diff --git a/tsnet/tsnet.go b/tsnet/tsnet.go
index 60acbccbd..a3dfeeff6 100644
--- a/tsnet/tsnet.go
+++ b/tsnet/tsnet.go
@@ -117,6 +117,7 @@ type Server struct {
 	loopbackListener net.Listener           // optional loopback for localapi and proxies
 	localAPIListener net.Listener           // in-memory, used by localClient
 	localClient      *tailscale.LocalClient // in-memory
+	localAPIServer   *http.Server
 	logbuffer        *filch.Filch
 	logtail          *logtail.Logger
 	logid            logid.PublicID
@@ -329,6 +330,13 @@ func (s *Server) Close() error {
 			s.logbuffer.Close()
 		}
 	}()
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		if s.localAPIServer != nil {
+			s.localAPIServer.Shutdown(ctx)
+		}
+	}()
 
 	if _, isMemStore := s.Store.(*mem.Store); isMemStore && s.Ephemeral && s.lb != nil {
 		wg.Add(1)
@@ -566,8 +574,9 @@ func (s *Server) start() (reterr error) {
 	lal := memnet.Listen("local-tailscaled.sock:80")
 	s.localAPIListener = lal
 	s.localClient = &tailscale.LocalClient{Dial: lal.Dial}
+	s.localAPIServer = &http.Server{Handler: lah}
 	go func() {
-		if err := http.Serve(lal, lah); err != nil {
+		if err := s.localAPIServer.Serve(lal); err != nil {
 			logf("localapi serve error: %v", err)
 		}
 	}()
diff --git a/tsnet/tsnet_test.go b/tsnet/tsnet_test.go
index e170de5e0..8de731726 100644
--- a/tsnet/tsnet_test.go
+++ b/tsnet/tsnet_test.go
@@ -34,6 +34,7 @@ import (
 	"tailscale.com/ipn/store/mem"
 	"tailscale.com/net/netns"
 	"tailscale.com/tailcfg"
+	"tailscale.com/tstest"
 	"tailscale.com/tstest/integration"
 	"tailscale.com/tstest/integration/testcontrol"
 	"tailscale.com/types/logger"
@@ -223,6 +224,7 @@ func startServer(t *testing.T, ctx context.Context, controlURL, hostname string)
 }
 
 func TestConn(t *testing.T) {
+	tstest.ResourceCheck(t)
 	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 	defer cancel()
 
@@ -280,6 +282,7 @@ func TestConn(t *testing.T) {
 }
 
 func TestLoopbackLocalAPI(t *testing.T) {
+	tstest.ResourceCheck(t)
 	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 	defer cancel()
 
diff --git a/wgengine/netstack/netstack.go b/wgengine/netstack/netstack.go
index 8fc9d6cca..fcd346586 100644
--- a/wgengine/netstack/netstack.go
+++ b/wgengine/netstack/netstack.go
@@ -222,6 +222,7 @@ func Create(logf logger.Logf, tundev *tstun.Wrapper, e wgengine.Engine, mc *magi
 func (ns *Impl) Close() error {
 	ns.ctxCancel()
 	ns.ipstack.Close()
+	ns.ipstack.Wait()
 	return nil
 }