diff --git a/control/controlclient/direct.go b/control/controlclient/direct.go
index bdc09d4eb..b10131475 100644
--- a/control/controlclient/direct.go
+++ b/control/controlclient/direct.go
@@ -821,7 +821,7 @@ func (c *Direct) sendMapRequest(ctx context.Context, maxPolls int, readOnly bool
 	request := &tailcfg.MapRequest{
 		Version:       tailcfg.CurrentCapabilityVersion,
 		KeepAlive:     c.keepAlive,
-		NodeKey:       persist.PrivateNodeKey.Public(),
+		NodeKey:       persist.PublicNodeKey(),
 		DiscoKey:      c.discoPubKey,
 		Endpoints:     epStrs,
 		EndpointTypes: epTypes,
diff --git a/ipn/ipnlocal/local.go b/ipn/ipnlocal/local.go
index 605c145e9..3fe6e0153 100644
--- a/ipn/ipnlocal/local.go
+++ b/ipn/ipnlocal/local.go
@@ -3396,7 +3396,7 @@ func (b *LocalBackend) TestOnlyPublicKeys() (machineKey key.MachinePublic, nodeK
 	}
 
 	mk := machinePrivKey.Public()
-	nk := prefs.Persist().PrivateNodeKey.Public()
+	nk := prefs.Persist().PublicNodeKey()
 	return mk, nk
 }
 
@@ -3506,7 +3506,7 @@ func (b *LocalBackend) SetDNS(ctx context.Context, name, value string) error {
 	b.mu.Lock()
 	cc := b.ccAuto
 	if b.prefs.Valid() {
-		req.NodeKey = b.prefs.Persist().PrivateNodeKey.Public()
+		req.NodeKey = b.prefs.Persist().PublicNodeKey()
 	}
 	b.mu.Unlock()
 	if cc == nil {
diff --git a/ipn/ipnlocal/network-lock.go b/ipn/ipnlocal/network-lock.go
index c09aae904..bf2b9221a 100644
--- a/ipn/ipnlocal/network-lock.go
+++ b/ipn/ipnlocal/network-lock.go
@@ -100,7 +100,7 @@ func (b *LocalBackend) tkaSyncIfNeeded(nm *netmap.NetworkMap) error {
 	b.mu.Lock() // take mu to protect access to synchronized fields.
 	defer b.mu.Unlock()
 
-	ourNodeKey := b.prefs.Persist().PrivateNodeKey.Public()
+	ourNodeKey := b.prefs.Persist().PublicNodeKey()
 
 	isEnabled := b.tka != nil
 	wantEnabled := nm.TKAEnabled
@@ -342,7 +342,7 @@ func (b *LocalBackend) NetworkLockInit(keys []tka.Key) error {
 	var ourNodeKey key.NodePublic
 	b.mu.Lock()
 	if b.prefs.Valid() {
-		ourNodeKey = b.prefs.Persist().PrivateNodeKey.Public()
+		ourNodeKey = b.prefs.Persist().PublicNodeKey()
 	}
 	b.mu.Unlock()
 	if ourNodeKey.IsZero() {
@@ -453,7 +453,7 @@ func (b *LocalBackend) NetworkLockModify(addKeys, removeKeys []tka.Key) (err err
 		return nil
 	}
 
-	ourNodeKey := b.prefs.Persist().PrivateNodeKey.Public()
+	ourNodeKey := b.prefs.Persist().PublicNodeKey()
 	b.mu.Unlock()
 	resp, err := b.tkaDoSyncSend(ourNodeKey, aums, true)
 	b.mu.Lock()
diff --git a/types/persist/persist.go b/types/persist/persist.go
index 9b9034005..031ef3427 100644
--- a/types/persist/persist.go
+++ b/types/persist/persist.go
@@ -36,6 +36,11 @@ type Persist struct {
 	LoginName         string
 }
 
+// PublicNodeKey returns the public key for the node key.
+func (p *Persist) PublicNodeKey() key.NodePublic {
+	return p.PrivateNodeKey.Public()
+}
+
 func (p *Persist) Equals(p2 *Persist) bool {
 	if p == nil && p2 == nil {
 		return true
@@ -63,7 +68,7 @@ func (p *Persist) Pretty() string {
 		ok = p.OldPrivateNodeKey.Public()
 	}
 	if !p.PrivateNodeKey.IsZero() {
-		nk = p.PrivateNodeKey.Public()
+		nk = p.PublicNodeKey()
 	}
 	return fmt.Sprintf("Persist{lm=%v, o=%v, n=%v u=%#v}",
 		mk.ShortString(), ok.ShortString(), nk.ShortString(), p.LoginName)