diff --git a/feature/conn25/api.go b/feature/conn25/api.go
index e10aec5d2..34a6038ac 100644
--- a/feature/conn25/api.go
+++ b/feature/conn25/api.go
@@ -22,7 +22,7 @@ import (
 	"tailscale.com/util/testenv"
 )
 
-// serveLocalAPIStateGet serves the localapi endpoint /conn25-state.
+// serveLocalAPIStateGet serves the localapi endpoint /conn25/state.
 // See also [*Conn25.GetActiveState].
 func serveLocalAPIStateGet(h *localapi.Handler, w http.ResponseWriter, r *http.Request) {
 	// TODO(tailscale/corp#39033): Remove for alpha release.
@@ -31,7 +31,7 @@ func serveLocalAPIStateGet(h *localapi.Handler, w http.ResponseWriter, r *http.R
 		return
 	}
 	if !h.PermitRead {
-		http.Error(w, "conn25-state access denied", http.StatusForbidden)
+		http.Error(w, "conn25/state access denied", http.StatusForbidden)
 		return
 	}
 	if r.Method != httpm.GET {
diff --git a/feature/conn25/conn25.go b/feature/conn25/conn25.go
index cb5925e32..8437a76cc 100644
--- a/feature/conn25/conn25.go
+++ b/feature/conn25/conn25.go
@@ -85,7 +85,7 @@ func init() {
 	})
 	ipnlocal.RegisterPeerAPIHandler("/v0/connector/transit-ip", handleConnectorTransitIP)
 	ipnlocal.HookReplyToDNSQueries.Add(handleHookReplyToDNSQueries)
-	localapi.Register("conn25-state", serveLocalAPIStateGet)
+	localapi.Register("conn25/state", serveLocalAPIStateGet)
 }
 
 func handleConnectorTransitIP(h ipnlocal.PeerAPIHandler, w http.ResponseWriter, r *http.Request) {