diff --git a/control/controlclient/direct.go b/control/controlclient/direct.go
index 3de527dfd..d30dad74a 100644
--- a/control/controlclient/direct.go
+++ b/control/controlclient/direct.go
@@ -45,6 +45,10 @@
 	"tailscale.com/version"
 )
 
+var (
+	enableV6Overlay, _ = strconv.ParseBool(os.Getenv("TS_DEBUG_ENABLE_IPV6_OVERLAY"))
+)
+
 type Persist struct {
 	_ structs.Incomparable
 
@@ -525,15 +529,16 @@ func (c *Direct) PollNetMap(ctx context.Context, maxPolls int, cb func(*NetworkM
 	}
 
 	request := tailcfg.MapRequest{
-		Version:     4,
-		IncludeIPv6: true,
-		DeltaPeers:  true,
-		KeepAlive:   c.keepAlive,
-		NodeKey:     tailcfg.NodeKey(persist.PrivateNodeKey.Public()),
-		DiscoKey:    c.discoPubKey,
-		Endpoints:   ep,
-		Stream:      allowStream,
-		Hostinfo:    hostinfo,
+		Version:            4,
+		IncludeIPv6:        true,
+		IncludeIPv6Overlay: enableV6Overlay,
+		DeltaPeers:         true,
+		KeepAlive:          c.keepAlive,
+		NodeKey:            tailcfg.NodeKey(persist.PrivateNodeKey.Public()),
+		DiscoKey:           c.discoPubKey,
+		Endpoints:          ep,
+		Stream:             allowStream,
+		Hostinfo:           hostinfo,
 	}
 	if c.newDecompressor != nil {
 		request.Compress = "zstd"
diff --git a/tailcfg/tailcfg.go b/tailcfg/tailcfg.go
index 3acfbcc90..1e56d9e93 100644
--- a/tailcfg/tailcfg.go
+++ b/tailcfg/tailcfg.go
@@ -461,16 +461,17 @@ type RegisterResponse struct {
 // using the local machine key, and sent to:
 //	https://login.tailscale.com/machine/<mkey hex>/map
 type MapRequest struct {
-	Version     int    // current version is 4
-	Compress    string // "zstd" or "" (no compression)
-	KeepAlive   bool   // whether server should send keep-alives back to us
-	NodeKey     NodeKey
-	DiscoKey    DiscoKey
-	Endpoints   []string // caller's endpoints (IPv4 or IPv6)
-	IncludeIPv6 bool     // include IPv6 endpoints in returned Node Endpoints
-	DeltaPeers  bool     // whether the 2nd+ network map in response should be deltas, using PeersChanged, PeersRemoved
-	Stream      bool     // if true, multiple MapResponse objects are returned
-	Hostinfo    *Hostinfo
+	Version            int    // current version is 4
+	Compress           string // "zstd" or "" (no compression)
+	KeepAlive          bool   // whether server should send keep-alives back to us
+	NodeKey            NodeKey
+	DiscoKey           DiscoKey
+	Endpoints          []string // caller's endpoints (IPv4 or IPv6)
+	IncludeIPv6        bool     // include IPv6 endpoints in returned Node Endpoints
+	IncludeIPv6Overlay bool     // include IPv6 Addresses and AllowedIPs in returned Nodes.
+	DeltaPeers         bool     // whether the 2nd+ network map in response should be deltas, using PeersChanged, PeersRemoved
+	Stream             bool     // if true, multiple MapResponse objects are returned
+	Hostinfo           *Hostinfo
 
 	// ReadOnly is whether the client just wants to fetch the
 	// MapResponse, without updating their Endpoints. The