diff --git a/cmd/tailscale/cli/up.go b/cmd/tailscale/cli/up.go
index a3aaa3cbe..0f399d260 100644
--- a/cmd/tailscale/cli/up.go
+++ b/cmd/tailscale/cli/up.go
@@ -57,7 +57,7 @@ var upFlagSet = (func() *flag.FlagSet {
 	upf.BoolVar(&upArgs.forceReauth, "force-reauth", false, "force reauthentication")
 	upf.BoolVar(&upArgs.reset, "reset", false, "reset unspecified settings to their default values")
 
-	upf.StringVar(&upArgs.server, "login-server", "https://login.tailscale.com", "base URL of control server")
+	upf.StringVar(&upArgs.server, "login-server", ipn.DefaultControlURL, "base URL of control server")
 	upf.BoolVar(&upArgs.acceptRoutes, "accept-routes", false, "accept routes advertised by other Tailscale nodes")
 	upf.BoolVar(&upArgs.acceptDNS, "accept-dns", true, "accept DNS configuration from the admin panel")
 	upf.BoolVar(&upArgs.singleRoutes, "host-routes", true, "install host routes to other Tailscale nodes")
diff --git a/cmd/tailscale/cli/web.go b/cmd/tailscale/cli/web.go
index f6d8bb72e..0790b51f0 100644
--- a/cmd/tailscale/cli/web.go
+++ b/cmd/tailscale/cli/web.go
@@ -246,7 +246,7 @@ func webHandler(w http.ResponseWriter, r *http.Request) {
 // TODO(crawshaw): some of this is very similar to the code in 'tailscale up', can we share anything?
 func tailscaleUp(ctx context.Context) (authURL string, retErr error) {
 	prefs := ipn.NewPrefs()
-	prefs.ControlURL = "https://login.tailscale.com"
+	prefs.ControlURL = ipn.DefaultControlURL
 	prefs.WantRunning = true
 	prefs.CorpDNS = true
 	prefs.AllowSingleHosts = true
diff --git a/ipn/prefs.go b/ipn/prefs.go
index 530dca59f..35b4a49b9 100644
--- a/ipn/prefs.go
+++ b/ipn/prefs.go
@@ -25,6 +25,11 @@ import (
 
 //go:generate go run tailscale.com/cmd/cloner -type=Prefs -output=prefs_clone.go
 
+// DefaultControlURL returns the URL base of the control plane
+// ("coordination server") for use when no explicit one is configured.
+// The default control plane is the hosted version run by Tailscale.com.
+const DefaultControlURL = "https://login.tailscale.com"
+
 // Prefs are the user modifiable settings of the Tailscale node agent.
 type Prefs struct {
 	// ControlURL is the URL of the control server to use.
@@ -258,7 +263,7 @@ func (p *Prefs) pretty(goos string) string {
 	if goos == "linux" {
 		fmt.Fprintf(&sb, "nf=%v ", p.NetfilterMode)
 	}
-	if p.ControlURL != "" && p.ControlURL != "https://login.tailscale.com" {
+	if p.ControlURL != "" && p.ControlURL != DefaultControlURL {
 		fmt.Fprintf(&sb, "url=%q ", p.ControlURL)
 	}
 	if p.Hostname != "" {
@@ -340,7 +345,7 @@ func NewPrefs() *Prefs {
 		// Provide default values for options which might be missing
 		// from the json data for any reason. The json can still
 		// override them to false.
-		ControlURL:       "https://login.tailscale.com",
+		ControlURL:       DefaultControlURL,
 		RouteAll:         true,
 		AllowSingleHosts: true,
 		CorpDNS:          true,