diff --git a/go.mod b/go.mod
index 5500779028..2d2d417524 100644
--- a/go.mod
+++ b/go.mod
@@ -5,7 +5,7 @@ go 1.25.1
 require (
 	github.com/tailscale/wireguard-go v0.0.0-20250716170648-1d0488a3d7da
 	golang.org/x/mobile v0.0.0-20240806205939-81131f6468ab
-	tailscale.com v1.87.0-pre.0.20250909160301-77250a301aee
+	tailscale.com v1.89.0-pre.0.20250929162250-7bcab4ab2841
 )
 
 require (
@@ -54,7 +54,6 @@ require (
 	github.com/mdlayher/netlink v1.7.3-0.20250113171957-fbb4dce95f42 // indirect
 	github.com/mdlayher/sdnotify v1.0.0 // indirect
 	github.com/mdlayher/socket v0.5.0 // indirect
-	github.com/miekg/dns v1.1.58 // indirect
 	github.com/mitchellh/go-ps v1.0.0 // indirect
 	github.com/pierrec/lz4/v4 v4.1.21 // indirect
 	github.com/prometheus-community/pro-bing v0.4.0 // indirect
diff --git a/go.sum b/go.sum
index 508feb2797..911c721b54 100644
--- a/go.sum
+++ b/go.sum
@@ -235,5 +235,5 @@ howett.net/plist v1.0.0 h1:7CrbWYbPPO/PyNy38b2EB/+gYbjCe2DXBxgtOOZbSQM=
 howett.net/plist v1.0.0/go.mod h1:lqaXoTrLY4hg8tnEzNru53gicrbv7rrk+2xJA/7hw9g=
 software.sslmate.com/src/go-pkcs12 v0.4.0 h1:H2g08FrTvSFKUj+D309j1DPfk5APnIdAQAB8aEykJ5k=
 software.sslmate.com/src/go-pkcs12 v0.4.0/go.mod h1:Qiz0EyvDRJjjxGyUQa2cCNZn/wMyzrRJ/qcDXOQazLI=
-tailscale.com v1.87.0-pre.0.20250909160301-77250a301aee h1:BCJ6ux5S7jSv8OkbUHUISyKso+m5VMf9zJ6mQAsBZ+s=
-tailscale.com v1.87.0-pre.0.20250909160301-77250a301aee/go.mod h1:LHaTiwRgzebPDLgZ6RQQVzX+1SR5fbNl51fzm7UtMaw=
+tailscale.com v1.89.0-pre.0.20250929162250-7bcab4ab2841 h1:BfBXlsl/ffzlJoTCQL78hVmGGdRm//h/75lKIWOX79o=
+tailscale.com v1.89.0-pre.0.20250929162250-7bcab4ab2841/go.mod h1:LHaTiwRgzebPDLgZ6RQQVzX+1SR5fbNl51fzm7UtMaw=
diff --git a/libtailscale/backend.go b/libtailscale/backend.go
index 8503b77c90..e7cbb78f05 100644
--- a/libtailscale/backend.go
+++ b/libtailscale/backend.go
@@ -288,7 +288,7 @@ func (a *App) newBackend(dataDir string, appCtx AppContext, store *stateStore,
 		log.Printf("netmon.New: %w", err)
 	}
 	b.netMon = netMon
-	b.setupLogs(dataDir, logID, logf, sys.HealthTracker())
+	b.setupLogs(dataDir, logID, logf, sys.HealthTracker.Get())
 	dialer := new(tsdial.Dialer)
 	vf := &VPNFacade{
 		SetBoth:           b.setCfg,
@@ -302,7 +302,7 @@ func (a *App) newBackend(dataDir string, appCtx AppContext, store *stateStore,
 		Dialer:         dialer,
 		SetSubsystem:   sys.Set,
 		NetMon:         b.netMon,
-		HealthTracker:  sys.HealthTracker(),
+		HealthTracker:  sys.HealthTracker.Get(),
 		Metrics:        sys.UserMetricsRegistry(),
 		DriveForLocal:  driveimpl.NewFileSystemForLocal(logf),
 		EventBus:       sys.Bus.Get(),
diff --git a/libtailscale/keystore.go b/libtailscale/keystore.go
index 20150dc932..b803de9444 100644
--- a/libtailscale/keystore.go
+++ b/libtailscale/keystore.go
@@ -89,3 +89,7 @@ func (k *hardwareAttestationKey) Close() error {
 	}
 	return k.appCtx.HardwareAttestationKeyRelease(k.id)
 }
+
+func (k *hardwareAttestationKey) Clone() key.HardwareAttestationKey {
+	return &hardwareAttestationKey{appCtx: k.appCtx, id: k.id, public: k.public}
+}