diff --git a/ipn/ipnlocal/c2n.go b/ipn/ipnlocal/c2n.go
index e91921533..b33794751 100644
--- a/ipn/ipnlocal/c2n.go
+++ b/ipn/ipnlocal/c2n.go
@@ -360,7 +360,7 @@ func handleC2NPostureIdentityGet(b *LocalBackend, w http.ResponseWriter, r *http
 		// and looks good in client metrics, remove this parameter and always report MAC
 		// addresses.
 		if r.FormValue("hwaddrs") == "true" {
-			res.IfaceHardwareAddrs, err = posture.GetHardwareAddrs()
+			res.IfaceHardwareAddrs, err = b.getHardwareAddrs()
 			if err != nil {
 				b.logf("c2n: GetHardwareAddrs returned error: %v", err)
 			}
diff --git a/ipn/ipnlocal/local.go b/ipn/ipnlocal/local.go
index 63b9d576a..206f69968 100644
--- a/ipn/ipnlocal/local.go
+++ b/ipn/ipnlocal/local.go
@@ -78,6 +78,7 @@ import (
 	"tailscale.com/net/tsdial"
 	"tailscale.com/paths"
 	"tailscale.com/portlist"
+	"tailscale.com/posture"
 	"tailscale.com/syncs"
 	"tailscale.com/tailcfg"
 	"tailscale.com/taildrop"
@@ -433,6 +434,12 @@ type LocalBackend struct {
 	// notified about.
 	lastNotifiedDriveShares *views.SliceView[*drive.Share, drive.ShareView]
 
+	// lastKnownHardwareAddrs is a list of the previous known hardware addrs.
+	// Previously known hwaddrs are kept to work around an issue on Windows
+	// where all addresses might disappear.
+	// http://go/corp/25168
+	lastKnownHardwareAddrs syncs.AtomicValue[[]string]
+
 	// outgoingFiles keeps track of Taildrop outgoing files keyed to their OutgoingFile.ID
 	outgoingFiles map[string]*ipn.OutgoingFile
 
@@ -7619,6 +7626,25 @@ func (b *LocalBackend) notifyProfileChangeLocked(profile ipn.LoginProfileView, p
 	}
 }
 
+// getHardwareAddrs returns the hardware addresses for the machine. If the list
+// of hardware addresses is empty, it will return the previously known hardware
+// addresses. Both the current, and previously known hardware addresses might be
+// empty.
+func (b *LocalBackend) getHardwareAddrs() ([]string, error) {
+	addrs, err := posture.GetHardwareAddrs()
+	if err != nil {
+		return nil, err
+	}
+
+	if len(addrs) == 0 {
+		b.logf("getHardwareAddrs: got empty list of hwaddrs, returning previous list")
+		return b.lastKnownHardwareAddrs.Load(), nil
+	}
+
+	b.lastKnownHardwareAddrs.Store(addrs)
+	return addrs, nil
+}
+
 // resetForProfileChangeLockedOnEntry resets the backend for a profile change.
 //
 // b.mu must held on entry. It is released on exit.