diff --git a/cmd/tailscaled/tailscaled_test.go b/cmd/tailscaled/tailscaled_test.go
index 0c14a755a..bdcfaff3e 100644
--- a/cmd/tailscaled/tailscaled_test.go
+++ b/cmd/tailscaled/tailscaled_test.go
@@ -3,10 +3,34 @@
 
 package main // import "tailscale.com/cmd/tailscaled"
 
-import "testing"
+import (
+	"testing"
+
+	"tailscale.com/tstest/deptest"
+)
 
 func TestNothing(t *testing.T) {
 	// This test does nothing on purpose, so we can run
 	// GODEBUG=memprofilerate=1 go test -v -run=Nothing -memprofile=prof.mem
 	// without any errors about no matching tests.
 }
+
+func TestDeps(t *testing.T) {
+	deptest.DepChecker{
+		GOOS:   "darwin",
+		GOARCH: "arm64",
+		BadDeps: map[string]string{
+			"gvisor.dev/gvisor/pkg/hostarch": "will crash on non-4K page sizes",
+		},
+	}.Check(t)
+
+	deptest.DepChecker{
+		GOOS:    "linux",
+		GOARCH:  "arm64",
+		BadDeps: map[string]string{
+			// TODO: per https://github.com/tailscale/tailscale/issues/8658,
+			// add this line too:
+			// "gvisor.dev/gvisor/pkg/hostarch": "will crash on non-4K page sizes",
+		},
+	}.Check(t)
+}
diff --git a/tstest/deptest/deptest.go b/tstest/deptest/deptest.go
new file mode 100644
index 000000000..72c9ceb75
--- /dev/null
+++ b/tstest/deptest/deptest.go
@@ -0,0 +1,56 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// The deptest package contains a shared implementation of negative
+// dependency tests for other packages, making sure we don't start
+// depending on certain packages.
+package deptest
+
+import (
+	"encoding/json"
+	"os"
+	"os/exec"
+	"runtime"
+	"testing"
+)
+
+type DepChecker struct {
+	GOOS    string
+	GOARCH  string
+	BadDeps map[string]string // package => why
+}
+
+func (c DepChecker) Check(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		// Slow and avoid caring about "go.exe" etc.
+		t.Skip("skipping dep tests on windows hosts")
+	}
+	t.Helper()
+	cmd := exec.Command("go", "list", "-json", ".")
+	var extraEnv []string
+	if c.GOOS != "" {
+		extraEnv = append(extraEnv, "GOOS="+c.GOOS)
+	}
+	if c.GOARCH != "" {
+		extraEnv = append(extraEnv, "GOARCH="+c.GOARCH)
+	}
+	cmd.Env = append(os.Environ(), extraEnv...)
+	out, err := cmd.Output()
+	if err != nil {
+		t.Fatal(err)
+	}
+	var res struct {
+		Deps []string
+	}
+	if err := json.Unmarshal(out, &res); err != nil {
+		t.Fatal(err)
+	}
+
+	for _, dep := range res.Deps {
+		if why, ok := c.BadDeps[dep]; ok {
+			t.Errorf("package %q is not allowed as a dependency (env: %q); reason: %s", dep, extraEnv, why)
+		}
+	}
+	t.Logf("got %d dependencies", len(res.Deps))
+
+}
diff --git a/tstest/iosdeps/iosdeps_test.go b/tstest/iosdeps/iosdeps_test.go
index f04f29eca..78a526ab1 100644
--- a/tstest/iosdeps/iosdeps_test.go
+++ b/tstest/iosdeps/iosdeps_test.go
@@ -1,38 +1,21 @@
 // Copyright (c) Tailscale Inc & AUTHORS
 // SPDX-License-Identifier: BSD-3-Clause
 
-// No need to run this on Windows where CI's slow enough. Then we don't need to
-// worry about "go.exe" etc.
-
-//go:build !windows
-
 package iosdeps
 
 import (
-	"encoding/json"
-	"os"
-	"os/exec"
 	"testing"
+
+	"tailscale.com/tstest/deptest"
 )
 
 func TestDeps(t *testing.T) {
-	cmd := exec.Command("go", "list", "-json", ".")
-	cmd.Env = append(os.Environ(), "GOOS=ios", "GOARCH=arm64")
-	out, err := cmd.Output()
-	if err != nil {
-		t.Fatal(err)
-	}
-	var res struct {
-		Deps []string
-	}
-	if err := json.Unmarshal(out, &res); err != nil {
-		t.Fatal(err)
-	}
-	for _, dep := range res.Deps {
-		switch dep {
-		case "text/template", "html/template":
-			t.Errorf("package %q is not allowed as a dependency on iOS", dep)
-		}
-	}
-	t.Logf("got %d dependencies", len(res.Deps))
+	deptest.DepChecker{
+		GOOS:   "ios",
+		GOARCH: "arm64",
+		BadDeps: map[string]string{
+			"text/template": "linker bloat (MethodByName)",
+			"html/template": "linker bloat (MethodByName)",
+		},
+	}.Check(t)
 }
diff --git a/tstest/jsdeps/jsdeps_test.go b/tstest/jsdeps/jsdeps_test.go
index d18984c96..c3dbcd39a 100644
--- a/tstest/jsdeps/jsdeps_test.go
+++ b/tstest/jsdeps/jsdeps_test.go
@@ -1,38 +1,24 @@
 // Copyright (c) Tailscale Inc & AUTHORS
 // SPDX-License-Identifier: BSD-3-Clause
 
-// No need to run this on Windows where CI's slow enough. Then we don't need to
-// worry about "go.exe" etc.
-
-//go:build !windows
-
 package jsdeps
 
 import (
-	"encoding/json"
-	"os"
-	"os/exec"
 	"testing"
+
+	"tailscale.com/tstest/deptest"
 )
 
 func TestDeps(t *testing.T) {
-	cmd := exec.Command("go", "list", "-json", ".")
-	cmd.Env = append(os.Environ(), "GOOS=js", "GOARCH=wasm")
-	out, err := cmd.Output()
-	if err != nil {
-		t.Fatal(err)
-	}
-	var res struct {
-		Deps []string
-	}
-	if err := json.Unmarshal(out, &res); err != nil {
-		t.Fatal(err)
-	}
-	for _, dep := range res.Deps {
-		switch dep {
-		case "runtime/pprof", "golang.org/x/net/http2/h2c", "net/http/pprof", "golang.org/x/net/proxy", "github.com/tailscale/goupnp":
-			t.Errorf("package %q is not allowed as a dependency on JS", dep)
-		}
-	}
-	t.Logf("got %d dependencies", len(res.Deps))
+	deptest.DepChecker{
+		GOOS:   "js",
+		GOARCH: "wasm",
+		BadDeps: map[string]string{
+			"runtime/pprof":               "bloat",
+			"golang.org/x/net/http2/h2c":  "bloat",
+			"net/http/pprof":              "bloat",
+			"golang.org/x/net/proxy":      "bloat",
+			"github.com/tailscale/goupnp": "bloat, which can't work anyway in wasm",
+		},
+	}.Check(t)
 }