Over the weekend, I added this to a common bit included in all my NixOS systems:

    -networking.firewall.allowedTCPPorts = [ 22 ];
    +networking.firewall.interfaces."tailscale0".allowedTCPPorts = [ 22 ];

I probably should have done this ages ago.