Failed to ssh-keyscan to tailscaled dns after tailscale/github-action@main

We have the following setup:

jobs:
  deploy:
    runs-on: ubuntu-latest
    name: Deploy Staging Website
    steps:
      - name: Setup Tailscale
        uses: tailscale/github-action@main
        with:
          authkey: ${{ secrets.TAILSCALE_AUTHKEY }}

      - name: Add to auth keys
        run: |
          mkdir -p ~/.ssh
          ssh-keyscan -t ed25519 $MACHINE >> ~/.ssh/known_hosts
        env:
          MACHINE: app-api-staging

From time to time our job fails on ssh-keyscan -t ed25519 $MACHINE >> ~/.ssh/known_hosts and app-api-staging is a tailscale MagicDNS.

On app-api-staging we see the following logs:
tailscaled[530]: CreateEndpoint error for 100.81..:53254 -> 100.107..:22: connection was refused

Sometimes it works, sometimes it doesn't.

I'd be grateful for any advice.

Start with the workflow's Setup Tailscale and ssh-keyscan steps, then compare successful and failed runs with the tailscaled connection-refused log from app-api-staging. Determine whether the intermittent failure is in the action setup, MagicDNS resolution, or SSH reachability; done means identifying a reproducible cause and documenting a reliable fix or workaround.