diff --git a/ipn/ipnlocal/local.go b/ipn/ipnlocal/local.go
index 849a57b49..8ea234d38 100644
--- a/ipn/ipnlocal/local.go
+++ b/ipn/ipnlocal/local.go
@@ -523,6 +523,7 @@ func stripKeysFromPrefs(p ipn.PrefsView) ipn.PrefsView {
 	p2.Persist.LegacyFrontendPrivateMachineKey = key.MachinePrivate{}
 	p2.Persist.PrivateNodeKey = key.NodePrivate{}
 	p2.Persist.OldPrivateNodeKey = key.NodePrivate{}
+	p2.Persist.NetworkLockKey = key.NLPrivate{}
 	return p2.View()
 }
 
diff --git a/ipn/ipnlocal/state_test.go b/ipn/ipnlocal/state_test.go
index 8a1653fe2..3ff1fcf72 100644
--- a/ipn/ipnlocal/state_test.go
+++ b/ipn/ipnlocal/state_test.go
@@ -973,20 +973,21 @@ func TestEditPrefsHasNoKeys(t *testing.T) {
 		t.Errorf("Hostname = %q; want foo", p.Hostname())
 	}
 
-	// Test that we can't see the PrivateNodeKey.
 	if !p.Persist().PrivateNodeKey.IsZero() {
 		t.Errorf("PrivateNodeKey = %v; want zero", p.Persist().PrivateNodeKey)
 	}
 
-	// Test that we can't see the PrivateNodeKey.
 	if !p.Persist().OldPrivateNodeKey.IsZero() {
 		t.Errorf("OldPrivateNodeKey = %v; want zero", p.Persist().OldPrivateNodeKey)
 	}
 
-	// Test that we can't see the PrivateNodeKey.
 	if !p.Persist().LegacyFrontendPrivateMachineKey.IsZero() {
 		t.Errorf("LegacyFrontendPrivateMachineKey = %v; want zero", p.Persist().LegacyFrontendPrivateMachineKey)
 	}
+
+	if !p.Persist().NetworkLockKey.IsZero() {
+		t.Errorf("NetworkLockKey= %v; want zero", p.Persist().NetworkLockKey)
+	}
 }
 
 type testStateStorage struct {