diff --git a/.github/workflows/go-generate-without-stringer.sh b/.github/workflows/go-generate-without-stringer.sh
new file mode 100755
index 0000000000000..796c047383436
--- /dev/null
+++ b/.github/workflows/go-generate-without-stringer.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env sh
+#
+# This is a temporary hack to work around
+# https://github.com/golang/go/issues/51629 , wherein the stringer
+# generator doesn't work with generics.
+#
+# This script is the equivalent of `go generate ./...`, except that it
+# only runs generate on packages that don't try to use stringer.
+
+find . -name '*.go' | xargs grep -l go:generate | xargs -n1 dirname | sort -u | while read dir; do
+	if ! grep cmd/stringer $dir/*.go; then
+		set -x
+		go generate -tags=hermetic $dir
+		set +x
+	fi
+done
diff --git a/.github/workflows/go_generate.yml b/.github/workflows/go_generate.yml
index 4f98ef9ad36a1..ca6ce1b5d9e63 100644
--- a/.github/workflows/go_generate.yml
+++ b/.github/workflows/go_generate.yml
@@ -25,6 +25,10 @@ jobs:
           fetch-depth: 0
 
       - name: check 'go generate' is clean
+        # The shell script invocation below is a temporary hack for
+        # https://github.com/tailscale/tailscale/issues/4194. When
+        # that issue is fixed, replace its invocation with:
+        # go generate --tags=hermetic ./...
         run: |
           if [[ "${{github.ref}}" == release-branch/* ]]
           then
@@ -32,7 +36,7 @@ jobs:
           else
             pkgs=$(go list ./... | grep -v dnsfallback)
           fi
-          go generate $pkgs
+          ./.github/workflows/go-generate-without-stringer.sh
           echo
           echo
           git diff --name-only --exit-code || (echo "The files above need updating. Please run 'go generate'."; exit 1)