diff --git a/tunnel/Dockerfile.tailscale b/tunnel/Dockerfile.tailscale
index 21ad097a2..fba707762 100644
--- a/tunnel/Dockerfile.tailscale
+++ b/tunnel/Dockerfile.tailscale
@@ -27,7 +27,7 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} go build \
 # Copy tailscale binaries from the official upstream image pinned by digest.
 # tailscale is distributed as official OCI images; pinning by digest
 # ensures reproducible builds. The image ships both tailscaled and tailscale CLI.
-FROM tailscale/tailscale:v1.104.1@sha256:87c55d6be56ad85b3d8bceca5f87f73de288c609131460dd1be1874c250cc41d AS tailscale-stage
+FROM tailscale/tailscale:v1.104.2@sha256:b11583ad2e93e4671128538c88cf11f460444a5d7e449311dd1933a400ab849d AS tailscale-stage
 
 FROM gcr.io/distroless/static:nonroot
 WORKDIR /