diff --git a/derp/derphttp/derphttp_client.go b/derp/derphttp/derphttp_client.go
index 0915227cceaaf..7899868581afe 100644
--- a/derp/derphttp/derphttp_client.go
+++ b/derp/derphttp/derphttp_client.go
@@ -247,7 +247,7 @@ func (c *Client) preferIPv6() bool {
 }
 
 // dialWebsocketFunc is non-nil (set by websocket.go's init) when compiled in.
-var dialWebsocketFunc func(ctx context.Context, urlStr string, tlsConfig *tls.Config) (net.Conn, error)
+var dialWebsocketFunc func(ctx context.Context, urlStr string, tlsConfig *tls.Config, httpHeader http.Header) (net.Conn, error)
 
 func (c *Client) useWebsockets() bool {
 	if runtime.GOOS == "js" {
@@ -326,7 +326,7 @@ func (c *Client) connect(ctx context.Context, caller string) (client *derp.Clien
 			tlsConfig = c.tlsConfig(reg.Nodes[0])
 		}
 		c.logf("%s: connecting websocket to %v", caller, urlStr)
-		conn, err := dialWebsocketFunc(ctx, urlStr, tlsConfig)
+		conn, err := dialWebsocketFunc(ctx, urlStr, tlsConfig, c.Header)
 		if err != nil {
 			c.logf("%s: websocket to %v error: %v", caller, urlStr, err)
 			return nil, 0, err
diff --git a/derp/derphttp/websocket.go b/derp/derphttp/websocket.go
index 7dc0029b23106..278b647caeb01 100644
--- a/derp/derphttp/websocket.go
+++ b/derp/derphttp/websocket.go
@@ -17,9 +17,10 @@ func init() {
 	dialWebsocketFunc = dialWebsocket
 }
 
-func dialWebsocket(ctx context.Context, urlStr string, tlsConfig *tls.Config) (net.Conn, error) {
+func dialWebsocket(ctx context.Context, urlStr string, tlsConfig *tls.Config, httpHeader http.Header) (net.Conn, error) {
 	c, res, err := websocket.Dial(ctx, urlStr, &websocket.DialOptions{
 		Subprotocols: []string{"derp"},
+		HTTPHeader:   httpHeader,
 		HTTPClient: &http.Client{
 			Transport: &http.Transport{
 				TLSClientConfig: tlsConfig,
diff --git a/derp/derphttp/websocket_js.go b/derp/derphttp/websocket_js.go
index 8dce5ffdf4665..5f0ff3f4a042a 100644
--- a/derp/derphttp/websocket_js.go
+++ b/derp/derphttp/websocket_js.go
@@ -10,6 +10,7 @@ import (
 	"crypto/tls"
 	"log"
 	"net"
+	"net/http"
 
 	"nhooyr.io/websocket"
 	"tailscale.com/net/wsconn"
@@ -19,7 +20,7 @@ func init() {
 	dialWebsocketFunc = dialWebsocket
 }
 
-func dialWebsocket(ctx context.Context, urlStr string, _ *tls.Config) (net.Conn, error) {
+func dialWebsocket(ctx context.Context, urlStr string, _ *tls.Config, _ http.Header) (net.Conn, error) {
 	c, res, err := websocket.Dial(ctx, urlStr, &websocket.DialOptions{
 		Subprotocols: []string{"derp"},
 	})