diff --git a/wgengine/magicsock/magicsock_test.go b/wgengine/magicsock/magicsock_test.go
index bcc3ee7c9..5ae40ab4c 100644
--- a/wgengine/magicsock/magicsock_test.go
+++ b/wgengine/magicsock/magicsock_test.go
@@ -928,6 +928,13 @@ func testTwoDevicePing(t *testing.T, d *devices) {
 		t.Fatal(err)
 	}
 
+	// In the normal case, pings succeed immediately.
+	// However, in the case of a handshake race, we need to retry.
+	// Typical retries take 5s. With very bad luck, we can need to retry
+	// multiple times. Give ourselves enough time for three retries
+	// plus a bit of processing time.
+	const pingTimeout = 16 * time.Second
+
 	ping1 := func(t *testing.T) {
 		msg2to1 := tuntest.Ping(net.ParseIP("1.0.0.1"), net.ParseIP("1.0.0.2"))
 		m2.tun.Outbound <- msg2to1
@@ -937,7 +944,7 @@ func testTwoDevicePing(t *testing.T, d *devices) {
 			if !bytes.Equal(msg2to1, msgRecv) {
 				t.Error("ping did not transit correctly")
 			}
-		case <-time.After(3 * time.Second):
+		case <-time.After(pingTimeout):
 			t.Error("ping did not transit")
 		}
 	}
@@ -950,7 +957,7 @@ func testTwoDevicePing(t *testing.T, d *devices) {
 			if !bytes.Equal(msg1to2, msgRecv) {
 				t.Error("return ping did not transit correctly")
 			}
-		case <-time.After(3 * time.Second):
+		case <-time.After(pingTimeout):
 			t.Error("return ping did not transit")
 		}
 	}
@@ -981,7 +988,7 @@ func testTwoDevicePing(t *testing.T, d *devices) {
 			if !bytes.Equal(msg1to2, msgRecv) {
 				t.Error("return ping did not transit correctly")
 			}
-		case <-time.After(3 * time.Second):
+		case <-time.After(pingTimeout):
 			t.Error("return ping did not transit")
 		}
 	})
@@ -1044,7 +1051,7 @@ func testTwoDevicePing(t *testing.T, d *devices) {
 						t.Errorf("return ping %d did not transit correctly: %s", i, cmp.Diff(b, msgRecv))
 					}
 				}
-			case <-time.After(3 * time.Second):
+			case <-time.After(pingTimeout):
 				if strict {
 					t.Errorf("return ping %d did not transit", i)
 				}