diff --git a/cmd/nginx-auth/README.md b/cmd/nginx-auth/README.md
index 66b7cd963..15b1811a2 100644
--- a/cmd/nginx-auth/README.md
+++ b/cmd/nginx-auth/README.md
@@ -1,5 +1,7 @@
 # nginx-auth
 
+[![status: experimental](https://img.shields.io/badge/status-experimental-blue)](https://tailscale.com/kb/1167/release-stages/#experimental)
+
 This is a tool that allows users to use Tailscale Whois authentication with
 NGINX as a reverse proxy. This allows users that already have a bunch of
 services hosted on an internal NGINX server to point those domains to the