diff --git a/clientupdate/clientupdate.go b/clientupdate/clientupdate.go
index b9d052618..2c49d9350 100644
--- a/clientupdate/clientupdate.go
+++ b/clientupdate/clientupdate.go
@@ -272,12 +272,12 @@ func (up *Updater) updateSynology() error {
 		return fmt.Errorf("cannot find Synology package for os=%s arch=%s, please report a bug with your device model", osName, arch)
 	}
 
-	if !up.confirm(latest.SPKsVersion) {
-		return nil
-	}
 	if err := requireRoot(); err != nil {
 		return err
 	}
+	if !up.confirm(latest.SPKsVersion) {
+		return nil
+	}
 
 	// Download the SPK into a temporary directory.
 	spkDir, err := os.MkdirTemp("", "tailscale-update")
@@ -716,12 +716,12 @@ func (up *Updater) updateWindows() error {
 		arch = "x86"
 	}
 
-	if !up.confirm(ver) {
-		return nil
-	}
 	if !winutil.IsCurrentProcessElevated() {
 		return errors.New("must be run as Administrator")
 	}
+	if !up.confirm(ver) {
+		return nil
+	}
 
 	tsDir := filepath.Join(os.Getenv("ProgramData"), "Tailscale")
 	msiDir := filepath.Join(tsDir, "MSICache")
@@ -914,13 +914,13 @@ func (up *Updater) updateLinuxBinary() error {
 	if err != nil {
 		return err
 	}
-	if !up.confirm(ver) {
-		return nil
-	}
 	// Root is needed to overwrite binaries and restart systemd unit.
 	if err := requireRoot(); err != nil {
 		return err
 	}
+	if !up.confirm(ver) {
+		return nil
+	}
 
 	dlPath, err := up.downloadLinuxTarball(ver)
 	if err != nil {