diff --git a/net/dns/manager_plan9.go b/net/dns/manager_plan9.go
index 24702ced5..ca179f27f 100644
--- a/net/dns/manager_plan9.go
+++ b/net/dns/manager_plan9.go
@@ -11,11 +11,11 @@ import (
 	"bytes"
 	"fmt"
 	"io"
-	"log"
 	"net/netip"
 	"os"
 	"regexp"
 	"strings"
+	"unicode"
 
 	"tailscale.com/control/controlknobs"
 	"tailscale.com/health"
@@ -37,16 +37,6 @@ type plan9DNSManager struct {
 	knobs *controlknobs.Knobs
 }
 
-// netNDBWithoutTailscale returns /net/ndb with any Tailscale
-// bits removed.
-func netNDBWithoutTailscale() ([]byte, error) {
-	raw, err := os.ReadFile("/net/ndb")
-	if err != nil {
-		return nil, err
-	}
-	return netNDBBytesWithoutTailscale(raw)
-}
-
 // netNDBBytesWithoutTailscale returns raw (the contents of /net/ndb) with any
 // Tailscale bits removed.
 func netNDBBytesWithoutTailscale(raw []byte) ([]byte, error) {
@@ -105,8 +95,9 @@ func setNDBSuffix(tsFree []byte, suffix string) []byte {
 			addLine(fmt.Sprintf("\tdnsdomain=%s\n", suffix))
 		}
 	}
-	if len(added) == 0 || true {
-		return buf.Bytes()
+	bufTrim := bytes.TrimLeftFunc(buf.Bytes(), unicode.IsSpace)
+	if len(added) == 0 {
+		return bufTrim
 	}
 	var ret bytes.Buffer
 	for _, s := range added {
@@ -115,12 +106,17 @@ func setNDBSuffix(tsFree []byte, suffix string) []byte {
 		ret.WriteString("\n")
 	}
 	ret.WriteString("\n")
-	ret.Write(buf.Bytes())
+	ret.Write(bufTrim)
 	return ret.Bytes()
 }
 
 func (m *plan9DNSManager) SetDNS(c OSConfig) error {
-	tsFree, err := netNDBWithoutTailscale()
+	ndbOnDisk, err := os.ReadFile("/net/ndb")
+	if err != nil {
+		return err
+	}
+
+	tsFree, err := netNDBBytesWithoutTailscale(ndbOnDisk)
 	if err != nil {
 		return err
 	}
@@ -131,8 +127,7 @@ func (m *plan9DNSManager) SetDNS(c OSConfig) error {
 	}
 
 	newBuf := setNDBSuffix(tsFree, suffix)
-	if !bytes.Equal(newBuf, tsFree) {
-		log.Printf("XXX plan9: going to write /net/ndb of %q", newBuf)
+	if !bytes.Equal(newBuf, ndbOnDisk) {
 		if err := os.WriteFile("/net/ndb", newBuf, 0644); err != nil {
 			return fmt.Errorf("writing /net/ndb: %w", err)
 		}
diff --git a/wgengine/router/router_plan9.go b/wgengine/router/router_plan9.go
index 5a03602a3..ce756e182 100644
--- a/wgengine/router/router_plan9.go
+++ b/wgengine/router/router_plan9.go
@@ -57,7 +57,7 @@ func (r *plan9Router) Set(cfg *Config) error {
 			self6 = addr.Addr()
 		}
 		_, err := fmt.Fprintf(ctl, "add %s /%d\n", addr.Addr().String(), maskBits)
-		r.logf("XXX add %s /%d = %v", addr.Addr().String(), maskBits, err)
+		r.logf("route/plan9: add %s /%d = %v", addr.Addr().String(), maskBits, err)
 	}
 
 	ipr, err := os.OpenFile("/net/iproute", os.O_RDWR, 0)
@@ -86,20 +86,20 @@ func (r *plan9Router) Set(cfg *Config) error {
 			nextHop = self6
 		}
 		if !nextHop.IsValid() {
-			r.logf("XXX skipping route %s: no next hop (no self addr)", route.String())
+			r.logf("route/plan9: skipping route %s: no next hop (no self addr)", route.String())
 			continue
 		}
-		r.logf("XXX plan9.router: add %s /%d %s", route.Addr(), maskBits, nextHop)
+		r.logf("route/plan9: plan9.router: add %s /%d %s", route.Addr(), maskBits, nextHop)
 		if _, err := fmt.Fprintf(ipr, "add %s /%d %s\n", route.Addr(), maskBits, nextHop); err != nil {
 			return fmt.Errorf("add %s: %w", route.String(), err)
 		}
 	}
 
 	if len(cfg.LocalRoutes) > 0 {
-		r.logf("XXX TODO: Set LocalRoutes %v", cfg.LocalRoutes)
+		r.logf("route/plan9: TODO: Set LocalRoutes %v", cfg.LocalRoutes)
 	}
 	if len(cfg.SubnetRoutes) > 0 {
-		r.logf("XXX TODO: Set SubnetRoutes %v", cfg.SubnetRoutes)
+		r.logf("route/plan9: TODO: Set SubnetRoutes %v", cfg.SubnetRoutes)
 	}
 
 	return nil