diff --git a/assert_ts_toolchain_match.go b/assert_ts_toolchain_match.go
index 901dbb8ec..4df0eeb15 100644
--- a/assert_ts_toolchain_match.go
+++ b/assert_ts_toolchain_match.go
@@ -17,10 +17,10 @@ func init() {
 		panic("binary built with tailscale_go build tag but failed to read build info or find tailscale.toolchain.rev in build info")
 	}
 	want := strings.TrimSpace(GoToolchainRev)
-	if os.Getenv("TS_GO_NEXT") == "1" {
-		want = strings.TrimSpace(GoToolchainNextRev)
-	}
-	if tsRev != want {
+	// Also permit the "next" toolchain rev, which is used in the main branch and will eventually become the new "current" rev.
+	// This allows building with TS_GO_NEXT=1 and then running the resulting binary without TS_GO_NEXT=1.
+	wantAlt := strings.TrimSpace(GoToolchainNextRev)
+	if tsRev != want && tsRev != wantAlt {
 		if os.Getenv("TS_PERMIT_TOOLCHAIN_MISMATCH") == "1" {
 			fmt.Fprintf(os.Stderr, "tailscale.toolchain.rev = %q, want %q; but ignoring due to TS_PERMIT_TOOLCHAIN_MISMATCH=1\n", tsRev, want)
 			return