diff --git a/.github/workflows/pull-request-kotlin.yml b/.github/workflows/pull-request-kotlin.yml
index 42cd0ae..20a1d9e 100644
--- a/.github/workflows/pull-request-kotlin.yml
+++ b/.github/workflows/pull-request-kotlin.yml
@@ -202,7 +202,8 @@ jobs:
         with:
           authkey: ${{ env.TAILSCALE_AUTHKEY }}
           hostname: "github-${{ github.run_id }}"
-          args: "--login-server https://headscale.monta.com --accept-routes"
+          # v4 passes --accept-routes itself; repeating it in args fails `tailscale up`
+          args: "--login-server https://headscale.monta.com"
       # Wait for the tailnet path to SonarQube to actually be usable before
       # scanning. `tailscale up` returns before DERP/route programming has
       # settled, so the scanner's first call (GET /api/v2/analysis/version)
diff --git a/.github/workflows/sonar-cloud.yml b/.github/workflows/sonar-cloud.yml
index 5cc32ca..f828870 100644
--- a/.github/workflows/sonar-cloud.yml
+++ b/.github/workflows/sonar-cloud.yml
@@ -108,7 +108,8 @@ jobs:
         with:
           authkey: ${{ env.TAILSCALE_AUTHKEY }}
           hostname: "github-${{ github.run_id }}"
-          args: "--login-server https://headscale.monta.com --accept-routes"
+          # v4 passes --accept-routes itself; repeating it in args fails `tailscale up`
+          args: "--login-server https://headscale.monta.com"
       - name: Run tests with coverage
         env:
           GHL_USERNAME: ${{ secrets.GHL_USERNAME }}