diff --git a/net/dns/direct.go b/net/dns/direct.go
index 4adbdb51c..69753d91c 100644
--- a/net/dns/direct.go
+++ b/net/dns/direct.go
@@ -403,6 +403,8 @@ func (m *directManager) GetBaseConfig() (OSConfig, error) {
 }
 
 func (m *directManager) Close() error {
+	m.ctxClose()
+
 	// We used to keep a file for the tailscale config and symlinked
 	// to it, but then we stopped because /etc/resolv.conf being a
 	// symlink to surprising places breaks snaps and other sandboxing
diff --git a/net/dns/direct_test.go b/net/dns/direct_test.go
index cb5aff51e..575d37f0e 100644
--- a/net/dns/direct_test.go
+++ b/net/dns/direct_test.go
@@ -4,6 +4,7 @@
 package dns
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"io/fs"
@@ -78,7 +79,10 @@ func testDirect(t *testing.T, fs wholeFileFS) {
 		}
 	}
 
-	m := directManager{logf: t.Logf, fs: fs}
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	m := directManager{logf: t.Logf, fs: fs, ctx: ctx, ctxClose: cancel}
 	if err := m.SetDNS(OSConfig{
 		Nameservers:   []netip.Addr{netip.MustParseAddr("8.8.8.8"), netip.MustParseAddr("8.8.4.4")},
 		SearchDomains: []dnsname.FQDN{"ts.net.", "ts-dns.test."},