diff --git a/cmd/tsconnect/wasm/wasm_js.go b/cmd/tsconnect/wasm/wasm_js.go
index ba376a7d1..b58242c42 100644
--- a/cmd/tsconnect/wasm/wasm_js.go
+++ b/cmd/tsconnect/wasm/wasm_js.go
@@ -253,7 +253,7 @@ func (i *jsIPN) run(jsCallbacks js.Value) {
 						NodeKey:    nm.NodeKey.String(),
 						MachineKey: nm.MachineKey.String(),
 					},
-					MachineStatus: jsMachineStatus[nm.MachineStatus],
+					MachineStatus: jsMachineStatus[nm.GetMachineStatus()],
 				},
 				Peers: mapSlice(nm.Peers, func(p tailcfg.NodeView) jsNetMapPeerNode {
 					name := p.Name()
diff --git a/ipn/ipnlocal/local.go b/ipn/ipnlocal/local.go
index 3ac6d185a..7088b35e3 100644
--- a/ipn/ipnlocal/local.go
+++ b/ipn/ipnlocal/local.go
@@ -3812,7 +3812,7 @@ func (b *LocalBackend) nextStateLocked() ipn.State {
 		// NetMap must be non-nil for us to get here.
 		// The node key expired, need to relogin.
 		return ipn.NeedsLogin
-	case netMap.MachineStatus != tailcfg.MachineAuthorized:
+	case netMap.GetMachineStatus() != tailcfg.MachineAuthorized:
 		// TODO(crawshaw): handle tailcfg.MachineInvalid
 		return ipn.NeedsMachineAuth
 	case state == ipn.NeedsMachineAuth:
diff --git a/types/netmap/netmap.go b/types/netmap/netmap.go
index d9687cdac..7c6302ff3 100644
--- a/types/netmap/netmap.go
+++ b/types/netmap/netmap.go
@@ -40,7 +40,10 @@ type NetworkMap struct {
 
 	// MachineStatus is either tailcfg.MachineAuthorized or tailcfg.MachineUnauthorized,
 	// depending on SelfNode.MachineAuthorized.
-	// TODO(bradfitz): remove this field and make it a method.
+	//
+	// Deprecated: use GetMachineStatus instead. This field exists still
+	// exists (as of 2023-09-13) for some tests in other repos that haven't
+	// yet been migrated. TODO(bradfitz): remove this field.
 	MachineStatus tailcfg.MachineStatus
 
 	MachineKey key.MachinePublic
@@ -106,6 +109,23 @@ func (nm *NetworkMap) AnyPeersAdvertiseRoutes() bool {
 	return false
 }
 
+// GetMachineStatus returns the MachineStatus of the local node.
+func (nm *NetworkMap) GetMachineStatus() tailcfg.MachineStatus {
+	if nm.MachineStatus != tailcfg.MachineUnknown {
+		// For now (2023-09-13), let the deprecated MachineStatus field take
+		// precedence. This is a migration mechanism while we update tests &
+		// code cross-repo.
+		return nm.MachineStatus
+	}
+	if !nm.SelfNode.Valid() {
+		return tailcfg.MachineUnknown
+	}
+	if nm.SelfNode.MachineAuthorized() {
+		return tailcfg.MachineAuthorized
+	}
+	return tailcfg.MachineUnauthorized
+}
+
 // PeerByTailscaleIP returns a peer's Node based on its Tailscale IP.
 //
 // If nm is nil or no peer is found, ok is false.
@@ -211,7 +231,7 @@ func (nm *NetworkMap) PeerWithStableID(pid tailcfg.StableNodeID) (_ tailcfg.Node
 // in equalConciseHeader in sync.
 func (nm *NetworkMap) printConciseHeader(buf *strings.Builder) {
 	fmt.Fprintf(buf, "netmap: self: %v auth=%v",
-		nm.NodeKey.ShortString(), nm.MachineStatus)
+		nm.NodeKey.ShortString(), nm.GetMachineStatus())
 	login := nm.UserProfiles[nm.User()].LoginName
 	if login == "" {
 		if nm.User().IsZero() {
@@ -229,7 +249,7 @@ func (nm *NetworkMap) printConciseHeader(buf *strings.Builder) {
 // used by printConciseHeader.
 func (a *NetworkMap) equalConciseHeader(b *NetworkMap) bool {
 	if a.NodeKey != b.NodeKey ||
-		a.MachineStatus != b.MachineStatus ||
+		a.GetMachineStatus() != b.GetMachineStatus() ||
 		a.User() != b.User() ||
 		len(a.Addresses) != len(b.Addresses) {
 		return false