diff --git a/client/embed/embed.go b/client/embed/embed.go
index 32e567be4..8e1ecca77 100644
--- a/client/embed/embed.go
+++ b/client/embed/embed.go
@@ -300,13 +300,23 @@ func (c *Client) Start(startCtx context.Context) error {
 	// nolint:staticcheck
 	ctx = context.WithValue(ctx, system.DeviceNameCtxKey, c.deviceName)
 
-	authClient, err := auth.NewAuth(ctx, c.config.PrivateKey, c.config.ManagementURL, c.config)
+	// Authentication runs on startCtx, not the client's own context. Both
+	// calls retry, and a management endpoint that accepts connections but
+	// never completes a stream leaves them retrying with no deadline of their
+	// own, so a caller's start timeout has to reach them. Neither outlives
+	// startup: authClient is closed below.
+	// Carry the device name onto the start context: registration happens during
+	// login and reads it from there, so authenticating on a context without it
+	// would register every client under the host's hostname instead.
+	authCtx := context.WithValue(startCtx, system.DeviceNameCtxKey, c.deviceName) //nolint:staticcheck
+
+	authClient, err := auth.NewAuth(authCtx, c.config.PrivateKey, c.config.ManagementURL, c.config)
 	if err != nil {
 		return fmt.Errorf("create auth client: %w", err)
 	}
 	defer authClient.Close()
 
-	if err, _ := authClient.Login(ctx, c.setupKey, c.jwtToken); err != nil {
+	if err, _ := authClient.Login(authCtx, c.setupKey, c.jwtToken); err != nil {
 		return fmt.Errorf("login: %w", err)
 	}
 	client := internal.NewConnectClient(ctx, c.config, c.recorder)
diff --git a/go.mod b/go.mod
index a2fe1e55b..2446fb9a5 100644
--- a/go.mod
+++ b/go.mod
@@ -331,7 +331,7 @@ replace github.com/kardianos/service => github.com/netbirdio/service v0.0.0-2024
 
 replace github.com/getlantern/systray => github.com/netbirdio/systray v0.0.0-20231030152038-ef1ed2a27949
 
-replace golang.zx2c4.com/wireguard => github.com/netbirdio/wireguard-go v0.0.0-20260628102922-2834bebf6c1a
+replace golang.zx2c4.com/wireguard => github.com/netbirdio/wireguard-go v0.0.0-20260904184957-e5c60e1195b3
 
 replace github.com/cloudflare/circl => codeberg.org/cunicu/circl v0.0.0-20230801113412-fec58fc7b5f6
 
diff --git a/go.sum b/go.sum
index 3e0b4f5dc..e3a3adb37 100644
--- a/go.sum
+++ b/go.sum
@@ -492,8 +492,8 @@ github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45/go.mod h1:5/sjFmLb8O96B5737VCqhHyGRzNFIaN/Bu7ZodXc3qQ=
 github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260825085513-5f07a01f7a78 h1:B/jRv24jnFeoA+VccxoCx6K94PUgsqR9wnshpeu9M+8=
 github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260825085513-5f07a01f7a78/go.mod h1:/6QR46/nhGCSADHbS++XtDb9dkTnenTHlGskTPRo9S0=
-github.com/netbirdio/wireguard-go v0.0.0-20260628102922-2834bebf6c1a h1:3CWK+yTvRKOcC0Q8VCTGy4l60TEb27CQVS7LkMxwjmw=
-github.com/netbirdio/wireguard-go v0.0.0-20260628102922-2834bebf6c1a/go.mod h1:rpwXGsirqLqN2L0JDJQlwOboGHmptD5ZD6T2VmcqhTw=
+github.com/netbirdio/wireguard-go v0.0.0-20260904184957-e5c60e1195b3 h1:ES7IumZAY/yubKdBcCUCnbSYk3eyqAOeX8s1GfBuHLw=
+github.com/netbirdio/wireguard-go v0.0.0-20260904184957-e5c60e1195b3/go.mod h1:rpwXGsirqLqN2L0JDJQlwOboGHmptD5ZD6T2VmcqhTw=
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
 github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
 github.com/nxadm/tail v1.4.11 h1:8feyoE3OzPrcshW5/MJ4sGESc5cqmGkGCWlco4l0bqY=