diff --git a/tailcfg/tailcfg.go b/tailcfg/tailcfg.go
index 09408e2fc..d1dc77942 100644
--- a/tailcfg/tailcfg.go
+++ b/tailcfg/tailcfg.go
@@ -79,12 +79,6 @@ func (u StableNodeID) IsZero() bool {
 	return u == ""
 }
 
-// NodeKey is the WireGuard public key for a node.
-//
-// Deprecated: prefer to use key.NodePublic instead. If you must have
-// a NodeKey, use NodePublic.AsNodeKey.
-type NodeKey = key.NodeKey
-
 // DiscoKey is the curve25519 public key for path discovery key.
 // It's never written to disk or reused between network start-ups.
 type DiscoKey [32]byte
diff --git a/types/key/node.go b/types/key/node.go
index bddfdbec6..eb394320e 100644
--- a/types/key/node.go
+++ b/types/key/node.go
@@ -305,10 +305,3 @@ func (k NodePublic) WireGuardGoString() string {
 	b[second+3] = b64((k.k[31] << 2) & 63)
 	return string(b)
 }
-
-// AsNodeKey returns k converted to a NodeKey.
-//
-// Cross-compatibility shim as part of #3206.
-func (k NodePublic) AsNodeKey() NodeKey {
-	return k.Raw32()
-}
diff --git a/types/key/node_legacy.go b/types/key/node_legacy.go
deleted file mode 100644
index 7fc1944cf..000000000
--- a/types/key/node_legacy.go
+++ /dev/null
@@ -1,28 +0,0 @@
-// Copyright (c) 2021 Tailscale Inc & AUTHORS All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package key
-
-import (
-	"go4.org/mem"
-)
-
-// NodeKey is the legacy form of NodePublic.
-// See #3206 for removal effort.
-type NodeKey [32]byte
-
-func (k NodeKey) ShortString() string          { return k.AsNodePublic().ShortString() }
-func (k NodeKey) String() string               { return k.AsNodePublic().String() }
-func (k NodeKey) MarshalText() ([]byte, error) { return k.AsNodePublic().MarshalText() }
-func (k NodeKey) AsNodePublic() NodePublic     { return NodePublicFromRaw32(mem.B(k[:])) }
-func (k NodeKey) IsZero() bool                 { return k == NodeKey{} }
-
-func (k *NodeKey) UnmarshalText(text []byte) error {
-	var nk NodePublic
-	if err := nk.UnmarshalText(text); err != nil {
-		return err
-	}
-	*k = nk.AsNodeKey()
-	return nil
-}
diff --git a/types/key/node_legacy_test.go b/types/key/node_legacy_test.go
deleted file mode 100644
index e70143b10..000000000
--- a/types/key/node_legacy_test.go
+++ /dev/null
@@ -1,75 +0,0 @@
-// Copyright (c) 2021 Tailscale Inc & AUTHORS All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package key
-
-import (
-	"bytes"
-	"encoding/json"
-	"strings"
-	"testing"
-)
-
-func TestNodeKeyMarshal(t *testing.T) {
-	var k1, k2 NodeKey
-	for i := range k1 {
-		k1[i] = byte(i)
-	}
-
-	const prefix = "nodekey:"
-	got, err := k1.MarshalText()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := k2.UnmarshalText(got); err != nil {
-		t.Fatal(err)
-	}
-	if s := k1.String(); string(got) != s {
-		t.Errorf("MarshalText = %q != String %q", got, s)
-	}
-	if !strings.HasPrefix(string(got), prefix) {
-		t.Errorf("%q didn't start with prefix %q", got, prefix)
-	}
-	if k2 != k1 {
-		t.Errorf("mismatch after unmarshal")
-	}
-}
-
-func TestNodeKeyRoundTrip(t *testing.T) {
-	serialized := `{
-      "Pub":"nodekey:50d20b455ecf12bc453f83c2cfdb2a24925d06cf2598dcaa54e91af82ce9f765"
-    }`
-
-	// Carefully check that the expected serialized data decodes and
-	// re-encodes to the expected keys. These types are serialized to
-	// disk all over the place and need to be stable.
-	pub := NodeKey{
-		0x50, 0xd2, 0xb, 0x45, 0x5e, 0xcf, 0x12, 0xbc, 0x45, 0x3f, 0x83,
-		0xc2, 0xcf, 0xdb, 0x2a, 0x24, 0x92, 0x5d, 0x6, 0xcf, 0x25, 0x98,
-		0xdc, 0xaa, 0x54, 0xe9, 0x1a, 0xf8, 0x2c, 0xe9, 0xf7, 0x65,
-	}
-
-	type key struct {
-		Pub NodeKey
-	}
-
-	var a key
-	if err := json.Unmarshal([]byte(serialized), &a); err != nil {
-		t.Fatal(err)
-	}
-	if a.Pub != pub {
-		t.Errorf("wrong deserialization of public key, got %#v want %#v", a.Pub, pub)
-	}
-
-	bs, err := json.MarshalIndent(a, "", "  ")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	var b bytes.Buffer
-	json.Indent(&b, []byte(serialized), "", "  ")
-	if got, want := string(bs), b.String(); got != want {
-		t.Error("json serialization doesn't roundtrip")
-	}
-}