diff --git a/flake.nix b/flake.nix
index 41afe2af5..b2fbc58ac 100644
--- a/flake.nix
+++ b/flake.nix
@@ -47,4 +47,4 @@
         };
       });
 }
-# nix-direnv cache busting line: sha256-OTklU0XBoB6VhQs0KYJ3EKPkLwHjqtpo6S7sUdJ1Kz4=
+# nix-direnv cache busting line: sha256-E3vBmBO4K4REDf62ztSLzvko9kKGeLz5efCv2HGi/3M=
diff --git a/flakehashes.json b/flakehashes.json
index c67c95fcd..2013c68c7 100644
--- a/flakehashes.json
+++ b/flakehashes.json
@@ -1,6 +1,6 @@
 {
   "vendor": {
-    "goModSum": "sha256-PR2Ud1Z0BQ0Gn9tx4aZCNhynrtXYLDZlfWUGJLd/EHY=",
-    "sri": "sha256-OTklU0XBoB6VhQs0KYJ3EKPkLwHjqtpo6S7sUdJ1Kz4="
+    "goModSum": "sha256-XQZn3hG/2N0/tWNeQlOeMjln9p6g/lewLpplCd+/n8A=",
+    "sri": "sha256-E3vBmBO4K4REDf62ztSLzvko9kKGeLz5efCv2HGi/3M="
   }
 }
diff --git a/go.mod b/go.mod
index 9d1f3de8c..e012681f0 100644
--- a/go.mod
+++ b/go.mod
@@ -22,7 +22,7 @@ require (
 	golang.org/x/net v0.59.0
 	golang.org/x/sys v0.48.0
 	gvisor.dev/gvisor v0.0.0-20260915211658-a6f909f08a72
-	tailscale.com v1.103.0-pre.0.20260925230348-6b3a45f14ef6
+	tailscale.com v1.103.0-pre.0.20260929142145-a0e471a35b8f
 )
 
 require (
diff --git a/go.sum b/go.sum
index 4ae6bccf7..285466f47 100644
--- a/go.sum
+++ b/go.sum
@@ -280,5 +280,5 @@ howett.net/plist v1.0.0 h1:7CrbWYbPPO/PyNy38b2EB/+gYbjCe2DXBxgtOOZbSQM=
 howett.net/plist v1.0.0/go.mod h1:lqaXoTrLY4hg8tnEzNru53gicrbv7rrk+2xJA/7hw9g=
 software.sslmate.com/src/go-pkcs12 v0.7.3 h1:JBQD3FDqYjTeyDAeZQklj2ar88ykBLtALloPJHyAauU=
 software.sslmate.com/src/go-pkcs12 v0.7.3/go.mod h1:Qiz0EyvDRJjjxGyUQa2cCNZn/wMyzrRJ/qcDXOQazLI=
-tailscale.com v1.103.0-pre.0.20260925230348-6b3a45f14ef6 h1:H/nfBPPmQTKkkUCxGoNHK1glbluHJdYLd5pLtOg8Zzk=
-tailscale.com v1.103.0-pre.0.20260925230348-6b3a45f14ef6/go.mod h1:oLPYoi6W3O/zll4eTYVbWaBoWE1hMUdAE1fvuRxTfz0=
+tailscale.com v1.103.0-pre.0.20260929142145-a0e471a35b8f h1:a9y2RcAkvFGRsyloa8maBtoKmCc+TwwJpxbaWjrrt0I=
+tailscale.com v1.103.0-pre.0.20260929142145-a0e471a35b8f/go.mod h1:axJuLvuCmXen5u0tyk8KZBZsjW4Wn9AZ+LbzezqsLdk=
diff --git a/internal/buildtags/buildtags.go b/internal/buildtags/buildtags.go
index efbb0d97f..0c9c7b8f5 100644
--- a/internal/buildtags/buildtags.go
+++ b/internal/buildtags/buildtags.go
@@ -28,8 +28,10 @@ import (
 // wasmKeep is the set of tailscale.com feature tags the wasm build
 // needs linked, following cmd/tsconnect/wasmbuild. tailcat uses the
 // data plane only, so it needs little: netstack for userspace TCP
-// (wasm has no kernel TUN) and nothing else. Omitting the rest
-// shrinks the wasm binary by about 6 MB (18%).
+// (wasm has no kernel TUN) and nothing else. In particular it omits
+// udptransport and nattraversal, since a browser has no UDP sockets
+// and reaches peers over DERP only. Omitting the rest shrinks the
+// wasm binary by about 6 MB (18%).
 var wasmKeep = []featuretags.FeatureTag{
 	"netstack",
 }
@@ -46,14 +48,21 @@ var wasmKeep = []featuretags.FeatureTag{
 // rooted shell, where a plain Go binary has no working DNS, no CA
 // roots, and no interface enumeration; those packages detect Android
 // at runtime and are inert elsewhere. The wasm build needs no roots
-// because the browser does its own TLS. Note that
-// featuretags.Requires pulls in ssh's c2n and dbus dependencies too.
+// because the browser does its own TLS. Native builds also keep
+// nattraversal (STUN, disco hole punching, and the peer relay
+// client), which pulls in udptransport (UDP sockets to peers at all);
+// without them magicsock is DERP-only, and direct paths between peers
+// are the whole point of tailcat. The wasm build omits both: a browser
+// has no UDP sockets, so all of its traffic is relayed over DERP
+// regardless. Note that featuretags.Requires pulls in ssh's c2n and
+// dbus dependencies too.
 var releaseKeep = []featuretags.FeatureTag{
 	"netstack",
 	"ssh",
 	"gro",
 	"bakedroots",
 	"androidbin",
+	"nattraversal",
 }
 
 // WasmTags returns the comma-joined -tags value for the wasm build,
diff --git a/internal/buildtags/buildtags_test.go b/internal/buildtags/buildtags_test.go
index 37642d2c6..c38db8562 100644
--- a/internal/buildtags/buildtags_test.go
+++ b/internal/buildtags/buildtags_test.go
@@ -42,14 +42,14 @@ func TestTags(t *testing.T) {
 			t.Errorf("ReleaseTags contains %q; see the comment in buildtags.go", notWant)
 		}
 	}
-	for _, notWant := range []string{"ts_omit_netstack", "ts_omit_ssh", "ts_omit_gro", "ts_omit_c2n", "ts_omit_dbus"} {
+	for _, notWant := range []string{"ts_omit_netstack", "ts_omit_ssh", "ts_omit_gro", "ts_omit_c2n", "ts_omit_dbus", "ts_omit_udptransport", "ts_omit_nattraversal"} {
 		if release[notWant] {
 			t.Errorf("ReleaseTags contains %q; that feature must stay linked in release builds", notWant)
 		}
 	}
 
 	wasm := tagSet(t, WasmTags())
-	for _, want := range []string{"ts_omit_ssh", "ts_omit_gro"} {
+	for _, want := range []string{"ts_omit_ssh", "ts_omit_gro", "ts_omit_udptransport", "ts_omit_nattraversal"} {
 		if !wasm[want] {
 			t.Errorf("WasmTags missing %q", want)
 		}