diff --git a/cmd/tailscaled/tailscaled.go b/cmd/tailscaled/tailscaled.go
index 8cd6695c3..cbdc3d378 100644
--- a/cmd/tailscaled/tailscaled.go
+++ b/cmd/tailscaled/tailscaled.go
@@ -29,6 +29,7 @@ import (
 	"time"
 
 	"github.com/go-multierror/multierror"
+	"github.com/tailscale/wireguard-go/tun"
 	"tailscale.com/ipn/ipnserver"
 	"tailscale.com/logpolicy"
 	"tailscale.com/net/socks5"
@@ -332,18 +333,19 @@ func tryEngine(logf logger.Logf, linkMon *monitor.Mon, name string) (e wgengine.
 		LinkMonitor: linkMon,
 	}
 	isUserspace = name == "userspace-networking"
+	var dev tun.Device
 	if isUserspace {
-		conf.TUN = tstun.NewFake()
+		dev = tstun.NewFake()
 		conf.Router = router.NewFake(logf)
 	} else {
-		dev, err := tstun.New(logf, name)
+		dev, err = tstun.New(logf, name)
 		if err != nil {
 			tstun.Diagnose(logf, name)
 			return nil, false, err
 		}
 		conf.TUN = dev
 	}
-	e, err = wgengine.NewUserspaceEngine(logf, conf)
+	e, err = wgengine.NewUserspaceEngine(logf, dev, conf)
 	if err != nil {
 		return nil, isUserspace, err
 	}
diff --git a/cmd/tailscaled/tailscaled_windows.go b/cmd/tailscaled/tailscaled_windows.go
index fbd760950..276594dd5 100644
--- a/cmd/tailscaled/tailscaled_windows.go
+++ b/cmd/tailscaled/tailscaled_windows.go
@@ -164,8 +164,7 @@ func startIPNServer(ctx context.Context, logid string) error {
 		if err != nil {
 			return nil, err
 		}
-		eng, err := wgengine.NewUserspaceEngine(logf, wgengine.Config{
-			TUN:        dev,
+		eng, err := wgengine.NewUserspaceEngine(logf, dev, wgengine.Config{
 			ListenPort: 41641,
 		})
 		if err != nil {
diff --git a/wgengine/userspace.go b/wgengine/userspace.go
index 01ae3cc8b..199604614 100644
--- a/wgengine/userspace.go
+++ b/wgengine/userspace.go
@@ -155,8 +155,7 @@ type Config struct {
 
 func NewFakeUserspaceEngine(logf logger.Logf, listenPort uint16) (Engine, error) {
 	logf("Starting userspace wireguard engine (with fake TUN device)")
-	return NewUserspaceEngine(logf, Config{
-		TUN:        tstun.NewFake(),
+	return NewUserspaceEngine(logf, tstun.NewFake(), Config{
 		Router:     router.NewFake(logf),
 		ListenPort: listenPort,
 		Fake:       true,
@@ -165,18 +164,14 @@ func NewFakeUserspaceEngine(logf logger.Logf, listenPort uint16) (Engine, error)
 
 // NewUserspaceEngine creates the named tun device and returns a
 // Tailscale Engine running on it.
-func NewUserspaceEngine(logf logger.Logf, conf Config) (_ Engine, reterr error) {
-	if conf.TUN == nil {
-		return nil, errors.New("TUN is required")
-	}
-
+func NewUserspaceEngine(logf logger.Logf, dev tun.Device, conf Config) (_ Engine, reterr error) {
 	var closePool closeOnErrorPool
 	defer closePool.closeAllIfError(&reterr)
 
 	// TODO: default to a no-op router, require caller to pass in
 	// effectful ones.
 	if conf.Router == nil {
-		r, err := router.New(logf, conf.TUN)
+		r, err := router.New(logf, dev)
 		if err != nil {
 			return nil, err
 		}
@@ -184,7 +179,7 @@ func NewUserspaceEngine(logf logger.Logf, conf Config) (_ Engine, reterr error)
 		closePool.add(r)
 	}
 
-	tsTUNDev := tstun.Wrap(logf, conf.TUN)
+	tsTUNDev := tstun.Wrap(logf, dev)
 	closePool.add(tsTUNDev)
 
 	e := &userspaceEngine{