diff --git a/cmd/tailscale/cli/cli_test.go b/cmd/tailscale/cli/cli_test.go
index b0658fd95..d103c8f7e 100644
--- a/cmd/tailscale/cli/cli_test.go
+++ b/cmd/tailscale/cli/cli_test.go
@@ -1448,7 +1448,7 @@ func TestParseNLArgs(t *testing.T) {
 			name:      "disablements not allowed",
 			input:     []string{"disablement:" + strings.Repeat("02", 32)},
 			parseKeys: true,
-			wantErr:   fmt.Errorf("parsing key 1: key hex string doesn't have expected type prefix nlpub:"),
+			wantErr:   fmt.Errorf("parsing key 1: key hex string doesn't have expected type prefix tlpub:"),
 		},
 		{
 			name:              "keys not allowed",
diff --git a/types/key/nl.go b/types/key/nl.go
index e0b4e5ca6..50caed98c 100644
--- a/types/key/nl.go
+++ b/types/key/nl.go
@@ -131,10 +131,10 @@ func NLPublicFromEd25519Unsafe(public ed25519.PublicKey) NLPublic {
 // is able to decode both the CLI form (tlpub:<hex>) & the
 // regular form (nlpub:<hex>).
 func (k *NLPublic) UnmarshalText(b []byte) error {
-	if mem.HasPrefix(mem.B(b), mem.S(nlPublicHexPrefixCLI)) {
-		return parseHex(k.k[:], mem.B(b), mem.S(nlPublicHexPrefixCLI))
+	if mem.HasPrefix(mem.B(b), mem.S(nlPublicHexPrefix)) {
+		return parseHex(k.k[:], mem.B(b), mem.S(nlPublicHexPrefix))
 	}
-	return parseHex(k.k[:], mem.B(b), mem.S(nlPublicHexPrefix))
+	return parseHex(k.k[:], mem.B(b), mem.S(nlPublicHexPrefixCLI))
 }
 
 // AppendText implements encoding.TextAppender.