headscale v0.29.3 released on 29-07-2026
headscale v0.29.3 is out now. It restores expected tag semantics and ownership checks, improves ephemeral node reconnect and registration timing reliability, and hardens follow-up registration and capability checks.
See the release notes on GitHub and follow the official upgrade guide at https://headscale.net/stable/setup/upgrade/ for full details.
What’s in this release
- Tagging and re-registration fixes: tagged nodes no longer get stuck expired after a tailscale logout; re-registering a tagged node with a different pre-auth key now applies the new key’s tags; re-authenticating with –advertise-tags is accepted when the authenticating user owns those tags (PRs: #3394).
- Ephemeral node and registration reliability: ephemeral nodes no longer linger disconnected after reconnect churn because GC/polling waits for Connect success before cancelling cleanup; registration requests now prefer completed auth over expired request contexts to avoid false “401 registration timed out” errors (PRs: #3383, #3392).
- Security hardening: the follow-up registration poll verifies the machine key to prevent leaked auth ID impersonation, and /key requests are rejected when the client capability version is below the supported floor (PRs: #3393, #3391).
Upgrade notes
- Follow the official upgrade guide at https://headscale.net/stable/setup/upgrade/ when updating. Minimum supported Tailscale client version: v1.80.0.
- Build and tooling updates include a Go toolchain bump to 1.26.5 and documentation tooling updates; consult the upgrade guide for compatibility details.
Share any comments on your experience upgrading to or running v0.29.3 on the project’s GitHub; feedback on tag and ephemeral node behaviour will be particularly useful.
