diff --git a/hscontrol/db/node_test.go b/hscontrol/db/node_test.go
index 0392e3b0..112079c2 100644
--- a/hscontrol/db/node_test.go
+++ b/hscontrol/db/node_test.go
@@ -87,7 +87,7 @@ func (s *Suite) TestGetNodeByAnyNodeKey(c *check.C) {
 	user, err := db.CreateUser("test")
 	c.Assert(err, check.IsNil)
 
-	pak, err := db.CreatePreAuthKey(user.Name, false, true, false, nil, nil)
+	pak, err := db.CreatePreAuthKey(user.Name, false, false, false, nil, nil)
 	c.Assert(err, check.IsNil)
 
 	_, err = db.GetNodeByID(0)
@@ -143,7 +143,7 @@ func (s *Suite) TestListPeers(c *check.C) {
 	user, err := db.CreateUser("test")
 	c.Assert(err, check.IsNil)
 
-	pak, err := db.CreatePreAuthKey(user.Name, false, true, false, nil, nil)
+	pak, err := db.CreatePreAuthKey(user.Name, false, false, false, nil, nil)
 	c.Assert(err, check.IsNil)
 
 	_, err = db.GetNodeByID(0)
@@ -237,7 +237,7 @@ func (s *Suite) TestGetACLFilteredPeers(c *check.C) {
 	for _, name := range []string{"test", "admin"} {
 		user, err := db.CreateUser(name)
 		c.Assert(err, check.IsNil)
-		pak, err := db.CreatePreAuthKey(user.Name, false, true, false, nil, nil)
+		pak, err := db.CreatePreAuthKey(user.Name, false, false, false, nil, nil)
 		c.Assert(err, check.IsNil)
 		stor = append(stor, base{user, pak})
 	}
@@ -330,7 +330,7 @@ func (s *Suite) TestApprovedNode(c *check.C) {
 	user, err := db.CreateUser("test")
 	c.Assert(err, check.IsNil)
 
-	pak, err := db.CreatePreAuthKey(user.Name, false, false, true, nil, nil)
+	pak, err := db.CreatePreAuthKey(user.Name, false, false, false, nil, nil)
 	c.Assert(err, check.IsNil)
 
 	_, err = db.getNode("test", "testnode")
@@ -370,7 +370,7 @@ func (s *Suite) TestExpireNode(c *check.C) {
 	user, err := db.CreateUser("test")
 	c.Assert(err, check.IsNil)
 
-	pak, err := db.CreatePreAuthKey(user.Name, false, true, false, nil, nil)
+	pak, err := db.CreatePreAuthKey(user.Name, false, false, false, nil, nil)
 	c.Assert(err, check.IsNil)
 
 	_, err = db.getNode("test", "testnode")
@@ -411,7 +411,7 @@ func (s *Suite) TestSetTags(c *check.C) {
 	user, err := db.CreateUser("test")
 	c.Assert(err, check.IsNil)
 
-	pak, err := db.CreatePreAuthKey(user.Name, false, true, false, nil, nil)
+	pak, err := db.CreatePreAuthKey(user.Name, false, false, false, nil, nil)
 	c.Assert(err, check.IsNil)
 
 	_, err = db.getNode("test", "testnode")
@@ -656,7 +656,7 @@ func TestAutoApproveRoutes(t *testing.T) {
 			user, err := adb.CreateUser("test")
 			assert.NoError(t, err)
 
-			pak, err := adb.CreatePreAuthKey(user.Name, false, true, false, nil, nil)
+			pak, err := adb.CreatePreAuthKey(user.Name, false, false, false, nil, nil)
 			assert.NoError(t, err)
 
 			nodeKey := key.NewNode()
@@ -788,10 +788,10 @@ func TestListEphemeralNodes(t *testing.T) {
 	user, err := db.CreateUser("test")
 	assert.NoError(t, err)
 
-	pak, err := db.CreatePreAuthKey(user.Name, false, true, false, nil, nil)
+	pak, err := db.CreatePreAuthKey(user.Name, false, false, false, nil, nil)
 	assert.NoError(t, err)
 
-	pakEph, err := db.CreatePreAuthKey(user.Name, false, true, true, nil, nil)
+	pakEph, err := db.CreatePreAuthKey(user.Name, false, false, true, nil, nil)
 	assert.NoError(t, err)
 
 	node := types.Node{
diff --git a/hscontrol/db/preauth_keys_test.go b/hscontrol/db/preauth_keys_test.go
index 7894eb33..e6551867 100644
--- a/hscontrol/db/preauth_keys_test.go
+++ b/hscontrol/db/preauth_keys_test.go
@@ -11,14 +11,14 @@ import (
 )
 
 func (*Suite) TestCreatePreAuthKey(c *check.C) {
-	_, err := db.CreatePreAuthKey("bogus", true, true, false, nil, nil)
+	_, err := db.CreatePreAuthKey("bogus", true, false, false, nil, nil)
 
 	c.Assert(err, check.NotNil)
 
 	user, err := db.CreateUser("test")
 	c.Assert(err, check.IsNil)
 
-	key, err := db.CreatePreAuthKey(user.Name, true, true, false, nil, nil)
+	key, err := db.CreatePreAuthKey(user.Name, true, false, false, nil, nil)
 	c.Assert(err, check.IsNil)
 
 	// Did we get a valid key?
@@ -44,7 +44,7 @@ func (*Suite) TestExpiredPreAuthKey(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	now := time.Now().Add(-5 * time.Second)
-	pak, err := db.CreatePreAuthKey(user.Name, true, true, false, &now, nil)
+	pak, err := db.CreatePreAuthKey(user.Name, true, false, false, &now, nil)
 	c.Assert(err, check.IsNil)
 
 	key, err := db.ValidatePreAuthKey(pak.Key)
@@ -72,7 +72,7 @@ func (*Suite) TestValidateKeyOk(c *check.C) {
 	user, err := db.CreateUser("test3")
 	c.Assert(err, check.IsNil)
 
-	pak, err := db.CreatePreAuthKey(user.Name, true, true, false, nil, nil)
+	pak, err := db.CreatePreAuthKey(user.Name, true, false, false, nil, nil)
 	c.Assert(err, check.IsNil)
 
 	key, err := db.ValidatePreAuthKey(pak.Key)
@@ -84,7 +84,7 @@ func (*Suite) TestAlreadyUsedKey(c *check.C) {
 	user, err := db.CreateUser("test4")
 	c.Assert(err, check.IsNil)
 
-	pak, err := db.CreatePreAuthKey(user.Name, false, true, false, nil, nil)
+	pak, err := db.CreatePreAuthKey(user.Name, false, false, false, nil, nil)
 	c.Assert(err, check.IsNil)
 
 	node := types.Node{
@@ -106,7 +106,7 @@ func (*Suite) TestReusableBeingUsedKey(c *check.C) {
 	user, err := db.CreateUser("test5")
 	c.Assert(err, check.IsNil)
 
-	pak, err := db.CreatePreAuthKey(user.Name, true, true, false, nil, nil)
+	pak, err := db.CreatePreAuthKey(user.Name, true, false, false, nil, nil)
 	c.Assert(err, check.IsNil)
 
 	node := types.Node{
@@ -128,7 +128,7 @@ func (*Suite) TestNotReusableNotBeingUsedKey(c *check.C) {
 	user, err := db.CreateUser("test6")
 	c.Assert(err, check.IsNil)
 
-	pak, err := db.CreatePreAuthKey(user.Name, false, true, false, nil, nil)
+	pak, err := db.CreatePreAuthKey(user.Name, false, false, false, nil, nil)
 	c.Assert(err, check.IsNil)
 
 	key, err := db.ValidatePreAuthKey(pak.Key)
@@ -140,7 +140,7 @@ func (*Suite) TestExpirePreauthKey(c *check.C) {
 	user, err := db.CreateUser("test3")
 	c.Assert(err, check.IsNil)
 
-	pak, err := db.CreatePreAuthKey(user.Name, true, true, false, nil, nil)
+	pak, err := db.CreatePreAuthKey(user.Name, true, false, false, nil, nil)
 	c.Assert(err, check.IsNil)
 	c.Assert(pak.Expiration, check.IsNil)
 
@@ -157,7 +157,7 @@ func (*Suite) TestNotReusableMarkedAsUsed(c *check.C) {
 	user, err := db.CreateUser("test6")
 	c.Assert(err, check.IsNil)
 
-	pak, err := db.CreatePreAuthKey(user.Name, false, true, false, nil, nil)
+	pak, err := db.CreatePreAuthKey(user.Name, false, false, false, nil, nil)
 	c.Assert(err, check.IsNil)
 	pak.Used = true
 	db.DB.Save(&pak)
@@ -170,12 +170,12 @@ func (*Suite) TestPreAuthKeyACLTags(c *check.C) {
 	user, err := db.CreateUser("test8")
 	c.Assert(err, check.IsNil)
 
-	_, err = db.CreatePreAuthKey(user.Name, false, true, false, nil, []string{"badtag"})
+	_, err = db.CreatePreAuthKey(user.Name, false, false, false, nil, []string{"badtag"})
 	c.Assert(err, check.NotNil) // Confirm that malformed tags are rejected
 
 	tags := []string{"tag:test1", "tag:test2"}
 	tagsWithDuplicate := []string{"tag:test1", "tag:test2", "tag:test2"}
-	_, err = db.CreatePreAuthKey(user.Name, false, true, false, nil, tagsWithDuplicate)
+	_, err = db.CreatePreAuthKey(user.Name, false, false, false, nil, tagsWithDuplicate)
 	c.Assert(err, check.IsNil)
 
 	listedPaks, err := db.ListPreAuthKeys("test8")
diff --git a/hscontrol/db/routes_test.go b/hscontrol/db/routes_test.go
index 6474e5f7..ccb9799c 100644
--- a/hscontrol/db/routes_test.go
+++ b/hscontrol/db/routes_test.go
@@ -35,7 +35,7 @@ func (s *Suite) TestGetRoutes(c *check.C) {
 	user, err := db.CreateUser("test")
 	c.Assert(err, check.IsNil)
 
-	pak, err := db.CreatePreAuthKey(user.Name, false, true, false, nil, nil)
+	pak, err := db.CreatePreAuthKey(user.Name, false, false, false, nil, nil)
 	c.Assert(err, check.IsNil)
 
 	_, err = db.getNode("test", "test_get_route_node")
@@ -79,7 +79,7 @@ func (s *Suite) TestGetEnableRoutes(c *check.C) {
 	user, err := db.CreateUser("test")
 	c.Assert(err, check.IsNil)
 
-	pak, err := db.CreatePreAuthKey(user.Name, false, true, false, nil, nil)
+	pak, err := db.CreatePreAuthKey(user.Name, false, false, false, nil, nil)
 	c.Assert(err, check.IsNil)
 
 	_, err = db.getNode("test", "test_enable_route_node")
@@ -153,7 +153,7 @@ func (s *Suite) TestIsUniquePrefix(c *check.C) {
 	user, err := db.CreateUser("test")
 	c.Assert(err, check.IsNil)
 
-	pak, err := db.CreatePreAuthKey(user.Name, false, true, false, nil, nil)
+	pak, err := db.CreatePreAuthKey(user.Name, false, false, false, nil, nil)
 	c.Assert(err, check.IsNil)
 
 	_, err = db.getNode("test", "test_enable_route_node")
@@ -234,7 +234,7 @@ func (s *Suite) TestDeleteRoutes(c *check.C) {
 	user, err := db.CreateUser("test")
 	c.Assert(err, check.IsNil)
 
-	pak, err := db.CreatePreAuthKey(user.Name, false, true, false, nil, nil)
+	pak, err := db.CreatePreAuthKey(user.Name, false, false, false, nil, nil)
 	c.Assert(err, check.IsNil)
 
 	_, err = db.getNode("test", "test_enable_route_node")
diff --git a/hscontrol/db/users_test.go b/hscontrol/db/users_test.go
index f276c0d1..18edf89d 100644
--- a/hscontrol/db/users_test.go
+++ b/hscontrol/db/users_test.go
@@ -31,7 +31,7 @@ func (s *Suite) TestDestroyUserErrors(c *check.C) {
 	user, err := db.CreateUser("test")
 	c.Assert(err, check.IsNil)
 
-	pak, err := db.CreatePreAuthKey(user.Name, false, true, false, nil, nil)
+	pak, err := db.CreatePreAuthKey(user.Name, false, false, false, nil, nil)
 	c.Assert(err, check.IsNil)
 
 	err = db.DestroyUser("test")
@@ -44,7 +44,7 @@ func (s *Suite) TestDestroyUserErrors(c *check.C) {
 	user, err = db.CreateUser("test")
 	c.Assert(err, check.IsNil)
 
-	pak, err = db.CreatePreAuthKey(user.Name, false, true, false, nil, nil)
+	pak, err = db.CreatePreAuthKey(user.Name, false, false, false, nil, nil)
 	c.Assert(err, check.IsNil)
 
 	node := types.Node{
@@ -97,7 +97,7 @@ func (s *Suite) TestSetMachineUser(c *check.C) {
 	newUser, err := db.CreateUser("new")
 	c.Assert(err, check.IsNil)
 
-	pak, err := db.CreatePreAuthKey(oldUser.Name, false, true, false, nil, nil)
+	pak, err := db.CreatePreAuthKey(oldUser.Name, false, false, false, nil, nil)
 	c.Assert(err, check.IsNil)
 
 	node := types.Node{
diff --git a/integration/embedded_derp_test.go b/integration/embedded_derp_test.go
index a52d44f8..40dd648f 100644
--- a/integration/embedded_derp_test.go
+++ b/integration/embedded_derp_test.go
@@ -251,7 +251,7 @@ func (s *EmbeddedDERPServerScenario) CreateHeadscaleEnv(
 			}
 		}
 
-		key, err := s.CreatePreAuthKey(userName, true, true, false)
+		key, err := s.CreatePreAuthKey(userName, true, false, false)
 		if err != nil {
 			return err
 		}
diff --git a/integration/general_test.go b/integration/general_test.go
index 677a7ec3..31963024 100644
--- a/integration/general_test.go
+++ b/integration/general_test.go
@@ -175,7 +175,7 @@ func TestAuthKeyLogoutAndRelogin(t *testing.T) {
 			}
 
 			for userName := range spec {
-				key, err := scenario.CreatePreAuthKey(userName, true, true, false)
+				key, err := scenario.CreatePreAuthKey(userName, true, false, false)
 				if err != nil {
 					t.Fatalf("failed to create pre-auth key for user %s: %s", userName, err)
 				}
@@ -274,7 +274,7 @@ func testEphemeralWithOptions(t *testing.T, opts ...hsic.Option) {
 			t.Fatalf("failed to create tailscale nodes in user %s: %s", userName, err)
 		}
 
-		key, err := scenario.CreatePreAuthKey(userName, true, true, true)
+		key, err := scenario.CreatePreAuthKey(userName, true, false, true)
 		if err != nil {
 			t.Fatalf("failed to create pre-auth key for user %s: %s", userName, err)
 		}
@@ -364,7 +364,7 @@ func TestEphemeral2006DeletedTooQuickly(t *testing.T) {
 			t.Fatalf("failed to create tailscale nodes in user %s: %s", userName, err)
 		}
 
-		key, err := scenario.CreatePreAuthKey(userName, true, true, true)
+		key, err := scenario.CreatePreAuthKey(userName, true, false, true)
 		if err != nil {
 			t.Fatalf("failed to create pre-auth key for user %s: %s", userName, err)
 		}
diff --git a/integration/scenario.go b/integration/scenario.go
index ff05aa05..65b36e50 100644
--- a/integration/scenario.go
+++ b/integration/scenario.go
@@ -504,7 +504,7 @@ func (s *Scenario) CreateHeadscaleEnv(
 			return err
 		}
 
-		key, err := s.CreatePreAuthKey(userName, true, true, false)
+		key, err := s.CreatePreAuthKey(userName, true, false, false)
 		if err != nil {
 			return err
 		}
diff --git a/integration/scenario_test.go b/integration/scenario_test.go
index caf11c90..5193ad63 100644
--- a/integration/scenario_test.go
+++ b/integration/scenario_test.go
@@ -61,7 +61,7 @@ func TestHeadscale(t *testing.T) {
 	})
 
 	t.Run("create-auth-key", func(t *testing.T) {
-		_, err := scenario.CreatePreAuthKey(user, true, true, false)
+		_, err := scenario.CreatePreAuthKey(user, true, false, false)
 		if err != nil {
 			t.Fatalf("failed to create preauthkey: %s", err)
 		}
@@ -153,7 +153,7 @@ func TestTailscaleNodesJoiningHeadcale(t *testing.T) {
 	})
 
 	t.Run("join-headscale", func(t *testing.T) {
-		key, err := scenario.CreatePreAuthKey(user, true, true, false)
+		key, err := scenario.CreatePreAuthKey(user, true, false, false)
 		if err != nil {
 			t.Fatalf("failed to create preauthkey: %s", err)
 		}