diff --git a/control/controlclient/direct.go b/control/controlclient/direct.go
index edc63cfb4..472a6fd92 100644
--- a/control/controlclient/direct.go
+++ b/control/controlclient/direct.go
@@ -398,6 +398,9 @@ func (c *Direct) TryLogout(ctx context.Context) error {
 }
 
 func (c *Direct) TryLogin(ctx context.Context, t *tailcfg.Oauth2Token, flags LoginFlags) (url string, err error) {
+	if strings.Contains(c.serverURL, "controlplane") {
+		panic("XXX controlclient: TryLogin called on controlplane server")
+	}
 	c.logf("[v1] direct.TryLogin(token=%v, flags=%v)", t != nil, flags)
 	return c.doLoginOrRegen(ctx, loginOpt{Token: t, Flags: flags})
 }
diff --git a/net/tshttpproxy/tshttpproxy.go b/net/tshttpproxy/tshttpproxy.go
index 2ca440b57..a4f47921b 100644
--- a/net/tshttpproxy/tshttpproxy.go
+++ b/net/tshttpproxy/tshttpproxy.go
@@ -142,6 +142,9 @@ func ProxyFromEnvironment(req *http.Request) (ret *url.URL, _ error) {
 			return
 		}
 		log.Printf("tshttpproxy: using proxy %q for URL: %q", ss, req.URL.String())
+		if strings.HasPrefix(req.URL.String(), "https://controlplane.tailscale.com/key") {
+			panic("XXX saw controlplane.tailscale.com/key in test")
+		}
 		mak.Set(&logMessagePrinted, ss, true)
 	}()