diff --git a/README.md b/README.md
index 7b62c07..29bcb12 100644
--- a/README.md
+++ b/README.md
@@ -212,7 +212,8 @@ configure
 
 It covers:
 
-- **Your Federated Computer Core.** Give it your Superpanel's address (e.g. https://superpanel.example.com), your Core email, name and password, and it adds Superpanel to your applications, joins this computer to your Core's Tailscale network, adds your Nextcloud (calendar, contacts and files) and email to GNOME's Online Accounts, and mounts your Nextcloud files at /mnt/example.com ("example.com" in the Files sidebar), and points Element at your Core's Matrix server. For Nextcloud and the files it creates a Nextcloud app password, which you can revoke in Nextcloud under Settings > Security.
+- **Your Federated Computer Core.** Give it your Superpanel's address (e.g. https://superpanel.example.com), your Core email, name and password, and it adds Superpanel to your applications, adds your Nextcloud (calendar, contacts and files) and email to GNOME's Online Accounts, and mounts your Nextcloud files at /mnt/example.com ("example.com" in the Files sidebar), and points Element at your Core's Matrix server. For Nextcloud and the files it creates a Nextcloud app password, which you can revoke in Nextcloud under Settings > Security.
+- **Your Core's Tailscale network.** Joins this computer to it through headscale.example.com, so you can reach your other machines on it. Set up your Core first. You sign in through a link it shows you; if this computer is on another Tailscale network, it moves it to your Core's.
 - **Daily backups of your home folder** to your Nextcloud files, in a .backup-{machine name} folder, with restic. Set up your Core first. The backup is encrypted with a passphrase that `configure` shows you once: save it somewhere other than this computer, such as Bitwarden. It keeps 7 daily, 4 weekly and 6 monthly backups, and leaves out caches and things that can be reinstalled. To leave out more, list paths in ~/.config/coredesktop/backup-exclude, one per line. restic reaches Nextcloud directly through rclone with its own Nextcloud app password, so the backup doesn't depend on the /mnt mount. See "Restoring from a backup" below.
 - Signing in to Claude Code, opencode and Hermes Agent and choosing their model providers.
 
diff --git a/configure.d/10-core.sh b/configure.d/10-core.sh
index c88cadd..0eb3376 100755
--- a/configure.d/10-core.sh
+++ b/configure.d/10-core.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 
 TITLE="Federated Computer Core"
-DESCRIPTION="Superpanel, Tailscale, Nextcloud, email, files and Element"
+DESCRIPTION="Superpanel, Nextcloud, email, files and Element"
 
 # What you entered last time, so running this again only does what's missing
 CORE_CONF="$HOME/.config/coredesktop/core.conf"
@@ -24,13 +24,6 @@ superpanel_done() {
   [ -f "$SUPERPANEL_DESKTOP" ]
 }
 
-# Tailscale has no status field naming its login server, so core.conf
-# records that it was set up for this Core
-tailscale_done() {
-  [ "$CORE_TAILSCALE" = "$CORE_DOMAIN" ] \
-    && tailscale status --json 2> /dev/null | jq -e '.BackendState == "Running"' > /dev/null
-}
-
 nextcloud_done() {
   "$GOA_ACCOUNT" exists owncloud "$CORE_USER@nextcloud.$CORE_DOMAIN" 2> /dev/null
 }
@@ -58,7 +51,7 @@ element_done() {
 is_configured() {
   [ -n "$CORE_DOMAIN" ] || return 1
   core_names
-  superpanel_done && tailscale_done && nextcloud_done && email_done && files_done && element_done
+  superpanel_done && nextcloud_done && email_done && files_done && element_done
 }
 
 save_conf() {
@@ -67,7 +60,6 @@ save_conf() {
     printf 'CORE_DOMAIN=%q\n' "$CORE_DOMAIN"
     printf 'CORE_EMAIL=%q\n' "$CORE_EMAIL"
     printf 'CORE_NAME=%q\n' "$CORE_NAME"
-    printf 'CORE_TAILSCALE=%q\n' "$CORE_TAILSCALE"
   } > "$CORE_CONF"
 }
 
@@ -100,19 +92,6 @@ setup_superpanel() {
   echo "Added Superpanel to your applications."
 }
 
-setup_tailscale() {
-  # --reset and --force-reauth move the machine from any other tailnet;
-  # --operator lets you, and the Tailscale GNOME extension, use it without sudo
-  if ! systemctl is-active -q tailscaled; then
-    sudo systemctl enable --now tailscaled || return 1
-  fi
-  echo "Open the link below to sign in to your Core's Tailscale network."
-  sudo tailscale up --reset --force-reauth --login-server "https://headscale.$CORE_DOMAIN" \
-    --accept-routes --operator="$USER" || return 1
-  CORE_TAILSCALE="$CORE_DOMAIN"
-  save_conf
-}
-
 setup_nextcloud() {
   [ -n "$APP_PASSWORD" ] || { echo "This needs your Core password, and Nextcloud didn't accept it."; return 1; }
   "$GOA_ACCOUNT" add << EOF || return 1
@@ -320,7 +299,6 @@ run_configure() {
 
   echo
   step superpanel "Superpanel in your applications"
-  step tailscale "Tailscale with your Core (headscale.$CORE_DOMAIN)"
   step nextcloud "Nextcloud in Online Accounts"
   step email "Email in Online Accounts"
   step files "Nextcloud files at $MOUNT"
diff --git a/configure.d/15-tailscale.sh b/configure.d/15-tailscale.sh
new file mode 100644
index 0000000..e0243e3
--- /dev/null
+++ b/configure.d/15-tailscale.sh
@@ -0,0 +1,40 @@
+#!/bin/bash
+
+TITLE="Tailscale"
+DESCRIPTION="Join your Core's Tailscale network"
+
+CORE_CONF="$HOME/.config/coredesktop/core.conf"
+TAILSCALE_CONF="$HOME/.config/coredesktop/tailscale.conf"
+[ -f "$CORE_CONF" ] && source "$CORE_CONF"
+[ -f "$TAILSCALE_CONF" ] && source "$TAILSCALE_CONF"
+
+is_installed() {
+  command -v tailscale
+}
+
+# Tailscale has no status field naming its login server, so tailscale.conf
+# records which Core it was set up for
+is_configured() {
+  [ -n "$CORE_DOMAIN" ] && [ "$TAILSCALE_DOMAIN" = "$CORE_DOMAIN" ] \
+    && tailscale status --json 2> /dev/null | jq -e '.BackendState == "Running"' > /dev/null
+}
+
+run_configure() {
+  if [ -z "$CORE_DOMAIN" ]; then
+    echo "This joins your Core's Tailscale network, so set up your Core first: configure core"
+    return 1
+  fi
+
+  # --reset and --force-reauth move the machine from any other tailnet;
+  # --operator lets you, and the Tailscale GNOME extension, use it without sudo
+  if ! systemctl is-active -q tailscaled; then
+    sudo systemctl enable --now tailscaled || return 1
+  fi
+  echo "Open the link below to sign in to your Core's Tailscale network (headscale.$CORE_DOMAIN)."
+  sudo tailscale up --reset --force-reauth --login-server "https://headscale.$CORE_DOMAIN" \
+    --accept-routes --operator="$USER" || return 1
+
+  mkdir -p "$(dirname "$TAILSCALE_CONF")"
+  printf 'TAILSCALE_DOMAIN=%q\n' "$CORE_DOMAIN" > "$TAILSCALE_CONF"
+  echo "This computer is on your Core's Tailscale network."
+}
diff --git a/migrations/1793101958.sh b/migrations/1793101958.sh
new file mode 100644
index 0000000..9352ea0
--- /dev/null
+++ b/migrations/1793101958.sh
@@ -0,0 +1,13 @@
+#!/bin/bash
+
+# Tailscale moved out of "configure core" into its own item, which records the
+# Core it joined in tailscale.conf rather than core.conf
+CORE_CONF="$HOME/.config/coredesktop/core.conf"
+TAILSCALE_CONF="$HOME/.config/coredesktop/tailscale.conf"
+
+[ -f "$CORE_CONF" ] || exit 0
+CORE_TAILSCALE="$(source "$CORE_CONF" && echo "$CORE_TAILSCALE")"
+if [ -n "$CORE_TAILSCALE" ] && [ ! -f "$TAILSCALE_CONF" ]; then
+  printf 'TAILSCALE_DOMAIN=%q\n' "$CORE_TAILSCALE" > "$TAILSCALE_CONF" || exit 1
+fi
+sed -i '/^CORE_TAILSCALE=/d' "$CORE_CONF"