diff --git a/wgengine/monitor/monitor.go b/wgengine/monitor/monitor.go
index 2fc503596..38cdbaa54 100644
--- a/wgengine/monitor/monitor.go
+++ b/wgengine/monitor/monitor.go
@@ -20,13 +20,6 @@ type message interface {
 	ignore() bool
 }
 
-// unspecifiedMessage is a minimal message implementation that should not
-// be ignored. In general, OS-specific implementations should use better
-// types and avoid this if they can.
-type unspecifiedMessage struct{}
-
-func (unspecifiedMessage) ignore() bool { return false }
-
 // osMon is the interface that each operating system-specific
 // implementation of the link monitor must implement.
 type osMon interface {
diff --git a/wgengine/monitor/monitor_freebsd.go b/wgengine/monitor/monitor_freebsd.go
index 832772f09..13a7fb8c1 100644
--- a/wgengine/monitor/monitor_freebsd.go
+++ b/wgengine/monitor/monitor_freebsd.go
@@ -13,6 +13,13 @@ import (
 	"tailscale.com/types/logger"
 )
 
+// unspecifiedMessage is a minimal message implementation that should not
+// be ignored. In general, OS-specific implementations should use better
+// types and avoid this if they can.
+type unspecifiedMessage struct{}
+
+func (unspecifiedMessage) ignore() bool { return false }
+
 // devdConn implements osMon using devd(8).
 type devdConn struct {
 	conn net.Conn
diff --git a/wgengine/monitor/monitor_linux.go b/wgengine/monitor/monitor_linux.go
index 1af279554..b60919367 100644
--- a/wgengine/monitor/monitor_linux.go
+++ b/wgengine/monitor/monitor_linux.go
@@ -19,6 +19,13 @@ import (
 	"tailscale.com/types/logger"
 )
 
+// unspecifiedMessage is a minimal message implementation that should not
+// be ignored. In general, OS-specific implementations should use better
+// types and avoid this if they can.
+type unspecifiedMessage struct{}
+
+func (unspecifiedMessage) ignore() bool { return false }
+
 // nlConn wraps a *netlink.Conn and returns a monitor.Message
 // instead of a netlink.Message. Currently, messages are discarded,
 // but down the line, when messages trigger different logic depending
diff --git a/wgengine/router/dns.go b/wgengine/router/dns.go
index 56c3ad29d..f3a2d146b 100644
--- a/wgengine/router/dns.go
+++ b/wgengine/router/dns.go
@@ -5,8 +5,6 @@
 package router
 
 import (
-	"time"
-
 	"inet.af/netaddr"
 )
 
@@ -46,13 +44,6 @@ func (lhs DNSConfig) EquivalentTo(rhs DNSConfig) bool {
 	return true
 }
 
-// dnsReconfigTimeout is the timeout for DNS reconfiguration.
-//
-// This is useful because certain conditions can cause indefinite hangs
-// (such as improper dbus auth followed by contextless dbus.Object.Call).
-// Such operations should be wrapped in a timeout context.
-const dnsReconfigTimeout = time.Second
-
 // dnsMode determines how DNS settings are managed.
 type dnsMode uint8
 
diff --git a/wgengine/router/dns_resolved.go b/wgengine/router/dns_resolved.go
index b37a4b87f..51339e079 100644
--- a/wgengine/router/dns_resolved.go
+++ b/wgengine/router/dns_resolved.go
@@ -11,6 +11,7 @@ import (
 	"errors"
 	"fmt"
 	"os/exec"
+	"time"
 
 	"github.com/godbus/dbus/v5"
 	"golang.org/x/sys/unix"
@@ -35,6 +36,13 @@ import (
 // this address is, in fact, hard-coded into resolved.
 var resolvedListenAddr = netaddr.IPv4(127, 0, 0, 53)
 
+// dnsReconfigTimeout is the timeout for DNS reconfiguration.
+//
+// This is useful because certain conditions can cause indefinite hangs
+// (such as improper dbus auth followed by contextless dbus.Object.Call).
+// Such operations should be wrapped in a timeout context.
+const dnsReconfigTimeout = time.Second
+
 var errNotReady = errors.New("interface not ready")
 
 type resolvedLinkNameserver struct {