diff --git a/control/controlclient/direct.go b/control/controlclient/direct.go
index 96e008de5..d96c8e8cb 100644
--- a/control/controlclient/direct.go
+++ b/control/controlclient/direct.go
@@ -67,7 +67,7 @@ type Direct struct {
 	linkMon                *monitor.Mon // or nil
 	discoPubKey            key.DiscoPublic
 	getMachinePrivKey      func() (key.MachinePrivate, error)
-	getNLPublicKey         func() (key.NLPublic, error)
+	getNLPublicKey         func() (key.NLPublic, error) // or nil
 	debugFlags             []string
 	keepSharerAndUserSplit bool
 	skipIPForwardingCheck  bool
@@ -108,7 +108,10 @@ type Options struct {
 	LinkMonitor          *monitor.Mon     // optional link monitor
 	PopBrowserURL        func(url string) // optional func to open browser
 	Dialer               *tsdial.Dialer   // non-nil
-	GetNLPublicKey       func() (key.NLPublic, error)
+
+	// GetNLPublicKey specifies an optional function to use
+	// Network Lock. If nil, it's not used.
+	GetNLPublicKey func() (key.NLPublic, error)
 
 	// Status is called when there's a change in status.
 	Status func(Status)
@@ -427,9 +430,12 @@ func (c *Direct) doLogin(ctx context.Context, opt loginOpt) (mustRegen bool, new
 		oldNodeKey = persist.OldPrivateNodeKey.Public()
 	}
 
-	nlPub, err := c.getNLPublicKey()
-	if err != nil {
-		return false, "", fmt.Errorf("get nl key: %v", err)
+	var nlPub key.NLPublic
+	if c.getNLPublicKey != nil {
+		nlPub, err = c.getNLPublicKey()
+		if err != nil {
+			return false, "", fmt.Errorf("get nl key: %v", err)
+		}
 	}
 
 	if tryingNewKey.IsZero() {