diff --git a/feature/tpm/attestation.go b/feature/tpm/attestation.go
index 597d4a649..49b80ade1 100644
--- a/feature/tpm/attestation.go
+++ b/feature/tpm/attestation.go
@@ -274,7 +274,7 @@ func (ak *attestationKey) Close() error {
 }
 
 func (ak *attestationKey) Clone() key.HardwareAttestationKey {
-	if ak == nil {
+	if ak.IsZero() {
 		return nil
 	}
 
diff --git a/feature/tpm/tpm.go b/feature/tpm/tpm.go
index 4b27a241f..7cbdec088 100644
--- a/feature/tpm/tpm.go
+++ b/feature/tpm/tpm.go
@@ -35,12 +35,15 @@ import (
 	"tailscale.com/util/testenv"
 )
 
-var infoOnce = sync.OnceValue(info)
+var (
+	infoOnce         = sync.OnceValue(info)
+	tpmSupportedOnce = sync.OnceValue(tpmSupported)
+)
 
 func init() {
 	feature.Register("tpm")
-	feature.HookTPMAvailable.Set(tpmSupported)
-	feature.HookHardwareAttestationAvailable.Set(tpmSupported)
+	feature.HookTPMAvailable.Set(tpmSupportedOnce)
+	feature.HookHardwareAttestationAvailable.Set(tpmSupportedOnce)
 
 	hostinfo.RegisterHostinfoNewHook(func(hi *tailcfg.Hostinfo) {
 		hi.TPM = infoOnce()