diff --git a/build_docker.sh b/build_docker.sh
index 8c134fbc5..16753da77 100755
--- a/build_docker.sh
+++ b/build_docker.sh
@@ -49,6 +49,7 @@ case "$TARGET" in
         -X tailscale.com/version.gitCommitStamp=${VERSION_GIT_HASH}" \
       --base="${BASE}" \
       --tags="${TAGS}" \
+      --gotags="ts_kube" \
       --repos="${REPOS}" \
       --push="${PUSH}" \
       --target="${PLATFORM}" \
diff --git a/ipn/store/store_aws.go b/ipn/store/store_aws.go
new file mode 100644
index 000000000..e164f9de7
--- /dev/null
+++ b/ipn/store/store_aws.go
@@ -0,0 +1,18 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build (ts_aws || (linux && (arm64 || amd64))) && !ts_omit_aws
+
+package store
+
+import (
+	"tailscale.com/ipn/store/awsstore"
+)
+
+func init() {
+	registerAvailableExternalStores = append(registerAvailableExternalStores, registerAWSStore)
+}
+
+func registerAWSStore() {
+	Register("arn:", awsstore.New)
+}
diff --git a/ipn/store/stores_linux.go b/ipn/store/store_kube.go
similarity index 67%
rename from ipn/store/stores_linux.go
rename to ipn/store/store_kube.go
index 2e26de2df..8941620f6 100644
--- a/ipn/store/stores_linux.go
+++ b/ipn/store/store_kube.go
@@ -1,25 +1,25 @@
 // Copyright (c) Tailscale Inc & AUTHORS
 // SPDX-License-Identifier: BSD-3-Clause
 
+//go:build (ts_kube || (linux && (arm64 || amd64))) && !ts_omit_kube
+
 package store
 
 import (
 	"strings"
 
 	"tailscale.com/ipn"
-	"tailscale.com/ipn/store/awsstore"
 	"tailscale.com/ipn/store/kubestore"
 	"tailscale.com/types/logger"
 )
 
 func init() {
-	registerAvailableExternalStores = registerExternalStores
+	registerAvailableExternalStores = append(registerAvailableExternalStores, registerKubeStore)
 }
 
-func registerExternalStores() {
+func registerKubeStore() {
 	Register("kube:", func(logf logger.Logf, path string) (ipn.StateStore, error) {
 		secretName := strings.TrimPrefix(path, "kube:")
 		return kubestore.New(logf, secretName)
 	})
-	Register("arn:", awsstore.New)
 }
diff --git a/ipn/store/stores.go b/ipn/store/stores.go
index 8bf3a24b0..1a87fc548 100644
--- a/ipn/store/stores.go
+++ b/ipn/store/stores.go
@@ -28,13 +28,13 @@ type Provider func(logf logger.Logf, arg string) (ipn.StateStore, error)
 
 var regOnce sync.Once
 
-var registerAvailableExternalStores func()
+var registerAvailableExternalStores []func()
 
 func registerDefaultStores() {
 	Register("mem:", mem.New)
 
-	if registerAvailableExternalStores != nil {
-		registerAvailableExternalStores()
+	for _, f := range registerAvailableExternalStores {
+		f()
 	}
 }