diff --git a/client/internal/engine.go b/client/internal/engine.go
index 5f10166a2..6efbc7b73 100644
--- a/client/internal/engine.go
+++ b/client/internal/engine.go
@@ -2580,7 +2580,11 @@ func (e *Engine) toExcludedLazyPeers(rules []firewallManager.ForwardRule, peers
 // peerRoutesAddr verifies if the peer is a router for a given address.
 func peerRoutesAddr(p *mgmProto.RemotePeerConfig, addr netip.Addr) bool {
 	for _, allowedIP := range p.GetAllowedIps() {
-		if allowedIP == addr.String() {
+		prefix, err := netip.ParsePrefix(allowedIP)
+		if err != nil {
+			continue
+		}
+		if prefix.Contains(addr) {
 			return true
 		}
 	}