diff --git a/ipn/ipnlocal/local.go b/ipn/ipnlocal/local.go
index f6f60c537..5a6bca277 100644
--- a/ipn/ipnlocal/local.go
+++ b/ipn/ipnlocal/local.go
@@ -2833,17 +2833,6 @@ func (b *LocalBackend) tryLookupUserName(uid string) string {
 	return u.Username
 }
 
-// Login implements Backend.
-// As of 2022-11-15, this is only exists for Android.
-func (b *LocalBackend) Login(token *tailcfg.Oauth2Token) {
-	b.mu.Lock()
-	b.assertClientLocked()
-	cc := b.cc
-	b.mu.Unlock()
-
-	cc.Login(token, b.loginFlags|controlclient.LoginInteractive)
-}
-
 // StartLoginInteractive implements Backend. It requests a new
 // interactive login from controlclient, unless such a flow is already
 // in progress, in which case StartLoginInteractive attempts to pick
diff --git a/ipn/ipnlocal/local_test.go b/ipn/ipnlocal/local_test.go
index e877dbd83..d5c8ab26e 100644
--- a/ipn/ipnlocal/local_test.go
+++ b/ipn/ipnlocal/local_test.go
@@ -775,7 +775,7 @@ func TestStatusWithoutPeers(t *testing.T) {
 		return cc, nil
 	})
 	b.Start(ipn.Options{})
-	b.Login(nil)
+	b.StartLoginInteractive()
 	cc.send(nil, "", false, &netmap.NetworkMap{
 		SelfNode: (&tailcfg.Node{
 			MachineAuthorized: true,
@@ -862,7 +862,7 @@ func TestStatusPeerCapabilities(t *testing.T) {
 		return cc, nil
 	})
 	b.Start(ipn.Options{})
-	b.Login(nil)
+	b.StartLoginInteractive()
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			b.setNetMapLocked(&netmap.NetworkMap{
@@ -901,8 +901,6 @@ type legacyBackend interface {
 	// flow. This should trigger a new BrowseToURL notification
 	// eventually.
 	StartLoginInteractive()
-	// Login logs in with an OAuth2 token.
-	Login(token *tailcfg.Oauth2Token)
 	// SetPrefs installs a new set of user preferences, including
 	// WantRunning. This may cause the wireguard engine to
 	// reconfigure or stop.
diff --git a/ipn/ipnlocal/state_test.go b/ipn/ipnlocal/state_test.go
index 88d449916..9ed8a2f98 100644
--- a/ipn/ipnlocal/state_test.go
+++ b/ipn/ipnlocal/state_test.go
@@ -264,6 +264,17 @@ func (cc *mockControl) UpdateEndpoints(endpoints []tailcfg.Endpoint) {
 	cc.called("UpdateEndpoints")
 }
 
+func (b *LocalBackend) nonInteractiveLoginForStateTest() {
+	b.mu.Lock()
+	if b.cc == nil {
+		panic("LocalBackend.assertClient: b.cc == nil")
+	}
+	cc := b.cc
+	b.mu.Unlock()
+
+	cc.Login(nil, b.loginFlags|controlclient.LoginInteractive)
+}
+
 // A very precise test of the sequence of function calls generated by
 // ipnlocal.Local into its controlclient instance, and the events it
 // produces upstream into the UI.
@@ -385,7 +396,7 @@ func TestStateMachine(t *testing.T) {
 	// then wait for us to respond.
 	t.Logf("\n\nLogin (noninteractive)")
 	notifies.expect(0)
-	b.Login(nil)
+	b.nonInteractiveLoginForStateTest()
 	{
 		cc.assertCalls("Login")
 		notifies.drain(0)
@@ -666,7 +677,7 @@ func TestStateMachine(t *testing.T) {
 		c.Assert(ipn.NeedsLogin, qt.Equals, b.State())
 	}
 
-	b.Login(nil)
+	b.StartLoginInteractive()
 	t.Logf("\n\nLoginFinished3")
 	notifies.expect(3)
 	cc.persist.UserProfile.LoginName = "user2"