diff --git a/control/controlclient/direct.go b/control/controlclient/direct.go
index 94743c15e..e5acbbaf0 100644
--- a/control/controlclient/direct.go
+++ b/control/controlclient/direct.go
@@ -772,7 +772,7 @@ func (c *Direct) sendMapRequest(ctx context.Context, maxPolls int, cb func(*netm
 			go answerPing(c.logf, c.httpc, pr)
 		}
 
-		if !resp.ControlTime.IsZero() {
+		if resp.ControlTime != nil && !resp.ControlTime.IsZero() {
 			c.logf("netmap: control time is %v", resp.ControlTime.UTC().Format(time.RFC3339Nano))
 		}
 		if resp.KeepAlive {
diff --git a/tailcfg/tailcfg.go b/tailcfg/tailcfg.go
index 457fef1ad..0c5c3b28e 100644
--- a/tailcfg/tailcfg.go
+++ b/tailcfg/tailcfg.go
@@ -1297,7 +1297,7 @@ type MapResponse struct {
 	SSHPolicy *SSHPolicy `json:",omitempty"`
 
 	// ControlTime, if non-zero, is the current timestamp according to the control server.
-	ControlTime time.Time `json:",omitempty"`
+	ControlTime *time.Time `json:",omitempty"`
 
 	// Debug is normally nil, except for when the control server
 	// is setting debug settings on a node.
diff --git a/tstest/integration/testcontrol/testcontrol.go b/tstest/integration/testcontrol/testcontrol.go
index 102c98b09..71dc3f593 100644
--- a/tstest/integration/testcontrol/testcontrol.go
+++ b/tstest/integration/testcontrol/testcontrol.go
@@ -721,6 +721,7 @@ func (s *Server) MapResponse(req *tailcfg.MapRequest) (res *tailcfg.MapResponse,
 		return nil, nil
 	}
 	user, _ := s.getUser(nk)
+	t := time.Date(2020, 8, 3, 0, 0, 0, 1, time.UTC)
 	res = &tailcfg.MapResponse{
 		Node:            node,
 		DERPMap:         s.DERPMap,
@@ -731,7 +732,7 @@ func (s *Server) MapResponse(req *tailcfg.MapRequest) (res *tailcfg.MapResponse,
 			DisableUPnP: "true",
 		},
 		DNSConfig:   s.DNSConfig,
-		ControlTime: time.Date(2020, 8, 3, 0, 0, 0, 1, time.UTC),
+		ControlTime: &t,
 	}
 	for _, p := range s.AllNodes() {
 		if p.StableID != node.StableID {