diff --git a/control/controlclient/map.go b/control/controlclient/map.go
index 9e8c2cacb..80db55259 100644
--- a/control/controlclient/map.go
+++ b/control/controlclient/map.go
@@ -110,7 +110,7 @@ func (ms *mapSession) netmapForResponse(resp *tailcfg.MapResponse) *netmap.Netwo
 	}
 
 	nm := &netmap.NetworkMap{
-		NodeKey:         ms.privateNodeKey.Public().AsNodeKey(),
+		NodeKey:         ms.privateNodeKey.Public(),
 		PrivateKey:      ms.privateNodeKey,
 		MachineKey:      ms.machinePubKey,
 		Peers:           resp.Peers,
diff --git a/types/netmap/netmap.go b/types/netmap/netmap.go
index 90be66196..9cf90f28c 100644
--- a/types/netmap/netmap.go
+++ b/types/netmap/netmap.go
@@ -26,7 +26,7 @@ type NetworkMap struct {
 	// Core networking
 
 	SelfNode   *tailcfg.Node
-	NodeKey    tailcfg.NodeKey
+	NodeKey    key.NodePublic
 	PrivateKey key.NodePrivate
 	Expiry     time.Time
 	// Name is the DNS name assigned to this node.
diff --git a/types/netmap/netmap_test.go b/types/netmap/netmap_test.go
index 628cd68cb..1bece7522 100644
--- a/types/netmap/netmap_test.go
+++ b/types/netmap/netmap_test.go
@@ -8,15 +8,18 @@ import (
 	"encoding/hex"
 	"testing"
 
+	"go4.org/mem"
 	"inet.af/netaddr"
 	"tailscale.com/tailcfg"
+	"tailscale.com/types/key"
 )
 
-func testNodeKey(b byte) (ret tailcfg.NodeKey) {
-	for i := range ret {
-		ret[i] = b
+func testNodeKey(b byte) (ret key.NodePublic) {
+	var bs [key.NodePublicRawLen]byte
+	for i := range bs {
+		bs[i] = b
 	}
-	return
+	return key.NodePublicFromRaw32(mem.B(bs[:]))
 }
 
 func testDiscoKey(hexPrefix string) (ret tailcfg.DiscoKey) {
@@ -40,12 +43,12 @@ func TestNetworkMapConcise(t *testing.T) {
 				NodeKey: testNodeKey(1),
 				Peers: []*tailcfg.Node{
 					{
-						Key:       testNodeKey(2),
+						Key:       testNodeKey(2).AsNodeKey(),
 						DERP:      "127.3.3.40:2",
 						Endpoints: []string{"192.168.0.100:12", "192.168.0.100:12354"},
 					},
 					{
-						Key:       testNodeKey(3),
+						Key:       testNodeKey(3).AsNodeKey(),
 						DERP:      "127.3.3.40:4",
 						Endpoints: []string{"10.2.0.100:12", "10.1.0.100:12345"},
 					},
@@ -95,7 +98,7 @@ func TestConciseDiffFrom(t *testing.T) {
 				NodeKey: testNodeKey(1),
 				Peers: []*tailcfg.Node{
 					{
-						Key:       testNodeKey(2),
+						Key:       testNodeKey(2).AsNodeKey(),
 						DERP:      "127.3.3.40:2",
 						Endpoints: []string{"192.168.0.100:12", "192.168.0.100:12354"},
 					},
@@ -105,7 +108,7 @@ func TestConciseDiffFrom(t *testing.T) {
 				NodeKey: testNodeKey(1),
 				Peers: []*tailcfg.Node{
 					{
-						Key:       testNodeKey(2),
+						Key:       testNodeKey(2).AsNodeKey(),
 						DERP:      "127.3.3.40:2",
 						Endpoints: []string{"192.168.0.100:12", "192.168.0.100:12354"},
 					},
@@ -119,7 +122,7 @@ func TestConciseDiffFrom(t *testing.T) {
 				NodeKey: testNodeKey(1),
 				Peers: []*tailcfg.Node{
 					{
-						Key:       testNodeKey(2),
+						Key:       testNodeKey(2).AsNodeKey(),
 						DERP:      "127.3.3.40:2",
 						Endpoints: []string{"192.168.0.100:12", "192.168.0.100:12354"},
 					},
@@ -129,7 +132,7 @@ func TestConciseDiffFrom(t *testing.T) {
 				NodeKey: testNodeKey(2),
 				Peers: []*tailcfg.Node{
 					{
-						Key:       testNodeKey(2),
+						Key:       testNodeKey(2).AsNodeKey(),
 						DERP:      "127.3.3.40:2",
 						Endpoints: []string{"192.168.0.100:12", "192.168.0.100:12354"},
 					},
@@ -144,7 +147,7 @@ func TestConciseDiffFrom(t *testing.T) {
 				Peers: []*tailcfg.Node{
 					{
 						ID:        2,
-						Key:       testNodeKey(2),
+						Key:       testNodeKey(2).AsNodeKey(),
 						DERP:      "127.3.3.40:2",
 						Endpoints: []string{"192.168.0.100:12", "192.168.0.100:12354"},
 					},
@@ -155,19 +158,19 @@ func TestConciseDiffFrom(t *testing.T) {
 				Peers: []*tailcfg.Node{
 					{
 						ID:        1,
-						Key:       testNodeKey(1),
+						Key:       testNodeKey(1).AsNodeKey(),
 						DERP:      "127.3.3.40:1",
 						Endpoints: []string{"192.168.0.100:12", "192.168.0.100:12354"},
 					},
 					{
 						ID:        2,
-						Key:       testNodeKey(2),
+						Key:       testNodeKey(2).AsNodeKey(),
 						DERP:      "127.3.3.40:2",
 						Endpoints: []string{"192.168.0.100:12", "192.168.0.100:12354"},
 					},
 					{
 						ID:        3,
-						Key:       testNodeKey(3),
+						Key:       testNodeKey(3).AsNodeKey(),
 						DERP:      "127.3.3.40:3",
 						Endpoints: []string{"192.168.0.100:12", "192.168.0.100:12354"},
 					},
@@ -182,19 +185,19 @@ func TestConciseDiffFrom(t *testing.T) {
 				Peers: []*tailcfg.Node{
 					{
 						ID:        1,
-						Key:       testNodeKey(1),
+						Key:       testNodeKey(1).AsNodeKey(),
 						DERP:      "127.3.3.40:1",
 						Endpoints: []string{"192.168.0.100:12", "192.168.0.100:12354"},
 					},
 					{
 						ID:        2,
-						Key:       testNodeKey(2),
+						Key:       testNodeKey(2).AsNodeKey(),
 						DERP:      "127.3.3.40:2",
 						Endpoints: []string{"192.168.0.100:12", "192.168.0.100:12354"},
 					},
 					{
 						ID:        3,
-						Key:       testNodeKey(3),
+						Key:       testNodeKey(3).AsNodeKey(),
 						DERP:      "127.3.3.40:3",
 						Endpoints: []string{"192.168.0.100:12", "192.168.0.100:12354"},
 					},
@@ -205,7 +208,7 @@ func TestConciseDiffFrom(t *testing.T) {
 				Peers: []*tailcfg.Node{
 					{
 						ID:        2,
-						Key:       testNodeKey(2),
+						Key:       testNodeKey(2).AsNodeKey(),
 						DERP:      "127.3.3.40:2",
 						Endpoints: []string{"192.168.0.100:12", "192.168.0.100:12354"},
 					},
@@ -220,7 +223,7 @@ func TestConciseDiffFrom(t *testing.T) {
 				Peers: []*tailcfg.Node{
 					{
 						ID:        2,
-						Key:       testNodeKey(2),
+						Key:       testNodeKey(2).AsNodeKey(),
 						DERP:      "127.3.3.40:2",
 						Endpoints: []string{"192.168.0.100:12", "1.1.1.1:1"},
 					},
@@ -231,7 +234,7 @@ func TestConciseDiffFrom(t *testing.T) {
 				Peers: []*tailcfg.Node{
 					{
 						ID:        2,
-						Key:       testNodeKey(2),
+						Key:       testNodeKey(2).AsNodeKey(),
 						DERP:      "127.3.3.40:2",
 						Endpoints: []string{"192.168.0.100:12", "1.1.1.1:2"},
 					},
@@ -246,7 +249,7 @@ func TestConciseDiffFrom(t *testing.T) {
 				Peers: []*tailcfg.Node{
 					{
 						ID:         2,
-						Key:        testNodeKey(2),
+						Key:        testNodeKey(2).AsNodeKey(),
 						DERP:       "127.3.3.40:2",
 						Endpoints:  []string{"192.168.0.100:41641", "1.1.1.1:41641"},
 						DiscoKey:   testDiscoKey("f00f00f00f"),
@@ -259,7 +262,7 @@ func TestConciseDiffFrom(t *testing.T) {
 				Peers: []*tailcfg.Node{
 					{
 						ID:         2,
-						Key:        testNodeKey(2),
+						Key:        testNodeKey(2).AsNodeKey(),
 						DERP:       "127.3.3.40:2",
 						Endpoints:  []string{"192.168.0.100:41641", "1.1.1.1:41641"},
 						DiscoKey:   testDiscoKey("ba4ba4ba4b"),
diff --git a/wgengine/bench/wg.go b/wgengine/bench/wg.go
index cf79c5d8e..6216afc52 100644
--- a/wgengine/bench/wg.go
+++ b/wgengine/bench/wg.go
@@ -105,7 +105,7 @@ func setupWGTest(b *testing.B, logf logger.Logf, traf *TrafficGen, a1, a2 netadd
 			Endpoints:  eps,
 		}
 		e2.SetNetworkMap(&netmap.NetworkMap{
-			NodeKey:    k2.Public().AsNodeKey(),
+			NodeKey:    k2.Public(),
 			PrivateKey: k2,
 			Peers:      []*tailcfg.Node{&n},
 		})
@@ -142,7 +142,7 @@ func setupWGTest(b *testing.B, logf logger.Logf, traf *TrafficGen, a1, a2 netadd
 			Endpoints:  eps,
 		}
 		e1.SetNetworkMap(&netmap.NetworkMap{
-			NodeKey:    k1.Public().AsNodeKey(),
+			NodeKey:    k1.Public(),
 			PrivateKey: k1,
 			Peers:      []*tailcfg.Node{&n},
 		})
diff --git a/wgengine/magicsock/magicsock_test.go b/wgengine/magicsock/magicsock_test.go
index 9cb69c83d..0aee05a54 100644
--- a/wgengine/magicsock/magicsock_test.go
+++ b/wgengine/magicsock/magicsock_test.go
@@ -247,7 +247,7 @@ func meshStacks(logf logger.Logf, mutateNetmap func(idx int, nm *netmap.NetworkM
 		me := ms[myIdx]
 		nm := &netmap.NetworkMap{
 			PrivateKey: me.privateKey,
-			NodeKey:    me.privateKey.Public().AsNodeKey(),
+			NodeKey:    me.privateKey.Public(),
 			Addresses:  []netaddr.IPPrefix{netaddr.IPPrefixFrom(netaddr.IPv4(1, 0, 0, byte(myIdx+1)), 32)},
 		}
 		for i, peer := range ms {