diff --git a/ipn/ipnstate/ipnstate.go b/ipn/ipnstate/ipnstate.go
index 5292bac47..db8e36d52 100644
--- a/ipn/ipnstate/ipnstate.go
+++ b/ipn/ipnstate/ipnstate.go
@@ -188,14 +188,22 @@ func (s *Status) Peers() []key.NodePublic {
 }
 
 type PeerStatusLite struct {
-	// TxBytes/RxBytes is the total number of bytes transmitted to/received from this peer.
-	TxBytes, RxBytes int64
-	// LastHandshake is the last time a handshake succeeded with this peer.
-	// (Or we got key confirmation via the first data message,
-	// which is approximately the same thing.)
-	LastHandshake time.Time
 	// NodeKey is this peer's public node key.
 	NodeKey key.NodePublic
+
+	// TxBytes/RxBytes are the total number of bytes transmitted to/received
+	// from this peer.
+	TxBytes, RxBytes int64
+
+	// LastHandshake is the last time a handshake succeeded with this peer. (Or
+	// we got key confirmation via the first data message, which is
+	// approximately the same thing.)
+	//
+	// The time.Time zero value means that no handshake has succeeded, at least
+	// since this peer was last known to WireGuard. (Tailscale removes peers
+	// from the wireguard peer that are idle.)
+	LastHandshake time.Time
+
 	// HandshakeAttempts is how many failed attempts there have been at
 	// completing the current WireGuard handshake. This resets to zero on every
 	// successful handshake.
diff --git a/wgengine/userspace.go b/wgengine/userspace.go
index a22063703..f50b5ade3 100644
--- a/wgengine/userspace.go
+++ b/wgengine/userspace.go
@@ -1025,8 +1025,10 @@ func (e *userspaceEngine) getPeerStatusLite(pk key.NodePublic) (status ipnstate.
 	status.NodeKey = pk
 	status.RxBytes = int64(wgint.PeerRxBytes(peer))
 	status.TxBytes = int64(wgint.PeerTxBytes(peer))
-	status.LastHandshake = time.Unix(0, wgint.PeerLastHandshakeNano(peer))
 	status.HandshakeAttempts = wgint.PeerHandshakeAttempts(peer)
+	if nano := wgint.PeerLastHandshakeNano(peer); nano != 0 {
+		status.LastHandshake = time.Unix(0, nano)
+	}
 	return status, true
 }