diff --git a/tstest/integration/integration_test.go b/tstest/integration/integration_test.go
index 4c38752eb..039491bbc 100644
--- a/tstest/integration/integration_test.go
+++ b/tstest/integration/integration_test.go
@@ -317,6 +317,8 @@ func newTestEnv(t testing.TB, bins *Binaries) *testEnv {
 	control := &testcontrol.Server{
 		DERPMap: derpMap,
 	}
+	control.HTTPTestServer = httptest.NewUnstartedServer(control)
+	control.HTTPTestServer.Start()
 	trafficTrap := new(trafficTrap)
 	e := &testEnv{
 		t:                 t,
@@ -324,12 +326,11 @@ func newTestEnv(t testing.TB, bins *Binaries) *testEnv {
 		LogCatcher:        logc,
 		LogCatcherServer:  httptest.NewServer(logc),
 		Control:           control,
-		ControlServer:     httptest.NewServer(control),
+		ControlServer:     control.HTTPTestServer,
 		TrafficTrap:       trafficTrap,
 		TrafficTrapServer: httptest.NewServer(trafficTrap),
 		derpShutdown:      derpShutdown,
 	}
-	e.Control.BaseURL = e.ControlServer.URL
 	return e
 }
 
diff --git a/tstest/integration/testcontrol/testcontrol.go b/tstest/integration/testcontrol/testcontrol.go
index fd118ea24..6915db958 100644
--- a/tstest/integration/testcontrol/testcontrol.go
+++ b/tstest/integration/testcontrol/testcontrol.go
@@ -18,6 +18,7 @@ import (
 	"log"
 	"math/rand"
 	"net/http"
+	"net/http/httptest"
 	"net/url"
 	"sort"
 	"strings"
@@ -40,9 +41,12 @@ type Server struct {
 	Logf        logger.Logf      // nil means to use the log package
 	DERPMap     *tailcfg.DERPMap // nil means to use prod DERP map
 	RequireAuth bool
-	BaseURL     string // must be set to e.g. "http://127.0.0.1:1234" with no trailing URL
 	Verbose     bool
 
+	// ExplicitBaseURL or HTTPTestServer must be set.
+	ExplicitBaseURL string           // e.g. "http://127.0.0.1:1234" with no trailing URL
+	HTTPTestServer  *httptest.Server // if non-nil, used to get BaseURL
+
 	initMuxOnce sync.Once
 	mux         *http.ServeMux
 
@@ -59,6 +63,20 @@ type Server struct {
 	pingReqsToAdd map[tailcfg.NodeKey]*tailcfg.PingRequest
 }
 
+// BaseURL returns the server's base URL, without trailing slash.
+func (s *Server) BaseURL() string {
+	if e := s.ExplicitBaseURL; e != "" {
+		return e
+	}
+	if hs := s.HTTPTestServer; hs != nil {
+		if hs.URL != "" {
+			return hs.URL
+		}
+		panic("Server.HTTPTestServer not started")
+	}
+	panic("Server ExplicitBaseURL and HTTPTestServer both unset")
+}
+
 // NumNodes returns the number of nodes in the testcontrol server.
 //
 // This is useful when connecting a bunch of virtual machines to a testcontrol
@@ -415,7 +433,7 @@ func (s *Server) serveRegister(w http.ResponseWriter, r *http.Request, mkey tail
 		crand.Read(randHex)
 		authPath := fmt.Sprintf("/auth/%x", randHex)
 		s.addAuthPath(authPath, req.NodeKey)
-		authURL = s.BaseURL + authPath
+		authURL = s.BaseURL() + authPath
 	}
 
 	res, err := s.encode(mkey, false, tailcfg.RegisterResponse{