diff --git a/go.mod b/go.mod
index 2d2d417524..a1b5054173 100644
--- a/go.mod
+++ b/go.mod
@@ -5,7 +5,7 @@ go 1.25.1
 require (
 	github.com/tailscale/wireguard-go v0.0.0-20250716170648-1d0488a3d7da
 	golang.org/x/mobile v0.0.0-20240806205939-81131f6468ab
-	tailscale.com v1.89.0-pre.0.20250929162250-7bcab4ab2841
+	tailscale.com v1.89.0-pre.0.20250930191317-9386a101d885
 )
 
 require (
diff --git a/go.sum b/go.sum
index 911c721b54..2260cea141 100644
--- a/go.sum
+++ b/go.sum
@@ -235,5 +235,5 @@ howett.net/plist v1.0.0 h1:7CrbWYbPPO/PyNy38b2EB/+gYbjCe2DXBxgtOOZbSQM=
 howett.net/plist v1.0.0/go.mod h1:lqaXoTrLY4hg8tnEzNru53gicrbv7rrk+2xJA/7hw9g=
 software.sslmate.com/src/go-pkcs12 v0.4.0 h1:H2g08FrTvSFKUj+D309j1DPfk5APnIdAQAB8aEykJ5k=
 software.sslmate.com/src/go-pkcs12 v0.4.0/go.mod h1:Qiz0EyvDRJjjxGyUQa2cCNZn/wMyzrRJ/qcDXOQazLI=
-tailscale.com v1.89.0-pre.0.20250929162250-7bcab4ab2841 h1:BfBXlsl/ffzlJoTCQL78hVmGGdRm//h/75lKIWOX79o=
-tailscale.com v1.89.0-pre.0.20250929162250-7bcab4ab2841/go.mod h1:LHaTiwRgzebPDLgZ6RQQVzX+1SR5fbNl51fzm7UtMaw=
+tailscale.com v1.89.0-pre.0.20250930191317-9386a101d885 h1:6q+2szaZyuooFtOIztf7z0RGPlTXBYhbY634FYkzLPM=
+tailscale.com v1.89.0-pre.0.20250930191317-9386a101d885/go.mod h1:LHaTiwRgzebPDLgZ6RQQVzX+1SR5fbNl51fzm7UtMaw=
diff --git a/libtailscale/keystore.go b/libtailscale/keystore.go
index b803de9444..bfb42dabfc 100644
--- a/libtailscale/keystore.go
+++ b/libtailscale/keystore.go
@@ -93,3 +93,7 @@ func (k *hardwareAttestationKey) Close() error {
 func (k *hardwareAttestationKey) Clone() key.HardwareAttestationKey {
 	return &hardwareAttestationKey{appCtx: k.appCtx, id: k.id, public: k.public}
 }
+
+func (k *hardwareAttestationKey) IsZero() bool {
+	return k == nil || k.id == "" || k.public == nil
+}