diff --git a/control/controlclient/map.go b/control/controlclient/map.go
index e03e57d7a..31854515f 100644
--- a/control/controlclient/map.go
+++ b/control/controlclient/map.go
@@ -8,6 +8,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"maps"
 	"net"
 	"reflect"
 	"slices"
@@ -668,14 +669,14 @@ func peerChangeDiff(was tailcfg.NodeView, n *tailcfg.Node) (_ *tailcfg.PeerChang
 				if n.CapMap == nil {
 					pc().CapMap = make(tailcfg.NodeCapMap)
 				} else {
-					pc().CapMap = n.CapMap
+					pc().CapMap = maps.Clone(n.CapMap)
 				}
 				break
 			}
 			was.CapMap().Range(func(k tailcfg.NodeCapability, v views.Slice[tailcfg.RawMessage]) bool {
 				nv, ok := n.CapMap[k]
 				if !ok || !views.SliceEqual(v, views.SliceOf(nv)) {
-					pc().CapMap = n.CapMap
+					pc().CapMap = maps.Clone(n.CapMap)
 					return false
 				}
 				return true
diff --git a/control/controlclient/map_test.go b/control/controlclient/map_test.go
index 817e730ca..c3d05b44a 100644
--- a/control/controlclient/map_test.go
+++ b/control/controlclient/map_test.go
@@ -865,6 +865,11 @@ func TestPeerChangeDiff(t *testing.T) {
 			a:    &tailcfg.Node{ID: 1, CapMap: tailcfg.NodeCapMap{tailcfg.CapabilityAdmin: nil}},
 			b:    &tailcfg.Node{ID: 1, CapMap: tailcfg.NodeCapMap{}},
 			want: &tailcfg.PeerChange{NodeID: 1, CapMap: tailcfg.NodeCapMap{}},
+		}, {
+			name: "patch-capmap-remove-as-nil",
+			a:    &tailcfg.Node{ID: 1, CapMap: tailcfg.NodeCapMap{tailcfg.CapabilityAdmin: nil}},
+			b:    &tailcfg.Node{ID: 1},
+			want: &tailcfg.PeerChange{NodeID: 1, CapMap: tailcfg.NodeCapMap{}},
 		}, {
 			name: "patch-capmap-add-key-to-empty-map",
 			a:    &tailcfg.Node{ID: 1},