diff --git a/hscontrol/derp/derp.go b/hscontrol/derp/derp.go
index 479bfe5c..6c8244f5 100644
--- a/hscontrol/derp/derp.go
+++ b/hscontrol/derp/derp.go
@@ -140,10 +140,13 @@ var crc64Table = crc64.MakeTable(crc64.ISO)
 var (
 	derpRandomOnce sync.Once
 	derpRandomInst *rand.Rand
-	derpRandomMu   sync.RWMutex
+	derpRandomMu   sync.Mutex
 )
 
 func derpRandom() *rand.Rand {
+	derpRandomMu.Lock()
+	defer derpRandomMu.Unlock()
+
 	derpRandomOnce.Do(func() {
 		seed := cmp.Or(viper.GetString("dns.base_domain"), time.Now().String())
 		rnd := rand.New(rand.NewSource(0))
diff --git a/hscontrol/derp/derp_test.go b/hscontrol/derp/derp_test.go
index 2e8ace91..c8a5e74c 100644
--- a/hscontrol/derp/derp_test.go
+++ b/hscontrol/derp/derp_test.go
@@ -240,7 +240,6 @@ func TestShuffleDERPMapEdgeCases(t *testing.T) {
 	}
 }
 
-
 func TestShuffleDERPMapWithoutBaseDomain(t *testing.T) {
 	viper.Reset()
 	resetDerpRandomForTesting()