From 14f833bdb9874075f888b4a01f3d1d327f6b338b Mon Sep 17 00:00:00 2001
From: Kristoffer Dalby <kristoffer@dalby.cc>
Date: Fri, 23 Jan 2026 19:35:42 +0000
Subject: [PATCH] policy: fix autogroup:self handling for tagged nodes Skip
 autogroup:self destination processing for tagged nodes since they can never
 match autogroup:self (which only applies to user-owned nodes). Also reorder
 the IsTagged() check to short-circuit before accessing User() to avoid
 potential nil pointer access on tagged nodes.

Updates #3036
---
 CHANGELOG.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index edd5f234..536db4fe 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,10 @@
 
 ## 0.29.0 (202x-xx-xx)
 
+### Changes
+
+- **ACL Policy**: Fix autogroup:self handling for tagged nodes - tagged nodes no longer incorrectly receive autogroup:self filter rules [#3036](https://github.com/juanfont/headscale/pull/3036)
+
 ## 0.28.0 (2026-02-04)
 
 **Minimum supported Tailscale client version: v1.74.0**