diff --git a/cmd/tailscale/cli/risks.go b/cmd/tailscale/cli/risks.go
index c495da171..4cfa50d58 100644
--- a/cmd/tailscale/cli/risks.go
+++ b/cmd/tailscale/cli/risks.go
@@ -12,6 +12,8 @@ import (
 	"strings"
 	"syscall"
 	"time"
+
+	"tailscale.com/util/testenv"
 )
 
 var (
@@ -56,7 +58,7 @@ func presentRiskToUser(riskType, riskMessage, acceptedRisks string) error {
 	if isRiskAccepted(riskType, acceptedRisks) {
 		return nil
 	}
-	if inTest() {
+	if testenv.InTest() {
 		return errAborted
 	}
 	outln(riskMessage)
diff --git a/cmd/tailscale/cli/up.go b/cmd/tailscale/cli/up.go
index d713050b1..aa23a8cdb 100644
--- a/cmd/tailscale/cli/up.go
+++ b/cmd/tailscale/cli/up.go
@@ -91,8 +91,6 @@ func acceptRouteDefault(goos string) bool {
 
 var upFlagSet = newUpFlagSet(effectiveGOOS(), &upArgsGlobal, "up")
 
-func inTest() bool { return flag.Lookup("test.v") != nil }
-
 // newUpFlagSet returns a new flag set for the "up" and "login" commands.
 func newUpFlagSet(goos string, upArgs *upArgsT, cmd string) *flag.FlagSet {
 	if cmd != "up" && cmd != "login" {
diff --git a/cmd/tailscale/depaware.txt b/cmd/tailscale/depaware.txt
index ccf6ef811..0d0152a9f 100644
--- a/cmd/tailscale/depaware.txt
+++ b/cmd/tailscale/depaware.txt
@@ -145,6 +145,7 @@ tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/dep
         tailscale.com/util/set                                       from tailscale.com/health+
         tailscale.com/util/singleflight                              from tailscale.com/net/dnscache
         tailscale.com/util/slicesx                                   from tailscale.com/net/dnscache+
+        tailscale.com/util/testenv                                   from tailscale.com/cmd/tailscale/cli
      💣 tailscale.com/util/winutil                                   from tailscale.com/hostinfo+
    W 💣 tailscale.com/util/winutil/authenticode                      from tailscale.com/cmd/tailscale/cli
         tailscale.com/version                                        from tailscale.com/cmd/tailscale/cli+
diff --git a/cmd/tailscaled/depaware.txt b/cmd/tailscaled/depaware.txt
index c5b6f7da7..a090a8919 100644
--- a/cmd/tailscaled/depaware.txt
+++ b/cmd/tailscaled/depaware.txt
@@ -343,6 +343,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com/util/slicesx                                   from tailscale.com/net/dnscache+
         tailscale.com/util/sysresources                              from tailscale.com/wgengine/magicsock
         tailscale.com/util/systemd                                   from tailscale.com/control/controlclient+
+        tailscale.com/util/testenv                                   from tailscale.com/ipn/ipnlocal+
         tailscale.com/util/uniq                                      from tailscale.com/wgengine/magicsock+
      💣 tailscale.com/util/winutil                                   from tailscale.com/control/controlclient+
    W 💣 tailscale.com/util/winutil/authenticode                      from tailscale.com/util/osdiag
diff --git a/ipn/ipnlocal/local.go b/ipn/ipnlocal/local.go
index 10b18a88c..b37ca3194 100644
--- a/ipn/ipnlocal/local.go
+++ b/ipn/ipnlocal/local.go
@@ -8,7 +8,6 @@ import (
 	"encoding/base64"
 	"encoding/json"
 	"errors"
-	"flag"
 	"fmt"
 	"io"
 	"log"
@@ -65,7 +64,6 @@ import (
 	"tailscale.com/types/dnstype"
 	"tailscale.com/types/empty"
 	"tailscale.com/types/key"
-	"tailscale.com/types/lazy"
 	"tailscale.com/types/logger"
 	"tailscale.com/types/logid"
 	"tailscale.com/types/netmap"
@@ -81,6 +79,7 @@ import (
 	"tailscale.com/util/osshare"
 	"tailscale.com/util/set"
 	"tailscale.com/util/systemd"
+	"tailscale.com/util/testenv"
 	"tailscale.com/util/uniq"
 	"tailscale.com/version"
 	"tailscale.com/version/distro"
@@ -93,14 +92,6 @@ import (
 	"tailscale.com/wgengine/wgcfg/nmcfg"
 )
 
-var lazyInTest lazy.SyncValue[bool]
-
-func inTest() bool {
-	return lazyInTest.Get(func() bool {
-		return flag.Lookup("test.v") != nil
-	})
-}
-
 var controlDebugFlags = getControlDebugFlags()
 
 func getControlDebugFlags() []string {
@@ -506,7 +497,7 @@ func (b *LocalBackend) maybePauseControlClientLocked() {
 		return
 	}
 	networkUp := b.prevIfState.AnyInterfaceUp()
-	b.cc.SetPaused((b.state == ipn.Stopped && b.netMap != nil) || (!networkUp && !inTest()))
+	b.cc.SetPaused((b.state == ipn.Stopped && b.netMap != nil) || (!networkUp && !testenv.InTest()))
 }
 
 // linkChange is our network monitor callback, called whenever the network changes.
diff --git a/logpolicy/logpolicy.go b/logpolicy/logpolicy.go
index 41d111455..c11aaf3bc 100644
--- a/logpolicy/logpolicy.go
+++ b/logpolicy/logpolicy.go
@@ -13,7 +13,6 @@ import (
 	"crypto/tls"
 	"encoding/json"
 	"errors"
-	"flag"
 	"fmt"
 	"io"
 	"log"
@@ -49,13 +48,12 @@ import (
 	"tailscale.com/util/clientmetric"
 	"tailscale.com/util/must"
 	"tailscale.com/util/racebuild"
+	"tailscale.com/util/testenv"
 	"tailscale.com/util/winutil"
 	"tailscale.com/version"
 	"tailscale.com/version/distro"
 )
 
-func inTest() bool { return flag.Lookup("test.v") != nil }
-
 var getLogTargetOnce struct {
 	sync.Once
 	v string // URL of logs server, or empty for default
@@ -576,7 +574,7 @@ func NewWithConfigPath(collection, dir, cmdName string, netMon *netmon.Monitor,
 		conf.IncludeProcSequence = true
 	}
 
-	if envknob.NoLogsNoSupport() || inTest() {
+	if envknob.NoLogsNoSupport() || testenv.InTest() {
 		logf("You have disabled logging. Tailscale will not be able to provide support.")
 		conf.HTTPC = &http.Client{Transport: noopPretendSuccessTransport{}}
 	} else if val := getLogTarget(); val != "" {
@@ -756,7 +754,7 @@ func dialContext(ctx context.Context, netw, addr string, netMon *netmon.Monitor,
 // The logf parameter is optional; if non-nil, logs are printed using the
 // provided function; if nil, log.Printf will be used instead.
 func NewLogtailTransport(host string, netMon *netmon.Monitor, logf logger.Logf) http.RoundTripper {
-	if inTest() {
+	if testenv.InTest() {
 		return noopPretendSuccessTransport{}
 	}
 	// Start with a copy of http.DefaultTransport and tweak it a bit.
diff --git a/tsnet/tsnet.go b/tsnet/tsnet.go
index d819e5a79..6fed40e34 100644
--- a/tsnet/tsnet.go
+++ b/tsnet/tsnet.go
@@ -12,7 +12,6 @@ import (
 	"crypto/tls"
 	"encoding/hex"
 	"errors"
-	"flag"
 	"fmt"
 	"io"
 	"log"
@@ -53,12 +52,11 @@ import (
 	"tailscale.com/types/logid"
 	"tailscale.com/types/nettype"
 	"tailscale.com/util/mak"
+	"tailscale.com/util/testenv"
 	"tailscale.com/wgengine"
 	"tailscale.com/wgengine/netstack"
 )
 
-func inTest() bool { return flag.Lookup("test.v") != nil }
-
 // Server is an embedded Tailscale server.
 //
 // Its exported fields may be changed until the first method call.
@@ -605,7 +603,7 @@ func (s *Server) start() (reterr error) {
 }
 
 func (s *Server) startLogger(closePool *closeOnErrorPool) error {
-	if inTest() {
+	if testenv.InTest() {
 		return nil
 	}
 	cfgPath := filepath.Join(s.rootPath, "tailscaled.log.conf")
diff --git a/tstest/deptest/deptest.go b/tstest/deptest/deptest.go
index 72c9ceb75..6c8614593 100644
--- a/tstest/deptest/deptest.go
+++ b/tstest/deptest/deptest.go
@@ -15,8 +15,8 @@ import (
 )
 
 type DepChecker struct {
-	GOOS    string
-	GOARCH  string
+	GOOS    string            // optional
+	GOARCH  string            // optional
 	BadDeps map[string]string // package => why
 }
 
diff --git a/util/testenv/testenv.go b/util/testenv/testenv.go
new file mode 100644
index 000000000..12ada9003
--- /dev/null
+++ b/util/testenv/testenv.go
@@ -0,0 +1,21 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package testenv provides utility functions for tests. It does not depend on
+// the `testing` package to allow usage in non-test code.
+package testenv
+
+import (
+	"flag"
+
+	"tailscale.com/types/lazy"
+)
+
+var lazyInTest lazy.SyncValue[bool]
+
+// InTest reports whether the current binary is a test binary.
+func InTest() bool {
+	return lazyInTest.Get(func() bool {
+		return flag.Lookup("test.v") != nil
+	})
+}
diff --git a/util/testenv/testenv_test.go b/util/testenv/testenv_test.go
new file mode 100644
index 000000000..43c332b26
--- /dev/null
+++ b/util/testenv/testenv_test.go
@@ -0,0 +1,18 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package testenv
+
+import (
+	"testing"
+
+	"tailscale.com/tstest/deptest"
+)
+
+func TestDeps(t *testing.T) {
+	deptest.DepChecker{
+		BadDeps: map[string]string{
+			"testing": "see pkg docs",
+		},
+	}.Check(t)
+}