diff --git a/wgengine/magicsock/magicsock.go b/wgengine/magicsock/magicsock.go
index 2e34d5d11..13bfd308a 100644
--- a/wgengine/magicsock/magicsock.go
+++ b/wgengine/magicsock/magicsock.go
@@ -1873,6 +1873,8 @@ func (c *Conn) handlePingLocked(dm *disco.Ping, src netaddr.IPPort, di *discoInf
 	di.lastPingFrom = src
 	di.lastPingTime = time.Now()
 
+	isDerp := src.IP() == derpMagicIPAddr
+
 	// If we got a ping over DERP, then derpNodeSrc is non-zero and we reply
 	// over DERP (in which case ipDst is also a DERP address).
 	// But if the ping was over UDP (ipDst is not a DERP address), then dstKey
@@ -1881,14 +1883,14 @@ func (c *Conn) handlePingLocked(dm *disco.Ping, src netaddr.IPPort, di *discoInf
 	dstKey := derpNodeSrc
 
 	// Remember this route if not present.
-	c.setAddrToDiscoLocked(src, di.discoKey)
 	var numNodes int
-	if !derpNodeSrc.IsZero() {
+	if isDerp {
 		if ep, ok := c.peerMap.endpointForNodeKey(derpNodeSrc); ok {
 			ep.addCandidateEndpoint(src)
 			numNodes = 1
 		}
 	} else {
+		c.setAddrToDiscoLocked(src, di.discoKey)
 		c.peerMap.forEachEndpointWithDiscoKey(di.discoKey, func(ep *endpoint) {
 			ep.addCandidateEndpoint(src)
 			numNodes++