diff --git a/cmd/tailscaled/depaware.txt b/cmd/tailscaled/depaware.txt
index b5046726c..d296987d5 100644
--- a/cmd/tailscaled/depaware.txt
+++ b/cmd/tailscaled/depaware.txt
@@ -84,7 +84,6 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com/disco                                          from tailscale.com/derp+
         tailscale.com/health                                         from tailscale.com/control/controlclient+
         tailscale.com/hostinfo                                       from tailscale.com/control/controlclient+
-        tailscale.com/internal/deephash                              from tailscale.com/ipn/ipnlocal+
         tailscale.com/ipn                                            from tailscale.com/ipn/ipnserver+
         tailscale.com/ipn/ipnlocal                                   from tailscale.com/ipn/ipnserver+
         tailscale.com/ipn/ipnserver                                  from tailscale.com/cmd/tailscaled
@@ -137,6 +136,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com/types/structs                                  from tailscale.com/control/controlclient+
         tailscale.com/types/wgkey                                    from tailscale.com/control/controlclient+
    L    tailscale.com/util/cmpver                                    from tailscale.com/net/dns
+        tailscale.com/util/deephash                                  from tailscale.com/ipn/ipnlocal+
         tailscale.com/util/dnsname                                   from tailscale.com/ipn/ipnstate+
   LW    tailscale.com/util/endian                                    from tailscale.com/net/netns+
         tailscale.com/util/groupmember                               from tailscale.com/ipn/ipnserver
diff --git a/ipn/ipnlocal/local.go b/ipn/ipnlocal/local.go
index 66039267c..d8ef19bfb 100644
--- a/ipn/ipnlocal/local.go
+++ b/ipn/ipnlocal/local.go
@@ -29,7 +29,6 @@ import (
 	"tailscale.com/client/tailscale/apitype"
 	"tailscale.com/control/controlclient"
 	"tailscale.com/health"
-	"tailscale.com/internal/deephash"
 	"tailscale.com/ipn"
 	"tailscale.com/ipn/ipnstate"
 	"tailscale.com/ipn/policy"
@@ -46,6 +45,7 @@ import (
 	"tailscale.com/types/persist"
 	"tailscale.com/types/preftype"
 	"tailscale.com/types/wgkey"
+	"tailscale.com/util/deephash"
 	"tailscale.com/util/dnsname"
 	"tailscale.com/util/osshare"
 	"tailscale.com/util/systemd"
diff --git a/internal/deephash/deephash.go b/util/deephash/deephash.go
similarity index 97%
rename from internal/deephash/deephash.go
rename to util/deephash/deephash.go
index b33531873..c116f0977 100644
--- a/internal/deephash/deephash.go
+++ b/util/deephash/deephash.go
@@ -4,6 +4,9 @@
 
 // Package deephash hashes a Go value recursively, in a predictable
 // order, without looping.
+//
+// This package, like most of the tailscale.com Go module, should be
+// considered Tailscale-internal; we make no API promises.
 package deephash
 
 import (
diff --git a/internal/deephash/deephash_test.go b/util/deephash/deephash_test.go
similarity index 100%
rename from internal/deephash/deephash_test.go
rename to util/deephash/deephash_test.go
diff --git a/internal/deephash/fmtsort.go b/util/deephash/fmtsort.go
similarity index 100%
rename from internal/deephash/fmtsort.go
rename to util/deephash/fmtsort.go
diff --git a/internal/deephash/mapiter.go b/util/deephash/mapiter.go
similarity index 100%
rename from internal/deephash/mapiter.go
rename to util/deephash/mapiter.go
diff --git a/internal/deephash/mapiter_future.go b/util/deephash/mapiter_future.go
similarity index 100%
rename from internal/deephash/mapiter_future.go
rename to util/deephash/mapiter_future.go
diff --git a/wgengine/userspace.go b/wgengine/userspace.go
index d5886960d..2972726e9 100644
--- a/wgengine/userspace.go
+++ b/wgengine/userspace.go
@@ -26,7 +26,6 @@ import (
 	"inet.af/netaddr"
 	"tailscale.com/control/controlclient"
 	"tailscale.com/health"
-	"tailscale.com/internal/deephash"
 	"tailscale.com/ipn/ipnstate"
 	"tailscale.com/net/dns"
 	"tailscale.com/net/dns/resolver"
@@ -42,6 +41,7 @@ import (
 	"tailscale.com/types/logger"
 	"tailscale.com/types/netmap"
 	"tailscale.com/types/wgkey"
+	"tailscale.com/util/deephash"
 	"tailscale.com/version"
 	"tailscale.com/wgengine/filter"
 	"tailscale.com/wgengine/magicsock"