diff --git a/ipn/ipnlocal/loglines_test.go b/ipn/ipnlocal/loglines_test.go
index cb6bb4cb6..a7e8ccd7e 100644
--- a/ipn/ipnlocal/loglines_test.go
+++ b/ipn/ipnlocal/loglines_test.go
@@ -90,7 +90,7 @@ func TestLocalLogLines(t *testing.T) {
 			TxBytes:       10,
 			RxBytes:       10,
 			LastHandshake: time.Now(),
-			NodeKey:       tailcfg.NodeKey(key.NewPrivate()),
+			NodeKey:       tailcfg.NodeKeyFromNodePublic(key.NewNode().Public()),
 		}},
 	})
 	lb.mu.Unlock()
@@ -105,7 +105,7 @@ func TestLocalLogLines(t *testing.T) {
 			TxBytes:       11,
 			RxBytes:       12,
 			LastHandshake: time.Now(),
-			NodeKey:       tailcfg.NodeKey(key.NewPrivate()),
+			NodeKey:       tailcfg.NodeKeyFromNodePublic(key.NewNode().Public()),
 		}},
 	})
 	lb.mu.Unlock()
diff --git a/tstest/integration/testcontrol/testcontrol.go b/tstest/integration/testcontrol/testcontrol.go
index dd54d2cb1..4fea34680 100644
--- a/tstest/integration/testcontrol/testcontrol.go
+++ b/tstest/integration/testcontrol/testcontrol.go
@@ -274,9 +274,9 @@ func (s *Server) AddFakeNode() {
 	if s.nodes == nil {
 		s.nodes = make(map[tailcfg.NodeKey]*tailcfg.Node)
 	}
-	nk := tailcfg.NodeKey(key.NewPrivate().Public())
+	nk := tailcfg.NodeKeyFromNodePublic(key.NewNode().Public())
 	mk := key.NewMachine().Public()
-	dk := tailcfg.DiscoKey(key.NewPrivate().Public())
+	dk := tailcfg.DiscoKeyFromDiscoPublic(key.NewDisco().Public())
 	id := int64(binary.LittleEndian.Uint64(nk[:]))
 	ip := netaddr.IPv4(nk[0], nk[1], nk[2], nk[3])
 	addr := netaddr.IPPrefixFrom(ip, 32)
diff --git a/wgengine/magicsock/magicsock_test.go b/wgengine/magicsock/magicsock_test.go
index 2f99ef9aa..e2df694b4 100644
--- a/wgengine/magicsock/magicsock_test.go
+++ b/wgengine/magicsock/magicsock_test.go
@@ -1136,7 +1136,7 @@ func TestDiscoMessage(t *testing.T) {
 	peer1Pub := c.DiscoPublicKey()
 	peer1Priv := c.discoPrivate
 	n := &tailcfg.Node{
-		Key:      tailcfg.NodeKey(key.NewPrivate().Public()),
+		Key:      tailcfg.NodeKeyFromNodePublic(key.NewNode().Public()),
 		DiscoKey: tailcfg.DiscoKeyFromDiscoPublic(peer1Pub),
 	}
 	c.peerMap.upsertEndpoint(&endpoint{
diff --git a/wgengine/userspace_test.go b/wgengine/userspace_test.go
index a88c7bfb3..18c1ba5e6 100644
--- a/wgengine/userspace_test.go
+++ b/wgengine/userspace_test.go
@@ -45,7 +45,7 @@ func TestNoteReceiveActivity(t *testing.T) {
 	}
 	ra := e.recvActivityAt
 
-	nk := tailcfg.NodeKey(key.NewPrivate().Public())
+	nk := tailcfg.NodeKeyFromNodePublic(key.NewNode().Public())
 
 	// Activity on an untracked key should do nothing.
 	e.noteRecvActivity(nk)