diff --git a/go.toolchain.rev b/go.toolchain.rev
index 02b6e5878..5d87594c2 100644
--- a/go.toolchain.rev
+++ b/go.toolchain.rev
@@ -1 +1 @@
-ed9dc37b2b000f376a3e819cbb159e2c17a2dac6
+bf15628b759344c6fc7763795a405ba65b8be5d7
diff --git a/version_tailscale_test.go b/version_tailscale_test.go
new file mode 100644
index 000000000..c15e0cbee
--- /dev/null
+++ b/version_tailscale_test.go
@@ -0,0 +1,35 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build tailscale_go
+
+package tailscaleroot
+
+import (
+	"os"
+	"runtime/debug"
+	"strings"
+	"testing"
+)
+
+func TestToolchainMatches(t *testing.T) {
+	bi, ok := debug.ReadBuildInfo()
+	if !ok {
+		t.Fatal("failed to read build info")
+	}
+	var tsRev string
+	for _, s := range bi.Settings {
+		if s.Key == "tailscale.toolchain.rev" {
+			tsRev = s.Value
+			break
+		}
+	}
+	want := strings.TrimSpace(GoToolchainRev)
+	if tsRev != want {
+		if os.Getenv("TS_PERMIT_TOOLCHAIN_MISMATCH") == "1" {
+			t.Logf("tailscale.toolchain.rev = %q, want %q; but ignoring due to TS_PERMIT_TOOLCHAIN_MISMATCH=1", tsRev, want)
+			return
+		}
+		t.Errorf("tailscale.toolchain.rev = %q, want %q; permit with TS_PERMIT_TOOLCHAIN_MISMATCH=1", tsRev, want)
+	}
+}