diff --git a/Dockerfile.derper b/Dockerfile.derper
index 905faa09..c108b220 100644
--- a/Dockerfile.derper
+++ b/Dockerfile.derper
@@ -2,6 +2,12 @@
 
 FROM golang:1.27.1-alpine AS build-env
 
+# The builder pin is a floor, not a ceiling: this stage compiles a tailscale
+# tree cloned from an unpinned branch, which can raise its go directive at any
+# time. The golang images set GOTOOLCHAIN=local, which turns that into a hard
+# build failure rather than a toolchain fetch.
+ENV GOTOOLCHAIN=auto
+
 WORKDIR /go/src
 
 RUN apk add --no-cache git
diff --git a/Dockerfile.tailscale-HEAD b/Dockerfile.tailscale-HEAD
index a57a4ca4..2a033951 100644
--- a/Dockerfile.tailscale-HEAD
+++ b/Dockerfile.tailscale-HEAD
@@ -6,6 +6,12 @@
 
 FROM golang:1.27.1-alpine AS build-env
 
+# The builder pin is a floor, not a ceiling: this stage compiles a tailscale
+# tree cloned from an unpinned branch, which can raise its go directive at any
+# time. The golang images set GOTOOLCHAIN=local, which turns that into a hard
+# build failure rather than a toolchain fetch.
+ENV GOTOOLCHAIN=auto
+
 WORKDIR /go/src
 
 RUN apk add --no-cache git