diff --git a/wgengine/router/router_linux.go b/wgengine/router/router_linux.go
index e0e4a105c..fcd00ee4b 100644
--- a/wgengine/router/router_linux.go
+++ b/wgengine/router/router_linux.go
@@ -245,13 +245,13 @@ func (r *linuxRouter) Up() error {
 		return err
 	}
 	if err := r.addIPRules(); err != nil {
-		return err
+		return fmt.Errorf("adding IP rules: %w", err)
 	}
 	if err := r.setNetfilterMode(netfilterOff); err != nil {
-		return err
+		return fmt.Errorf("setting netfilter mode: %w", err)
 	}
 	if err := r.upInterface(); err != nil {
-		return err
+		return fmt.Errorf("bringing interface up: %w", err)
 	}
 
 	return nil
diff --git a/wgengine/userspace.go b/wgengine/userspace.go
index 2a41a2e6e..ce52a9337 100644
--- a/wgengine/userspace.go
+++ b/wgengine/userspace.go
@@ -389,11 +389,11 @@ func NewUserspaceEngine(logf logger.Logf, conf Config) (_ Engine, reterr error)
 
 	e.logf("Bringing wireguard device up...")
 	if err := e.wgdev.Up(); err != nil {
-		return nil, fmt.Errorf("wgdev.Up(): %w", err)
+		return nil, fmt.Errorf("wgdev.Up: %w", err)
 	}
 	e.logf("Bringing router up...")
 	if err := e.router.Up(); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("router.Up: %w", err)
 	}
 
 	// It's a little pointless to apply no-op settings here (they
@@ -401,7 +401,7 @@ func NewUserspaceEngine(logf logger.Logf, conf Config) (_ Engine, reterr error)
 	// router implementation early on.
 	e.logf("Clearing router settings...")
 	if err := e.router.Set(nil); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("router.Set(nil): %w", err)
 	}
 	e.logf("Starting link monitor...")
 	e.linkMon.Start()