diff --git a/ipn/local.go b/ipn/local.go
index 9303be87f..35a121461 100644
--- a/ipn/local.go
+++ b/ipn/local.go
@@ -868,7 +868,7 @@ func (b *LocalBackend) enterState(newState State) {
 		b.blockEngineUpdates(true)
 		fallthrough
 	case Stopped:
-		err := b.e.Reconfig(&wgcfg.Config{}, nil)
+		err := b.e.Reconfig(&wgcfg.Config{}, &router.Config{})
 		if err != nil {
 			b.logf("Reconfig(down): %v", err)
 		}
@@ -958,7 +958,7 @@ func (b *LocalBackend) stateMachine() {
 // a status update that predates the "I've shut down" update.
 func (b *LocalBackend) stopEngineAndWait() {
 	b.logf("stopEngineAndWait...")
-	b.e.Reconfig(&wgcfg.Config{}, nil)
+	b.e.Reconfig(&wgcfg.Config{}, &router.Config{})
 	b.requestEngineStatusAndWait()
 	b.logf("stopEngineAndWait: done.")
 }
diff --git a/wgengine/router/router_darwin.go b/wgengine/router/router_darwin.go
index ac937ad7f..36b718248 100644
--- a/wgengine/router/router_darwin.go
+++ b/wgengine/router/router_darwin.go
@@ -11,6 +11,7 @@ import (
 )
 
 type darwinRouter struct {
+	logf    logger.Logf
 	tunname string
 }
 
@@ -19,7 +20,10 @@ func newUserspaceRouter(logf logger.Logf, _ *device.Device, tundev tun.Device) (
 	if err != nil {
 		return nil, err
 	}
-	return &darwinRouter{tunname: tunname}, nil
+	return &darwinRouter{
+		logf:    logf,
+		tunname: tunname,
+	}, nil
 }
 
 func (r *darwinRouter) Up() error {
diff --git a/wgengine/userspace.go b/wgengine/userspace.go
index a19ca15e5..e160ccc4e 100644
--- a/wgengine/userspace.go
+++ b/wgengine/userspace.go
@@ -370,6 +370,10 @@ func configSignature(cfg *wgcfg.Config, routerCfg *router.Config) (string, error
 }
 
 func (e *userspaceEngine) Reconfig(cfg *wgcfg.Config, routerCfg *router.Config) error {
+	if routerCfg == nil {
+		panic("routerCfg must not be nil")
+	}
+
 	e.wgLock.Lock()
 	defer e.wgLock.Unlock()