Tailscale Bought a PAM Company and Repriced to Seats in One Quarter: What It Actually Costs to Stay on Headscale

Two events, six weeks apart, tell opposite stories about the same company. On March 17, 2026, Tailscale made its first-ever acquisition: Border0, a privileged-access-management (PAM) startup that adds session recording and protocol-aware controls for SSH, RDP, and database access. On April 8, it flipped its business plans from usage-based billing to flat per-seat pricing — Standard at $8/seat/month, Premium at $18/seat/month. One move adds a compliance layer no open-source project can casually replicate. The other makes the bill for not using that layer completely predictable, and, for some teams, considerably higher.

If you run Headscale — the open-source reimplementation of Tailscale's control plane — both moves land on your desk at once: what does staying on the free, self-hosted alternative actually cost you in dollars, and what does it cost you in the capability Tailscale just bought?

What Pricing v4 Actually Changed​

Tailscale's business tiers used to bill retrospectively on active users in a billing period — the old Starter plan ran roughly $6–7 per active user per month. Pricing v4 replaces that with a flat per-seat charge, billed whether or not that seat logs in that month: Standard at $8/seat/month, Premium unchanged at $18/seat/month. Tailscale's own stated reason is billing predictability — procurement teams wanted a number they could forecast and compare against seat-priced competitors, not a bill that moved with usage.

For a team where most provisioned seats are actually active most months, the change is a modest increase — moving from ~$6.50/active-user to a flat $8/seat is roughly a 15–23% bump on the equivalent tier. But usage-based billing's whole value was that idle seats were free, and plenty of infrastructure-access setups have exactly that shape: contractors with standing access rarely used, service accounts, rotating on-call credentials. One Hacker News commenter running an eight-person startup reported their bill jumping from $6–12/month to $64/month under the new model — worth naming clearly as the edge case it is (only one or two of eight seats were active in a typical month), not the typical one, but it's precisely the scenario usage-based pricing used to make cheap and seat-based pricing now prices at full rate regardless.

Tailscale isn't forcing this on existing customers overnight — it's giving current accounts at least a 12-month window before any mandatory migration to the new plans, and sweetening the free Personal tier along the way (now covering up to six users with unlimited user-owned devices, plus self-serve additions like SCIM, device posture checks, and webhooks that used to require a sales conversation). That's a real grace period for teams to model their actual utilization before the flat rate applies — but it's also a year-long countdown, not a permanent reprieve, and the math below is what it counts down to.

At team scale, here's what both tiers cost flat, no utilization discount:

That 90%-utilization column is the typical case — a team that actually uses most of what it provisions. The gap between it and flat seat pricing is real but not dramatic. The gap becomes dramatic exactly when utilization drops, which is the scenario seat pricing structurally can't discount for anymore.

The Actual Cost of Staying on Headscale​

Headscale needs almost nothing to run. Community deployment guides and the project's own requirements docs put a functional instance on a single-vCPU, 1 GB VPS — Hetzner's CX22 (2 vCPU, 4 GB RAM) at €4.49/month (~$4.85) is comfortably more than enough. It handles "hundreds of devices" without issue as long as network topology isn't changing constantly; documented reports put the practical ceiling around 300 devices before the cost of recalculating the network map on every join/leave event starts to bite. For a 50- or 100-person team, that's headroom, not a wall you're already up against — but it's a real ceiling worth knowing about before you plan a Headscale instance for a 500-person org.

Put side by side against the pricing table above, at 50 seats: $4.85/month self-hosted vs. $400–$900/month on Tailscale. At 100 seats: $4.85/month vs. $800–$1,800/month. The delta isn't close. If the only thing you need is the mesh network — devices reaching each other over WireGuard, coordinated by a control plane — Headscale gets there for the cost of a coffee subscription while Tailscale's new flat-seat model makes clear exactly how much you're paying for something else.

What "Something Else" Now Includes​

That something else is where Border0 matters. Founded to handle infrastructure-access workflows — SSH, Kubernetes access, RDP and VNC for remote admin, database access controls, session recording, and command/query visibility — Border0 was a seven-person, Vancouver-based startup before its March 17 acquisition, Tailscale's first ever. The whole team joined Tailscale as part of the deal, with founder Andree Toonk becoming Director of Engineering to lead the resulting PAM effort. That's a meaningful detail: Tailscale didn't license a feature or bolt on an integration, it acquired the engineers who built the thing, specifically to build it deeper into Tailscale's own product rather than keep it as a bolt-on.

Headscale's 2026 feature set is, by design, a faithful reimplementation of Tailscale's coordination protocol — it gets devices talking to each other. It does not, and structurally can't easily, replicate what Border0 adds: session recording for SSH/RDP/database access, protocol-aware access controls that understand the difference between an SSH command and a database query, and approval workflows gating access to sensitive systems. Tailscale's own roadmap description frames these as evolving into a native PAM offering built on the Border0 team's work — not a config flag, but backend infrastructure: recording pipelines, audit storage, protocol proxies per access type, and the compliance surface (data retention, access logs, who-approved-what) that goes with any of it. That's the kind of investment an open-source coordinator run by volunteers and part-time maintainers doesn't take on casually — not because nobody could write the code, but because operating it (storing recordings securely, keeping audit trails tamper-evident, supporting it when a customer's compliance auditor has questions) is a different, ongoing commitment than shipping a connectivity daemon.

Headscale's current gaps mirror this precisely: no SSH session recording, no native SSO console (you wire up OIDC yourself), no vendor-run compliance backend, community-only support. None of that is a bug in Headscale — it's an open-source coordinator, not a security product — but it means the two projects are diverging in exactly the direction their pricing suggests. Tailscale is monetizing a bundle it's actively expanding; Headscale gives you the part of that bundle that was always the least differentiated to begin with — box-to-box connectivity — for free.

Where the Cost Argument Still Wins, and Where It Doesn't​

The decision isn't "cost vs. no cost" — it's which side of Tailscale's growing bundle a given team actually needs:

1. Pure mesh connectivity, no regulated access requirement: a dev team wiring together internal services, a homelab, a fleet of machines that need to reach each other securely — Headscale's $4.85/month wins outright. There's no PAM requirement to give up.
2. Infrastructure with an audit trail requirement: production database access, SSH into systems handling regulated data, anything where "who ran what command, and did someone approve it" is a compliance question rather than a nice-to-have — that's exactly the gap Border0 is built to close, and it's not a gap Headscale is trying to close. Managed Tailscale (or building the equivalent yourself) is the honest answer here, seat pricing notwithstanding.
3. In between — mesh today, PAM later: nothing about running Headscale now forecloses adding a dedicated PAM layer later for the specific systems that need it, rather than paying seat prices across an entire team's connectivity for a capability only a subset of that access actually requires.

The pricing change makes the first case's math unambiguous. The acquisition makes the second case's requirement unambiguous too. What it doesn't do is create a reason to pay seat prices for connectivity alone — that math hasn't changed, and Headscale's answer to it is still a rounding error on a cloud bill.

Bex.co is the open-source, AI-native Render alternative — push a git repo, get a running HTTPS service on machines you own. The network layer connecting your build pipeline, your nodes, and your operators is one more piece of infrastructure worth owning outright rather than renting by the seat. Star the repo on GitHub or deploy your first app today.

Sources​

• Tailscale pricing update: clearer plans, more value
• Tailscale pricing
• Border0 is joining Tailscale
• Border0 joins Tailscale — FAQs
• Tailscale makes first acquisition with Border0 purchase — BetaKit
• Tailscale's Pricing v4 — Hacker News discussion
• Headscale — Requirements and Assumptions
• Headscale — Features
• Hetzner Cloud pricing — CX22