diff --git a/src/node-server/server-address-discovery.test.ts b/src/node-server/server-address-discovery.test.ts
index 1f1590e38ef..96e3bcbf66b 100644
--- a/src/node-server/server-address-discovery.test.ts
+++ b/src/node-server/server-address-discovery.test.ts
@@ -23,4 +23,14 @@ describe('discoverServerPairingAddress', () => {
       source: 'loopback'
     })
   })
+
+  it.each(['999.999.999.999', '256.0.0.1', '01.2.3.4'])(
+    'stays on loopback for invalid Tailscale IPv4 output %s',
+    async (address) => {
+      await expect(discoverServerPairingAddress(undefined, async () => address)).resolves.toEqual({
+        address: '127.0.0.1',
+        source: 'loopback'
+      })
+    }
+  )
 })
diff --git a/src/node-server/server-address-discovery.ts b/src/node-server/server-address-discovery.ts
index 0171ba5a6d9..598378406bb 100644
--- a/src/node-server/server-address-discovery.ts
+++ b/src/node-server/server-address-discovery.ts
@@ -1,4 +1,5 @@
 import { execFile } from 'node:child_process'
+import { isIPv4 } from 'node:net'
 
 const TAILSCALE_ADDRESS_TIMEOUT_MS = 1_500
 
@@ -10,7 +11,7 @@ export async function discoverServerPairingAddress(
     return { address: explicitAddress, source: 'explicit' }
   }
   const tailscaleAddress = await readTailscaleAddress()
-  return tailscaleAddress
+  return tailscaleAddress && isIPv4(tailscaleAddress)
     ? { address: tailscaleAddress, source: 'tailscale' }
     : { address: '127.0.0.1', source: 'loopback' }
 }
@@ -27,7 +28,7 @@ function readTailscaleIpv4(): Promise<string | null> {
           return
         }
         const address = stdout.trim().split(/\s+/)[0]
-        resolve(/^\d{1,3}(?:\.\d{1,3}){3}$/.test(address ?? '') ? address : null)
+        resolve(address ?? null)
       }
     )
   })