diff --git a/net/portmapper/portmapper.go b/net/portmapper/portmapper.go
index cc0542c17..7cdca1fb3 100644
--- a/net/portmapper/portmapper.go
+++ b/net/portmapper/portmapper.go
@@ -21,6 +21,7 @@ import (
 
 	"go4.org/mem"
 	"tailscale.com/control/controlknobs"
+	"tailscale.com/envknob"
 	"tailscale.com/net/netaddr"
 	"tailscale.com/net/neterror"
 	"tailscale.com/net/netmon"
@@ -32,6 +33,8 @@ import (
 	"tailscale.com/util/clientmetric"
 )
 
+var disablePortMapperEnv = envknob.RegisterBool("TS_DISABLE_PORTMAPPER")
+
 // DebugKnobs contains debug configuration that can be provided when creating a
 // Client. The zero value is valid for use.
 type DebugKnobs struct {
@@ -55,6 +58,9 @@ type DebugKnobs struct {
 }
 
 func (k *DebugKnobs) disableAll() bool {
+	if disablePortMapperEnv() {
+		return true
+	}
 	if k.DisableAll != nil {
 		return k.DisableAll()
 	}
diff --git a/tstest/integration/integration_test.go b/tstest/integration/integration_test.go
index 0741d832f..b9c356e6e 100644
--- a/tstest/integration/integration_test.go
+++ b/tstest/integration/integration_test.go
@@ -1262,6 +1262,7 @@ func (n *testNode) StartDaemonAsIPNGOOS(ipnGOOS string) *Daemon {
 		"TS_NETCHECK_GENERATE_204_URL="+n.env.ControlServer.URL+"/generate_204",
 		"TS_ASSUME_NETWORK_UP_FOR_TEST=1", // don't pause control client in airplane mode (no wifi, etc)
 		"TS_PANIC_IF_HIT_MAIN_CONTROL=1",
+		"TS_DISABLE_PORTMAPPER=1", // shouldn't be needed; test is all localhost
 	)
 	if version.IsRace() {
 		cmd.Env = append(cmd.Env, "GORACE=halt_on_error=1")