diff --git a/tailcfg/tailcfg.go b/tailcfg/tailcfg.go
index d32f8edf9..111ae1cf9 100644
--- a/tailcfg/tailcfg.go
+++ b/tailcfg/tailcfg.go
@@ -475,6 +475,14 @@ type Hostinfo struct {
 	//       require changes to Hostinfo.Equal.
 }
 
+// TailscaleSSHEnabled reports whether or not this node is acting as a
+// Tailscale SSH server.
+func (hi *Hostinfo) TailscaleSSHEnabled() bool {
+	// Currently, we use `SSH_HostKeys` as a proxy for this. However, we may later
+	// include non-Tailscale host keys, and will add a separate flag to rely on.
+	return hi != nil && len(hi.SSH_HostKeys) > 0
+}
+
 // NetInfo contains information about the host's network state.
 type NetInfo struct {
 	// MappingVariesByDestIP says whether the host's NAT mappings
diff --git a/tailcfg/tailcfg_test.go b/tailcfg/tailcfg_test.go
index e5135a407..10ef8800e 100644
--- a/tailcfg/tailcfg_test.go
+++ b/tailcfg/tailcfg_test.go
@@ -271,6 +271,33 @@ func TestHostinfoHowEqual(t *testing.T) {
 	}
 }
 
+func TestHostinfoTailscaleSSHEnabled(t *testing.T) {
+	tests := []struct {
+		hi   *Hostinfo
+		want bool
+	}{
+		{
+			nil,
+			false,
+		},
+		{
+			&Hostinfo{},
+			false,
+		},
+		{
+			&Hostinfo{SSH_HostKeys: []string{"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO.... root@bar"}},
+			true,
+		},
+	}
+
+	for i, tt := range tests {
+		got := tt.hi.TailscaleSSHEnabled()
+		if got != tt.want {
+			t.Errorf("%d. got %v; want %v", i, got, tt.want)
+		}
+	}
+}
+
 func TestNodeEqual(t *testing.T) {
 	nodeHandles := []string{
 		"ID", "StableID", "Name", "User", "Sharer",