diff --git a/derp/derp_client.go b/derp/derp_client.go
index 551548b92..d771d2203 100644
--- a/derp/derp_client.go
+++ b/derp/derp_client.go
@@ -15,18 +15,19 @@
 
 	"golang.org/x/crypto/curve25519"
 	"golang.org/x/crypto/nacl/box"
+	"tailscale.com/logger"
 )
 
 type Client struct {
 	serverKey  [32]byte
 	privateKey [32]byte // TODO(crawshaw): make this wgcfg.PrivateKey?
 	publicKey  [32]byte
-	logf       func(format string, args ...interface{})
+	logf       logger.Logf
 	netConn    net.Conn
 	conn       *bufio.ReadWriter
 }
 
-func NewClient(privateKey [32]byte, netConn net.Conn, conn *bufio.ReadWriter, logf func(format string, args ...interface{})) (*Client, error) {
+func NewClient(privateKey [32]byte, netConn net.Conn, conn *bufio.ReadWriter, logf logger.Logf) (*Client, error) {
 	c := &Client{
 		privateKey: privateKey,
 		logf:       logf,
diff --git a/derp/derp_server.go b/derp/derp_server.go
index 14948836c..d054ea0bc 100644
--- a/derp/derp_server.go
+++ b/derp/derp_server.go
@@ -23,6 +23,7 @@
 
 	"golang.org/x/crypto/curve25519"
 	"golang.org/x/crypto/nacl/box"
+	"tailscale.com/logger"
 )
 
 const magic = 0x44c55250 // "DERP" with a non-ASCII high-bit
@@ -44,14 +45,14 @@
 type Server struct {
 	privateKey [32]byte // TODO(crawshaw): make this wgcfg.PrivateKey?
 	publicKey  [32]byte
-	logf       func(format string, args ...interface{})
+	logf       logger.Logf
 
 	mu       sync.Mutex
 	netConns map[net.Conn]chan struct{}
 	clients  map[[32]byte]*client
 }
 
-func NewServer(privateKey [32]byte, logf func(format string, args ...interface{})) *Server {
+func NewServer(privateKey [32]byte, logf logger.Logf) *Server {
 	s := &Server{
 		privateKey: privateKey,
 		logf:       logf,
diff --git a/derp/derphttp/derphttp_client.go b/derp/derphttp/derphttp_client.go
index 16d747b02..30ee51015 100644
--- a/derp/derphttp/derphttp_client.go
+++ b/derp/derphttp/derphttp_client.go
@@ -23,6 +23,7 @@
 	"sync"
 
 	"tailscale.com/derp"
+	"tailscale.com/logger"
 )
 
 // Client is a DERP-over-HTTP client.
@@ -32,7 +33,7 @@
 // Send/Recv will completely re-establish the connection.
 type Client struct {
 	privateKey [32]byte
-	logf       func(format string, args ...interface{})
+	logf       logger.Logf
 	closed     chan struct{}
 	url        *url.URL
 	resp       *http.Response
@@ -44,13 +45,13 @@ type Client struct {
 	client   *derp.Client
 }
 
-func NewClient(privateKey [32]byte, serverURL string, logf func(format string, args ...interface{})) (c *Client, err error) {
+func NewClient(privateKey [32]byte, serverURL string, logf logger.Logf) (*Client, error) {
 	u, err := url.Parse(serverURL)
 	if err != nil {
 		return nil, fmt.Errorf("derphttp.NewClient: %v", err)
 	}
 
-	c = &Client{
+	c := &Client{
 		privateKey: privateKey,
 		logf:       logf,
 		url:        u,
diff --git a/wgengine/rusage.go b/wgengine/rusage.go
index 35756b46c..98df2afa4 100644
--- a/wgengine/rusage.go
+++ b/wgengine/rusage.go
@@ -7,9 +7,11 @@
 import (
 	"fmt"
 	"runtime"
+
+	"tailscale.com/logger"
 )
 
-func RusagePrefixLog(logf func(f string, argv ...interface{})) func(f string, argv ...interface{}) {
+func RusagePrefixLog(logf logger.Logf) func(f string, argv ...interface{}) {
 	return func(f string, argv ...interface{}) {
 		var m runtime.MemStats
 		runtime.ReadMemStats(&m)