diff --git a/integration/embedded_derp_test.go b/integration/embedded_derp_test.go
index 7f73bd38..046f3890 100644
--- a/integration/embedded_derp_test.go
+++ b/integration/embedded_derp_test.go
@@ -245,7 +245,7 @@ func (s *EmbeddedDERPServerScenario) CreateHeadscaleEnv(
 			err = s.CreateTailscaleIsolatedNodesInUser(
 				hash,
 				userName,
-				"head",
+				tsic.VersionHead,
 				clientCount.WebsocketDERP,
 				tsic.WithWebsocketDERP(true),
 			)
diff --git a/integration/tsic/tsic.go b/integration/tsic/tsic.go
index bfaa70b6..b0bd7a60 100644
--- a/integration/tsic/tsic.go
+++ b/integration/tsic/tsic.go
@@ -194,6 +194,10 @@ func WithNetfilter(state string) Option {
 // Attempts to use it with any other version is a bug in the calling code.
 func WithBuildTag(tag string) Option {
 	return func(tsic *TailscaleInContainer) {
+		if tsic.version != VersionHead {
+			panic(errInvalidClientConfig)
+		}
+
 		tsic.buildConfig.tags = append(
 			tsic.buildConfig.tags, tag,
 		)