Depot CI now supports Tailscale | Changelog

Depot CI jobs can now join your Tailscale tailnet, so builds and tests can reach private services like internal databases, clusters, and APIs without exposing them to the public internet or maintaining static IP allow lists. Previously, this was available for Depot GitHub Actions runners and container builders, but CI jobs couldn't reach anything inside your private network.

Connect your organization to Tailscale once in your org settings, and CI jobs will join your tailnet as ephemeral nodes, tagged so you can control their access with Tailscale ACLs. For example, grant CI jobs access to a private database:

{
  "acls": [{"action": "accept", "src": ["tag:depot-runner"], "dst": ["database-hostname"]}]
}

See the Tailscale integration docs for the full setup.