diff --git a/projects/tailscale/Dockerfile b/projects/tailscale/Dockerfile
index 58c3c0533bd3..0c928a08ad0b 100644
--- a/projects/tailscale/Dockerfile
+++ b/projects/tailscale/Dockerfile
@@ -15,13 +15,15 @@
 ################################################################################
 
 FROM gcr.io/oss-fuzz-base/base-builder-go
-RUN apt-get update && apt-get install -y wget
+
+# The Go version is intentionally not pinned here. tailscale's go.mod (`go`
+# directive) is the single source of truth; GOTOOLCHAIN=auto fetches a matching
+# toolchain at build time if the base image's bundled Go is older, and
+# fuzz/oss-fuzz.sh copies it to a writable dir so go-118-fuzz-build_v2 can
+# overlay its testing/fuzz.go. Bumping Go = editing go.mod in the tailscale repo;
+# this Dockerfile stays untouched.
+
 RUN git clone --depth 1 https://github.com/tailscale/tailscale
-RUN wget https://go.dev/dl/go1.23.1.linux-amd64.tar.gz \
-    && mkdir temp-go \
-    && rm -rf /root/.go/* \
-    && tar -C temp-go/ -xzf go1.23.1.linux-amd64.tar.gz \
-    && mv temp-go/go/* /root/.go/
 
 COPY build.sh $SRC/
 WORKDIR $SRC/tailscale
diff --git a/projects/tailscale/build.sh b/projects/tailscale/build.sh
index 47f281ad7798..c2507074d0ae 100644
--- a/projects/tailscale/build.sh
+++ b/projects/tailscale/build.sh
@@ -15,4 +15,4 @@
 #
 ################################################################################
 
-compile_go_fuzzer tailscale.com/net/stun FuzzStunParser stun_parser_fuzzer
+bash -x ./fuzz/oss-fuzz.sh