diff --git a/client/web/src/hooks/node-data.ts b/client/web/src/hooks/node-data.ts
index c1dfee607..991ccba60 100644
--- a/client/web/src/hooks/node-data.ts
+++ b/client/web/src/hooks/node-data.ts
@@ -28,8 +28,6 @@ export type NodeData = {
   IsTagged: boolean
   Tags: string[]
   RunningSSHServer: boolean
-
-  DebugMode: "" | "login" | "full" // empty when not running in any debug mode
 }
 
 type NodeState =
diff --git a/client/web/web.go b/client/web/web.go
index fc98ba747..c4cd78995 100644
--- a/client/web/web.go
+++ b/client/web/web.go
@@ -92,10 +92,6 @@ const (
 	// the source's Tailscale identity. If the source browser does not have
 	// a valid session, a readonly version of the app is displayed.
 	ManageServerMode ServerMode = "manage"
-
-	// LegacyServerMode serves the legacy web client, visible to users
-	// prior to release of tailscale/corp#14335.
-	LegacyServerMode ServerMode = "legacy"
 )
 
 var (
@@ -133,7 +129,7 @@ type ServerOpts struct {
 // and not the lifespan of the web server.
 func NewServer(opts ServerOpts) (s *Server, err error) {
 	switch opts.Mode {
-	case LoginServerMode, ManageServerMode, LegacyServerMode:
+	case LoginServerMode, ManageServerMode:
 		// valid types
 	case "":
 		return nil, fmt.Errorf("must specify a Mode")
@@ -544,8 +540,6 @@ type nodeData struct {
 	ClientVersion *tailcfg.ClientVersion
 
 	LicensesURL string
-
-	DebugMode string // empty when not running in any debug mode
 }
 
 func (s *Server) serveGetNodeData(w http.ResponseWriter, r *http.Request) {
@@ -559,12 +553,6 @@ func (s *Server) serveGetNodeData(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 		return
 	}
-	var debugMode string
-	if s.mode == ManageServerMode {
-		debugMode = "full"
-	} else if s.mode == LoginServerMode {
-		debugMode = "login"
-	}
 	data := &nodeData{
 		ID:               st.Self.ID,
 		Status:           st.BackendState,
@@ -582,7 +570,6 @@ func (s *Server) serveGetNodeData(w http.ResponseWriter, r *http.Request) {
 		RunningSSHServer: prefs.RunSSH,
 		URLPrefix:        strings.TrimSuffix(s.pathPrefix, "/"),
 		LicensesURL:      licenses.LicensesURL(),
-		DebugMode:        debugMode, // TODO(sonia,will): just pass back s.mode directly?
 	}
 	cv, err := s.lc.CheckUpdate(r.Context())
 	if err != nil {
diff --git a/cmd/tailscale/cli/web.go b/cmd/tailscale/cli/web.go
index 99e68c2fc..44f5e357f 100644
--- a/cmd/tailscale/cli/web.go
+++ b/cmd/tailscale/cli/web.go
@@ -90,12 +90,10 @@ func runWeb(ctx context.Context, args []string) error {
 		selfIP = st.Self.TailscaleIPs[0]
 	}
 
-	cliServerMode := web.LegacyServerMode
 	var existingWebClient bool
 	if prefs, err := localClient.GetPrefs(ctx); err == nil {
 		existingWebClient = prefs.RunWebClient
 	}
-	cliServerMode = web.LoginServerMode
 	if !existingWebClient {
 		// Also start full client in tailscaled.
 		log.Printf("starting tailscaled web client at %s:%d\n", selfIP.String(), web.ListenPort)
@@ -105,7 +103,7 @@ func runWeb(ctx context.Context, args []string) error {
 	}
 
 	webServer, err := web.NewServer(web.ServerOpts{
-		Mode:        cliServerMode,
+		Mode:        web.LoginServerMode,
 		CGIMode:     webArgs.cgi,
 		PathPrefix:  webArgs.prefix,
 		LocalClient: &localClient,
diff --git a/tsnet/example/web-client/web-client.go b/tsnet/example/web-client/web-client.go
index 2f64f3dd9..b4207659a 100644
--- a/tsnet/example/web-client/web-client.go
+++ b/tsnet/example/web-client/web-client.go
@@ -30,7 +30,7 @@ func main() {
 
 	// Serve the Tailscale web client.
 	ws, err := web.NewServer(web.ServerOpts{
-		Mode:        web.LegacyServerMode,
+		Mode:        web.LoginServerMode,
 		LocalClient: lc,
 	})
 	if err != nil {