diff --git a/derp/derp_server.go b/derp/derp_server.go
index 4cc07e151..1d6e5b96a 100644
--- a/derp/derp_server.go
+++ b/derp/derp_server.go
@@ -18,6 +18,8 @@ import (
 	"io"
 	"math/big"
 	"net"
+	"os"
+	"strconv"
 	"sync"
 	"sync/atomic"
 	"time"
@@ -28,6 +30,8 @@ import (
 	"tailscale.com/types/logger"
 )
 
+var debug, _ = strconv.ParseBool(os.Getenv("DERP_DEBUG_LOGS"))
+
 // Server is a DERP server.
 type Server struct {
 	// BytesPerSecond, if non-zero, specifies how many bytes per
@@ -226,7 +230,9 @@ func (s *Server) accept(nc net.Conn, brw *bufio.ReadWriter) error {
 
 		if dst == nil {
 			atomic.AddInt64(&s.packetsDropped, 1)
-			s.logf("derp: %s: client %x: dropping packet for unknown %x", nc.RemoteAddr(), c.key, dstKey)
+			if debug {
+				s.logf("derp: %s: client %x: dropping packet for unknown %x", nc.RemoteAddr(), c.key, dstKey)
+			}
 			continue
 		}