diff --git a/cmd/tsconnect/common.go b/cmd/tsconnect/common.go
index 437393b1d..aab2d2b8e 100644
--- a/cmd/tsconnect/common.go
+++ b/cmd/tsconnect/common.go
@@ -32,6 +32,9 @@ func commonSetup(dev bool) (*esbuild.BuildOptions, error) {
 	if err != nil {
 		return nil, err
 	}
+	if *yarnPath == "" {
+		*yarnPath = path.Join(root, "tool", "yarn")
+	}
 	tsConnectDir := filepath.Join(root, "cmd", "tsconnect")
 	if err := os.Chdir(tsConnectDir); err != nil {
 		return nil, fmt.Errorf("Cannot change cwd: %w", err)
diff --git a/cmd/tsconnect/tsconnect.go b/cmd/tsconnect/tsconnect.go
index 1ab13b355..1e91e47ee 100644
--- a/cmd/tsconnect/tsconnect.go
+++ b/cmd/tsconnect/tsconnect.go
@@ -20,7 +20,7 @@ var (
 	addr            = flag.String("addr", ":9090", "address to listen on")
 	distDir         = flag.String("distdir", "./dist", "path of directory to place build output in")
 	pkgDir          = flag.String("pkgdir", "./pkg", "path of directory to place NPM package build output in")
-	yarnPath        = flag.String("yarnpath", "../../tool/yarn", "path yarn executable used to install JavaScript dependencies")
+	yarnPath        = flag.String("yarnpath", "", "path yarn executable used to install JavaScript dependencies")
 	fastCompression = flag.Bool("fast-compression", false, "Use faster compression when building, to speed up build time. Meant to iterative/debugging use only.")
 	devControl      = flag.String("dev-control", "", "URL of a development control server to be used with dev. If provided without specifying dev, an error will be returned.")
 	rootDir         = flag.String("rootdir", "", "Root directory of repo. If not specified, will be inferred from the cwd.")
diff --git a/tool/node b/tool/node
new file mode 100755
index 000000000..11bb6c232
--- /dev/null
+++ b/tool/node
@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+# Run a command with our local node install, rather than any globally installed
+# instance.
+
+set -euo pipefail
+
+if [[ "${CI:-}" == "true" ]]; then
+    set -x
+fi
+
+(
+    if [[ "${CI:-}" == "true" ]]; then
+        set -x
+    fi
+
+    repo_root="${BASH_SOURCE%/*}/../"
+    cd "$repo_root"
+
+    cachedir="$HOME/.cache/tailscale-node"
+    tarball="${cachedir}.tar.gz"
+
+    read -r want_rev < "$(dirname "$0")/node.rev"
+
+    got_rev=""
+    if [[ -x "${cachedir}/bin/node" ]]; then
+        got_rev=$("${cachedir}/bin/node" --version)
+        got_rev="${got_rev#v}" # trim the leading 'v'
+    fi
+
+    if [[ "$want_rev" != "$got_rev" ]]; then
+        rm -rf "$cachedir" "$tarball"
+        if [[ -n "${IN_NIX_SHELL:-}" ]]; then
+            nix_node="$(which -a node | grep /nix/store | head -1)"
+            nix_node="${nix_node%/bin/node}"
+            nix_node_rev="${nix_node##*-}"
+            if [[ "$nix_node_rev" != "$want_rev" ]]; then
+                echo "Wrong node version in Nix, got $nix_node_rev want $want_rev" >&2
+		        exit 1
+            fi
+            ln -sf "$nix_node" "$cachedir"
+        else
+            # works for "linux" and "darwin"
+            OS=$(uname -s | tr A-Z a-z)
+            ARCH=$(uname -m)
+            if [ "$ARCH" = "x86_64" ]; then
+                ARCH="x64"
+            fi
+            if [ "$ARCH" = "aarch64" ]; then
+                ARCH="arm64"
+            fi
+            mkdir -p "$cachedir"
+            curl -f -L -o "$tarball" "https://nodejs.org/dist/v${want_rev}/node-v${want_rev}-${OS}-${ARCH}.tar.gz"
+            (cd "$cachedir" && tar --strip-components=1 -xf "$tarball")
+            rm -f "$tarball"
+        fi
+    fi
+)
+
+export PATH="$HOME/.cache/tailscale-node/bin:$PATH"
+exec "$HOME/.cache/tailscale-node/bin/node" "$@"
diff --git a/tool/node.rev b/tool/node.rev
index 0baffb7e2..3876fd498 100644
--- a/tool/node.rev
+++ b/tool/node.rev
@@ -1 +1 @@
-16.4.1
+18.16.1
diff --git a/tool/yarn b/tool/yarn
index e8c1b697f..48c61c564 100755
--- a/tool/yarn
+++ b/tool/yarn
@@ -1,79 +1,43 @@
-#!/bin/sh
-#
-# This script acts like the "yarn" command, but uses Tailscale's
-# currently-desired version, downloading it (and node) first if necessary.
+#!/usr/bin/env bash
+# Run a command with our local yarn install, rather than any globally installed
+# instance.
 
-set -eu
+set -euo pipefail
 
-NODE_DIR="$HOME/.cache/tailscale-node"
-read -r YARN_REV < "$(dirname "$0")/yarn.rev"
-YARN_DIR="$HOME/.cache/tailscale-yarn"
-# This works for linux and darwin, which is sufficient
-# (we do not build for other targets).
-OS=$(uname -s | tr A-Z a-z)
-ARCH="$(uname -m)"
-if [ "$ARCH" = "aarch64" ]; then
-    # Node uses the name "arm64".
-    ARCH="arm64"
-elif [ "$ARCH" = "x86_64" ]; then
-    # Node uses the name "x64".
-    ARCH="x64"
+if [[ "${CI:-}" == "true" ]]; then
+    set -x
 fi
 
-install_node() {
-    read -r NODE_REV < "$(dirname "$0")/node.rev"
-    NODE_URL="https://nodejs.org/dist/v${NODE_REV}/node-v${NODE_REV}-${OS}-${ARCH}.tar.gz"
-    install_tool "node" $NODE_REV $NODE_DIR $NODE_URL
-}
+(
+    if [[ "${CI:-}" == "true" ]]; then
+        set -x
+    fi
 
-install_yarn() {
-    YARN_URL="https://github.com/yarnpkg/yarn/releases/download/v$YARN_REV/yarn-v$YARN_REV.tar.gz"
-    install_tool "yarn" $YARN_REV $YARN_DIR $YARN_URL
-}
+    repo_root="${BASH_SOURCE%/*}/../"
+    cd "$repo_root"
 
-install_tool() {
-    TOOL=$1
-    REV=$2
-    TOOLCHAIN=$3
-    URL=$4
+    ./tool/node --version >/dev/null # Ensure node is unpacked and ready
 
-    archive="$TOOLCHAIN-$REV.tar.gz"
-    mark="$TOOLCHAIN.extracted"
-    extracted=
-    [ ! -e "$mark" ] || read -r extracted junk <$mark
+    cachedir="$HOME/.cache/tailscale-yarn"
+    tarball="${cachedir}.tar.gz"
 
-    if [ "$extracted" = "$REV" ] && [ -e "$TOOLCHAIN/bin/$TOOL" ]; then
-        # Already extracted, continue silently
-        return 0
-    fi
+    read -r want_rev < "$(dirname "$0")/yarn.rev"
 
-    rm -f "$archive.new" "$TOOLCHAIN.extracted"
-    if [ ! -e "$archive" ]; then
-            log "Need to download $TOOL '$REV' from $URL."
-            curl -f -L -o "$archive.new" $URL
-            rm -f "$archive"
-            mv "$archive.new" "$archive"
+    got_rev=""
+    if [[ -x "${cachedir}/bin/yarn" ]]; then
+        got_rev=$(PATH="$HOME/.cache/tailscale-node/bin:$PATH" "${cachedir}/bin/yarn" --version)
     fi
 
-    log "Extracting $TOOL '$REV' into '$TOOLCHAIN'." >&2
-    rm -rf "$TOOLCHAIN"
-    mkdir -p "$TOOLCHAIN"
-    (cd "$TOOLCHAIN" && tar --strip-components=1 -xf "$archive")
-    echo "$REV" >$mark
-}
-
-log() {
-    echo "$@" >&2
-}
-
-if [ "${YARN_REV}" = "SKIP" ] ||
-   [ "${OS}" != "darwin" -a "${OS}" != "linux" ] ||
-   [ "${ARCH}" != "x64" -a "${ARCH}" != "arm64" ]; then
-    log "Using existing yarn (`which yarn`)."
-    exec yarn "$@"
-fi
-
-install_node
-install_yarn
+    if [[ "$want_rev" != "$got_rev" ]]; then
+        rm -rf "$cachedir" "$tarball"
+        mkdir -p "$cachedir"
+        curl -f -L -o "$tarball" "https://github.com/yarnpkg/yarn/releases/download/v${want_rev}/yarn-v${want_rev}.tar.gz"
+        (cd "$cachedir" && tar --strip-components=1 -xf "$tarball")
+        rm -f "$tarball"
+    fi
+)
 
-exec /usr/bin/env PATH="$NODE_DIR/bin:$PATH" "$YARN_DIR/bin/yarn" "$@"
+# Deliberately not using cachedir here, to keep the environment
+# completely pristine for execution of yarn.
+export PATH="$HOME/.cache/tailscale-node/bin:$HOME/.cache/tailscale-yarn/bin:$PATH"
+exec "$HOME/.cache/tailscale-yarn/bin/yarn" "$@"