+
         tailscale.com/clientupdate/distsign                          from tailscale.com/clientupdate
         tailscale.com/cmd/tailscale/cli                              from tailscale.com/cmd/tailscale
         tailscale.com/control/controlbase                            from tailscale.com/control/controlhttp
diff --git a/cmd/tailscaled/depaware.txt b/cmd/tailscaled/depaware.txt
index 4a617aa13..9d6fb9d42 100644
--- a/cmd/tailscaled/depaware.txt
+++ b/cmd/tailscaled/depaware.txt
@@ -228,7 +228,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com/client/tailscale                               from tailscale.com/derp+
         tailscale.com/client/tailscale/apitype                       from tailscale.com/ipn/ipnlocal+
         tailscale.com/client/web                                     from tailscale.com/ipn/ipnlocal
-     💣 tailscale.com/clientupdate                                   from tailscale.com/ipn/ipnlocal+
+        tailscale.com/clientupdate                                   from tailscale.com/ipn/ipnlocal+
         tailscale.com/clientupdate/distsign                          from tailscale.com/clientupdate
         tailscale.com/cmd/tailscaled/childproc                       from tailscale.com/ssh/tailssh+
         tailscale.com/control/controlbase                            from tailscale.com/control/controlclient+