diff --git a/cmd/k8s-operator/depaware.txt b/cmd/k8s-operator/depaware.txt
index c871bf75a..68941dbf9 100644
--- a/cmd/k8s-operator/depaware.txt
+++ b/cmd/k8s-operator/depaware.txt
@@ -730,6 +730,7 @@ tailscale.com/cmd/k8s-operator dependencies: (generated by github.com/tailscale/
         tailscale.com/envknob                                        from tailscale.com/client/local+
         tailscale.com/envknob/featureknob                            from tailscale.com/client/web+
         tailscale.com/feature                                        from tailscale.com/ipn/ipnext+
+        tailscale.com/feature/acme                                   from tailscale.com/tsnet
         tailscale.com/feature/buildfeatures                          from tailscale.com/wgengine/magicsock+
         tailscale.com/feature/c2n                                    from tailscale.com/tsnet
         tailscale.com/feature/condlite/expvar                        from tailscale.com/wgengine/magicsock
diff --git a/cmd/tsidp/depaware.txt b/cmd/tsidp/depaware.txt
index e2f26d63f..456aa9881 100644
--- a/cmd/tsidp/depaware.txt
+++ b/cmd/tsidp/depaware.txt
@@ -147,6 +147,7 @@ tailscale.com/cmd/tsidp dependencies: (generated by github.com/tailscale/depawar
         tailscale.com/envknob                                        from tailscale.com/client/local+
         tailscale.com/envknob/featureknob                            from tailscale.com/client/web+
         tailscale.com/feature                                        from tailscale.com/ipn/ipnext+
+        tailscale.com/feature/acme                                   from tailscale.com/tsnet
         tailscale.com/feature/buildfeatures                          from tailscale.com/wgengine/magicsock+
         tailscale.com/feature/c2n                                    from tailscale.com/tsnet
         tailscale.com/feature/condlite/expvar                        from tailscale.com/wgengine/magicsock
diff --git a/tsnet/depaware.txt b/tsnet/depaware.txt
index 2e8a15e20..f3b7ad6f1 100644
--- a/tsnet/depaware.txt
+++ b/tsnet/depaware.txt
@@ -143,6 +143,7 @@ tailscale.com/tsnet dependencies: (generated by github.com/tailscale/depaware)
         tailscale.com/envknob                                        from tailscale.com/client/local+
         tailscale.com/envknob/featureknob                            from tailscale.com/client/web+
         tailscale.com/feature                                        from tailscale.com/ipn/ipnext+
+        tailscale.com/feature/acme                                   from tailscale.com/tsnet
         tailscale.com/feature/buildfeatures                          from tailscale.com/wgengine/magicsock+
         tailscale.com/feature/c2n                                    from tailscale.com/tsnet
         tailscale.com/feature/condlite/expvar                        from tailscale.com/wgengine/magicsock
diff --git a/tsnet/maybe_acme.go b/tsnet/maybe_acme.go
new file mode 100644
index 000000000..41941a0a0
--- /dev/null
+++ b/tsnet/maybe_acme.go
@@ -0,0 +1,12 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !js && !ts_omit_acme
+
+package tsnet
+
+// Link in the ACME/TLS-cert feature so [Server.CertDomains],
+// [Server.ListenTLS], and related cert-fetch paths work out of the box.
+// Build with the ts_omit_acme tag to omit it.
+
+import _ "tailscale.com/feature/acme"