Blog|productJuly 25, 2025

This month at Tailscale: Tailnet Lock, Control plane IP changes, and headless Windows runners

Image of stacked shapes in various shades of green, against a darker green background.

We continuously ship updates to make your network more reliable, manageable, and secure. Each month, we highlight some of the most impactful changes across clients, admin tools, integrations, and infrastructure—so you can stay on top of what’s new and what’s better.

This month's updates include the general availability of Tailnet Lock, a shift and simplification in Tailscale's control-plane domains, and a fix to GitHub Actions on headless Windows runners. For instructions on how to update to the latest version, visit our update guide.

Tailnet Lock is generally available

Tailnet Lock, first introduced in December 2022, provides even more security and control for your tailnet by allowing you to take over control of signing nodes and keys. With Tailnet Lock, you can use Tailscale without having to trust Tailscale. After testing with thousands of tailnets, Tailnet Lock is now ready for production use.

Tailnet Lock uses a Trust On First Use (TOFU) model, letting you create your signing nodes and disablement secrets, then removing Tailscale's role from signing on new nodes to your tailnet. It's up to you whether you share a disablement secret with Tailscale's support team, offering a way to disable Tailnet Lock in case of emergency. Since Tailnet Lock's announcement, we've also added safeguards against removing all signing nodes, and included webhook events to help with node signing, alerts, and audits.

You can read more on how Tailnet Lock works in our whitepaper and get started with it using our documentation.

Changes to Tailscale's control plane IP ranges

Tailscale does not typically require firewall rule changes to function. But if IP-based firewall rules are necessary, Tailscale can be managed with the IPv4 range 192.200.0.0/24 and the IPv6 range 2606:B740:49::/48 . More information is available in our docs on firewall ports.