diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index f73e8178d..cb283a8b8 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -23,9 +23,6 @@ env:
 
 on:
   push:
-    branches:
-      - "main"
-      - "release-branch/*"
   pull_request:
     # all PRs on all branches
   merge_group:
@@ -263,6 +260,7 @@ jobs:
     - name: test
       if: matrix.key != 'win-bench' # skip on bench builder
       working-directory: src
+      shell: bash
       run: ./tool/go run ./cmd/testwrapper sharded:${{ matrix.shard }}
       env:
         NOPWSHDEBUG: "true" # to quiet tool/gocross/gocross-wrapper.ps1 in CI
@@ -270,13 +268,8 @@ jobs:
     - name: bench all
       if: matrix.key == 'win-bench'
       working-directory: src
-      # Don't use -bench=. -benchtime=1x.
-      # Somewhere in the layers (powershell?)
-      # the equals signs cause great confusion.
-      # Don't use -run "^$" either; the ^ is cmd.exe's escape
-      # character, so go.cmd's cmd.exe layer eats it, turning
-      # -run "^$" into -run "$" which matches all test names.
-      run: ./tool/go test ./... -bench . -benchtime 1x -run XXXXNothingXXXX
+      shell: bash
+      run: ./tool/go test ./... -bench=. -benchtime=1x -run="^^$"
       env:
         NOPWSHDEBUG: "true" # to quiet tool/gocross/gocross-wrapper.ps1 in CI
 
diff --git a/tool/go-win.ps1 b/tool/go-win.ps1
deleted file mode 100644
index 49313ffba..000000000
--- a/tool/go-win.ps1
+++ /dev/null
@@ -1,64 +0,0 @@
-<#
-  go.ps1 – Tailscale Go toolchain fetching wrapper for Windows/PowerShell
-  • Reads go.toolchain.rev one dir above this script
-  • If the requested commit hash isn't cached, downloads and unpacks
-    https://github.com/tailscale/go/releases/download/build-${REV}/${OS}-${ARCH}.tar.gz
-  • Finally execs the toolchain's "go" binary, forwarding all args & exit-code
-#>
-
-param(
-    [Parameter(ValueFromRemainingArguments = $true)]
-    [string[]] $Args
-)
-
-Set-StrictMode -Version Latest
-$ErrorActionPreference = 'Stop'
-
-if ($env:CI -eq 'true' -and $env:NODEBUG -ne 'true') {
-    $VerbosePreference = 'Continue'
-}
-
-$repoRoot = Resolve-Path (Join-Path $PSScriptRoot '..')
-$REV      = (Get-Content (Join-Path $repoRoot 'go.toolchain.rev') -Raw).Trim()
-
-if ([IO.Path]::IsPathRooted($REV)) {
-    $toolchain = $REV
-} else {
-    if (-not [string]::IsNullOrWhiteSpace($env:TSGO_CACHE_ROOT)) {
-        $cacheRoot = $env:TSGO_CACHE_ROOT
-    } else {
-        $cacheRoot = Join-Path $env:USERPROFILE '.cache\tsgo'
-    }
-
-    $toolchain = Join-Path $cacheRoot $REV
-    $marker    = "$toolchain.extracted"
-
-    if (-not (Test-Path $marker)) {
-        Write-Host "# Downloading Go toolchain $REV" -ForegroundColor Cyan
-        if (Test-Path $toolchain) { Remove-Item -Recurse -Force $toolchain }
-
-        # Removing the marker file again (even though it shouldn't still exist)
-        # because the equivalent Bash script also does so (to guard against
-        # concurrent cache fills?).
-        # TODO(bradfitz): remove this and add some proper locking instead?
-        if (Test-Path $marker   ) { Remove-Item -Force $marker    }
-
-        New-Item -ItemType Directory -Path $cacheRoot -Force | Out-Null
-
-        $url  = "https://github.com/tailscale/go/releases/download/build-$REV/windows-amd64.tar.gz"
-        $tgz  = "$toolchain.tar.gz"
-        Invoke-WebRequest -Uri $url -OutFile $tgz -UseBasicParsing -ErrorAction Stop
-
-        New-Item -ItemType Directory -Path $toolchain -Force | Out-Null
-        tar --strip-components=1 -xzf $tgz -C $toolchain
-        Remove-Item $tgz
-        Set-Content -Path $marker -Value $REV
-    }
-}
-
-$goExe = Join-Path $toolchain 'bin\go.exe'
-if (-not (Test-Path $goExe)) { throw "go executable not found at $goExe" }
-
-& $goExe @Args
-exit $LASTEXITCODE
-
diff --git a/tool/go.cmd b/tool/go.cmd
deleted file mode 100644
index b7b5d0483..000000000
--- a/tool/go.cmd
+++ /dev/null
@@ -1,36 +0,0 @@
-@echo off
-rem Checking for PowerShell Core using PowerShell for Windows...
-powershell -NoProfile -NonInteractive -Command "& {Get-Command -Name pwsh -ErrorAction Stop}" > NUL
-if ERRORLEVEL 1 (
-  rem Ask the user whether they should install the dependencies. Note that this
-  rem code path never runs in CI because pwsh is always explicitly installed.
-
-  rem Time out after 5 minutes, defaulting to 'N'
-  choice /c yn /t 300 /d n /m "PowerShell Core is required. Install now"
-  if ERRORLEVEL 2 (
-    echo Aborting due to unmet dependencies.
-    exit /b 1
-  )
-
-  rem Check for a .NET Core runtime using PowerShell for Windows...
-  powershell -NoProfile -NonInteractive -Command "& {if (-not (dotnet --list-runtimes | Select-String 'Microsoft\.NETCore\.App' -Quiet)) {exit 1}}" > NUL
-  rem Install .NET Core if missing to provide PowerShell Core's runtime library.
-  if ERRORLEVEL 1 (
-    rem Time out after 5 minutes, defaulting to 'N'
-    choice /c yn /t 300 /d n /m "PowerShell Core requires .NET Core for its runtime library. Install now"
-    if ERRORLEVEL 2 (
-      echo Aborting due to unmet dependencies.
-      exit /b 1
-    )
-
-    winget install --accept-package-agreements --id Microsoft.DotNet.Runtime.8 -e --source winget
-  )
-
-  rem Now install PowerShell Core.
-  winget install --accept-package-agreements --id Microsoft.PowerShell -e --source winget
-  if ERRORLEVEL 0 echo Please re-run this script within a new console session to pick up PATH changes.
-  rem Either way we didn't build, so return 1.
-  exit /b 1
-)
-
-pwsh -NoProfile -ExecutionPolicy Bypass "%~dp0..\tool\gocross\gocross-wrapper.ps1" %*