diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 706cb8dc..97c94440 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -208,4 +208,5 @@ jobs:
       - name: Publish
         run: cargo ws publish --publish-as-is
         env:
+          TS_FFI_BUILDRS_STRICT: 1
           CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
diff --git a/ts_ffi/build.rs b/ts_ffi/build.rs
index 644ea4b9..acf1fcfb 100644
--- a/ts_ffi/build.rs
+++ b/ts_ffi/build.rs
@@ -11,7 +11,11 @@ fn main() {
         .generate()
         .unwrap();
 
-    bindings.write_to_file("tailscale.h");
+    // We're not supposed to generate anything outside of `OUT_DIR`, but it's useful
+    // as a convenience. Turn it off with this var (for use with publish).
+    if env::var("TS_FFI_BUILDRS_STRICT").is_err_and(|e| e == env::VarError::NotPresent) {
+        bindings.write_to_file("tailscale.h");
+    }
 
     let out = env::var("OUT_DIR").unwrap();
     let out = PathBuf::from(out);