diff --git a/control/controlclient/direct.go b/control/controlclient/direct.go
index d96c8e8cb..96d49f13f 100644
--- a/control/controlclient/direct.go
+++ b/control/controlclient/direct.go
@@ -1151,8 +1151,8 @@ var clockNow = time.Now
 
 // opt.Bool configs from control.
 var (
-	controlUseDERPRoute atomic.Value
-	controlTrimWGConfig atomic.Value
+	controlUseDERPRoute atomic.Value // of opt.Bool
+	controlTrimWGConfig atomic.Value // of opt.Bool
 )
 
 func setControlAtomic(dst *atomic.Value, v opt.Bool) {
diff --git a/ipn/ipnlocal/local.go b/ipn/ipnlocal/local.go
index 0d85fa26e..1e436ea9a 100644
--- a/ipn/ipnlocal/local.go
+++ b/ipn/ipnlocal/local.go
@@ -130,7 +130,7 @@ type LocalBackend struct {
 	sshAtomicBool         syncs.AtomicBool
 	shutdownCalled        bool // if Shutdown has been called
 
-	filterAtomic            atomic.Value // of *filter.Filter
+	filterAtomic            atomic.Pointer[filter.Filter]
 	containsViaIPFuncAtomic atomic.Value // of func(netip.Addr) bool
 
 	// The mutex protects the following elements.
@@ -577,8 +577,8 @@ func (b *LocalBackend) PeerCaps(src netip.Addr) []string {
 	if b.netMap == nil {
 		return nil
 	}
-	filt, ok := b.filterAtomic.Load().(*filter.Filter)
-	if !ok {
+	filt := b.filterAtomic.Load()
+	if filt == nil {
 		return nil
 	}
 	for _, a := range b.netMap.Addresses {
diff --git a/ipn/ipnlocal/peerapi.go b/ipn/ipnlocal/peerapi.go
index 6c12862d0..a73111372 100644
--- a/ipn/ipnlocal/peerapi.go
+++ b/ipn/ipnlocal/peerapi.go
@@ -973,8 +973,8 @@ func (h *peerAPIHandler) replyToDNSQueries() bool {
 	// ourselves. As a proxy for autogroup:internet access, we see
 	// if we would've accepted a packet to 0.0.0.0:53. We treat
 	// the IP 0.0.0.0 as being "the internet".
-	f, ok := b.filterAtomic.Load().(*filter.Filter)
-	if !ok {
+	f := b.filterAtomic.Load()
+	if f == nil {
 		return false
 	}
 	// Note: we check TCP here because the Filter type already had
diff --git a/net/dns/resolver/debug.go b/net/dns/resolver/debug.go
index cbe415bda..9a33f8856 100644
--- a/net/dns/resolver/debug.go
+++ b/net/dns/resolver/debug.go
@@ -24,8 +24,8 @@ func init() {
 		} else if n > 10000 {
 			n = 10000
 		}
-		fl, ok := fwdLogAtomic.Load().(*fwdLog)
-		if !ok || n != len(fl.ent) {
+		fl := fwdLogAtomic.Load()
+		if fl == nil || n != len(fl.ent) {
 			fl = &fwdLog{ent: make([]fwdLogEntry, n)}
 			fwdLogAtomic.Store(fl)
 		}
@@ -33,7 +33,7 @@ func init() {
 	}))
 }
 
-var fwdLogAtomic atomic.Value // of *fwdLog
+var fwdLogAtomic atomic.Pointer[fwdLog]
 
 type fwdLog struct {
 	mu  sync.Mutex
diff --git a/net/dns/resolver/forwarder.go b/net/dns/resolver/forwarder.go
index fc6f5e02e..616c8b8c4 100644
--- a/net/dns/resolver/forwarder.go
+++ b/net/dns/resolver/forwarder.go
@@ -688,7 +688,7 @@ func (f *forwarder) forwardWithDestChan(ctx context.Context, query packet, respo
 		}
 	}
 
-	if fl, ok := fwdLogAtomic.Load().(*fwdLog); ok {
+	if fl := fwdLogAtomic.Load(); fl != nil {
 		fl.addName(string(domain))
 	}
 
diff --git a/net/tstun/wrap.go b/net/tstun/wrap.go
index 909340416..0fd3e65ec 100644
--- a/net/tstun/wrap.go
+++ b/net/tstun/wrap.go
@@ -126,7 +126,7 @@ type Wrapper struct {
 	eventsOther chan tun.Event
 
 	// filter atomically stores the currently active packet filter
-	filter atomic.Value // of *filter.Filter
+	filter atomic.Pointer[filter.Filter]
 	// filterFlags control the verbosity of logging packet drops/accepts.
 	filterFlags filter.RunFlags
 
@@ -477,8 +477,7 @@ func (t *Wrapper) filterOut(p *packet.Parsed) filter.Response {
 		}
 	}
 
-	filt, _ := t.filter.Load().(*filter.Filter)
-
+	filt := t.filter.Load()
 	if filt == nil {
 		return filter.Drop
 	}
@@ -606,8 +605,7 @@ func (t *Wrapper) filterIn(buf []byte) filter.Response {
 		}
 	}
 
-	filt, _ := t.filter.Load().(*filter.Filter)
-
+	filt := t.filter.Load()
 	if filt == nil {
 		return filter.Drop
 	}
@@ -698,8 +696,7 @@ func (t *Wrapper) tdevWrite(buf []byte, offset int) (int, error) {
 }
 
 func (t *Wrapper) GetFilter() *filter.Filter {
-	filt, _ := t.filter.Load().(*filter.Filter)
-	return filt
+	return t.filter.Load()
 }
 
 func (t *Wrapper) SetFilter(filt *filter.Filter) {
diff --git a/paths/paths.go b/paths/paths.go
index 57ad1cf6c..183e97ff6 100644
--- a/paths/paths.go
+++ b/paths/paths.go
@@ -17,7 +17,7 @@ import (
 
 // AppSharedDir is a string set by the iOS or Android app on start
 // containing a directory we can read/write in.
-var AppSharedDir atomic.Value
+var AppSharedDir atomic.Value // of string
 
 // DefaultTailscaledSocket returns the path to the tailscaled Unix socket
 // or the empty string if there's no reasonable default.
diff --git a/version/prop.go b/version/prop.go
index fcb095062..fef10c4ff 100644
--- a/version/prop.go
+++ b/version/prop.go
@@ -43,7 +43,7 @@ func IsSandboxedMacOS() bool {
 	return strings.HasSuffix(exe, "/Contents/MacOS/Tailscale")
 }
 
-var isMacSysExt atomic.Value
+var isMacSysExt atomic.Value // of bool
 
 // IsMacSysExt whether this binary is from the standalone "System
 // Extension" (a.k.a. "macsys") version of Tailscale for macOS.
diff --git a/wgengine/magicsock/magicsock.go b/wgengine/magicsock/magicsock.go
index 97c1455c0..00a95607f 100644
--- a/wgengine/magicsock/magicsock.go
+++ b/wgengine/magicsock/magicsock.go
@@ -305,9 +305,9 @@ type Conn struct {
 	// derpMapAtomic is the same as derpMap, but without requiring
 	// sync.Mutex. For use with NewRegionClient's callback, to avoid
 	// lock ordering deadlocks. See issue 3726 and mu field docs.
-	derpMapAtomic atomic.Value // of *tailcfg.DERPMap
+	derpMapAtomic atomic.Pointer[tailcfg.DERPMap]
 
-	lastNetCheckReport atomic.Value // of *netcheck.Report
+	lastNetCheckReport atomic.Pointer[netcheck.Report]
 
 	// port is the preferred port from opts.Port; 0 means auto.
 	port syncs.AtomicUint32
@@ -1357,7 +1357,7 @@ func (c *Conn) derpWriteChanOfAddr(addr netip.AddrPort, peer key.NodePublic) cha
 			// We're closing anyway; return nil to stop dialing.
 			return nil
 		}
-		derpMap, _ := c.derpMapAtomic.Load().(*tailcfg.DERPMap)
+		derpMap := c.derpMapAtomic.Load()
 		if derpMap == nil {
 			return nil
 		}
@@ -4142,7 +4142,7 @@ func (di *discoInfo) setNodeKey(nk key.NodePublic) {
 type derpAddrFamSelector struct{ c *Conn }
 
 func (s derpAddrFamSelector) PreferIPv6() bool {
-	if r, ok := s.c.lastNetCheckReport.Load().(*netcheck.Report); ok {
+	if r := s.c.lastNetCheckReport.Load(); r != nil {
 		return r.IPv6
 	}
 	return false