diff --git a/wgengine/userspace.go b/wgengine/userspace.go
index 6583804ec..e78d5939c 100644
--- a/wgengine/userspace.go
+++ b/wgengine/userspace.go
@@ -118,6 +118,7 @@ type userspaceEngine struct {
 	lastEngineSigFull   deephash.Sum // of full wireguard config
 	lastEngineSigTrim   deephash.Sum // of trimmed wireguard config
 	lastDNSConfig       *dns.Config
+	lastIsSubnetRouter  bool // was the node a primary subnet router in the last run.
 	recvActivityAt      map[key.NodePublic]mono.Time
 	trimmedNodes        map[key.NodePublic]bool   // set of node keys of peers currently excluded from wireguard config
 	sentActivityAt      map[netaddr.IP]*mono.Time // value is accessed atomically
@@ -125,8 +126,6 @@ type userspaceEngine struct {
 	statusBufioReader   *bufio.Reader // reusable for UAPI
 	lastStatusPollTime  mono.Time     // last time we polled the engine status
 
-	lastIsSubnetRouter bool // was the node a primary subnet router in the last run.
-
 	mu                  sync.Mutex         // guards following; see lock order comment below
 	netMap              *netmap.NetworkMap // or nil
 	closing             bool               // Close was called (even if we're still closing)
@@ -854,6 +853,7 @@ func (e *userspaceEngine) Reconfig(cfg *wgcfg.Config, routerCfg *router.Config,
 		e.peerSequence = append(e.peerSequence, p.PublicKey)
 		peerSet[p.PublicKey] = struct{}{}
 	}
+	nm := e.netMap
 	e.mu.Unlock()
 
 	listenPort := e.confListenPort
@@ -862,8 +862,8 @@ func (e *userspaceEngine) Reconfig(cfg *wgcfg.Config, routerCfg *router.Config,
 	}
 
 	isSubnetRouter := false
-	if e.birdClient != nil {
-		isSubnetRouter = hasOverlap(e.netMap.SelfNode.PrimaryRoutes, e.netMap.Hostinfo.RoutableIPs)
+	if e.birdClient != nil && nm != nil && nm.SelfNode != nil {
+		isSubnetRouter = hasOverlap(nm.SelfNode.PrimaryRoutes, nm.Hostinfo.RoutableIPs)
 	}
 	isSubnetRouterChanged := isSubnetRouter != e.lastIsSubnetRouter