diff --git a/ipn/ipnstate/ipnstate.go b/ipn/ipnstate/ipnstate.go
index 52aa3f97a..c2a1f1725 100644
--- a/ipn/ipnstate/ipnstate.go
+++ b/ipn/ipnstate/ipnstate.go
@@ -20,6 +20,7 @@ import (
 
 	"inet.af/netaddr"
 	"tailscale.com/tailcfg"
+	"tailscale.com/tstime"
 	"tailscale.com/types/key"
 	"tailscale.com/util/dnsname"
 )
@@ -90,7 +91,7 @@ type PeerStatus struct {
 	RxBytes       int64
 	TxBytes       int64
 	Created       time.Time // time registered with tailcontrol
-	LastWrite     time.Time // time last packet sent
+	LastWrite     int64     // time last packet sent
 	LastSeen      time.Time // last seen to tailcontrol
 	LastHandshake time.Time // with local wireguard
 	KeepAlive     bool
@@ -256,7 +257,7 @@ func (sb *StatusBuilder) AddPeer(peer key.Public, st *PeerStatus) {
 	if v := st.LastSeen; !v.IsZero() {
 		e.LastSeen = v
 	}
-	if v := st.LastWrite; !v.IsZero() {
+	if v := st.LastWrite; v != 0 {
 		e.LastWrite = v
 	}
 	if st.InNetworkMap {
@@ -320,7 +321,7 @@ table tbody tr:nth-child(even) td { background-color: #f5f5f5; }
 	f("<tr><th>Peer</th><th>OS</th><th>Node</th><th>Owner</th><th>Rx</th><th>Tx</th><th>Activity</th><th>Connection</th></tr>\n")
 	f("</thead>\n<tbody>\n")
 
-	now := time.Now()
+	now := tstime.MonotonicCoarse()
 
 	var peers []*PeerStatus
 	for _, peer := range st.Peers() {
@@ -334,10 +335,10 @@ table tbody tr:nth-child(even) td { background-color: #f5f5f5; }
 
 	for _, ps := range peers {
 		var actAgo string
-		if !ps.LastWrite.IsZero() {
-			ago := now.Sub(ps.LastWrite)
-			actAgo = ago.Round(time.Second).String() + " ago"
-			if ago < 5*time.Minute {
+		if ps.LastWrite != 0 {
+			ago := now - ps.LastWrite
+			actAgo = fmt.Sprintf("%ds ago", ago)
+			if ago < 5*60 /*time.Minute */ {
 				actAgo = "<b>" + actAgo + "</b>"
 			}
 		}
@@ -378,7 +379,7 @@ table tbody tr:nth-child(even) td { background-color: #f5f5f5; }
 		f("<td>")
 
 		// TODO: let server report this active bool instead
-		active := !ps.LastWrite.IsZero() && time.Since(ps.LastWrite) < 2*time.Minute
+		active := ps.LastWrite != 0 && tstime.MonotonicCoarse()-ps.LastWrite < 120 /*2*time.Minute*/
 		if active {
 			if ps.Relay != "" && ps.CurAddr == "" {
 				f("relay <b>%s</b>", html.EscapeString(ps.Relay))
diff --git a/wgengine/magicsock/legacy.go b/wgengine/magicsock/legacy.go
index 420c717ef..589fe2b2d 100644
--- a/wgengine/magicsock/legacy.go
+++ b/wgengine/magicsock/legacy.go
@@ -353,7 +353,7 @@ type addrSet struct {
 
 	mu sync.Mutex // guards following fields
 
-	lastSend time.Time
+	lastSend int64
 
 	// roamAddr is non-nil if/when we receive a correctly signed
 	// WireGuard packet from an unexpected address. If so, we
diff --git a/wgengine/magicsock/magicsock.go b/wgengine/magicsock/magicsock.go
index 3625fc74a..a21f4f950 100644
--- a/wgengine/magicsock/magicsock.go
+++ b/wgengine/magicsock/magicsock.go
@@ -3145,7 +3145,7 @@ type discoEndpoint struct {
 	mu sync.Mutex // Lock ordering: Conn.mu, then discoEndpoint.mu
 
 	heartBeatTimer *time.Timer    // nil when idle
-	lastSend       time.Time      // last time there was outgoing packets sent to this peer (from wireguard-go)
+	lastSend       int64          // last time there was outgoing packets sent to this peer (from wireguard-go)
 	lastFullPing   int64          // last time we pinged all endpoints
 	derpAddr       netaddr.IPPort // fallback/bootstrap path, if non-zero (non-zero for well-behaved clients)
 
@@ -3169,7 +3169,7 @@ const (
 	// try to keep an established discoEndpoint peering alive.
 	// It's also the idle time at which we stop doing STUN queries to
 	// keep NAT mappings alive.
-	sessionActiveTimeout = 2 * time.Minute
+	sessionActiveTimeout = 120 // seconds 2 * time.Minute
 
 	// upgradeInterval is how often we try to upgrade to a better path
 	// even if we have some non-DERP route that works.
@@ -3339,12 +3339,12 @@ func (de *discoEndpoint) heartbeat() {
 
 	de.heartBeatTimer = nil
 
-	if de.lastSend.IsZero() {
+	if de.lastSend == 0 {
 		// Shouldn't happen.
 		return
 	}
 
-	if time.Since(de.lastSend) > sessionActiveTimeout {
+	if tstime.MonotonicCoarse()-de.lastSend > sessionActiveTimeout {
 		// Session's idle. Stop heartbeating.
 		de.c.logf("[v1] magicsock: disco: ending heartbeats for idle session to %v (%v)", de.publicKey.ShortString(), de.discoShort)
 		return
@@ -3385,7 +3385,7 @@ func (de *discoEndpoint) wantFullPingLocked(now int64) bool {
 }
 
 func (de *discoEndpoint) noteActiveLocked() {
-	de.lastSend = time.Now()
+	de.lastSend = tstime.MonotonicCoarse()
 	if de.heartBeatTimer == nil {
 		de.heartBeatTimer = time.AfterFunc(heartbeatInterval, de.heartbeat)
 	}
@@ -3831,7 +3831,7 @@ func (de *discoEndpoint) populatePeerStatus(ps *ipnstate.PeerStatus) {
 	de.mu.Lock()
 	defer de.mu.Unlock()
 
-	if de.lastSend.IsZero() {
+	if de.lastSend == 0 {
 		return
 	}