diff --git a/.github/actions/testing-tailnet/action.yml b/.github/actions/testing-tailnet/action.yml
index e7ec63a7..89f013e1 100644
--- a/.github/actions/testing-tailnet/action.yml
+++ b/.github/actions/testing-tailnet/action.yml
@@ -33,7 +33,8 @@ runs:
         oauth-client-id: ${{ inputs.client-id }}
         audience: ${{ inputs.audience }}
         tags: tag:e2e-github-runner
-        args: --accept-routes=true --accept-dns=false --ssh=false
+        # The pinned upstream action already enables route acceptance.
+        args: --accept-dns=false --ssh=false
     - name: Verify testing tailnet
       id: verify
       shell: bash
diff --git a/.github/actions/testing-tailnet/test/test_action.py b/.github/actions/testing-tailnet/test/test_action.py
index 1d11227a..f77c8c40 100644
--- a/.github/actions/testing-tailnet/test/test_action.py
+++ b/.github/actions/testing-tailnet/test/test_action.py
@@ -1,5 +1,7 @@
 import importlib.util
 import json
+import re
+import shlex
 from pathlib import Path
 from types import SimpleNamespace
 
@@ -19,6 +21,15 @@ def load(name):
 verify = load("verify")
 
 
+def test_join_args_do_not_repeat_upstream_route_flag():
+    action = (SRC.parent / "action.yml").read_text()
+    assert "tailscale/github-action@064b10558093f38325e838ddea35486bdc6b1d5c" in action
+    args = shlex.split(re.search(r"^\s+args: (.+)$", action, re.MULTILINE).group(1))
+    assert not any(arg.split("=", 1)[0].lstrip("-") == "accept-routes" for arg in args)
+    assert "--accept-dns=false" in args
+    assert "--ssh=false" in args
+
+
 @pytest.fixture
 def env():
     return {"RUNNER_OS": "Linux", "RUNNER_ENVIRONMENT": "github-hosted", "GITHUB_EVENT_NAME": "push", "GITHUB_REF": "refs/heads/main", "INPUT_CLIENT_ID": "client-123", "INPUT_AUDIENCE": "api.tailscale.com/client-123", "INPUT_EXPECTED_TAILNET": "example-tailnet.ts.net"}